HCA Healthcare (HCA) Risk Analysis

As a participant in the health care industry, we are required to comply with extensive and complex laws and regulations at the federal, state and local government levels relating to, among other things: - billing and coding for services and properly handling overpayments;- appropriateness and classification of level and setting of care provided, including proper classification of admissions, observation services and outpatient care;- relationships with physicians and other referral sources and referral recipients;- necessity, appropriateness and adequacy of medical care;- quality of medical equipment and services;- qualifications and supervision of medical and support personnel;- patient, workforce and public safety;- the confidentiality, maintenance, interoperability, exchange and security of health-related and personal information and medical records, including data breach, ransomware and identity theft issues;- the provision of services via telehealth, including technological standards and coverage restrictions or other limitations on reimbursement;- the development and use of AI and other predictive algorithms, including those used in clinical decision support tools;- screening, stabilization and transfer of individuals who have emergency medical conditions;- restrictions on the provision of medical care, including with respect to reproductive care;- facility and personnel licensure, certification and accreditation and enrollment standards and requirements for participation in government programs;- the manufacture, distribution, maintenance and dispensing of pharmaceuticals, controlled substances and medical devices;- debt collection, balance billing and billing for out of network services;- consumer disclosures and price transparency;- communications with patients and consumers;- preparing and filing of cost reports;- operating policies and procedures;- activities regarding competitors;- addition of facilities and services; and - environmental protection, including disposal of regulated materials. Among these laws are the federal Anti-kickback Statute, EKRA, the federal Stark Law, the FCA, the No Surprises Act and similar state laws. We have a variety of financial relationships with physicians and others who either refer or influence the referral of patients to our hospitals, other health care facilities, laboratories and employed physicians or who are the recipients of referrals, and these laws govern those relationships. The OIG has enacted safe harbor regulations that outline practices deemed protected from prosecution under the Anti-kickback Statute. While we endeavor to comply with the applicable safe harbors, certain of our current arrangements, including joint ventures and financial relationships with physicians and other referral sources and persons and entities to which we refer patients, do not qualify for safe harbor protection. Failure to qualify for a safe harbor does not mean the arrangement necessarily violates the Anti-kickback Statute but may subject the arrangement to greater scrutiny. However, we cannot offer assurance that practices outside of a safe harbor will not be found to violate the Anti-kickback Statute. Allegations of violations of the Anti-kickback Statute may be brought under the federal Civil Monetary Penalty Law, which requires a lower burden of proof than other fraud and abuse laws, including the Anti-kickback Statute. Our financial relationships with physicians who make referrals for designated health services and their immediate family members must comply with the Stark Law by meeting an exception. We attempt to structure our relationships to meet an exception to the Stark Law, but the regulations implementing the exceptions are detailed and complex. We do not always have the benefit of significant regulatory or judicial interpretations of the Stark Law and its implementing regulations. Thus, we cannot provide assurance that every relationship complies fully with the Stark Law. Unlike the Anti-kickback Statute, failure to meet an exception under the Stark Law results in a violation of the Stark Law, even if such violation is technical in nature. Additionally, if we violate the Anti-kickback Statute or Stark Law, or if we improperly bill for our services, we may be found to violate the FCA, either under a suit brought by the government or by a private person under a qui tam, or "whistleblower," suit. See Item 1, "Business - Regulation and Other Factors." A variety of state, national, foreign and international laws and regulations apply to the collection, use, retention, protection, security, disclosure, transfer and other processing of personal information. Various states in which we operate have passed privacy laws and regulations that impose restrictive requirements on the use, disclosure, transfer and storage of personal information, including restrictions on the offshoring of data, and many other state and federal privacy laws have been proposed. In many cases, these laws are more restrictive or impose more obligations than, and may not be preempted by, the HIPAA privacy and security regulations, may apply to employees and business contacts in addition to patients, and may be subject to new and varying interpretations by courts and government agencies. The potential effects of these laws are far-reaching and may require us to incur substantial expenses, including costs associated with modifying our data processing practices and policies. As a result of our operations in the United Kingdom, we are subject to the UK Data Protection Act, which contains stricter privacy restrictions than laws and regulations in the United States and provides for significant fines in the event of violations. These administrative fines are based on a multi-factored approach. Moreover, rules for data transfers outside of the United Kingdom and European Economic Area are subject to increased regulation, and such regulations are frequently subject to further revision and updated regulator guidance, making necessary compliance measures challenging to ascertain and implement with respect to our United Kingdom operations. We expect that there will continue to be new or modified laws, regulations, regulatory guidance and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions, which could impact our operations and cause us to incur substantial costs. We send short message service ("SMS") text messages to patients. We must ensure that our SMS texting practices comply with regulations and agency guidance under the Telephone Consumer Protection Act (the "TCPA"), a federal statute that protects consumers from unwanted telephone calls, faxes and text messages as well as similar state laws and regulations. While we strive to adhere to strict policies and procedures that comply with the TCPA and similar state laws, the Federal Communications Commission, the agency that implements and enforces the TCPA, or other federal or state regulatory authorities or private litigants may disagree with our interpretation of such laws, and may claim that the notices and disclosures we provide, form of consents we obtain or our SMS texting practices are not adequate or violate applicable law, all which may subject us to penalties and other consequences for noncompliance. Determination by a court or regulatory agency that our SMS texting practices violate the TCPA or similar state laws could subject us to civil penalties and could require us to change some portions of our business. Even an unsuccessful challenge by patients or regulatory authorities of our activities could result in adverse publicity and could require a costly response from and defense by us. Moreover, if wireless carriers or their trade associations, which issue guidelines for texting programs, determine that we have violated their guidelines, our ability to engage in texting programs may be curtailed or revoked, which could impact our operations and cause us to incur costs related to implementing alternative solutions. We engage in consumer debt collection for HCA-affiliated hospitals and certain non-affiliated hospitals. We also engage in credit reporting for certain non-affiliated hospitals. The federal Fair Debt Collection Practices Act, the Fair Credit Reporting Act and the TCPA restrict the methods that companies may use to contact and seek payment from consumer debtors regarding past due accounts and to report to consumer reporting agencies on the status of those accounts. Many states impose additional limitations or requirements on debt collection and credit reporting practices, and some of those requirements are more stringent than the federal requirements. We are also subject to various international, federal, state and local statutes and ordinances regulating the discharge of materials into the environment. For example, our health care operations generate medical waste, such as pharmaceuticals, biological materials and disposable medical instruments that must be handled, stored, transported, treated and disposed of in compliance with federal, state and local environmental laws and regulations. Environmental regulations also may apply when we build new facilities or renovate existing facilities. If we are found not to be in compliance with such laws and regulations, we may be liable for significant investigation and clean-up costs or be subject to enforcement actions by governmental authorities or lawsuits by private plaintiffs. Moreover, any changes in the environmental regulatory framework (including legislative or regulatory efforts designed to address changing global weather patterns) could have a material, adverse effect on our business. We are also subject to various federal and state antitrust laws that, for example, restrict exclusive contracting relationships with health care providers, restrict sharing of cost and pricing data, prohibit competitors from taking collective action to set commercial payer reimbursement rates and establish integration requirements for joint ventures to contract with payers. We also operate health care facilities in the United Kingdom and have operations and commercial relationships with companies in other foreign jurisdictions and, as a result, are subject to certain U.S. and foreign laws applicable to businesses generally, including anti-corruption and anti-bribery laws. The Foreign Corrupt Practices Act regulates U.S. companies in their dealings with foreign officials, prohibiting bribes and similar practices, and requires that they maintain records that fairly and accurately reflect transactions and appropriate internal accounting controls. In addition, the United Kingdom Bribery Act has wide jurisdiction over certain activities occurring within the United Kingdom. If we fail to comply with these or other applicable laws and regulations, which are subject to change, we could be subject to liabilities, including civil penalties, money damages, lapses in reimbursement, the loss of our licenses to operate one or more facilities, exclusion of one or more facilities from participation in the Medicare, Medicaid and other federal and state health care programs, civil lawsuits and criminal penalties. In addition, different interpretations or enforcement of, or amendments to, these and other laws and regulations in the future could subject our current or past practices to allegations of impropriety or illegality or could require us to make changes in our facilities, equipment, personnel, services, capital expenditure programs and operating expenses. The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, result in interruptions or delays in the availability of systems and/or result in a patient volume decline. We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations. An adverse outcome under any such investigation or audit, a determination that we have violated these or other laws or a public announcement that we are being investigated for possible violations could result in liability, could result in negative publicity and an adverse impact on our reputation and could adversely affect our business, financial condition, results of operations or prospects.

A significant portion of our patient volume is derived from government health care programs, principally Medicare and Medicaid. Specifically, we derived 45.4% of our revenues from the Medicare and Medicaid programs in 2025. However, federal and state governments have made, and continue to make, significant modifications to the Medicare and Medicaid programs through statutory and regulatory changes, administrative rulings and other interpretations and determinations. These changes may include, for example, reductions to reimbursement levels and to supplemental payment programs, funding restrictions, limitations on scope of coverage or patient eligibility, and changes affecting utilization review. These and other changes may impact the scale and scope of the Medicare and Medicaid programs, may reduce the reimbursement we receive, may affect the cost of providing services to patients and could otherwise adversely affect our business and results of operations. In addition, delays or issues implementing reimbursement-related rules, including periodic payment updates for government programs, and interruptions in the distribution of governmental funds could have an adverse impact on our business. In recent years, legislative and regulatory changes have resulted in limitations on and, in some cases, reductions in levels of payments to health care providers for certain services under the Medicare program. For example, Congress established automatic spending reductions, referred to as sequestration, under the BCA, resulting in a 2% reduction in Medicare payments that extends through the first five months of federal fiscal year 2033. These reductions are in addition to reductions mandated by other laws. It is difficult to predict whether, when or what other deficit or other spending reduction initiatives may be proposed by Congress, but we anticipate that efforts to address the federal budget deficit will continue to place pressures on government health care programs and that future legislation may include additional Medicare spending reductions. From time to time, CMS revises the reimbursement systems used to reimburse health care providers, including changes to the inpatient hospital MS-DRG system and other payment systems, which may result in reduced Medicare payments. For example, under a site neutrality policy, clinic visit services provided by off-campus provider-based departments are generally not covered as outpatient department services under the outpatient PPS, but instead are paid at the Physician Fee Schedule rate, which is generally substantially lower than the outpatient PPS rate. Further, to address past changes to the 340B Drug Pricing Program that were invalidated by the U.S. Supreme Court, CMS finalized payment reductions under the outpatient PPS. Payment rates were reduced for non-drug services in calendar year 2023, and additional reductions to payments for non-drug item and services took effect in calendar year 2026 and will continue for several years, until the past invalidated payments are offset. These payment policies and future changes to payment policies may adversely impact our results of operations, and any potential legal challenges to changes may take years to resolve. Payment policies for different types of providers and for various items and services continue to evolve. Congress and/or CMS may implement further changes to reimbursement for items or services that result in payment reductions for other items or services or that otherwise affect our business and operations. In some cases, private third-party payers rely on all or portions of Medicare payment systems to determine payment rates. Changes to government health care programs that reduce payments under these programs may negatively impact payments from private third-party payers. Legislation and administrative actions at the federal and state levels may also impact the funding for, or structure or administration of, the Medicaid program, including through changes to Medicaid supplemental payments and SDP arrangements. For example, the FBA includes significant health care policy reforms that are expected to result in Medicaid spending reductions and changes in administration of state Medicaid programs. Among other changes, the law makes significant changes to Medicaid financing mechanisms, including restrictions intended to reduce the federal matching funds received by state Medicaid programs, such as limitations on provider tax arrangements and SDP arrangements. The FBA requires HHS to revise regulations governing SDP arrangements to cap total payment rates paid by Medicaid managed care organizations for specified services, tying caps to Medicare payment rates instead of average commercial rates, a change that we anticipate will impact payment rates in many states in which we operate, including Texas. It is difficult to anticipate the ultimate effects of the FBA, as it is a complex law that mandates various changes over time and, in many cases, the details of implementation are not yet clear. Further, CMS administrators may make other changes to Medicaid payment models and may impose new restrictions or grant states additional flexibilities in the administration of state Medicaid programs. For example, structural and other changes to Medicaid supplemental payment programs and SDP arrangements, both of which are subject to CMS approval, could result in our revenues from such payments being reduced or eliminated. Among other measures, states may divert funding for SDP arrangements from other payment programs or direct payments to a specific subset of providers, and we may not satisfy applicable criteria. In addition, several states in which we operate face budgetary challenges that have resulted, and likely will continue to result, in reduced Medicaid funding levels to hospitals and other providers. Because most states must operate with balanced budgets and the Medicaid program is often a state's largest program, some states have enacted or may consider enacting legislation designed to reduce their Medicaid expenditures. Budgetary pressures, which may be heightened during periods of economic weakness, combined with increased spending demands, including as a result of recent federal actions, are creating additional uncertainty and may result in decreased spending, or decreased spending growth, for Medicaid programs in many states. Many states have also adopted, or are considering, legislation or administrative actions designed to reduce coverage, change patient eligibility requirements and/or enroll Medicaid recipients in managed care programs. Current or future health care reform and deficit reduction efforts, changes or delays in laws or regulations regarding government health care programs, other changes in the administration of government health care programs and changes by private third-party payers in response to health care reform and other changes to government health care programs could have a material, adverse effect on our financial position and results of operations.