Tenet Healthcare (THC) Risk Factors

The success of our business and clinical program development depends in large part on the number, quality, specialties, and admitting and scheduling practices of the licensed physicians who are members of the medical staffs of our hospitals and other facilities, as well as physicians who affiliate with us and use our facilities as an extension of their practices. Physicians are often not employees of the hospitals or surgery centers at which they practice. Members of the medical staffs of our facilities also often serve on the medical staffs of facilities we do not operate, and they are free to terminate their association with our facilities or admit their patients to competing facilities at any time. In addition, although physicians who own interests in our facilities are generally subject to agreements restricting them from owning an interest in competitive facilities, we may not learn of, or may be unsuccessful in preventing, our physician partners from acquiring interests in competitive facilities. We compete with system-affiliated hospitals and healthcare companies, as well as health insurers and private equity companies, in recruiting physicians, acquiring physician practices and, where permitted by law, employing physicians. In 2023, we continued to experience challenges in recruiting and retaining physicians. In some of the regions where we operate, physician recruitment and retention are affected by a shortage of qualified physicians in certain higher-demand clinical service lines and specialties. Furthermore, our ability to recruit and employ physicians is closely regulated. For example, the types, amount and duration of compensation and assistance we can provide to recruited physicians are limited by the federal Anti-kickback Statute and Stark law, as well as other applicable antifraud and abuse laws and regulations. All arrangements with physicians must also be fair market value and commercially reasonable. If we are unable to attract and retain sufficient numbers of quality physicians by providing adequate support personnel, technologically advanced equipment, and facilities that meet the needs of those physicians and their patients, physicians may choose not to refer patients to our facilities, admissions and outpatient visits may decrease, and our operating performance may decline.

USPI and our hospital-based joint ventures depend in part on the efforts, reputations and success of health system partners and the strength of our relationships with those systems. Our joint ventures could be adversely affected by any damage to those health systems' reputations or to our relationships with them. In addition, damage to our business reputation could negatively impact the willingness of health systems to enter into relationships with us or USPI. If we are unable to maintain existing arrangements on favorable terms or enter into relationships with additional health system partners, we may be unable to implement our business strategies for our joint ventures successfully.

We cannot predict whether or how the Affordable Care Act may be modified, amended or implemented in the future, and we are also unable to predict the impacts on our business from the enactment of, or changes in, other statutes and regulations affecting the healthcare industry generally. Some initiatives, requirements and proposals could increase our operating costs, negatively impact our patient volumes, case mix and revenue mix, adversely affect the reimbursement we receive for our services or require us to expend resources to modify certain aspects of our operations. Moreover, some current reforms could impact our competitive position, as well as our relationships with insurers and patients, including the No Surprises Act and CMS' rules relating to hospital price transparency. We are also unable to predict the effect of future government healthcare funding policy changes on our operations. If the rates paid by governmental payers are reduced, if the scope of services covered by governmental payers is limited, or if we or one or more of our hospitals are excluded from participation in the Medicare or Medicaid program or any other government healthcare program, there could be a material adverse effect on our business, financial condition, results of operations or cash flows. For the year ended December 31, 2023, approximately 16% and 8% of our net patient service revenues for the hospitals and related outpatient facilities in our Hospital Operations segment were from the Medicare program and various state Medicaid programs, respectively, in each case excluding Medicare and Medicaid managed care programs. The Medicare and Medicaid programs are subject to: - statutory and regulatory changes, administrative and judicial rulings, interpretations and determinations concerning patient eligibility requirements, funding levels and the method of calculating reimbursements, among other things;- requirements for utilization review; and - federal and state funding restrictions. Any of these factors could materially increase or decrease payments from these government programs in the future, as well as affect the cost of providing services to our patients and the timing of payments to our facilities, which could in turn adversely affect our overall business, financial condition, results of operations or cash flows. Several states in which we operate continue to face budgetary challenges that have resulted in reduced Medicaid funding levels to hospitals and other providers. Because most states must operate with balanced budgets, and the Medicaid program is generally a significant portion of a state's budget, states can be expected to adopt or consider adopting future legislation designed to reduce or not increase their Medicaid expenditures. In addition, some states delay issuing Medicaid payments to providers to manage state expenditures. As an alternative means of funding provider payments, many of the states where we operate have adopted supplemental payment programs under the Social Security Act. Continuing pressure on state budgets and other factors, including legislative and regulatory changes, could result in future reductions to Medicaid payments, payment delays or changes to Medicaid supplemental payment programs that could negatively impact our financial condition, results of operations or cash flows. Federal government denials or delayed approvals of waiver applications or extension requests by the states where we operate could also materially impact our Medicaid funding levels. Because we cannot predict what actions the federal government or the states may take under existing or future legislation and/or regulatory changes to address budget gaps, deficits, Medicaid expansion, Medicaid eligibility redeterminations, provider fee programs, state-directed payment programs or Medicaid Section 1115 waivers, we are unable to assess the effect that any such legislation or regulatory action might have on our business; however, the overall impact on our future financial position, results of operations or cash flows could be material.

Our information technology systems are critical to the day-to-day operation of our business. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII, and proprietary and confidential business data. We utilize electronic health records ("EHRs") and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. Our systems, in turn, interface with and rely on third-party systems that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures. We rely on these third-party providers to have appropriate controls to protect our systems, confidential information and other sensitive or regulated data. While we seek to obtain assurances that third parties will protect our information and business operations, there is a risk the security of data held by such third parties could be breached or that systems are rendered unavailable causing direct business operations impacts. The information technology and infrastructure we use, the third-party systems we interact with and the suppliers we use, have been, and will likely continue to be, subject to cyber attacks, computer viruses or breaches due to malfeasance or employee error. In April 2022, we experienced a cybersecurity incident that temporarily disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities. The risk of cyber attack (including ransomware attack), breach or other disruption to healthcare systems, including ours, remains elevated in the current environment. Attacks on, or breaches or other disruptions to, our information technology assets or those of third parties that we rely upon could impact the integrity, security or availability of data we process, transmit or store and could impact our operations, as well as patient PHI and customer PII. The preventive actions we take to reduce the risk of such incidents and protect our information technology and data may not be sufficient. As cybersecurity threats continue to evolve, we may not be able to anticipate certain attack methods in order to implement effective protective measures. We continue to be required to expend significant additional resources to modify and strengthen our security measures, investigate and respond to cybersecurity incidents, remediate any vulnerabilities in our information systems and infrastructure, and invest in new technology designed to mitigate security risks. Our insurance against cybersecurity risks and cyber attacks may not provide the coverage we anticipate or offset the financial impact of a material loss event. In addition, the occurrence of cybersecurity incidents and the continued and elevated risk of attacks (including ransomware), system and data breaches, and other disruptions to information technology systems in the current environment has caused increases in our cyber premiums and lower coverage limits. Third parties to whom we outsource certain of our functions, that are part of our supply chain or with whom our systems interface and who may, in some instances, store our sensitive and confidential data, are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business. Further, successful cyber attacks at other healthcare services companies, whether or not we are impacted, could lead to a general loss of consumer confidence in our industry that could negatively affect us, including harming the market perception of the effectiveness of our security measures or of the healthcare industry in general, which could result in reduced use of our services. Our networks and technology systems have also experienced disruption due to planned events, such as system implementations, upgrades, and other maintenance and improvements, and they are subject to disruption in the future for similar events, as well as catastrophic events, including a major earthquake, fire, hurricane, telecommunications failure, terrorist attack or the like. Any ransomware attack, breach, system interruption or unavailability of our information systems or of third-party systems with access to our data could result in: the unauthorized disclosure, misuse, loss or corruption of such data; interruptions and delays in our normal business operations (including the collection of revenues); patient harm; potential liability under privacy, security, consumer protection or other applicable laws; regulatory penalties; ransomware payments; and negative publicity and damage to our reputation. Any of these could have a material adverse effect on our business, financial condition, results of operations or cash flows.