Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 1102

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 1102
---
 and regulatory matters is included in Note 21 to the Consolidated Financial Statements included in this Form 10-K. The outcome of litigation and other legal or regulatory matters is always uncertain.

If we fail to comply with applicable privacy, security and data laws, regulations and standards, our business and reputation could be materially adversely affected.

Most of our activities involve the receipt, use, storage or transmission of a substantial amount of individuals' PII, including PHI. We also use aggregated and/or anonymized data for research and analysis purposes and, in some cases, provide access to such anonymized data, or analytics created from such data, to pharmaceutical manufacturers and third-party data aggregators and analysts. We may also use such information to create analytic models designed to predict, and potentially improve, outcomes and patient care. The collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of PII are regulated at the federal, state, international and industry levels, and requirements are imposed on us by contracts with clients. In some cases, such laws, rules, regulations and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements. We are also subject to various other consumer protection laws that regulate our communications with customers, such as the FTC Act and the Telephone Consumer Protection Act. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard ("PCI DSS"), which is designed to protect credit card account data as mandated by payment card industry entities. International laws, rules and regulations governing the use and disclosure of such information, such as the GDPR, can be more stringent than similar laws in the United States, 

30

and they vary across jurisdictions. In addition, more jurisdictions are regulating the transfer of data across borders, and domestic privacy and data protection laws are generally becoming more onerous.

These laws, rules and contractual requirements are subject to change and the regulatory environment surrounding data security and privacy is increasingly demanding. Compliance with existing or new privacy, security and data laws, regulations and requirements may result in increased operating costs and may constrain or require us to alter our business model or operations. For more information on privacy regulations to which we are subject, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.

HIPAA requires covered entities and business associates to comply with the HIPAA privacy, security and breach rules. While we endeavor to provide appropriate protections through our contracts with our