ci-20251231
UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
FORM10-K
(Mark One)
For the fiscal year ended December 31, 2025
OR
For the transition period from ______________ to ______________
Commission file number001-38769
The Cigna Group
(Exact name of registrant as specified in its charter)
900 Cottage Grove Road, Bloomfield, Connecticut 06002
(Address of principal executive offices) (Zip Code)
Registrant's telephone number, including area code
Securities registered pursuant to Section 12(b) of the Act:
Title of each class Trading Symbol(s) Name of each exchange on which registered
Common Stock, Par Value $0.01 CI New York Stock Exchange, Inc.
Securities registered pursuant to Section 12(g) of the Act:
NONE
Yes No
Large accelerated filer ☒ Accelerated filer ☐ Non-accelerated filer ☐
Smaller reporting company ☐ Emerging growth company ☐
The aggregate market value of the voting stock held by non-affiliates of the registrant as of June 30, 2025 was approximately $88.0 billion.
As of January 30, 2026, 263,528,277 shares of the registrant's Common Stock were outstanding.
DOCUMENTS INCORPORATED BY REFERENCE
Part III of this Form 10-K incorporates by reference information from the registrant's definitive proxy statement related to the 2026 Annual Meeting of Shareholders.
TABLE OF CONTENTS
Page
Cautionary Statement
PART I
Item 1. Business 1
Item 1A. Risk Factors 18
Item 1B. Unresolved Staff Comments 32
Item 1C. Cybersecurity 32
Item 2. Properties 33
Item 3. Legal Proceedings 34
Item 4. Mine Safety Disclosures 34
Information about Our Executive Officers 34
PART II
Item 6. [Reserved] 36
Item 7A. Quantitative and Qualitative Disclosures about Market Risk 52
Item 8. Financial Statements and Supplementary Data 53
Item 9A. Controls and Procedures 110
Item 9B. Other Information 111
Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections 111
PART III
Item 10. Directors, Executive Officers and Corporate Governance 111
Item 11. Executive Compensation 112
Item 14. Principal Accountant Fees and Services 112
PART IV
Item 15. Exhibits and Financial Statement Schedules 113
Index to Financial Statement Schedules FS-1
CAUTIONARY NOTE REGARDING FORWARD-LOOKING STATEMENTS
This Annual Report on Form 10-K contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. Forward-looking statements are based on The Cigna Group's current expectations and projections about future trends, events and uncertainties. These statements are not historical facts. Forward-looking statements may include, among others, statements concerning future financial or operating performance, including our ability to improve the health and vitality of those we serve; future growth, business strategy and strategic or operational initiatives; economic, regulatory or competitive environments, particularly with respect to the pace and extent of change in these areas and the impact of developing inflationary and interest rate pressures; financing or capital deployment plans and amounts available for future deployment; our prospects for growth in the coming years; strategic transactions and their expected benefits; and other statements regarding The Cigna Group's future beliefs, expectations, plans, intentions, liquidity, cash flows, financial condition or performance. You may identify forward-looking statements by the use of words such as "believe," "expect," "project," "plan," "intend," "anticipate," "estimate," "predict," "potential," "may," "should," "will" or other words or expressions of similar meaning, although not all forward-looking statements contain such terms.
Forward-looking statements are subject to risks and uncertainties, both known and unknown, that could cause actual results to differ materially from those expressed or implied in forward-looking statements. Such risks and uncertainties include, but are not limited to: our ability to manage health care costs and respond to price competition, inflation and other pressures that could compress our margins or result in premiums that are insufficient to cover the cost of services delivered to our customers; our ability to compete effectively, differentiate our products and services from those of our competitors and adapt to changes in an evolving and rapidly changing industry; our ability to develop and effectively implement products and services to improve the accessibility, affordability and transparency of health care; changes in drug pricing or industry pricing benchmarks; our ability to maintain relationships with one or more key pharmaceutical manufacturers or if payments made or discounts provided decline; changes in the pharmacy provider marketplace or pharmacy networks; the potential for actual claims to exceed our estimates related to expected medical claims; our ability to develop and maintain satisfactory relationships with health care payors, physicians, hospitals, other health service providers and with producers and consultants; potential liability in connection with managing medical practices and operating pharmacies, onsite clinics and other types of medical facilities; uncertainties surrounding participation in government-sponsored programs and providing services to payors who participate in government-sponsored programs; the substantial level of government regulation over our business and the potential effects of new laws or regulations or changes in existing laws or regulations; compliance with applicable privacy, security and data laws, regulations and standards; the outcome of litigation, regulatory audits and investigations; compliance costs and potential failure of our prevention, detection and control systems; our ability to invest in and properly maintain our information technology and other business systems; our ability to prevent or contain effects of a potential cyberattack or other privacy or data security incident; risks related to our use of artificial intelligence and machine learning; dependence on success of relationships with third parties; risk of significant disruption within our operations or among key suppliers or third parties; political, legal, operational, regulatory, economic and other risks that could affect our multinational operations, including currency exchange rates; risks related to strategic transactions and realization of the expected benefits of such transactions, as well as integration or separation difficulties or underperformance relative to expectations which could lead to an impairment charge; our ability to achieve our strategic and operational initiatives; unfavorable economic and market conditions, the risk of a recession or other economic downturn and resulting impact on employment metrics, stock market or changes in interest rates; risks related to a downgrade in financial strength ratings of our insurance subsidiaries; the impact of our significant indebtedness and the potential for further indebtedness in the future; credit risk related to our reinsurers; as well as more specific risks and uncertainties discussed in Part I, Item 1A – Risk Factors and in Part II, Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operations of this Form 10-K, and as described from time to time in our future reports filed with the Securities and Exchange Commission.
You should not place undue reliance on forward-looking statements, which speak only as of the date they are made, are not guarantees of future performance or results, and are subject to risks, uncertainties and assumptions that are difficult to predict or quantify. The Cigna Group undertakes no obligation to update or revise any forward-looking statement, whether as a result of new information, future events or otherwise, except as may be required by law.
PART I
Item 1. BUSINESS
OVERVIEW
The Cigna Group®, together with its subsidiaries (either individually or collectively referred to as the "Company," "we," "us" or "our"), is a global health company.
Our Focused Mission
At The Cigna Group our global workforce of approximately 67,700 colleagues strives to fulfill our mission to improve the health and vitality of more than 185 million customer relationships in more than 30 markets and jurisdictions (as of December 31, 2025). We play an important role in the health care system, and the breadth and depth of our customer relationships - as well as our approximately 1.7 million relationships with health care providers, clinics and facilities - give us opportunities to drive positive change.
We have two segments: Evernorth Health Services®and Cigna Healthcare®. The Evernorth Health Services segment, through our Pharmacy Benefit Services and Specialty and Care Services operating segments, provides independent and coordinated health solutions and capabilities to enable the health care system to work better and help people live healthier lives. Cigna Healthcare, the health benefits segment of The Cigna Group, provides comprehensive medical and coordinated solutions to customers and clients served by our U.S. Healthcare and International Health operating segments.
Together, Evernorth Health Services and Cigna Healthcare combine pharmacy and medical capabilities to create solutions that improve affordability, transparency and health outcomes. This combination helps us anticipate needs, accelerate innovation and deliver personalized experiences for customers and patients at scale.
Information about Segments
We present the financial results of our businesses in the following segments (see the "Executive Overview" section of Management's Discussion and Analysis of Financial Condition and Results of Operations("MD&A") located in Part II, Item 7 of this Form 10-K for a financial summary):
Evernorth Health Services includes our Pharmacy Benefit Services and Specialty and Care Services operating segments, which provide independent and coordinated health solutions and capabilities to enable the health care system to work better and help people live healthier lives.
Cigna Healthcare includes our U.S. Healthcare and International Health operating segments, which provide comprehensive medical and coordinated solutions to clients and customers.
Other Operations comprises the remainder of our business operations, which includes certain continuing, run-off and other non-strategic businesses.
Corporate reflects amounts not allocated to operating segments, including net interest expense (defined as interest on corporate financing less net investment income on investments not supporting segment and other operations), certain litigation matters, expense associated with our frozen pension plans, charitable contributions, operating severance, certain overhead and enterprise-wide project costs, and eliminations for products and services sold between segments.
See the "Executive Overview - Key Transactions and Business Developments" section of our Management's Discussion and Analysis of Financial Condition and Results of Operations located in Part II, Item 7 of this Form 10-K for discussion of key developments impacting the segments.
1
Commitments to Better
Through our Commitments to Better, we embarked on a new, multiyear chapter to accelerate our ongoing evolution and industry leadership. We know we play an important role in a health care system that needs changing for the better, and we are determined to lead that change for the health and vitality of those we serve. We have many roles in the health care system to deliver better outcomes to our customers, including helping to make healthcare more affordable, administering health care claims and working to reduce health care waste. The Cigna Group has established five key areas of focus, and several initial specific actions, to improve the health of its customers and increase the value it provides:
•Easier access to care: address challenges customers face by making processes simpler, easier and faster.
•Better support: provide customers with more support and resources to navigate the health care system.
•Better value: drive better value for customers and patients.
•Accountability: stand behind our commitments to our customers and patients.
•Transparency: provide information on how we are continuously improving to serve our customers better.
Other Information
The Cigna Group, through its predecessor companies, was incorporated in Delaware in 1981.
The financial information included in this Form 10-K for the fiscal year ended December 31, 2025 is presented in conformity with accounting principles generally accepted in the United States of America ("GAAP") unless otherwise indicated. Industry rankings and percentages set forth herein are for the year ended December 31, 2025, unless otherwise indicated. In addition, statements set forth in this document concerning our rank or position in an industry or particular line of business have been developed internally based on publicly available information unless otherwise noted.
You can access our website at http://www.thecignagroup.com to learn more about our company. We make annual, quarterly and current reports and proxy statements and amendments to those reports available, free of charge, through our website as soon as reasonably practicable after we electronically file these materials with, or furnish them to, the Securities and Exchange Commission ("SEC"). We also use our website as a means of disclosing material information and for complying with our disclosure obligations under the SEC's Regulation FD (Fair Disclosure). Important information, including news releases, analyst presentations and financial information regarding The Cigna Group is routinely posted on our website. Accordingly, investors should monitor the Investor Relations portion of our website, in addition to following our press releases, SEC filings, and public conference calls and webcasts. The information contained on, or that may be accessed through, our website is neither incorporated by reference into nor a part of this report. See also "Code of Ethics and Other Corporate Governance Disclosures" in Part III, Item 10 of this Form 10-K for additional information regarding the availability of our Codes of Ethics on our website.
EVERNORTH HEALTH SERVICES
Evernorth Health Servicesincludes our Pharmacy Benefit Services and Specialty and Care Services operating segments, which provide independent and coordinated health solutions and capabilities to enable the health care system to work better and help people live healthier lives.
Evernorth Health Services offers a full suite of products and services that both (a) enables our clients to combine our products and services to create a comprehensive benefit offering designed to manage prescription drugs and provide independent and coordinated health solutions and capabilities and (b) addresses the needs of a shared customer base across both operating segments of Evernorth Health Services. Our ability to deliver this broad array of health care services on either a standalone or combined basis between its two operating segments enables us to drive incremental growth. Additionally, many Evernorth Health Services offerings are available within Cigna Healthcare solutions.
2
How We Deliver
Principal Products and Services
Pharmacy Benefit Services
•Pharmacy Benefits.We drive high-quality, cost-effective pharmacy care through a range of services. We adjudicate drug claims from retail network participants and provide retail pharmacy network administration, benefit design consultation, drug utilization review, drug formulary management and other services.
◦Retail Pharmacy Network Administration. We contract with retail pharmacies to provide prescription drugs to customers of the pharmacy benefit plans our clients offer. We negotiate with pharmacies throughout the United States to discount drug prices and offer national and regional network options responsive to client preferences related to cost containment, convenience of access for customers and network performance.
◦Benefits Design Consultation. We consult with our clients on how best to structure and leverage the pharmacy benefit to meet plan objectives for affordable and sustainable access to the prescription medications customers need to stay healthy and to ensure the safe and effective use of those medications.
◦Drug Utilization Review. When pharmacies submit claims for prescription drugs to us, we review them in real time for health and safety. If issues are detected, we then alert the dispensing pharmacy. Clients may also choose to enroll in programs that result in communications about potential therapy concerns being sent to prescribers after the initial claim submission.
◦Drug Formulary Management.
▪Formularies are lists of drugs with designations that may be used to determine one component of drug coverage and customer out-of-pocket costs as well as communicate plan preferences in competitive therapeutic drug categories. Our formulary managementservices support clients in establishing formularies that assist customers and physicians in choosing clinically appropriate, cost-effective drugs and prioritize access, safety and affordability.
▪We administer specific formularies for our clients, including standard formularies developed by Express Scripts® Pharmacy Benefit Services ("Express Scripts") and custom formularies in which we play a more limited role. Many of our clients select standard formularies, governed by both internal and independent committees that make recommendations for formularies that first consider clinical results separate from price considerations.
▪We manage our clients' rebate arrangements, with most choosing to receive the greater of a minimum rebate guarantee or a contractually agreed-upon percentage of rebates. In some rebate arrangements, Express Scripts takes on the risk of securing the rebate value necessary to meet the value guaranteed to its client. The actual amount of value secured by Express Scripts is dependent upon the result of its negotiations for rebates. In 2025, for clients covered under our pharmacy benefit contracts, Express Scripts shared over 95% of the drug formulary management rebates it received with its integrated clients, and more than two-thirds of clients received 100% of rebates.
◦Medical Drug Management. We offer a comprehensive range of services with guaranteed savings for managing medically billed specialty drugs. Our solutions apply utilization management, site of care management and claims prepayment review to help ensure patient safety and healthier outcomes and reduce wasteful spend.
◦Administration of Group Purchasing Organizations. We participate in various group purchasing organizations that negotiate pricing for the purchase of pharmaceuticals or formulary rebates with pharmaceutical manufacturers on behalf of their participants.
3
◦Value-Based Programs. We offer a variety of solutions aimed at helping clients reduce costs and enhance clinical outcomes. These programs include SafeGuardRx®, Express Scripts Patient Assurance®, Evernorth EncircleRxSM and Evernorth EnReachRxSM.
◦Evernorth Wholesale Marketplace. Evernorth Wholesale Marketplace® offers a suite of flexible, private label pharmacy benefit manager solutions including but not limited to a pharmacy rebate program, a retail network program, value-based solutions, a medical rebate program and utilization management policies. These offerings are captured under either our drug formulary administrative service arrangements or our formulary processing arrangements.
◦Transparent Rebate-free Model.Evernorth Health Services has announced a transformative new pharmacy benefits model to make discounts negotiated with drug companies available upfront to customers buying their medications, lowering their costs at the counter. Cigna Healthcare will adopt this new model for its fully insured customers beginning in 2027. It will become the standard model available for Evernorth Health Services pharmacy benefit clients beginning in 2028.
•Home Delivery Pharmacy.Our Express Scripts® Pharmacy offers free standard shipping of medications nationwide, usually in a 90-day supply, directly to the customer's home and allows for automatic refills on eligible medications and unrestricted telephone access to customer care advocates and specially trained pharmacists. Our Evernorth EnGuideSM Pharmacy ("EnGuide Pharmacy") was established in 2025 to focus on the growing population of customers that are prescribed GLP-1 medications requiring clinical support. Express Scripts Pharmacy operations consist of 11 licensed pharmacies, inclusive of four fulfillment pharmacies located in Arizona, Indiana, Missouri and New Jersey. EnGuide Pharmacy operations consist of two licensed pharmacies, inclusive of one fulfillment pharmacy located in Ohio.
Specialty and Care Services
•Specialty Pharmacy. Specialty medications are primarily characterized as high-cost medications for the treatment of complex and rare diseases. These medications broadly include those with frequent dosing adjustments, intensive clinical monitoring, the need for customer training, specialized product administration requirements or medications limited to certain specialty pharmacy networks by manufacturers. The front-end of our pharmacy, anchored by Accredo® Specialty Pharmacy ("Accredo"), is organized into Therapeutic Resource Centers, where pharmacists focus their practice of pharmacy by condition. Accredo provides support for customers through our specially trained clinicians, network of in-home nursing services, nationwide footprint, drug reimbursement services and highly tailored clinical care programs. Our Specialty Pharmacy operations consist of 35 licensed pharmacies.
•Health System Services.Health System Services includesCuraScript SD by Evernorth®, which is a specialty distributor of pharmaceuticals and medical supplies (including injectable and infusible pharmaceuticals and medications to treat specialty and rare or orphan diseases) directly to health care providers, including clinics and hospitals in the United States for office or clinic administration. We provide distribution services primarily to health care providers who treat customers with chronic diseases and regularly order costly specialty pharmaceuticals. This business operates four distribution centers and ships most products overnight within the United States. It is a contracted supplier with most major group purchasing organizations and leverages its distribution platform to operate as a third-party logistics provider for certain pharmaceutical companies.
•Care Services.We offer clinical programs to help our clients, including third-party administrators, drive better whole-person health outcomes through our Care Delivery (MD Live by Evernorth® ("MD Live") virtual care) and Care Management (EviCore by Evernorth® ("EviCore") benefits management, behavioral health services, network services and health coaching capabilities) offerings.
Clients and Customers
We provide products and services in the Evernorth Health Services segment to clients and customers, as described below.
•Clients. We provide services to managed care organizations, health insurers, third-party administrators, employers, union-sponsored benefit plans, workers' compensation plans, government health programs, providers, clinics, hospitals and others. We provide services to a majority of clients in our Cigna Healthcare segment.
•Customers. Prescription drugs are dispensed to patients connected to the service offerings we provide to clients. Prescription drugs are dispensed primarily through networks of retail pharmacies under nonexclusive contracts with us and via home delivery pharmacies, including Express Scripts Pharmacy, and specialty pharmacies, including Accredo.
Evernorth Health Services has three clients that each drive significant revenues for the segment:
•Express Scripts and Centene Corporation ("Centene") have a multiyear agreement, which began January 1, 2024, to manage pharmacy benefit services for Centene's customers, providing them with access to the extensive Express Scripts national network of retail pharmacies.
4
•Express Scripts and Prime Therapeutics LLC ("Prime") have agreements to deliver improved choice and affordability for Prime's clients and customers by enhancing retail pharmacy networks, providing access to Accredo and Express Scripts Pharmacy, and providing pharmaceutical manufacturer value.
•The Department of War (previously the Department of Defense) TRICARE® is the military health care program available to active-duty service members, active-duty family members, National Guard and Reserve members and their family members, retirees and retiree family members, survivors and certain former spouses.
Competition
The primary competitive factors in the industry include the ability to negotiate with retail pharmacies to ensure retail pharmacy networks meet the needs of clients and customers; provide home delivery and specialty pharmacy services; negotiate with drug manufacturers to lower the cost of prescription drugs; manage cost and quality of specialty drugs; specialize in claim adjudication and benefit administration; improve access, outcomes, and efficiencies within the health care ecosystem; deliver quality primary and behavioral care in virtual-led hybrid settings and in the workplace; navigate the complexities of government-reimbursed business including Medicare, Medicaid and the public exchanges; and use the information obtained about drug, behavioral and medical utilization patterns and consumer behavior to reduce costs for clients and customers and assess the level of service provided.
Our focus on improving the health and vitality of those we serve will allow us to further differentiate ourselves from our primary competitors. Our primary competitors include independent and managed care pharmacy benefit managers; retail, home delivery and specialty pharmacies; specialty drug distributors; health plans; third-party benefit administrators; group purchasing organizations; clinical solutions companies; health care data analytics companies; and care services providers.
Suppliers
We maintain an inventory of brand-name and generic pharmaceuticals in our home delivery pharmacies, specialty pharmacies and specialty distributor. Our specialty pharmacies and specialty distributor also carry biopharmaceutical products to meet the needs of our customers, including pharmaceuticals for the treatment of rare or chronic diseases; if a drug is not in our inventory, we can generally obtain it from a supplier within a reasonable amount of time.
We purchase pharmaceuticals either directly from manufacturers or through authorized wholesalers. Evernorth Health Services uses one wholesaler for approximately half of our pharmaceutical purchases, but holds contracts with other wholesalers if needs for an alternate source arise. Generic pharmaceuticals are generally purchased directly from manufacturers.
CIGNA HEALTHCARE
Cigna Healthcare includes our U.S. Healthcare and International Health operating segments, which provide comprehensive medical and coordinated solutions to clients and customers. U.S. Healthcare provides medical plans and other benefits and solutions for insured and self-insured clients as well as for individual and family plan customers. International Health provides health care solutions in our international markets, as well as health solutions for globally mobile individuals and employees of multinational organizations.
How We Deliver
We offer administrative services only ("ASO") and insurance funding options to employers, groups and individuals along with other health care benefits and solutions to improve the quality of care, lower costs and help customers achieve better health outcomes. Funding options, referring to the entity assuming financial risk, are described in the Premiums and Fees section below.
5
Principal Products and Services
U.S. Healthcare Medical Plans
•Employer Medical Plans are offered by our insurance companies, health maintenance organizations ("HMOs") and third-party administrators ("TPAs"), and include Open Access Plus, LocalPlus® and HMO options. These plans use cost-sharing incentives to encourage the use of "in-network" rather than "out-of-network" health care providers. We also offer Preferred Provider Organization ("PPO") plans that feature broader provider access than the other plans, do not require referrals and typically have a higher cost-share for out-of-network services. Plans are offered nationwide, and our funding solutions include ASO (self-funded), insured guaranteed cost ("GC") and insured experience rated ("ER").
◦Consumer-Driven Products are paired with employer medical plans and offer customers a tax-advantaged way to pay for eligible health care expenses. Health Savings Accounts, Health Reimbursement Accounts and Flexible Spending Accounts encourage customers to play an active role in managing their health and health care costs.
•Individual and Family Plans ("IFP") are Patient Protection and Affordable Care Act and related amendments ("ACA") compliant exclusive provider organizations ("EPOs") or HMO plans marketed to individuals under age 65 without access to health care coverage through an employer or government program such as Medicare or Medicaid. Customers receive comprehensive health care benefits and have access to a local network of health care providers who have been selected with cost and quality in mind. Plans are currently offered in 11 states with a GC funding solution.
Sold Businesses
On March 19, 2025, the Company completed the sale of our Medicare Advantage, Medicare Individual Stand-Alone Prescription Drug Plans, Medicare and Other Supplemental Benefits, and CareAllies® businesses to Health Care Service Corporation ("HCSC," and such transaction, the "HCSC transaction"). Prior to the disposal date, U.S. Healthcare's results include these businesses. See Note 5 to the Consolidated Financial Statements for further information.
U.S. Healthcare Benefits and Solutions
The following benefits and solutions are offered nationwide with various funding options to enhance the benefits from our health care medical plans.
•Behavioral Health solutions consist of a broad national network of providers, including one of the largest virtual networks in the United States; specialty case and utilization management; a 24/7-accessible crisis intervention phone line; employee assistance programs; and work/life programs.
•Consumer Health Engagement solutions include an array of health management, disease management and wellness programs to improve customers' health and well-being.
•Cost Containment Programs are designed to reduce the cost of covered health care services and supplies by reducing out-of-network costs, protecting customers from balance billing and educating customers regarding the availability of lower cost in-network services. We negotiate discounts with out-of-network providers, review provider bills and recover overpayments.
•Dental solutions include HMO plans, PPO plans, EPO plans, traditional indemnity plans and a discount program. Employers and other groups may purchase our products as standalone products or in conjunction with medical products. IFP standalone dental PPO plans are available in 49 states and sold to individuals under age 65 and retirees without access to dental coverage through an employer or a government program.
•Pharmacy Management solutions and benefits may be combined with our medical and behavioral health offerings by leveraging the capabilities of Evernorth Health Services.
•Stop-Loss insurance coverage is offered to self-funded clients whose group health plans are administered by Cigna Healthcare. Stop-loss insurance provides reimbursement for claims in excess of a predetermined amount for individuals, the entire group or both.
International Health
•Global Health Care offerings include medical, dental, pharmacy, vision, life, accidental death and dismemberment, and disability risks. We provide products and services that meet the needs of multinational employers, intergovernmental and nongovernmental organizations, and globally mobile individuals with a focus on keeping employees healthy and productive. Products and services are offered worldwide except as limited by applicable law and include ASO, GC and ER funding options.
•Local Health Care offerings include medical, dental, pharmacy and vision as well as life coverage. Customers include employers and individuals located in specific geographies (China, Singapore, Hong Kong, Spain and India, along with various countries in the Middle East) where the products and services are purchased. Offerings include ASO, GC and ER funding options.
6
Premiums and Fees
•ASO. Plan sponsors (i.e., employers, unions and other groups) create self-funded group health plans to fund all claims and may purchase stop-loss insurance to limit exposure. We earn fees for providing access to our participating provider networks, claims administration services, and other benefits and solutions. ASO arrangements represent approximately 32% of 2025 segment revenues and 79% of Cigna Healthcare medical customers as of December 31, 2025.
•Insured.
GC and ER. Individual and group insurance premium rates generally must be approved by the applicable state regulatory agency, and state or federal laws may restrict or limit the use of rating methods. Premium rates are established at the beginning of a policy period and may be based in whole or in part on prior experience and include estimates of future claims costs over the fixed contract period. With the exception of ER policies, we generally cannot adjust premium rates to reflect actual claims experience until the next policy period, and the policyholder does not share in actual claim experience. We retain any margin if costs are less than the premium charged (subject to minimum medical loss ratio ("MLR") rebate requirements) and bear the risk for costs in excess of the premium charged.
The ACA subjects individual and small group policy rate increases above an identified threshold to review by the United States Department of Health and Human Services ("HHS"), and our U.S. Healthcare medical plans are subject to minimum MLR requirements. The MLR represents the percentage of premiums used to pay claims and expenses for activities that improve the quality of care. If we do not satisfy the prescribed MLR, statutes require premium refunds to policyholders.
GC and ER insured arrangements represent approximately 68% of 2025 segment revenues (which includes Medicare Advantage prior to the HCSC transaction) and 21% of Cigna Healthcare medical customers as of December 31, 2025.
See the "Business – Regulation" section of this Form 10-K for additional information about MLR requirements.
Market Segments
Cigna Healthcare serves medical customers across the following market segments:
•National Accounts. Employers with 3,000 or more eligible employees.
•Middle Market. Employers with 500 to 2,999 eligible employees, solutions for third-party payors, Taft-Hartley plans and other groups.
•Select. Employers with 51 to 499 eligible employees.
•Small. Employers with 2 to 50 eligible employees.
•IFP.Individual health insurance coverage both on and off the public exchanges.
•International Health.Includes multinational employers and globally mobile individuals, and employers and individuals in specific countries outside of the United States.
•Medicare Advantage (sold business in 2025). Includes individuals who are Medicare-eligible, as well as employer group-sponsored post-65 retirees.
Clients and Customers
We provide clients and customers with access to a mix of medical and other health care benefits and solutions.
•Clients. Employers, TPAs, union-sponsored benefit plans and other groups.
•Customers. Individuals who access our offerings through an employer-sponsored plan, government-sponsored plan in Medicare Advantage prior to the HCSC transaction, IFP or other individual plan, or other insured group.
Primary Distribution Channels
•Brokers and Consultants. Sales representatives distribute our products and solutions through a broad group of brokerage and consulting firms as well as individuals.
•Direct. Cigna Healthcare sales representatives distribute our products and solutions directly to employers, unions, and other groups or individuals. Various products may also be sold directly to insurance companies, HMOs and TPAs.
•Private Exchanges. We partner with select private exchanges that provide employees of participating clients access to health insurance, targeting participation to those models that best align with our mission and value proposition.
•Public Exchanges. Cigna Healthcare offers individual ACA-compliant policies through public health insurance exchanges in select geographies.
7
Competition
The primary competitive factors affecting our business are quality of care and cost-effectiveness of service and provider networks, effectiveness of medical care management, products that meet the needs of our clients and customers, total cost management, technology, and effectiveness of marketing and sales. Financial strength, as indicated by ratings issued by nationally recognized rating agencies, is also a competitive factor. Our health advocacy capabilities, holistic approach to consumer engagement, breadth of product offerings, and clinical care and health management capabilities, along with an array of product funding solutions, are competitive advantages. Our primary competitors include national insurers, local health plans, TPAs, dental insurers, independent and managed care pharmacy benefit managers, global insurers, and local non-U.S. insurers.
Provider Networks and Partnerships
•Participating Provider Networks. We provide our customers with a national network of participating health care providers; hospitals; and other facilities, pharmacies and providers of health care services and supplies. As of December 31, 2025, our U.S. network had approximately 1.7 million physicians, including specialists, and over 6,000 hospitals. We have strategic alliances with several regional managed care organizations to gain access to their provider networks and discounts.
•Network Strength and Stability. We successfully maintain a broad provider network with high levels of provider retention to ensure our customers have access to high-quality care at affordable, competitive rates.
•Provider Partnerships. We partner with a variety of provider groups in value-based payment arrangements to continuously improve the quality of care for those we serve. With more than 200 arrangements with primary care groups, our flagship program is the Cigna Collaborative Accountable Care program, which rewards providers for improving quality outcomes and medical cost performance. As of December 31, 2025, we had approximately 100 arrangements with specialist groups across a variety of disciplines that include incentives for enhanced care coordination or reimbursements for meeting cost and quality goals. We also had contracts with more than 200 hospital systems, involving more than 750 hospitals, with reimbursements tied to quality metrics.
•Site of Care Optimization. We encourage the use of clinically appropriate settings to reduce the cost of care while ensuring high-quality care and service through our clinical programs. Through our clinical programs and partnership with EviCore, we guide care to the most appropriate settings, reducing unnecessary costs while preserving quality and service, and offer virtual care options, including MD Live, to improve convenience and access.
OTHER OPERATIONS
Other Operations comprises the remainder of our business operations, which includes certain continuing, run-off and other non-strategic businesses.
Continuing Business
Corporate-Owned Life Insurance. The principal products of the corporate-owned life insurance ("COLI") business are permanent insurance contracts sold to corporations to provide coverage on the lives of certain employees for financing employer-paid future benefit obligations. Permanent life insurance provides coverage that, when adequately funded, does not expire after a term of years. The contracts are primarily nonparticipating universal life policies. Fees for universal life insurance products consist primarily of mortality and administrative charges assessed against the policyholder's fund balance. Interest credited and mortality charges for universal life and mortality charges on variable universal life may be adjusted prospectively to reflect expected interest and mortality experience. To reduce our exposure to large individual losses, we purchase reinsurance from unaffiliated reinsurers.
Run-off Businesses
Settlement Annuity Business. Our settlement annuity business is a closed, run-off block of single premium annuity contracts. These contracts are primarily liability settlements, with approximately 10% of the liabilities associated with guaranteed payments not contingent on survivorship. Non-guaranteed payments are contingent on the survival of one or more parties involved in the settlement.
Reinsurance. Our reinsurance operations are an inactive business in run-off. In February 2013, we effectively exited the variable annuity reinsurance business by reinsuring 100% of our future exposures, net of retrocessional arrangements in place at that time, up to a specified limit. For additional information regarding this reinsurance transaction and the arrangements that secure our reinsurance recoverables, see Note 10 to the Consolidated Financial Statements.
Individual Life Insurance and Annuity and Retirement Benefits Businesses. The individual life insurance and annuity business and the retirement benefits business were sold through reinsurance agreements in 1998 and 2004, respectively. For more information
8
regarding the arrangements that secure our reinsurance recoverables for the retirement benefits business, see Note 10 to the Consolidated Financial Statements.
MISCELLANEOUS
•Revenues from a single pharmacy benefit client were approximately 19% and 16% of total revenue from external customers for the years ended December 31, 2025 and 2024, respectively. These amounts were reported in the Evernorth Health Services segment.
•Revenues from U.S. Federal Government agencies, under a number of contracts, were 11% and 15% of total revenue from external customers for the years ended December 31, 2024 and 2023, respectively. These amounts were reported in the Evernorth Health Services and Cigna Healthcare segments.
•The Company does not rely on business from one or a few brokers or agents.
INVESTMENT MANAGEMENT
Our investment operations provide investment management and related services for our various businesses, including the insurance-related invested assets. For additional information about invested assets, see the "Investment Assets" section of the MD&A and Notes 11 and 12 to the Consolidated Financial Statements.
We manage our investment portfolios to reflect the underlying characteristics of related insurance and contractholder liabilities and capital requirements, as well as regulatory and tax considerations pertaining to those liabilities and state investment laws. Insurance and contractholder liabilities range from short-duration health care products to longer-term obligations associated with COLI products and the run-off settlement annuity business. Assets supporting these liabilities are managed in segregated investment portfolios to facilitate matching of asset durations and cash flows to those of corresponding liabilities. Investment results are affected by the amount and timing of cash available for investment, economic and market conditions and asset allocation decisions. We routinely monitor and evaluate the status of our investments, obtaining and analyzing relevant investment-specific information and assessing current economic conditions, trends in capital markets and other factors, such as industry-sector, geographic and property-specific information.
DIGITAL, DATA AND TECHNOLOGY
The Cigna Group investments in digital, data and technology are focused on cultivating robust, innovative digital-first capabilities to better engage with customers and stakeholders.
Our Commitments to Better. The Cigna Group is on a multiyear journey toward making the health care experience better for those we serve. We are taking action on our five commitments, which are outlined above. The Cigna Group is driving meaningful improvements for all customers through strong governance and collaboration across the organization. These partnerships guide our efforts to enhance health outcomes for the millions we serve while ensuring transparency and accountability every step of the way.
Innovation. At the core of the Company's strategic priorities lies a culture of innovation and enablement - one that empowers a customer-centric, digital-first, virtual-led vision for health care. The advancement of our internal innovative capabilities and strategic partnerships empowers teams to continuously challenge conventions, embrace experimentation and produce new and more effective ways to engage with our customers to help close gaps in care, optimize treatment and improve outcomes.
The Cigna Group is committed to innovative, transformative changes by reimagining our operating models, products and interactions to create new sources of value. We use artificial intelligence ("AI") to support health care transformation by helping to enable the next generation of accessible, effective, affordable and enhanced health care solutions. AI models can facilitate personalized solutions for individuals, inform earlier interventions and simplify health care experiences. There is human engagement in claims reviews, including expert decisions made by physicians or employees at The Cigna Group. Given this, we consider most of the AI models we use as augmented intelligence, providing information to human experts for further consideration, in combination with many other factors evaluated in care and benefit administration decisions.
To ensure our practices and solutions are consistent with our commitment to health equity and to facilitate compliance with applicable laws and regulations, we have a dedicated team and governance structure in place, known as Enterprise Model Governance ("EMG"). Our EMG team oversees the development, deployment and monitoring of AI models driven by our Responsible AI Principles: validity and reliability, safety, privacy, fairness, transparency, and accountability. EMG is governed by the EMG Board, consisting of senior
9
leaders from across the company, with representation from business, clinical, privacy, legal, internal audit, information protection and other departments. The EMG Board oversees an enterprise-wide model approval and governance process for review of AI models in use or in development across the enterprise.
We also have established comprehensive governance processes for new capabilities, such as generative AI ("Gen AI"). Our AI Center of Enablement ("AI COE") expands on EMG and brings together individuals from across our technology, privacy, data governance, security, legal, compliance, marketing and other teams to evaluate and approve Gen AI use cases. The AI COE ensures these use cases align with our Responsible AI Principles and adhere to health care privacy and security requirements.
Data and Analytics. Data and analytics power the Company's strategy, fueling informed decisions, deeper insights and accelerated growth. We are creating technology that drives AI processes and enables predictive, personalized and adaptive business outcomes. We conduct timely, rigorous and objective research and analysis that informs evidence-based medical and pharmacy benefit management decisions and evaluates the clinical, economic and individual impact of enhanced benefit designs and programs, ultimately resulting in rich, integrated data that helps to provide differentiated outcomes. The combination of our predictive analytics, and our machine learning ("ML") and deep learning capabilities help to uncover trends, anticipate needs and create actionable intelligence that assists and accelerates decision-making of our health care professionals, improves operational efficiency and enables greater innovation. Our data-driven approach to building products and solutions provides personalized and customized care across the entire continuum for the populations we serve. These solutions predict emerging health needs, close gaps in care and drive cost savings, all while focusing on improving the health and vitality of the lives we touch.
Digital. Our digital health focus has shown value across the enterprise by reimagining the future of health care and creating engaging experiences that give customers the right information at the right time. We are positioning our lines of business for today's market pressures while ensuring we are building a sustainable advantage through data, insights and digital innovation. We drive efficiencies, improve sentiment and create market differentiation, while accelerating our path toward personalized, AI-driven solutions for customers, clients and providers. We deliver digital products and features at scale with a commitment to security, resiliency and compliance. Our digital strategy also focuses on the drive from analog to digital, which complements the growth strategy of The Cigna Group, creates efficiency and amplifies the value of existing offerings, as well as creates option value with industry-leading personalization and precision to drive better health and business outcomes. Cybersecurity protections continue to be a top priority across The Cigna Group digital offerings to further strengthen our security posture and grow the trust of those we serve. See Part I, Item 1C - "Cybersecurity" of this Form 10-K for additional information regarding our cybersecurity practices and governance.
Technology Operations. Our technology team consistently maintains a high degree of availability and reliability to our various information systems critical to client and customer care operations, providers, and overall customer experience. Within Evernorth Health Services, uninterrupted point-of-sale electronic retail pharmacy claims processing is a significant operational requirement for our business. We believe we have substantial capacity for growth in our U.S. pharmacy claims processing facilities. Our pharmacy technology platform allows us to safely, rapidly and accurately adjudicate over two billion adjusted prescriptions annually. Our technology helps retail pharmacies focus on patient care, and our real-time safety checks help avoid medication errors. The Cigna Group companies hold over 540 U.S. patents. We use these patents to protect our proprietary technological advances and to differentiate ourselves in the market. We are not substantially dependent on any single patent or group of related patents. We are not aware of any facts that could materially impact the continuing use of our intellectual property.
HUMAN CAPITAL MANAGEMENT
The mission of The Cigna Group is to improve the health and vitality of those we serve. A healthy and diverse global workforce is essential to achieving our mission and our business growth strategies. We continually invest in our employees by supporting their health and vitality, providing fair and market-competitive compensation, and fostering opportunities for growth and development. As of the end of 2025, The Cigna Group employed approximately 67,700 employees worldwide, with about 88% of our employees based in the United States. Roughly 97% of our workforce is full-time.At year-end 2025, our global workforce was approximately 69% women and 31% men, and about 40% of our U.S. employees identified as ethnic minorities. We have a long-standing and deep commitment to cultivating a purpose and performance driven workforce that is equipped and empowered to drive growth and innovation across our businesses.
Health, Vitality and Other Benefits. Supporting our employees' health and vitality is not only a core value, it's a critical business imperative. Each year, we make continued investments to help ensure our workforce is healthy, engaged and empowered to advance our mission and business strategy, ultimately creating long-term shareholder value.
10
In 2025, The Cigna Group invested approximately 20% of total payroll in health, well-being and other benefits. These investments include comprehensive medical and pharmacy coverage, paid time off, life and disability programs, 401(k) contributions, and retirement-related benefits for our employees in the United States.
Beyond traditional medical and pharmacy benefits, we provide multidimensional wellness programs designed to support many aspects of well-being (physical, mental, financial and social health) while promoting overall vitality. We also encourage employees to voluntarily share additional demographic information, such as military veteran status or disability, so we can tailor resources and programs to meet their unique needs and perspectives.
Talent Acquisition, Development and Retention. Our talent acquisition and rewards strategies are designed to attract and retain skilled employees who are committed to our mission. We strive to reach a broad and diverse pool of candidates to engage and recruit top talent across all levels and functions of the Company. In 2025, the voluntary turnover rate was approximately 9% for all employees.
Our compensation practices, rooted in our pay-for-performance philosophy, promote fair and competitive pay through measures such as benchmarking compensation by role, eliminating inquiries regarding applicants' compensation history from the hiring process and monitoring for potential disparities. Within the U.S., female employees of The Cigna Group earn more than 99 cents for every dollar earned by similarly situated male employees, and employees from underrepresented groups earn more than 99 cents for every dollar earned by similarly situated white employees. On a global basis, across the entire Company, female employees at The Cigna Group earn more than 99 cents for every dollar earned by similarly situated male employees.
Our online learning platform and career development tools, including a career portal and career planning tool, offer a broad range of training, education and development resources to all employees. In 2025, based on internal data, employees on average engaged in 45 hours of learning through these resources. Our leadership development strategy, anchored by The Cigna Group Leader Profile and aligned with our mission and enterprise goals, serves to cultivate leadership capabilities for people leaders and critical segments across our organization through innovative programs and resources. The Cigna Group also offers an education reimbursement program for both full-time and part-time employees who meet the continuing education criteria. We believe these strategies and programs contribute to employee engagement and retention and prepare our employees to meet our needs now and in the future.
CORPORATE IMPACT AND SUSTAINABILITY
The Cigna Group corporate impact and sustainability framework is structured around four connected pillars that underscore our enterprise mission to improve the health and vitality of those we serve. We drive action through this framework to deliver on our vision: to transform the ecosystem of health into one that is well-functioning, sustainable, accessible and equitable - advancing better health for all. Our commitment to this vision guides us in our value-creation strategy as we strive to meet the needs of our many stakeholders. The four pillars of this framework are as follows:
Healthy Society. We are committed to understanding and addressing social determinants of health and improving medical quality and access while lowering health risks, promoting preventive health interventions and coordinating all aspects of care. We drive progress by aligning our products and services with value-based care models, leveraging integrated benefits, managing drug costs through innovation, expanding digital offerings and reviewing coverage policies for health equity. We also give back through charitable giving and volunteerism in communities where we operate around the world.
Healthy Workforce. We believe that employers play a vital role in the health care system, and we strive to be a model for others by prioritizing and investing in the health and vitality of employees within our own company. We aim to cultivate a workforce that is equipped and empowered to drive growth and innovation across our diverse businesses. See further discussion of this pillar within Part I, Item 1 "Human Capital Management" section above.
Healthy Environment. We believe that responsible environmental stewardship can improve health and vitality and also makes sound business sense. We strive to identify new efficiencies and make strategic investments that reduce our environmental impacts and our operating costs.
Healthy Company. We have a deep and long-held commitment to strong governance as well as ethical and resilient business practices. This includes protecting the sensitive data of our clients and customers by ensuring cybersecurity incident response preparedness, as well as supporting a responsible supply chain.
11
REGULATION
We are regulated by federal, state and international legislative and executive bodies and agencies, which generally have discretion to issue regulations and interpret and enforce laws and rules. These regulations can vary significantly from jurisdiction to jurisdiction, and the regulations and interpretations thereof may also change periodically. We expect continued legislative and regulatory debate of issues related to our businesses, and executive, judicial or legislative intervention could further impact the regulatory landscape for the health services industry. Our international subsidiaries face an increasingly complex regulatory dynamic, including as a result of rigorous regulations and the impact of geopolitical developments or tensions.
Many aspects of our business are directly regulated by federal and state laws and administrative agencies, such as HHS, Centers for Medicare and Medicaid Services ("CMS"), the Internal Revenue Service ("IRS"), the U.S. Departments of Labor ("DOL") and Treasury, the Office of Personnel Management ("OPM"), the Defense Health Agency ("DHA"), the Federal Trade Commission ("FTC"), the SEC, the Office of the National Coordinator for Health Information Technology, state departments of insurance, state boards of health and state boards of pharmacy. Our business practices may also be shaped by enforcement actions of federal agencies, such as the Department of Justice ("DOJ"), state agencies and judicial decisions.
In addition, aspects of our business are subject to indirect regulation. The self-funded benefit plans sponsored by our U.S. employer clients are regulated under federal law. These self-funded clients expect us to administer their plans in compliance with the regulatory requirements applicable to them.
Our business operations and the books and records of our regulated businesses are routinely subject to regulatory examination and audit at regular intervals by state insurance and HMO regulatory agencies, state boards of pharmacy, CMS, DOL, and OPM to assess compliance with applicable laws and regulations. Our operations are also subject to nonroutine examinations, audits and investigations by various state and federal regulatory agencies, generally as the result of a complaint. In addition, we may be subject to examination or investigation of our clients whose group benefit plans we administer on their behalf. As a result, we routinely receive subpoenas and other demands or requests for information from various state insurance and HMO regulatory agencies, state attorneys general, the HHS Office of Inspector General ("HHS-OIG"); the DOJ; the FTC; the DOL; and other state, federal and international authorities. We may also be called upon by members of the U.S. Congress, state legislators, state regulators or attorneys general to provide information regarding certain business practices. If The Cigna Group is determined to have failed to comply with applicable laws or regulations, these examinations, audits, investigations, reviews, subpoenas and demands may (a) result in fines, penalties, injunctions, consent orders or other settlement agreements (such as corporate integrity agreements or loss of licensure); (b) suspend or exclude us from participation in government programs or limit our ability to sell or market our products; (c) require changes in business practices; (d) damage relationships with the agencies that regulate us and affect our ability to secure regulatory approvals necessary for the operation of our business; or (e) damage our brand and reputation.
Even where we believe that we are in compliance with the various laws and regulations, any enforcement actions by federal, state or international government officials alleging noncompliance with these rules and regulations could subject us to penalties or restructuring or reorganization of our business. For a discussion of the risks related to our compliance with these laws and regulations, please see the "Risk Factors" section located in Part I, Item 1A of this Form 10-K.
Federal Legislative Developments
In February 2026, the U.S. Congress enacted the Consolidated Appropriations Act, 2026, which includes multiple provisions applicable to pharmacy benefit manager ("PBM") operations. These provisions are expected to impact pharmacy benefit arrangements in the commercial market and the Medicare Part D program, with varying effective dates. The ultimate impact of these provisions will depend, in part, on future regulatory guidance and implementation by the HHS and the DOL, among other federal agencies.
With respect to employer-sponsored health plans subject to the Employee Retirement Income Security Act ("ERISA"), the legislation includes provisions, effective beginning in August 2028, that require PBMs to remit 100% of certain rebates, fees and other remuneration to plan sponsors. In addition, the legislation imposes enhanced disclosure and reporting requirements intended, among other things, to increase transparency into PBM compensation and prescription drug spending.
The legislation also includes provisions affecting PBM services provided in connection with Medicare Part D plans that, beginning in January 2028, prohibit PBMs from receiving compensation that is directly or indirectly linked to the list price of a covered Part D drug, limiting PBM compensation to bona fide service fees.In addition, beginning January 2029, under the legislation, Medicare Part D plan sponsors will be required to contract with any pharmacy that is willing and able to meet standard contract terms and conditions. The Company continues to monitor legislative and regulatory developments regarding the Consolidated Appropriations Act, 2026; however, the full impact of these provisions on PBM operations cannot be determined at this time.
12
The Patient Protection and Affordable Care Act
The ACA governs significant aspects of the U.S. health care system that affect insured and self-insured health benefit plans and PBMs. Our business model is impacted by the ACA and may be impacted by additional, future changes to the ACA, including our relationships with current and future producers and health care providers, products, service providers, and technologies. The ACA, among other things, created health insurance exchanges for individuals and small group employers to purchase insurance coverage and implemented minimum MLRs for our Cigna Healthcare business. The ACA allows states to adopt MLR requirements that are more stringent than those established by the ACA. Other provisions of the ACA in effect include reduced Medicare Advantage payment rates, the requirement to cover preventive services with no enrollee cost-sharing, a ban on the use of lifetime and annual limits on the dollar amount of essential health benefits, increased restrictions on rescinding coverage, extended coverage of dependents up to age 26, restrictions on differential pricing, and certain pharmacy benefit transparency requirements. In 2021, in response to the COVID-19 pandemic, the federal government temporarily expanded eligibility for ACA subsidies to higher-income people who did not otherwise qualify and increased ACA subsidies for lower-income people who already qualified in 2021 and 2022, among other actions. These ACA subsidies expired on December 31, 2025. The Inflation Reduction Act of 2022 extended the increased premium tax credits for individuals enrolled in ACA-qualified health plans through December 31, 2025, which were not renewed.
Health Care Fraud and Abuse Laws
Our products and services are subject to health care fraud, waste and abuse laws, including the federal False Claims Act ("False Claims Act"), state false claims acts, federal and state anti-kickback laws, and the federal Civil Monetary Penalties Law. These laws and related regulations prohibit a wide range of activities, including kickbacks in return for customer referrals, billing for unnecessary medical services, beneficiary inducement, upcoding and improper marketing. The regulations and contractual requirements in this area are complex, frequently modified, and subject to administrative discretion and judicial interpretation.
Noncompliance with such laws may result in enforcement and other actions, including civil and criminal penalties, substantial financial liabilities (including treble damages under the False Claims Act), and exclusion from participation in federal and state health care programs. Additionally, private individuals have brought and may bring qui tam, or "whistleblower," suits under the False Claims Act, which authorizes the payment of a portion of any recovery to the individual bringing suit. Any changes to such laws, and the implementation of any regulations that would eliminate the anti-kickback regulatory safe harbors on which we rely, may impact our ability to engage in certain arrangements, such as price concessions, including rebates, that are offered by pharmaceutical manufacturers to plan sponsors or PBMs under the Medicare Part D program.
Government Procurement Regulations
The Cigna Group is required to comply with applicable federal and state procurement laws and regulations which govern eligibility, bidding, contract performance, and ongoing operational obligations for entities participating in government purchasing and contracting activities. As an example, we have a contract with the DHA that subjects us to applicable Federal Acquisition Regulations ("FAR") and the FAR Supplement, which govern federal government contracts. Further, there are other federal and state laws applicable to our DHA arrangement and our arrangements with other clients that may be subject to government procurement regulations. In addition, certain of our clients participate as contracting carriers in the Federal Employees Health Benefits Program administered by the OPM, which includes various pharmacy benefit management standards.
Laws and Regulations Affecting Pharmacy Benefit Plan Design, Administration and Pharmacy Network Access
The federal government and states have laws, regulations and guidance that affect our ability, or our clients' ability, to limit access to pharmacy provider networks or that prohibit plan sponsors from implementing certain network and benefit plan design features, including provisions relating to the pharmacy benefit. These laws can negatively impact the use of cost-saving network and benefit configurations for plan sponsors or affect access. One state recently enacted legislation prohibiting PBMs from owning or operating pharmacies within the state, which affects vertically integrated entities such as ours and is currently the subject of ongoing litigation.Similarly, the federal government and some states have issued laws, regulations and guidance that impose restrictions and generate additional costs by limiting our ability to maximize efficiencies that could otherwise be gained through certain prescription and refill processes or by imposing mandated coverage of certain benefits, conditions or U.S. Food and Drug Administration ("FDA")-approved drugs that may also restrict certain therapeutic interventions.
Pharmacy Benefit Manager and Drug Pricing Regulation
Our pharmacy benefit management services are subject to numerous laws and regulations that govern critical practices, including disclosure, receipt and retention of rebates and other payments received from pharmaceutical manufacturers; certain pharmacy contracting practices, including disclosure of cost information to customers; pharmacy reimbursement mandates; the receipt and
13
retention of transmission fees from contracted pharmacies; performance-based price concessions; pharmacy price concessions to drug prices at the point of sale; audits of contracted pharmacies; use of, administration of or changes to drug formularies, the use and disclosure of maximum allowable cost ("MAC") pricing, or clinical programs; "most favored nation" pricing, which provides that a pharmacy participating in a specific government program must give the program the best price the pharmacy makes available to any third-party plan; disclosure of data to third parties; drug utilization management practices; the level of duty a PBM owes its clients or customers; configuration of pharmacy networks; the operations of our subsidiary pharmacies; fiduciary requirements; referrals to affiliated pharmacies; disclosure of negotiated provider reimbursement rates; disclosure of negotiated drug rebates; calculation of certain customer cost-share for prescription drug claims; pricing that includes differential or spread (i.e., a difference between the drug price charged to the plan sponsor by a PBM and the price paid by the manager to the dispensing provider); disclosure of fees associated with administrative service agreements and patient care programs that are attributable to customers' drug utilization; utilization management; and registration or licensing of PBMs.
Pharmacy and Pharmaceutical Distribution Regulation
We are licensed to do business as a pharmacy in the states in which our pharmacies are located, and the health care professionals who we employ are also licensed by, and subject to the laws and regulations of, state boards of pharmacy and other governmental authorities. Participation in Medicare and Medicaid programs requires our pharmacies to comply with the applicable Medicare and Medicaid provider rules and regulations and exposes the pharmacies to reimbursement, claims submission, pricing and other changes. In addition to the health care fraud and abuse laws and the privacy and security laws described above, our home delivery and specialty pharmacy operations are also subject to extensive federal and state laws and regulations that govern the labeling, packaging, repackaging, compounding, storing, holding, disposal, distribution, advertising, misbranding, adulteration, transfer, handling and security of prescription drugs and the dispensing of prescription, over-the-counter, hazardous and controlled substances, as well as laws enforced by the U.S. Drug Enforcement Administration, the FDA, state-controlled substance authorities, the FTC and the United States Postal Service. Violations of pharmacy laws and regulations may result in warning letters, civil and criminal penalties, seizures, suspension, termination or revocation of licenses and registrations, restrictions on facilities or operations, and other enforcement actions.
Certain of our subsidiaries engage in pharmaceutical distribution operations, which are subject to state and federal licensing, reporting and compliance requirements, including state drug distribution licensing regulations, supply chain security laws and controlled substances monitoring requirements. If we fail to satisfy state or federal regulatory expectations, we could be subject to fines, suspension or revocation of our distributor licenses, restrictions on operation, and other enforcement actions.
Privacy, Security and Data Standards Regulations
On the federal level, we are subject to a number of sector-specific regulations related to the creation, collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, disposal and other processing of protected health information ("PHI") and other personally identifiable information ("PII"). The federal Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations that implement such laws (collectively, "HIPAA") impose requirements on covered entities and business associates (and we are both) that address the privacy and security of PHI, regulate permissible uses and disclosures of PHI, and impose breach notification requirements. Violations of HIPAA may result in enforcement actions; civil and criminal penalties; and settlement, resolution and monitoring agreements. State attorneys general may also bring civil actions seeking injunctions or damages in response to violations of HIPAA that threaten the privacy of state residents, and violations of privacy, data-security or HIPAA-related requirements could subject us to private litigants or other claims under state or common law theories. We may also be held liable under HIPAA for violations by our vendors. There can be no assurance that we will not be the subject of an investigation, audit or compliance review regarding our compliance with HIPAA. HIPAA does not preempt more stringent state health privacy laws and regulations, which may protect the health information of certain individuals, such as minors, and certain types of sensitive health information, such as transgender care, HIV/AIDS status, reproductive health information, genetic information, and mental and behavioral health.
Other U.S. federal and state consumer privacy laws typically exempt data and/or entities subject to HIPAA, but several states, such as Washington, Nevada and Connecticut, have enacted privacy laws to protect consumer health data and require consent for the collection, use, sharing and other processing of consumer health data. These laws apply to data that is collected outside the scope of HIPAA. In addition, 19 states have enacted comprehensive state data privacy laws governing certain categories of personal information such as employee and business partner data, website visitor information, and customer data collected by entities not subject to HIPAA. Under these laws, consumer rights to access, correction, and deletion limit how we may collect and process such residents' personal information. All 50 U.S. states have laws requiring companies to notify individuals and state regulatory authorities in the event of certain data breaches. Moreover, the U.S. Congress has considered, and in the future will likely consider, proposals from time to time for comprehensive privacy and data security legislation to which we may be subject if enacted. These laws and others may impact our businesses and practices.
14
The federal government has also enacted final regulations on interoperability and information blocking to support the seamless and secure access, exchange and use of electronic health information by and between patients, enrollees and entities, such as payors and health care providers. The regulations impact how industry participants, including us, comply with disclosure requirements and share information with individuals and other health care organizations.
The federal Gramm-Leach-Bliley Act and its implementing regulations generally place restrictions on the disclosure of nonpublic information to nonaffiliated third parties and requires financial institutions, including insurers, to provide customers with notice regarding how their nonpublic personal information is used, including an opportunity to "opt out" of certain disclosures. State departments of insurance and certain federal agencies adopted implementing regulations as required by federal law.
Under Section 5 of the Federal Trade Commission Act ("FTC Act"), the FTC has jurisdiction over certain privacy and security practices deemed unfair and deceptive acts and practices in or affecting commerce, which includes unfair and deceptive practices with respect to consumer privacy rights and safeguarding of PHI and PII. In addition to the FTC Act, the FTC also enforces other federal laws relating to consumers' privacy and security. The FTC has also been active with respect to companies' use of data and AI, specifically ensuring fair and equitable use of these tools, and AI remains an FTC area of enforcement focus. More broadly, the federal government has made AI development a priority, with executive orders from successive administrations addressing its adoption and regulation. U.S. state legislatures and regulators are similarly interested in the use of AI, particularly where it may impact decision-making in the delivery of insurance or health care services. A handful of states, such as California, Colorado and Texas, have either passed legislation or issued regulatory guidance concerning AI. Additionally, the National Association of Insurance Commissioners ("NAIC"), an organization of state insurance regulators, established the Innovation, Cybersecurity and Technology Committee to provide a forum for regulators to learn about, monitor and confer on emerging technology issues, including, among others, cybersecurity and AI. State Departments of Insurance, state attorneys general, and other state government agencies and legislatures are increasingly aware and active in providing guidance in the AI space.
The Cybersecurity Information Sharing Act of 2015 encouraged organizations to share cyber threat indicators with the federal government and, among other things, directed HHS to develop a set of voluntary cybersecurity best practices for organizations in the health care industry. States have issued regulations specifically related to cybersecurity, which may differ or conflict from state to state. In October 2017, the NAIC adopted the Insurance Data Security Model Law, which creates rules for insurers and other covered entities addressing data security, investigation and notification of breaches. This includes maintaining an information security program based on ongoing risk assessment, overseeing third-party service providers, investigating data breaches and notifying regulators of a cybersecurity event. As the model law is intended to serve as model legislation only, states will need to enact legislation for the model law to become mandatory and enforceable. To date, 28 states have enacted some form of the model law.
Over the past several years, the federal government has increasingly focused on the cybersecurity requirements applicable to government contractors, including enhanced guidance and regulation. These include compliance with the Privacy Act of 1974, the Defense Federal Acquisition Regulation Supplement cybersecurity requirements, the Cybersecurity Maturity Model Certification (phasing in between November 2025 and November 2028 and based on the National Institute of Standards and Technology ("NIST") standards), the Federal Information Security Modernization Act, and the White House's 2021 Executive Order on Improving the Nation's Cybersecurity.
Certain of our businesses are also subject to the Payment Card Industry Data Security Standard ("PCI DSS"), which is designed to protect credit card account data as mandated by payment card industry entities.
In addition, we are or may become subject to international laws, rules and regulations governing privacy, data protection, information security, AI and wider data regulation, such as the European Union's General Data Protection Regulation ("GDPR"), the European Union Artificial Intelligence Act (the "EU AI Act"), and the Digital Operational Resilience Act, which can be more stringent than those in the United States. Complying with these laws may increase our compliance costs or necessitate changes to our business activities, and any failure to comply could result in regulatory investigations, fines or other penalties. Some non-U.S. jurisdictions are also instituting data residency regulations requiring that data be maintained within the respective jurisdiction or otherwise restricting transfer of personal data across borders unless specified regulatory requirements are met.
Consumer Protection Laws
We engage in direct-to-consumer activities and are therefore subject to federal and state regulations applicable to electronic communications and other consumer protection laws and regulations, such as the Telephone Consumer Protection Act and the CAN-SPAM Act. We face increased risk under such laws and may be subject to consumer or other lawsuits, penalties, enforcement actions and sanctions. The FTC and state attorneys general are also increasingly exercising their regulatory and enforcement authorities in the areas of consumer privacy, including with respect to drug pricing, rebate, formulary or contracting practices, and data security.
15
State and federal policymakers have taken actions intended to increase transparency and predictability of health care costs for consumers and protect consumers from certain out-of-network surprise bills. For example, the Transparency in Coverage rule issued by HHS, the DOL and the Department of the Treasury now requires most group health plans and health insurance issuers in the individual and group markets to publicly disclose price and cost-sharing information for all items and services to participants and enrollees.
The federal No Surprises Act and state laws prohibit health care providers, in certain situations, from balance billing the patient and require providers to work directly with insurers to agree on out-of-network reimbursement or use defined arbitration processes like independent dispute resolution. These laws and regulations vary in their approach, impacting consumers and the health care system as a whole.
Additionally, most states have consumer protection laws that have been the basis for investigations and multistate settlements relating to financial incentives provided by drug manufacturers to retail pharmacies in connection with product conversion programs. Such statutes have also been cited as the basis for claims or investigations by state attorneys general relative to privacy and data security.Further, states continue to leverage their market conduct examination authority in both the health insurance and PBM contexts, which adds to the regulatory complexity that exists in the health care space.
Employee Retirement Income Security Act
Our domestic subsidiaries sell most of their products and services to sponsors of employee benefit plans that are governed by ERISA. ERISA is a complex set of federal laws and regulations enforced by the IRS and the DOL, as well as the courts. ERISA regulates certain aspects of the relationship between us, the employers that maintain employee welfare benefit plans subject to ERISA and the participants in such plans. Certain of our domestic subsidiaries are also subject to requirements imposed by ERISA affecting claim payment and appeals procedures for individual health insurance and insured and self-insured group health plans and for the insured plans we administer.
Medicare and Medicaid Regulations
Through our subsidiaries, we provide services to Medicare Part D plan sponsors, Medicare Advantage Prescription Drug Plans, and employers and clients offering Medicare Part D benefits to Medicare Part D eligible beneficiaries, including those dually eligible for Medicare and Medicaid benefits ("dual-eligible"). We participate in state Medicaid programs directly or indirectly through our clients that are Medicaid managed care contractors. We also perform certain Medicaid subrogation services and certain delegated services for clients, including utilization management, which are regulated by federal and state laws.
Government-sponsored health care programs are regulated by HHS and its agencies such as CMS, state Medicaid agencies, the HHS-OIG, DOJ, and other federal and state agencies, and we are subject to risks associated with audits of our performance and audits to determine compliance with contracts and regulations. A company's ability to obtain payment (and the determination of the amount of such payments) and retain business is subject to compliance with CMS' numerous and complex regulations and requirements that are subject to administrative discretion, review and enforcement. In July 2025, Congress enacted the Budget Reconciliation Act of 2025, which included provisions affecting Medicare and Medicaid, including measures expected to reduce federal Medicaid spending and modify Medicaid eligibility, among other changes. Noncompliance with state and federal laws and regulations may result in significant consequences, including fines and penalties, exclusion from the Medicare and Medicaid programs, corrections of improper payments and criminal penalties.
On March 19, 2025, the Company completed the HCSC transaction. See Note 5 to the Consolidated Financial Statements for further information.
Office of Foreign Assets Control Sanctions and Anti-Money Laundering
We are also subject to regulation by the Office of Foreign Assets Control of the U.S. Department of the Treasury, which administers and enforces economic and trade sanctions against targeted foreign jurisdictions and regimes based on U.S. foreign policy and national security goals. Certain of our products are subject to the Department of the Treasury anti-money laundering regulations under the Bank Secrecy Act. In addition, we are subject to similar regulations in non-U.S. jurisdictions in which we operate.
16
Corporate Practice of Medicine and Other Laws
Many states in which our subsidiaries operate limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals, and business corporations generally may not exercise control over the medical decisions of physicians. Statutes, regulations, and judicial and regulatory interpretations relating to the practice of medicine, fee-splitting between physicians, and referral sources and similar issues vary widely from state to state and are subject to change and varying interpretations. We believe that our health services operations comply with applicable state statutes regarding corporate practice of medicine, fee-splitting and similar issues. However, any enforcement actions by government officials alleging noncompliance with these statutes could subject us to penalties or restructuring or reorganization of our business.
Financial Reporting, Internal Control and Corporate Governance
State regulators closely monitor the financial condition of licensed insurance companies and HMOs. States regulate the form and content of statutory financial statements, the type and concentration of permitted investments, and corporate governance over financial reporting. Our insurance and HMO subsidiaries are required to file periodic financial reports and schedules with regulators in most of the jurisdictions in which they do business as well as annual financial statements audited by independent registered public accounting firms. Certain insurance and HMO subsidiaries are required to file an annual report of internal control over financial reporting with most jurisdictions in which they do business. Insurance and HMO subsidiaries' operations and financial statements are subject to examination by regulators. Many states have expanded regulations relating to corporate governance and internal control activities of insurance and HMO subsidiaries as a result of model regulations adopted by the NAIC with elements similar to corporate governance and risk oversight disclosure requirements under federal securities laws.
Guaranty Associations, Indemnity Funds, Risk Pools and Administrative Funds
Most states and certain non-U.S. jurisdictions require insurance companies to support guaranty associations or indemnity funds that are established to pay claims on behalf of insolvent insurance companies. Some states have similar laws relating to HMOs. In the United States, these associations levy assessments on member insurers licensed in a particular state to pay such claims. Certain states require HMOs to participate in guaranty funds, special risk pools and administrative funds.
Solvency and Capital Requirements
Many states have adopted some form of the NAIC model solvency-related laws and risk-based capital ("RBC") rules for life and health insurance companies and HMOs. The RBC rules recommend a minimum level of capital depending on the types and quality of investments held, the types of business written, and the types of liabilities incurred. If the ratio of the insurer's adjusted surplus to its RBC falls below statutorily required minimums, the insurer could be subject to regulatory actions ranging from increased scrutiny to conservatorship.
In addition, various non-U.S. jurisdictions prescribe minimum surplus requirements that are based upon solvency, liquidity and reserve coverage measures. Our HMOs and life and health insurance subsidiaries, as well as non-U.S. insurance subsidiaries, are compliant with applicable RBC and non-U.S. surplus rules.
Holding Company Laws
Our insurance companies and most of our HMOs are regulated under state insurance holding company laws and regulations, which are largely based on the NAIC’s Insurance Holding Company System Regulatory Act and its companion model regulation. These regulations provide a framework for monitoring risks in insurance groups and generally require registration with the applicable state insurance departments; disclosure of enterprise risk information; and approvals of certain dividends, distributions and affiliate transactions. The regulations also generally require approval for acquisitions of control of an insurance company or HMO and authorize group-wide supervision to assess risk across the holding company structure, including the use of group capital calculation reporting and associated liquidity stress testing. The Cigna Group is subject to such testing as may be required by our lead state regulator.
Marketing, Advertising and Products
In most states, our insurance companies and HMO subsidiaries are required to certify compliance with applicable advertising regulations on an annual basis and comply with certain federal and state marketing, advertising, and communications laws and regulations.
17
Licensing, Registration and Utilization Management Requirements
Our insurance companies and HMO subsidiaries must be licensed by the jurisdictions in which they conduct business, and our international subsidiaries are often required to be licensed when entering new markets or starting new operations in certain jurisdictions. Additionally, certain subsidiaries contract to provide claim administration, utilization management and other related services for the administration of self-insured benefit plans and may be subject to state third-party administration and other licensing requirements and regulation, as well as URAC and other third-party accreditation requirements.
Certain states have adopted pharmacy benefit management registration, licensure or disclosure laws, which may mandate disclosure of various aspects of our financial practices, including those concerning pharmaceutical company revenue, prescribing processes, and client and provider audit terms. States have begun to enact laws exempting certain providers from pre-authorization requirements of insurers; laws standardizing the process for, and restricting the use of, utilization management rules; and laws shortening the time frames within which prescription drug prior authorization determinations must be made. The inability to apply pre-authorization requirements could lead to increased costs to plan sponsors and issuers by way of the provision of unnecessary services. The licensure requirements for our insurance companies and subsidiaries vary by jurisdiction and are subject to change.
Pharmacy and Professional Practice Requirements
State pharmacy professional practice laws, enforced by state boards of pharmacy, govern both the operation of the pharmacy as a licensed facility and the scope of practice of pharmacists and pharmacy technicians. These laws establish the definition of the “practice of pharmacy,” outlining authorized professional functions such as compounding, dispensing, labeling, drug‐therapy management, and patient counseling, while specifying nondiscretionary tasks permitted for pharmacy technicians.
State boards of pharmacy also oversee pharmacy licensure and facility compliance, including requirements related to physical premises, storage conditions, security measures, prescription processing, recordkeeping, and adherence to federal and state controlled‐substance standards. State law further defines operational parameters for pharmacies offering clinical services - such as collaborative drug‐therapy management, immunization programs, or test‐and‐treat protocols by establishing relevant documentation, supervision and procedural requirements.
International Regulations
Our operations outside of the United States expose us to laws of multiple jurisdictions and the rules and regulations of various governing bodies and regulators, including those related to the provision of insurance, financial and other disclosures, the provision of health care-related services, corporate governance, privacy, data protection, data mining, data transfer, intellectual property, labor and employment, consumer protection, direct-to-consumer communications activities, tax, anti-corruption, and anti-money laundering. Foreign laws and rules may include requirements that are different from, or more stringent than, similar requirements in the United States.
Our operations in countries outside of the United States are subject to local regulations of the jurisdictions where we operate. In some cases, they are subject to regulations in the jurisdictions where customers reside, and in all cases, they are subject to the Foreign Corrupt Practices Act ("FCPA").
The FCPA prohibits offering, promising, providing or authorizing others to give anything of value to a foreign government official or employee to obtain or retain business or otherwise secure a business advantage. Outside of the United States, we may interact with government officials in several different capacities: as regulators of our insurance business; as clients or partners who are state-owned or partially state-owned; as health care providers who are employed by the government; as hospitals that are state-owned; and as officials issuing permits in connection with real estate transactions. Violations of the FCPA and other anti-corruption laws may result in severe criminal and civil sanctions as well as other penalties. Countries in which we do business also have anti-corruption laws to which we are subject, such as the UK Bribery Act of 2010. As international regulators often share information, any voluntary disclosures of violations may be shared with authorities in other countries, thus potentially exposing companies to liability and potential penalties in multiple jurisdictions.
Anti-money laundering requirements in countries where we do business also may impose obligations to collect certain information about each customer at time of sale or to risk rank each customer to determine possible future money laundering risk.
Item 1A. RISK FACTORS
As a large global health company operating in a complex industry, we encounter a variety of risks and uncertainties, which could have a material adverse effect on our business, liquidity, results of operations, financial condition or the trading price of our securities. You should carefully consider each of the risks and uncertainties discussed below, together with other information
18
contained in this Form 10-K, including the MD&A. These risks and uncertainties are not the only ones we face. Additional risks and uncertainties not presently known to us or that we currently believe to be immaterial may also adversely affect us. The following risk factors have been organized by category for ease of use; however, many of the risks may have impacts in more than one category. These categories, therefore, should be viewed as a starting point for understanding the significant risks facing us and not as a limitation on the potential impact of the matters discussed. Risk factors are not necessarily listed in order of importance.
Risks Related to Our Business as a Health Company
We must predict, price for and manage health care costs appropriately. We face price competition and other pressures that could compress our margins or result in premiums that are insufficient to cover the cost of services delivered to our customers.
Our profitability depends in part on our ability to accurately predict, price for and effectively manage future health care costs. Relatively small differences between predicted and actual medical costs or utilization rates as a percentage of revenue can result in significant changes in our financial results. In addition to appropriately pricing health care costs, we must accurately manage costs through medical management, product design, negotiation of favorable provider contracts and underwriting criteria. Our health care costs are also affected by external events that we cannot forecast or project and over which we have little or no control, including changes in laws and regulations, costly new treatments, new treatment guidelines, provider billing practices, inflation and changes in customers' health care utilization patterns, pandemics, natural disasters, and other large-scale medical emergencies. If we do not accurately price our health care costs, our business, cash flows, financial condition and results of operations could be materially adversely impacted.
While we compete on the basis of many service- and quality-related factors, we expect that price will continue to be a significant basis of competition. Our client contracts are subject to negotiation as clients seek to contain their costs, including by reducing benefits offered. Increasingly, our clients seek to negotiate performance guarantees that require us to pay penalties if the guaranteed performance standard is not met. Clients can easily move between our competitors and us. Our clients are well-informed and typically have knowledgeable consultants who seek competing bids from our competitors before contract renewal. For example, our Express Scripts client contracts generally have three-year terms and may be subject to periodic renegotiation of pricing terms based on market factors. If one or more of our large clients terminates or does not renew a contract for any reason, or if the provisions of a contract with a large client are modified with terms less favorable to us, our results of operations could be adversely affected, and we could experience a negative reaction in the investment community.
A significant loss of customers or clients resulting from our need to increase or maintain premiums, administrative fees or reimbursement levels could adversely affect our business, cash flows, financial condition and results of operations. In addition, as brokers and benefit consultants seek to enhance their revenue streams, they look to take on services that we typically provide. Each of these events could negatively impact our financial results.
Strong competition within the pharmacy benefit business has generated greater demand for lower product and service pricing, increased revenue sharing, and enhanced product and service offerings. These competitive factors have historically applied pressure on our operating margins and caused many companies, including us, to reduce the prices charged for products and services while sharing with clients a greater portion of the formulary rebates and related fees received from pharmaceutical manufacturers. If we are unable to respond effectively, including through the implementation of a rebate-free model for our pharmacy benefit services clients, these trends could negatively impact our ability to attract or retain clients or sell additional services, which could negatively impact our margins and have a material adverse effect on our business and results of operations. In addition, legislative reforms and regulatory or executive actions related to rebates, reporting, owned pharmacies and other activities may adversely affect our ability to price our pharmacy products and services appropriately, as well as our competitive position, cash flows, financial condition and results of operations.
Premiums in the Cigna Healthcare segment are generally set for a one-year period and are priced well in advance of the date on which the contract commences or renews. Federal and state regulatory agencies may restrict or prevent entirely our ability to implement changes in premium rates or collect certain administrative fees. Fiscal or other concerns related to the government-sponsored programs in which we participate may cause decreasing reimbursement rates, delays in premium payments, restrictions on implementing changes in premium rates or insufficient increases in reimbursement rates. Our participation in health insurance exchanges through our IFP offerings in certain states involves uncertainties associated with mix and volume of business and could adversely affect our results of operations, financial position and cash flows.
19
We operate in a highly competitive and evolving business environment, and our failure to compete effectively or differentiate our products and services from those of our competitors could materially adversely affect our results of operations, financial position and cash flows.
We operate in a highly competitive, evolving and rapidly changing industry. Industry shifts have resulted and could result from, among other things:
•a large intra- or inter-industry merger or industry consolidation;
•strategic alliances;
•new or alternative business models or new government options or offerings;
•continuing consolidation among physicians, hospitals and other health care providers, as well as changes in the organizational structures chosen by physicians, hospitals and health care providers;
•new market entrants, including those not traditionally in the health services industry;
•the ability of larger employers and clients to contract directly with providers;
•technological changes and rapid shifts in the use of technology, such as telehealth and AI;
•the impact or consequences of legislation, executive actions or regulatory changesincluding premium rate increases, public debates over drug pricing, government involvement in drug pricing and purchasing, and public debate over current or proposed legislation;
•impacts to distribution channels, including changes to the United States Postal Service or the consolidation of shipping carriers;
•increased drug acquisition cost or unexpected changes to drug pricing trend;
•changes in the generic/biosimilar drug market or the failure of new generic/biosimilar drugs to come to market; and
•changes in utilization of health care, prescription drugs or other covered services and items, including under risk-based contracts in the health benefit management market and for those businesses that utilize risk adjustment methodology.
Any significant shifts in the structure of the industry could alter industry dynamics and adversely affect our ability to attract or retain clients and customers. Our failure to anticipate or appropriately adapt to changes in the industry could negatively impact our competitive position and adversely affect our business and results of operations.
We must remain competitive to attract new customers, retain existing customers and further integrate additional product and service offerings. We are subject to significant market pressures brought about by customer and client needs, legislative and regulatory developments, and other market factors. Our competitors may have greater, better or more established capabilities, resources, market share, reputation or business relationships, or lower profit margin or financial return expectations. Unless we can demonstrate greater value to our clients through innovative and cost-effective product and service offerings in the rapidly changing health care industry, we may be unable to remain competitive, which could have a material adverse effect on our business, results of operations, financial position and cash flows.
Additionally, to succeed in this highly competitive marketplace, we must maintain a strong reputation. Increasingly, our customers, clients and investors consider our efforts on a variety of matters that could impact our stakeholders, including our employees and the communities in which we operate. Our reputation may be negatively impacted by a failure to meet customer expectations for consistent, transparent, high-quality and accessible care or by other significant events, including a failure to execute on customer or client contracts or strategic or operational initiatives, failure to comply with applicable laws or regulations, or failure to innovate and deliver cost-effective products and services that demonstrate greater value to our customers. Negative publicity may come as a result of adverse media coverage, litigation against us and other industry participants, the ongoing public debates over the affordability, accessibility and transparency of health care, and social media and other media relations activities.
Changes in drug pricing or industry pricing benchmarks could materially impact our financial performance.
Contracts in the prescription drug industry, including our contracts with retail pharmacy networks and our pharmacy and specialty pharmacy clients, generally use pricing metrics published by third parties as benchmarks to establish pricing for prescription drugs. If these benchmarks are no longer published by third parties; if we, or our contractual partners, adopt other pricing benchmarks for establishing prices within the industry; if legislation or regulation requires the use of other pricing benchmarks; or if future changes in drug prices substantially deviate from our expectations, the short- or long-term impacts may have a material adverse effect on our business and results of operations. Additionally, laws such as the Inflation Reduction Act have granted CMS the ability to negotiate drug prices for high-cost Medicare Part D and Part B drugs, and other federal and state legislative proposals and executive actions can lead to residual effects as drug companies adjust pricing strategies for broader marketplaces, impacting which medications are prioritized.
20
If we lose our relationship with one or more key pharmaceutical manufacturers, or if the payments made or discounts provided by pharmaceutical manufacturers decline, our business and results of operations could be adversely affected.
We maintain relationships with numerous pharmaceutical manufacturers, which provide us with, among other things, discounts for drugs we purchase to be dispensed from our home delivery and specialty pharmacies; discounts, in the form of rebates, for drug utilization; fees for administering rebate programs, including invoicing, allocating and collecting rebates; fees for services provided to pharmaceutical manufacturers by our specialty pharmacies; and access to limited distribution specialty pharmaceuticals by our specialty pharmacies.
Our contracts with pharmaceutical manufacturers are typically nonexclusive and terminable on relatively short notice by either party. The consolidation of pharmaceutical manufacturers, the termination or material alteration of our relationships, or our failure to renew contracts on market competitive terms could have a material adverse effect on our business and results of operations. In addition, arrangements between payors and pharmaceutical manufacturers have been the subject of debate in various public and governmental forums. Our announced commitment to developing a rebate-free model may alter manufacturer contracting dynamics. Adoption of new laws, rules or regulations, or changes in - or new interpretations of - existing laws, rules or regulations relating to any of these programs could materially adversely affect our business and results of operations.
If significant changes occur within the pharmacy provider marketplace, or if other issues arise with respect to our pharmacy networks, including the loss of or adverse change in our relationship with one or more key pharmacy providers, our business and results of operations could be adversely affected.
More than 65,000 pharmacies participated in one or more of our networks as of December 31, 2025. The 10 largest retail pharmacy chains represent approximately 47% of the total number of stores in our largest network. In certain geographic areas of the United States, our networks may be comprised of higher concentrations of one or more large pharmacy chains. Contracts with retail pharmacies are generally nonexclusive and are terminable on relatively short notice by either party. If one or more of the larger pharmacy chains terminates its relationship with us, or is able to renegotiate terms substantially less favorable to us, our customers' access to retail pharmacies or our business could be materially adversely affected. We could also face harm to our relationships with large pharmacy chains depending upon changing competitive conditions. Changes in the overall composition of our pharmacy networks, including changes due to legislative, regulatory or executive action, or reduced pharmacy access under our networks, could have a negative impact on our claims volume or our competitiveness in the marketplace, which could cause us to fall short of certain guarantees in our contracts with clients or otherwise materially adversely impact our business or results of operations.
The reserves we hold for expected medical claims are based on estimates that involve an extensive degree of judgment and are inherently variable. If actual claims exceed our estimates, our operating results could be materially adversely affected, and our ability to take timely corrective actions to contain future costs may be limited.
We maintain and record medical claims reserves in our Consolidated Balance Sheets for estimated future payments. Our estimates of health care costs payable are based on a number of factors, including historical claim experience. This estimation process requires extensive judgment. Considerable variability is inherent in such estimates, and the accuracy of the estimates is highly sensitive to a number of factors including, among others, changes in medical claims submission and processing patterns or procedures; changes in customer base and product mix; changes in the utilization of prescription drugs, medical or other covered items or services; changes in medical cost trends; changes in our health management practices; changes in regulations; and the introduction of new benefits and products. If we are not able to accurately and promptly anticipate and detect medical cost trends, our ability to take timely corrective actions to limit future costs and reflect our current benefit cost experience in our pricing process may be limited. Additionally, we must estimate the amount of rebates payable by us under the ACA's and CMS' minimum loss ratio rules and the amounts payable by us to, and receivable by us from, the federal government under the ACA's remaining premium stabilization program. Because establishing reserves is an inherently uncertain process involving estimates of future losses, there can be no certainty that ultimate losses will not exceed existing reserves, which may adversely affect our results of operations, financial position and cash flows.
If we fail to develop and maintain satisfactory relationships with health care payors, physicians, hospitals and other health service providers and with, producers and consultants, our business and results of operations may be adversely affected.
We contract with or employ physicians, hospitals and other health service providers and facilities to provide health services to our customers and patients. We also contract with health care payors (as a service provider to those payors). Our results of operations depend on our ability to contract for these services at competitive prices. In any particular market, physicians, hospitals and health service providers may enter into exclusive arrangements with competitors or simply refuse to contract with us, demand higher payments, or take other actions that could result in higher medical costs or less desirable products or services for our customers. In some markets, certain providers, particularly hospitals, physician/hospital organizations and multi-specialty physician groups, may have significant or controlling market positions that could result in a diminished bargaining position for us. If providers refuse to
21
contract with us, use their market position to negotiate more favorable contracts or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially adversely affected. Additionally, certain regulations may impact our ability to obtain competitive prices. We establish collaborative care arrangements with physician groups, specialist groups, independent practice associations, hospitals and health care delivery systems to improve quality outcomes and medical cost performance. If such collaborative arrangements do not result in the lower medical costs that we project or do not improve value to our customers and clients, if we fail to attract health care providers to such arrangements or if we are less successful at implementing such arrangements than our competitors, our attractiveness to customers may be reduced and our ability to profitably grow our business or improve value for our customers, patients and clients may be adversely affected.
Our ability to develop and maintain satisfactory relationships with providers may also be negatively impacted by other factors not associated with us, such as increasing pressure on revenue and other pressures on health care providers; increasing consolidation activity among hospitals, physician groups and providers; and changes in Medicare or Medicaid reimbursement levels or programming. Many factors, including continuing consolidation among physicians, hospitals and other providers; the growth of accountable care organizations; vertical integration of providers and other entities; changes in the organizational structures chosen by physicians, hospitals and providers; new market entrants, including those not traditionally in the health services industry; and the use of new modes of health care delivery, including virtual care services, may affect the way providers interact with us and may change the competitive landscape in which we operate. In some instances, these organizations may compete directly with us, potentially affecting the way we price our products and services or causing us to incur increased costs if we change our operations to be more competitive.
Out-of-network providers for non-Medicare services are not limited by any agreement with us in the amounts they bill. While benefit plans place limits on the amount of charges that will be considered for reimbursement and regulations seek to prescribe payment levels, establish methodologies and dispute resolution processes, the outcome of disputes where we do not have a provider contract may cause us to pay higher medical or other benefit costs than we project.
Additionally, our products and services, including a broad range of medical, pharmacy, specialty health, and ancillary benefit offerings, are sold in part through non-exclusive producers and consultants for whose services and allegiance we compete. Our sales could be materially adversely affected if we are unable to attract, retain and support such independent producers and consultants or if our enterprise sales strategy is not appropriately aligned across product lines and producer relationships.
In managing medical practices and operating pharmacies, onsite clinics and other types of medical facilities, we may be subject to additional liability that could result in significant time and expense.
In addition to contracting with physicians and other health care providers for services, we employ physicians, pharmacists, nurses and other health care providers at our home delivery and specialty pharmacies, onsite low-acuity and primary care practices that we manage and operate for our customers, and certain clinics for our employees. We also provide virtual primary care, urgent care, dermatology services and behavioral health services through clinicians that we employ, as well as through third-party contractors. As such, we may be subject to liability for certain acts, omissions or injuries caused by our employees or agents, or that occur at one of these practices, pharmacies or clinics. The defense of any actions may require diverting personnel and other resources and incurring significant costs that could have a material adverse effect on our business, results of operations, financial condition, liquidity and reputation.
There are various risks associated with participating in government-sponsored programs and providing services to payors who participate in government-sponsored programs, including dependence upon government funding, compliance with government contracts, and increased regulatory oversight and enforcement.
Our Evernorth Health Services business provides services to government entities and payors participating in government health care programs, and our relationships with these government entities are subject to laws and regulations regarding government contracts. Additionally, through our U.S. Healthcare business, we contract with CMS and various state government agencies.
Our revenues from government-funded programs, including our government clients, are dependent, in whole or in part, upon annual funding from the federal government or applicable state or local governments. Funding for these programs is dependent on many factors outside our control, including general economic conditions, continuing government efforts to contain health care costs, budgetary constraints at the federal or applicable state or local level, and general political issues and priorities. These entities generally have the right to not renew or to cancel their contracts with us on short notice without cause or if funds are not available. Unanticipated changes in funding, such as the application of sequestration by the federal or state governments, retroactive rate adjustments, a delay by Congress in raising the federal debt ceiling, or the failure to provide for continued appropriations or regular ongoing scheduled payments to us, could substantially reduce our revenues or profitability or impact our liquidity.
22
Additionally, if we fail to comply with applicable state or federal regulatory or contractual requirements, including data submission, enrollment and marketing, provider network adequacy, provider directory accuracy, quality measures, claims payment, continuity of care, timely and accurate processing of appeals and grievances, oversight of first-tier downstream and related entities, and call center performance, we may be subject to administrative actions, including enrollment sanctions or contract termination, fines or other penalties or enforcement actions that could materially impact our profitability.
Legal, Regulatory and Public Policy Risks Arising from Our Business
Our business is subject to substantial government regulation, and new laws or regulations or changes in existing laws or regulations could have a material adverse effect on our business, results of operations, financial condition and liquidity.
Our business is regulated at the federal, state and international level. The laws and rules governing our business and related interpretations are increasing in number and complexity, are subject to frequent change, and can be inconsistent or in conflict with each other. Noncompliance with applicable regulations by us or third-party vendors could have material adverse effects on our business, results of operations, financial condition, liquidity and reputation.
We must identify, assess and respond to new trends in the legislative and regulatory environment, as well as comply with the various existing laws and regulations applicable to our business and respond to policymakers and enforcement agencies accordingly. We expect federal and state governments to continue to enact legislative and regulatory reforms that will or could materially impact various aspects of the health services system, including pharmacy benefits manager, drug pricing or insurance market reforms. These reforms could result in material changes to the way we conduct our business and could impact the market for our products.
Existing or future laws, regulations, actions by governmental or regulatory authorities, or judgments could force us to change how we conduct our business; affect the products and services we offer and where we offer them; restrict revenue and enrollment growth; increase our costs, including medical, operating, health care technology and administrative costs; increase our liability; and require enhancements to our compliance infrastructure and internal controls environment. For example, we are required to obtain and maintain approvals from state boards of pharmacy, departments of insurance, and other federal and state regulatory agencies to, among other things, market many of our products, expand into additional geographic or product markets, increase prices for certain regulated products, and consummate some of our acquisitions and dispositions. Delays in obtaining or failure to obtain or maintain these approvals could reduce our revenue or increase our costs. Additionally, we must maintain licenses and registrations in the jurisdictions in which we conduct business, and the suspension, material adverse modification or termination of such licenses and registrations could adversely affect operations. Such licensure subjects many of our business operations and products to state regulation, as well as risks associated with doing business in those jurisdictions. Failure to effectively implement or adjust our strategic and operational initiatives, such as reducing operating costs, adjusting premium pricing or benefit design, or transforming our business model in response to new laws, regulatory changes or executive actions may have a material adverse effect on our results of operations, financial condition and cash flows.
Our effective tax rate or tax payments could also be adversely affected by new laws or regulations, both within the United States and in other foreign jurisdictions in which we operate. While we believe that our historical tax positions are consistent with applicable laws, regulations and existing precedent, our tax positions could be challenged by relevant tax authorities, and we may not be successful in any such challenge. The market price of our securities may react to the announcement of such proposals.
Customers, investors, employees and other stakeholders have focused on corporate governance, environmental stewardship and social matters. Environmental, social and governance-related laws and regulations, including those aimed at restricting the consideration of these factors by companies and requiring climate- and sustainability-related disclosures, and related stakeholder expectations have resulted, and may in the future result, in increased expenses and management time and attention spent complying with or meeting such laws, regulations or expectations. Overall, environmental, social and governance matters, and related stakeholder reactions, which may be conflicting or divergent, may impact our reputation and have other business impacts which could adversely affect our business.
For more information on regulations affecting our business, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.
If we fail to comply with applicable privacy, security and data laws, regulations and standards, our business and reputation could be materially adversely affected.
Most of our activities involve the receipt, use, storage, transmission or other processing of a substantial amount of PII, including PHI, as well as financial information (including payment card information) and other confidential and sensitive information about our clients and employees. The processing of such information is regulated at the federal, state, international and industry levels, and requirements are imposed on us by industry standards and contracts with clients. In some cases, such laws, rules, regulations, industry
23
standards and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements.
At the federal level, we are subject to, among other laws and regulations, HIPAA, which requires business associates as well as covered entities to comply with specified privacy and security requirements. While we endeavor to provide appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity clients and, as a result, collect, receive, use, disclose, transmit and maintain PHI in order to provide services to these customers. If HHS alleges or finds noncompliance with HIPAA requirements or implements an enforcement action against us, it could have an adverse effect on our results of operations, financial position, cash flows and reputation. For example, in 2025, we responded to a voluntary HIPAA security rule audit from HHS's Office for Civil Rights ("OCR"). As participation in this audit was voluntary, the information provided did not result in any HIPAA enforcement action or civil monetary penalty; however, any serious compliance issues could open up subsequent compliance reviews that could include a range of remedies from OCR.
Additionally, we are, or may become, subject to U.S. state and international laws and regulations, as well as industry standards such as PCI DSS. These laws, regulations, rules, industry standards and contractual requirements are subject to change and the regulatory environment surrounding data security and privacy is increasingly demanding. Compliance with existing or new privacy, security and data laws, regulations and requirements may result in increased operating costs and may constrain or require us to alter our business model or operations. For more information on privacy regulations to which we are subject, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.
Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of PII, whether by us or by one of our third-party service providers, could materially adversely affect our business and reputation, including our results of operations, financial position and cash flows.
We face risks related to litigation, regulatory audits and investigations.
We are routinely involved in legal matters arising from our health services business, including but not limited to claims related to the dispensing of pharmaceutical products by our home delivery and specialty pharmacies; pharmacy benefit management services, such as formulary management services; health benefit management services; and provider services. Our pharmacy services operations are subject to liability arising from clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors.
We also have incurred and likely will continue to incur liability for practices and claims related to our health care business, such as marketing misconduct; failure to timely or appropriately pay for or provide health care services; provider network structure; poor outcomes for care delivered or arranged; provider disputes, including disputes over compensation or contractual provisions; ERISA claims; allegations related to calculations of cost-sharing; and claims related to our administration of self-funded business.
In addition, we are routinely involved in numerous claims, lawsuits, regulatory audits, investigations and other legal matters arising, for the most part, in the ordinary course of business. These legal matters could include civil claims (including tort and breach of contract claims) as well as claims arising from alleged violations of certain laws (such as consumer protection or false claims act laws). There are currently, and may be in the future, attempts to bring class action lawsuits against the Company and other companies in our industry; individual plaintiffs also may bring multiple claims regarding the same subject matter against us and other companies in our industry.
In addition, various government agencies have conducted investigations, inquiries and audits into certain pharmacy benefit management practices, which in certain instances have resulted in litigation or other adverse outcomes for our Company. For example, the FTC has released two staff reports on PBMs and the accessibility and affordability of prescription drugs. In September 2024, the FTC filed an administrative complaint against Express Scripts and two other PBMs, among others, for allegedly engaging in anticompetitive and unfair rebate practices related to insulin drug pricing. In February 2026, we reached a final settlement with the FTC, which resolved all FTC matters and litigation without a monetary penalty, finding of fault or admission of liability. The settlement requires, among other things, updates to our business practices related to affordability of medications of Express Scripts customers.
We are frequently the subject of regulatory market conduct and other reviews, audits and investigations by state insurance, health and welfare and pharmacy departments; attorneys general; the DOJ; the FTC; CMS; the DOL; the HHS-OIG; and comparable authorities in foreign jurisdictions. Additionally, we have previously been, and may in the future be, subject to qui tam actions in which the government may or may not intervene. Although our Medicare Advantage and Medicare Part D businesses were included in the HCSC
24
transaction, we may have indemnification obligations in certain circumstances related to regulatory audits that were ongoing at the time that transaction was completed. There also continues to be heightened review by federal and state regulators of business and reporting practices within the health services industry, including with respect to claims payment and related escheat practices, and increased scrutiny by other federal and state governmental agencies (such as state attorneys general) empowered to bring criminal actions in circumstances that could have previously given rise only to civil or administrative proceedings.
Court decisions and legislative and regulatory activities may increase our exposure to any type of claim. In some cases, substantial noneconomic or punitive damages may be sought. We procure insurance coverage to cover some of these potential liabilities, and we also self-insure a significant portion of our litigation risks. While we maintain some third-party insurance coverage, including excess liability insurance with third-party insurance carriers, certain liabilities or types of damages, such as punitive damages, may not be covered by insurance, insurers may dispute coverage, or the amount of insurance may be insufficient to cover the entire damages awarded. Resolving disputes is often expensive and disruptive, regardless of the outcome. Additionally, it is possible that the resolution of current or future legal matters and claims could result in changes to our industry and business practices, losses material to our results of operations, financial condition, and liquidity or damage to our reputation.
Moreover, regulatory investigations and audits have resulted in, and could result in, sanctions or changes to our business practices, including retroactive adjustments to certain premiums, corporate integrity agreements, restrictions on our ability to participate in government programs or exclusion from such programs, and our ability to market certain products or engage in business-related activities. We cannot predict what effect, if any, such government investigations and audits may ultimately have on us or on the industry in general. However, we will likely continue to experience government scrutiny and audit activity, which has resulted in, and may result in, civil penalties. Any failure, or alleged failure, to comply with various state and federal health care laws and regulations, including those directed at preventing fraud, waste and abuse in government-funded programs, has resulted in, and could in the future result in, investigations or litigation, such as actions under the federal False Claims Act and similar whistleblower statutes under state laws.
In addition, disclosure of an adverse investigation or audit or the imposition of fines or other sanctions could negatively affect our reputation in certain markets and make it more difficult for us to sell our products and services.
A description of material pending legal actions and other legal and regulatory matters is included in Note 22 to the Consolidated Financial Statements included in this Form 10-K. The outcome of litigation and other legal or regulatory matters is always uncertain.
Extensive health care regulation and enforcement, including fraud, waste and abuse laws, could increase our compliance costs, restrict our operations and expose us to significant liability.
Federal and state governments have made investigating and prosecuting health care and other insurance fraud, waste and abuse a priority. Fraud, waste and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of customers, billing for unnecessary medical services, improper marketing and violations of patient privacy rights. Some of our businesses are also subject to federal and state laws and regulations that may impact our relationships with health care providers and customers, including laws on self-referrals, beneficiary inducements, false claims, fee-splitting, telemedicine, corporate practice of medicine, dispensing, packaging, fulfillment and distribution of controlled substances, other pharmaceutical products and medical devices, medical malpractice, consumer protection, product liability, narrow networks, provider tiering programs, provider contracts, overpayments, reimbursement of out-of-network claims, and licensure. The regulations and contractual requirements applicable to us are complex and subject to change and may affect our ability to market or provide our products or services. In addition, ongoing vigorous law enforcement, a highly technical regulatory scheme, and the Dodd-Frank Act and related regulations enhance regulators' enforcement powers and whistleblower incentives and protections. Our compliance efforts in this area will continue to require significant resources, and failure to comply with such regulation could adversely affect our reputation and also expose us to litigation and other proceedings, fines and penalties.
Operational Risks
Our business depends on our ability to effectively invest in, improve and properly maintain the uninterrupted operation, availability and data integrity of our information technology and other business systems.
Our business is highly dependent on maintaining effective information systems, as well as the integrity and timeliness of the data we use to serve our customers and health care providers and to operate our business. If our data were found to be inaccurate or unreliable due to fraud or other error, or if we, or any of the third-party providers or subcontractors that we or they engage, were to fail to maintain information systems and data integrity effectively, we could experience operational disruptions that may impact our clients, customers and health care providers and hinder our ability to provide or establish appropriate pricing for products and services, retain
25
and attract clients and customers, establish reserves, report financial results accurately and in a timely manner, and maintain regulatory compliance, among other things.
Any failure or disruption of our performance of, or our ability to perform, key business functions, including through unavailability or cyberattack of our information technology systems or those of third parties (including cloud service providers), could cause slower response times, decreased levels of service satisfaction and harm to our reputation. Our systems interface with and depend on third-party systems, and we could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption.
While we have adopted, and continue to enhance, business continuity and disaster recovery plans and strategies, there is no guarantee that such plans and strategies will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and clients, which could have material adverse effects on our business and results of operations.
Our information technology strategy and execution are critical to our continued success. We must continue to invest in and maintain long-term solutions that will enable us to anticipate customer needs and expectations, enhance the customer experience, act as a differentiator in the market, and protect against cybersecurity risks and threats or other events that could disrupt our information technology systems. Our success is dependent, in large part, on maintaining the effectiveness of existing technology systems and continuing to deliver and enhance technology systems that support our business processes in a cost- and resource-efficient manner. Increasing regulatory and legislative changes will place additional demands on our infrastructure that could have a direct impact on resources available for other strategic initiatives. In addition, recent trends toward greater consumer engagement in health care require new and enhanced technologies, including applications for mobile devices. Connectivity among technologies is becoming increasingly important. We must also develop new systems to meet current market standards and keep pace with continuing changes in information processing technology, evolving industry and regulatory standards, and customer needs. Failure to do so may present compliance challenges and impede our ability to deliver services in a competitive manner. Further, because system development projects are long-term in nature, they may be more costly than expected to complete and may not deliver the expected benefits upon completion. Our failure to effectively invest in, implement improvements to and properly maintain the uninterrupted operation, availability and data integrity of our systems could adversely affect our results of operations, financial position, cash flow and internal controls over financial reporting.
As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages.
Our business depends on our clients' and customers' willingness to entrust us with their PII, including PHI, that is subject to various privacy and data security laws and regulations, including data breach notification laws. Computer networks or systems may be vulnerable to intrusion, hacking, computer viruses or malware (including ransomware), denial of service attacks, credential stuffing, phishing and other social engineering attacks, supply chain attacks, programming errors, fraud or malice on the part of our employees or vendors, human error, terrorism, and other attacks by third parties or similar disruptive problems. We have been, and will likely continue to be, the target of computer viruses or other malicious codes, unauthorized access, cyberattacks or other computer-related penetrations. There have been, and will continue to be, large-scale cyberattacks within the health services industry. For example, Change Healthcare, a health technology company owned by UnitedHealth Group and a service provider for certain of our pharmacy benefit management services, was the victim of a ransomware attack in February 2024. This resulted in limited disruption of certain of our services and necessitated security validations for certain systems before we reconnected with Change Healthcare to resume such services. Additionally, hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects, software bugs or errors or other problems that could unexpectedly compromise information technology. Human or technological error has resulted in, and could in the future result in, for example, unauthorized access to and acquisition, disclosure, modification, misuse, loss or destruction of company, customer, or other third-party data or systems; theft of sensitive, regulated or confidential data, including PII and intellectual property; the loss of access to critical data or systems through ransomware, destructive attacks or other means; and business delays, service or system disruptions, or denials of service.
As we increase the amount of PII that we store and share digitally, our exposure to unauthorized uses and disclosures and data privacy and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss, or unauthorized access or acquisition or misappropriation of proprietary information or PII. The cost of attempting to protect against these risks also increases. The health care data ecosystem is complex and requires data exchange with vendors, business partners, health care professionals, the government and others. If disruptions, data disclosures, security incidents or breaches are not detected quickly, their effect could be compounded. We have dedicated significant resources to implement privacy and security technologies, processes and procedures to protect PII and
26
provide employee awareness training around phishing, malware and other cyber risks; however, such measures may not be effective against all types of security incidents.
Cybersecurity threats are rapidly evolving, and those threats and the means for obtaining access to our proprietary systems are becoming increasingly sophisticated. Cyberattacks can originate from a wide variety of sources, including terrorists; nation states; nation-state supported actors; organized criminal groups; “hacktivists;” internal actors; or third parties, such as external service providers. The techniques used change frequently or are often not recognized until after they have been launched. For example, there continues to be an increase in new financial fraud schemes akin to ransomware attacks on large companies, whereby a cybercriminal installs a type of malicious software, or malware, that prevents a user or enterprise from accessing computer files, systems or networks and demands payment of a ransom for their return. Such threats also may see their frequency increased, and effectiveness enhanced, by the use of AI. Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose or inadvertently provide access to systems in order to gain access to our data or that of our customers. In addition, while we have certain standards for all vendors that provide services to us, our vendors and, in turn, their own service providers may become subject to the same types of security breaches. Finally, our offices may be vulnerable to security incidents or security attacks, acts of vandalism or theft, misplaced or lost data, human error or similar events that could negatively affect our systems and our customers' and clients' data.
The costs to eliminate or address security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of customers. As security threats continually evolve, we may be required to devote additional resources to modify or enhance our operational or security systems and networks and our cybersecurity program.
In addition, the unauthorized access to and the acquisition, use, disclosure or dissemination of information about us, our customers or other third parties could expose our customers and their private information to the risk of financial or medical identity theft. Unauthorized access to and the acquisition, use, disclosure or dissemination of information about our business and strategy could also negatively affect the achievement of our strategic initiatives. Such events could cause us to breach our contractual obligations and violate applicable laws. Any actual or perceived data security incident could negatively affect our ability to compete, our reputation, our customer base and our revenues and could expose us to mandatory disclosure requirements; government investigations, litigation and other enforcement proceedings; material fines, penalties or remediation costs; compensatory, special, punitive or statutory damages; consent orders; or other adverse actions, any of which could adversely affect our business, results of operations, financial condition or liquidity.
Our use of artificial intelligence and machine learning present regulatory and legal challenges that could negatively affect our business and our reputation.
Our use of AI and ML technologies, as well as more recent technological advances in AI/ML, pose risks to us and subject us to new and existing laws and regulations. The use of generative AI, a relatively new and emerging technology still in the early stages of commercial use, potentially exposes us to additional risks, such as damage to our reputation, competitive position, and business, legal and regulatory risks and additional costs. For example, generative AI has been known to produce false or “hallucinatory” inferences or output. Certain generative AI uses ML and predictive analytics, which can produce inaccurate, incomplete or misleading content; unintended biases and other discriminatory or unexpected results; or errors and inadequacies, any of which may not be easily detectable by us or any of our related service providers. Accordingly, while AI systems may help provide more tailored or personalized user experiences, if the content, analyses or recommendations that AI systems assist in producing on our platform are, or are perceived to be, deficient, inaccurate, biased, unethical or otherwise flawed, our reputation, competitive position and business may be materially and adversely affected.
While we are committed to responsible use of AI/ML and following applicable laws and regulations, and while we have made progress developing governance as to use of AI/ML by our organization, any failure to use AI/ML responsibly and to adhere to such laws, regulations and governance could have a material unfavorable effect on our business, results of operations and financial condition. Depending on how existing laws and regulations are interpreted, and as new laws go into effect, we may have to make changes to our business practices to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to retrain our AI/ML, require us to comply with outside standards, or cease or limit our use of AI/ML. We may not be able to adequately anticipate or respond to these evolving laws and regulations, and we may need to expend additional resources to adjust our offerings in certain jurisdictions if applicable legal frameworks are inconsistent across jurisdictions. Moreover, because these technologies are highly complex and rapidly developing, it is not possible to predict all of the legal or regulatory risks that may arise relating to our use of such technologies.
Our use of AI/ML technologies has resulted and could continue to result in additional compliance costs, regulatory investigations and actions, and lawsuits. For example, we are currently subject to litigation claiming that we improperly used AI in the claims evaluation
27