UNITEDHEALTH GROUP INCORPORATED (Delaware)

Technology infrastructure · Disaster recovery and business continuity

We have business continuity and resiliency plans which we maintain, update and test regularly in an effort to contain and remediate potential disruptions from cybersecurity events. If our prevention and remediation efforts are not successful, we may experience operational interruptions, delays, or cessation of service and loss of existing or potential customers.

Cybersecurity and data protection · Third party data security and vendors

We rely in some circumstances on third-party vendors to process, store and transmit large amounts of data for our business. The operations of these vendors are subject to similar risks, but are outside our direct oversight and control. For example, we previously reported that our Change Healthcare business, which we had recently acquired, was subject to a cyberattack in 2024, in which the data involved contained protected health information or personally identifiable information.

Digital transformation and innovation · Technology implementation and upgrades

We may not successfully implement our initiatives to consolidate the number of information systems we operate, upgrade and expand our systems' capabilities, integrate and enhance our systems and develop new systems to keep pace with recent regulations and changes in information processing technology. Failure to protect, consolidate and integrate our systems successfully could result in higher than expected costs.

Cybersecurity and data protection · Data privacy and protection regulations

If we fail to comply with applicable privacy, security, technology and data laws, regulations and standards, including with respect to third-party service providers utilizing protected personal information on our behalf, our business, reputation, results of operations, financial position and cash flows could be materially and adversely affected. The collection, maintenance, protection, use, transmission, disclosure and disposal of protected personal information are regulated at the federal, state, international and industry levels.

Digital transformation and innovation · Artificial intelligence and automation

We anticipate that fast-evolving AI technologies, including generative AI, will play an increasingly important role in our information systems and customer-facing technology products. Our ability to protect and enhance existing systems and develop new systems to keep pace with changes in information processing technology (including AI), regulatory standards and changing customer preferences will require our ongoing commitment of significant development and operational resources.

Tax and financial reporting · Tax compliance and changes in tax law

Additionally, changes in tax laws or unfavorable resolutions of exams could create additional tax liabilities. The laws and regulations governing our businesses and interpretations of those laws and regulations are subject to frequent and often unpredictable change.

Data and privacy · Data protection and privacy laws

Uncertain and rapidly evolving U.S. federal and state, non-U.S. and international laws and regulations related to health data and health information technologies, including those powered by or incorporating AI, may alter the competitive landscape or impose new compliance requirements and could materially and adversely affect the configuration of our information systems and platforms, and our ability to compete in our markets.

Data and privacy · Cross border data transfer regulations

Internationally, many of the jurisdictions in which we operate have established their own data security and privacy legal framework with which we or our customers must comply. We expect there will continue to be new proposed laws, regulations and industry standards concerning privacy, data protection, information security, and AI/ML and automation in the European Union, UK, Chile, India and other jurisdictions.

Industry regulation · Capital and liquidity requirements

As a result of our participation in various government health care programs, both as a payer and as a service provider to payers, we are exposed to additional risks associated with program funding, enrollments, payment adjustments, audits and government investigations which could materially and adversely affect our business, results of operations, financial position and cash flows.

Industry regulation · Licensing and permits

Our insurance and HMO subsidiaries must be licensed by and are subject to regulation in the jurisdictions in which they conduct business. For example, states require periodic financial reports and enforce minimum capital or restricted cash reserve requirements.

Data and privacy · Regulatory investigations and penalties

If HHS alleges or finds noncompliance by us with HIPAA privacy or security requirements, the allegations or findings could damage our reputation and subject us to monetary and other sanctions. Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of protected personal information could result in significant fines, penalties and litigation awards.

Legal and litigation · Litigation and legal proceedings

We are routinely subject to private party and governmental legal actions and investigations, which could damage our reputation and, if resolved unfavorably, could result in substantial penalties or monetary damages and materially and adversely affect our results of operations, financial position and cash flows. We are routinely made party to a variety of private party and governmental legal actions and investigations related to, among other matters, the design, management and delivery of our product and service offerings.

Strategic execution · Merger acquisition and divestiture risks

Our business could suffer, and our results of operations, financial position and cash flows could be materially and adversely affected, if we fail to successfully manage our strategic alliances, or to complete, manage or integrate acquisitions and other significant strategic transactions or relationships. Successful acquisitions also require us to effectively, comprehensively and expeditiously integrate the acquired business into our existing operations.

Market position and competition · Disruptive competitors and new market entrants

Our success in the health care marketplace and future growth depends on our ability to develop and deliver innovative and potentially disruptive products and services to satisfy evolving market demands. If we do not continue to innovate and provide products and services which are useful and relevant to health care payers, consumers and our customers, we may not remain competitive and risk losing market share to existing competitors and disruptive new market entrants.

Capital structure and performance · Credit rating and cost of capital

Any downgrades in our credit ratings could increase our borrowing and operating costs. Claims paying ability, financial strength and debt ratings by nationally recognized statistical rating organizations are important factors in establishing the competitive position of insurance companies. Our credit ratings impact both the cost and availability of future borrowings.

Market and investment · Asset valuation and impairment

If the value of our intangible assets is materially impaired, our results of operations, equity and credit ratings could be materially and adversely affected. As of December 31, 2025, our goodwill and other intangible assets had a carrying value of $131 billion, representing 42% of our total consolidated assets.

Market and investment · Investment portfolio performance

Our investment and loan portfolio may sustain losses which could adversely affect our profitability. Market fluctuations could impair the value of our investment and loan portfolio and our profitability. Volatility in interest rates affects our interest income and the market value of our investments in debt securities of varying maturities.

International and currency · International operations and emerging markets

We also currently operate outside of the United States and in the future may acquire or commence additional businesses based outside of the United States, increasing our exposure to non-U.S. regulatory regimes. Our failure to comply with U.S. or non-U.S. laws and regulations governing our conduct outside the United States or to establish constructive relationships with non-U.S. regulators could adversely affect our ability to market our products and services.

Geopolitical and trade · Regulatory and policy uncertainty

The laws and regulations governing our businesses and interpretations of those laws and regulations are subject to frequent and often unpredictable change. For example, legislative, administrative and public policy changes to the ACA have been and likely will continue to be considered, and we cannot predict if the ACA will be further modified or to what extent such modifications may impact our businesses or member enrollment.

Natural and catastrophic events · Climate change and environmental impact

These factors may include medical cost inflation, increased use of services, increased provider billing intensity, business mix, unexpected differences among new customer populations, increased cost of individual services, costs to deliver care, large-scale medical emergencies, the potential effects of climate change, pandemics, the introduction of new or costly drugs or increases in drug prices.