CVS Health (CVS) 10-K2023 FY Annual report

0000064803srt:RevisionOfPriorPeriodAccountingStandardsUpdateAdjustmentMemberus-gaap:AccumulatedNetInvestmentGainLossIncludingPortionAttributableToNoncontrollingInterestMember2022-12-31

Unless the context otherwise requires, references to the terms “we,” “our” or “us” used throughout this Annual Report on Form 10-K (this “10-K”) refer to CVS Health Corporation (a Delaware corporation), together with its subsidiaries (collectively, “CVS Health” or the “Company”). References to competitors and other companies throughout this 10-K, including the information incorporated herein by reference, are for illustrative or comparison purposes only and are not identifying that these companies are the only competitors or closest competitors of the Company or any of the Company’s businesses, products, or services.

CAUTIONARY STATEMENT CONCERNING FORWARD-LOOKING STATEMENTS

The Private Securities Litigation Reform Act of 1995 (the “Reform Act”) provides a “safe harbor” for forward-looking statements, so long as (1) those statements are identified as forward-looking, and (2) the statements are accompanied by meaningful cautionary statements that identify important factors that could cause actual results to differ materially from those discussed in the statement. We want to take advantage of these safe harbor provisions.

Certain information contained in this 10-K is forward-looking within the meaning of the Reform Act or Securities and Exchange Commission (“SEC”) rules. This information includes, but is not limited to: “Outlook for 2024” of Management’s Discussion and Analysis of Financial Condition and Results of Operations (“MD&A”) included in Item 7, “Quantitative and Qualitative Disclosures About Market Risk” included in Item 7A, “Government Regulation” included in Item 1, and “Risk Factors” included in Item 1A. In addition, throughout this 10-K and our other reports and communications, we use the following words or variations or negatives of these words and similar expressions when we intend to identify forward-looking statements:

All statements addressing the future operating performance of CVS Health or any segment or any subsidiary and/or future events or developments, including, but not limited to, statements relating to the Company’s investment portfolio, operating results, cash flows and/or financial condition, statements relating to corporate strategy, statements relating to future revenue, operating income or adjusted operating income, earnings per share or adjusted earnings per share, Health Care Benefits segment business, sales results and/or trends, medical cost trends, medical membership, Medicare Part D membership, medical benefit ratios and/or operations, Health Services segment business, sales results and/or trends and/or operations, Pharmacy & Consumer Wellness segment business, sales results and/or trends and/or operations, incremental investment spending, interest expense, effective tax rate, weighted-average share count, cash flow from operations, net capital expenditures, cash available for debt repayment, statements related to possible, proposed, pending or completed acquisitions, joint ventures, investments or combinations that involve, among other things, the timing or likelihood of receipt of regulatory approvals, the timing of completion, integration synergies, net synergies and integration risks and other costs, including those related to CVS Health’s acquisitions of Oak Street Health, Inc. (“Oak Street Health”) and Signify Health, Inc. (“Signify Health”), enterprise modernization, transformation, leverage ratio, cash available for enhancing shareholder value, inventory reduction, turn rate and/or loss rate, debt ratings, the Company’s ability to attract or retain customers and clients, store development and/or relocations, new product development, and the impact of industry and regulatory developments, as well as statements expressing optimism or pessimism about future operating results or events, are forward-looking statements within the meaning of the Reform Act.

Forward-looking statements rely on a number of estimates, assumptions and projections concerning future events, and are subject to a number of significant risks and uncertainties and other factors that could cause actual results to differ materially from those statements. Many of these risks and uncertainties and other factors are outside our control.

Certain additional risks and uncertainties and other factors are described under “Risk Factors” included in Item 1A of this 10-K; these are not the only risks and uncertainties we face. There can be no assurance that the Company has identified all the risks that may affect it. Additional risks and uncertainties not presently known to the Company or that the Company currently believes to be immaterial also may adversely affect the Company’s businesses. If any of those risks or uncertainties develops into actual events, those events or circumstances could have a material adverse effect on the Company’s businesses, operating results, cash flows, financial condition and/or stock price, among other effects.

You should not put undue reliance on forward-looking statements. Any forward-looking statement speaks only as of the date of this 10-K, and we disclaim any intention or obligation to update or revise forward-looking statements, whether as a result of new information, future events, uncertainties or otherwise.

CVS Health Corporation, together with its subsidiaries (collectively, “CVS Health,” the “Company,” “we,” “our” or “us”), is a leading health solutions company building a world of health around every consumer it serves and connecting care so that it works for people wherever they are. As of December 31, 2023, we had more than 9,000 retail locations, more than 1,000 walk-in medical clinics, 204 primary care medical clinics, a leading pharmacy benefits manager with approximately 108 million plan members and expanding specialty pharmacy solutions, and a dedicated senior pharmacy care business serving more than one million patients per year. We serve an estimated more than 35 million people through traditional, voluntary and consumer-directed health insurance products and related services, including expanding Medicare Advantage offerings and a leading standalone Medicare Part D prescription drug plan (“PDP”). We are creating new sources of value through our integrated model allowing us to expand into personalized, technology driven care delivery and health services, increasing access to quality care, delivering better health outcomes and lowering overall health care costs.

During the year ended December 31, 2023, the Company completed the acquisition of two key health care delivery assets to enhance its ability to execute on its care delivery strategy by advancing its primary care, home-based care and provider enablement capabilities. On March 29, 2023, the Company acquired Signify Health, Inc. (“Signify Health”), a leader in health risk assessments, value-based care and provider enablement services. On May 2, 2023, the Company also acquired Oak Street Health, Inc. (“Oak Street Health”), a leading multi-payor operator of value-based primary care centers serving Medicare eligible patients. Both Signify Health and Oak Street Health are included within the Health Services segment.

In connection with its new operating model adopted in the first quarter of 2023, the Company realigned the composition of its segments to reflect how its Chief Operating Decision Maker (the “CODM”) reviews information and manages the business. The Company’s CODM is the Chief Executive Officer. As a result of this realignment, the Company formed a new Health Services segment, which in addition to providing a full range of pharmacy benefit management (“PBM”) solutions, also delivers health care services in the Company’s medical clinics, virtually, and in the home, as well as provider enablement solutions. In addition, the Company created a new Pharmacy & Consumer Wellness segment, which includes its retail and long-term care pharmacy operations and related pharmacy services, as well as its retail front store operations. This segment will also provide pharmacy fulfillment services to support the Health Services segment’s specialty and mail order pharmacy offerings. Prior period segment financial information has been recast to conform with the current period presentation. See Note 19 ‘‘Segment Reporting’’ included in Item 8 of this 10-K for segment financial information.

The Company has four reportable segments: Health Care Benefits, Health Services, Pharmacy & Consumer Wellness and Corporate/Other.

We are building a world of health around every consumer we serve, seeking to make it easier and more affordable to live a healthier life. This means delivering solutions that are more personalized, simpler to use and increasingly digital so consumers can receive care when, where and how they desire. We address holistic health – physical, emotional, social and economic – and we are creating new sources of value through our integrated care model which allows us to expand into personalized, technology driven care delivery and health services, increasing access to quality care, delivering better health outcomes and lowering overall health care costs. We believe our consumer-centric strategy will drive sustainable long-term growth and deliver value for all stakeholders.

The Health Care Benefits segment operates as one of the nation’s leading diversified health care benefits providers, serving an estimated more than 35 million people as of December 31, 2023. The Health Care Benefits segment has the information and resources to help members, in consultation with their health care professionals, make more informed decisions about their health care. The Health Care Benefits segment offers a broad range of traditional, voluntary and consumer-directed health insurance products and related services, including medical, pharmacy, dental and behavioral health plans, medical management capabilities, Medicare Advantage and Medicare Supplement plans, PDPs and Medicaid health care management services. The Health Care Benefits segment’s customers include employer groups, individuals, college students, part-time and hourly

workers, health plans, health care providers (“providers”), governmental units, government-sponsored plans, labor groups and expatriates.

Health Care Benefits Products and Services

The Company refers to insurance products (where it assumes all or a majority of the risk for medical and dental care costs) as “Insured” and administrative services contract products (where the plan sponsor assumes all or a majority of the risk of medical and dental care costs) as “ASC.” Health Care Benefits products and services consist of the following:

The Company also has a portfolio of transformative products and services aimed at creating a holistic and integrated approach to individual health and wellness. These products and services complement the Commercial Medical and Government Medical products and aim to provide innovative solutions, create integrated experience offerings and enable enhanced care delivery to customers.

Health Care Benefits Provider Networks

The Company contracts with physicians, hospitals and other providers for services they provide to the Company’s members. The Company uses a variety of techniques designed to help encourage appropriate utilization of medical services (“utilization”) and maintain affordability of quality coverage. In addition to contracts with providers for negotiated rates of reimbursement, these techniques include creating risk sharing arrangements that align economic incentives with providers, the development and implementation of guidelines for the appropriate utilization and the provision of data to providers to enable them to improve health care quality. At December 31, 2023, the Company’s underlying nationwide provider network had approximately 1.7 million participating providers. Other providers in the Company’s provider networks also include laboratory, imaging, urgent care and other freestanding health facilities.

Health Care Benefits Quality Assessment

CMS uses a 5-star rating system to monitor Medicare health care and drug plans and ensure that they meet CMS’s quality standards. CMS uses this rating system to provide Medicare beneficiaries with a tool that they can use to compare the overall quality of care and level of customer service of companies that provide Medicare health care and drug plans. The rating system considers a variety of measures adopted by CMS, including quality of preventative services, chronic illness management and overall customer satisfaction. See “Health Care Benefits Pricing” below in this Item 1 for further discussion of star ratings. The Company seeks Health Plan accreditation for Aetna Inc. (“Aetna”) HMO plans from the National Committee for Quality Assurance (“NCQA”), a private, not-for-profit organization that evaluates, accredits and certifies a wide range of health care organizations. Health care plans seeking accreditation must pass a rigorous, comprehensive review and must annually report on their performance.

Aetna Life Insurance Company (“ALIC”), a wholly-owned subsidiary of the Company, has received nationwide NCQA PPO Health Plan accreditation. As of December 31, 2023, all of the Company’s Commercial HMO and all of ALIC’s PPO members who were eligible participated in HMOs or PPOs that are accredited by the NCQA.

The Company’s provider selection and credentialing/re-credentialing policies and procedures are consistent with NCQA and URAC, a health care accrediting organization that establishes quality standards for the health care industry, as well as state and federal, requirements. In addition, the Company is certified under the NCQA Credentials Verification Organization (“CVO”) certification program for all certification options and has URAC CVO accreditation.

Quality assessment programs for contracted providers who participate in the Company’s networks begin with the initial review of health care practitioners. Practitioners’ licenses and education are verified, and their work history is collected by the Company or in some cases by the practitioner’s affiliated group or organization. The Company generally requires participating hospitals to be certified by CMS or accredited by The Joint Commission, the American Osteopathic Association, or Det Norske Veritas Healthcare.

The Company also offers quality and outcome measurement programs, quality improvement programs, and health care data analysis systems to providers and purchasers of health care services.

Health Care Benefits Information Systems

The Health Care Benefits segment currently operates and supports an end-to-end suite of information technology platforms to support member engagement, enrollment, health benefit administration, care management, service operations, financial reporting and analytics. The multiple platforms are supported by an integration layer to facilitate the transfer of real-time data. There is continued focus and investment in enterprise data platforms, cloud capabilities, digital products to offer innovative solutions and a seamless experience to the Company’s members through mobile and web channels. The Company is making concerted investments in emerging technology capabilities such as voice, artificial intelligence and robotics to further automate, reduce cost and improve the experience for all of its constituents. The Health Care Benefits segment is utilizing the full breadth of the Company’s assets to build enterprise technology that will help guide our members through their health care journey, provide them a high level of service, enable healthier outcomes and encourage them to take next best actions to lead healthier lives.

Health Care Benefits Customers

Medical membership is dispersed throughout the U.S., and the Company also serves medical members in certain countries outside the U.S. The Company offers a broad range of traditional, voluntary and consumer-directed health insurance products

and related services, many of which are available nationwide. Depending on the product, the Company markets to a range of customers, including employer groups, individuals, college students, part-time and hourly workers, health plans, providers, governmental units, government-sponsored plans, labor groups and expatriates. For additional information on medical membership, see “Health Care Benefits Segment” in the Management’s Discussion and Analysis of Financial Condition and Results of Operations (the “MD&A”) included in Item 7 of this 10-K.

The Company markets both Commercial Insured and ASC products and services primarily to employers that sponsor the Company’s products for the benefit of their employees and their employees’ dependents. Frequently, larger employers offer employees a choice among coverage options from which the employee makes his or her selection during a designated annual open enrollment period. Typically, employers pay all of the monthly premiums to the Company and, through payroll deductions, obtain reimbursement from employees for a percentage of the premiums that is determined by each employer. Some Health Care Benefits products are sold directly to employees of employer groups on a fully employee-funded basis. In some cases, the Company bills the covered individual directly. The Company sold Insured plans directly to individual consumers through the individual public health insurance exchanges (“Public Exchanges”) in 12 states as of December 31, 2023. The Company entered Public Exchanges in five additional states effective January 2024.

Health Care Benefits products are sold through: the Company’s sales personnel; independent brokers, agents and consultants who assist in the production and servicing of business; as well as private health insurance exchanges (“Private Exchanges”) and Public Exchanges (together with Private Exchanges, “Insurance Exchanges”). For large employers or other entities that sponsor the Company’s products (“plan sponsors”), independent consultants and brokers are frequently involved in employer health plan selection decisions and sales. In some instances, the Company may pay commissions, fees and other amounts to brokers, agents, consultants and sales representatives who place business with the Company. In certain cases, the customer pays the broker for services rendered, and the Company may facilitate that arrangement by collecting the funds from the customer and transmitting them to the broker. The Company supports marketing and sales efforts with an advertising program that may include television, radio, billboards, print media and social media, supplemented by market research and direct marketing efforts.

The Patient Protection and Affordable Care Act and the Health Care and Education Reconciliation Act of 2010 (collectively, the “ACA”) ties a portion of each Medicare Advantage plan’s reimbursement to the plan’s “star ratings.” Plans must have a star rating of 4 or higher (out of 5) to qualify for bonus payments. CMS released the Company’s 2024 star ratings in October 2023. The Company’s 2024 star ratings will be used to determine which of the Company’s Medicare Advantage plans have ratings of four stars or higher and qualify for bonus payments in 2025. Based on the Company’s membership at December 31, 2023, 87% of the Company’s Medicare Advantage members were in plans with 2024 star ratings of at least 4.0 stars, compared to the unmitigated 21% of the Company’s Medicare Advantage members being in plans with 2023 star ratings of at least 4.0 stars based on the Company’s membership at December 31, 2022. Refer to “Medicare Star Ratings” within the “Government Regulation” section of this Item 1 for further discussion of the decrease in the Company’s star ratings.

The Company offers HMO and consumer-directed medical and dental plans to federal employees under the Federal Employees Health Benefits (“FEHB”) Program and the Federal Employees Dental and Vision Insurance Program. Premium rates and fees for those plans are subject to federal government review and audit, which can result, and have resulted, in retroactive and prospective premium and fee adjustments and refunds to the government and/or members.

Health Care Benefits Seasonality

The Health Care Benefits segment’s quarterly operating income progression is impacted by (i) the seasonality of benefit costs which generally increase during the year as Insured members progress through their annual deductibles and out-of-pocket expense limits, (ii) continued changes in product mix between Commercial and Government medical membership and (iii) the seasonality of operating expenses, which are generally the highest during the fourth quarter due primarily to spending to support readiness for the start of the upcoming plan year and marketing associated with Medicare annual enrollment.

During the year ended December 31, 2023, overall medical costs continued to progress toward normalized utilization in the first quarter. Beginning in the second quarter of 2023, the segment experienced higher than previously expected medical cost trend in Medicare Advantage driven by increased outpatient and supplemental benefit utilization when compared with pandemic influenced utilization levels in the prior year. This elevated utilization continued through year end, which resulted in elevated medical costs throughout the remainder of 2023.

During the year ended December 31, 2022, the impact of COVID-19 within the Health Care Benefits segment generally stabilized as a result of the Company’s ability to capture COVID-19 related medical costs in pricing, and the segment experienced a return to a more normal seasonality pattern, as described above.

During the year ended December 31, 2021, the customary quarterly operating income progression was impacted by COVID-19. While overall medical costs in the first quarter were generally consistent with historical baseline levels in the aggregate, the segment experienced increased COVID-19 testing and treatment costs and lower Medicare risk-adjusted revenue. During the second quarter, COVID-19 testing and treatment costs persisted, however at levels significantly lower than those observed during the first quarter. Beginning in the third quarter, medical costs once again increased primarily driven by the spread of the emerging new variants of COVID-19, which resulted in increased testing and treatment costs that continued throughout the fourth quarter.

Health Care Benefits Competition

The health care benefits industry is highly competitive, primarily due to a large number of for-profit and not-for-profit competitors, competitors’ marketing and pricing and a proliferation of competing products, including new products that are continually being introduced into the marketplace. New entrants into the marketplace, as well as consolidation within the industry, have contributed to and are expected to intensify the competitive environment. In addition, the rapid pace of change as the industry evolves towards a consumer-focused retail marketplace, including Insurance Exchanges, and the increased use of technology to interact with members, providers and customers, increase the risks the Company faces from new entrants and disruptive actions by existing competitors compared to prior periods.

In addition to competitive pressures affecting the Company’s ability to obtain new customers or retain existing customers, the Health Care Benefits segment’s medical membership has been and may continue to be adversely affected by adverse and/or uncertain economic conditions and reductions in workforce by existing customers due to adverse and/or uncertain general economic conditions, especially in the U.S. and industries where such membership is concentrated.

Health Care Benefits Reinsurance

PBM Solutions

The Health Services segment manages prescription drug distribution directly through the Company’s specialty and mail order pharmacies and through pharmacies in its retail network. All prescriptions processed by the Company are analyzed, processed and documented by the Company’s proprietary prescription management systems. These systems provide essential features and functionality to allow plan members to utilize their prescription drug benefits. These systems also streamline the process by which prescriptions are processed by staff and network pharmacists by enhancing review of various items through automation, including plan eligibility, early refills, duplicate dispensing, appropriateness of dosage, drug interactions or allergies, over-utilization and potential fraud.

Plan Design Offerings and Administration

The Company assists its PBM clients in designing pharmacy benefit plans that help improve health outcomes while minimizing the costs to the client. The Company also assists PBM clients in monitoring the effectiveness of their plans through frequent, informal communications, the use of proprietary software, as well as through formal annual, quarterly and sometimes monthly performance reviews. The Company administers pharmacy benefit plans for clients who contract with it to facilitate prescription drug coverage and claims processing for their eligible plan members. The Company also provides administrative services for Covered Entities.

The Company makes recommendations to help PBM clients design benefit plans that promote the use of lower cost, clinically appropriate drugs and helps its PBM clients control costs by recommending plan designs that encourage the use of generic equivalents of brand name drugs when such equivalents are available. Clients also have the option, through plan design, to further lower their pharmacy benefit plan costs by setting different member payment levels for different products on their drug lists or “formularies,” which helps guide members to choose lower cost alternatives through appropriate financial incentives.

Formulary Management

The Company utilizes an independent panel of doctors, pharmacists and other medical experts, referred to as the CVS Caremark National Pharmacy and Therapeutics Committee, to review and approve the selection of drugs that meet the Company’s standards of safety and efficacy for inclusion on one of the Company’s template formularies. The Company’s formularies provide recommended products in numerous drug classes to help ensure member access to clinically appropriate drugs with alternatives within a class under the client’s pharmacy benefit plan, while helping to drive the lowest net cost for clients that

select one of the Company’s formularies. To help improve clinical outcomes for members and clients, the Company conducts ongoing, independent reviews of all drugs, including those appearing on the formularies and generic equivalent products. Many of the Company’s clients choose to adopt a template formulary offering as part of their plan design. PBM clients are given capabilities to offer real time benefits information for a member’s specific plan design, provided electronically in the Electronic Health Record at the point of prescribing, at the CVS pharmacy and directly to members.

The Company maintains a national network of approximately 66,000 retail pharmacies, consisting of approximately 38,000 chain pharmacies (which include CVS pharmacy locations) and approximately 28,000 independent pharmacies, in the U.S., including Puerto Rico, the District of Columbia, Guam and the U.S. Virgin Islands. When a customer fills a prescription in a retail pharmacy, the pharmacy sends prescription data electronically to the Company from the point-of-sale. This data interfaces with the Company’s proprietary prescription management systems, which verify relevant plan member data and eligibility, while also performing a drug utilization review to help evaluate clinical appropriateness and safety and confirming that the pharmacy will receive payment for the prescription.

Specialty and Mail Order Pharmacy Services

The Company operates mail order pharmacies, specialty mail order pharmacies and retail specialty pharmacy stores in the U.S. The mail order pharmacies are used primarily for maintenance medications, while the specialty mail order pharmacies and retail specialty pharmacy stores are used for the delivery of advanced medications to individuals with chronic or genetic diseases and disorders. The Health Services segment’s plan members or their prescribers submit prescriptions or refill requests to these pharmacies, and staff pharmacists review these prescriptions and refill requests with the assistance of the Company’s prescription management systems. This review may involve communications with the prescriber and, with the prescriber’s approval when required, can result in generic substitution, therapeutic interchange or other actions designed to help reduce cost and/or improve quality of treatment.

The Company’s mail order pharmacies and specialty mail order pharmacies have been awarded Mail Service Pharmacy and Specialty Pharmacy accreditation, respectively, from URAC. Substantially all of the Company’s specialty mail order pharmacies also have been accredited by The Joint Commission and the Accreditation Commission for Health Care (“ACHC”), which are independent, not-for-profit organizations that accredit and certify health care programs and organizations in the U.S. The ACHC accreditation includes an additional accreditation by the Pharmacy Compounding Accreditation Board, which certifies compliance with the highest level of pharmacy compounding standards.

Clinical Services

Disease Management Programs

The Company’s clinical programs and services utilize advanced protocols and offer clients convenience in working with providers and other third parties. The Company’s care management program covers diseases such as rheumatoid arthritis,

Parkinson’s disease, epilepsy and multiple sclerosis and is accredited by the NCQA. The Company’s UM program covers similar diseases and is accredited by the NCQA and URAC.

Group Purchasing Organization Services

The Company operates a group purchasing organization that negotiates pricing for the purchase of pharmaceuticals and rebates with pharmaceutical manufacturers on behalf of its participants. The Company also provides various administrative, management and reporting services to pharmaceutical manufacturers.

Value-Based Care

In response to rising healthcare spending in the U.S., commercial, government and other payors are shifting away from fee-for-service payment models towards value-based models, including risk-based payment models that tie financial incentives to quality, efficiency and coordination of care. Value-based care (“VBC”) refers to the goal of incentivizing healthcare providers to simultaneously increase quality while lowering the cost of care for patients. More specifically, providers in a VBC model are incentivized to focus on more preventative care, higher quality of care and better coordination of care to create better health outcomes and avoid potentially expensive complications from illnesses that could be managed more conveniently and cost effectively.

The Company is committed to expanding value-based care in the U.S. and delivering higher quality care to patients at a lower overall cost to the industry. The Company operates in value-based care through two primary means: providing comprehensive primary care through its Oak Street Health primary care centers and enabling independent health systems transition to value-based care through contracting and care management services. The Company’s value-based care assets typically contract with payors, primarily Medicare Advantage plans, and/or CMS.

The Company’s Oak Street Health business operates retail-like, community-based centers that provide medical primary care services and support Medicare eligible patients in the management of chronic illnesses and the prevention of unnecessary acute events. Through its centers and management services organization, the Company combines an innovative health care model and its proprietary Canopy technology with superior patient experience and quality care. The Company engages its patients through the use of an innovative community outreach approach. Once engaged, the Company integrates population health analytics, social support services and primary care into the care model to drive improved patient outcomes. The Company contracts with health plans and CMS to generate medical costs savings, assume full financial risk of its patients and realize a return on its investment in primary care.

The Company’s clinics implement a branded and consumer-focused design to create a welcoming environment that engages patients. While traditional healthcare facilities are often located in medical office buildings that are removed from where patients spend a majority of their time, the Company targets locations in highly accessible, convenient locations close to where patients live, work and shop. Each of the Company’s centers has a consistent look and feel, which contributes to the success in acquiring patients. Subsequent to the Company’s acquisition of Oak Street Health, the Company has opened 31 locations. As of December 31, 2023, the Company operated 204 centers across 25 states, which provided care for approximately 270,000 patients.

In addition to its primary care centers, the Company provides enablement services to independent health systems, assisting these groups with their transition to value-based care. The Company’s customers practice value-based care primarily through two programs administered by CMS, the Accountable Care Organization (“ACO”) Realizing Equity, Access, and Community Health (“REACH”) Model (collectively, “ACO REACH”) and the Medicare Shared Savings Program (“MSSP”), under which the Company served approximately 793,000 covered lives as of December 31, 2023.

ACOs are networks of healthcare providers and suppliers that work together to invest in infrastructure and redesign delivery processes to attempt to achieve high quality and efficient delivery of services. ACOs that achieve performance standards established by the U.S. Department of Health and Human Services (“HHS”) are eligible to share in a portion of the amounts saved by the Medicare program. ACOs employ a retrospective payment system in which Medicare reimburses providers in accordance with their usual fee-for-service payment schedule, while also tracking the total fee-for-service costs for all billable services rendered for attributed Medicare beneficiaries over the course of a year. CMS periodically compares the total amount of all fee-for-service payments for a beneficiary against a benchmark price for the annual cost of such beneficiary’s medical

care. If the total fee-for-service costs exceed the benchmark price, then typically the ACO owes a portion of the difference to CMS and, likewise, if total fee-for-service costs are lower than the benchmark price, then CMS pays a portion of the difference, representing the shared savings achieved, to the ACO.

The Company’s ACO REACH contracts are global risk arrangements and the ACO assumes full risk for the total cost of care for aligned beneficiaries and, accordingly, the ACO is subject to 100% of shared savings and shared losses. The final shared savings due from CMS or shared losses due to CMS for each performance period is reconciled in the year following the performance year.

As part of the MSSP, the Company helps unrelated providers join together to form a “collaborative ACO.” The collaborative ACO has a large attributed patient population, consisting of the beneficiaries attributed to all of the participating providers. Risks are therefore spread across a much larger beneficiary population, helping to stabilize performance and reduce downside risk for participating providers. The Company offers providers a suite of tools and services that are designed to enhance their ability to effectively manage and coordinate the care of attributed patients in order to improve patient outcomes, reduce costs and generate savings. The Company assumes a portion of the collaborative ACO’s financial risk and also receives a portion of any shared savings received by the collaborative ACO.

In-Home Health Evaluations

As a complement to its value-based care delivery, the Company operates a large mobile network of credentialed providers in the U.S. through its Signify Health business. These credentialed providers are deployed into the home primarily to conduct in-home health evaluations (“IHEs”) and perform select diagnostic services. IHEs may also be performed virtually or at a healthcare provider facility. From the date of the Signify Health acquisition through December 31, 2023, the Company performed nearly 2 million IHEs. While in the home, providers perform IHEs with the assistance of the Company’s longitudinal patient records and proprietary clinical workflow software with its integrated device hub. The Company’s software guides clinical workflows as well as in-home diagnostic screenings, yielding a rich patient report of hundreds of data points. The Company also offers diagnostic and preventive services and provides comprehensive medication review services while in the home. Through its IHEs, the Company creates a comprehensive, documented record of the clinical, social and behavioral needs of its health plan customers’ medically complex populations and seek to further engage them with the healthcare system.

The evaluation results of IHEs are provided to individuals’ primary care physicians. The Company believes sharing these results helps to fill gaps in care, while encouraging individuals who have not regularly visited their PCP to schedule a visit. The IHEs also provide health plans with insights into member health without taking members out of the home, the reports IHEs produce form a basis of the Medicare Risk Adjustment Factor (“RAF”) scores, which contribute to health plans’ ability to effectively participate in value-based and risk-adjusted government programs such as Medicare Advantage, and affect the premiums health plans receive for Medicare Advantage beneficiaries. The data gathered during an IHE is also a resource that can be used by health plans to improve their Healthcare Effectiveness Data and Information Set (“HEDIS”) scores and Medicare Advantage star ratings.

MinuteClinic

As of December 31, 2023, the Company operated more than 1,000 MinuteClinic locations in the U.S. The clinics are staffed by nurse practitioners and physician assistants who utilize nationally established guidelines to deliver a variety of health care services. Payors value these clinics because they provide convenient, high-quality, cost-effective care, in many cases offering an attractive alternative to more expensive sites of care. MinuteClinic also offers virtual care services to connect customers with licensed providers to provide access to health services remotely. MinuteClinic is collaborating with the Company’s medical and pharmacy members to help meet the needs of the Company’s health plan and client plan members by offering programs that can improve member health and lower costs. MinuteClinic also maintains relationships with leading hospitals, clinics and physicians in the communities we serve to support and enhance quality, access and continuity of care.

Health Services Information Systems

The Health Services segment’s custom-built proprietary Canopy technology is a key driver of the success of its value-based care model and foundation for patients receiving a consistent, high-quality level of care. Canopy underlies every aspect of the Company’s day-to-day clinical and operational workflows, allowing care teams to tailor care plans to the needs of both the patient and the business. Canopy integrates an immense amount of data about patients from a broad set of sources, including payor claims data, pharmacy data and medical records from hospitals and specialists and provides actionable insights and workflows to accelerate effective clinical management and oversight. Canopy leverages artificial intelligence and machine learning capabilities to create and refine a clinical rules engine (predictive models and prescriptive algorithms) that informs care delivery and addresses hospital admissions and readmissions, medical costs and patient retention.

Health Services Clients & Customers

The Company’s Health Services clients and customers are primarily employers, insurance companies, unions, government employee groups, health plans, PDPs, Managed Medicaid plans, CMS, plans offered on Insurance Exchanges, other sponsors of health benefit plans throughout the U.S., patients who receive care in the Health Services segment’s medical clinics, virtually or in the home, as well as Covered Entities. The Health Services segment’s revenues are primarily generated from the sale and managing of prescription drugs to eligible members in benefit plans maintained by clients. Pharmaceuticals are provided to eligible members in benefit plans maintained by clients and utilize the Company’s information systems, among other things, to help perform safety checks, drug interaction screening and identify opportunities for generic substitution.

The Company’s primary care operations rely on its value-based capitated partnerships with payors and CMS which manage and market Medicare Advantage plans across the U.S. The Company has strategic value-based relationships with over 30 different payors as of December 31, 2023, including each of the top 5 national payors by number of Medicare Advantage patients. These existing contracts and relationships and their understanding of the value of the Company’s model reduces the risk of entering into new markets as the Company typically has payor contracts before entering a new market. Maintaining, supporting and growing these relationships, particularly as the Company enters new geographies, is critical to its long-term success.

The Company’s value-based care arrangements are primarily directed at independent health systems, including community hospitals, physician practices and clinics, participating in, or seeking to participate in, ACOs or contract with Medicare Advantage plans.

The Company’s IHE operations customers are primarily Medicare Advantage health plans and Managed Medicaid organizations. In 2023, the Company had IHE contracts with 52 health plans in the U.S., including 25 of the 50 largest Medicare Advantage plans.

Health Services Seasonality

The majority of the Health Services segment revenues, including revenues generated from its PBM services, are not seasonal in nature.

The Company’s primary care operations experience some variability depending upon the time of year in which they are measured. Typically, a significant portion of the Company’s at-risk patient growth is experienced during the first quarter, when plan enrollment selections made during the prior annual enrollment period from October 15th through December 7th of the prior year take effect. Per-patient revenue will generally decline over the course of the year as new patients typically join with less complete or accurate documentation (and therefore lower risk-adjustment scores), and patient attrition skews towards higher-risk (and therefore greater revenue) patients. Finally, medical costs will vary seasonally depending on a number of factors including the weather, which can be a driver of certain illnesses such as the influenza virus.

Revenues generated from the Company’s IHEs and related services are generally lower in the fourth quarter of each calendar year than the other quarters. Each year, IHE customers provide a member list, which may be supplemented or amended during the year. Customers generally limit the number of times the Company may attempt to contact their members. Throughout the year, as IHEs are completed and the Company attempts to contact members, the number of members who have not received an IHE and whom the Company is still able to contact declines, typically resulting in fewer IHEs scheduled during the fourth quarter.

Health Services Competition

The Company believes the primary competitive factors in the health services industry include: (i) the ability to negotiate favorable discounts from drug manufacturers as well as to negotiate favorable discounts from, and access to, retail pharmacy networks; (ii) the ability to identify and apply effective cost management programs utilizing clinical strategies, including the development and utilization of preferred formularies; (iii) the ability to market PBM and other health products and services; (iv) the commitment to provide flexible, clinically-oriented services to clients and be responsive to clients’ needs; (v) the ability to attract and retain physicians, nurse practitioners, physician assistants and other medical personnel; (vi) the quality, scope and costs of products and services offered to clients and their members, as well as the care delivered to customers; and (vii) operational excellence in delivering services.

The Health Services segment has a significant number of competitors offering PBM services, including large, national PBM companies (e.g., Prime Therapeutics and MedImpact), PBMs owned by large national health plans (e.g., the Express Scripts business of Cigna Corporation and the OptumRx business of UnitedHealth) and smaller standalone PBMs. The Health Services segment’s MinuteClinic offerings compete with retail health clinics, urgent care and primary care offices. The Company competes for provider solutions and health information technology (“HIT”) business with other large health plans and commercial health care benefit insurance companies as well as information technology companies and companies that specialize in provider solutions and HIT.

The Company’s ACO operations compete with healthcare risk management providers. Key competitors are companies that work directly with providers to enable them to successfully take risk in value-based care arrangements. Some of these competitors focus on a specific function – like analytics – while others offer more comprehensive services. The MSSP offers comprehensive services, including a collaborative ACO model, a suite of population health tools and services, and the ability to facilitate in-home annual wellness visits, which is unique and distinguishes the Company from competitors. Some key competitors operate nationally (e.g., Aledade, Collaborative Health Systems, Evolent Health, Vytalize Health and Stellar Health) while other competitors are more geographically focused (e.g., Equality Health and Physicians of Southwest Washington).

The Company’s IHE and related services operations compete with a wide variety of local and national providers of in-home, virtual and in-person diagnostic and evaluative services. Competitors include pure-play companies whose principal business is providing health risk assessments and similar services (e.g., Matrix Medical Network), as well as large payors, which may use a variety of different providers to perform health risk assessments across care settings or may perform some or all of their health risk assessments utilizing their own in-house capabilities.

The Pharmacy & Consumer Wellness segment dispenses prescriptions in its retail pharmacies and through its infusion operations, provides ancillary pharmacy services including pharmacy patient care programs, diagnostic testing and vaccination administration, and sells a wide assortment of health and wellness products and general merchandise. The segment also conducts long-term care pharmacy (“LTC”) operations, which distribute prescription drugs and provide related pharmacy consulting and ancillary services to long-term care facilities and other care settings, and provides pharmacy fulfillment services to support the Health Services segment’s specialty and mail order pharmacy offerings. As of December 31, 2023, the Pharmacy

& Consumer Wellness segment operated more than 9,000 retail locations, as well as online retail pharmacy websites, LTC pharmacies and on-site pharmacies, retail specialty pharmacy stores, compounding pharmacies and branches for infusion and enteral nutrition services. During the year ended December 31, 2023, the Pharmacy & Consumer Wellness segment filled 1.6 billion prescriptions on a 30-day equivalent basis and dispensed approximately 26.7% of total retail pharmacy prescriptions in the U.S.

Pharmacy & Consumer Wellness Products and Services

A typical retail store sells prescription drugs and a wide assortment of high-quality, nationally advertised brand name and proprietary brand merchandise. Pharmacy locations may also contract with Covered Entities under the federal 340B drug pricing program. Front store categories include over-the-counter drugs, consumer health products, beauty products and personal care products. The Company purchases merchandise from numerous manufacturers and distributors. The Company believes that competitive sources are readily available for substantially all of the products carried in its retail stores and the loss of any one supplier would not likely have a material effect on the Pharmacy & Consumer Wellness segment. LTC operations include distribution of prescription drugs and related consulting and ancillary services.

Pharmacy & Consumer Wellness revenues by major product group are as follows:

Pharmacy revenues represented over three-fourths of Pharmacy & Consumer Wellness segment revenues in each of 2023, 2022 and 2021. The Company believes that retail pharmacy operations will continue to represent a critical part of the Company’s business due to industry demographics, e.g., an aging American population consuming a greater number of prescription drugs, prescription drugs being used more often as the first line of defense for managing illness, the introduction of new pharmaceutical products, the need for vaccinations, including the COVID-19 vaccination, and Medicare Part D growth. The Company believes the retail pharmacy business benefits from investment in both people and technology, as well as innovative collaborations with health plans, PBMs and providers. Given the nature of prescriptions, consumers want their prescriptions filled accurately by professional pharmacists using the latest tools and technology, and ready when promised. Consumers also need medication management programs and better information to help them get the most out of their health care dollars. To assist consumers with these needs, the Company has introduced integrated pharmacy health care services that provide an earlier, easier and more effective approach to engaging consumers in behaviors that can help lower costs, improve health and save lives.

Front Store

On-site Pharmacies

The Company also operates a limited number of pharmacies located at client sites, which provide certain health plan members and customers with a convenient alternative for filling their prescriptions and receiving vaccinations, including the COVID-19 vaccination.

Specialty and Mail Order Pharmacy Fulfillment Services

The Pharmacy & Consumer Wellness segment provides pharmacy fulfillment services to support the Health Services segment’s specialty and mail order pharmacy offerings, in exchange for which the Health Services segment pays an administrative service fee to the Pharmacy & Consumer Wellness segment.

Infusion and Enteral Services

The Company operates branches for compounding, specialty infusion and enteral nutrition services in the U.S.

Medical Diagnostic Testing

The Company offers medical diagnostic testing through its CVS pharmacy locations. The Company offered point of care COVID-19 testing at more than 2,000 pharmacy locations as of December 31, 2023.

Long-term Care Pharmacy Operations

Community Location Development

CVS Health’s community health destinations are an integral part of its ability to meet the needs of consumers and maintain its leadership position in the changing health care landscape. When paired with its rapidly expanding digital presence, the Company’s physical presence in thousands of communities across the country represents a competitive advantage by allowing it to develop deep and trusted relationships through everyday engagement in consumer health. The Company’s community health destinations have played, and will continue to play, a key role in the Company’s continued growth and success. During 2023, the Company opened approximately 39 new locations, relocated 5 locations and closed approximately 318 locations.

The Company’s continuous assessment of its national footprint is an essential component of competing effectively in the current health care environment. On an ongoing basis, the Company evaluates changes in population, consumer buying patterns and future health needs to assess the ability of its existing stores and locations to meet the needs of its consumers and the business. During the fourth quarter of 2021, the Company completed a strategic review of its retail business and announced its plans to reduce store density in certain locations through the closure of approximately 900 retail stores between 2022 and 2024. As of December, 31, 2023, the Company has closed approximately 600 retail stores in connection with this strategic review.

Pharmacy & Consumer Wellness Information Systems

The success of the Pharmacy & Consumer Wellness segment’s businesses is dependent upon the Company’s ability to establish and maintain contractual relationships with pharmacy benefit managers and other payors on acceptable terms. Substantially all of the Pharmacy & Consumer Wellness segment’s pharmacy revenues are derived from pharmacy benefit managers, managed care organizations (“MCOs”), government funded health care programs, commercial employers and other third-party payors. No single Pharmacy & Consumer Wellness payor accounted for 10% or more of the Company’s consolidated total revenues in 2023, 2022 or 2021.

Pharmacy & Consumer Wellness Seasonality

The majority of Pharmacy & Consumer Wellness segment revenues, particularly pharmacy revenues, generally are not seasonal in nature. However, front store revenues tend to be higher during the December holiday season. In addition, both pharmacy and front store revenues are affected by the timing and severity of the cough, cold and flu season. Uncharacteristic or extreme weather conditions also can adversely affect consumer shopping patterns and Pharmacy & Consumer Wellness revenues, expenses and operating results.

During the year ended December 31, 2023, the impact of COVID-19 on the Pharmacy & Consumer Wellness segment continued to decline compared to the prior year. OTC test kit demand was highest during the first quarter and declined to its lowest quarterly volume during the fourth quarter. In contrast, contributions from COVID-19 vaccinations reached their highest quarterly volume during the fourth quarter.

During the year ended December 31, 2022, the customary quarterly operating income progression in the Pharmacy & Consumer Wellness segment continued to be impacted by COVID-19. During the first quarter, the Company saw high volumes of administration of COVID-19 vaccinations, as well as demand for OTC test kits in the front store, particularly in the beginning of the year when the Omicron variant incidence was high. In addition, the Company administered the highest quarterly volume of COVID-19 diagnostic tests of 2022 during the first quarter, however a decline compared to the prior year. During the second and third quarters, the Company continued to generate earnings from the sale of OTC test kits, as customers performed more in-home testing versus diagnostic testing, in addition to earnings from the continued administration of COVID-19 diagnostic testing and vaccinations, albeit at lower levels than those experienced in the first quarter. During the fourth quarter, the Company saw an increase in COVID-19 vaccine administration from the prior quarter related to the bivalent COVID-19 booster.

During the year ended December 31, 2021, the customary quarterly operating income progression was impacted by COVID-19. During the first quarter, the Company experienced reduced customer traffic in its retail pharmacies, which reflected the impact of a weaker cough, cold and flu season, while it administered the highest quarterly volume of COVID-19 diagnostic tests. During the second quarter, the segment generated earnings from COVID-19 vaccinations and saw improved customer traffic as vaccinated customers began more actively shopping in CVS locations. During the third and fourth quarters, emerging new variants drove the continued administration of COVID-19 vaccinations (including booster shots) and diagnostic testing, while the segment also generated earnings from the sale of OTC test kits in the front store.

Pharmacy & Consumer Wellness Competition

The retail pharmacy business is highly competitive. The Company believes that it competes principally on the basis of: (i) store location and convenience, (ii) customer service and satisfaction, (iii) product selection and variety, and (iv) price. In the areas it serves, the Company competes with other drugstore chains (e.g., Walgreens and Rite Aid), supermarkets, discount retailers (e.g., Walmart), independent pharmacies, restrictive pharmacy networks, online retailers (e.g., Amazon), membership clubs, infusion pharmacies, as well as mail order dispensing pharmacies.

LTC pharmacy services are highly regional or local in nature, and within a given geographic area of operation, highly competitive. The Company’s largest LTC pharmacy competitor nationally is PharMerica. The Company also competes with numerous local and regional institutional pharmacies, pharmacies owned by long-term care facilities and local retail pharmacies. Some states have enacted “freedom of choice” or “any willing provider” requirements as part of their state Medicaid programs or in separate legislation, which may increase the competition that the Company faces in providing services to long-term care facility residents in these states.

The Company presents the remainder of its financial results in the Corporate/Other segment, which primarily consists of:

The Company and Cardinal Health, Inc. (“Cardinal”) each have a 50% ownership in Red Oak Sourcing, LLC (“Red Oak”), a generic pharmaceutical sourcing entity. Under this arrangement, the Company and Cardinal contributed their sourcing and supply chain expertise to Red Oak and agreed to source and negotiate generic pharmaceutical supply contracts for both companies through Red Oak. Red Oak does not own or hold inventory on behalf of either company.

The Company funds the growth of its businesses through a combination of cash flow from operations, commercial paper and other short-term borrowings, as well as long-term borrowings. For additional information on the Company’s working capital practices, see “Liquidity and Capital Resources” in the MD&A included in Item 7 of this 10-K. Employer groups, individuals, college students, part-time and hourly workers, health plans, providers, governmental units, government-sponsored plans (with the exception of Medicare Part D services, which are described below), labor groups and expatriates, which represent the vast majority of Health Care Benefits segment revenues, typically settle in less than 30 days. As a provider of Medicare Part D services, the Company contracts annually with CMS. Utilization of services each plan year results in the accumulation of either a receivable from or a payable to CMS. The timing of settlement of the receivable or payable with CMS takes several quarters, which impacts working capital from year to year. The majority of the Pharmacy & Consumer Wellness segment non-pharmacy revenues are paid in cash, or with debit or credit cards. Managed care organizations, pharmacy benefit managers, government funded health care programs, commercial employers and other third party insurance programs, which represent the vast majority of the Company’s consolidated pharmacy revenues, typically settle in less than 30 days. The remainder of the Company’s consolidated pharmacy revenues are paid in cash, or with debit or credit cards.

Overview

At CVS Health, we share a single, clear purpose: bringing our heart to every moment of your health. We devote significant time and attention to the attraction, development and retention of talent to deliver high levels of service to our customers. Our commitment to them includes a competitive rewards package and programs that support our diverse range of colleagues in rewarding and fulfilling careers. As of December 31, 2023, we employed over 300,000 colleagues primarily in the U.S. including in all 50 states, the District of Columbia and Puerto Rico, approximately 73% of whom were full-time.

We believe engaged colleagues produce stronger business results and are more likely to build a career with the Company. Each year we conduct engagement surveys that provide colleagues with an opportunity to share their opinions and experiences with respect to their role, their team and the enterprise to help CVS Health Corporation’s Board of Directors (the “Board”) and our management identify areas where we can improve colleague experience. These surveys cover a broad range of topics including development and opportunities, diversity management, recognition, performance, well-being, compliance and continuous improvement. In 2023, we conducted engagement surveys in both January and November. More than 145,000 colleagues participated in each survey and overall engagement stayed consistent across surveys.

The Board, our Chief Executive Officer (“CEO”) and our Chief People Officer provide oversight of our human capital strategy, which consists of the following categories: total rewards; diversity, equity and inclusion; colleague development; and health and safety.

Total Rewards

We recognize how vital our colleagues are to our success and strive to offer a comprehensive and competitive mix of pay and benefits to meet the varying needs of our colleagues and their families. In addition to competitive wages, the comprehensive list of programs and benefits that we offer include annual bonuses, stock awards, 401(k) plans including matching company contributions, no cost comprehensive wellness screenings, tobacco cessation and weight management programs, no cost confidential counseling and no cost financial navigation support, an employee stock purchase plan, health care and insurance benefits, paid time off, flexible work schedules, family leave, dependent care resources, colleague assistance programs and tuition assistance, retiree medical access, and discount programs, among many others, depending on eligibility.

Diversity, Equity, Inclusion & Belonging

We believe that a diverse workforce creates a healthier, stronger and more sustainable company. We aim to attract, develop, retain and support a diverse workforce that reflects the many customers, patients, members and communities we serve. Our Diversity Management Leadership Council, a cross-functional group of senior leaders appointed by our CEO, works with our Strategic Diversity Management leadership team to intentionally embed the full spectrum of diversity across all facets of our business. For our efforts, we have been recognized as one of Seramount’s Best Companies for Multicultural Women and earned a 100 percent score on the Disability Equality Index, meaning the company is recognized as a “Best Place to Work for Disability Inclusion.” The Company discloses information on our diversity, equity, inclusion and belonging strategy and programs in our annual Environmental, Social and Governance (“ESG”) Report.

As a foundation of diversity and inclusion, we continuously focus on talented representation across our business. In 2023, 70% of our total colleague population and 46% of our colleagues at the manager level and above self-reported as female. In addition, in 2023 our colleagues reported their race/ethnicity as: White (47%), Black/African American (18%), Hispanic/Latino (17%), Asian (12%) and Other (6%). The appendix to our ESG Report and our EEO-1 Employer Information Report include additional information on the diversity of our workforce.

Our diversity strategy emphasizes workforce representation across the full spectrum of diversity, a workplace that promotes inclusion and belonging for all, and a marketplace that reflects the customers, consumers, and communities we serve. We have continued the deployment of our INCLUDE program to activate inclusive behaviors. We support 16 Colleague Resource Groups (“CRGs”) that include more than 29,000 colleagues across the enterprise. These groups represent a wide range of professional, cultural, ethical and personal affinities and interests, as well as formal mentoring programs. Our CRGs provide all of our colleagues with an opportunity to connect and network with one another through a particular affinity, culture or interest. Each of our CRGs is sponsored by a senior leader.

Colleague Development

The Company offers a number of resources and programs that attract, engage, develop, advance and retain colleagues. Training and development provides colleagues the support they need to perform well in their current role while planning and preparing for future roles and career growth. We offer an online orientation program that pairs new hires with seasoned colleagues and the training continues throughout a colleague’s career through in-person, virtual and self-paced learning at all levels. We also provide mentoring, tools and workshops for colleagues to manage their career development. We offer a variety of management and leadership programs that develop incumbent diverse and other high potential colleagues. In addition, we offer leadership development to all leaders across the organization to best support their growth and their leadership of our colleagues. Our broad training practices include updated, tech-enabled tools and keep our colleagues informed of new developments in our industry that are relevant to their roles. During the year ended December 31, 2023, our colleagues invested approximately 14 million hours in learning and development courses.

Our colleague development programming also promotes the importance of compliance across our business. Our colleagues demonstrate this commitment through our annual Code of Conduct training, which nearly 100% of active colleagues completed in 2023. In 2023, we launched approximately 70 different training courses as part of our Enterprise Compliance Training Program.

Health & Safety

We have a strong commitment to providing a safe working environment. We have implemented an environmental health and safety management system to support adherence and monitoring of programs designed to make our various business operations compliant with applicable occupational safety and health regulations and requirements. Our Health, Safety, & Environmental

Department oversees the implementation and adherence to programs like Powered Industrial Truck training, materials handling and storage, selection of personal protective equipment and workplace violence prevention.

We utilize a Management Information System to track compliance, analyze data and concentrate on key areas of risk to reduce the chance of workplace incidents. We focus on identifying causes and improving performance when workplace incidents occur. We capture colleague observations and feedback through programs like our Behavior Based Safety and our Safety Hazard and Awareness Reporting Program. We also engage leaders in promoting a culture of safety. With safety task forces in place at each distribution center, we empower leaders and safety business partners to identify policies, procedures and processes that could improve their own operations.

From the outset of the COVID-19 pandemic, we took a comprehensive approach to managing occupational health and safety challenges presented by the pandemic, including implementing facial covering requirements for our workplaces and providing face masks to colleagues, providing sick leave, implementing symptom screening measures and implementing additional protocols in accordance with applicable Occupational Safety and Health Administration (“OSHA”) requirements and guidance and Centers for Disease Control and Prevention (“CDC”) guidelines for workplaces. We have emphasized the importance of taking immediate steps toward full vaccination.

Overview

Healthy People

We keep people at the center of all our decisions across CVS Health because we believe every person has the fundamental right to be as healthy as possible. Every day, we work to make health care simpler, more accessible, affordable and more convenient for every person we serve. Whether we are increasing equitable access to health care and services, reducing energy use or making investments to support under-resourced communities to improve health outcomes, we are leveraging our expertise and resources to improve people’s health.

Healthy Business

We are purpose-driven – all of us. Diversity, equity, inclusion and belonging are a part of our core values and imperative to operating at our best. Together, we set high standards and hold ourselves to them. We work daily to create value for everyone who trusts and relies on us and ensure every action we take is done ethically and transparently. We support our colleagues' education and growth with scholarships, promote and develop leadership skills through training and development courses and continue strengthening our pipeline for a diverse workforce by expanding our workforce initiatives into our communities. We integrate governance and partnership across our business units and seek responsible and equitable purchasing practices throughout our supply chain. We hold our supplier's partners to the same standard.

Healthy Community

We are strengthening our communities by addressing the unique barriers to improving health outcomes locally. We will make a lasting impact by pulling together all our assets to encourage a more holistic approach and collaboration across our programs, investments and organizations. As part of this work, we are investing nationwide to expand access to mental and maternal health care services and address health-related social needs to complement our company’s strategy and focus areas. When a natural disaster or other incident affects the communities where we live and work, we swiftly take action to ensure our response addresses our colleagues' and customers' evolving needs. Our colleagues are also making a meaningful difference in the communities where we live and work by donating their time and talents, and we’re supporting their efforts by contributing to the causes that mean the most to them.

Healthy Planet

We are inseparable from the environment we operate in and the people we serve. That’s why we continue to invest in initiatives and programs that focus on improving the health of our planet by advancing our sustainability commitments and addressing the environmental factors that contribute to health inequities. We were one of the first companies in the world to have our net-zero targets validated by the Science-Based Targets Initiative’s (SBTi) net-zero methodology. This set us on the path to achieving net-zero emissions from our direct operations by 2048 and across our value chain by 2050. We’re also committed to achieving carbon neutrality by 2030. To make a meaningful impact, we are reducing the carbon footprint of our direct operations and supply chain by working across our expansive retail footprint and supply chain to increase energy efficiency, implement water-saving programs, eliminate waste, and reduce fuel usage.

The Company has registered and/or applied to register a variety of trademarks and service marks used throughout its businesses, as well as domain names, and relies on a combination of copyright, patent, trademark and trade secret laws, in addition to contractual restrictions, to establish and protect the Company’s proprietary rights. The Company regards its intellectual property as having significant value in the Health Care Benefits, Health Services and Pharmacy & Consumer Wellness segments. The Company is not aware of any facts that could materially impact the continuing use of any of its intellectual property.

Overview

The Company’s operations are subject to comprehensive federal, state and local laws and regulations and comparable multiple levels of international regulation in the jurisdictions in which it does business. There also continues to be a heightened level of review and/or audit by federal, state and international regulators of the health and related benefits industry’s business and reporting practices. In addition, many of the Company’s PBM clients and the Company’s payors in the Pharmacy & Consumer Wellness segment, including insurers, Medicare plans, Managed Medicaid plans and MCOs, are themselves subject to extensive regulations that affect the design and implementation of prescription drug benefit plans that they sponsor. Similarly, the Company’s LTC clients, such as skilled nursing facilities, are subject to government regulations, including many of the same government regulations to which the Company is subject.

The laws and rules governing the Company’s businesses, the contracts they enter into, and interpretations of those laws and rules continue to expand and become more restrictive each year and are subject to frequent change. The application of these complex legal and regulatory requirements to the detailed operation of the Company’s businesses creates areas of uncertainty. Further, there are numerous proposed health care, financial services and other laws and regulations at the federal, state and international levels, some of which could adversely affect the Company’s businesses if they are enacted. The Company cannot predict whether pending or future federal or state legislation or court proceedings will change aspects of how it operates in the specific markets in which it competes or the health care industry generally, but if changes occur, the impact of any such changes could have a material adverse impact on the Company’s businesses, operating results, cash flows and/or stock price. Possible regulatory or legislative changes include the federal or one or more state governments fundamentally restructuring the Commercial, Medicare or Medicaid marketplace; reducing payments to the Company in connection with Medicare, Medicaid, dual eligible or special needs programs; increasing its involvement in drug reimbursement, pricing, purchasing, and/or importation; or changing the laws governing PBMs.

The Company has internal control policies and procedures and conducts training and compliance programs for its employees to help prevent, detect and correct prohibited practices. However, if the Company’s employees or agents fail to comply with applicable laws governing its international or other operations, it may face investigations, prosecutions and other legal proceedings and actions which could result in civil penalties, administrative remedies and criminal sanctions. Any failure or alleged failure to comply with applicable laws and regulations summarized below, or any adverse applications or interpretations of, or changes in, the laws and regulations affecting the Company and/or its businesses, could have a material adverse effect on the Company’s operating results, financial condition, cash flows and/or stock price. See Item 1A of this 10-K, “Risk Factors—Risks from Changes in Public Policy and Other Legal and Regulatory Risks,” and Item 3 of this 10-K, “Legal Proceedings,” for further information.

The Company can give no assurance that its businesses, financial condition, operating results and/or cash flows will not be materially adversely affected, or that the Company will not be required to materially change its business practices, based on: (i)

Laws and Regulations Related to Multiple Segments of the Company’s Business

The AKS prohibits, among other things, knowingly and willfully offering, paying, soliciting or receiving remuneration, directly or indirectly, in cash or kind, to induce or reward either the referral of an individual for, or the purchase, order or recommendation of, any good or service, for which payment may be made in whole or in part under federal health care programs, such as Medicare and Medicaid. Some court decisions have held that the statute may be violated even if only one purpose of remuneration is to induce referrals. Certain of the Company’s programs involve arrangements with payments intended to influence behavior relative to Medicare and other federal health care program beneficiaries, including risk sharing and “gainsharing” arrangements. While there is no fixed definition of a gainsharing arrangement, the term typically refers to an arrangement in which a share of cost savings for patient care attributable in part to a physician’s efforts are shared with the physician. The Office of the Inspector General of the HHS (the “OIG”) has recognized that there are legitimate interests in enlisting physicians in effort to reduce unnecessary costs from the health care system and, if appropriately structured, such gainsharing arrangements should not violate the AKS. Effective in early 2021, CMS and the OIG established new safe harbors that protect certain value-based arrangements, and the Company has integrated its understanding of these safe harbors into its new and existing programs.

The Stark Law prohibits a physician who has a financial relationship, or who has an immediate family member who has a financial relationship, with entities providing “designated health services” (“DHS”) from referring Medicare patients to such entities for the furnishing of DHS, unless an exception applies. The Stark Law prohibits any entity providing DHS that has received a prohibited referral from presenting, or causing to be presented, a claim or billing for the services arising out of the prohibited referral. Similarly, the Stark Law prohibits an entity from “furnishing” DHS to another entity with which it has a financial relationship when that entity bills for the service. The prohibition applies regardless of the reasons for the financial relationship and the referral. Unlike the AKS, the Stark Law is a strict liability statute where unlawful intent need not be demonstrated. Although uncertainty exists, some federal agencies and some courts have taken the position that the Stark Law also applies to Medicaid. With respect to certain CMS innovation models in which we may participate, the OIG and CMS jointly issued waivers of the Stark Law. In early 2021, CMS established new exceptions to the Stark Law that protect certain value-based arrangements.

included in commercial benefit designs, limits commercial individual and small group rating and pricing practices, encourages additional competition (including potential incentives for new participants to enter the marketplace), and includes regulations and processes that could delay or limit the Company’s ability to appropriately increase its health plan premium rates. This in turn could adversely affect the Company’s ability to continue to participate in certain product lines and/or geographies that it serves today.

In June 2021, the U.S. Supreme Court dismissed a challenge on procedural grounds that argued the ACA is unconstitutional in its entirety and issued an opinion preserving the ACA and its consumer protections in its current form. Even though the ACA was deemed constitutional, there may nevertheless be continued efforts to invalidate, modify, repeal or replace portions of it. In addition to litigation, parts of the ACA continue to evolve through the promulgation of executive orders, legislation, regulations and guidance at the federal or state level. The Company expects the ACA, including potential changes thereto, to continue to significantly impact its business operations and operating results, including pricing, medical benefit ratios (“MBRs”) and the geographies in which the Company’s products are available.

The Company continues to expand the number of counties in which it offers Medicare products. The Company has expanded its Medicare service area and products in 2023 and is seeking to substantially grow its Medicare membership, revenue and operating results over the next several years, including through growth in Medicare Supplement products. The anticipated organic expansion of the Medicare service area and Medicare products offered and the Medicare-related provisions of the ACA significantly increase the Company’s exposure to funding and regulation of, and changes in government policy with respect to and/or funding or regulation of, the various Medicare programs in which the Company participates, including changes in the amounts payable to us under those programs and/or new reforms or surcharges on existing programs. For example, the ACA requires minimum MLRs for Medicare Advantage and Medicare Part D plans of 85%. If a Medicare Advantage or Medicare Part D contract pays minimum MLR rebates for three consecutive years, it will become ineligible to enroll new members. If a Medicare Advantage or Medicare Part D contract pays such rebates for five consecutive years, it will be terminated by CMS. It is possible that certain Medicare Advantage contracts may not meet the 85% MLR for consecutive years.

The Company’s Medicare Advantage and PDP products are heavily regulated by CMS. The regulations and contractual requirements applicable to the Company and other private participants in Medicare programs are complex, expensive to comply with and subject to change. Payments the Company receives from CMS for its Medicare Advantage and Part D businesses also are subject to risk adjustment based on the health status of the individuals enrolled. Elements of that risk adjustment mechanism continue to be challenged by the U.S. Department of Justice (the “DOJ”), the OIG and CMS itself. For example, CMS made significant changes to the structure of the hierarchical condition category model in version 28, which may impact risk adjustment factor (“RAF”) scores for a larger percentage of Medicare Advantage beneficiaries and could result in changes to beneficiary RAF scores with or without a change in the patient’s health status. Substantial changes in the risk adjustment mechanism, including changes that result from enforcement or audit actions, could materially affect the amount of the Company’s Medicare reimbursement; require the Company to raise prices or reduce the benefits offered to Medicare beneficiaries; impact the services provided by, or the financial performance of, Oak Street Health and Signify Health; and potentially limit the Company’s (and the industry’s) participation in the Medicare program.

The Company has invested significant resources to comply with Medicare standards, and its Medicare compliance efforts will continue to require significant resources. CMS may seek premium and other refunds, prohibit the Company from continuing to market and/or enroll members in or refuse to passively enroll members in one or more of the Company’s Medicare or dual eligible plans, exclude us from participating in one or more Medicare, dual eligible or dual eligible special needs plan programs and/or institute other sanctions and/or civil monetary penalties against the Company if it fails to comply with CMS regulations or its Medicare contractual requirements. The Company’s Medicare Supplement products are regulated at the state level and are subject to similar significant compliance requirements and risks.

In addition, in November 2020, the HHS released the final Rebate Rule (the “Rebate Rule”), which eliminates the regulatory safe harbor from prosecution under the AKS for rebates from pharmaceutical companies to PBMs in Medicare Part D, replacing it with two far narrower safe harbors designed to directly benefit patients with high out-of-pocket costs and to change the way PBMs are compensated. The new safe harbors are (i) for rebates which are passed on to the patient at the point of sale and (ii)

for flat service fee payments made to PBMs which cannot be tied to the list prices of drugs. It is unclear whether the Rebate Rule will be enforceable, whether pharmaceutical companies will respond by reducing list prices, whether list prices in the private market may also be reduced, and what the resulting impact will be to PBMs or the Company. The Pharmaceutical Care Management Association (the “PCMA”), which represents PBMs, has filed a suit in an effort to block the Rebate Rule, claiming that the Rebate Rule would lead to higher premiums in Medicare Part D and was adopted in an unlawful manner. The Bipartisan Infrastructure Act of 2021 delays the effective date of the rebate rule to January 2026, and the Inflation Reduction Act, enacted in August 2022 (the “IRA”), further delays the Rebate Rule through 2032.

Going forward, the Company expects CMS, the OIG, the DOJ, other federal agencies and the U.S. Congress to continue to scrutinize closely each component of the Medicare program (including Medicare Advantage, PDPs, dual eligible plans, broker compensation and marketing, and provider network access and adequacy), modify the terms and requirements of the program and possibly seek to recast or limit private insurers’ roles. Any of the federal agencies noted above or U.S. Congress may also recommend changes or take additional action with respect to the way in which producers are compensated. For example, CMS has recently proposed new limitations on the amounts producers may earn for selling our Medicare Advantage and Part D plans, and the IRA contains changes to the Part D program that began in 2023 and will continue to 2032 that could shift more of the claim liability to plans and away from the government. It is also possible that Congress may consider changes to Medicare Advantage payment policies due to recent recommendations by the Medicare Payment Advisory Commission and to reduce the potential added cost burden of costly new benefits, or policies that impact drug pricing such as price controls and inflationary rebates applied to pharmaceutical manufacturers. In addition, states are increasingly requiring companies to offer Medicaid within a state and conducting competitive bid processes to qualify to offer dual eligible products.

It is not possible to predict the outcome of such regulatory or Congressional activity, any of which could materially and adversely affect the Company.

In addition to a quality rating system that applies to Medicaid and Managed Medicaid plans, federal regulations give states the option to choose to establish a minimum MLR of at least 85% for their Managed Medicaid plans, including those offered by the Company. Regardless of whether a state establishes a minimum MLR, it must use plan-reported MLR data to set future payment rates for managed care, so that its plans will “reasonably achieve” an MLR of at least 85%. For Managed Medicaid products, states may use more stringent definitions of “medical loss ratio” or impose other requirements related to minimum MLR. Minimum MLR requirements and similar actions further limit the level of margin the Company can earn in its Insured Medicaid products while leaving the Company exposed to medical costs that are higher than those reflected in its pricing. The Company also may be subject to significant fines, penalties, premium refunds and litigation if it fails to comply with minimum MLR laws and regulations.

States may also establish their own standards and use discretion in choosing what determines compliance within Medicaid contracts, including, among other provisions, standards for determining provider network adequacy, staffing, service operations, utilization management, provider support and claims payment.

States continue to consider Medicaid expansion; however, ten states have not yet expanded and may not do so. States may opt out of the elements of the ACA requiring expansion of Medicaid coverage without losing their current federal Medicaid funding. In addition, the election of new Governors and/or state legislatures may impact states’ previous decisions regarding Medicaid expansion. Although Congress enacted incentives for states that had not yet done so to expand Medicaid, this incentive alone may not persuade holdout states to expand.

States have flexibility related to rate setting and provider network adequacy that could adversely or positively impact our Medicaid plans. Other changes related to managed care operations include beneficiary communications, appeals and grievances, and provider directories.

The economic aspects of the Medicaid, dual eligible and dual eligible special needs plan business vary from state to state and are subject to frequent change. Medicaid premiums are paid by each state and differ from state to state. The federal government and certain states also are considering proposals and legislation for Medicaid and dual eligible program reforms or redesigns, including restrictions on the collection of manufacturer’s rebates on pharmaceuticals by Medicaid MCOs and their contracted PBMs, further program, population and/or geographic expansions of risk-based managed care, increasing beneficiary cost-

sharing or payment levels, and changes to benefits, reimbursement, eligibility criteria, provider network adequacy requirements (including requiring the inclusion of specified high cost providers in the Company’s networks) and program structure. In some states, current Medicaid and dual eligible funding and premium revenue may not be adequate for the Company to continue program participation. The Company’s Medicaid and dual eligible contracts with states (or sponsors of Medicaid managed care plans) are subject to cancellation by the state (or the sponsors of the managed care plans) after a short notice period without cause (e.g., when a state discontinues a managed care program) or in the event of insufficient state funding.

The Company’s Medicaid, dual eligible and dual eligible special needs plan products also are heavily regulated by CMS and state Medicaid agencies, which have the right to audit the Company’s performance to determine compliance with CMS contracts and regulations. The Company’s Medicaid products, dual eligible products and CHIP contracts also are subject to complex federal and state regulations and oversight by state Medicaid agencies regarding the services provided to Medicaid enrollees, payment for those services, network requirements (including mandatory inclusion of specified high-cost providers), and other aspects of these programs, and by external review organizations which audit Medicaid plans on behalf of state Medicaid agencies. The laws, regulations and contractual requirements applicable to the Company and other participants in Medicaid and dual eligible programs, including requirements that the Company submit encounter data to the applicable state agency, are extensive, complex and subject to change. The Company has invested significant resources to comply with these standards, and its Medicaid and dual eligible program compliance efforts will continue to require significant resources. CMS and/or state Medicaid agencies may fine the Company, withhold payments to the Company, seek premium and other refunds, terminate the Company’s existing contracts, elect not to award the Company new contracts or not to renew the Company’s existing contracts, prohibit the Company from continuing to market and/or enroll members in or refuse to automatically assign members to one or more of the Company’s Medicaid or dual eligible products, exclude the Company from participating in one or more Medicaid or dual eligible programs and/or institute other sanctions and/or civil monetary penalties against the Company if it fails to comply with CMS or state regulations or contractual requirements. CMS has proposed requiring that health plans offering certain dual eligible programs must also offer Medicaid programs, which could impact the Company’s ability to obtain or retain membership in its dual eligible programs.

The Company cannot predict whether pending or future federal or state legislation or court proceedings will change various aspects of the Medicaid program, nor can it predict the impact those changes will have on its business operations or operating results, but the effects could be materially adverse.

On January 30, 2023, CMS released the final rule concerning Part C contract-level Risk Adjustment Data Validation Audits (the “RADV Audit Rule”). The RADV Audit Rule eliminated the application of a fee-for-service adjuster (“FFS Adjuster”) in contract-level RADV audits but continued the use of extrapolation in such audits of Medicare Advantage organizations. The FFS Adjuster that was announced in 2012 was to be used by CMS to determine a permissible level of payment error. By applying the FFS Adjuster, Medicare Advantage organizations would have been liable for repayments only to the extent that their extrapolated payment errors exceeded the error rate in Original Medicare, which could have impacted the extrapolated repayments to which Medicare Advantage organizations are subject. Under the RADV Audit Rule, CMS is now conducting RADV audits of Medicare Advantage organizations, including the Company’s Medicare Advantage plans, for payment year 2018 and subsequent payment years using extrapolation without the application of a FFS Adjuster. The RADV Audit Rule may have potential adverse effects, which could be material, on the Company’s operating results, financial condition, and cash flows. CMS also has announced that it will not conduct RADV audits on all contracts; instead, it will only audit contracts it believes are at the highest risk for overpayments based on its statistical modeling. The RADV Audit Rule is subject to ongoing litigation and the outcome and future impacts are uncertain.

In addition, state Medicaid agencies regularly audit the Company’s performance across all areas of its contractual obligations to the state to determine compliance and quality of services. The Company may be subject to, among other penalties, significant fines, sanctions, corrective actions, and enrollment freezes depending on the findings of these audits and reviews. The

Company’s ongoing performance and compliance with program requirements can impact our ability to expand and retain Medicaid business. State Medicaid agencies are also increasingly using the audit process to challenge the legality of PBM practices, such as guaranteed effective rate reconciliations with retail pharmacies and transmission fees.

The Company’s 2023 star ratings were used to determine which of its Medicare Advantage plans qualify for bonus payments in 2024. Based on the 2023 star ratings, the Company’s Medicare Advantage plans are not eligible for full level quality bonuses in 2024, which could reduce profit margin. CMS released the Company’s 2024 star ratings in October 2023, which will impact revenues in 2025. The percentage of Aetna Medicare Advantage members in 4+ Star plans is expected to return to 87% in 2024 (based on enrollment and contract affiliation as of December 31, 2023), as compared to the unmitigated 21% in 2023 based on the 2023 star ratings. The main driver of this increase was a half star improvement in the Aetna National PPO, which increased from 3.5 stars to 4.0 stars. This means that the Company expects its Medicare Advantage plans will again be eligible for full level quality bonuses in 2025.

The Company faces a challenge from the impact of the increasing cost of medical care (including prescription medications), changes to methodologies for determining payments and CMS local and national coverage decisions that require the Company to pay for services and supplies that are not factored into the Company’s bids. The federal government may seek to impose restrictions on the configuration of pharmacy or other provider networks for Medicare Advantage and/or PDP plans, or otherwise restrict the ability of these plans to alter benefits, negotiate prices or establish other terms to improve affordability or maintain viability of products. The Company currently believes that the payments it has received and will receive in the near term are adequate to justify the Company’s continued participation in the Medicare Advantage and PDP programs, although there are economic and political pressures to continue to reduce spending on the program, and this outlook could change.

individuals or the purchase, lease or order of items or services for which payment may be made under Medicare, Medicaid or certain other federal and state health care programs. A number of states have similar laws, some of which are not limited to services paid for with government funds. Sanctions for violating these federal and state anti-remuneration laws may include imprisonment, criminal and civil fines, and exclusion from participation in Medicare, Medicaid and other federal and state government-sponsored health care programs. Companies involved in public health care programs such as Medicare and/or Medicaid are required to maintain compliance programs to detect and deter fraud, waste and abuse, and are often the subject of fraud, waste and abuse investigations and audits. The Company has invested significant resources to comply with Medicare and Medicaid program standards. Ongoing vigorous law enforcement and the highly technical regulatory scheme mean that the Company’s compliance efforts in this area will continue to require significant resources.

The federal Health Insurance Portability and Accountability Act of 1996 and the regulations issued thereunder (collectively, “HIPAA”), as further modified by the American Recovery and Reinvestment Act of 2009 (“ARRA”) impose extensive requirements on the way in which health plans, providers, health care clearinghouses (known as “covered entities”) and their business associates use, disclose and safeguard protected health information (“PHI”). Further, ARRA requires the Company and other covered entities to report any breaches of PHI to impacted individuals and to the HHS and to notify the media in any states where 500 or more people are impacted by the unauthorized release or use of or access to PHI. Criminal penalties and civil sanctions may be imposed for failing to comply with HIPAA standards. The Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), enacted as part of ARRA, amended HIPAA to impose additional restrictions on third-party funded communications using PHI and the receipt of remuneration in exchange for PHI. The HITECH Act also extended HIPAA privacy and security requirements and penalties directly to business associates.

In addition to HIPAA, state health privacy laws apply to the extent they are more protective of individual privacy than is HIPAA, including laws that place stricter controls on the release of information relating to specific diseases or conditions and requirements to notify members of unauthorized release or use of or access to PHI. States also have adopted regulations to implement provisions of the Financial Modernization Act of 1999 (also known as the Gramm-Leach-Bliley Act (“GLBA”)) which generally require insurers, including health insurers, to provide customers with notice regarding how their non-public personal health and financial information is used and the opportunity to “opt out” of certain disclosures before the insurer shares such information with a non-affiliated third party. Like HIPAA, GLBA sets a “floor” standard, allowing states to adopt more stringent requirements governing privacy protection. Complying with additional state requirements requires us to make additional investments beyond those the Company has made to comply with HIPAA and GLBA.

The Cybersecurity Information Sharing Act of 2015 encourages organizations to share cyber threat indicators with the federal government and, among other things, directs HHS to develop a set of voluntary cybersecurity best practices for organizations in the health care industry. In addition, states have begun to enact more comprehensive privacy laws and regulations addressing consumer rights to data access, deletion, protection or transparency, such as the California Consumer Privacy Act (“CCPA”). States also are starting to issue regulations and proposed regulations specifically related to cybersecurity, such as the regulations

issued by the New York Department of Financial Services. Complying with conflicting cybersecurity regulations, which may differ from state to state, requires significant resources. In addition, differing approaches to state privacy and/or cyber-security regulation and varying enforcement philosophies may materially and adversely affect the Company’s ability to standardize its products and services across state lines. Widely-reported large scale commercial data breaches in the U.S and abroad increase the likelihood that additional data security legislation will be considered by additional states. These legislative and regulatory developments will impact the design and operation of the Company’s businesses, its privacy and security strategy and its web-based and mobile assets.

Finally, each Public Exchange is required to adhere to privacy and security standards with respect to PII, and to impose privacy and security standards that are at least as protective of PII as those the Public Exchange has implemented for itself or non-Public Exchange entities, which include insurers offering plans through the Public Exchange and their designated downstream entities, including PBMs and other business associates. These standards may differ from, and be more stringent than, HIPAA.

See Item 1C of this 10-K, “Cybersecurity,” for more information on the Company’s cybersecurity risk management and governance.

The Consolidated Appropriations Act of 2021 was signed into law in December 2020 and contains further transparency provisions requiring group health plans and health insurance issuers to report certain prescription drug costs, overall spending on health services and prescription drugs, and information about premiums and the impact of rebates and other remuneration on premiums and out-of-pocket costs to the Tri-Departments. No later than 18 months after the first submission and bi-annually thereafter, the Tri-Departments will release a public report on drug pricing trends, drug reimbursement, and the impact of drug prices on premiums. The first filings of plan year data were required in December 2022 and will be required annually in June of each year on an ongoing basis.

such as phone calls, texts or emails. Under certain circumstances, these laws provide consumers with a private right of action. Violations of these laws could result in substantial statutory penalties and other sanctions.

PBM offerings of prescription drug coverage under certain risk arrangements may be subject to laws and regulations in various states. Such laws may require that the party at risk become licensed as an insurer, establish reserves or otherwise demonstrate financial viability. Laws that may apply in such cases include insurance laws and laws governing MCOs and limited prepaid health service plans. In addition, most states require that PBMs become directly registered or licensed with the department of insurance or similar government oversight agency regardless of any arrangements they have with clients. PBM licensure laws may include oversight of certain PBM activities and operations and may include auditing of those activities.

The states of domicile of the Company’s regulated subsidiaries have statutory risk-based capital (“RBC”) requirements for health and other insurance companies and HMOs based on the National Association of Insurance Commissioners’ (the “NAIC”) Risk-Based Capital for Insurers Model Act (the “RBC Model Act”). These RBC requirements are intended to assess the capital adequacy of life and health insurers and HMOs, taking into account the risk characteristics of a company’s investments and products. The RBC Model Act sets forth the formula for calculating RBC requirements, which are designed to take into account asset risks, insurance risks, interest rate risks and other relevant risks with respect to an individual company’s business. In general, under these laws, an insurance company or HMO must submit a report of its RBC level to the insurance department or insurance commissioner of its state of domicile for each calendar year. At December 31, 2023, all of the Company’s insurance and HMO subsidiaries were either above the RBC level that would require regulatory action or otherwise subject to an agreement to avoid any regulatory action.

For information regarding restrictions on certain payments of dividends or other distributions by the Company’s HMO and insurance company subsidiaries, see Note 14 ‘‘Shareholders’ Equity’’ included in Item 8 of this 10-K.

The holding company laws for the states of domicile of certain of the Company’s subsidiaries also restrict the ability of any person to obtain control of an insurance company or HMO without prior regulatory approval. Under those statutes, without such approval (or an exemption), no person may acquire any voting security of an insurance holding company (such as the Company’s ultimate parent company, CVS Health Corporation) that controls an insurance company or HMO, or merge with such a holding company, if as a result of such transaction such person would control the insurance holding company. Control is generally defined as the direct or indirect power to direct or cause the direction of the management and policies of a person and is presumed to exist if a person directly or indirectly owns or controls 10% or more of the voting securities of another person.

Certain states have laws that prohibit submitting a false claim or making a false record or statement in order to secure reimbursement from an insurance company. These state laws vary, and violation of them may lead to the imposition of civil or criminal penalties.

Some of the Company’s health and related benefits and large case pensions products and services and related fees also are subject to potential issues raised by judicial interpretations relating to ERISA. Under those interpretations, together with DOL regulations, the Company may have ERISA fiduciary duties with respect to medical members, PBM members and/or certain general account assets held under contracts that are not guaranteed benefit policies. As a result, certain transactions related to those general account assets are subject to conflict of interest and other restrictions, and the Company must provide certain disclosures to policyholders annually. The Company must comply with these restrictions or face substantial penalties.

provisions that alter and limit some of the options that an ERISA plan can use, because none of the provisions mandate that ERISA plans make any specific choices. On appeal, the Tenth Circuit decided that the Oklahoma law was preempted by ERISA and, in part, by Medicare Part D, and the Company expects the Oklahoma Attorney General to file a writ of certiorari with the U.S. Supreme Court.

It is uncertain whether the Company can counter the potential adverse effects of such potential legislation or regulation on its operating results or cash flows, including whether it can recoup, through higher premium rates, expanded membership or other measures, the increased costs of mandated coverage or benefits, assessments, fees, taxes or other increased costs, including the cost of modifying its systems to implement any enacted legislation or regulations.

The Company’s businesses also may be affected by other legislation and regulations. The Dodd-Frank Wall Street Reform and Consumer Protection Act creates incentives for whistleblowers to speak directly to the government rather than utilizing internal compliance programs and reduces the burden of proof under the Foreign Corrupt Practices Act of 1977 (the “FCPA”). There also are laws and regulations that set standards for the escheatment of funds to states.

Health savings accounts, health reimbursement arrangements and flexible spending accounts and certain of the tax, fee and subsidy provisions of the ACA also are regulated by the U.S. Department of the Treasury and the IRS.

The Company also may be adversely affected by court and regulatory decisions that expand or revise the interpretations of existing statutes and regulations or impose medical malpractice or bad faith liability. Federal and state courts, including the U.S. Supreme Court, continue to consider cases, and federal and state regulators continue to issue regulations and interpretations, addressing bad faith liability for denial of medical claims, the scope of ERISA’s fiduciary duty requirements, the scope of the False Claims Act and the pre-emptive effect of ERISA and Medicare Part D on state laws.

clinical activities. Clinicians engaged in a professional practice in connection with the provision of clinical services must satisfy applicable state licensing requirements and must act within their scope of practice.

The Company’s international operations are subject to different, and sometimes more stringent, legal and regulatory requirements, which vary widely by jurisdiction, including anti-corruption laws; economic sanctions laws; various privacy, insurance, tax, tariff and trade laws and regulations; corporate governance, privacy, data protection (including the EU’s General Data Protection Regulation which began to apply across the EU during 2018), data mining, data transfer, labor and employment, intellectual property, consumer protection and investment laws and regulations; discriminatory licensing procedures; compulsory cessions of reinsurance; required localization of records and funds; higher premium and income taxes; limitations on dividends and repatriation of capital; and requirements for local participation in an insurer’s ownership. In addition, the presence of operations in foreign countries potentially increases the Company’s exposure to the anti-bribery, anti-corruption and anti-money laundering provisions of U.S. law, including the FCPA, and corresponding foreign laws, including the U.K. Bribery Act 2010 (the “UK Bribery Act”).

Laws and Regulations Related to the Health Care Benefits Segment

In addition to the laws and regulations discussed above that may affect multiple segments of the Company’s business, the Company is subject to federal, state, local and international statutes and regulations, as well as government program contracts, governing its Health Care Benefits segment specifically.

Each health insurer and HMO must file periodic financial and operating reports with the states in which it does business. In addition, health insurers and HMOs are subject to state examination and periodic license renewal. Applicable laws also restrict the ability of the Company’s regulated subsidiaries to pay dividends, and certain dividends require prior regulatory approval. In addition, some of the Company’s businesses and related activities may be subject to PPO, MCO, utilization review or TPA-related licensure requirements and regulations. These licensure requirements and regulations differ from state to state, but may contain provider network, contracting, product and rate, financial and reporting requirements. There also are laws and regulations that set specific standards for the Company’s delivery of services, payment of claims, fraud prevention, protection of consumer health information, and payment for covered benefits and services.

The Company’s operations, current and past business practices, current and past contracts, and accounts and other books and records are subject to routine, regular and special investigations, audits, examinations and reviews by, and from time to time the Company receives subpoenas and other requests for information from, federal, state and international supervisory and enforcement agencies, Attorneys General and other state, federal and international governmental authorities and legislators.

states, these laws and regulations restrict the Company’s ability to price for the risk it assumes and/or reflect reasonable costs in the Company’s pricing.

The ACA expanded the premium rate review process by, among other things, requiring the Company’s Commercial Insured rates to be reviewed for “reasonableness” at either the state or the federal level. HHS established a federal premium rate review process that generally applies to proposed premium rate increases equal to or exceeding a federally (or lower state) specified threshold. HHS’s rate review process imposes additional public disclosure requirements as well as additional review on filings requesting premium rate increases equal to or exceeding this “reasonableness” threshold. These combined state and federal review requirements may prevent, further delay or otherwise affect the Company’s ability to price for the risk it assumes, which could adversely affect its MBRs and operating results, particularly during periods of increased utilization of medical services and/or medical cost trend or when such utilization and/or trend exceeds the Company’s projections.

The ACA also specifies minimum MLRs of 85% for large group Commercial products and 80% for individual and small group Commercial products. Because the ACA minimum MLRs are structured as “floors” for many of their requirements, states have the latitude to enact more stringent rules governing these restrictions. For Commercial products, states have and may adopt higher minimum MLR requirements, use more stringent definitions of “medical loss ratio,” incorporate minimum MLR requirements into prospective premium rate filings, require prior approval of premium rates or impose other requirements related to minimum MLR. Minimum MLR requirements and similar actions further limit the level of margin the Company can earn in its Insured Commercial products while leaving the Company exposed to medical costs that are higher than those reflected in its pricing. The Company also may be subject to significant fines, penalties, premium refunds and litigation if it fails to comply with minimum MLR laws and regulations.

In addition, the Company requested increases in its premium rates in its Commercial Health Care Benefits business for 2024 and expects to request future increases in those rates in order to adequately price for projected medical cost trends, required expansions of coverage and rating limits, and significant assessments, fees and taxes imposed by the federal and state governments, including as a result of the ACA. The Company’s rates also must be adequate to reflect adverse selection in its products, particularly in small group Commercial products. These rate increases may be significant and thus heighten the risks of adverse publicity, adverse regulatory action and adverse selection and the likelihood that the Company’s requested premium rate increases will be denied, reduced or delayed, which could lead to operating margin compression.

Many of the laws and regulations governing the Company’s pricing and underwriting practices also limit the differentials in premium rates insurers and other carriers may charge between new and renewal business, and/or between groups based on differing characteristics. They may also require that carriers disclose to customers the basis on which the carrier establishes new business and renewal premium rates and limit the ability of a carrier to terminate customers’ coverage.

Laws and Regulations Related to the Health Services Segment

In addition to the laws and regulations discussed above that may affect multiple segments of the Company’s business, the Company is subject to federal, state and local statutes and regulations governing the operation of its Health Services segment specifically. Among these are the following:

The Company’s PBM activities also are regulated directly and indirectly at the federal and state levels, including being subject to the False Claims Act and state false claims acts and the AKS and state anti-kickback laws. These laws and regulations govern, and proposed legislation and regulations may govern and/or further restrict, critical PBM practices, including disclosure, receipt and retention of rebates and other payments received from pharmaceutical manufacturers; use of, administration of and/or changes to drug formularies, maximum allowable cost (“MAC”) list pricing, average wholesale prices (“AWP”) and/or clinical programs; the offering to plan sponsors of pricing that includes retail network “differential” or “spread” (i.e., a difference between the drug price charged to the plan sponsor by a PBM and the price paid by the PBM to the dispensing provider); reconciliation to pricing guarantees; disclosure of data to third parties; drug UM practices; the level of duty a PBM owes its customers; configuration of pharmacy networks; the operations of the Company’s pharmacies (including audits of its pharmacies); disclosure of negotiated provider reimbursement rates; disclosure of fees associated with administrative service agreements and patient care programs that are attributable to members’ drug utilization; and registration or licensing of PBMs. Failure by the Company or one of its PBM services suppliers to comply with these laws or regulations could result in material fines and/or sanctions and could have a material adverse effect on the Company’s operating results and/or cash flows.

The Company’s PBM service contracts, including those in which the Company assumes certain risks under performance guarantees or similar arrangements, are generally not subject to insurance regulation by the states. However, state departments of insurance are increasing their oversight of PBM activities due to legislation passing in nearly all states requiring PBMs to register or obtain a license with the department, authorizing agencies to conduct market conduct examinations and other audits of our licensed entities. In addition, rulemaking in a number of states expands the underlying statutory law particularly with respect to the scope of application to pharmacy appeals and reimbursement, network design, member cost sharing and pharmacy audits.

private and public payors (including CMS) to pay pharmacies for dispensing generic prescription drugs. MAC prices specify the allowable reimbursement by a PBM for a particular strength and dosage of a generic drug that is available from multiple manufacturers but sold at different prices. State legislation can regulate the disclosure of MAC prices and MAC price methodologies, the kinds of drugs that a PBM can pay for at a MAC price, and the rights of pharmacies to appeal a MAC price established by a PBM. Some states now require the PBM to reimburse a pharmacy’s actual acquisition cost if the PBM denies a pharmacy’s MAC reimbursement appeal. These laws could negatively affect the Company’s ability to establish MAC prices for generic drugs. Additionally, some states have passed legislation that would restrict certain types of retroactive reconciliation or recoupment from pharmacies in the network or create a reimbursement benchmark mandate, such as the national average drug acquisition cost and/or the wholesale acquisition cost (“WAC”), plus a set dispensing fee, for pharmacies in the network.

Historically, the medical profession has recognized an ethical prohibition against physicians (and often other providers) paying professional peers and others for referrals and fee splitting. Fee splitting generally occurs when a physician splits part of the professional fee earned from treating a referred patient with the source of the referral. Among the public policy harms that have been cited in support of fee splitting prohibitions are (a) unnecessary medical services, and (b) incompetent specialists. In response to these legitimate concerns, many states have adopted prohibitions against fee splitting. States have taken a variety of legislative approaches to fee splitting, from near complete bans, to bans with various exceptions, to no prohibition at all. Some of the prohibitions, have a broad reach and also prohibit otherwise legitimate business relationships with entities that are not healthcare providers, such as billing agencies or management companies.

Legal structures have been developed to comply with various state corporate practice of medicine and fee splitting laws. The “captive” or “friendly” professional corporation model allows a legal entity (typically a professional corporation or professional limited liability company) whose shareholders are all physicians to employ the physicians (and other providers). The physician entity then contracts with a corporate entity referred to as a management services organization (“MSO”) to provide various management services. The physician entity is kept “friendly” through a stock transfer restriction agreement and/or other

relationship between the MSO and the physician owners of the professional corporation. The fees under the management services arrangement must be carefully structured to comply with state fee splitting laws, which in some states may prohibit percentage-based fees.

Laws and Regulations Related to the Pharmacy & Consumer Wellness Segment

In addition to the laws and regulations discussed above that may affect multiple segments of the Company’s business, the Company is subject to federal, state and local statutes and regulations governing the operation of its Pharmacy & Consumer Wellness segment specifically, including laws and regulations that limit the sale of alcohol, mandate a minimum wage, govern the practices of optometry or audiology, or impact the provision of dietician services and the sale of durable medical equipment, contact lenses, eyeglasses and hearing aids.

You should carefully consider each of the following risks and uncertainties and all of the other information set forth in this 10-K. These risks and uncertainties and other factors may affect forward-looking statements, including those we make in this 10-K or elsewhere, such as in news releases or investor or analyst calls, meetings or presentations, on our websites or through our social media channels. The risks and uncertainties described below are not the only ones we face. There can be no assurance that we have identified all the risks that affect us. Additional risks and uncertainties not presently known to us or that we currently believe to be immaterial also may adversely affect our businesses. Any of these risks or uncertainties could cause our actual results to differ materially from our expectations and the expected results discussed in our forward-looking statements. You should not consider past results to be an indication of future performance.

If any of the following risks or uncertainties develops into actual events or if the circumstances described in the risks or uncertainties occur or continue to occur, those events or circumstances could have a material adverse effect on our businesses, operating results, cash flows, financial condition and/or stock price, among other effects on us. You should read the following section in conjunction with the MD&A, included in Item 7 of this 10-K, our consolidated financial statements and the related notes, included in Item 8 of this 10-K, and our “Cautionary Statement Concerning Forward-Looking Statements” in this 10-K.

The following is a summary of the principal risks we face that could negatively impact our businesses, operating results, cash flows and/or financial condition:

We may not be able to accurately forecast health care and other benefit costs, including as a result of pandemics or disease outbreaks, which could adversely affect our Health Care Benefits segment’s operating results. There can be no assurance that future health care and other benefits costs will not exceed our projections.

Premiums for our Insured Health Care Benefits products, which comprised 94% of our Health Care Benefits revenues for 2023, are priced in advance based on our forecasts of health care and other benefit costs during a fixed premium period, which is generally twelve months. These forecasts are typically developed several months before the fixed premium period begins, are influenced by historical data (and recent historical data in particular), are dependent on our ability to anticipate and detect medical cost trends and changes in our members’ behavior and health care utilization patterns and medical claim submission patterns and require a significant degree of judgment. For example, our revenue on Medicare policies is based on bids submitted in June of the year before the contract year. Cost increases in excess of our projections cannot be recovered in the fixed premium period through higher premiums. As a result, our profits are particularly sensitive to the accuracy of our forecasts of the increases in health care and other benefit costs that we expect to occur and our ability to anticipate and detect medical cost trends. During periods when health care and other benefit costs, utilization and/or medical costs trends experience significant volatility and medical claim submission patterns are changing rapidly, as they did during the COVID-19 pandemic, accurately detecting, forecasting, managing, reserving and pricing for our (and our self-insured customers’) medical cost trends and incurred and future health care and other benefits costs is more challenging. There can be no assurance regarding the accuracy of the health care or other benefit cost projections reflected in our pricing, and whether our health care and other benefit costs will be affected by pandemics, disease outbreaks and other external events over which we have no control. Even relatively small differences between predicted and actual health care and other benefit costs as a percentage of premium revenues can result in significant adverse changes in our Health Care Benefits segment’s operating results.

While the public health emergency related to COVID-19 expired in May 2023, COVID-19 still exists and it may, like many other respiratory viruses, wax and wane depending on geography and seasonality. The future impact COVID-19 will have on the Company and its ability to accurately forecast health care and other benefit costs is uncertain, and will depend on geographies impacted, whether new variants emerge and their severity, the availability and costs of testing, vaccination and treatment, and legal and regulatory actions. COVID-19 may also impact provider behavior, utilization trends, membership, and overall economic conditions. These impacts could be adverse and material.

A number of factors contribute to rising health care and other benefit costs, including previously uninsured members entering the health care system; Medicare members’ utilization of supplemental benefits; other changes in members’ behavior, health care utilization patterns and utilization management; turnover in our membership, health care provider and member fraud; additional government mandated benefits or other regulatory changes, including changes to or as a result of the ACA; changes in the health status of our members; the aging of the population and other changing demographic characteristics; advances in medical technology; increases in the number and cost of prescription drugs (including specialty pharmacy drugs and ultra-high cost drugs and therapies); direct-to-consumer marketing by drug manufacturers; the increasing influence of social media on our members’ health care utilization and other behaviors; the shift to a consumer-driven business model; changes in health care practices and general economic conditions (such as inflation and employment levels); increases in labor costs; pandemics, epidemics or disease outbreaks; influenza-related health care costs (which may be substantial and higher than we expected); clusters of high-cost cases; natural disasters and extreme weather events (which may increase in frequency or intensity as a result of climate change); and numerous other factors that are or may be beyond our control. For example, the 2022-2023 influenza season had an earlier than average start; the 2020-2021 influenza season was impacted by efforts taken to reduce the spread of COVID-19; and the 2019-2020 influenza season maintained a high level of severity for a longer period of time than average. In addition, government-imposed limitations on Medicare and Medicaid reimbursements to health plans and providers have caused the private sector to bear a greater share of increasing health care and other benefits costs over time, and future amendments to the ACA that increase the uninsured population may amplify this issue.

Our Health Care Benefits segment’s operating results and competitiveness depend in large part on our ability to appropriately manage future health care and other benefit costs through underwriting criteria, product design, provider network configuration, negotiation of favorable provider contracts and medical management programs. Our medical cost management programs may not be successful and may have a smaller impact on health care and benefit costs than we expect. The factors described above may adversely affect our ability to predict and manage health care and other benefit costs, which can adversely affect our competitiveness and operating results.

Furthermore, if we are not able to accurately and promptly anticipate and detect medical cost trends or accurately estimate the cost of incurred but not yet reported claims or reported claims that have not been paid, our ability to take timely corrective

actions to limit future health care costs and reflect our current benefit cost experience in our pricing process may be limited, which would further amplify the extent of any adverse impact on our operating results. These risks are particularly acute during periods when health care and other benefit costs, utilization and/or medical cost trends experience significant volatility and medical claim submission patterns are changing rapidly, as they did during the COVID-19 pandemic. Such risks are further magnified by the ACA and other existing and future legislation and regulations that limit our ability to price for our projected and/or experienced increases in utilization and/or medical cost trends.

Adverse economic conditions in the U.S. and abroad can materially and adversely impact our businesses, operating results, cash flows and financial condition, and we do not expect these conditions to improve in the near future.

Adverse economic conditions in the U.S. and abroad, including those caused by inflation, high interest rates and supply chain disruptions, can materially and adversely impact our businesses, operating results, cash flows and financial condition, including:

Each of our segments operates in a highly competitive and evolving business environment; and operating income in the industries in which we compete may decline.

Each of our segments, Health Care Benefits, Health Services, which includes our PBM business, and Pharmacy & Consumer Wellness, operates in a highly competitive and evolving business environment. Specifically:

In addition, competitors in each of our businesses may offer services and pricing terms that we may not be willing or able to offer. Competition also may come from new entrants and other sources in the future. Unless we can demonstrate enhanced value to our clients through innovative product and service offerings in the rapidly changing health care industry, we may be unable to remain competitive.

Disruptive innovation by existing or new competitors could alter the competitive landscape in the future and require us to accurately identify and assess such alterations and make timely and effective changes to our strategies and business model to compete effectively. For example, decisions to buy our Health Care Benefits and Health Services products and services increasingly are made or influenced by consumers, either through direct purchasing (e.g., Medicare Advantage plans and PDPs) or through Public Exchanges and private health insurance exchanges that allow individual choice. Consumers also are increasingly seeking to access consumer goods and health care products and services locally and through other direct channels such as mobile devices and websites. To compete effectively in the consumer-driven marketplace, we will be required to develop or acquire new capabilities, attract new talent and develop new service and distribution relationships that respond to consumer needs and preferences.

Changes in marketplace dynamics or the actions of competitors or manufacturers, including industry consolidation, the emergence of new competitors and strategic alliances, and decisions to exclude us from new narrow or restricted retail pharmacy networks could materially and adversely affect our businesses, operating results, cash flows and/or prospects.

Our recent acquisitions of Signify Health and Oak Street Health subject us to new and additional risks beyond those to which we have been historically subject.

We consummated the Signify Health acquisition in March 2023 through which we expanded our offerings to include health risk assessments, value-based care and provider enablement services, and we also consummated the Oak Street Health acquisition in May 2023 through which we offer multi-payor, senior-focused, value-based primary care for Medicare-eligible patients, broadening our ability to provide primary care services. The Signify Health and the Oak Street Health businesses are subject to many of the risks described in this Item 1A, as well as certain additional risks that are different from the risks our businesses have historically faced.

The additional risks to which our Signify Health business is subject include, but are not limited to, the following:

The additional risks to which our Oak Street Health business is subject include, but are not limited to, the following:

The additional risks faced by Signify Health and Oak Street Health may also compound, or be heightened by, many of our other risks, including the risks related to adverse economic conditions in the U.S. and abroad, cybersecurity, and compliance with applicable laws and regulations, among others. The Signify Health and the Oak Street Health businesses may also be subject to additional risks the existence or significance of which we may not have anticipated prior to the respective acquisitions of such businesses. Any risks associated with the Signify Health or the Oak Street Health business, if they materialize, could adversely affect our business, financial condition and results of operations, including our ability to timely and effectively integrate the businesses in our operations and the timing and extent of realization of synergies and other benefits that we expected in connection with the acquisitions. Our experience in managing the additional risks associated with the acquisitions is more limited than our experience in managing the risks associated with our historical businesses, and there is no assurance that we will be able to effectively manage or mitigate such risks.

In January 2022, we entered into the Public Exchanges in eight states, expanded to a total of twelve states in 2023, and further expanded to a total of 17 states in 2024. To compete effectively on Public Exchanges, we have developed or acquired the technology, systems, tools and talent necessary to interact with Public Exchanges and engage Public Exchange consumers

through enhanced consumer-focused sales, marketing channels and customer interfaces. We have also created new customer service programs and product offerings. While participating on the Public Exchanges, we will have to respond to pricing and other actions taken by existing competitors and regulators as well as potentially disruptive new entrants, which could reduce our profit margins. Due to the price transparency provided by Public Exchanges, when we market products we face competitive pressures from existing and new competitors who may have lower cost structures. Our competitors may bring their Public Exchange and other consumer products to market more quickly, have greater experience marketing to consumers and/or may be targeting the higher margin portions of our business. We can provide no assurance that we will be able to compete successfully or profitably on Public Exchanges or that we will be able to benefit from any opportunities presented by Public Exchanges.

In addition, there can be no assurance that our pricing or other actions will result in the profitability of our Public Exchange products in 2024 or any future year. We have set 2024 premium rates for our Public Exchange products based on our projections, including as to the health status and quantity of membership and utilization of medical and/or other covered services by members. The accuracy of the projections reflected in our pricing may be impacted by (i) adverse selection among individuals who require or utilize more expensive medical and/or other covered services, (ii) other plans’ withdrawals from participation in the Public Exchanges we serve, (iii) a rapid increase or decline in membership, and (iv) legislation, regulations, enforcement activity and/or judicial decisions that cause Public Exchanges to operate in a manner different than what we projected in setting our premium rates, including the potential expiration of premium subsidies in 2025.

A change in our Health Care Benefits product mix may adversely affect our profit margins.

Our Insured Health Care Benefits products that involve greater potential risk generally tend to be more profitable than our ASC products. Historically, smaller employer groups have been more likely to purchase Insured Health Care Benefits products because such purchasers are generally unable or unwilling to bear greater liability for health care expenditures, although over the last several years even relatively small employers have moved to ASC products. We also serve, and expect to grow our business with, government-sponsored programs, including Medicare and Medicaid, that are subject to competitive bids and have lower profit margins than our Commercial Insured Health Care Benefits products. A shift of enrollees from more profitable products to less profitable products could have a material adverse effect on the Health Care Benefits segment’s operating results.

Negative public perception of the industries in which we operate, or of our industries’ or our practices, can adversely affect our businesses, operating results, cash flows and prospects.

Our brand and reputation are two of our most important assets, and the industries in which we operate have been and are negatively perceived by the public from time to time. Negative publicity may come as a result of adverse media coverage, litigation against us and other industry participants, the ongoing public debates over drug pricing, PBMs, government involvement in drug pricing and purchasing, changes to the ACA, “surprise” medical bills, governmental hearings and/or investigations, actual or perceived shortfalls regarding our industries’ or our own products, including Medicare Advantage plans in general, and/or business practices (including PBM operations, drug pricing and insurance coverage determinations) and social media and other media relations activities. Negative publicity also may come from a failure to meet customer expectations for consistent, high quality and accessible care. This risk may increase as we continue to offer products and services that make greater use of data and as our business model becomes more focused on delivering health care to consumers.

Negative public perception and/or publicity of our industries in general, or of us or our key vendors, brokers or product distribution networks in particular, can further increase our costs of doing business and adversely affect our operating results and our stock price by:

We must maintain and improve our relationships with our retail and specialty pharmacy customers and increase the demand for our products and services, including proprietary brands.

The success of our businesses depends in part on customer loyalty, superior customer service and our ability to persuade customers to frequent our retail stores and online sites and to purchase products in additional categories and our proprietary brands. Failure to timely identify or effectively respond to changing consumer preferences, spending patterns and evolving demographic mixes in the communities we serve, including shifts toward online shopping, or failure to maintain desirable selections of merchandise, store environments or guests experiences could adversely affect our relationship with our customers and clients and the demand for our products and services and could result in excess inventories of products.

We offer our retail customers proprietary brand products that are available exclusively at our retail stores and through our online retail sites. The sale of proprietary products subjects us to unique risks including potential product liability risks, mandatory or voluntary product recalls, potential supply chain and distribution chain disruptions for raw materials and finished products, our ability to successfully protect our intellectual property rights and the rights of applicable third parties, and other risks generally encountered by entities that source, market and sell private-label products. We also face similar risks for the other products we sell in our retail operations, including supply chain and distribution chain disruption risk. Any failure to adequately address some or all of these risks could have an adverse effect on our retail business, operating results, cash flows and/or financial condition. Additionally, an increase in the sales of our proprietary brands may adversely affect our sales of products owned by our suppliers and adversely impact certain of our supplier relationships. Our ability to locate qualified, economically stable suppliers who satisfy our requirements, and to acquire sufficient products in a timely and effective manner, is critical to ensuring, among other things, that customer confidence is not diminished. Any failure to develop sourcing relationships with a broad and deep supplier base could adversely affect our operating results and erode customer loyalty.

We also could be adversely affected if we fail to identify or effectively respond to changes in marketplace dynamics. For example, specialty pharmacy represents a significant and growing proportion of prescription drug spending in the U.S., a significant portion of which is dispensed outside of traditional retail pharmacies. Because our specialty pharmacy business focuses on complex and high-cost medications, many of which are made available by manufacturers to a limited number of pharmacies (so-called limited distribution drugs) that serve a relatively limited universe of patients, the future growth of our specialty pharmacy business depends largely upon expanding our access to key drugs and penetration in certain treatment categories. Any contraction of our base of patients or reduction in demand for the prescriptions we currently dispense could have an adverse effect on our specialty pharmacy business, operating results and cash flows.

We face risks relating to the availability, pricing and safety profiles of prescription drugs that we purchase and sell.

The profitability of our Pharmacy & Consumer Wellness and Health Services segments is dependent upon the utilization of prescription drug products. We dispense significant volumes of brand name and generic drugs from our retail, LTC, specialty and mail order pharmacies, and the retail pharmacies in our PBM’s network also dispense significant volumes of brand name and generic drugs. Our revenues, operating results and cash flows may decline if physicians cease writing prescriptions for drugs or the utilization of drugs is reduced, including due to:

In addition, increased utilization of generic drugs (which normally yield a higher gross profit rate than equivalent brand name drugs) has resulted in pressure to decrease reimbursement payments to retail, mail order, specialty and LTC pharmacies for generic drugs, causing a reduction in our margins on sales of generic drugs. Consolidation within the generic drug manufacturing industry and other external factors may enhance the ability of manufacturers to sustain or increase pricing of generic drugs and diminish our ability to negotiate reduced generic drug acquisition costs. Any inability to offset increased brand name or generic prescription drug acquisition costs or to modify our activities to lessen the financial impact of such increased costs could have a significant adverse effect on our operating results.

The reserves we hold for expected claims in our Insured Health Care Benefits products are based on estimates that involve an extensive degree of judgment and are inherently variable. Any reserve, including a premium deficiency reserve, may be

insufficient. If actual claims exceed our estimates, our operating results could be materially adversely affected, and our ability to take timely corrective actions to limit future costs may be limited.

A large portion of health care claims are not submitted to us until after the end of the quarter in which services are rendered by providers to our members. Our reported health care costs payable for any particular period reflect our estimates of the ultimate cost of such claims as well as claims that have been reported to us but not yet paid. We also must estimate the amount of rebates payable under the MLR rules of the ACA, CMS and the OPM and the amounts payable by us to, and receivable by us from, the U.S. federal government under the ACA’s remaining premium stabilization program.

Our estimates of health care costs payable are based on a number of factors, including those derived from historical claim experience, but this estimation process also makes use of extensive judgment. Considerable variability is inherent in such estimates, and the accuracy of the estimates is highly sensitive to changes in medical claims submission and processing patterns and/or procedures, turnover and other changes in membership, changes in product mix, changes in the utilization of medical and/or other covered services, including prescription drugs, changes in medical cost trends, changes in our medical management practices and the introduction of new benefits and products. We estimate health care costs payable periodically, and any resulting adjustments, including premium deficiency reserves, are reflected in current-period operating results within benefit costs. For example, as of December 31, 2021, we established a premium deficiency reserve of $16 million related to Medicaid products in the Health Care Benefits segment, but did not establish a premium deficiency reserve as of December 31, 2023 or 2022. A worsening (or improvement) of health care cost trend rates or changes in claim payment patterns from those that we assumed in estimating health care costs payable as of December 31, 2023 would cause these estimates to change in the near term, and such a change could be material.

Furthermore, if we are not able to accurately and promptly anticipate and detect medical cost trends or accurately estimate the cost of incurred but not yet reported claims or reported claims that have not been paid, our ability to take timely corrective actions to limit future health care costs and reflect our current benefit cost experience in our pricing process may be limited, which would further exacerbate the extent of any adverse impact on our operating results. These risks are particularly acute during and following periods when utilization of medical and/or other covered services and/or medical cost trends are below recent historical levels and in products where there is significant turnover in our membership each year, and such risks are further magnified by the ACA and other legislation and regulations that limit our ability to price for our projected and/or experienced increases in utilization and/or medical cost trends.

Our operating results are affected by the health of the economy in general and in the communities we serve.

The U.S. financial markets have been experiencing, and may continue to experience, volatility and disruptions, including diminished liquidity and credit availability, inflation, declines in consumer confidence and economic growth and increases in unemployment rates, all of which have resulted in uncertainty about economic stability. Our businesses are affected by economic instability and declines in consumer confidence in general and in the communities we serve, and various other economic factors, including inflation and changes in consumer purchasing power, preferences and/or spending patterns. An unfavorable, uncertain or volatile economic environment, as we have experienced recently as a result of inflation, rising interest rates, supply chain disruptions and COVID-19, has caused and could cause a decline in drug utilization, an increase in health care utilization, a dampening demand for PBM services and retail products, and an increase in theft or other crime that could impact our retail locations.

If our customers’ operating and financial performance deteriorates, or they are unable to make scheduled payments or obtain adequate financing, as a result of adverse economic conditions or otherwise, our customers may not be able to pay timely, or may delay payment of, amounts owed to us. Any inability of our customers to pay us for our products and services may adversely affect our businesses, operating results and cash flows. In addition, both state and federal government sponsored payers, as a result of budget deficits or spending reductions, may suspend payments or seek to reduce their health care expenditures resulting in our customers delaying payments to us or renegotiating their contracts with us.

The adverse impacts on our businesses of an uncertain economic environment may be further exacerbated by the increasing prevalence of high deductible health plans and health plan designs favoring co-insurance over co-payments as members and other consumers may decide to postpone, or not to seek, medical treatment which may lead them to incur more expensive medical treatment in the future and/or decrease our prescription volumes.

Further, economic conditions including interest rate fluctuations, changes in capital market conditions and regulatory changes may affect our ability to obtain necessary financing on acceptable terms, our ability to secure suitable store locations under

acceptable terms, our ability to execute sale-leaseback transactions under acceptable terms and the value of our investment portfolio.

In addition, our Health Care Benefits membership remains concentrated in certain U.S. geographies and in certain industries. Unfavorable changes in health care or other benefit costs or reimbursement rates or increased competition in those geographic areas where our membership is concentrated could therefore have a disproportionately adverse effect on our Health Care Benefits segment’s operating results. Our Health Care Benefits membership has been and may continue to be affected by workforce reductions by our customers due to adverse and/or uncertain general economic conditions, especially in the U.S. geographies and industries where our membership is concentrated. As a result, we may not be able to profitably grow and diversify our Health Care Benefits membership geographically, by product type or by customer industry, and our revenues and operating results may be disproportionately affected by adverse changes affecting our customers.

Adverse changes in the U.S. economy, consumer confidence and economic conditions could have an adverse effect on our businesses and financial results.

We are exposed to risks relating to the solvency of other insurers.

We are subject to assessments under guaranty fund laws existing in all states for obligations of insolvent insurance companies (including long-term care insurers), HMOs, ACA co-ops and other payors to policyholders and claimants. For example, in the first quarter of 2017, Aetna recorded a discounted estimated liability expense of $231 million pretax for our estimated share of future assessments for long-term care insurer Penn Treaty Network America Insurance Company and one of its subsidiaries. Guaranty funds are maintained by state insurance commissioners to protect policyholders and claimants in the event that an insurer, HMO, ACA co-op and/or other payor becomes insolvent or is unable to meet its financial obligations. These funds are usually financed by assessments against insurers regulated by a state. Future assessments may have an adverse effect on our operating results and cash flows.

Extreme events, or the threat of extreme events, could materially impact our businesses.

The occurrence of natural disasters or extreme weather events, such as hurricanes, tropical storms, floods, wildfires, earthquakes, tsunamis, cyclones, typhoons, extended winter storms, droughts and tornadoes; epidemics, pandemics or disease outbreaks and other extreme events and man-made disasters, such as nuclear or biological attacks or other acts of violence, such as active shooter situations, whether as a result of war or terrorism or otherwise, can have a material adverse effect on the U.S. economy in general, our industries and us specifically. In particular, the long-term effects of climate change are expected to be widespread and unpredictable. The physical effects of climate change, such as an increase in the frequency or intensity of extreme weather events described above and rising sea levels, could adversely affect our operations, including by increasing our energy costs, disrupting our supply chain, negatively impacting our workforce, damaging our facilities and threatening the habitability of the locations in which we operate. Climate change also presents transition risks, including risks posed by regulatory and technology changes and the associated costs as the economy and our business transitions from reliance on carbon-based energy.

Extreme events or the threat of extreme events could result in significant health care costs, including those associated with behavior health offerings, waiving certain medical requirements or assisting with replacement medications or transfer prescriptions, which could also be affected by the government’s actions and the responsiveness of public health agencies and other insurers. For example, during the COVID-19 pandemic, we waived various member cost sharing and prior authorization requirements and expanded support for our members. In addition, some of our employees and our vendors are concentrated in certain large, metropolitan areas which may be particularly exposed to these events. Such events could adversely affect our businesses, operations, operating results and cash flows, and, in the event of extreme circumstances, our financial condition or viability, particularly if our responses to such events are less adequate than those of our competitors.

We may be unable to achieve our environmental, social and governance goals.

We are dedicated to corporate social responsibility and sustainability and we established certain goals as part of our ESG strategy. We face pressures from our colleagues, customers, stockholders and other stakeholders to meet our goals and to make significant advancements in ESG matters. Achievement of our goals is subject to risks and uncertainties, many of which are outside of our control, and it is possible that we may fail to achieve these goals or that our colleagues, customers, stockholders or other stakeholders may not be satisfied with the goals we set or our efforts to achieve them. These risks and uncertainties include, but are not limited to: our ability to set and execute on our operational strategies and achieve our goals within the currently projected costs and the expected timeframes; the availability and cost of technological advancements, renewable

energy and other materials necessary to meet our goals and expectations; compliance with, and changes or additions to, global and regional regulations, taxes, charges, mandates or requirements relating to climate-related goals; labor-related regulations and requirements that restrict or prohibit our ability to impose requirements on third party contractors; the actions of competitors and competitive pressures; and an acquisition of or merger with another company that has not adopted similar goals or whose progress towards reaching its goals is not as advanced as ours. A failure to meet our goals could adversely affect public perception of our business, employee morale or customer or stockholder support.

Further, an increasing percentage of colleagues, customers, stockholders and other stakeholders considers ESG factors in making employment, consumer health care and investment decisions. If we are unable to meet our goals, we may have difficulty retaining or attracting colleagues, investors, customers, or partners or competing effectively, which would negatively impact our brand and reputation, as well as our business, operating results, and financial condition.

In addition, we could face increased regulatory, reputational and legal scrutiny as a result of our ESG-related commitments and disclosures, and we could also face challenges with managing conflicting regulatory requirements and our various stakeholders’ expectations.

We are subject to potential changes in public policy, laws and regulations, including reform of the U.S. health care system and entitlement programs, which could have a material adverse effect on our businesses, operations and/or operating results.

The political environment in which we operate remains uncertain. It is reasonably possible that our business operations and operating results could be materially adversely affected by legislative, enforcement, regulatory and public policy changes at the federal or state level, including, but not limited to: changes to the regulatory environment for health care and related benefits, including Medicare, Medicare Advantage, the ACA, and related Public Exchange regulations; efforts to amend the ACA and related regulations, including through litigation aimed at challenging the ability to enforce portions of the ACA, such as the preventative services mandate; changes to laws or regulations governing drug reimbursement, pricing, purchasing and/or importation; changes to or adoption of laws or regulations governing PBMs, including those related to network restrictions, formulary management, affiliate reimbursement, contractual guarantees and reconciliations, reimbursement mandates, required reporting, purchase discount and/or rebate arrangements with drug manufacturers and/or other PBM services; changes to the laws and regulations governing PBMs’, PDPs’ and/or Managed Medicaid organizations’ interactions with government funded health care programs; changes to or adoption of laws and/or regulations relating to claims processing and billing; changes to immigration policies; changes to patent laws; changes with respect to tax and trade policies, tariffs and other government regulations affecting trade between the U.S. and other countries; and other public policy initiatives.

Our businesses, profitability and growth also may be adversely affected by (i) judicial and regulatory decisions that change and/or expand the interpretations of existing statutes and regulations, expand fiduciary obligations, impose medical or bad faith liability, increase our responsibilities under ERISA or the remedies available under ERISA, or reduce the scope of ERISA and Medicare Part D preemption of state law claims or (ii) other legislation and regulations. For example, laws in Arkansas, North Dakota and Oklahoma have attempted to limit PBM practices and have been subject to recent lawsuits. Additional litigation has been filed in several states to challenge ERISA and Medicare Part D preemption.

In addition, in November 2020, the HHS released the Rebate Rule, which eliminates the regulatory safe harbor from prosecution under the AKS for rebates from pharmaceutical companies to PBMs in Medicare Part D and in Medicaid MCOs, replacing it with two far narrower safe harbors designed to directly benefit patients with high out-of-pocket costs and to change the way PBMs are compensated. The new safe harbors are (i) for rebates which are passed on to the patient at the point of sale and (ii) for flat service fee payments made to PBMs which cannot be tied to the list prices of drugs. The PCMA, which represents PBMs, has filed a suit in an effort to block the Rebate Rule, claiming that the Rebate Rule would lead to higher premiums in Medicare Part D and was adopted in an unlawful manner. It is unclear whether the Rebate Rule will be enforceable, whether pharmaceutical companies will respond by reducing list prices, whether list prices in the private market may also be reduced, and what the resulting impact will be to PBMs or the Company. The Bipartisan Infrastructure Act of 2021 delays the effective date of the rebate rule to January 2026, and the IRA further delays the Rebate Rule through 2032.

Additionally, the Consolidated Appropriations Act of 2021 was signed into law in December 2020 and contains transparency provisions requiring group health plans and health insurance issuers to report certain prescription drug costs, overall spending on health services and prescription drugs, and information about premiums and the impact of rebates and other remuneration on premiums and out-of-pocket costs to the Tri-Departments. No later than 18 months after the first submission and bi-annually

thereafter, the Tri-Departments will release a public report on drug pricing trends, drug reimbursement, and the impact of drug prices on premiums. The first filings of plan year data were required in December 2022 and will be required annually in June of each year on an ongoing basis.

It is not possible to predict the enactment or content of new legislation or regulations or changes to existing laws or regulations or their enforcement, interpretation or application, or the form they will take (for example, through the use of U.S. Presidential Executive Orders or executive orders by governors or key regulators). If we fail to respond adequately to such changes, including by implementing strategic and operational initiatives, or do not respond as effectively as our competitors, our businesses, operations and operating results may be materially adversely affected. Even if we could predict such matters, it may not be possible to eliminate the adverse impact of public policy changes that would fundamentally change the dynamics of one or more industries in which we compete. Examples of such changes include, but are not limited to: the federal or one or more state governments fundamentally restructuring or reducing the funding available for government programs, increasing its involvement in drug reimbursement, pricing, purchasing and/or importation, changing the laws and regulations governing PBMs’, PDPs’ and/or Managed Medicaid organizations’ interactions with government funded health care programs, changing the tax treatment of health or related benefits, or significantly altering the ACA. The likelihood of adverse changes remains high due to state and federal budgetary pressures, and our businesses and operating results could be materially and adversely affected by such changes, even if we correctly predict their occurrence.

For more information on these matters, see “Government Regulation” included in Item 1 of this 10-K.

If we fail to comply with applicable laws and regulations, many of which are highly complex, we could be subject to significant adverse regulatory actions, including monetary penalties, or suffer brand and reputational harm.

Our businesses are subject to extensive regulation and oversight by state, federal and international governmental authorities. The laws and regulations governing our operations and interpretations of those laws and regulations, including those related to human capital and climate change, are increasing in number and complexity, change frequently and can be inconsistent or conflict with one another. In general, these laws and regulations are designed to benefit and protect customers, members and providers rather than us or our investors. In addition, the governmental authorities that regulate our businesses have broad latitude to make, interpret and enforce the laws and regulations that govern us and continue to interpret and enforce those laws and regulations more strictly and more aggressively each year. We also must follow various restrictions on certain of our businesses and the payment of dividends by certain of our subsidiaries put in place by certain state regulators.

Certain of our Health Services and Pharmacy & Consumer Wellness operations, products and services are subject to:

Our Health Care Benefits products are highly regulated, particularly those that serve Public Exchange, Medicare, Medicaid, dual eligible, dual eligible special needs and small group Commercial customers and members. The laws and regulations governing participation in the Public Exchanges, Medicare Advantage (including dual eligible special needs plans), Medicare Part D, Medicaid, and Managed Medicaid plans are complex, are subject to interpretation and can expose us to penalties for non-compliance.

eligible special needs plan programs, and we also may be required to pay significant fines and/or other monetary penalties. Whistleblower suits have resulted in significant settlements between governmental agencies and health care companies. The significant incentives and protections provided to whistleblowers under applicable law increase the risk of whistleblower suits.

If we fail to comply with laws and regulations that apply to government programs, we could be subject to criminal fines, civil penalties, premium refunds, prohibitions on marketing or active or passive enrollment of members, corrective actions, termination of our contracts or other sanctions, which could have a material adverse effect on our ability to participate in Public Exchange, Medicare Advantage, Medicare Part D, Medicaid, dual eligible, and dual eligible special needs plans and other programs, our brand and reputation, and our operating results, cash flows and financial condition.

For more information on these matters, see “Government Regulation” included in Item 1 of this 10-K.

If our compliance or other systems and processes fail or are deemed inadequate, we may suffer brand and reputational harm and become subject to contractual damages, regulatory actions and/or litigation.

In addition to being subject to extensive and complex laws and regulations, many of our contracts with customers include detailed requirements. In order to be eligible to offer certain products or bid on certain contracts, we must demonstrate that we have robust systems and processes in place that are designed to maintain compliance with all applicable legal, regulatory and contractual requirements. These systems and processes frequently are reviewed and audited by our customers and regulators. If our systems and processes designed to maintain compliance with applicable legal and contractual requirements, and to prevent and detect instances of, or the potential for, non-compliance fail or are deemed inadequate, we may suffer brand and reputational harm and be subject to contractual damages, regulatory actions, litigation and other proceedings which may result in damages, fines, suspension or loss of licensure, suspension or exclusion from participation in government programs and/or other penalties, any of which could adversely affect our businesses, operating results, cash flows and/or financial condition.

We routinely are subject to litigation and other adverse legal proceedings, including class actions and qui tam actions. Many of these proceedings seek substantial damages which may not be covered by insurance. These proceedings are costly to defend, may result in changes in our business practices, harm our brand and reputation and adversely affect our businesses and operating results.

PBM, retail pharmacy, mail order pharmacy, specialty pharmacy, LTC pharmacy and health care and related benefits are highly regulated industries whose participants frequently are subject to litigation and other adverse legal proceedings. We are currently subject to various litigation and arbitration matters, investigations, regulatory audits, inspections, government inquiries, and regulatory and other legal proceedings, both within and outside the U.S. Litigation related to our provision of professional services in our medical clinics, pharmacies and LTC operations is increasing as we execute our vertical integration strategy and expand our services along the continuum of health care. In addition, disputes over contracts could lead to litigation or pre-litigation settlements that could materially adversely affect our businesses, operating results and/or cash flows.

The outcome of litigation and other adverse legal proceedings is always uncertain, and outcomes that are not justifiable by the evidence or existing law or regulation can and do occur, and the costs incurred frequently are substantial regardless of the outcome. In addition, litigation and other adverse legal proceedings outside the U.S. may be subject to greater uncertainty than

within the U.S. Litigation and other adverse legal proceedings could materially adversely affect our businesses, operating results and/or cash flows because of brand and reputational harm to us, the cost of defending such proceedings, the cost of settlement or judgments against us, or the changes in our operations that could result from such proceedings. See Item 3 of this 10-K for additional information.

We frequently are subject to regular and special governmental audits, investigations and reviews that could result in changes to our business practices and also could result in material refunds, fines, penalties, civil liabilities, criminal liabilities and other sanctions.

As one of the largest national retail, mail order, specialty and LTC pharmacy, PBM and health care and related benefits providers, we frequently are subject to regular and special governmental market conduct and other audits, investigations and reviews by, and we receive subpoenas and other requests for information from, various federal and state agencies, regulatory authorities, Attorneys General, committees, subcommittees and members of the U.S. Congress and other state, federal and international governmental authorities. For example, we have received CIDs from, and provided documents and information to, the Civil Division of the DOJ in connection with a current investigation of our patient chart review processes in connection with risk adjustment data submissions under Parts C and D of the Medicare program. CMS and the OIG also are auditing the risk adjustment-related data of certain of our Medicare Advantage plans, and the number of such audits continues to increase. Several such audits, investigations and reviews by governmental authorities currently are pending, some of which may be resolved in 2024, the results of which may be adverse to us.

Federal and state governments have made investigating and prosecuting health care and other insurance fraud, waste and abuse a priority. Fraud, waste and abuse prohibitions encompass a wide range of activities, including kickbacks for referral of members, billing for unnecessary medical and/or other covered services, improper marketing, including by insurance brokers, and violations of patient privacy rights. The regulations and contractual requirements applicable to us and other industry participants are complex and subject to change, making it necessary for us to invest significant resources in complying with our regulatory and contractual requirements. Ongoing vigorous law enforcement and the highly technical regulatory scheme mean that our compliance efforts in this area will continue to require significant resources. In addition, our medical costs and the medical expenses of our Health Care Benefits ASC customers may be adversely affected if we do not prevent or detect fraudulent activity by providers and/or members.

Regular and special governmental audits, investigations and reviews by federal, state and international regulators could result in changes to our business practices, and also could result in significant or material premium refunds, fines, penalties, civil liabilities, criminal liabilities or other sanctions, including suspension or exclusion from participation in government programs and suspension or loss of licensure. Any of these audits, investigations or reviews could have a material adverse effect on our businesses, operating results, cash flows and/or financial condition or result in significant liabilities and negative publicity for us.

See “Legal and Regulatory Proceedings” in Note 18 ‘‘Commitments and Contingencies’’ included in Item 8 of this 10-K for additional information.

Our litigation and regulatory risk profiles are changing as we offer new products and services and expand in business areas beyond our historical businesses, and we may face increased regulatory risks related to our vertical integration strategy.

Historically, we focused primarily on providing products and services within our Health Care Benefits and Pharmacy & Consumer Wellness segments, as well as pharmacy services within our Health Services segment. As a result of our vertical integration strategy and other innovation initiatives, we are expanding our presence in the health care space and plan to offer new products and services, including services provided by Oak Street Health and Signify Health, which present a different litigation and regulatory risk profile than the products and services that we historically have offered and increase our exposure to additional risks. Our vertical integration strategy may also lead to increased regulatory and public scrutiny as a result of consumer protection and quality of care concerns.

We face unique regulatory and other challenges in our Medicare and Medicaid businesses.

We are seeking to substantially grow the Medicare and Medicaid membership in our Health Care Benefits segment in 2024 and over the next several years. We face unique regulatory and other challenges that may inhibit the growth and profitability of those businesses.

Programs funded in whole or in part by the U.S. federal government account for a significant portion of our revenues, and we expect that percentage to increase.

Programs funded in whole or in part by the U.S. federal government account for a significant portion of our revenues, and we expect that percentage to increase. As our government funded businesses grow, our exposure to changes in federal and state government policy with respect to and/or regulation of the various government funded programs in which we participate also increases.

The laws and regulations governing participation in Public Exchange, Medicare Advantage (including dual eligible special needs plans), Medicare Part D, Medicaid, and Managed Medicaid plans are complex, are subject to interpretation and can expose us to penalties for non-compliance. Federal, state and local governments have the right to cancel or not to renew their contracts with us on short notice without cause or if funds are not available. Funding for these programs is dependent on many factors outside our control, including general economic conditions, continuing government efforts to contain health care costs and budgetary constraints at the federal or applicable state or local level and general political issues and priorities.

The U.S. federal government and our other government customers also may reduce funding for health care or other programs, cancel or decline to renew contracts with us, or make changes that adversely affect the number of persons eligible for certain programs, the services provided to enrollees in such programs, our premiums and our administrative and health care and other benefit costs, any of which could have a material adverse effect on our businesses, operating results and cash flows. When federal funding is delayed, suspended or curtailed, we continue to receive, and we remain liable for and are required to fund, claims from providers for providing services to beneficiaries of federally funded health benefits programs in which we participate. An extended federal government shutdown or a delay by Congress in raising the federal government’s debt ceiling also could lead to a delay, reduction, suspension or cancellation of federal government spending and a significant increase in interest rates that could, in turn, have a material adverse effect on the value of our investment portfolio, our ability to access the capital markets and our businesses, operating results, cash flows and liquidity.

Possible changes in industry pricing benchmarks and drug pricing generally can adversely affect our PBM and Pharmacy & Consumer Wellness businesses.

It is possible that the pharmaceutical industry, regulators, or federal policymakers may evaluate and/or develop an alternative pricing reference to replace AWP or WAC, which are the pricing references used for many of our PBM and LTC client contracts, drug purchase agreements, retail network contracts, specialty payor agreements and other contracts with third party payors in connection with the reimbursement of drug payments. In addition, many state Medicaid fee-for-service programs have established pharmacy network payments on the basis of Actual Acquisition Cost (“AAC”). The use of an AAC basis in fee for service Medicaid could have an impact on reimbursement practices in Health Care Benefits’ Commercial and other Government products. It is also possible that Congress may enact some limited form of price negotiation for Medicare. In addition, CMS also publishes the National Average Drug Acquisition Cost (“NADAC”) for certain drugs; NADAC pricing is being adopted in an increasing number of states.

Future changes to the use of AWP, WAC or to other published pricing benchmarks used to establish drug pricing, including changes in the basis for calculating reimbursement by federal and state health care programs and/or other payors, could impact the reimbursement we receive from Medicare and Medicaid programs, the reimbursement we receive from our PBM clients and other payors and/or our ability to negotiate rebates and/or discounts with drug manufacturers, wholesalers, PBMs and retail pharmacies. A failure or inability to fully offset any increased prices or costs or to modify our operations to mitigate the impact of such increases could have a material adverse effect on our operating results. Additionally, any future changes in drug prices could be significantly different than our projections. We cannot predict the effect of these possible changes on our businesses.

We may not be able to obtain adequate premium rate increases in our Insured Health Care Benefits products, which would have an adverse effect on our revenues, MBRs and operating results and could magnify the adverse impact of increases in health care and other benefit costs and of ACA assessments, fees and taxes.

Premium rates for our Insured Health Care Benefits products often must be filed with state insurance regulators and are subject to their approval, which creates risk for us in the current political and regulatory environment. The ACA generally requires a review by HHS in conjunction with state regulators of premium rate increases that exceed a federally specified threshold (or lower state-specific thresholds set by states determined by HHS to have adequate processes). Rate reviews can magnify the adverse impact on our operating margins, MBRs and operating results of increases in health care and other benefit costs, increased utilization of covered services, and ACA assessments, fees and taxes, by restricting our ability to reflect these increases and/or these assessments, fees and taxes in our pricing. Further, our ability to reflect ACA assessments, fees and taxes in our Medicare, Medicaid and CHIP premium rates is limited.

Since 2013, HHS has issued determinations to health plans that their premium rate increases were “unreasonable,” and we may experience challenges to appropriate premium rate increases in certain states. Regulators or legislatures in several states have implemented or are considering limits on premium rate increases, either by enforcing existing legal requirements more stringently or proposing different regulatory standards. Regulators or legislatures in several states also have conducted hearings on proposed premium rate increases, which can result, and in some instances have resulted, in substantial delays in implementing proposed rate increases even if they ultimately are approved. Our plans can be excluded from participating in small group Public Exchanges if they are deemed to have a history of “unreasonable” rate increases. Any significant rate increases we may request heighten the risks of adverse publicity, adverse regulatory action and adverse selection and the likelihood that our requested premium rate increases will be denied, reduced or delayed, which could lead to operating margin compression.

We anticipate continued regulatory and legislative action to increase regulation of premium rates in our Insured Health Care Benefits products. We may not be able to obtain rates that are actuarially justified or that are sufficient to make our policies

profitable in one or more product lines or geographies. If we are unable to obtain adequate premium rates and/or premium rate increases, it could materially and adversely affect our operating margins and MBRs and our ability to earn adequate returns on Insured Health Care Benefits products in one or more states or cause us to withdraw from certain geographies and/or products.

Minimum MLR rebate requirements limit the level of margin we can earn in our Insured Health Care Benefits products while leaving us exposed to higher than expected medical costs. Challenges to our minimum MLR rebate methodology and/or reports could adversely affect our operating results.

The ACA’s minimum MLR rebate requirements limit the level of margin we can earn in Health Care Benefits’ Commercial Insured business. CMS minimum MLR rebate regulations limit the level of margin we can earn in our Medicare Advantage and Medicaid Insured businesses. Certain portions of our Health Care Benefits Medicaid and FEHB program business also are subject to minimum MLR rebate requirements in addition to but separate from those imposed by the ACA. Minimum MLR rebate requirements leave us exposed to medical costs that are higher than those reflected in our pricing. The process supporting the management and determination of the amount of MLR rebates payable is complex and requires judgment, and the minimum MLR reporting requirements are detailed. CMS has also proposed, but not yet finalized, a definition of “prescription drug price concessions” for commercial MLR calculation purposes, which would make additional PBM information available to plans and the HHS, potentially further complicating the MLR calculation process. Federal and state auditors are challenging our Commercial Health Care Benefits business’ compliance with the ACA’s minimum MLR requirements as well as our FEHB plans’ compliance with OPM’s FEHB program-specific minimum MLR requirements. Our Medicare and Medicaid contracts also are subject to minimum MLR audits. If a Medicare Advantage or Medicare Part D contract pays minimum MLR rebates for three consecutive years, it will become ineligible to enroll new members. If a Medicare Advantage or Medicare Part D contract pays such rebates for five consecutive years, it will be terminated by CMS. Additional challenges to our methodology and/or reports relating to minimum MLR and related rebates by federal and state regulators and private litigants are reasonably possible. The outcome of these audits and additional challenges could adversely affect our operating results.

Our operating results may be adversely affected by changes in laws and policies governing employers and by union organizing activity.

Congress and certain state legislatures continue to consider and pass legislation that increases our costs of doing business, including increased minimum wages and requiring employers to provide paid sick leave or paid family leave. In addition, our employee-related operating costs may be increased by union organizing activity and it is possible that the National Labor Relations Board may adopt regulatory changes through re-making or case law that could facilitate union organizing. If we are unable to reflect these increased expenses in our pricing or otherwise modify our operations to mitigate the effects of such increases, our operating results will be adversely affected.

We face international political, legal and compliance, operational, regulatory, economic and other risks that may be more significant than in our domestic operations.

Our international operations present political, legal, compliance, operational, regulatory, economic and other risks that we do not face or that are more significant than in our domestic operations. These risks vary widely by country and include varying regional and geopolitical business conditions and demands, government intervention and censorship, discriminatory regulation, climate change regulation, nationalization or expropriation of assets and pricing constraints. Our international products need to meet country-specific customer and member preferences as well as country-specific legal requirements, including those related to licensing, data privacy, data storage and data protection.

Our international operations increase our exposure to, and require us to devote significant management resources to implement controls and systems to comply with, the privacy and data protection laws of non-U.S. jurisdictions, such as the EU’s GDPR, and the anti-bribery, anti-corruption and anti-money laundering laws of the U.S. (including the FCPA) and the United Kingdom (including the UK Bribery Act) and similar laws in other jurisdictions. Implementing our compliance policies, internal controls and other systems may also require the investment of considerable management time and financial and other resources. Violations of these laws and regulations could result in fines, criminal sanctions against us, our officers or employees, restrictions or outright prohibitions on the conduct of our business, and significant brand and reputational harm. We must regularly reassess the size, capability and location of our global infrastructure and make appropriate changes, and must have effective change management processes and internal controls in place to address changes in our businesses and operations. Our success depends, in part, on our ability to anticipate these risks and manage these difficulties, and the failure to do so could have a material adverse effect on our brand, reputation, businesses, operating results and/or financial condition.

Our international operations require us to overcome logistical and other challenges based on differing languages, cultures, legal and regulatory schemes and time zones. Our international operations encounter labor laws, standards and customs that can be difficult and make employee relationships less flexible than in our domestic operations and expensive to modify or terminate. In some countries we are required to, or choose to, operate with local business associates, which requires us to manage our relationships with these third parties and may reduce our operational flexibility and ability to quickly respond to business challenges.

In some countries we may be exposed to currency exchange controls or other restrictions that prevent us from transferring funds internationally or converting local currencies into U.S. dollars or other currencies. Fluctuations in foreign currency exchange rates may adversely affect our revenues, operating results and cash flows from our international operations. Some of our operations are, and are increasingly likely to be, in emerging markets where these risks are heightened. Any measures we may implement to reduce the effect of volatile currencies and other risks on our international operations may not be effective.

We may be unable to successfully integrate companies we acquire.

Upon the closing of any acquisition, including the recent acquisitions of Oak Street Health and Signify Health, we need to successfully integrate the products, services and related assets, as well as internal controls into our business operations. If an acquisition is consummated, the integration of the acquired business, its products, services and related assets into our company also may be complex, expensive, and time-consuming and, if the integration is not fully successful, we may not achieve the anticipated benefits, operating and cost synergies and/or growth opportunities of an acquisition. Potential difficulties that may be encountered in the integration process, including with respect to Oak Street Health and Signify Health, include the following:

An inability to realize the full extent of the anticipated benefits, operating and cost synergies, innovations and operations efficiencies or growth opportunities of an acquisition, including the recent acquisitions of Oak Street Health and Signify Health, as well as any delays or additional expenses encountered in the integration process, could have a material adverse effect on our businesses and operating results. Furthermore, acquisitions, including the recent acquisitions of Oak Street Health and Signify Health, even if successfully integrated, may fail to further our business strategy as anticipated, expose us to increased competition or challenges with respect to our products, services or service areas, and expose us to additional liabilities associated with an acquired business including risks and liabilities associated with litigation involving the acquired business. Any one of these challenges or risks could impair our ability to realize any benefit from our acquisitions after we have expended resources on them.

We expect to continue to pursue acquisitions, joint ventures, strategic alliances and other inorganic growth opportunities, as well as strategic divestitures, which may be unsuccessful, cause us to assume unanticipated liabilities, disrupt our existing businesses, be dilutive or lead us to assume significant debt, among other things.

We expect to continue to pursue acquisitions, joint ventures, strategic alliances and other inorganic growth opportunities as part of our business strategy. In addition to the integration risks noted above, some other risks we may face with respect to acquisitions, including the recent acquisitions of Oak Street Health and Signify Health, and other inorganic growth strategies include:

Similarly, we may also seek to divest assets that no longer fit into our long-term strategic plan. Such divestitures may take time and, even if such divestitures can be completed, the terms of such divestitures will be subject to market conditions, financing availability and other considerations of potential buyers, and they may have negative short-term financial impacts on us. In addition, joint ventures present risks that are different from acquisitions, including selection of appropriate joint venture parties, initial and ongoing governance of the joint venture, joint venture compliance activities (including compliance with applicable CMS requirements), growing the joint venture’s business in a manner acceptable to all the parties, including other providers in the networks that include joint ventures, maintaining positive relationships among the joint venture parties and the joint venture’s customers, and member and business disruption that may occur upon joint venture termination.

Failure to meet customer expectations may harm our brand and reputation, our ability to retain and grow our customer base and membership and our operating results and cash flows.

Our ability to attract and retain customers and members is dependent upon providing compliant, cost effective, quality customer service operations (such as call center operations, PBM functions, retail pharmacy and LTC services, retail, mail order and specialty pharmacy prescription delivery, claims processing, customer case installation and online access and tools) that meet or exceed our customers’ and members’ expectations, either directly or through vendors. As we seek to reduce general and administrative expenses, we must balance the potential impact of cost-saving measures on our customers and other services and performances. If we misjudge the effects of such measures, customers and other services may be adversely affected. We depend on third parties for certain of our customer service, PBM and prescription delivery operations. If we or our vendors fail to provide compliant service that meets our customers’ and members’ expectations, we may have difficulty retaining or profitably growing our customer base and/or membership, which could adversely affect our operating results. For example, noncompliance with any privacy or security laws or regulations or any security breach involving us or one of our third-party vendors could have a material adverse effect on our businesses, operating results, brand and reputation.

We and our vendors have experienced and continue to experience cyberattacks. We can provide no assurance that we or our vendors will be able to detect, prevent or contain the effects of such attacks or other information security (including cybersecurity) risks or threats in the future.

We and our vendors have experienced diverse cyberattacks and expect to continue to experience cyberattacks going forward. As examples, the Company and its vendors have experienced attempts to gain access to systems, denial of service attacks, attempted malware infections, account takeovers, scanning activity, and phishing emails. Attacks can originate from external sources (including criminals, terrorists and nation states) or internal actors. The Company is dedicating and will continue to dedicate significant resources and incur significant expenses to maintain and update on an ongoing basis the systems and processes that are designed to mitigate the information security risks it faces and protect the security of its computer systems, software, networks and other technology assets against attempts by unauthorized parties to obtain access to confidential information, disrupt or degrade service, or cause other damage. The impact of known cyberattacks has not been material to the Company’s operations or operating results through December 31, 2023. The Board is regularly informed regarding the Company’s information security policies, practices and status.

A compromise of our information security controls or of those businesses with whom we interact, which results in confidential information being accessed, obtained, damaged, or used by unauthorized or improper persons, could harm our reputation and expose us to regulatory actions and claims from customers and clients, financial institutions, payment card associations and other persons, any of which could adversely affect our businesses, operating results and financial condition. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques or to implement adequate preventative measures. Moreover, a data security breach could require that we expend significant resources related to our information systems and infrastructure, and could distract management and other key personnel from performing their primary operational duties. We also could be adversely affected by any significant disruption in the systems of third parties we interact with, including key payors and vendors.

The costs of attempting to protect against the foregoing risks and the costs of responding to an information security incident are significant. Large scale data breaches at other entities increase the challenge we and our vendors face in maintaining the security of our information technology systems and proprietary information and of our customers’, employees’, members’ and other constituents’ sensitive information. Following an information security incident, our and/or our vendors’ remediation efforts may not be successful, and could result in interruptions, delays or cessation of service, and loss of existing or potential customers and members. In addition, breaches of our and/or our vendors’ security measures and the unauthorized access to or dissemination of sensitive personal information, proprietary information or confidential information about us, our customers, our members or other third-parties, could expose our customers’, members’ and other constituents’ private information and our customers, members and other constituents to the risk of financial or medical identity theft, or expose us or other third parties to a risk of loss or misuse of this information, and result in investigations, regulatory enforcement actions, material fines and penalties, loss of customers, litigation or other actions, which could have a material adverse effect on our brand, reputation, businesses, operating results and cash flows.

See Item 1C of this 10-K, “Cybersecurity,” for more information on the Company’s cybersecurity risk management and governance.

Data governance failures can adversely affect our reputation, businesses and prospects. Our use and disclosure of members’, customers’ and other constituents’ sensitive information is subject to complex regulations at multiple levels. We would be adversely affected if we or our business associates or other vendors fail to adequately protect members’, customers’ or other constituents’ sensitive information.

Our information systems are critical to the operation of our businesses. We collect, process, maintain, retain, evaluate, utilize and distribute large amounts of personally identifiable, personal health, and financial information (including payment card information) and other confidential and sensitive data about our customers, employees, members and other constituents in the ordinary course of our businesses. Some of our information systems rely upon third party systems, including cloud service providers, to accomplish these tasks. The use and disclosure of such information is regulated at the federal, state and international levels. In some cases, such laws, rules and regulations also apply to our vendors and/or may hold us liable for any violations by our vendors. These laws, rules and regulations are subject to change (and many are rapidly evolving) and in recent years have given rise to increased enforcement activity, litigation, and other disputes. For example, certain of our vendors have experienced incidents that resulted in the unauthorized disclosure of confidential information, including personal information of our members, patients or employees, which has caused us to incur expenses including those related to responding to regulatory inquiries and/or litigation. Some of these expenses are indemnified but others are not. International laws, rules and regulations governing the use and disclosure of these types of information are generally more stringent than U.S. laws and regulations, and they vary from jurisdiction to jurisdiction. Noncompliance with applicable privacy or security laws or regulations, or any security breach, information security incident, and any other incident involving the theft, misappropriation, loss or other

unauthorized disclosure of, or access to, sensitive or confidential customer, member or other constituent information, whether by us, by one of our business associates or vendors or by another third party, could require us to expend significant resources to remediate any damage, could interrupt our operations and could adversely affect our brand and reputation, membership and operating results and also could expose and/or has exposed us to mandatory disclosure requirements, adverse media attention, litigation (including class action litigation), governmental investigations and enforcement proceedings, material fines, penalties and/or remediation costs, and compensatory, special, punitive and statutory damages, consent orders, adverse actions against our licenses to do business and/or injunctive relief, any of which could adversely affect our businesses, operating results, cash flows or financial condition.

Our businesses depend on our customers’, members’ and other constituents’ willingness to entrust us with their health related and other sensitive personal information. Events that adversely affect that trust, including inadequate disclosure to our members or customers of our uses of their information, failing to keep our information technology systems and our customers’, members’ and other constituents’ sensitive information secure from significant attack, theft, damage, loss or unauthorized disclosure or access, whether as a result of our action or inaction (including human error) or that of our business associates, vendors or other third parties, could adversely affect our brand and reputation, membership and operating results and also could expose and/or has exposed us to mandatory disclosure to the media, litigation (including class action litigation), governmental investigations and enforcement proceedings, material fines, penalties and/or remediation costs, and compensatory, special, punitive and statutory damages, consent orders, adverse actions against our licenses to do business and/or injunctive relief, any of which could adversely affect our businesses, operating results, cash flows or financial condition. There can be no assurance that awe have or will be able to adequately prevent, detect, and/or remediate such data security incidents.

The failure or disruption of our information technology systems or the failure of our information technology infrastructure to support our businesses could adversely affect our reputation, businesses, operating results and cash flows.

Our information systems are subject to damage or interruption from power outages, facility damage, computer and telecommunications failures, computer viruses, security breaches (including credit card or personally identifiable information breaches), cyberattacks, vandalism, catastrophic events and human error. If our information systems are damaged, fail to work properly or otherwise become unavailable, we may incur substantial costs to repair or replace them, and may experience reputational damage, loss of critical information, customer disruption and interruptions or delays in our ability to perform essential functions and implement new and innovative services. We use third-party vendors to set-up, service, and/or maintain portions of our information technology systems, and our vendors may suffer the same types of issues, which could adversely affect our ability to access and use such systems and the data contained therein, which could result in similar harm. In addition, our efforts to comply with changes in U.S. and foreign laws and regulations, including privacy and information security laws and standards, may cause us to incur significant expense due to increased investment in technology and the development of new operational processes.

Our business success and operating results depend in part on effective information technology systems and on continuing to develop and implement improvements in technology. Pursuing multiple initiatives simultaneously could make this continued development and implementation significantly more challenging.

Many aspects of our operations are dependent on our information systems and the information collected, processed, stored and handled by these systems. We rely heavily on our information and technology systems to manage our ordering, pricing, point-of-sale, pharmacy fulfillment, inventory replenishment, claims processing, customer loyalty and subscription programs, finance, human resources and other processes. Throughout our operations, we collect, process, maintain, retain, evaluate, utilize and distribute large amounts of confidential and sensitive data and information, including personally identifiable information and protected health information, that our customers, employees, members and other constituents provide to purchase products or services, enroll in programs or services, register on our websites, interact with our personnel, or otherwise communicate with us. For these operations, we depend in part on the secure transmission of confidential information over public networks.

We have many different information and other technology systems supporting our different businesses (including as a result of our acquisitions). Our businesses depend in large part on these systems to adequately price our products and services; accurately establish reserves, process claims and report operating results; and interact with providers, employer plan sponsors, customers, members, consumers and vendors in an efficient and uninterrupted fashion. In addition, recent trends toward greater consumer engagement in health care require new and enhanced technologies, including more sophisticated applications for mobile devices. Certain of our technology systems (including software) are older, legacy systems that are less flexible, less efficient and require a significant ongoing commitment of capital and human resources to maintain, protect and enhance them and to integrate them with our other systems. We must re-engineer and reduce the number of these older, legacy systems to meet changing consumer and vendor preferences and needs, improve our productivity and reduce our operating expenses. We

also need to develop or acquire new technology systems, contract with new vendors or modify certain of our existing systems to support the consumer-oriented and transformational products and services we are developing, operating and expanding and/or to meet current and developing industry and regulatory standards, including to keep pace with continuing changes in information processing technology, emerging cybersecurity risks and threats, and changes to applicable privacy and security laws, rules and regulations. If we fail to achieve these objectives, our ability to profitably grow our business and/or our operating results may be adversely affected.

In addition, information technology and other technology and process improvement projects, including our transformation and enterprise modernization programs, frequently are long-term in nature and may take longer to complete and cost more than we expect and may not deliver the benefits we project once they are complete. If we do not effectively and efficiently secure, manage, integrate and enhance our technology portfolio (including vendor sourced systems), we could, among other things, have problems determining health care and other benefit cost estimates and/or establishing appropriate pricing, meeting the needs of customers, consumers, providers, members and vendors, developing and expanding our consumer-oriented products and services or keeping pace with industry and regulatory standards, and our operating results may be adversely affected.

Product liability, product recall, professional liability or personal injury issues could damage our reputation and have a significant adverse effect on our businesses, operating results, cash flows and/or financial condition.

The products that we sell could become subject to contamination, product tampering, mislabeling, recall or other damage. In addition, errors in the dispensing, packaging or administration of drugs or other products and consuming drugs in a manner that is not prescribed could lead to serious injury or death. Product liability or personal injury claims may be asserted against us with respect to any of the drugs or other products we sell or services we provide. For example, we are a defendant in hundreds of litigation proceedings relating to opioids and the sale of products containing talc. Our businesses also involve the provision of professional services, including by physicians, pharmacists, physician assistants, nurses and nurse practitioners, which exposes us to professional liability claims. Should a product or other liability issue arise, the coverage available under our insurance programs and the indemnification amounts available to us from third parties may not be adequate to protect us against the financial impact of the related claims. We also may not be able to maintain our existing levels of insurance on acceptable terms in the future. Any of the issues discussed above could damage our brand and reputation and have a significant adverse effect on our businesses, operating results and/or financial condition.

We face significant competition in attracting and retaining talented employees. Further, managing succession for, and retention of, key executives is critical to our success, and our failure to do so could adversely affect our businesses, operating results and/or future performance.

Our ability to attract and retain qualified and experienced employees is essential to meet our current and future goals and objectives. There is no guarantee we will be able to attract and retain such employees or that competition among potential employers will not result in increased compensation and/or benefits costs. If we are unable to retain existing employees or attract additional employees, or we experience an unexpected loss of leadership, we could experience a material adverse effect on our businesses, operating results and/or future performance.

In addition, our failure to adequately plan for succession of senior management and other key management roles or the failure of key employees to successfully transition into new roles could have a material adverse effect on our businesses, operating results and/or future performance. The succession plans we have in place and our employment arrangements with certain key executives do not guarantee the services of these executives will continue to be available to us.

Sales of our products and services are dependent on our ability to attract and motivate internal sales personnel and independent third-party brokers, consultants and agents. New distribution channels create new disintermediation risk. We may be subject to penalties or other regulatory actions as a result of the marketing practices of brokers and agents selling our products.

Our products are sold primarily through our sales personnel, who frequently work with independent brokers, consultants and agents who assist in the marketing, production and servicing of business. The independent brokers, consultants and agents generally are not dedicated to us exclusively and may frequently recommend and/or market health care benefits products of our competitors. Our sales could be adversely affected if we are unable to attract, retain or motivate sales personnel and third-party brokers, consultants and agents, or if we do not adequately provide support, training and education to this sales network regarding our complex product portfolio, or if our sales strategy is not appropriately aligned across distribution channels. This risk is heightened as we develop, operate and expand our consumer-oriented products and services and we expand in the health

care space and our business model evolves to include a greater focus on consumers and direct-to-consumer sales, such as competing for sales on Insurance Exchanges.

New distribution channels for our products and services continue to emerge, including Private Exchanges operated by health care consultants and technology companies. These channels may make it more difficult for us to directly engage consumers and other customers in the selection and management of their health care benefits, in health care utilization and in the effective navigation of the health care system. We also may be challenged by new technologies and marketplace entrants that could interfere with our existing relationships with customers and health plan members in these areas.

In addition, there have been several investigations regarding the marketing practices of brokers and agents selling health care and other insurance products and the payments they receive. These investigations have resulted in enforcement actions against companies in our industry and brokers and agents marketing and selling those companies’ products. These investigations and enforcement actions could result in penalties and the imposition of corrective action plans and/or changes to industry practices, which could adversely affect our ability to market our products.

Specifically, CMS, U.S. Congressional committees and state departments of insurance have each increased scrutiny of the marketing practices of brokers and agents who market Medicare products and of the Medicare Advantage organizations that use these organizations to market their products. Any of the federal agencies noted above or U.S. Congress may also recommend changes or take additional action with respect to the way in which brokers and agents are compensated for selling our Medicare Advantage and Part D plans. In addition, CMS has recently proposed new limitations on the amounts brokers and agents can earn for marketing Medicare Advantage and Part D plans.

Failure of our businesses to effectively collaborate could prevent us from maximizing our operating results.

To maximize our overall enterprise value, our various businesses need to collaborate effectively. Our businesses need to be aligned in order to carry out our business strategy, prioritize goals and coordinate the design of new products intended to utilize the offerings of multiple businesses, including implementing our transformation and enterprise modernization programs. In addition, misaligned incentives, information siloes, ineffective product development and failure of our corporate governance policies or procedures, for example significant financial decisions being made at an inappropriate level in our organization, also could prevent us from maximizing our operating results and/or achieving our financial and other projections.

We are subject to payment-related risks that could increase our operating costs, expose us to fraud or theft, subject us to new rules and other requirements and potential liability and may disrupt our business operations.

We accept payments using a variety of methods, including cash, checks, credit cards, debit cards, gift cards, mobile payments and potentially other technologies in the future that may subject us to new and additional risks related to fraud and theft. Acceptance of these payment methods subjects us to rules, regulations, contractual obligations and compliance requirements, including payment network rules and operating guidelines, data security standards and certification requirements, and rules governing electronic funds transfers. These requirements may change in the future, which could make compliance more difficult or costly. For certain payment options, including credit and debit cards, we pay interchange and other fees, which could increase periodically thereby raising our operating costs. We rely on third parties to provide payment processing services, including the processing of credit cards, debit cards, and various other forms of electronic payment. If these vendors are unable to provide these services to us, or if their systems are compromised, our operations could be disrupted. The payment methods that we offer also expose us to potential fraud and theft by persons seeking to obtain unauthorized access to, or exploit any weaknesses in, the payment systems we use. If we fail to abide by applicable rules or requirements, or if data relating to our payment systems is compromised due to a breach or misuse, we may be responsible for any costs incurred by payment card issuing banks and other third parties or subject to fines and higher transaction fees. In addition, our reputation and ability to accept certain types of payments could each be harmed resulting in reduced sales and adverse effects on our operating results.

Both our and our vendors’ operations are subject to a variety of business continuity hazards and risks, any of which could interrupt our operations or otherwise adversely affect our performance and operating results.

We and our vendors are subject to business continuity hazards and other risks, including natural disasters and extreme weather events (which may increase in frequency or intensity as a result of climate change), utility and other mechanical failures, acts of war or terrorism, acts of civil unrest, crime, disruption of communications, data security and preservation, disruption of supply or distribution, safety regulation and labor difficulties. The occurrence of any of these or other events to us or our vendors might disrupt or shut down our operations or otherwise adversely affect our operations. We also may be subject to certain liability claims in the event of an injury or loss of life, or damage to property, resulting from such events. Although we have

developed procedures for crisis management and disaster recovery and business continuity plans, and we maintain insurance policies that we believe are customary and adequate for our size and industry, our crisis management and disaster recovery procedures and business continuity plans may not be effective and our insurance policies include limits and exclusions and, as a result, our coverage may be insufficient to protect against all potential hazards and risks incident to our businesses. Should any such hazards or risks occur, or should our insurance coverage be inadequate or unavailable, our businesses, operating results, cash flows and financial condition could be adversely affected.

Our operations generate significant capital, and we may from time to time raise additional capital, subject to market conditions. The manner in which we deploy our capital, including investments in our businesses, our operations (such as information technology and other strategic and capital projects), dividends, acquisitions, share and/or debt repurchases, repayment of debt, reinsurance or other capital uses, impacts our financial strength, claims paying ability and credit ratings issued by nationally-recognized statistical rating organizations. Credit ratings issued by nationally-recognized statistical rating organizations are broadly distributed and generally used throughout our industries. Our ratings reflect each rating organization’s opinion of our financial strength, operating performance and ability to meet our debt obligations or obligations to our insureds. We believe our credit ratings and the financial strength and claims paying ability of our principal insurance and HMO subsidiaries are important factors in marketing our Health Care Benefits products to certain of our customers.

Each of the ratings organizations reviews our ratings periodically, and there can be no assurance that our current ratings will be maintained in the future. Downgrades in our ratings could adversely affect our businesses, operating results, cash flows and financial condition.

Goodwill and other intangible assets could, in the future, become impaired.

As of December 31, 2023 and December 31, 2022, we had $120.5 billion and $102.9 billion, respectively, of goodwill and other intangible assets. Goodwill and indefinite-lived intangible assets are subject to annual impairment reviews, or more frequent reviews if events or circumstances indicate that the carrying value may not be recoverable. When evaluating goodwill for potential impairment, we compare the fair value of our reporting units to their respective carrying amounts. We estimate the fair value of our reporting units using a combination of a discounted cash flow method and a market multiple method. If the carrying amount of a reporting unit exceeds its estimated fair value, a goodwill impairment loss is recognized in an amount equal to the excess to the extent of the goodwill balance. Indefinite-lived intangible assets are tested for impairment by comparing the estimated fair value of the asset to its carrying value. The Company estimates the fair value of its indefinite-lived trademarks using the relief from royalty method under the income approach. If the carrying value of the asset exceeds its estimated fair value, an impairment loss is recognized, and the asset is written down to its estimated fair value. Definite-lived intangible assets are tested for impairment whenever events or changes in circumstances indicate that the carrying value of such an asset may not be recoverable. If indicators of impairment are present, the Company first compares the carrying amount of the asset group to the estimated future cash flows associated with the asset group (undiscounted). If the estimated future cash flows used in this analysis are less than the carrying amount of the asset group, an impairment loss calculation is prepared. The impairment loss calculation compares the carrying amount of the asset group to the asset group’s estimated future cash flows (discounted).

Estimated fair values could change if, for example, there are changes in the business climate, industry-wide changes, changes in the competitive environment, adverse legal or regulatory actions or developments, changes in capital structure, cost of debt, interest rates, capital expenditure levels, operating cash flows or market capitalization. Because of the significance of our goodwill and intangible assets, any future impairment of these assets could require material noncash charges to our operating results, which also could have a material adverse effect on our financial condition.

Adverse conditions in the U.S. and global capital markets can significantly and adversely affect the value of our investments in debt and equity securities, mortgage loans, alternative investments and other investments, and our operating results and/or our financial condition.

The global capital markets, including credit markets, continue to experience volatility and uncertainty. As an insurer, we have a substantial investment portfolio that supports our policy liabilities and surplus and is comprised largely of debt securities of

issuers located in the U.S. As a result, the income we earn from our investment portfolio is largely driven by the level of interest rates in the U.S., and to a lesser extent the international financial markets. Volatility, uncertainty and/or disruptions in the global capital markets, particularly the U.S. credit markets, and governments’ monetary policy, particularly U.S. monetary policy, can significantly and adversely affect the value of our investment portfolio, our operating results and/or our financial condition by:

Although we seek, within guidelines we deem appropriate, to match the duration of our assets and liabilities and to manage our credit and counterparty exposures, a failure to do so adequately could adversely affect our net income and our financial condition and, in extreme circumstances, our cash flows.

We face risks relating to the market availability, pricing, suppliers and safety profiles of prescription drugs and other products that we purchase and sell.

Our Pharmacy & Consumer Wellness segment and our mail order and specialty pharmacy operations generate revenues in significant part by dispensing prescription drugs. Our PBM business generates revenues primarily by contracting with clients to provide prescription drugs and related health care services to plan members. As a result, we are dependent on our relationships with prescription drug manufacturers and suppliers. We acquire a substantial amount of our mail order and specialty pharmacies’ prescription drug supply from a limited number of suppliers. Certain of our agreements with such suppliers are short-term and cancelable by either party without cause. In addition, these agreements may allow the supplier to distribute through channels other than us. Certain of these agreements also allow pricing and other terms to be adjusted periodically for changing market conditions or required service levels. A termination or modification to any of these relationships could adversely affect our prescription drug supply and have a material adverse effect on our businesses, operating results and financial condition. Moreover, many products distributed by our pharmacies are manufactured with ingredients that are susceptible to supply shortages. In some cases, we depend upon a single source of supply. Any such supply shortages or loss of any such single source of supply could adversely affect our operating results and cash flows.

Much of the branded and generic drug product that we sell in our pharmacies, and much of the other merchandise we sell, is manufactured in whole or in substantial part outside of the U.S. In most cases, the products or merchandise are imported by others and sold to us. As a result, significant changes in tax or trade policies, tariffs or trade relations between the U.S. and other countries, such as the imposition of unilateral tariffs on imported products, could result in significant increases in our costs, restrict our access to suppliers, depress economic activity, and have a material adverse effect on our businesses, operating results and cash flows. In addition, other countries may change their business and trade policies and such changes, as well as any negative sentiments towards the U.S. in response to increased import tariffs and other changes in U.S. trade regulations, could adversely affect our businesses.

Our suppliers are independent entities subject to their own operational and financial risks that are outside our control. If our current suppliers were to stop selling prescription drugs to us or delay delivery, including as a result of supply shortages, supplier production disruptions, supplier quality issues, closing or bankruptcies of our suppliers, or for other reasons, we may be unable to procure alternatives from other suppliers in a timely and efficient manner and on acceptable terms, or at all.

Our operating results may be adversely affected if we are unable to contract with providers on competitive terms and develop and maintain attractive networks with high quality providers.

We are seeking to enhance our health care provider networks by entering into joint ventures and other collaborative risk-sharing arrangements with providers. Providers’ willingness to enter these arrangements with us depends upon, among other things, our ability to provide them with up to date quality of care data to support these value-based contracts. These arrangements are designed to give providers incentives to engage in population health management and optimize delivery of health care to our members. These arrangements also may allow us to expand into new geographies, target new customer groups, increase membership and reduce medical costs and, if we provide technology or other services to the relevant health system or provider organization, may contribute to our revenue and earnings from alternative sources. If such arrangements do not result in the lower medical costs that we project or if we fail to attract providers to such arrangements, or are less successful at implementing such arrangements than our competitors, our medical costs may not be competitive and may be higher than we project, our attractiveness to customers may be reduced, we may lose or be unable to grow medical membership, and our ability to profitably grow our business and/or our operating results may be adversely affected.

While we believe joint ventures, ACOs and other non-traditional health care provider organizational structures present opportunities for us, the implementation of our joint ventures and other non-traditional structure strategies may not achieve the intended results, which could adversely affect our operating results and cash flows. Among other things, joint ventures require us to maintain collaborative relationships with our counterparties, continue to gain access to provider rates that make the joint ventures economically sustainable and devote significant management time to the operation and management of the joint ventures. We may not be able to achieve these objectives in one or more of our joint ventures, which could adversely affect our operating results and cash flows.

If our suppliers or service providers fail to meet their contractual obligations to us or to comply with applicable laws or regulations, we may be exposed to brand and reputational harm, litigation and/or regulatory action. This risk is particularly high in our Medicare, Medicaid, dual eligible and dual eligible special needs plan programs.

We contract with various third parties to supply us with necessary products, perform certain functions and services and provide us with certain information technology systems. Our arrangements with suppliers and these third parties may expose us to public scrutiny, adversely affect our brand and reputation, expose us to litigation or regulatory action, and otherwise make our operations vulnerable if we fail to adequately oversee, monitor and regulate their performance or if they fail to meet their contractual obligations to us or to comply with applicable laws or regulations, including those related to human capital and climate change. For example, certain of our vendors have been responsible for releases of sensitive information of our members and employees, which has caused us to incur additional expenses and given rise to regulatory actions and litigation against us.

These risks are particularly high in our in Medicare Advantage (including dual eligible special needs plans), Medicare Part D, Medicaid, and Managed Medicaid plans, where third parties may perform medical management and other member related services for us. Any failure of our or these third parties’ prevention, detection or control systems related to regulatory compliance, compliance with our internal policies, data security and/or cybersecurity or any incident involving the theft, misappropriation, loss or other unauthorized disclosure of, or access to, members’, customers’ or other constituents’ sensitive information could require us to expend significant resources to remediate any damage, interrupt our operations and adversely affect our brand and reputation and also expose us to whistleblower, class action and other litigation, other proceedings, prohibitions on marketing or active or passive enrollment of members, corrective actions, fines, sanctions and/or penalties, any of which could adversely affect our businesses, operating results, cash flows and/or financial condition.

We may experience increased medical and other benefit costs, litigation risk and customer and member dissatisfaction when providers that do not have contracts with us render services to our Health Care Benefits members.

Some providers that render services to our Health Care Benefits members do not have contracts with us. In those cases, we do not have a pre-established understanding with these nonparticipating providers as to the amount of compensation that is due to them for services rendered to our members. In some states, the amount of compensation due to these nonparticipating providers is defined by law or regulation, but in most instances it is either not defined or it is established by a standard that is not clearly translatable into dollar terms. In such instances providers may believe that they are underpaid for their services and may either litigate or arbitrate their dispute with us or try to recover the difference between what we have paid them and the amount they charged us from our members, which may result in member dissatisfaction. For example, in 2019, certain claimant hospitals were awarded approximately $86 million in an arbitration proceeding relating to Aetna’s out-of-network benefit payment and administration practices. Such disputes may cause us to pay higher medical or other benefit costs than we projected.

Continuing consolidation and integration among providers and other suppliers may increase our medical and other covered benefits costs, make it difficult for us to compete in certain geographies and create new competitors.

Hospitals, other health care providers and health systems continue to consolidate across the health care industry. While this consolidation could increase efficiency and has the potential to improve the delivery of health care services, it also reduces competition and the number of potential contracting parties in certain geographies. These health systems also are increasingly forming and considering forming health plans to directly offer health insurance in competition with us, a process that has been accelerated by the ACA. In addition, ACOs (including Commercial and Medicaid-only ACOs developed as a result of state Medicaid laws), practice management companies, consolidation among and by integrated health systems and other changes in the organizational structures that physicians, hospitals and other providers adopt continues to change the way these providers interact with us and the competitive landscape in which we operate. These changes may increase our medical and other covered benefits costs, may affect the way we price our products and services and estimate our medical and other covered benefits costs and may require us to change our operations, including by withdrawing from certain geographies where we do not have a significant presence across our businesses or are unable to collaborate or contract with providers on acceptable terms. Each of these changes may adversely affect our businesses and operating results.

There are no unresolved SEC Staff Comments.

Securing the Company’s business information, intellectual property, customer, patient and employee data and technology systems is essential for the continuity of its businesses, meeting applicable regulatory requirements and maintaining the trust of its stakeholders. Cybersecurity is an important and integrated part of the Company’s enterprise risk management function that identifies, monitors and mitigates business, operational and legal risks.

To help protect the Company from a major cybersecurity incident that could have a material impact on operations or the Company’s financial results, the Company has implemented policies, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps the Company takes to reduce its vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include, but are not limited to: establishing information security policies and standards, implementing information protection processes and technologies, monitoring its information technology systems for cybersecurity threats, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company is currently in material compliance with applicable information privacy and cybersecurity standards.

The Company has implemented a Cybersecurity Incident Response Plan (the “Plan”), which is integrated into its overall crisis management program. The Plan provides a framework for responding to cybersecurity incidents. The Plan identifies applicable requirements for incident disclosure and reporting as well as provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to the Company’s senior management, the disclosure committee, the Board and appropriate Board committees. The Plan also addresses requirements for the Company’s external reporting obligations. The Plan is reviewed and updated, as necessary, under the leadership of the Company’s Chief Information Security Officer (“CISO”) and Chief Privacy Officer (“CPO”).

The Company’s information technology systems and processes are assessed by independent third parties, as appropriate to their business requirements, for compliance with the following standards: HIPAA; NIST 800-53; System and Organization Controls (“SOC”) 1; SOC 2 Type 2; HI-TRUST; Payment Card Industry Data Security Standards; and the National Association of Insurance Commissioners. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See “Item 1A. Risk Factors” for more information on the Company’s cybersecurity-related risks.

Management has responsibility to manage risk and bring to the Board’s attention the most material near-term and long-term risks to the Company. The Company’s CISO leads management’s assessment and management of cybersecurity risk. The CISO reports to the Company’s Chief Digital, Data, Analytics & Technology Officer (the “CDDATO”), who reports directly to the Company’s Chief Executive Officer. The CDDATO, CISO and the CPO, regularly review cybersecurity matters with management. The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.

The Board is actively engaged in overseeing and reviewing the Company’s strategic direction and objectives, taking into account, among other considerations, the Company’s risk profile and related exposures, as part of this oversight the Board has delegated certain of these responsibilities to committees of the Board. The Board has delegated the responsibility for the oversight of the Company’s cybersecurity risks program to the Nominating and Corporate Governance Committee. As part of this oversight, the Nominating and Corporate Governance Committee reviews the Company’s cybersecurity program periodically, and at least annually. The Company’s CDDATO and CISO update the Nominating and Corporate Governance Committee periodically, and at least annually, and the full Board as needed, on the Company’s cybersecurity program, including with respect to particular cybersecurity threats, incidents or new developments in the Company’s risk profile. The CISO is a member of the Company’s disclosure committee, and the CPO advises the disclosure committee on cybersecurity matters on an as-needed basis. During 2023, the Board conducted a review of its overall committee structure, membership and responsibilities in an effort to enhance its oversight. As part of this review, the Board has determined that it will shift the delegation of the oversight of the Company’s cybersecurity risks program to the Audit Committee effective March 2024.

The Company’s principal office is an owned building complex located in Woonsocket, Rhode Island, which totals approximately one million square feet. The Company also leases office space in other locations in the U.S.

The Health Care Benefits segment’s principal office is an owned building complex located in Hartford, Connecticut, which totals approximately 1.7 million square feet. The Health Care Benefits segment also owns or leases office space in other locations in the U.S. and several other countries.

The Health Services segment includes owned or leased mail service dispensing pharmacies, call centers, on-site pharmacy stores, retail specialty pharmacy stores, specialty mail service pharmacies and primary care centers.

The Health Services segment leases 204 primary care centers across 25 states, totaling approximately 1.9 million square feet.

The Health Services segment also owns or leases office space used for administration, sales and marketing, technology and development and professional services throughout the U.S. and in Ireland.

As of December 31, 2023, the Pharmacy & Consumer Wellness segment operated the following properties:

In connection with certain business dispositions completed between 1995 and 1997, the Company continues to guarantee lease obligations for 63 former stores. The Company is indemnified for these guarantee obligations by the respective initial purchasers. These guarantees generally remain in effect for the initial lease term and any extension thereof pursuant to a renewal option provided for in the lease prior to the time of the disposition. For additional information on these guarantees, see “Lease Guarantees” in Note 18 ‘‘Commitments and Contingencies’’ included in Item 8 of this 10-K.

Management believes that the Company’s owned and leased facilities are suitable and adequate to meet the Company’s anticipated needs. At the end of the existing lease terms, management believes the leases can be renewed or replaced by alternative space. For additional information on the right-of-use assets and lease liabilities associated with the Company’s leases, see Note 7 ‘‘Leases’’ included in Item 8 of this 10-K.

The information contained in Note 18 ‘‘Commitments and Contingencies’’ included in Item 8 of this 10-K is incorporated herein by reference.

Not applicable.

The following sets forth the name, age and biographical information for each of the Registrant’s executive officers as of February 7, 2024. In each case the officer’s term of office extends to the date of the meeting of the Board following the next annual meeting of stockholders of CVS Health Corporation. Previous positions and responsibilities held by each of the executive officers over the past five years or more are indicated below:

from August 2018 through November 2021; Vice President - Specialty Pharmacy, CVS Caremark from February 2013 through July 2018.

CVS Health Corporation’s common stock is listed on the New York Stock Exchange under the symbol “CVS.”

During 2023, 2022 and 2021, the quarterly cash dividend was $0.605, $0.55 and $0.50 per share, respectively. In December 2023, the Board authorized an increase of approximately 10% in the quarterly cash dividend to $0.665 per share effective in 2024. CVS Health Corporation has paid cash dividends every quarter since becoming a public company. Future dividends will depend on the Company’s earnings, capital requirements, financial condition and other factors considered relevant by the Board.

See Note 14 ‘‘Shareholders’ Equity’’ included in Item 8 of this 10-K for information regarding CVS Health Corporation’s dividends.

As of January 31, 2024, there were 23,098 registered holders of the registrant’s common stock according to the records maintained by the registrant’s transfer agent.

The following share repurchase programs have been authorized by the Board:

Each of the share Repurchase Programs was effective immediately and permit the Company to effect repurchases from time to time through a combination of open market repurchases, privately negotiated transactions, accelerated share repurchase (“ASR”) transactions, and/or other derivative transactions. Both the 2022 and 2021 Repurchase Programs can be modified or terminated by the Board at any time.

During the years ended December 31, 2023 and 2022, the Company repurchased an aggregate of 22.8 million shares of common stock for approximately $2.0 billion and an aggregate of 34.1 million shares of common stock for approximately $3.5 billion, respectively, both pursuant to the 2021 Repurchase Program. This activity includes the share repurchases under the ASR transactions described below. During the year ended December 31, 2021, the Company did not repurchase any shares of common stock.

Pursuant to the authorization under the 2021 Repurchase Program, the Company entered into a $3.0 billion fixed dollar ASR with Morgan Stanley & Co. LLC (“Morgan Stanley”). Upon payment of the $3.0 billion purchase price on January 4, 2024, the Company received a number of shares of CVS Health Corporation’s common stock equal to 85% of the $3.0 billion notional amount of the ASR or approximately 31.4 million shares at a price of $81.19 per share, which were placed into treasury stock in January 2024. At the conclusion of the ASR, the Company may receive additional shares representing the remaining 15% of the $3.0 billion notional amount. The ultimate number of shares the Company may receive will depend on the daily volume-weighted average price of the Company’s stock over an averaging period, less a discount. It is also possible, depending on such weighted average price, that the Company will have an obligation to Morgan Stanley which, at the Company’s option, could be settled in additional cash or by issuing shares. Under the terms of the ASR, the maximum number of shares that could be delivered to the Company is 73.9 million.

Pursuant to the authorization under the 2021 Repurchase Program, the Company entered into a $2.0 billion fixed dollar ASR with Citibank, N.A. Upon payment of the $2.0 billion purchase price on January 4, 2023, the Company received a number of

shares of CVS Health Corporation’s common stock equal to 80% of the $2.0 billion notional amount of the ASR or approximately 17.4 million shares at a price of $92.19 per share, which were placed into treasury stock in January 2023. The ASR was accounted for as an initial treasury stock transaction for $1.6 billion and a forward contract for $0.4 billion. The forward contract was classified as an equity instrument and was recorded within capital surplus. In February 2023, the Company received approximately 5.4 million shares of CVS Health Corporation’s common stock, representing the remaining 20% of the $2.0 billion notional amount of the ASR, thereby concluding the ASR. These shares were placed into treasury and the forward contract was reclassified from capital surplus to treasury stock in February 2023.

Pursuant to the authorization under the 2021 Repurchase Program, the Company entered into a $1.5 billion fixed dollar ASR with Barclays Bank PLC. Upon payment of the $1.5 billion purchase price on January 4, 2022, the Company received a number of shares of CVS Health Corporation’s common stock equal to 80% of the $1.5 billion notional amount of the ASR or approximately 11.6 million shares at a price of $103.34 per share, which were placed into treasury stock in January 2022. The ASR was accounted for as an initial treasury stock transaction for $1.2 billion and a forward contract for $0.3 billion. The forward contract was classified as an equity instrument and was recorded within capital surplus. In February 2022, the Company received approximately 2.7 million shares of CVS Health Corporation’s common stock, representing the remaining 20% of the $1.5 billion notional amount of the ASR, thereby concluding the ASR. These shares were placed into treasury stock and the forward contract was reclassified from capital surplus to treasury stock in February 2022.

At the time they were received, the initial and final receipt of shares resulted in an immediate reduction of the outstanding shares used to calculate the weighted average common shares outstanding for basic and diluted earnings per share.

See Note 14 ‘‘Shareholders’ Equity’’ included in Item 8 of this 10-K for additional information regarding the Company’s share repurchases.

The following graph compares the cumulative total shareholder return on CVS Health Corporation’s common stock (assuming reinvestment of dividends) with the cumulative total return on the S&P 500 Index, the S&P 500 Food and Staples Retailing Industry Group Index and the S&P 500 Healthcare Sector Group Index from December 31, 2018 through December 31, 2023. The graph assumes a $100 investment in shares of CVS Health Corporation’s common stock on December 31, 2018.

The year-ended values of each investment shown in the preceding graph are based on share price appreciation plus dividends, with the dividends reinvested as of the last business day of the month during which such dividends were ex-dividend. The calculations exclude trading commissions and taxes. Total shareholder returns from each investment can be calculated from the year-end investment values shown beneath the graph.

Not applicable.

The following discussion and analysis should be read in conjunction with the audited consolidated financial statements and related notes included in Item 8 of this Annual Report on Form 10-K (this “10-K”), “Risk Factors” included in Item 1A of this 10-K and the “Cautionary Statement Concerning Forward-Looking Statements” in this 10-K.

CVS Health Corporation, together with its subsidiaries (collectively, “CVS Health,” the “Company,” “we,” “our” or “us”), is a leading health solutions company building a world of health around every consumer it serves and connecting care so that it works for people wherever they are. As of December 31, 2023, the Company had more than 9,000 retail locations, more than 1,000 walk-in medical clinics, 204 primary care medical clinics, a leading pharmacy benefits manager with approximately 108 million plan members and expanding specialty pharmacy solutions, and a dedicated senior pharmacy care business serving more than one million patients per year. The Company also serves an estimated more than 35 million people through traditional, voluntary and consumer-directed health insurance products and related services, including expanding Medicare Advantage offerings and a leading standalone Medicare Part D prescription drug plan (“PDP”). The Company is creating new sources of value through its integrated model allowing it to expand into personalized, technology driven care delivery and health services, increasing access to quality care, delivering better health outcomes and lowering overall health care costs.

During the year ended December 31, 2023, the Company completed the acquisition of two key health care delivery assets to enhance its ability to execute on its care delivery strategy by advancing its primary care, home-based care and provider enablement capabilities. On March 29, 2023, the Company acquired Signify Health, Inc. (“Signify Health”), a leader in health risk assessments, value-based care and provider enablement services. On May 2, 2023, the Company also acquired Oak Street Health, Inc. (“Oak Street Health”), a leading multi-payor operator of value-based primary care centers serving Medicare eligible patients. Both Signify Health and Oak Street Health are included within the Health Services segment.

In connection with its new operating model adopted in the first quarter of 2023, the Company realigned the composition of its segments to reflect how its Chief Operating Decision Maker (the “CODM”) reviews information and manages the business. The Company’s CODM is the Chief Executive Officer. As a result of this realignment, the Company formed a new Health Services segment, which in addition to providing a full range of pharmacy benefit management (“PBM”) solutions, also delivers health care services in the Company’s medical clinics, virtually, and in the home, as well as provider enablement solutions. In addition, the Company created a new Pharmacy & Consumer Wellness segment, which includes its retail and long-term care pharmacy operations and related pharmacy services, as well as its retail front store operations. This segment will also provide pharmacy fulfillment services to support the Health Services segment’s specialty and mail order pharmacy offerings. Prior period segment financial information has been recast to conform with the current period presentation. See Note 19 ‘‘Segment Reporting’’ included in Item 8 of this 10-K for segment financial information.

The Company has four reportable segments: Health Care Benefits, Health Services, Pharmacy & Consumer Wellness and Corporate/Other, which are described below.

The Health Care Benefits segment operates as one of the nation’s leading diversified health care benefits providers. The Health Care Benefits segment has the information and resources to help members, in consultation with their health care professionals, make more informed decisions about their health care. The Health Care Benefits segment offers a broad range of traditional, voluntary and consumer-directed health insurance products and related services, including medical, pharmacy, dental and behavioral health plans, medical management capabilities, Medicare Advantage and Medicare Supplement plans, PDPs and Medicaid health care management services. The Health Care Benefits segment’s customers include employer groups, individuals, college students, part-time and hourly workers, health plans, health care providers (“providers”), governmental units, government-sponsored plans, labor groups and expatriates. The Company refers to insurance products (where it assumes all or a majority of the risk for medical and dental care costs) as “Insured” and administrative services contract products (where the plan sponsor assumes all or a majority of the risk for medical and dental care costs) as “ASC.” The Company sold Insured plans directly to individual consumers through the individual public health insurance exchanges (“Public Exchanges”) in 12 states as of December 31, 2023. The Company entered Public Exchanges in five additional states effective January 2024.

The Pharmacy & Consumer Wellness segment dispenses prescriptions in its retail pharmacies and through its infusion operations, provides ancillary pharmacy services including pharmacy patient care programs, diagnostic testing and vaccination administration, and sells a wide assortment of health and wellness products and general merchandise. The segment also conducts long-term care pharmacy (“LTC”) operations, which distribute prescription drugs and provide related pharmacy consulting and ancillary services to long-term care facilities and other care settings, and provides pharmacy fulfillment services to support the Health Services segment’s specialty and mail order pharmacy offerings. As of December 31, 2023, the Pharmacy & Consumer Wellness segment operated more than 9,000 retail locations, as well as online retail pharmacy websites, LTC pharmacies and on-site pharmacies, retail specialty pharmacy stores, compounding pharmacies and branches for infusion and enteral nutrition services.

The Company presents the remainder of its financial results in the Corporate/Other segment, which primarily consists of:

The coronavirus disease 2019 (“COVID-19”) continues to impact the economies of the U.S. and other countries around the world. The impact of COVID-19 on the Company’s businesses, operating results, cash flows and financial condition in the years ended December 31, 2023, 2022 and 2021, as well as information regarding certain expected impacts of COVID-19 on the Company, is discussed throughout this Annual Report on Form 10-K.

The following information summarizes the Company’s results of operations for 2023 compared to 2022. Financial information for the years ended December 31, 2022 and 2021 has been revised to reflect the impact of the following items, as applicable:

For discussion of the Company’s results of operations for 2022 compared to 2021, see “Management’s Discussion and Analysis of Financial Condition and Results of Operations with Retrospective Adjustments” for the year ended December 31, 2022, which was revised to reflect the items noted above and is included in Exhibit 99.1 to the Company’s Current Report on Form 8-K filed with the U.S. Securities and Exchange Commission (the “SEC”) on May 25, 2023.

Commentary - 2023 compared to 2022

Revenues

Operating expenses

Operating income

Interest expense

Income tax provision

The Company believes you should consider the following key business and regulatory trends and uncertainties:

Key Business Trends and Uncertainties

Key Regulatory Trends and Uncertainties

For additional information regarding these and other trends and uncertainties, see Item 1A, “Risk Factors” and Part I, Item 1 “Business - Government Regulation.”

The following discussion of segment operating results is presented based on the Company’s reportable segments in accordance with the accounting guidance for segment reporting and is consistent with the segment disclosure in Note 19 ‘‘Segment Reporting’’ included in Item 8 of this 10-K.

The Company has three operating segments, Health Care Benefits, Health Services and Pharmacy & Consumer Wellness, as well as a Corporate/Other segment. The Company’s segments maintain separate financial information, and the CODM evaluates the segments’ operating results on a regular basis in deciding how to allocate resources among the segments and in assessing segment performance. The CODM evaluates the performance of the Company’s segments based on adjusted operating income. Adjusted operating income is defined as operating income as measured by accounting principles generally accepted in the United States of America (“GAAP”) excluding the impact of amortization of intangible assets and other items, if any, that neither relate to the ordinary course of the Company’s business nor reflect the Company’s underlying business performance. Effective for the first quarter of 2023, adjusted operating income also excludes the impact of net realized capital gains or losses. See the reconciliations of operating income (GAAP measure) to adjusted operating income below for further context regarding the items excluded from operating income in determining adjusted operating income. The Company uses adjusted operating income as its principal measure of segment performance as it enhances the Company’s ability to compare past financial performance with current performance and analyze underlying business performance and trends. Non-GAAP financial measures the Company discloses, such as consolidated adjusted operating income, should not be considered a substitute for, or superior to, financial measures determined or calculated in accordance with GAAP.

The impact of these items on segment financial information for the years ended December 31, 2022 and 2021 is reflected in the “Adjustments” lines of the table included on the next page.

The following is a reconciliation of financial measures of the Company’s segments to the consolidated totals:

The following are reconciliations of consolidated operating income (GAAP measure) to consolidated adjusted operating income, as well as reconciliations of segment GAAP operating income (loss) to segment adjusted operating income (loss):