Molina Healthcare (MOH) Risk Factors

We contract with physicians, hospitals, and other providers as a means to ensure access to healthcare services for our members, to manage medical care costs and utilization, and to better monitor the quality of care being delivered. We compete with other health plans to contract with these providers. We believe providers select plans in which they participate based on criteria including reimbursement rates, timeliness and accuracy of claims payment, potential to deliver new patient volume and/or retain existing patients, effectiveness of resolution of calls and complaints, and other factors. There can be no assurance that we will be able to successfully attract and retain providers to maintain a competitive network in the geographic areas we serve. In addition, in any particular market, providers could refuse to contract with us, demand higher payments, or take other actions which could result in higher medical care costs, disruption to provider access for current members, a decline in our growth rate, or difficulty in meeting regulatory or accreditation requirements. The Medicaid program generally pays doctors and hospitals at levels well below those of Medicare and private insurance. Large numbers of doctors, therefore, do not accept Medicaid patients. In the face of fiscal pressures, some states may reduce rates paid to providers, which may further discourage participation in the Medicaid program. In some markets, certain providers, particularly hospitals and some specialists, may have significant market positions or even monopolies. If these providers refuse to contract with us or utilize their market position to negotiate favorable contracts which are disadvantageous to us, our profitability in those areas could be adversely affected. Some providers that render services to our members are not contracted with our health plans. In those cases, there is no pre-established understanding between the provider and our health plan about the amount of compensation that is due to the provider. If providers claim they are underpaid for their services, they may either litigate or arbitrate their dispute with our health plan. State and federal laws intended to prevent or limit "surprise billing," such as the No Surprises Act, define the compensation that must be paid to out-of-network providers in certain scenarios and require rate disputes between payors and out-of-network providers to be resolved through independent dispute resolution ("IDR"). There have been lawsuits challenging portions of the No Surprises Act in federal courts, particularly related to the use of the qualifying payment amount ("QPA") in the IDR process, which may result in an increase in rates we must pay to out-of-network providers. Federal agencies have continued to issue guidance regarding the implementation of the No Surprises Act, and we expect the agencies' interpretations of law's requirements will continue to evolve. The impact that federal and state surprise billing laws will have on our business is uncertain and could adversely affect our business, financial condition, cash flows, or results of operations.

As part of our normal operations, we routinely collect, process, store, and transmit large amounts of data, including sensitive personal information as well as proprietary or confidential information relating to our business or third parties. To ensure information security, we have implemented controls designed to protect the confidentiality, integrity and availability of this data and the systems that store and transmit such data. However, our information technology systems and safety control systems are subject to a growing number of threats from computer programmers, hackers, and other adversaries that may be able to penetrate our network security and misappropriate our confidential information, create system disruptions, or cause damage, security issues, or shutdowns. They also may be able to develop and deploy viruses, worms, and other malicious software programs that attack our systems or otherwise exploit security vulnerabilities. We may also face increased cybersecurity risks due to our reliance on internet technology and our fully remote working environment, which may create additional opportunities for cybercriminals to exploit vulnerabilities. All of these risks are also faced by our significant vendors who are also in possession of sensitive confidential information. Because the techniques used to circumvent, gain access to, or sabotage security systems can be highly sophisticated and change frequently, they often are not recognized until launched against a target, and may originate from less regulated and remote areas around the world. We may be unable to anticipate these techniques or implement adequate preventive measures, resulting in potential data loss and damage to our systems. Our systems are also subject to compromise from internal threats such as improper action by employees, including malicious insiders, or by vendors, counterparties, and other third parties with otherwise legitimate access to our systems. Our policies, employee training (including phishing prevention training), procedures and technical safeguards may not prevent all improper access to our network or proprietary or confidential information by employees, vendors, counterparties, or other third parties. Our facilities may also be vulnerable to security incidents or security attacks, acts of vandalism or theft, misplaced or lost data, human errors, or other similar events that could negatively affect our systems and our and our members' data. Moreover, we face the ongoing challenge of managing access controls in a complex environment. The process of enhancing our protective measures can itself create a risk of systems disruptions and security issues. Given the breadth of our operations and the increasing sophistication of cyberattacks, a particular incident could occur and persist for an extended period of time before being detected. The extent of a particular cyberattack and the steps that we may need to take to investigate the attack may take a significant amount of time before such an investigation could be completed and full and reliable information about the incident is known. During such time, the extent of any harm or how best to remediate it might not be known, which could further increase the risks, costs, and consequences of a data security incident. In addition, our systems must be routinely updated, patched, and upgraded to protect against known vulnerabilities. The volume of new software vulnerabilities has increased substantially, as has the importance of patches and other remedial measures. In addition to remediating newly identified vulnerabilities, previously identified vulnerabilities must also be updated. We are at risk that cyber attackers exploit these known vulnerabilities before they have been addressed. The complexity of our systems and platforms, the increased frequency at which vendors are issuing security patches to their products, our need to test patches and, in some instances, coordinate with third parties before they can be deployed, all could further increase our risks. Where doing so is necessary in order to conduct our business, we also provide sensitive personal member information, as well as proprietary or confidential information relating to our business, to our third-party service providers. Although we obtain assurances from those third parties that they have systems and processes in place to protect such data, and that they will take steps to assure the protection of such data by other third parties, those third-party service providers may also be subject to data intrusion or data breach. Any compromise of the confidential data of our members, employees, or business, or the failure to prevent or mitigate the loss of or damage to this data through breach, could result in operational, reputational, competitive, or other business harm, as well as financial costs and regulatory action. The Company maintains cybersecurity insurance in the event of an information security or cyber incident. However, the coverage may not be sufficient to cover all financial losses. In the future, we may be subject to litigation and governmental investigations related to cyber-attacks and security breaches. Any such future litigation or governmental investigation could divert the attention of management from the operation of our business, result in reputational damage, and have a material adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities. Noncompliance with any privacy, security or data protection laws and regulations, or any security breach, cyber-attack or cyber-security breach, and any incident involving the misappropriation, theft, loss or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers, could require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, and could also result in regulatory enforcement actions, material fines and penalties, litigation or other actions that could have a material adverse effect on our business, cash flows, financial condition, and results of operations.

We maintain a significant investment portfolio of cash equivalents and short-term and long-term investments in a variety of securities, which are subject to general credit, liquidity, market and interest rate risks. As a result, we may experience a reduction in value or loss of our investments, which may have a negative adverse effect on our results of operations, liquidity and financial condition. Changes in the economic environment, including periods of increased volatility in the securities markets and recent increases in inflation and interest rates, can increase the difficulty of assessing investment impairment and increase the risk of potential impairment of these assets. There is continuing risk that declines in the fair value of our investments may occur and material impairments may be charged to income in future periods, resulting in recognized losses.

Our corporate headquarters are located in Long Beach, California. In addition, some of our health plans' claims are processed in Long Beach, California. Southern California is exposed to a statistically greater risk of a major earthquake and wildfires than most other parts of the United States. If a major earthquake or wildfire were to strike Southern California, our corporate functions and claims processing could be impaired for an unforeseen period of time. If there is a major Southern California earthquake or wildfire, there can be no assurances that our disaster recovery plan will be successful or that the business operations of our health plans, including those that are remote from any such event, would not be impacted. Item 1C. CYBERSECURITY CYBERSECURITY RISK MANAGEMENT, GOVERNANCE AND RISK ASSESSMENT The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company has established a cybersecurity program (the "Program") that is designed to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents. CYBERSECURITY RISK MANAGEMENT The Program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST Special Publication 800-53, and the Payment Card Industry standards, as applicable, and designed to comply with applicable laws and regulations, including HIPAA and the New York Department of Financial Services Cybersecurity Regulation, as applicable. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and Payment Card Industry standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. The Program is aligned with the Company's overall enterprise risk management system and processes and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Control procedures are assessed regularly to confirm their effectiveness. The Company undergoes an annual Service Organization Controls ("SOC") Type 2 attestation report covering the performance of safeguards deployed to protect certain Company systems and applications. The Company maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions. The Company has a designated Chief Information Security Officer (the "CISO"). The Program is implemented and managed by the Company's executive management under the leadership of the CISO. The Company contracts with third-party service providers to support aspects of the Program implementation, operations, and review of information technology operations and cybersecurity technologies. Additionally, the Company has retained a number of well-established and reputable cybersecurity consultants, including forensics experts, auditors, as well as outside cybersecurity legal counsel to assist with cybersecurity matters as needed from time to time. The Company has a Computer Incident Response Team ("CIRT") which is responsible for monitoring, preventing, detecting, assisting with the investigation, and responding to cybersecurity threats. The Company has in place an Information Security Incident Response Plan ("IRP") Protocol which provides an operational framework to coordinate the response to any type of cybersecurity incident affecting the Company. The CIRT team informs the CISO of cybersecurity threats consistent with the IRP. The IRP also provides the process and oversight to manage cybersecurity incidents that may arise from a third-party service provider. In addition, the IRP addresses management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate. The Company's cybersecurity policies and procedures are reviewed by the CISO and updated at least annually. In addition, under the IRP, following the resolution of a cybersecurity incident, the Company will generally consider the effectiveness of the Program and the IRP, make adjustments as appropriate, and report to senior management and the Audit Committee as appropriate on these matters. The cybersecurity policies and procedures are communicated and enforced throughout the Company, as well as with the third-party service providers that have access to the Company's information systems or nonpublic information. Cybersecurity policies and procedures are also subject to periodic review and audits by internal and external parties, such as the internal audit function, external auditors, regulators, or independent assessors. The Company requires employees to undergo cybersecurity-related training, including phishing prevention training, and employees are tested regularly through phishing exercises. GOVERNANCE The CISO is responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO has the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The CISO's expertise includes decades of information technology and cybersecurity as a subject matter expert, including more than a decade of executive management experience as a CISO for Fortune 500 companies. The Program is overseen by the Company's Board of Directors through its Audit Committee which, pursuant to its charter, assists the Board with oversight of Company privacy, data security, and cybersecurity matters and risks. The Audit Committee meets regularly with the Company's executive management, including the CISO and the Chief Information Officer, and receives updates on the status and overall effectiveness of the Program, changes to the Program, relevant information technology operations, any changes in material cybersecurity risks and any significant cybersecurity incidents consistent with the IRP. The Audit Committee also discusses with executive management the steps management has taken to monitor and mitigate privacy, data security, and cybersecurity risk exposures, the Company's information governance policies and programs, and major legislative and regulatory developments that could materially impact the Company's exposure regarding privacy, data security risk, and cybersecurity. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation. CYBERSECURITY RISK ASSESSMENT The CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company conducts regular risk assessments to identify, evaluate, and prioritize material cybersecurity risks to the Company, including its health plans and state contracts, shared services and IT operations, or business strategy. The risk assessments are informed by various sources of information, such as internal and external audits, vulnerability scans, penetration tests, threat intelligence, incident reports, industry benchmarks, and accepted industry practices. The risk assessments consider the potential impact and likelihood of various cybersecurity threats, such as ransomware, malware, social engineering, third-party incidents, supply chain attacks and insider threats, and contemplates the adequacy of controls to detect, prevent, respond, and recover to reduce the possibility of an adverse material cybersecurity event. The Company has in place processes to identify material risks from cybersecurity threats associated with its use of third-party service providers and as such, conducts assessments of such third-party service providers with respect to their cybersecurity programs and risks and requires third-party service providers to notify the Company if they experienced a cybersecurity incident. The Company hires experienced security professionals to conduct advanced and realistic cybersecurity attack simulations to verify its Program, and conducts regular cybersecurity tabletop exercises with executive management, which are coordinated by a third-party. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

In the past, the securities and credit markets have experienced extreme volatility and disruption. The availability of credit, from virtually all types of lenders, has at times been restricted. In the event we need access to additional capital to pay our operating expenses, fund subsidiary surplus requirements, make payments on or refinance our indebtedness, pay capital expenditures, or fund acquisitions, our ability to obtain such capital may be limited and the cost of any such capital may be significant, particularly if we are unable to access our existing revolving credit facility. Our access to additional financing will depend on a variety of factors such as prevailing economic and credit market conditions, the general availability of credit, the overall availability of credit to our industry, our credit ratings and credit capacity, and perceptions of our financial prospects. Similarly, our access to funds may be impaired if regulatory authorities or rating agencies take negative actions against us. If one or any combination of these factors were to occur, our internal sources of liquidity may prove to be insufficient, and in such case, we may not be able to successfully obtain sufficient additional financing on favorable terms, within an acceptable time, or at all. We are party to a credit agreement (the "Credit Agreement") which includes a revolving credit facility ("Credit Facility") of $1.0 billion, among other provisions. Our Credit Agreement, and the indentures governing our notes, require us to comply with various covenants that impose restrictions on our operations, including our ability to incur additional indebtedness, create liens, pay dividends, make certain investments or other restricted payments, sell or otherwise dispose of substantially all of our assets and engage in other activities. Our Credit Agreement also requires us to comply with a maximum consolidated net leverage ratio and a minimum consolidated interest coverage ratio. These restrictive covenants could limit our ability to pursue our business strategies. In addition, any failure by us to comply with these restrictive covenants could result in an event of default under the Credit Agreement and, in some circumstances, under the indentures governing our notes, which, in any case, could have a material adverse effect on our financial condition. GENERAL RISK FACTORS