Elevance Health (ELV) Risk Analysis

Our debt service obligations require us to use a portion of our cash flow to pay interest and principal on debt instead of for other corporate purposes, including funding future expansion. We are exposed to interest rate risk to the extent of our variable rate indebtedness. Increases in interest rates could increase our cost of borrowing, and volatility in U.S. and global financial markets could impact our access to, or further increase the cost of, financing. If our cash flow and capital resources are insufficient to service our debt obligations, we may be forced to seek extraordinary dividends from our subsidiaries, sell assets, seek additional equity or debt capital or restructure our debt. However, these measures might be unsuccessful or inadequate to meet scheduled debt service obligations or may not be available on commercially reasonable terms. We may also incur future debt obligations that might subject us to restrictive covenants that could affect our financial and operational flexibility. Our breach or failure to comply with any of these covenants could result in a default under our credit facilities or other indebtedness. If we default under our credit agreement, the lenders could cease to make further extensions of credit or cause all of our outstanding debt obligations under our credit agreement to become immediately due and payable, together with accrued and unpaid interest. If the indebtedness under our notes or our credit agreement or our other indebtedness is accelerated, we may be unable to repay or finance the amounts due, on commercially reasonable terms, or at all.

As part of our normal operations, we collect, process, retain and analyze certain sensitive and confidential information, including personal information subject to privacy, security and data breach notification requirements. Some of the data we process, store and transmit is outside of the U.S. due to the structure of our information technology systems and our internal business operations. We are subject to a variety of continuously evolving federal, state and international laws and rules regarding collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of sensitive or confidential information that, depending on the specific business and intended data use, include without limitation, HIPAA's privacy and security rules, HIPAA's HITECH rule, the Gramm-Leach-Bliley Act, the General Data Protection Regulation and numerous state laws governing personal information, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Regulators are also imposing new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, and continue to propose, data privacy legislation and/or regulations related to Artificial Intelligence ("AI"). We have programs in place to detect, contain and respond to data, privacy and security incidents and provide employee awareness training regarding phishing, malware, and other risks to protect against privacy and cybersecurity incidents. Our facilities and systems, and those of our third-party service providers, including our business associates, are regularly the target of, and may be vulnerable to, cyber-attacks, security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, negligent or wrongful conduct by associates or others with permitted access to our systems and information, or other threats or catastrophic events. Additionally, there have been, and may in the future be, heightened vulnerabilities due to our remote or varied geographical workforce operations. We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their information technology systems or business. Hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security. In addition, because the techniques used to obtain unauthorized access, disable, disrupt or degrade service or sabotage systems change frequently, are becoming increasingly sophisticated (in part due to the use of evolving technologies), and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques and threats, timely discover or counter them or implement adequate preventative measures. Viruses, worms, malicious software programs or other unauthorized methods of acquiring data may be used to attack our systems or otherwise exploit any security vulnerabilities which may cause system disruptions or shutdowns, or may cause personal, proprietary or confidential information to be disclosed, misappropriated or compromised. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to successfully contain and remediate potential disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage and unauthorized access remain a priority for us. We have been, and may in the future be, subject to litigation and governmental investigations related to cyber-attacks, privacy incidents and security breaches. Any such future litigation or governmental investigation could divert the attention of management from the operation of our business, result in reputational damage and have an adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities. Noncompliance with any privacy, security or data protection laws and regulations, or any security breach, cyber-attack or cybersecurity breach, and any incident involving the misappropriation, compromise, exfiltration, theft, loss or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers or their vendors, previously have and could in the future require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, expose us or our members to the risk of financial or medical identity theft, and result in regulatory enforcement actions, material fines and penalties, litigation or other actions that could have an adverse effect on our business, cash flows, financial condition and results of operations.

Our business depends significantly on effective information systems, and we have many different information systems for our various businesses, including those that we have acquired as a result of our merger and acquisition activities. Our information systems require an ongoing investment, commitment of significant resources to maintain, integrate, upgrade, enhance and expand existing systems, and development of new systems, including systems powered by or incorporating AI and machine learning (including generative AI), to keep pace with continuing changes in information processing technology, emerging cybersecurity risks, changing customer preferences, evolving industry and regulatory standards and legal requirements, including as a result of the ACA, the Health Plan Transparency Rule, the 2021 Appropriations Act and federal data interoperability regulations. In addition, we may obtain significant portions of our systems-related or other services from independent third parties (and their vendors), which may make our operations vulnerable if such third parties fail to perform and oversee adequately. Further, unauthorized third parties present additional risk, including by propagating misinformation related to products, business and the health industry. Failure to adequately implement, consolidate, integrate, streamline, maintain and upgrade effective and efficient information systems, including those powered by or incorporating AI, with sufficiently advanced technological capabilities could result in investigations, audits, fines and penalties, competitive and cost disadvantages to us compared to our competitors, contractual damages, and diversion of management's time, and could have an adverse effect on our business, financial condition and results of operations. Failure or disruption of our performance of, or our ability to perform, key business functions, including as a result of the unavailability of, or cyber-attack on, our information technology systems or those of third parties (including cloud service providers), could decrease response times, lower levels of service satisfaction and harm our reputation and brand. Our systems interface with and depend on third-party systems, hardware, infrastructure and cloud technologies, and we could experience service denials if demand for such service exceeds capacity, or these systems fail or experience interruption. From time to time, we update, transition, acquire, or expand use of our and third-party information technology systems, which may result in heightened vulnerability. Some third-party systems that are necessary for the operation of our business processes are maintained outside of our control but would impact our business operations if compromised as a result of a cyber-attack. Despite our adoption and continued enhancement of business continuity and disaster recovery strategies, there is no guarantee that such efforts will be effective, which could interrupt the functionality of our information technology systems or those of third parties. Our failure to implement adequate business continuity and disaster recovery strategies could significantly reduce our ability to provide products and services to our customers and members, which could have an adverse effect on our business and results of operations. In addition, connectivity amongst technologies is becoming increasingly important, with recent trends bringing greater consumer engagement in healthcare; therefore, the pace at which our customers will need enhanced technologies with sophisticated applications for mobile interfaces, including tools and products that leverage AI to improve the customer experience, will quicken. We anticipate that fast-evolving AI technologies will play an increasingly significant role in our information systems and technology products. If the information systems we rely upon to run our business were found to be inaccurate or unreliable or if we fail to adequately maintain, upgrade, enhance, expand and protect our information systems, security controls and data integrity effectively, we could experience problems in determining medical cost estimates and establishing appropriate pricing and reserves, have disputes with customers and providers, lengthen the pace of integration activities or otherwise delay the launch of acquired products, face regulatory problems, including sanctions and penalties, incur increases in operating expenses or suffer other adverse consequences, including a decrease in membership.

We are subject to significant state and federal regulation across many aspects of our business, including, but not limited to, licensing, premiums, marketing activities, provider contracting, access and payment standards, and corporate governance and financial reporting matters, as described in greater detail in Part I, Item 1, "Business - Regulation" in this Annual Report on Form 10-K. Further, the integration into our business of entities that we acquire, or our expansion into new businesses or jurisdictions, may increase our regulatory risk and affect how existing laws and rules apply to us. Frequent and sometimes unpredictable changes to existing laws, rules and regulations or judicial interpretation, application or enforcement thereof, or development of new laws, rules, regulatory interpretations or judgments could force us to change how we conduct our business, affect the products and services we offer (and where we offer them), restrict revenue and enrollment growth, increase our costs, including operating, healthcare technology and administrative costs, restrict our ability to obtain new product approvals, modify existing products, and implement changes in premium rates, and require enhancements to our compliance infrastructure and internal controls environment. Any of these developments could adversely impact our business and results of operations. In addition, legislative and/or regulatory policies or proposals that seek to manage the healthcare industry or otherwise impact our business may cause the market price of our securities to decrease, even if such policies or proposals never become effective. In particular, further regulations and modifications to the ACA and laws and regulations stemming from the ACA could impact the market for our products, funding for ACA programs, the regulations applicable to us, the methodologies used to determine our reimbursement, and the fees and taxes payable by us and otherwise affect our business and future operations, any of which may adversely affect our financial condition and results of operations. Furthermore, legislative or regulatory actions intended to address rising health-care costs or affordability concerns may result in the imposition of additional requirements on health insurers, including mandated benefits, restrictions on premium increases, or other pricing limitations, which could increase costs, constrain pricing flexibility, and adversely affect our financial condition and results of operations. We expect state legislatures will continue to focus on healthcare delivery and financing issues, including actions to reduce or limit increases to premium payments, provider billing protections, access to care and other reforms of state health insurance markets. State ballot initiatives could also be put to voters that could adversely impact our operating environment. If enacted into law, these state proposals and actions could have an adverse impact on our business, cash flows, operations or financial condition. Additionally, state legislative actions and litigation could impact ERISA pre-emption. Further, Congress has considered, and may consider in the future, various forms of managed care reform legislation which, if adopted, could fundamentally alter the treatment of coverage decisions under ERISA, including limiting ERISA's preemptive effect on state laws, and could increase our costs, expose us to expanded liability, permit greater state regulation of our operations, or require us to revise the ways in which we conduct business. We are required to obtain and maintain insurance licenses and other regulatory approvals to market certain of our products and services, to increase prices for certain regulated products and services and to consummate some of our acquisitions and dispositions. Delays in obtaining or failure to obtain or maintain these approvals, as well as future regulatory action by state or federal authorities, could have an adverse effect on the profitability or marketability of our health benefits, pharmacy services, healthcare and other products and services or on our business, financial condition, and results of operations. In addition, changes in government regulations, policies or funding that apply to government-sponsored programs such as Medicare and Medicaid including, among other things, reimbursement levels, quality-based bonus payment determinations, eligibility and redetermination requirements, taxes or assessments for our programs, such as premium taxes on health insurance, benefit coverage requirements, rate-setting methodologies, audit and oversight practices, and additional governmental participation, have adversely affected, and could in the future adversely affect, our business, cash flows, financial condition, and results of operations. We have experienced past assessments under state or federal insolvency or guaranty association laws applicable to insurance companies, HMOs and other payers, and may experience assessments in the future if, for example, premiums established by other companies for their health insurance products, including certain long-term care products, are inadequate to cover their costs. Any such assessment could expose us to the risk of paying a portion of an impaired or insolvent insurance company's claims through state guaranty associations. We are not currently able to estimate our potential financial obligations, losses or the availability of offsets associated with future guaranty association assessments; however, any significant increase in guaranty association assessments could have an adverse effect on our business, cash flows, financial condition, and results of operations.

We contract with various federal and state agencies, including CMS, to provide managed health benefits services, such as Medicare Advantage, Medicare Part D, Medicare Supplement, Medicaid, TANF, SPD, LTSS, CHIP, Medicaid expansion programs and various specialty programs, products and services. We also provide various administrative services for other entities offering medical and/or prescription drug plans to their Medicaid or Medicare eligible members, and we offer employer group waiver plans which provide medical and/or prescription drug coverage to retirees. We also participate in programs in several states for the care of dual-eligible members. Changes in existing laws or regulations applicable to these programs, or their interpretations, are difficult to predict and could have an adverse effect on our business, cash flows, financial condition and results of operations. Revenues from the Medicare and Medicaid programs are determined, in whole or in part, by the federal government and/or applicable state governments, and base premium rates paid by each state or federal agency differ depending upon a combination of factors such as defined upper payment limits, a member's health status, age, gender, county or region, benefit mix, member eligibility category and risk scores. Rates may be affected by federal and state budgetary constraints. Certain state contracts are subject to cancellation in the event of the unavailability of state funds. Additionally, ongoing CMS changes to the calculation of risk in the Medicare Advantage program may impact our revenue. For example, CMS made significant changes to the structure of the hierarchical condition category model in version 28, which impacted risk adjustment factor ("RAF") scores for a larger percentage of Medicare Advantage beneficiaries and resulted in changes to beneficiary RAF scores regardless of a change in the patient's health status. The federal government or any state in which we operate could decrease rates paid to us, pay us less than the amount necessary to keep pace with our cost trends, cancel our contracts retroactively or seek an adjustment to previously negotiated rates. In addition, various states' Medicare-Medicaid dual-eligible plans are still subject to uncertainty surrounding payment rates and other requirements, which could affect where we seek to participate in these programs. For example, CMS will require in future years that health plans offering certain dual-eligible products must also align with integrated Medicaid products in the same service area. Some states are also requiring companies to offer Medicaid within a state and are conducting competitive bid processes to qualify to offer dual-eligible products. An unexpected reduction in payments, inadequate government funding or significantly delayed payments for these programs may adversely affect our business, cash flows, financial condition and results of operations. Other potential risks associated with Medicare Advantage and Medicare Part D plans include increased medical or pharmaceutical costs, data corrections identified as a result of ongoing auditing and monitoring activities, potential uncollectability of receivables resulting from processing and/or verifying enrollment, inadequacy of underwriting assumptions, inability to receive and process correct information (including inability due to systems issues by the federal government, the applicable state government or us), uncollectability of premiums from members and limited enrollment periods. Actual results may be materially different than our assumptions and estimates and could have an adverse effect on our business, financial condition and results of operations. Our contracts with CMS and state governmental agencies contain certain provisions regarding data submission, risk adjustment, provider network and directory maintenance, quality measures, claims payment, timely and accurate processing of appeals and grievances, oversight of service providers, encounter data, continuity of care, call center performance and other requirements specific to federal and state program regulations. We have been subject in the past, and may again be in the future, to administrative actions, fines, penalties, liquidated damages or retrospective adjustments in payments made to our health plans as a result of a failure to comply with these requirements, which has impacted, and in the future could impact, our profitability. We have experienced retroactive rate adjustments by certain state Medicaid agencies in the past, and such rate adjustments may occur in the future. Further, our state Medicaid contracts have not always been renewed, we have not always been awarded new contracts as a result of the competitive procurement process, and in some cases, we have lost members under existing contracts as a result of a post-award challenge by unsuccessful bidders, each of which could take place in the future and have an adverse effect on our business, cash flows, financial condition and results of operations. The Star Rating System utilized by CMS to evaluate Medicare Advantage Plans may have a significant effect on our revenue, as higher-rated plans tend to experience increased enrollment, plans with a Star Rating of 4.0 or higher are eligible for quality-based bonus payments and plans with a Star Rating of 5.0 can market to and enroll members year-round. CMS has made, and continues to make, changes to its Star Rating program that have impacted, and continue to impact, the ability of plans to achieve Star Ratings of 4.0 or higher. CMS released our 2026 Star Ratings in October 2025, which will be used to determine our Medicare Advantage plans' quality bonus payments in 2027. Our 2026 Star Ratings reflect that approximately 59% of our Medicare Advantage members are enrolled in plans rated at least 4.0 stars or higher, or the equivalent, compared to approximately 40% of our Medicare Advantage members being in plans with 2025 Star Ratings of at least 4.0 stars. Uncertainties with respect to future changes to the Star Rating System, which are not determined until after the relevant measurement period, continue to make accurate predictions of each Medicare Advantage plan's Star Ratings more challenging. If we do not maintain our Star Ratings in future years, or if quality-based bonus payments are reduced or eliminated, we would likely experience a negative impact on our revenues and the benefits that our plans can offer, which could adversely affect the marketability of our plans, our ability to expand our business, our membership levels, and our results of operations, financial condition and cash flows. Similarly, if we fail to meet or exceed any performance standards imposed by state Medicaid programs in which we participate, we may not receive performance-based bonus payments or may incur penalties. In addition, our failure to comply with federal and state healthcare laws and regulations applicable to our participation in Medicaid and Medicare programs, including those directed at preventing fraud, abuse and discrimination, could result in investigations, litigation, fines, restrictions on, or exclusions from, program participation, or the imposition of corporate integrity agreements or other agreements with a federal or state governmental agency, any of which could adversely impact our business, cash flows, financial condition and results of operations. We are periodically subject to government audits, including CMS RADV audits of our Medicare Advantage Plans to validate diagnostic data, patient claims and financial reporting, and audits of our Medicare Part D plans by the Medicare Part D Recovery Audit Contractor ("RAC"), as well as state Medicaid RAC programs. Certain of our contracts currently have pending RADV audits by CMS and the HHS Office of Inspector General that are awaiting CMS finalization. In addition, we routinely perform ordinary course reviews of, among other things, our Medicare Advantage data submitted to CMS. These governmental audits, or changes in how these audits are conducted, including changes that may result from the final RADV Audit rule that was issued in 2023, and our internal reviews, have resulted, and could in the future result, in reports or disclosures for prior, current or future filing years to federal or state regulatory agencies, submission of data corrections, and/or significant adjustments in payments made to our health plans and future Medicare Advantage bids, which could adversely affect our financial condition and results of operations. Governmental regulators and agencies continue to heighten their scrutiny of business and reporting practices within the health services industry with respect to risk adjustment and claims payment. Additionally, state regulators are increasingly conducting audits to assess the quality of services we provide to our Medicare members. If we fail to report and correct errors discovered through our own auditing procedures, during a RADV or RAC audit or during state regulatory audits, or otherwise fail to comply with applicable laws and regulations, we could be subject to fines, civil penalties or other sanctions, which could have an adverse effect on our ability to participate in these programs, and on our financial condition, cash flows and results of operations. In addition, price transparency initiatives, such as the Health Plan Transparency in Coverage Rule, may impact our ability to obtain or maintain favorable contract terms. For example, hospitals are required to publish online payer-specific negotiated charges for each item or service the hospital provides. Our Medicare and Medicaid contracts are also subject to various MLR rules, including minimum MLR thresholds, rebate requirements and audits, which could adversely affect our membership and revenues if any of our state Medicare or Medicaid plans do not meet an applicable minimum MLR threshold. If a Medicare Advantage, MMP or Medicare Part D contract pays minimum MLR rebates for three consecutive years, it will become ineligible to enroll new members. If a Medicare Advantage or Medicare Part D contract pays such rebates for five consecutive years, it will be terminated by CMS.

We maintain a significant investment portfolio of cash equivalents and short-term and long-term investments in a variety of securities, which are subject to general credit, liquidity, market and interest rate risks. As a result, we may experience a reduction in value or loss of our investments, which may have a negative adverse effect on our results of operations, liquidity and financial condition. Changes in the economic environment, including periods of increased volatility in the securities markets, recent changes in interest rates and currency exchange rates, can increase the difficulty of assessing investment impairment and increase the risk of potential impairment of these assets. There is continuing risk that declines in the fair value of our investments may occur and impairments may be charged to income in future periods, resulting in recognized losses.

Our profitability is dependent in part upon our ability to contract on favorable terms with hospitals, physicians, pharmacy services providers and supply chain partners and other healthcare providers. These partners may elect not to contract with us, and the failure to secure or maintain cost-effective contracts on competitive terms may result in a loss of membership or higher medical costs, which could adversely affect our business. In addition, consolidation among healthcare providers, Accountable Care Organizations practice management companies, and other organizational structures that physicians, hospitals and other care providers choose, as well as the ability of larger employers to contract directly with providers, has changed and may continue to change the way that these providers interact with us and may alter the competitive landscape overall. Such organizations or groups of physicians may compete directly with us or be owned by one of our competitors, which may impact our relationship with these providers or affect the way that we price our products and estimate our costs. Such competition may require us to incur costs to change our operations, which could adversely affect our business, cash flows, financial condition, and results of operations. Our inability to contract with providers, providers attempting to use their market position to negotiate more favorable contracts or place us at a competitive disadvantage, the departure of prominent network providers or provider groups to competitors, or the inability of providers to provide adequate care could adversely affect our business. In addition, we do not have contracts with all providers that render services to our members and, as a result, may not have a pre-established agreement about the amount of compensation those out-of-network providers will accept for the services they render. State and federal laws, such as the No Surprises Act, define the compensation that must be paid to out-of-network providers in certain scenarios, and related litigation has lessened the weight of the Qualifying Payment Amount during independent dispute resolution processes, which may result in an increase in rates we must pay to out-of-network providers. Further ongoing regulatory developments or judicial interpretations may continue to shift payment responsibilities or calculation methodologies in ways that increase our costs. Both our lack of contracts with certain providers and the development of new federal and state laws could result in significant litigation or arbitration proceedings, including instances in which a provider attempts to obtain payment from our members for the difference between the amount we have paid and the amount they have charged, or other increases in rates paid to out-of-network providers.