Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 824

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 824
---
. These laws apply to data that is collected outside the scope of HIPAA. In addition, the California Consumer Privacy Act, as amended by the California Privacy Act ("CCPA"), became effective on January 1, 2020, and applies to data that is collected outside the scope of HIPAA (e.g., employee and business contact information). The CCPA increased the privacy protections afforded to California residents with respect to PII that falls outside the scope of HIPAA, including by providing such residents certain rights with respect to their PII and limiting how we may collect and process such residents' PII. All 50 U.S. states have laws requiring companies to notify individuals and state regulatory authorities in the event of certain data breaches. These laws and others may impact our businesses and practices.

The federal government has also enacted final regulations on interoperability and information blocking to support the seamless and secure access, exchange and use of electronic health information by and between patients, enrollees and entities, such as payors and health care providers. The regulations impact how industry participants, including us, comply with disclosure requirements and share information with individuals and other health care organizations.

The federal Gramm-Leach-Bliley Act and its implementing regulations generally place restrictions on the disclosure of nonpublic information to nonaffiliated third parties and requires financial institutions, including insurers, to provide customers with notice regarding how their nonpublic personal information is used, including an opportunity to "opt out" of certain disclosures. State departments of insurance and certain federal agencies adopted implementing regulations as required by federal law. 

Additionally, under Section 5 of the Federal Trade Commission Act ("FTC Act"), the FTC has jurisdiction over certain privacy and security practices deemed unfair and deceptive acts and practices in or affecting commerce, which includes unfair and deceptive practices with respect to consumer privacy rights and safeguarding of PHI and PII. In addition to the FTC Act, the FTC also enforces other federal laws relating to consumers' privacy and security. The FTC has also been active with respect to companies' use of big data and AI, specifically ensuring fair and equitable use of these tools, and the FTC has named AI as an area of enforcement focus. U.S. state legislatures and regulators are similarly interested in the use of AI, particularly as it is used in modeling, and a handful of states have either passed legislation or issued regulatory guidance concerning AI. Additionally, the National Association of Insurance Commissioners ("NAIC"), an organization of state insurance regulators, recently established the Innovation, Cybersecurity and Technology Committee to provide