Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 1103

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 1103
---
 third-party service providers and in certain cases assess their security controls, we have limited oversight or control over their actions and practices. Several of our businesses act as business associates to their covered entity clients and, as a result, collect, receive, use, disclose, transmit and maintain PHI in order to provide services to these customers. HHS administers an audit program to assess HIPAA compliance efforts by covered entities and business associates. In addition, HHS continues to exercise its enforcement authority to bring enforcement actions resulting from complaints, compliance reviews, audits and investigations brought on by notification to HHS of a breach or other HIPAA violation. An audit resulting in findings or allegations of noncompliance or the implementation of an enforcement action could have an adverse effect on our results of operations, financial position, cash flows and reputation. For example, in December 2024, we received a request for a voluntary audit from HHS's Office for Civil Rights ("OCR") to review our compliance with HIPAA security rules. We are in the process of preparing our initial response to OCR's request. As participation in this audit is voluntary, the information provided will not result in any HIPAA enforcement action or civil monetary penalty; however, any serious compliance issues could open up subsequent compliance reviews that could include a range of remedies from OCR.

Noncompliance or findings of noncompliance with applicable laws, regulations or requirements, or the occurrence of any privacy or security breach involving the misappropriation, loss or other unauthorized disclosure of PII, whether by us or by one of our third-party service providers, could materially adversely affect our business and reputation, including our results of operations, financial position and cash flows.

Effective prevention, detection and control systems are critical to maintain regulatory compliance and prevent fraud; failure of these systems could adversely affect us.

Federal and state governments have made investigating and prosecuting health care and other insurance fraud and abuse a priority. Fraud and abuse prohibitions encompass a wide range of activities including kickbacks for referral of customers, billing for unnecessary medical services, improper marketing and violations of patient privacy rights. Some of our businesses are also subject to federal and state laws and regulations that may impact our relationships with health care providers and customers, including laws on self-referrals, beneficiary inducements, false claims, fee-splitting, telemedicine, corporate practice of medicine, dispensing, packaging, fulfillment and distribution of controlled substances, other pharmaceutical products and medical devices, medical malpractice, consumer protection, product liability, narrow networks, provider tiering programs, provider contracts, over