Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 1069

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 1069
---
 as contracting carriers in the Federal Employees Health Benefits Program administered by the OPM, which includes various pharmacy benefit management standards.

Employee Retirement Income Security Act

Our domestic subsidiaries sell most of their products and services to sponsors of employee benefit plans that are governed by the Employee Retirement Income Security Act ("ERISA"). ERISA is a complex set of federal laws and regulations enforced by the IRS and the DOL, as well as the courts. ERISA regulates certain aspects of the relationship between us, the employers that maintain employee welfare benefit plans subject to ERISA and the participants in such plans. Certain of our domestic subsidiaries are also subject to requirements imposed by ERISA affecting claim payment and appeals procedures for individual health insurance and insured and self-insured group health plans and for the insured plans we administer. 

Privacy, Security and Data Standards Regulations

On the federal level, we are subject to a number of sector-specific regulations related to the creation, collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, processing and disposal of protected health information ("PHI") and other personally identifiable information ("PII"). The federal Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations that implement such laws (collectively, "HIPAA") impose requirements on covered entities and business associates (and we are both) that address the privacy and security of PHI, regulate permissible uses and disclosures of PHI, and impose breach notification requirements. Violations of HIPAA may result in enforcement actions, civil and criminal penalties and settlement, resolution and monitoring agreements. State attorneys general may also bring civil actions seeking injunctions or damages in response to violations of HIPAA that threaten the privacy of state residents. We may also be held liable under HIPAA for violations by our vendors. There can be no assurance that we will not be the subject of an investigation, 

14

audit or compliance review regarding our compliance with HIPAA. HIPAA does not preempt more stringent state health privacy laws and regulations, which may protect the health information of certain individuals, such as minors, and certain types of sensitive health information, such as transgender care, HIV/AIDS status, reproductive health information, genetic information, and mental and behavioral health.

Other U.S. federal and state consumer privacy laws typically exempt data and/or entities subject to HIPAA, but several states, such as Washington, Nevada and Connecticut, have recently enacted privacy laws to protect consumer health data and require consent for the collection, use and sharing of consumer health data