UNH GOVERNMENT REGULATION

Our businesses are subject to comprehensive U.S. federal and state and international laws and regulations. We are regulated by agencies which generally have discretion to issue regulations and interpret and enforce laws and rules. U.S. federal and state and international governments continue to consider and enact various legislative and regulatory proposals which could materially impact certain aspects of the health care system. New laws, regulations and rules, or changes in the interpretation of existing laws, regulations and rules, including as a result of changes in the political environment, could adversely affect our businesses.


UNH GOVERNMENT REGULATION

See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to our compliance with U.S. federal and state and international laws and regulations.


UNH U.S. Federal Laws and Regulation

When we contract with the federal government, we are subject to federal laws and regulations relating to the award, administration and performance of U.S. government contracts. CMS regulates our UnitedHealthcare businesses and certain aspects of our Optum businesses. Payments by CMS to our businesses are subject to regulations, including those governing fee-for-service and the submission of information relating to the health status of enrollees for purposes of determining the amounts of certain payments to us. CMS also has the right to audit our performance to determine our compliance with CMS contracts and regulations and the quality of care we provide to Medicare beneficiaries. Our commercial business is further subject to CMS audits related to medical loss ratios (MLRs) and risk adjustment data.


UNH U.S. Federal Laws and Regulation

UnitedHealthcare Community & State has Medicaid and CHIP contracts, which are subject to federal regulations regarding services to be provided to Medicaid enrollees, payment for those services and other aspects of these programs. There are many regulations affecting Medicare and Medicaid compliance, and the regulatory environment with respect to these programs is complex.


UNH U.S. Federal Laws and Regulation

Our businesses are also subject to laws and regulations relating to consumer protection, anti-fraud and abuse, anti-kickbacks, false claims, prohibited referrals, inappropriate reduction or limitation of health care services, anti-money laundering, securities and antitrust compliance.


UNH U.S. Federal Laws and Regulation

Privacy, Security and Data Standards Regulation. Certain of our operations are subject to regulation under the administrative simplification provisions of the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA), which apply to both the group and individual health insurance markets, including self-funded employee benefit plans. Federal regulations related to HIPAA contain minimum standards for electronic transactions and code sets and for the privacy and security of protected health information.


UNH U.S. Federal Laws and Regulation

Our businesses must comply with the Health Information Technology for Economic and Clinical Health Act (HITECH) which regulates matters relating to privacy, security and data standards. HITECH imposes requirements on uses and disclosures of


UNH U.S. Federal Laws and Regulation

health information; includes contracting requirements for HIPAA business associate agreements; extends parts of HIPAA privacy and security provisions to business associates; adds federal data breach notification requirements for covered entities and business associates and reporting requirements to HHS and the Federal Trade Commission (FTC) and, in some cases, to the local media; strengthens enforcement and imposes higher financial penalties for HIPAA violations and, in certain cases, imposes criminal penalties for individuals, including employees. In the conduct of our business, depending on the circumstances, we may act as either a covered entity or a business associate.


UNH U.S. Federal Laws and Regulation

The use and disclosure of individually identifiable health data by our businesses are also regulated in some instances by other federal laws, including the Gramm-Leach-Bliley Act (GLBA) or state statutes implementing GLBA. These federal laws and state statutes generally require insurers to provide customers with notice regarding how their non-public personal health and financial information is used and the opportunity to “opt out” of certain disclosures before the insurer shares such information with a third party, and generally prescribe safeguards for the protection of personal information. Neither the GLBA nor HIPAA privacy regulations preempt more stringent state laws and regulations, which may apply to us, as discussed below. Federal consumer protection laws may also apply in some instances to privacy and security practices related to personally identifiable information.


UNH U.S. Federal Laws and Regulation

ERISA. The Employee Retirement Income Security Act of 1974, as amended (ERISA), regulates how our services are provided to or through certain types of employer-sponsored health benefit plans. ERISA is a set of laws and regulations subject to interpretation by the U.S. Department of Labor (DOL) as well as the federal courts. ERISA sets forth standards on how our business units may do business with employers who sponsor employee health benefit plans, particularly those who maintain self-funded plans. Regulations established by the DOL subject us to additional requirements for administration of benefits, claims payment and member appeals under health care plans governed by ERISA.


UNH State Laws and Regulation

Health Care Regulation. Our insurance and HMO subsidiaries must be licensed by the jurisdictions in which they conduct business. All of the states in which our subsidiaries offer insurance and HMO products regulate those products and operations. The states require periodic financial reports and establish minimum capital or restricted cash reserve requirements. The National Association of Insurance Commissioners (NAIC) has adopted model regulations, which require expanded governance practices and risk and solvency assessment reporting. Most states have adopted these or similar measures to expand the scope of regulations relating to corporate governance and internal control activities of HMOs and insurance companies. We are required to maintain a risk management framework and file a confidential self-assessment report with state insurance regulators. We file reports annually with Connecticut, our lead regulator, and with New York, as required by the state’s regulation.


UNH State Laws and Regulation

Our health plans and insurance companies are regulated under state insurance holding company regulations. Such regulations generally require registration with applicable state departments of insurance and the filing of reports describing capital structure, ownership, financial condition, certain affiliated transactions and general business operations. Most state insurance holding company laws and regulations require prior regulatory approval of acquisitions and material affiliated transfers of assets, as well as transactions between the regulated companies and their parent holding companies or affiliates. These laws may restrict the ability of our regulated subsidiaries to pay dividends to our holding companies.


UNH State Laws and Regulation

Some of our business activity is subject to other health care-related regulations and requirements, including PPO, Managed Care Organization (MCO), utilization review (UR), TPA, pharmacy care services, durable medical equipment or care provider-related regulations and licensure requirements. These regulations differ from state to state and may contain network, contracting, product and rate, licensing and financial and reporting requirements. Health care-related laws and regulations set specific standards for delivery of services, appeals, grievances and payment of claims, adequacy of health care professional networks, fraud prevention, protection of consumer health information, pricing and underwriting practices and covered benefits and services. State health care anti-fraud and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of members, billing for unnecessary medical services and improper marketing. Certain of our businesses are subject to state general agent, broker and sales distribution laws and regulations. UnitedHealthcare Community & State and certain of our Optum businesses are subject to regulation by state Medicaid agencies which oversee the provision of benefits to our Medicaid and CHIP beneficiaries and to our beneficiaries dually eligible for Medicare and Medicaid. We also contract with state governmental entities and are subject to state laws and regulations relating to the award, administration and performance of state government contracts.


UNH State Laws and Regulation

State Privacy and Security Regulations. A number of states have adopted laws and regulations which may affect our privacy and security practices, such as state laws governing the use, disclosure and protection of social security numbers and protected health information or which are designed to implement GLBA or protect credit card account data. State and local authorities increasingly focus on the importance of protecting individuals from identity theft, with a significant number of states enacting laws requiring businesses to meet minimum cyber-security standards and notify individuals of security breaches involving personal information. State consumer protection laws may also apply to privacy and security practices related to personally identifiable information, including information related to consumers and care providers. Different approaches to state privacy


UNH State Laws and Regulation

and insurance regulation and varying enforcement philosophies may materially and adversely affect our ability to standardize our products and services across state lines. See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to compliance with state privacy and security regulations.


UNH State Laws and Regulation

Corporate Practice of Medicine and Fee-Splitting Laws. Certain of our businesses function as direct medical service providers and, as such, are subject to additional laws and regulations. Some states have corporate practice of medicine laws prohibiting specific types of entities from practicing medicine or employing physicians to practice medicine. Moreover, some states prohibit certain entities from engaging in fee-splitting practices, which involve sharing in the fees or revenues of a professional practice. These prohibitions may be statutory or regulatory, or may be imposed through judicial or regulatory interpretation. The laws, regulations and interpretations in certain states have been subject to limited judicial and regulatory interpretation and are subject to change.


UNH Pharmacy and Pharmacy Benefits Management (PBM) Regulations

Optum Rx’s businesses include home delivery, specialty and compounding pharmacies, as well as clinic-based pharmacies which must be licensed as pharmacies in the states in which they are located. Certain of our pharmacies must also register with the U.S. Drug Enforcement Administration (DEA) and individual state controlled substance authorities to dispense controlled substances. In addition to adhering to the laws and regulations in the states where our pharmacies are located, we also are required to comply with laws and regulations in some non-resident states where we deliver pharmaceuticals, including those requiring us to register with the board of pharmacy in the non-resident state. These non-resident states generally expect our pharmacies to follow the laws of the state in which the pharmacies are located, but some non-resident states also require us to comply with their laws where pharmaceuticals are delivered. Additionally, certain of our pharmacies which participate in programs for Medicare and state Medicaid providers are required to comply with applicable Medicare and Medicaid provider rules and regulations. Other laws and regulations affecting our pharmacies include federal and state statutes and regulations governing the labeling, packaging, advertising and adulteration of prescription drugs and dispensing of controlled substances. See Part I, Item 1A, “Risk Factors” for a discussion of the risks related to our pharmacy care services businesses.


Federal and state legislation regulating PBM activities affects both our ability to limit access to a pharmacy provider network or remove network providers. Additionally, many states limit our ability to manage and establish maximum allowable costs for generic prescription drugs. With respect to formulary services, a number of government entities, including CMS, HHS and state departments of insurance, regulate the administration of prescription drug benefits offered through federal or state exchanges. Many states also regulate the scope of prescription drug coverage, as well as the delivery channels to receive such prescriptions, for insurers, MCOs and Medicaid managed care plans. These regulations could limit or preclude (i) certain plan designs, (ii) limited networks, (iii) use of particular care providers or distribution channels, (iv) copayment differentials among providers and (v) formulary tiering practices.


Legislation seeking to regulate PBM activities introduced or enacted at the federal or state level could impact our business practices with others in the pharmacy supply chain, including pharmaceutical manufacturers and network providers. In addition, organizations like the NAIC periodically issue model regulations while credentialing organizations, like the National Committee for Quality Assurance (NCQA) and the Utilization Review Accreditation Commission (URAC), may establish standards impacting PBM pharmacy activities. Although these model regulations and standards do not have the force of law, they may influence states to adopt their recommendations and impact the services we deliver to our clients.


UNH Consumer Protection Laws

Certain of our businesses participate in direct-to-consumer activities and are subject to regulations applicable to online communications and other general consumer protection laws and regulations such as the Federal Tort Claims Act, the Federal Postal Service Act and the FTC’s Telemarketing Sales Rule. Most states also have similar consumer protection laws.


UNH Consumer Protection Laws

Certain laws, such as the Telephone Consumer Protection Act, give the FTC, the Federal Communications Commission (FCC) and state attorneys general the ability to regulate, and bring enforcement actions relating to, telemarketing practices and certain automated outbound contacts such as phone calls, texts or emails. Under certain circumstances, these laws may provide consumers with a private right of action. Violations of these laws could result in substantial statutory penalties and other sanctions.


UNH Banking Regulation

Optum Bank is subject to regulation by federal banking regulators, including the Federal Deposit Insurance Corporation (FDIC), which performs annual examinations to ensure the bank is operating in accordance with federal safety and soundness requirements, and the Consumer Financial Protection Bureau, which may perform periodic examinations to ensure the bank is in compliance with applicable consumer protection statutes, regulations and agency guidelines. Optum Bank is also subject to supervision and regulation by the Utah State Department of Financial Institutions, which carries out annual examinations to ensure the bank is operating in accordance with state safety and soundness requirements and performs periodic examinations of


UNH Banking Regulation

the bank’s compliance with applicable state banking statutes, regulations and agency guidelines. In the event of unfavorable examination results from any of these agencies, the bank could become subject to increased operational expenses and capital requirements, enhanced governmental oversight and monetary penalties.


UNH Non-U.S. Regulation

Certain of our businesses operate internationally and are subject to regulation in the jurisdictions in which they are organized or conduct business. These regulatory regimes vary from jurisdiction to jurisdiction. In addition, our non-U.S. businesses and operations are subject to U.S. laws regulating the conduct and activities of U.S.-based businesses operating outside the United States, such as the Foreign Corrupt Practices Act (FCPA), which prohibits offering, promising, providing or authorizing others to give anything of value to a foreign government official to obtain or retain business or otherwise secure a business advantage.


UNH COMPETITION

As a diversified health care company, we operate in highly competitive markets across the full expanse of health care benefits and services. Our competitors include organizations ranging from startups to highly sophisticated Fortune 50 global enterprises, for-profit and non-profit companies, and private and government-sponsored entities. New entrants to our markets and business combinations among our competitors and suppliers also contribute to a dynamic and competitive environment. We compete fundamentally on the quality and value we provide to those we serve which can include elements such as product and service innovation; use of technology; consumer and provider engagement and satisfaction; and sales, marketing and pricing. See Part I, Item 1A, “Risk Factors” for additional discussion of our risks related to competition.


UNH INTELLECTUAL PROPERTY RIGHTS

We have obtained trademark registration for the UnitedHealth Group, Optum and UnitedHealthcare names and logos. We own registrations for certain of our other trademarks in the United States and abroad. We hold a portfolio of patents and have patent applications pending from time to time. We are not substantially dependent on any single patent or group of related patents.


UNH INTELLECTUAL PROPERTY RIGHTS

Unless otherwise noted, trademarks appearing in this report are trademarks owned by us. We disclaim any proprietary interest in the marks and names of others.


UNH HUMAN CAPITAL RESOURCES

Our more than 440,000 employees, as of December 31, 2023, including nearly 160,000 clinical professionals, are guided by our mission to help people live healthier lives and help make the health system work better for everyone. Our mission and cultural values of integrity, compassion, inclusion, relationships, innovation, performance and quality align with our long-term business strategy to increase access to care, make care more affordable, enhance the care experience, improve health outcomes and advance health equity. Our mission and values attract individuals who are determined to make a difference – individuals whose talent, innovation, engagement and empowerment are critical in our ability to achieve our mission.


UNH HUMAN CAPITAL RESOURCES

We are committed to developing our people and culture by creating an inclusive environment where people of diverse backgrounds, experiences and perspectives make us better. Our approach is data-driven and leader-led and uses enterprise and business scorecards to ensure our leaders are accountable for a consistent focus on hiring, developing, advancing and retaining diverse talent. We have embedded inclusion and diversity throughout our culture, including in our talent acquisition and talent management practices; leadership development; careers; learning and skills; and systems and processes. We strive to maintain a sustainable and diverse talent pipeline by building strong strategic partnerships and outreach through early career programs, internships and apprenticeships. We support career coaching, mentorship and accelerated leadership development programs to ensure mobility and advancement for our diverse talent. To foster an engaged workforce and an inclusive culture, we invest in a broad array of skills-based learning and culture development programs. We rely on a shared leadership framework, which clearly and objectively defines our expectations, enables an environment where everyone has the opportunity to learn and grow, and helps us identify, develop and deploy talent to help achieve our mission.


UNH HUMAN CAPITAL RESOURCES

We prioritize pay equity by regularly evaluating and reviewing our compensation practices by gender, ethnicity and race. Receiving on-going feedback from our team members is another way to strengthen and reinforce a culture of inclusion. Our Employee Experience Index measures an employee’s sense of commitment and belonging to our company and is a metric in the Stewardship section of our annual incentive plan. Our Sustainability Report, which can be accessed on our website at www.unitedhealthgroup.com, provides further information about our people and culture.


UNH INFORMATION ABOUT OUR EXECUTIVE OFFICERS

The following sets forth certain information regarding our executive officers as of February 28, 2024, including the business experience of each executive officer during the past five years: Name##Age##Position Andrew Witty##59##Chief Executive Officer Dirk McMahon##64##President and Chief Operating Officer John Rex##62##Executive Vice President and Chief Financial Officer Rupert Bondy##62##Executive Vice President, Chief Legal Officer and Corporate Secretary Erin McSweeney##59##Executive Vice President and Chief People Officer Thomas Roos##51##Senior Vice President and Chief Accounting Officer Brian Thompson##49##Chief Executive Officer of UnitedHealthcare


Our Board of Directors elects executive officers annually. Our executive officers serve until their successors are duly elected and qualified, or until their earlier death, resignation, removal or disqualification.


Andrew Witty has served as Chief Executive Officer and a member of the Board of Directors of UnitedHealth Group since February 2021. Previously, Andrew served as Chief Executive Officer of Optum from July 2018 to April 2021, President of UnitedHealth Group from November 2019 to February 2021 and as a UnitedHealth Group director from August 2017 to March 2018. Prior to joining UnitedHealth Group, he was Chief Executive Officer and a board member of GlaxoSmithKline, a global pharmaceutical company, from 2008 to 2017.


Dirk McMahon has served as President and Chief Operating Officer of UnitedHealth Group since February 2021. He previously served as Chief Executive Officer of UnitedHealthcare from June 2019 to April 2021, President and Chief Operating Officer of Optum from April 2017 to June 2019 and Executive Vice President, Operations at UnitedHealth Group from November 2014 to April 2017. Dirk also served as Chief Executive Officer of Optum Rx from November 2011 to November 2014. Prior to 2011, he held various positions in UnitedHealthcare in operations, technology and finance.


John Rex has served as Executive Vice President and Chief Financial Officer of UnitedHealth Group since June 2016. From March 2012 to June 2016, he served as Executive Vice President and Chief Financial Officer of Optum. Prior to joining Optum in 2012, John was a Managing Director at JP Morgan, a global financial services firm.


Rupert Bondy has served as Executive Vice President and Chief Legal Officer of UnitedHealth Group since March 2022 and additionally as Corporate Secretary since April 2022. Prior to joining UnitedHealth Group, Rupert served as Senior Vice President, General Counsel and Corporate Secretary at Reckitt Benckiser Group, a consumer goods group focused on hygiene, health and nutrition products, from January 2017 to February 2022. Prior to his service with Reckitt Benckiser Group, he served as Group General Counsel of BP plc, an international energy company, and, among his prior positions, as Senior Vice President and General Counsel of GlaxoSmithKline, a global pharmaceutical company.


Erin McSweeney has served as Executive Vice President and Chief People Officer of UnitedHealth Group since March 2022. From February 2021 to March 2022, Erin served as chief of staff to UnitedHealth Group’s Office of the Chief Executive. From January 2017 to February 2021, she served as Executive Vice President and Chief Human Resources Officer at Optum. Prior to joining UnitedHealth Group, Erin was Executive Vice President and Chief Human Resources Officer for EMC Corporation, an international technology company.


Tom Roos has served as Senior Vice President and Chief Accounting Officer of UnitedHealth Group since August 2015. Prior to joining UnitedHealth Group, Tom was a Partner at Deloitte & Touche LLP, an independent registered public accounting firm.


Brian Thompson has served as Chief Executive Officer of UnitedHealthcare since April 2021. Prior to his service in this role, he served as Chief Executive Officer of UnitedHealthcare's government programs including Medicare & Retirement and Community & State from July 2019 to April 2021; as Chief Executive Officer of Medicare & Retirement from April 2017 to July 2019; and as Chief Financial Officer of UnitedHealthcare’s Employer & Individual and Medicare & Retirement businesses from August 2010 to April 2017.


UNH ADDITIONAL INFORMATION

Our executive offices are located at UnitedHealth Group Center, 9900 Bren Road East, Minnetonka, Minnesota 55343; our telephone number is (952) 936-1300. You can access our website at www.unitedhealthgroup.com to learn more about our company. We make periodic and current reports and amendments available, free of charge, on our website, as soon as reasonably practicable after we file or furnish these reports to the Securities and Exchange Commission (SEC). Information on or linked to our website is neither part of nor incorporated by reference into this Annual Report on Form 10-K or any other SEC filings.


UNH CAUTIONARY STATEMENTS

The statements, estimates, projections or outlook contained in this Annual Report on Form 10-K include forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995 (PSLRA). When used in this Annual Report on Form 10-K and in future filings by us with the SEC, in our news releases, presentations to securities analysts or investors, and in oral statements made by or with the approval of one of our executive officers, the words “believe,” “expect,” “intend,” “estimate,” “anticipate,” “forecast,” “outlook,” “plan,” “project,” “should” or similar words or phrases are intended to identify such forward-looking statements. These statements are intended to take advantage of the “safe harbor” provisions of the PSLRA. These forward-looking statements involve risks and uncertainties which may cause our actual results to differ materially from the expectations expressed or implied in the forward-looking statements. Any forward-looking statement in this report speaks only as of the date of this report and, except as required by law, we undertake no obligation to update any forward-looking statement to reflect events or circumstances, including unanticipated events, after the date of this report.


UNH CAUTIONARY STATEMENTS

The following discussion contains cautionary statements regarding our business, which investors and others should consider. We do not undertake to address in future filings with the SEC or other communications regarding our business or results of operations how any of these factors may have caused our results to differ from discussions or information contained in our previous filings or communications. In addition, any of the matters discussed below may have affected past, as well as current, forward-looking statements about future results. Any or all forward-looking statements in this Annual Report on Form 10-K and in any other SEC filings or public statements we make may turn out to be wrong. Our forward-looking statements can be affected by inaccurate assumptions we might make or by known or unknown risks and uncertainties. Many factors discussed below will be important in determining our future results. By their nature, forward-looking statements are not guarantees of future performance or results and are subject to risks, uncertainties and assumptions which are difficult to predict or quantify.


UNH Risks Related to Our Business and Our Industry

If we fail to estimate, price for and manage our medical costs or design benefits in an effective manner, the profitability of our risk-based products and services could decline and could materially and adversely affect our results of operations, financial position and cash flows.


Through our risk-based benefit products, we assume the risk of both medical and administrative costs for our customers in return for monthly premiums. We generally use approximately 80% to 85% of our premium revenues to pay the costs of health care services delivered to these customers. The profitability of our products depends in large part on our ability to predict and effectively price for and manage medical costs. Our Optum Health business also enters into fully accountable value-based arrangements with payers. Premium revenues from risk-based products constitute nearly 80% of our total consolidated revenues. Estimates of benefit expense payments involve extensive judgement and are subject to considerable inherent variability. Relatively small differences between predicted and actual medical costs, or utilization rates as a percentage of revenues, can result in significant changes in our financial results. If we fail to predict accurately, or effectively price for or manage, the costs of providing care under risk-based arrangements, our results of operations could be materially and adversely affected.


We manage medical costs through underwriting criteria, product design, negotiation of competitive provider contracts and care management programs. Total medical costs are affected by the number of individual services rendered, the cost of each service and the type of service rendered. Although we base the premiums we charge on our estimates of future medical costs over the fixed contract period, many factors may cause, and have previously caused, actual costs to exceed those estimated and reflected in premiums or bids. These factors may include medical cost inflation, increased use of services, business mix, unexpected differences among new customer populations, increased cost of individual services, costs to deliver care, large-scale medical emergencies, the potential effects of climate change, pandemics, the introduction of new or costly drugs or increases in drug prices, treatments and technology, new treatment guidelines, newly mandated benefits or other regulatory changes and insured population characteristics. Cost increases in excess of our forecasts typically cannot be recovered in the fixed premium period through higher premiums. For Optum Health’s fully accountable value-based care, any inability to provide higher-quality outcomes and better experiences at lower costs or to integrate our care delivery models could impact our results of operations, financial positions and cash flows.


In addition, the financial results we report for any particular period include estimates of costs incurred for which claims are still outstanding. These estimates involve an extensive degree of judgment. If these estimates prove inaccurate, our results of operations could be materially and adversely affected.


If we fail to maintain properly the integrity or availability of our data or successfully consolidate, integrate, upgrade or expand our existing information systems, or if our technology products do not operate as intended, our business could be materially and adversely affected.


Our business depends on the integrity and timeliness of the data we use to serve our members, customers and health care professionals and to operate our business. If the data we rely upon to run our businesses is found to be inaccurate or unreliable or if we fail to effectively maintain or protect the integrity of our data and information systems, including systems powered by or incorporating artificial intelligence and machine learning (AI/ML), we could experience failures in our health, wellness and information technology products; lose existing customers; have difficulty attracting new customers; experience problems in determining medical cost estimates and establishing appropriate pricing; have difficulty preventing, detecting and controlling fraud; have disputes with customers, physicians and other health care professionals; become subject to regulatory sanctions, penalties, investigations or audits; incur increases in operating expenses; or suffer other adverse consequences.


The volume of health care data generated, and the uses of data, including electronic health records, are rapidly expanding. We depend on the integrity of the data in our information systems to implement new and innovative services, automate and deploy new technologies to simplify administrative processes and clinical decision making, price our products and services adequately, provide effective service to our customers and consumers in an efficient and uninterrupted fashion, provide timely payments to care providers, and accurately report our results of operations. In addition, connectivity among technologies is becoming increasingly important and recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices and new tools and products that leverage AI/ML to improve the customer experience. We anticipate that fast-evolving AI/ML technologies, including generative AI, will play an increasingly important role in our information systems and customer-facing technology products. Our ability to protect and enhance existing systems and develop new systems to keep pace with changes in information processing technology (including AI/ML), regulatory standards and changing customer preferences will require an ongoing commitment of significant development and operational resources. If these commitments fail to provide the anticipated benefits, if we are unable to successfully anticipate future technology developments, or if the cost to keep pace with the technological changes exceed our estimates, we could be exposed to reputational harm and experience adverse effects on our business.


We may not successfully implement our initiatives to consolidate the number of systems we operate, upgrade and expand our information systems’ capabilities, integrate and enhance our systems and develop new systems to keep pace with recent regulations and changes in information processing technology. Failure to protect, consolidate and integrate our systems successfully could result in higher than expected costs.


Some of our businesses sell and install software products which may contain unexpected design defects or may encounter unexpected complications during installation or when used with other technologies utilized by the customer. A failure of our technology products to operate as intended and in a seamless fashion with other products could materially and adversely affect our results of operations, financial position and cash flows.


Uncertain and rapidly evolving U.S. federal and state, non-U.S. and international laws and regulations related to health data and health information technologies, including those powered by or incorporating AI/ML, may alter the competitive landscape or impose new compliance requirements and could materially and adversely affect the configuration of our information systems and platforms, and our ability to compete in our markets.


If we or third parties we rely on sustain cyber-attacks or other privacy or data security incidents resulting in disruption to our operations or the disclosure of protected personal information or proprietary or confidential information, we could suffer a loss of revenue and increased costs, negative operational affects, exposure to significant liability, reputational harm and other serious negative consequences.


We routinely process, store and transmit large amounts of data in our operations, including protected personal information subject to privacy, security or data breach notification laws, as well as proprietary or confidential information relating to our business or third parties. Some of the data we process, store and transmit may be outside of the United States due to our information technology systems and international business operations. We are regularly the target of attempted cyber-attacks and other security threats and have previously been, and may in the future be, subject to compromises of the information technology systems we use, information we hold, or information held on our behalf by third parties. While we have programs in place to detect, contain and respond to data security incidents and provide employee awareness training regarding phishing, malware and other cyber threats to protect against cyber risks and security incidents, we expect that we will continue to experience these incidents, some of which may negatively affect our business. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we


may be unable to anticipate these techniques and threats, detect data security incidents or implement adequate preventive measures. Threat actors and hackers have previously been, and may in the future be, able to negatively affect our operations by penetrating our security controls and causing system and operational disruptions or shutdowns, accessing, misappropriating or otherwise compromising protected personal information or proprietary or confidential information or that of third parties, and developing and deploying viruses, ransomware and other malware that can attack our systems, exploit any security vulnerabilities, and disrupt or shutdown our systems and operations. In addition, hardware, software, or applications we develop or procure from third parties may contain defects or other problems which could unexpectedly compromise our information security controls. Our systems may also be vulnerable to financial fraud schemes, misplaced or lost data, human error, malicious social engineering, or other events which could negatively affect the data or financial accounts, proprietary or confidential information relating to our business or third parties, or our operations. There have previously been and may be in the future heightened vulnerabilities due to the lack of physical supervision and on-site infrastructure for remote workforce operations and for recently-acquired or non-integrated businesses. We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business whose operations are subject to similar risks.


The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident could be material. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to contain and remediate potential disruptions or cyber events. If our remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers. In addition, compromises of our security measures or the unauthorized dissemination of sensitive personal information, proprietary information or confidential information about us, our customers or other third parties, previously and in the future, could expose us or them to the risk of financial or medical identity theft, negative operational affects, expose us or them to a risk of loss or misuse of this information, result in litigation and liability, including regulatory penalties, for us, damage our brand and reputation, or otherwise harm our business.


If we fail to compete effectively to maintain or increase our market share, including maintaining or increasing enrollments in businesses providing health benefits, our results of operations, financial position and cash flows could be materially and adversely affected.


Our businesses face significant competition in all of the geographic markets in which we operate. In particular geographies or product segments, our competitors may have certain competitive advantages. Our competitive position may also be adversely affected by significant merger and acquisition activity in the industries in which we operate, among both our competitors and suppliers. Consolidation may make it more difficult for us to retain or increase our customer base, improve the terms on which we do business with our suppliers, or maintain or increase our profitability.


In addition, our success in the health care marketplace and future growth depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands. If we do not continue to innovate and provide products and services which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants. We may face risks from new technologies and market entrants which could affect our existing relationship with health plan enrollees in these areas. We could sustain competitive disadvantages and loss of market share if we fail to continue developing innovative care models, including by accelerating the transition of care to value-based models that achieve higher quality outcomes and better experiences at lower costs and expand access to virtual and in-home care. Additionally, our competitive position could be adversely affected by any failure to develop and apply innovative technologies and other effective data and analytics capabilities or to provide services to our clients focused on these technologies and capabilities.


Our business, results of operations, financial position and cash flows also could be materially and adversely affected if we do not compete effectively in our markets, if we set rates too high or too low in highly competitive markets, if we do not design and price our products properly and competitively, if we are unable to innovate and deliver products and services demonstrating value to our customers, if we do not provide a satisfactory level of services, if membership or demand for other services does not increase as we expect or declines, or if we lose accounts with more profitable products while retaining or increasing membership in accounts with less profitable products. The resumption of Medicaid redeterminations has impacted our membership levels and may impact our ability to maintain market share if we are unable to retain or add new consumers to other benefit offerings.


If we fail to develop and maintain satisfactory relationships with health care payers, physicians, hospitals and other service providers, our business could be materially and adversely affected.


We depend substantially on our continued ability to contract with health care payers (as a service provider to those payers), as well as physicians, hospitals, pharmaceutical benefit service providers, pharmaceutical manufacturers and other care and service providers at competitive prices. If we fail to develop and maintain satisfactory relationships with health care providers, whether in-network or out-of-network, our failure to do so could materially and adversely affect our business, results of operations,


financial position and cash flows. In addition, some of our activities related to network design, provider participation in networks and provider payments could result in disputes, which may be costly and attract negative publicity.


In any particular market, physicians and health care providers could refuse to contract with us, demand higher payments, or take other actions which could result in higher medical costs, less desirable products for customers or difficulty meeting regulatory or accreditation requirements. In some markets, certain health care providers, particularly hospitals, physician and hospital organizations or multi-specialty physician groups, may have significant market positions which could diminish our bargaining power. In addition, Accountable Care Organizations (ACOs); physician group management services organizations (which aggregate physician practices for administrative efficiency); and other organizational structures adopted by physicians, hospitals and other care providers may change the way in which these providers do business with us and may change the competitive landscape. Such organizations or groups of physicians may compete directly with us, which could adversely affect our business, and our results of operations, financial position and cash flows by impacting our relationships with these providers or affecting the way we price our products and estimate our costs, which might require us to incur costs to change our operations in an effort to mitigate these impacts. In addition, if these providers refuse to contract with us, use their market position to negotiate favorable contracts or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially and adversely affected.


Our health care benefits businesses have risk-based arrangements with some physicians, hospitals and other health care providers. These arrangements limit our exposure to the risk of increasing medical costs, but expose us to risk related to the adequacy of the financial and medical care resources of the health care providers. To the extent a risk-based health care provider organization faces financial difficulties or otherwise is unable to perform its obligations under the arrangement, we may be held responsible for unpaid health care claims which should have been the responsibility of the health care provider and for which we have already paid the provider. Further, payment or other disputes between a primary care provider and specialists with whom the primary care provider contracts could result in a disruption in the provision of services to our members or a reduction in the services available to our members. Health care providers with which we contract may not properly manage the costs of services, maintain financial solvency or avoid disputes with other providers. They may also fail to provide us with the information we need to effectively conduct our businesses, such as information enabling us to estimate costs of care. Any of these events could have a material adverse effect on the provision of services to our members and our operations.


Some providers that render services to our members do not have contracts with us. In some instances, those providers may dispute the payment for these services and may institute litigation or arbitration relying on state and federal laws that define the compensation that must be paid to out-of-network providers in some circumstances.


The success of some of our businesses depends on maintaining satisfactory relationships with physicians as our employees, independent contractors or joint venture partners. The physicians who practice medicine or contract with our affiliated physician organizations could terminate their provider contracts or otherwise become unable or unwilling to continue practicing medicine or contracting with us. We face and will likely continue to face heightened competition to acquire or manage physician practices or to employ or contract with individual physicians. Our revenues could be materially and adversely affected if we are unable to maintain or expand satisfactory relationships with physicians, to acquire, recruit or, in some instances, employ physicians, or to retain enrollees following physician departures. In addition, our affiliated physician organizations contract with competitors of UnitedHealthcare. Our businesses could suffer if our affiliated physician organizations fail to maintain relationships with or fail to adequately price their contracts with these third-party payer competitors.


Further, physicians, hospitals, pharmaceutical benefit service providers, pharmaceutical manufacturers and certain health care providers are customers of our Optum businesses. Physicians also provide medical services at facilities owned by our Optum businesses. Given the importance of health care providers and other constituents to our businesses, failure to maintain satisfactory relationships with them could materially and adversely affect our results of operations, financial position and cash flows.


We are routinely subject to various private party and governmental legal actions and investigations, which could damage our reputation and, if resolved unfavorably, could result in substantial penalties or monetary damages and materially and adversely affect our results of operations, financial position and cash flows.


We are routinely made party to a variety of private party and governmental legal actions and investigations related to, among other matters, the design, management and delivery of our product and service offerings. Any failure by us to adhere to the laws and regulations applicable to our businesses could subject us to civil and criminal penalties.


Legal actions to which we are a party have included and in the future could include matters related to health care benefits coverage and payment of claims (including disputes with enrollees, customers and contracted and non-contracted physicians, hospitals and other health care professionals), tort claims (including claims related to the delivery of health care services, such as medical malpractice by personnel at our affiliates’ facilities, or by health care practitioners who are employed by us, have contractual relationships with us, or serve as providers to our managed care networks, including as a result of a failure to adhere


to applicable clinical, quality and/or patient safety standards), antitrust claims (including as a result of changes in the enforcement of antitrust laws), whistleblower claims (including claims under the False Claims Act or similar statutes), matters related to our use of personal information or other proprietary data, claims related to alleged failure of our technology products to operate properly or fairly, contract and labor disputes, tax claims and claims related to disclosure of certain business practices. In addition, some of our pharmacy services operations are subject to clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs, including claims related to purported dispensing and other operational errors. We may also be party to certain class action lawsuits brought by health care professional groups and consumers. We operate in jurisdictions outside of the United States where contractual rights, tax positions and applicable regulations may be subject to interpretation or uncertainty to a greater degree than in the United States, and therefore subject to dispute by customers, government authorities or others.


We are largely self-insured with regard to litigation risks, including claims of medical malpractice against our affiliated physicians and us. Although we record liabilities for our estimates of the probable costs resulting from self-insured matters, it is possible the level of actual losses will significantly exceed the liabilities recorded. Additionally, physicians and other healthcare providers have become subject to an increasing number of legal actions alleging medical malpractice and general professional liabilities. Even in states that have imposed caps on damages for such actions, litigants are seeking recoveries under new theories of liability that might not be subject to the caps on damages. These actions involve significant defense costs and could result in substantial monetary damages or damage to our reputation.


We cannot predict the outcome of significant legal actions in which we are involved. Even in situations where we engage external insurers, our coverage may not be sufficient to cover the entirety of certain claims. We incur expenses to resolve these matters and current and future legal actions could further increase our cost of doing business and materially and adversely affect our results of operations, financial position and cash flows. Moreover, certain legal actions could result in adverse publicity which could damage our reputation and materially and adversely affect our ability to retain our current business or grow our market share in some markets and businesses.


Our business could suffer, and our results of operations, financial position and cash flows could be materially and adversely affected, if we fail to successfully manage our strategic alliances, to complete, manage or integrate acquisitions and other significant strategic transactions or relationships domestically or outside the United States.


As part of our business strategy, we frequently engage in discussions with third parties regarding possible investments, acquisitions, divestitures, strategic alliances, joint ventures and outsourcing transactions and often enter into agreements relating to such transactions. If we fail to meet the needs of our alliance or joint venture partners, including by developing additional products and services, providing high levels of service, pricing our products and services competitively or responding effectively to applicable federal and state regulatory changes, our alliances and joint ventures could be damaged or terminated, which in turn could adversely impact our reputation, business and results of operations. Further, governmental actions, such as actions by the FTC or DOJ, may affect our ability to complete strategic transactions, which could adversely affect our future growth. If we fail to identify and successfully complete transactions to meet our strategic objectives, including as a result of antitrust regulatory enforcement actions, such as those that have been brought against us in the past, we may be required to expend resources to develop products and technology internally, be placed at a competitive disadvantage or be adversely affected by negative market perceptions, any of which may have a material adverse effect on our results of operations, financial position or cash flows.


Successful acquisitions also require us to effectively integrate the acquired business into our existing operations, including our internal control environment and culture, or otherwise leveraging its operations which may present risks different from those presented by organic growth and may be difficult for us to manage. In addition, even with appropriate diligence, pre-acquisition practices of an acquired business have in the past and may in the future expose us to legal challenges and investigations that could subject us to criminal fines or reputational harm. Even if we are ultimately successful, defending such claims may be costly and result in negative publicity. If we cannot successfully integrate our acquired businesses and realize contemplated revenue growth opportunities, cost savings and other synergies, our business, prospects, results of operations, financial position and cash flows could be materially and adversely affected.


As we operate our business outside of the United States, we face risks different from those presented by acquisitions of domestic businesses, including risks in adapting to new markets, languages, business, labor and cultural practices and regulatory environments. Managing these risks could require us to devote significant senior management attention and other resources to the acquired businesses before we realize anticipated synergies or other benefits from those businesses. These risks vary widely by country and, outside of the United States, may include political instability, government intervention, unanticipated court decisions, discriminatory regulation and currency exchange controls or other restrictions, which could prevent us from transferring funds from these operations out of the countries in which our acquired businesses operate, or converting local currencies we hold into U.S. dollars or other currencies.


Foreign currency exchange rates and fluctuations have had and may in future periods have an impact on our shareholders’ equity from period to period, which could adversely affect our debt to debt-plus-equity ratio, and our future revenues, costs and cash flows from international operations. Any measures we may implement to reduce the effect of volatile currencies may be costly or ineffective.


We are subject to risks associated with public health crises arising from large-scale medical emergencies, pandemics, natural disasters and other extreme events, which have and could have an adverse effect on our business, results of operations, financial condition and financial performance.


Large-scale medical emergencies, pandemics, natural disasters, public health crises and other extreme events could have a material adverse effect on our business operations, cash flows, financial conditions and results of operations. For example, disruptions in public and private infrastructure resulting from such events could increase our operating costs and impair our ability to provide services to our clients and customers. In addition, as a result of these events, the premiums and fees we charge may not be sufficient to cover our medical and administrative costs, deferred medical care could be sought in future periods at potentially higher acuity levels, we could experience reduced demand for our services, and our clinical and non-clinical workforce could be affected and sustain a reduced capacity to handle demand for care. Public health crises arising from natural disasters, such as wildfires, hurricanes, and snowstorms, or effects of climate change could impact our business operations and result in increased medical care costs. Government enactment of emergency powers in response to public health crises could disrupt our business operations, including by restricting availability of or our ability to deliver pharmaceuticals or other supplies, and could increase the risk of shortages of necessary items.


Our sales performance will suffer if we do not adequately attract, retain and provide support to a network of independent producers and consultants.


Our products and services are sold in part through nonexclusive producers and consultants for whose services and allegiance we must compete. Our sales could be materially and adversely affected if we are unable to attract, retain and support independent producers and consultants or if our sales strategy is not appropriately aligned across distribution channels. Our relationships with producers could be impaired by changes in our business practices and the terms of our relationships, including commission levels.


Our businesses are subject to risks associated with unfavorable economic conditions.


Unfavorable economic conditions may have a range of impacts on the demand for our products and services. Such conditions also have caused and in future periods could continue to cause employers to stop offering certain health care coverage as an employee benefit or elect to offer particular coverage on a voluntary, employee-funded basis to reduce their operating costs. In addition, unfavorable economic conditions could adversely impact our ability to increase premiums or result in the cancellation by certain customers of our products and services. These conditions could lead to a decrease in people served and in the premium and fee revenues we generate.


A prolonged unfavorable economic environment could constrain state and federal budgets and result in reduced reimbursements or payments in our federal and state government health care coverage programs, including Medicare, Medicaid and CHIP. A reduction in state Medicaid reimbursement rates could be implemented retroactively to apply to payments already negotiated or received from the government. In addition, state and federal budgetary pressures could cause the affected governments to impose new or a higher level of taxes or assessments for our commercial programs, such as premium taxes on health insurance and surcharges or fees on select fee-for-service and capitated medical claims. Any of these developments or actions could materially and adversely affect our results of operations, financial position and cash flows.


A prolonged unfavorable economic environment could also adversely impact the financial position of hospitals and other care providers which could negatively affect our contracted rates with these parties and increase our medical costs or materially and adversely affect their ability to purchase our service offerings. Further, unfavorable economic conditions could have a material adverse effect on our financial results by impacting the customers of our Optum businesses, including health plans, hospitals, care providers, employers and others.


Our failure to attract, develop, retain, and manage the succession of key employees and executives could adversely affect our business, results of operations and future performance.


We depend on our ability to attract, develop and retain qualified employees and executives, including those with diverse backgrounds, experiences and skills, to operate and expand our business. While we have development and succession plans in place for our key employees and executives, these plans do not guarantee that the services of our key employees and executives will continue to be available to us. If we are unable to attract, develop, retain and effectively manage the development and succession plans for key employees and executives, our business, results of operations and future performance could be adversely affected. Experienced and highly skilled employees and executives in the health care and technology industries are in high demand and the market for their services is competitive. We may have difficulty in replacing key executives because of the limited number of qualified individuals in these industries with the breadth of skills and experience required to operate and


successfully expand our business. Adverse changes to our corporate culture could harm our business operations and our ability to retain key employees and executives.


Our investment portfolio may sustain losses which could adversely affect our profitability.


Market fluctuations could impair the value of our investment portfolio and our profitability. Volatility in interest rates affects our interest income and the market value of our investments in debt securities of varying maturities which constitute the substantial majority of the fair value of our investments as of December 31, 2023. In addition, a delay in payment of principal or interest by issuers, or defaults by issuers (primarily issuers of our investments in corporate and municipal bonds), could reduce our investment income and require us to write down the value of our investments which could adversely affect our profitability and equity.


Our investments may not produce total positive returns and we may sell investments at prices which are less than their carrying values. Changes in the value of our investment assets, as a result of interest rate fluctuations, changes in issuer financial or market conditions, illiquidity or otherwise, could have an adverse effect on our equity. In addition, if it should become necessary for us to liquidate a material portion of our investment portfolio on an accelerated basis, such an action could have an adverse effect on our results of operations and the capital position of our regulated subsidiaries.


If the value of our intangible assets is materially impaired, our results of operations, equity and credit ratings could be materially and adversely affected.


As of December 31, 2023, our goodwill and other intangible assets had a carrying value of $119 billion, representing 43% of our total consolidated assets. We periodically evaluate our goodwill and other intangible assets to determine whether all or a portion of their carrying values may be impaired, in which case a charge to earnings may be necessary. The value of our goodwill may be materially and adversely impacted if businesses we acquire perform in a manner inconsistent with our assumptions. In addition, from time to time we divest businesses, and any such divestiture could result in significant asset impairment and disposition charges, including those related to goodwill and other intangible assets. Any future evaluations requiring an impairment of our goodwill and other intangible assets could materially and adversely affect our results of operations and equity in the period in which the impairment occurs. A material decrease in equity could, in turn, adversely affect our credit ratings.


If we are not able to protect our proprietary rights to our databases, software and related products, or other intellectual property, our ability to market our knowledge and information-related businesses could suffer.


We rely on our agreements with customers, confidentiality agreements with employees and third parties, and our trademarks, trade secrets, copyrights and patents to protect our proprietary rights. These legal protections and precautions may not prevent misappropriation of our proprietary information. In addition, intellectual property rights inherent in software are the subject of substantial litigation, and we expect our software products to be increasingly subject to third-party infringement claims as the number of products and competitors in the health care-focused software industry segment grows. Such litigation and misappropriation of our proprietary information could hinder our ability to market and sell products and services which could materially and adversely affect our results of operations, financial position and cash flows.


Any downgrades in our credit ratings could increase our borrowing and operating costs.


Claims paying ability, financial strength and debt ratings by nationally recognized statistical rating organizations are important factors in establishing the competitive position of insurance companies. Ratings information is broadly disseminated and generally used by customers and creditors. We believe our claims paying ability and financial strength ratings are important factors in marketing our products to certain of our customers. Our credit ratings impact both the cost and availability of future borrowings. Each of the credit rating agencies reviews its ratings periodically. Our ratings reflect each credit rating agency’s opinion of our financial strength, operating performance and ability to meet our debt obligations or obligations to policyholders. We may not be able to maintain our current credit ratings in the future. Any downgrades in our credit ratings could materially increase our costs of or ability to access funds in the debt capital markets and otherwise materially increase our operating costs.


UNH Risks Related to the Regulation of Our Business

Our business activities in the United States and other countries are highly regulated and new laws or regulations or changes in existing laws or regulations or their enforcement or application could materially and adversely affect our business.


We are regulated by federal, state and local governments in the United States and other countries where we do business. Our insurance and HMO subsidiaries must be licensed by and are subject to regulation in the jurisdictions in which they conduct business. For example, states require periodic financial reports and enforce minimum capital or restricted cash reserve requirements. Health plans and insurance companies are also regulated under state insurance holding company regulations and some of our activities may be subject to other health care-related regulations and requirements, including regulations and licensure requirements related to PPOs, MCOs, UR and TPAs. Under state guaranty association laws, certain insurance companies can be assessed (up to prescribed limits) for certain obligations to the policyholders and claimants of impaired or insolvent insurance companies which write the same line or similar lines of business. Any such assessment could expose our insurance entities and other insurers to the risk they would be required to pay a portion of an impaired or insolvent insurance company’s claims through state guaranty associations.


Some of our businesses provide products or services to government agencies. For example, some of our Optum and UnitedHealthcare businesses hold government contracts or provide services related to government contracts and are subject to U.S. federal and state and non-U.S. self-referral, anti-kickback, medical necessity, risk adjustment, false claims and other laws and regulations governing government contractors and the use of government funds. Our relationships with these government agencies are subject to the terms of our contracts with the agencies and to laws and regulations regarding government contracts. Among others, certain laws and regulations restrict or prohibit companies from performing work for government agencies which might be viewed to involve an actual or potential conflict of interest. These laws and regulations may limit our ability to pursue and perform certain types of engagements, thereby materially and adversely affecting our results of operations, financial position and cash flows.


Some of our Optum businesses are also subject to regulations distinct from those faced by our insurance and HMO subsidiaries, some of which could impact our relationships with physicians, hospitals and customers. These regulations include state telemedicine regulations; debt collection laws; banking regulations; distributor and producer licensing requirements; state corporate practice of medicine restrictions; fee-splitting rules; and health care facility licensure and certificate of need requirements. These risks and uncertainties may materially and adversely affect our ability to market or provide our products and services, or to achieve targeted operating margins, or may increase the regulatory burdens under which we operate.


The laws and rules governing our businesses and interpretations of those laws and rules are subject to frequent and often unpredictable change. For example, legislative, administrative and public policy changes to the ACA have been and likely will continue to be considered, and we cannot predict if the ACA will be further modified. Additionally, changes in tax laws or unfavorable resolutions of exams could create additional tax liabilities.


The integration of entities we acquire into our businesses may affect the way in which existing laws and rules apply to us, including by subjecting us to laws and rules which did not previously apply to us. The broad latitude given to the agencies administering, interpreting and enforcing current and future regulations governing our businesses could compel us to change how we do business, renegotiate existing contracts and other arrangements, restrict revenue and enrollment growth, increase our health care and administrative costs and capital requirements, or expose us to increased liability in courts for coverage determinations, resolution of commercial disputes and other actions.


We also must obtain and maintain regulatory approvals to market many of our products and services, increase prices for some regulated products and services and complete or integrate strategic transactions. For example, premium rates for our health insurance and managed care products are subject to regulatory review or approval in many states and by the federal government. Additionally, we must submit data on proposed rate increases to HHS on many of our products for monitoring purposes. Geographic and product expansions of our businesses may be subject to state and federal regulatory approvals. Delays in obtaining necessary approvals or our failure to obtain or maintain adequate approvals could materially and adversely affect our results of operations, financial position and cash flows.


We also currently operate outside of the United States and in the future may acquire or commence additional businesses based outside of the United States, increasing our exposure to non-U.S. regulatory regimes. Our failure to comply with U.S. or non-U.S. laws and regulations governing our conduct outside the United States or to establish constructive relationships with non-U.S. regulators could adversely affect our ability to market our products and services or to do so at targeted operating margins, which may have a material adverse effect on our business, financial condition and results of operations. Non-U.S. regulatory regimes, which vary by jurisdiction, encompass, among other matters, local and cross-border taxation, licensing, tariffs, intellectual property, investment, capital (including minimum solvency margin and reserve requirements), management control, labor, anti-fraud, anti-corruption and privacy and data protection regulations (including requirements for cross-border data transfers). Any foreign regulator or court may take an approach to the interpretation, implementation and enforcement of


industry regulations which could differ from the approach taken by U.S. regulators or courts. In addition, our non-U.S. businesses and operations are subject to U.S. laws regulating the conduct and activities of U.S.-based businesses operating outside the United States, such as the FCPA, which prohibits offering, promising, providing or authorizing others to give anything of value to a foreign government official to obtain or retain business or otherwise secure a business advantage.


The health care industry is regularly subject to negative publicity, including as a result of governmental investigations, adverse media coverage and political debate concerning industry regulation. Negative publicity may adversely affect our stock price and damage our reputation, and expose us to unexpected or unwarranted regulatory scrutiny.


As a result of our participation in various government health care programs, both as a payer and as a service provider to payers, we are exposed to additional risks associated with program funding, enrollments, payment adjustments, audits and government investigations which could materially and adversely affect our business, results of operations, financial position and cash flows.


We participate in various federal, state and local government health care benefit programs, including as a payer in Medicare Advantage, Medicare Part D, various Medicaid programs and CHIP, and receive substantial revenues from these programs. Some of our Optum businesses also provide services to payers participating in government health care programs. A reduction or less than expected increase, or a protracted delay, in government funding for these programs or change in allocation methodologies, or termination of the contract at the option of the government, has affected and in future periods may materially and adversely affect our results of operations, financial position and cash flows.


The government health care programs in which we participate are generally subject to frequent changes, including changes which may reduce the number of persons enrolled or eligible for coverage (such as Medicaid eligibility redeterminations in certain states), reduce the amount of reimbursement or payment levels, reduce our participation in, or prevent our expansion into, certain service areas or markets, or increase our administrative or medical costs under such programs. Revenues for these programs depend on periodic funding from the federal government or applicable state governments and allocation of the funding through various payment mechanisms. Funding for these government programs depends on many factors outside of our control, including general economic conditions and budgetary constraints at the federal or applicable state level. For example, CMS in the past has reduced or frozen Medicare Advantage benchmarks and additional cuts to Medicare Advantage benchmarks are possible. In addition, from time to time, CMS makes changes to the way it calculates Medicare Advantage risk adjustment payments. Although we have adjusted members’ benefits and premiums on a selective basis, ceased to offer benefit plans in certain counties, and intensified both our medical and operating cost management in response to the benchmark reductions and other funding pressures, these or other strategies may not fully address the funding pressures in the Medicare Advantage program. In addition, payers in the Medicare Advantage program may be subject to reductions in payments from CMS as a result of decreased funding or recoupment pursuant to government audit. States have also made changes in rates and reimbursements for Medicaid members and audits can result in unexpected recoupments.


Under the Medicaid managed care program, state Medicaid agencies solicit bids from eligible health plans to continue their participation in the acute care Medicaid health programs. If we are not successful in obtaining renewals of state Medicaid managed care contracts, we risk losing the members who were enrolled in those Medicaid programs. Under the Medicare Part D program, to qualify for automatic enrollment of low income members, our bids must result in an enrollee premium below a regional benchmark, which is calculated by the government after all regional bids are submitted. If the enrollee premium is not below the government benchmark, we risk losing the members who were auto-assigned to us and will not have additional members auto-assigned to us. Chronic failure to meet the benchmarks could result in termination of these government contracts. In general, our bids are based upon certain assumptions regarding enrollment, utilization, medical costs and other factors. If any of these assumptions are materially incorrect, either as a result of unforeseen changes to the programs on which we bid, implementation of material program or policy changes after our bid submission, or submission by our competitors at lower rates than our bids, our results of operations, financial position and cash flows could be materially and adversely affected.


Many of the government health care coverage programs we participate in are subject to the prior satisfaction of certain conditions or performance standards or benchmarks. For example, as part of the ACA, CMS has a system providing various quality bonus payments to Medicare Advantage plans meeting specified quality star ratings at the individual plan or local contract level. The star rating system considers various measures adopted by CMS, including, among others, quality of care, preventive services, chronic illness management, handling of appeals and customer satisfaction. Plans must have a rating of four stars or higher to qualify for bonus payments. If we do not maintain or continue to improve our star ratings, our plans may not be eligible for quality bonuses and we may experience a negative impact on our revenues and the benefits our plans can offer, which could materially and adversely affect the marketability of our plans and the number of people we serve. Any changes in standards or care delivery models applying to government health care programs, including Medicare and Medicaid, or our inability to maintain or improve our quality scores and star ratings to meet evolving government performance requirements or to match the performance of our competitors could result in limitations to our participation in or exclusion from these or other government programs, which could materially and adversely affect our results of operations, financial position and cash flows.


CMS uses various payment mechanisms to allocate funding and adjust monthly capitation payments for Medicare programs. For Medicare Advantage plans, these adjustments are made according to the predicted health status of each beneficiary as supported by data from health care providers. For Medicare Part D plans, payment adjustments are driven by risk-sharing provisions based on a comparison of costs forecasted in our annual bids to actual prescription drug costs. Some state Medicaid programs utilize a similar process. For example, our UnitedHealthcare Medicare & Retirement and UnitedHealthcare Community & State businesses submit information relating to the health status of enrollees to CMS or state agencies for purposes of determining the amount of certain payments to us. CMS and the Office of Inspector General for HHS periodically perform risk adjustment data validation (RADV) audits of selected Medicare health plans to validate the coding practices of and supporting documentation maintained by health care providers. Some of our local plans have been selected for such audits, which in the past have resulted and in future periods could result in retrospective adjustments to payments made to our health plans, fines, corrective action plans or other adverse action by CMS.


We have been involved, and in the future may become involved in routine, regular and special governmental investigations, audits, reviews and assessments. Such investigations, audits, reviews or assessments sometimes arise out of, or prompt claims by private litigants or whistleblowers regarding, among other allegations, claims that we failed to disclose certain business practices or, as a government contractor, submitted false or erroneous claims to the government. Government investigations, audits, reviews and assessments could lead to government actions, which have resulted and in future periods could result in adverse publicity, the assessment of damages, civil or criminal fines or penalties, or other sanctions, including restrictions or changes in the way we conduct business, loss of licensure or exclusion from participation in government programs, any of which could have a material adverse effect on our business, results of operations, financial position and cash flows.


Our pharmacy care services businesses face regulatory and operational risks and uncertainties which may differ from the risks of our other businesses.


We provide pharmacy care services through our Optum Rx and UnitedHealthcare businesses. Each business is subject to federal and state anti-kickback, beneficiary inducement and other laws governing the relationships of the business with pharmaceutical manufacturers, physicians, pharmacies, customers and consumers. In addition, federal and state legislatures regularly consider new regulations for the industry which could materially affect current industry practices, including potential new legislation and regulations regarding the receipt or disclosure of rebates and other fees from pharmaceutical companies, the development and use of formularies and other utilization management tools, the use of average wholesale prices or other pricing benchmarks, pricing for specialty pharmaceuticals, limited access to networks and pharmacy network reimbursement methodologies. Further, various governmental agencies have conducted and continue to conduct investigations and studies into certain PBM practices, which have resulted and in future periods may result in PBMs agreeing to civil penalties, including the payment of money and entry into corporate integrity agreements, or could materially and adversely impact the PBM business model. As a provider of pharmacy benefit management services, Optum Rx is also subject to an increasing number of licensure, registration and other laws and accreditation standards. Optum Rx conducts business through home delivery, specialty and compounding pharmacies, pharmacies located in community mental health centers and home infusion, which subjects it to extensive federal, state and local laws and regulations, including those of the DEA and individual state controlled substance authorities, the Food and Drug Administration (FDA) and Boards of Pharmacy.


We could face potential claims in connection with purported errors by our home delivery, specialty or compounding or clinic-based pharmacies or the provision of home infusion services, as well as claims related to the inherent risks in the packaging and distribution of pharmaceuticals and other health care products. Disruptions from any of our home delivery, specialty pharmacy or home infusion services could materially and adversely affect our results of operations, financial position and cash flows.


In addition, our pharmacy care services businesses provide services to sponsors of health benefit plans subject to ERISA. A private party or the DOL, which is the agency that enforces ERISA, could assert that fiduciary obligations imposed by the statute apply to some or all of the services provided by our pharmacy care services businesses even where those businesses are not contractually obligated to assume fiduciary obligations. If a court were to determine such fiduciary obligations apply, we could be subject to claims for breaches of fiduciary obligations or claims we entered into prohibited transactions.


If we fail to comply with applicable privacy, security, technology and data laws, regulations and standards, including with respect to third-party service providers utilizing protected personal information on our behalf, our business, reputation, results of operations, financial position and cash flows could be materially and adversely affected.


The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels and addressed in requirements imposed on us by contracts with customers. Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI/ML and automation. These laws, regulations and requirements are subject to change. Compliance with new privacy, security, technology and data laws, regulations and requirements may result in increased operating costs, and may constrain or require us to alter our business model or operations.


Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions, and we cannot yet determine the impacts such future laws, regulations and standards may have on our businesses or the businesses of our customers. For example, the European Union’s General Data Protection Regulation (GDPR) imposes stringent European Union data protection requirements on us or our customers, and prescribes substantial penalties for noncompliance.


Many of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard designed to protect payment card account data.


HIPAA requires business associates as well as covered entities to comply with specified privacy and security requirements. While we provide for appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity customers and, as a result, collect, use, disclose and maintain protected personal information in order to provide services to these customers. HHS administers its audit program to assess HIPAA compliance efforts by covered entities and business associates. An audit resulting in findings or allegations of noncompliance could damage our reputation and subject us to monetary and other sanctions.


Through our Optum businesses, we maintain a database of administrative and clinical data statistically de-identified in accordance with HIPAA standards. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information, whether by us or by one of our third-party service providers, could have a material adverse effect on our reputation and business and, among other consequences, could subject us to mandatory disclosure to the media, loss of existing or new customers, significant increases in the cost of managing and remediating privacy or security incidents, and material fines, penalties and litigation awards. Any of these consequences could have a material and adverse effect on our results of operations, financial position and cash flows.


As an enterprise, we increasingly rely on new and evolving technologies, including those powered by or incorporating AI/ML, as part of our internal operations and in the delivery of our products and services. New technologies have potential and power to improve and optimize operational processes and clinical outcomes across the healthcare system, but also present ethical, technological, legal, regulatory and other risks. With respect to AI/ML, we have developed and implemented policies and procedures intended to promote and sustain responsible design, development, and use of AI/ML, consistent with industry best practices. Any inadequacy or failure in compliance with our responsible use of AI/ML policies and procedures or emerging laws, regulations and standards governing AI/ML use could cause our technology products not to operate as intended or to produce outcomes that could have a material and adverse effect on our business, reputation, results of operations, financial position and cash flows.


Restrictions on our ability to obtain funds from our regulated subsidiaries could materially and adversely affect our ability to reinvest in our business, service our debt and return capital to our shareholders.


Because we operate as a holding company, we are dependent on dividends and administrative expense reimbursements from our subsidiaries to fund our obligations. Many of these subsidiaries are regulated by state departments of insurance or similar regulatory authorities. We are also required by law or regulation to maintain specific prescribed minimum amounts of capital in these subsidiaries. The levels of capitalization required depend primarily on the volume of premium revenues generated by the applicable subsidiary. In most states, we are required to seek approval by state regulatory authorities before we transfer money or pay dividends from our regulated subsidiaries exceeding specified amounts. An inability of our regulated subsidiaries to pay dividends to their parent companies in the desired amounts or at the time of our choosing could adversely affect our ability to reinvest in our business through capital expenditures or business acquisitions, as well as our ability to maintain our corporate quarterly dividend payment, repurchase shares of our common stock and repay our debt. If we are unable to obtain sufficient funds from our subsidiaries to fund our obligations, our results of operations, financial position and cash flows could be materially and adversely affected.


UNH UNRESOLVED STAFF COMMENTS

None.


UNH CYBERSECURITY

UnitedHealth Group manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.


UNH CYBERSECURITY

Our cybersecurity program is managed by our Chief Digital and Technology Officer and Chief Information Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company’s cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and Chief Information Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.


UNH CYBERSECURITY

The Company’s framework includes an incident management and response program that continuously monitors the Company’s information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Chief Digital and Technology Officer and Chief Information Security Officer, as deemed necessary or appropriate. Pursuant to the Company’s incident response plan, incidents are reported to the Audit and Finance Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.


UNH CYBERSECURITY

We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws. We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.


UNH CYBERSECURITY

To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors. We have obtained various certifications from industry-recognized certifying organizations as a result of certain external audits. We also perform regular vulnerability assessments and penetration tests to improve system security and address emerging security threats. Our internal audit team independently assesses security controls against our enterprise policies to evaluate compliance and leverages a combination of auditing and security frameworks to evaluate how leading practices are applied throughout our enterprise. Audit results and remediation progress are reported to and monitored by senior management and the Audit and Finance Committee. We also periodically partner with industry-leading cybersecurity firms to assess our cybersecurity program. These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.


UNH CYBERSECURITY

We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Information Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company’s overall enterprise risk management program.


UNH CYBERSECURITY

We believe our Chief Digital and Technology Officer and Chief Information Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group. Our Chief Information Security Officer has experience leading a global digital portfolio for a large multinational corporation and held key leadership roles for a large technology and software company, including overseeing information security, before joining UnitedHealth Group.


UNH CYBERSECURITY

As of December 31, 2023, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future. For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, “Risk Factors.”


UNH CYBERSECURITY

On February 22, 2024, we disclosed the occurrence of a cybersecurity incident. We continue to investigate the extent of the incident, which we believe was committed by cybercrime threat actors. As of the date of this report, we have not determined the incident is reasonably likely to materially impact our financial condition or results of operations.


UNH PROPERTIES

We own and lease real properties to support our business operations in the United States and other countries. Our reportable segments use these facilities for their respective business purposes, and we believe the current facilities are suitable for their respective uses and are adequate for our anticipated future needs.


UNH LEGAL PROCEEDINGS

The information required by this Item 3 is incorporated herein by reference to the information set forth under the captions “Legal Matters” and “Government Investigations, Audits and Reviews” in Note 12 of the Notes to the Consolidated Financial Statements included in Part II, Item 8, “Financial Statements and Supplementary Data”


UNH MINE SAFETY DISCLOSURES

Not Applicable.


UNH MINE SAFETY DISCLOSURES

MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES


UNH MARKET AND HOLDERS

Our common stock is traded on the New York Stock Exchange (NYSE) under the symbol UNH. On January 31, 2024, there were 9,853 holders of record of our common stock.


UNH DIVIDEND POLICY

In June 2023, our Board of Directors increased the Company’s quarterly cash dividend to shareholders to an annual rate of $7.52 compared to $6.60 per share, which the Company had paid since June 2022. Declaration and payment of future quarterly dividends is at the discretion of the Board and may be adjusted as business needs or market conditions change.