CVS Health (CVS) Risk Analysis

Our businesses are subject to extensive regulation and oversight by state, federal and international governmental authorities. The laws and regulations governing our operations and interpretations of those laws and regulations are increasing in number and complexity, change frequently and can be inconsistent or conflict with one another. In general, these laws and regulations are designed to benefit and protect customers, members and providers rather than us or our investors. In addition, the governmental authorities that regulate our businesses have broad latitude to make, interpret and enforce the laws and regulations that govern us and continue to interpret and enforce those laws and regulations more strictly and more aggressively each year. We also must follow various restrictions on certain of our businesses and the payment of dividends by certain of our subsidiaries put in place by certain state regulators. Certain of our Health Services and Pharmacy & Consumer Wellness operations, products and services are subject to: - the clinical quality, patient safety and other risks inherent in the dispensing, packaging and distribution of drugs and other health care products and services, including claims related to purported dispensing and other operational errors (any failure by our Health Services and/or Pharmacy & Consumer Wellness operations to adhere to the laws and regulations applicable to the dispensing of drugs could subject us to civil and criminal penalties);- federal and state anti-kickback and other laws that govern our relationship with drug manufacturers, customers and consumers;- compliance requirements under ERISA, including fiduciary obligations in connection with the development and implementation of items such as drug formularies and preferred drug listings; and - federal and state legislative proposals and/or regulatory activity that could adversely affect pharmacy benefit industry practices. Our Health Care Benefits products are highly regulated, particularly those that serve Medicare, Medicaid, dual eligible, dual eligible special needs and small group Commercial customers and members. The laws and regulations governing participation in Medicare Advantage (including dual eligible special needs plans), Medicare Part D, Medicaid, and Managed Medicaid plans are complex, are subject to interpretation and can expose us to penalties for non-compliance. The scope of the practices and activities that are prohibited by federal and state false claims acts is the subject of pending litigation. Claims under federal and state false claims acts can be brought by the government or by private individuals on behalf of the government through a qui tam or "whistleblower" suit, and we are a defendant in a number of such proceedings. If we are convicted of fraud or other criminal conduct in the performance of a government program or if there is an adverse decision against us under the False Claims Act, we may be temporarily or permanently suspended from participating in government health care programs, including Medicare Advantage, Medicare Part D, Medicaid and dual eligible plan programs, and we also may be required to pay significant fines and/or other monetary penalties. Whistleblower suits have resulted in significant settlements between governmental agencies and health care companies. The significant incentives and protections provided to whistleblowers under applicable law increase the risk of whistleblower suits. In addition, we are subject to assessments under guaranty fund laws existing in all states for obligations of insolvent insurance companies (including long-term care insurers), HMOs, ACA co-ops and other payors to policyholders and claimants. Guaranty funds are maintained by state insurance commissioners to protect policyholders and claimants in the event that an insurer, HMO, ACA co-op and/or other payor becomes insolvent or is unable to meet its financial obligations. These funds are usually financed by assessments against insurers regulated by a state. Future assessments may have an adverse effect on our operating results and cash flows. If we fail to comply with laws and regulations that apply to government programs, we could be subject to criminal fines, civil penalties, premium refunds, prohibitions on marketing or active or passive enrollment of members, corrective actions, termination of our contracts or other sanctions, which could have a material adverse effect on our ability to participate in Medicare Advantage, Medicare Part D, Medicaid and dual eligible plans and other programs, our brand and reputation, and our operating results, cash flows and financial condition. For more information on these matters, see "Government Regulation" included in Item 1 of this 10-K.

The political environment in which we operate remains uncertain. It is reasonably possible that our business operations and operating results could be materially adversely affected by legislative, enforcement, regulatory and public policy changes at the federal or state level, including, but not limited to: changes to the regulatory environment for health care and related benefits, including Medicare, Medicare Advantage, the ACA, and related regulations; changes in the 340B program, including the resumption of the Pilot and any expansion thereof; efforts to amend the ACA and related regulations, including through litigation aimed at challenging the ability to enforce portions of the ACA, such as the preventative services mandate; changes to laws or regulations governing drug reimbursement, pricing, purchasing and/or importation; changes to or adoption of laws or regulations governing PBMs, including those related to prohibiting pharmacy licensure for pharmacies affiliated with a PBM, network restrictions, formulary management, affiliate reimbursement, contractual guarantees and reconciliations, reimbursement mandates, required reporting, compensation, purchase discount and/or rebate arrangements with drug manufacturers and/or other PBM services; changes to the laws and regulations governing PBMs', PDPs' and/or Managed Medicaid organizations' interactions with government funded health care programs; changes to or adoption of laws and/or regulations relating to claims processing and billing; changes to immigration policies; changes to patent laws; changes with respect to tax and trade policies, tariffs and other government regulations affecting trade between the U.S. and other countries; and other public policy initiatives. Our businesses, profitability and growth also may be adversely affected by (i) judicial and regulatory decisions that change and/or expand the interpretations of existing statutes and regulations, expand fiduciary obligations, impose medical or bad faith liability, increase our responsibilities under ERISA or the remedies available under ERISA, or reduce the scope of ERISA and Medicare Part D preemption of state law claims or (ii) other legislation and regulations. For example, laws in Arkansas, Louisiana, North Dakota and Oklahoma have attempted to limit PBM practices and have been subject to recent lawsuits. Additional litigation has been filed in several states to challenge ERISA and Medicare Part D preemption. It is not possible to predict the enactment or content of new legislation or regulations or changes to existing laws or regulations or their enforcement, interpretation or application, or the form they will take (for example, through the use of U.S. Presidential Executive Orders or executive orders by governors or key regulators). If we fail to respond adequately to such changes, including by implementing strategic and operational initiatives, or do not respond as effectively as our competitors, our businesses, operations and operating results may be materially adversely affected. Even if we could predict such matters, it may not be possible to eliminate the adverse impact of public policy changes that would fundamentally change the dynamics of one or more industries in which we compete. Examples of such changes include, but are not limited to: the federal or one or more state governments fundamentally restructuring or reducing the funding available for government programs, increasing its involvement in drug reimbursement, pricing, purchasing and/or importation, changing the laws and regulations governing PBMs', PDPs' and/or Managed Medicaid organizations' interactions with government funded health care programs, changing the tax treatment of health or related benefits, including the expiration of enhanced premium tax credits, or significantly altering the ACA. The likelihood of adverse changes remains high due to state and federal budgetary pressures, and our businesses and operating results could be materially and adversely affected by such changes, even if we correctly predict their occurrence. There is also uncertainty surrounding potential changes to the health care regulatory environment in the U.S. For example, potential efforts to reform federal government processes and reduce expenditures as well as pressures on and uncertainty surrounding the U.S. federal government's budget and potential changes in budgetary priorities could adversely affect the funding for individual programs, including government programs, upon which our business depends. Executive orders covering health care and other subjects including immigration, AI, energy and the federal workforce as well as the workforce of public and private companies, if implemented through agency action, may also impact the Company. Potential regulatory changes related to tax, trade, economic and monetary policy and heightened diplomatic tensions or political and civil unrest, among other potential changes, could adversely impact the global economy and our operating results. For more information on these matters, see "Government Regulation" included in Item 1 of this 10-K.

Congress and certain state legislatures continue to consider and pass legislation that increases our costs of doing business, including increased minimum wages and requiring employers to provide paid sick leave or paid family leave. In addition, our employee-related operating costs may be increased by the proposed changes to the H-1B and other visa programs, which could limit our and others' ability to hire skilled individuals. Regarding union organizing activity, it is possible that the National Labor Relations Board may adopt regulatory changes through re-making or case law that could facilitate union organizing. If we are unable to reflect these increased expenses in our pricing or otherwise modify our operations to mitigate the effects of such increases, our operating results will be adversely affected.

The ACA's minimum MLR rebate requirements limit the level of margin we can earn in Health Care Benefits' Commercial Insured business. CMS and state minimum MLR rebate regulations limit the level of margin we can earn in our Medicare Advantage and Medicaid Insured businesses. Certain portions of our Health Care Benefits Medicaid and FEHB program business also are subject to minimum MLR rebate requirements in addition to but separate from those imposed by the ACA. Minimum MLR rebate requirements leave us exposed to medical costs that are higher than those reflected in our pricing. The process supporting the management and determination of the amount of MLR rebates payable is complex and requires judgment, and the minimum MLR reporting requirements are detailed. CMS has also proposed, but not yet finalized, a definition of "prescription drug price concessions" for commercial MLR calculation purposes, which would make additional PBM information available to plans and the HHS, potentially further complicating the MLR calculation process. Federal and state auditors are challenging our Commercial Health Care Benefits business' compliance with the ACA's minimum MLR requirements as well as our FEHB plans' compliance with OPM's FEHB program-specific minimum MLR requirements. Our Medicare and Medicaid contracts also are subject to minimum MLR audits. If a Medicare Advantage or Medicare Part D contract pays minimum MLR rebates for three consecutive years, it will become ineligible to enroll new members. If a Medicare Advantage or Medicare Part D contract pays such rebates for five consecutive years, it will be terminated by CMS. Additional challenges to our methodology and/or reports relating to minimum MLR and related rebates by federal and state regulators and private litigants are reasonably possible. The outcome of these audits and additional challenges could adversely affect our operating results.

We face unique regulatory and other challenges that may inhibit the profitability of our Medicare and Medicaid businesses. - In April 2025, CMS issued its final notice detailing final 2026 Medicare Advantage payment rates. Based on CMS' notice, Medicare Advantage rates resulted in an expected average increase in revenue for the Medicare Advantage industry of 7.16%, which includes a risk score trend increase of 2.10%. Risk scores vary among Medicare Advantage plans depending on the specific population served, so this increase does not represent an actual guaranteed payment increase. Without including the risk score trend increase, the 2026 rates result in an expected average increase in revenue for the Medicare Advantage industry of 5.06%, though the rates may vary widely depending on the provider group and patient demographics. On January 26, 2026, CMS issued an advance notice detailing proposed 2027 Medicare Advantage payment rates. The 2027 Medicare Advantage rates, if finalized as proposed, will result in an expected average increase in revenue for the Medicare Advantage industry of 2.54%, which includes a risk score trend increase of 2.45%. Without including the risk score trend increase, the advance 2027 rates will result in an expected average increase in revenue for the Medicare Advantage industry of 0.09%, though the rates may vary widely depending on the provider group and patient demographics. CMS intends to publish the final 2027 rate announcement no later than April 6, 2026. The Company faces challenges from the impact of the increasing cost of medical care (including prescription medications), changes to methodologies for determining payments and CMS local and national coverage decisions that require the Company to pay for services and supplies that are not factored into the Company's bids. In addition, insufficient CMS Medicare rate increases relative to underlying medical cost trends may materially impact the results of our Oak Street Health business. We cannot predict how the rates will be finalized, future Medicare funding levels, the impact of future federal budget actions or ensure that such changes or actions will not have a material adverse effect on our Medicare operating results. - The organic expansion of our Medicare Advantage and Medicare Part D service area is subject to the ability of CMS to process our requests for service area expansions and our ability to build cost competitive provider networks in the expanded service areas that meet applicable network adequacy requirements. CMS' decisions on our requests for service area expansions also may be affected adversely by compliance issues that arise each year in our Medicare operations. - CMS regularly audits our performance to determine our compliance with CMS's regulations and our contracts with CMS and to assess the quality of the services we provide to our Medicare members, and state regulators are increasingly conducting audits to assess the quality of services we provide to our Medicaid members. As a result of these audits, we may be subject to significant or material retroactive adjustments to and/or withholding of certain premiums and fees, fines, criminal liability, civil monetary penalties, CMS- or state-imposed sanctions (including suspension or exclusion from participation in government programs) or other restrictions on our Medicare, Medicaid and other businesses, including suspension or loss of licensure. - "Star ratings" from CMS for our Medicare Advantage plans will continue to have a significant effect on our plans' operating results. Only Medicare Advantage plans with a star rating of 4 or higher (out of 5) are eligible for a quality bonus in their basic premium rates. Based on the Company's membership as of December 2025, more than 81% of the Company's Medicare Advantage members were in 2026 Medicare Advantage plans that are rated 4 stars or higher and more than 63% of the Company's Medicare Advantage members were in a 4.5-star plan for 2026. CMS also gives PDPs star ratings that affect each PDP's enrollment. Medicare Advantage and PDP plans that are rated less than 3 stars for three consecutive years are subject to contract termination by CMS. CMS continues to change its rating system to make achieving and maintaining a four or higher star rating more difficult, including annual updates to performance measures. If our star ratings fall or remain below four for a significant portion of our Medicare Advantage membership, or do not match the performance of our competitors, or the star rating quality bonuses are reduced or eliminated, our revenues, operating results and cash flows may be significantly adversely affected. In addition, due to uncertainties with CMS cut-points, no Medicare Advantage plan can guarantee their overall star ratings. There can be no assurances that the Company will be successful in maintaining or improving its star ratings in future years. - Payments we receive from CMS for our Medicare Advantage and Medicare Part D businesses also are subject to risk adjustment based on the health status of the individuals we enroll. Elements of that risk adjustment mechanism continue to be challenged by the DOJ, the OIG and CMS itself. For example, CMS made significant changes to the structure of the hierarchical condition category model in version 28, which may impact RAF scores for a larger percentage of Medicare Advantage beneficiaries and could result in changes to beneficiary RAF scores with or without a change in the patient's health status. CMS continuously evaluates how and where risk adjustment is captured, which from time-to-time has included the capture of diagnosis codes in home visits. A legislative or regulatory change to the ability of Medicare Advantage plans to use home visits as a means to evaluate and diagnose their members' health conditions, or substantial changes in the risk adjustment mechanism or other changes that may result from enforcement or audit actions, could: materially affect the amount of our Medicare reimbursement, require us to raise prices or reduce the benefits we offer to Medicare beneficiaries, impact the services provided by, or the financial performance of, Oak Street Health and Signify Health and potentially limit our (and the industry's) participation in the Medicare program. - In May 2025, CMS announced it would audit every Medicare Advantage contract each payment year, with an expedited plan to complete audits for payment years 2018 through 2024 by early 2026. The lack of detail provided with respect to how CMS will select claims to audit and the methodology CMS will use may impact future Medicare Advantage bids and result in other implications. - Our Medicare Part D operating results and our ability to expand our Medicare Part D business could be adversely affected if: the cost and complexity of Medicare Part D exceed management's expectations or prevent effective program implementation or administration; further changes to the regulations regarding how drug costs are reported for Medicare Part D (including changes related to the IRA) are implemented in a manner that adversely affects the profitability of our Medicare Part D business; changes to the applicable regulations impact our ability to retain fees from third parties including network pharmacies; the government alters Medicare Part D program requirements or reduces funding because of the higher-than-anticipated cost to taxpayers of Medicare Part D or for other reasons; or reinsurance thresholds are reduced. - The IRA contains significant changes to the Medicare Part D program, including changes that shift more of the claim liability to plans and away from the government, including a complete redesign of the Medicare Part D standard benefit effective in 2025, which may reduce the Company's flexibility to design competitive offerings. - Further, as a result of the ACA and changes to the retiree drug subsidy rules, clients of our PBM business could decide to discontinue providing prescription drug benefits to their Medicare-eligible members. To the extent this phenomenon occurs, the adverse effects of increasing customer migration into Medicare Part D may outweigh the benefits we realize from growth of our Medicare Part D products. - State Medicaid agencies regularly audit, and state officials regularly investigate, the Company's performance across all areas of its contractual obligations to the state to determine compliance and quality of services. The Company may be subject to, among other penalties, significant fines, sanctions, corrective actions, and enrollment freezes depending on the findings of these audits and reviews. The Company's ongoing performance and compliance with program requirements can impact our ability to expand and retain Medicaid business. State Medicaid agencies are also increasingly using the audit process to challenge the legality of PBM practices, such as guaranteed effective rate reconciliations with retail pharmacies and transmission fees. - We have experienced challenges in obtaining complete and accurate encounter data for our Medicaid products due to difficulties with providers and third-party vendors submitting claims in a timely fashion in the proper format, and with state agencies in coordinating such submissions. As states increase their reliance on encounter data, and some states mandate that certain amounts be included or excluded from encounter data, these difficulties could affect the Medicaid premium rates we receive and how Medicaid membership is assigned to us, which could have a material adverse effect on our Medicaid operating results and cash flows and/or our ability to bid for, and continue to participate in, certain Medicaid programs. - If we fail to report and correct errors discovered through our own auditing procedures or during a CMS audit or otherwise fail to comply with the applicable laws and regulations, we could be subject to fines, civil monetary penalties or other sanctions, including fines and penalties under the False Claims Act, which could have a material adverse effect on our ability to participate in Medicare Advantage, Medicare Part D or other government programs, and on our operating results, cash flows and financial condition. - Certain of our Medicaid contracts require the submission of complete and correct encounter data. The accurate and timely reporting of encounter data is increasingly important to the success of our Medicaid programs because more states are using encounter data to determine compliance with performance standards and, in part, to set premium rates. We have expended and may continue to expend additional effort and incur significant additional costs to collect accurate, or to correct inaccurate or incomplete, encounter data and have been and could be exposed to premium withholding, operating sanctions and financial fines and penalties for noncompliance. - CMS has proposed requiring that health plans offering certain dual eligible programs must also offer Medicaid programs, which could further impact the Company's ability to obtain or retain membership in its dual eligible programs. In addition, states are increasingly requiring companies to offer Medicaid within a state and conducting competitive bid processes to qualify to offer dual eligible products. - The "Working Families Tax Cut Act," formerly the "One Big Beautiful Bill Act," of 2025 makes changes to Medicaid eligibility rules and financing which will lead to reduced eligibility for Medicaid beneficiaries, particularly expansion populations, and reduced state funding, which will impact Medicaid benefits and payment rates. Given these changes, states that have not already done so are unlikely to consider Medicaid expansion.