Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 24

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 24
---
 imposed on us by contracts with clients. In some cases, such laws, rules, regulations and contractual requirements also apply to our vendors and require us to obtain written assurances of their compliance with such requirements. We are also subject to various other consumer protection laws that regulate our communications with customers, such as the FTC Act and the Telephone Consumer Protection Act. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard ("PCI DSS"), which is designed to protect credit card account data as mandated by payment card industry entities. International laws, rules and regulations governing the use and disclosure of such information, such as the GDPR, can be more stringent than similar laws in the United States, 

30

and they vary across jurisdictions. In addition, more jurisdictions are regulating the transfer of data across borders, and domestic privacy and data protection laws are generally becoming more onerous.

These laws, rules and contractual requirements are subject to change and the regulatory environment surrounding data security and privacy is increasingly demanding. Compliance with existing or new privacy, security and data laws, regulations and requirements may result in increased operating costs and may constrain or require us to alter our business model or operations. For more information on privacy regulations to which we are subject, see "Business – Regulation" in Part I, Item 1 of this Form 10-K.

HIPAA requires covered entities and business associates to comply with the HIPAA privacy, security and breach rules. While we endeavor to provide appropriate protections through our contracts with our third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity clients and, as a result, collect, receive, use, disclose, transmit and maintain PHI in order to provide services to these customers. HHS administers an audit program to assess HIPAA compliance efforts by covered entities and business associates. In addition, HHS continues to exercise its enforcement authority to bring enforcement actions resulting from complaints, compliance reviews, audits and investigations brought on by notification to HHS of a breach or other HIPAA violation. An audit resulting in findings or allegations of noncompliance or the implementation of an enforcement action could have an adverse effect on our results of operations, financial position, cash flows and reputation. For example, in December 2024, we received a request for a voluntary audit from HHS's Office for Civil Rights ("OCR") to review our compliance with HIPAA security rules. We are in the process of preparing our initial response to