Company: ELV
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001156039-25-000010
Chunk: 38

Company: Elevance Health, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 38
---
 or third parties we rely on could result in an unauthorized disclosure of sensitive or confidential information, cause a loss of data, disrupt our operations, give rise to remediation or other expenses, expose us to liability under our contracts, federal, state and international laws, and subject us to litigation and investigations, which could have an adverse effect on our business, reputation, cash flows, financial condition and results of operations.

As part of our normal operations, we collect, store, process, retain and analyze certain sensitive and confidential information, including personal information subject to privacy, security and data breach notification requirements. Some of the data we process, store and transmit is outside of the U.S. due to the structure of our information technology systems and our internal business operations. We are subject to a variety of continuously evolving federal, state and international laws and rules regarding collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of sensitive or confidential information that, depending on the specific business and intended data use, include without limitation, HIPAA's privacy and security rules, HIPAA's HITECH rule, the Gramm-Leach-Bliley Act, the General Data Protection Regulation and numerous state laws governing personal information, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Regulators are also imposing new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, and continue to propose, data privacy legislation and/or regulations related to Artificial Intelligence (“AI”). We have programs in place to detect, contain and respond to data, privacy and security incidents and provide employee awareness training regarding phishing, malware, and other risks to protect against privacy and cybersecurity incidents. Our facilities and systems, and those of our third-party service providers, including our business associates, are regularly the target of, and may be vulnerable to, cyber-attacks, security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, negligent or wrongful conduct by associates or others with permitted access to our systems and information, or other threats or catastrophic events. Additionally, there have been, and may in the future be, heightened vulnerabilities due to our remote or varied geographical workforce operations.

We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their information technology systems or business. Hardware,