HCA Healthcare

“Certain states may direct managed care plans to pass through supplemental payments to designated providers, independent of services rendered, to ensure consistent funding of providers that serve large numbers of low-income patients. In an effort to more closely tie funds to delivery and outcomes, CMS is limiting these “pass-through payments” that are paid by states under managed Medicaid plan contracts and will generally prohibit such payments by July 2027.”

Annual report 2025A · The company itself

“States are increasingly using SDP arrangements, and some states have converted supplemental payment programs to SDP arrangements, diverting previously available funding. SDP arrangements can be limited to a specific subset of providers, and providers that do not satisfy applicable criteria may be ineligible for payments. If a state is unable to obtain future CMS approvals of these programs, our revenues could be negatively impacted.”

Annual report 2025A · The company itself

“For example, the FBA directs HHS to revise regulations governing SDP arrangements by tying caps on total payment rates paid by Medicaid managed care organizations for specified services, including hospital services, to Medicare payment rates instead of average commercial rates. Several states in which we operate currently tie caps on total payment rates paid by managed care organizations to average commercial rates. Under the revised regulations, rates will generally be capped at 100% of the total published Medicare payment rate in Medicaid expansion states, including states with waiver-based expansions, and at 110% of the total published Medicare payment rate in non-expansion states.”

Annual report 2025A · The company itself

“Beginning with the rating period on or after January 1, 2028, grandfathered SDP arrangements will be reduced by 10 percentage points annually until they reach the allowable payment limits. Certain states in which we operate have submitted applications to CMS for approval where the grandfathered payments we receive could be impacted and, in some instances, increased. Some states have received preliminary grandfathering determinations with application approvals, but we are unable to predict the timing or extent of any additional approvals by CMS and the resulting recognition of the 14 related revenues.”

Annual report 2025A · The company itself

“In addition, CMS issued a final rule in May 2024 that revised SDP arrangement requirements, including removing regulatory barriers to help states use SDP arrangements to implement value-based purchasing payment arrangements and include non-network providers in SDP arrangements. Further, the rule requires states to ensure each provider receiving an SDP attest by January 1, 2028, that they do not participate in any arrangement that holds taxpayers harmless for the cost of a tax.”

Annual report 2025A · The company itself

“For example, CMS published a final rule in August 2023 that has been the subject of litigation and that will affect the treatment of patient days paid under demonstrations authorized under Section 1115 of the Social Security Act (including through demonstration-authorized uncompensated and undercompensated care pools) in the Medicaid fraction of the DSH payment formula. Implementation of the 2023 final rule is expected to result in lower DSH payments for hospitals.”

Annual report 2025A · The company itself

“Separately, lawsuits filed in April 2025 allege that the Medicare DSH calculation inappropriately reduces hospital reimbursement by counting only fee-for-service Medicare patients who received Supplemental Security Income (“SSI”) cash assistance during the inpatient stay, excluding beneficiaries covered under Medicare Advantage and other Medicare and SSI categories. The plaintiffs argue this policy resembles rulemaking previously vacated by the U.S. Supreme Court.”

Annual report 2025A · The company itself

“Medicare-approved ACOs that achieve quality performance standards while lowering growth in expenditures are eligible to share in a portion of the amounts saved by the Medicare program. Conversely, under some MSSP payment tracks, ACOs may be required to pay shared losses if expenditures exceed an established benchmark. Failure to meet quality performance 15 standards may result in an ACO’s termination from the MSSP.”

Annual report 2025A · The company itself

“Model reviews and new model designs may require that all alternative payment models involve downside risk and that a growing proportion of Medicare and Medicaid beneficiaries are in global downside risk arrangements, among other requirements.”

Annual report 2025A · The company itself

“Several private third-party payers are increasingly employing alternative payment models, which may increasingly shift financial risk to providers.”

Annual report 2025A · The company itself

“Managed care contracts are typically negotiated for terms between one and three years. While we generally have received contracted annual increases to payment rates from managed care payers, there can be no assurance that we will continue to receive increases in the future. Price transparency initiatives may impact our relationships with payers and ability to obtain or maintain favorable contract terms.”

Annual report 2025A · The company itself

“The No Surprises Act requires providers to provide uninsured and self-pay patients, in advance of the scheduled date for the item or service or upon request of the individual, a good faith estimate of the expected charges for furnishing scheduled items or services, including billing and diagnostic codes. HHS is delaying enforcement with regard to good faith estimates to uninsured individuals that do not include expected charges for co-providers or co-facilities until the agency issues additional regulations. If the actual charges to the uninsured or self-pay patient exceed the good faith estimate by an amount deemed to be substantial by regulation (which is currently $400), the patient can invoke a patient-provider dispute resolution process to challenge the higher amount.”

Annual report 2025A · The company itself

“Managed care plans attempt to direct and coordinate members’ use of health care services and obtain discounts from providers’ established gross charges. Similarly, employers and traditional health insurers continue to attempt to contain costs through negotiations with providers for managed care programs and discounts from established gross charges.”

Annual report 2025A · The company itself

“Health plans increasingly utilize narrow networks that restrict the number of participating providers or tiered networks that impose significantly higher cost sharing obligations on patients who obtain services from providers in a disfavored tier.”

Annual report 2025A · The company itself

“In those states that do not require state approval or that set relatively high levels of expenditures before they become reviewable by state authorities, competition in the form of new services, facilities and capital spending is more prevalent.”

Annual report 2025A · The company itself

“Regulation and Other Factors Licensure, Certification and Accreditation Health care facility construction and operation are subject to numerous federal, state and local regulations relating to the adequacy of medical care, equipment, personnel, operating policies and procedures, maintenance of adequate records, fire prevention, rate-setting, building codes and environmental protection. Facilities are subject to periodic inspection by governmental and other authorities to assure continued compliance with the various standards necessary for licensing, certification, and accreditation.”

Annual report 2025A · The company itself

“The requirements for licensure, certification and accreditation are subject to change, and, in order to remain qualified, it may become necessary for us to make changes in our facilities, equipment, personnel and services.”

Annual report 2025A · The company itself

“Certificates of Need In some states where we operate hospitals and other health care providers, the construction or expansion of health care facilities, the transfer or change of ownership of existing facilities, capital expenditures and the addition of new beds or services may be subject to review by and prior approval of, or notifications to, state regulatory agencies under a CON program. Such laws generally require the reviewing state agency to determine the public need for additional or expanded health care facilities and services or other change.”

Annual report 2025A · The company itself

“If a hospital or other provider fails to substantially comply with the numerous conditions of participation in the Medicare and Medicaid programs or performs certain prohibited acts, the provider’s participation in the federal health care programs may be terminated, or civil and/or criminal penalties may be imposed. Civil monetary penalties are adjusted annually based on updates to the consumer price index.”

Annual report 2025A · The company itself

“Anti-kickback Statute A section of the Social Security Act known as the “Anti-kickback Statute” prohibits providers and others from directly or indirectly soliciting, receiving, offering or paying any remuneration with the intent of generating referrals or orders for services or items covered by a federal health care program. Courts have interpreted this statute broadly and held that there is a violation of the Anti-kickback Statute if just one purpose of the remuneration is to generate referrals, even if there are other lawful purposes. Furthermore, knowledge of the law or the intent to violate the law is not required. Violations of the Anti-kickback Statute may be punished by criminal fines per violation, imprisonment, substantial civil monetary penalties per violation that are subject to annual adjustment based on updates to the consumer price index and damages of up to three times the total amount of the remuneration and/or exclusion from participation in federal health care programs, including Medicare and Medicaid.”

Annual report 2025A · The company itself

“While we endeavor to comply with the applicable safe harbors, certain of our current arrangements, including joint ventures and financial relationships with physicians and other referral sources and persons and entities to which we refer patients, do not qualify for safe harbor protection.”

Annual report 2025A · The company itself

“Although we believe our arrangements with physicians and other referral sources and referral recipients have been structured to comply with current law and available interpretations, there can be no assurance regulatory authorities enforcing these laws will determine these financial arrangements comply with the Anti-kickback Statute or other applicable laws. An adverse determination could subject us to liabilities under the Social Security Act and other laws, including criminal penalties, civil monetary penalties and exclusion from participation in Medicare, Medicaid or other federal health care programs.”

Annual report 2025A · The company itself

“The Stark Law prohibits physicians from referring Medicare and Medicaid patients to entities with which they or any of their immediate family members have a financial relationship, if these entities provide certain “designated health services” reimbursable by Medicare or Medicaid unless an exception applies. The Stark Law also prohibits entities that provide designated health services reimbursable by Medicare and Medicaid from billing the Medicare and Medicaid programs for any items or services that result from a prohibited referral and requires the entities to refund amounts received for items or services provided pursuant to the prohibited referral on a timely basis. “Designated health services” include inpatient and outpatient hospital services, clinical laboratory services, radiology and certain other imaging services, radiation therapy services and home health services.”

Annual report 2025A · The company itself

“Unlike safe harbors under the Anti-kickback Statute with which compliance is voluntary, a financial relationship must comply with every requirement of a Stark Law exception or the arrangement is in violation of the Stark Law.”

Annual report 2025A · The company itself

“Violations of the HIPAA privacy and security regulations may result in criminal penalties and in substantial civil penalties per violation. These civil penalties are updated annually based on updates to the consumer price index.”

Annual report 2025A · The company itself

“For example, federal regulations require hospitals to publish a list of their 26 standard charges for all items and services, including gross charges, discounted cash prices and payer-specific and de-identified minimum and maximum negotiated charges, in a machine-readable, publicly accessible online file. The current presidential administration has signaled its commitment to advancing price transparency initiatives, including through an executive order issued in February 2025 and a final rule issued in November 2025 that update the requirements for data elements in the machine-readable file, among other changes. Hospitals are also required to publish a consumer-friendly list of standard charges for certain “shoppable” services (i.e., services that can be scheduled by a patient in advance) and associated ancillary services or, alternatively, maintain an online price estimator tool.”

Annual report 2025A · The company itself

“In addition, the No Surprises Act imposes various requirements on providers and health plans intended to prevent “surprise” medical bills, and several states have implemented similar laws intended to protect consumers. The No Surprises Act prohibits providers from charging patients an amount beyond the in-network cost sharing amount for items and services rendered by out-of-network providers (i.e., prohibits balance billing), subject to limited exceptions.”

Annual report 2025A · The company itself

“Hospitals may face conflicting interpretations by courts and federal and state law enforcement agencies regarding EMTALA’s requirements in relation to state laws that limit access to abortion or other reproductive health services. For example, 25 in May 2025, CMS rescinded EMTALA guidance issued to hospitals under the prior presidential administration regarding the preemption of state laws restricting abortion.”

Annual report 2025A · The company itself

“For example, the FBA includes significant health care policy reforms that are expected to result in Medicaid spending reductions and changes in administration of state Medicaid programs. Among other changes, the law limits eligibility for Medicaid by imposing work or community engagement requirements for adults under age 65 in Medicaid expansion states, including states with waiver-based expansions, subject to limited exceptions. The law also makes significant changes to Medicaid financing mechanisms, including restrictions intended to reduce the federal matching funds received by state Medicaid programs, with greater restrictions in states that have expanded Medicaid.”

Annual report 2025A · The company itself

“Generally, value-based care aims to hold providers accountable for delivering efficient, effective care, tying provider reimbursement to patient outcomes or related measures. Value-based care arrangements vary in the method for determining payments and the level of risk assumed, among other factors.”

Annual report 2025A · The company itself

“The end of the continuous enrollment requirement in 2023, including the resumption of redeterminations for Medicaid enrollees, resulted in significant coverage disruptions and dis-enrollments of Medicaid beneficiaries. Most states have completed the process of unwinding the continuous enrollment provision.”

Annual report 2025A · The company itself

“The FBA is expected to decrease federal Medicaid spending, including as a result of changes to Medicaid eligibility policies and changes to Medicaid financing mechanisms, such as limitations on provider tax arrangements.”

Annual report 2025A · The company itself

“Managed Medicaid Enrollment in managed Medicaid plans has decreased following the end of the Medicaid continuous enrollment policy established under COVID-19 relief legislation, but the plans remain a common strategy as state governments seek to control the cost of Medicaid programs.”

Annual report 2025A · The company itself

“We and the health care industry as a whole face the challenge of continuing to provide quality patient care while dealing with rising costs and strong competition for patients. Changes in medical technology, existing and future legislation, regulations and interpretations and contracting for provider services by third-party payers remain ongoing challenges.”

Annual report 2025A · The company itself

“The health care industry is heavily regulated. Federal agencies oversee, regulate and otherwise affect many aspects of our business, including through Medicare and Medicaid policies, policies affecting the size of the uninsured population, and enforcement and interpretation of fraud and abuse laws.”

Annual report 2025A · The company itself

“These changes may include, for example, reductions to reimbursement levels and to supplemental payment programs, funding restrictions, limitations on scope of coverage or patient eligibility, and changes affecting utilization review. These and other changes may impact the scale and scope of the Medicare and Medicaid programs, may reduce the reimbursement we receive, may affect the cost of providing services to patients and could otherwise adversely affect our business and results of operations.”

Annual report 2025A · The company itself

“For example, Congress established automatic spending reductions, referred to as sequestration, under the BCA, resulting in a 2% reduction in Medicare payments that extends through the first five months of federal fiscal year 2033.”

Annual report 2025A · The company itself

“From time to time, CMS revises the reimbursement systems used to reimburse health care providers, including changes to the inpatient hospital MS-DRG system and other payment systems, which may result in reduced Medicare payments. For example, under a site neutrality policy, clinic visit services provided by off-campus provider-based departments are generally not covered as outpatient department services under the outpatient PPS, but instead are paid at the Physician Fee Schedule rate, which is generally substantially lower than the outpatient PPS rate.”

Annual report 2025A · The company itself

“For example, the FBA includes significant health care policy reforms that are expected to result in Medicaid spending reductions and changes in administration of state Medicaid programs. Among other changes, the law makes significant changes to Medicaid financing mechanisms, including restrictions intended to reduce the federal matching funds received by state Medicaid programs, such as limitations on provider tax arrangements and SDP arrangements. The FBA requires HHS to revise regulations governing SDP arrangements to cap total payment rates paid by Medicaid managed care organizations for specified services, tying caps to Medicare payment rates instead of average commercial rates, a change that we anticipate will impact payment rates in many states in which we operate, including Texas.”

Annual report 2025A · The company itself

“In addition, several states in which we operate face budgetary challenges that have resulted, and likely will continue to result, in reduced Medicaid funding levels to hospitals and other providers. Because most states must operate with balanced budgets and the Medicaid program is often a state’s largest program, some states have enacted or may consider enacting legislation designed to reduce their Medicaid expenditures.”

Annual report 2025A · The company itself

“Medicaid reimbursement is often less than a hospital’s cost of services.”

Annual report 2025A · The company itself

“Our general, acute care hospitals typically provide a full range of services to accommodate such medical specialties as internal medicine, general surgery, cardiology, oncology, neurosurgery, orthopedics and obstetrics, as well as diagnostic and emergency services.”

Annual report 2025A · The company itself

“Outpatient and ancillary health care services are provided by our general, acute care hospitals, ASCs, freestanding emergency care facilities, urgent care facilities, walk-in clinics, physician practices, diagnostic centers, home health agencies, hospices and rehabilitation facilities and various other facilities.”

Annual report 2025A · The company itself

“At December 31, 2025, we owned and operated 179 general, acute care hospitals with 50,436 licensed beds.”

Annual report 2025A · The company itself

“We receive payments for patient services from the federal government under the Medicare program, state governments under their respective Medicaid or similar programs, managed care plans (including plans offered through federal and state-based health insurance marketplaces (“Exchanges”)), private insurers and directly from patients.”

Annual report 2025A · The company itself

“Over the last three years, states in which the majority of our hospitals operate have implemented or enhanced their Medicaid supplemental payment programs and SDP arrangements. Revenues from these programs totaled approximately $6.2 billion, $5.5 billion and $4.4 billion in 2025, 2024 and 2023, respectively.”

Annual report 2025A · The company itself

“EMTALA All of our hospitals in the United States are subject to EMTALA. This federal law requires any hospital participating in the Medicare program to conduct an appropriate medical screening examination of every individual who presents to the hospital’s emergency room for treatment and, if the individual is suffering from an emergency medical condition, to either stabilize the condition or make an appropriate transfer of the individual to a facility able to handle the condition.”

Annual report 2025A · The company itself

“A significant portion of our patient volume is derived from government health care programs, principally Medicare and Medicaid. Specifically, we derived 45.4% of our revenues from the Medicare and Medicaid programs in 2025.”

Annual report 2025A · The company itself

“Risks related to operations, strategy, demand and competition: • Our hospitals and other facilities face competition for patients from other hospitals and health care providers. • Any increase in the volume of uninsured patients or deterioration in the collectability of uninsured and patient due accounts could adversely affect our results of operations. • If our volume of patients with private health insurance coverage declines or we are unable to retain and negotiate favorable contracts with private third-party payers, including managed care plans, our revenues may be adversely affected. • Changes to physician utilization practices and treatment methodologies and other factors outside our control that impact demand for medical services may reduce our revenues. • Third-party payer controls designed to reduce costs and other payer practices intended to decrease inpatient services, surgical procedure volumes or reimbursement for services rendered may reduce our revenues.”

Annual report 2025A · The company itself

“Managed Medicaid Enrollment in managed Medicaid plans has decreased following the end of the Medicaid continuous enrollment policy established under COVID-19 relief legislation, but the plans remain a common strategy as state governments seek to control the cost of Medicaid programs.”

Annual report 2025A · The company itself

“Admissions, average lengths of stay and reimbursement amounts continue to be negatively affected by third-party payer pre-admission authorization requirements, utilization review and pressure to maximize outpatient and alternative health care delivery services for less acutely ill patients.”

Annual report 2025A · The company itself

“Other risks we face during periods of economic weakness and high unemployment include potential declines in the population covered under managed care agreements, increased patient decisions to postpone or cancel elective and nonemergency health care procedures (including delaying surgical procedures), increases in the uninsured and underinsured populations, increased adoption of health plan structures that shift financial responsibility to patients and increased difficulties in collecting patient receivables for copayment and deductible amounts.”

Annual report 2025A · The company itself

“For example, COVID-19 relief legislation temporarily enhanced the premium tax credits available for purchasing coverage through the Exchanges by lowering premiums and raising income eligibility thresholds, but these enhanced premium tax credits expired at the end of 2025. Their expiration is expected to adversely impact Exchange enrollment and increase the uninsured rate.”

Annual report 2025A · The company itself

“Other legislative and executive branch initiatives related to health insurance, such as permitting the sale of insurance plans that lack currently required consumer protections, could increase rates of uninsured and underinsured individuals and destabilize insurance markets. Reductions in the number of insured individuals or the scope of insurance coverage, a decline in patients with private insurance coverage, or an increase in patients covered under governmental health programs or other health plans with lower reimbursement levels may have an adverse effect on our business and results of operations.”

Annual report 2025A · The company itself

“For example, the temporarily enhanced premium tax credits for purchasing coverage through the Exchanges that were established by COVID-19 relief legislation expired at the end of 2025. We expect their expiration will adversely impact Exchange enrollment and increase the uninsured rate.”

Annual report 2025A · The company itself

“If we experience reductions in the volume of patients with private health insurance coverage, our revenues may be reduced.”

Annual report 2025A · The company itself

“We anticipate that several recent developments may adversely affect our revenues by contributing to potential future declines in our volume of patients with private health insurance coverage, including the expiration of enhanced premium tax credits, provisions of the FBA that are expected to impact coverage obtained through the Exchanges, and a final rule issued by CMS in June 2025 focused on affordability, consumer protections and integrity of the Exchanges.”

Annual report 2025A · The company itself

“For the year ended December 31, 2025, approximately 88% of our admissions of uninsured patients occurred through our emergency rooms.”

Annual report 2025A · The company itself

“Risks related to macroeconomic conditions: • Our overall business results may suffer during periods of significant inflation, general economic weakness or recessions or as a result of changing governmental policies.”

Annual report 2025A · The company itself

“Budget deficits at the federal level and within some state and local government entities have had a negative impact on spending for many health and human service programs, including Medicare, Medicaid and similar programs, which represent significant payer sources for our hospitals and other providers. We anticipate that federal and state budget deficits, the growing magnitude of Medicare and Medicaid expenditures and the aging and health status of the U.S. population, among other factors, will continue to place pressure on government health care programs.”

Annual report 2025A · The company itself

“Other risks we face during periods of economic weakness and high unemployment include potential declines in the population covered under managed care agreements, increased patient decisions to postpone or cancel elective and nonemergency health care procedures (including delaying surgical procedures), increases in the uninsured and underinsured populations, increased adoption of health plan structures that shift financial responsibility to patients and increased difficulties in collecting patient receivables for copayment and deductible amounts.”

Annual report 2025A · The company itself

“Our facilities may experience growth in total uncompensated care as a result of a number of factors, including conditions impacting the overall economy and unemployment levels.”

Annual report 2025A · The company itself

“To achieve these objectives, we align our efforts around the following growth agenda: • grow our presence in existing markets; • achieve industry-leading performance in clinical, operational and satisfaction measures; • recruit and retain physicians and other health care professionals to meet the need for high-quality health services; • continue to utilize economies of scale to grow the Company; • pursue a disciplined development strategy; and • advance our digital and artificial intelligence (“AI”) capabilities.”

Annual report 2025A · The company itself

“As EHR technologies have become widespread, the federal government has increased its focus on promoting patient access to health care data and interoperability. The 21st Century Cures Act and its implementing regulations prohibit information blocking by health care providers and certain other entities. Information blocking is defined as engaging in activities likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified by HHS as a reasonable and necessary activity. Under a rule finalized by HHS in July 2024, a hospital found to have engaged in information blocking will not qualify as a “meaningful electronic health record user” under the Medicare Promoting Interoperability Program and as a result will lose 75% of the annual market basket increase it would otherwise receive, and MIPS-eligible clinicians, ACOs and ACO participants face similar disincentives.”

Annual report 2025A · The company itself

“Failure to effectively manage change associated with our technology, resiliency and other initiatives, including with respect to the implementation of a new EHR platform, may adversely affect our business, services and results of operations.”

Annual report 2025A · The company itself

“We are implementing a new EHR platform across our facilities, which is complex and time-intensive. Significant internal and external resources have been, and will continue to be, required for successful implementation, including resources to train colleagues. Complexity or delay in implementation may require substantial additional time and expense and divert management’s attention from other strategic priorities, which, in turn, could adversely affect our business, results of operations or financial condition.”

Annual report 2025A · The company itself

“As part of these efforts, we are implementing a new EHR platform across our facilities that is designed to help improve care coordination, enhance data integrity and interoperability, and drive operating efficiencies and cost savings.”

Annual report 2025A · The company itself

“Health care technology initiatives, particularly those related to sharing patient data and interoperability and AI, involve risks that may adversely affect our operations. • Failure to effectively manage change associated with our technology, resiliency and other initiatives, including with respect to the implementation of a new electronic health record (“EHR”) platform, may adversely affect our business, services and results of operations.”

Annual report 2025A · The company itself

“Increasing use of AI technologies in our internal systems may create new attack surfaces or methods for threat actors, and threat actors may use AI technologies to make cyberattacks more difficult to detect, contain or mitigate.”

Annual report 2025A · The company itself

“Rapid changes in technology driven by AI may require us to expend significant resources to acquire, develop, implement and maintain that technology. Failure to integrate these technologies in a timely, cost-efficient and resource-efficient manner may impede our ability to deliver health care services in a competitive manner.”

Annual report 2025A · The company itself

“There is also a risk that our confidential information becomes part of a model that is accessible by other third-party AI applications or users as a result of a cybersecurity incident or a third-party AI developer’s violation of our vendor engagement terms.”

Annual report 2025A · The company itself

“For instance, AI models used by us or third-party vendors may be based on biased, inaccurate or deficient datasets, which could result in inaccurate or misleading outputs. Ineffective or inadequate AI development or deployment practices by us or third-party developers or vendors, including any disruptions, errors or failures of AI systems once implemented, could result in unintended consequences.”

Annual report 2025A · The company itself

“Our strategy also emphasizes investments that seek to advance our clinical systems and digital capabilities, transform care models with innovative care solutions, expand our workforce development programs and enhance our health care networks and partnerships.”

Annual report 2025A · The company itself

“In particular, AI is driving innovation and, in some cases, augmenting risks related to health care technology. For example, our physicians are adopting the use of generative AI to assist with the taking of patient medical notes, among other tasks. We may also use AI in health care-related administrative tasks, including in the collection of patient accounts receivable.”

Annual report 2025A · The company itself

“Our hospitals face competitors that are implementing physician alignment strategies, such as employing physicians, acquiring physician practice groups and participating in ACOs or other clinical integration models.”

Annual report 2025A · The company itself

“For example, some of our competitors may negotiate exclusivity provisions with managed care plans or otherwise restrict the ability of managed care companies to contract with us. Price transparency initiatives and increasing vertical integration efforts involving third-party payers and health care providers, among other factors, may increase these challenges.”

Annual report 2025A · The company itself

“Moreover, the trend toward consolidation among private third-party payers tends to increase payer bargaining power over fee structures, and private third-party payers may increasingly demand reduced fees or be unwilling to negotiate reimbursement increases.”

Annual report 2025A · The company itself

“A component of our business strategy is acquiring hospitals and other health care businesses.”

Annual report 2025A · The company itself

“Health care technology initiatives, particularly those related to sharing patient data and interoperability and AI, involve risks that may adversely affect our operations. • Failure to effectively manage change associated with our technology, resiliency and other initiatives, including with respect to the implementation of a new electronic health record (“EHR”) platform, may adversely affect our business, services and results of operations.”

Annual report 2025A · The company itself

“Trends toward clinical and pricing transparency may impact our competitive position, ability to obtain or maintain favorable contract terms and patient volumes in ways that may be difficult to predict. For example, hospitals are required to publish a list of their standard charges for all items and services, including gross charges, discounted cash prices and payer-specific and de-identified minimum and maximum negotiated charges, in a machine-readable, publicly accessible online file. In addition, CMS websites make available to the public data submitted by hospitals, home health agencies, hospices, and other Medicare-certified providers in connection with Medicare reimbursement claims, including performance data on quality measures and patient satisfaction.”

Annual report 2025A · The company itself

“Our strategy also emphasizes investments that seek to advance our clinical systems and digital capabilities, transform care models with innovative care solutions, expand our workforce development programs and enhance our health care networks and partnerships.”

Annual report 2025A · The company itself

“Most of our hospitals offer discounts from established charges to certain large group purchasers of health care services, including managed care plans and private health insurers. Admissions reimbursed by commercial managed care and other insurers were 32%, 32% and 30% of our total admissions for the years ended December 31, 2025, 2024 and 2023, respectively.”

Annual report 2025A · The company itself

“To achieve these objectives, we align our efforts around the following growth agenda: • grow our presence in existing markets; • achieve industry-leading performance in clinical, operational and satisfaction measures; • recruit and retain physicians and other health care professionals to meet the need for high-quality health services; • continue to utilize economies of scale to grow the Company; • pursue a disciplined development strategy; and • advance our digital and artificial intelligence (“AI”) capabilities.”

Annual report 2025A · The company itself

“Risks related to human capital: • Our results of operations may be adversely affected by competition for staffing, the shortage of experienced nurses and other health care professionals and labor union activity. • Our performance depends on our ability to recruit and retain quality physicians. • We may be unable to attract, hire and retain a highly qualified workforce, including key management.”

Annual report 2025A · The company itself

“The impact of labor shortages across the health care industry may result in other health care facilities, such as nursing homes, limiting admissions, which may constrain our ability to discharge patients to such facilities, increase labor costs and further exacerbate the demand on our resources, supplies and staffing.”

Annual report 2025A · The company itself

“If there is additional union organizing activity or a significant portion of our employee base unionizes, it is possible our labor costs could increase. When negotiating collective bargaining agreements with unions, whether such agreements are renewals or first contracts, we have experienced, and could experience in the future, labor strikes. Our continued operation during any strikes could result in an increase to our labor costs.”

Annual report 2025A · The company itself

“We anticipate facing increased challenges with recruitment and retention as a significant portion of the current physician population reaches retirement age, especially if there is a shortage of physicians willing and able to provide comparable services. Moreover, changes in immigration policies could reduce the availability of international physicians.”

Annual report 2025A · The company itself

“The talents and efforts of our employees, particularly our key management, are vital to our success. The members of our management team have significant industry experience, and if any member of our management team leaves the Company unexpectedly, such member would be difficult to replace.”

Annual report 2025A · The company itself

“Two of the most significant factors that impact the competitive position of a hospital are the number and quality of physicians affiliated with or employed by the hospital. Although physicians may at any time terminate their relationship with a hospital we operate, our hospitals seek to retain physicians with varied specialties on the hospitals’ medical staffs and to attract other qualified physicians.”

Annual report 2025A · The company itself

“Many hospitals and health care systems across the nation, including our own, have experienced challenges related to labor costs and turnover. Nurse and medical support personnel availability and retention can present significant operational issues for our hospitals and other facilities, including capacity and growth constraints, reduced patient satisfaction, reduced physician satisfaction, impacts on services offered and increased costs.”

Annual report 2025A · The company itself

“We continue to experience increasing competition to recruit and retain quality physicians, as well as increasing contracting costs with hospital-based physicians.”

Annual report 2025A · The company itself

“We compete with other health care providers in recruiting and retaining qualified management and personnel responsible for the daily operations of each of our hospitals and other facilities, including nurses and other nonphysician health care professionals. We depend on the available labor pool of employees in each of the markets in which we operate to fill other necessary positions. In some markets, the availability of nonphysician health care professionals and medical support personnel has been a significant operating issue to health care providers, including at certain of our facilities.”

Annual report 2025A · The company itself

“We may be required to increase wages and benefits to recruit and retain nurses and other medical support personnel and to hire more expensive temporary or contract personnel.”

Annual report 2025A · The company itself

“We continue to face increasing competition to recruit and retain quality physicians, as well as increasing costs to contract with hospital-based physicians. Such physicians may terminate their affiliation with our hospitals at any time.”

Annual report 2025A · The company itself

“Risks related to technology, data privacy and cybersecurity: Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems, causing our operations to be impaired or impacted. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under privacy and security laws, consumer protection laws, common law theories or other laws. Such incidents could subject us to litigation and foreign, federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business.”

Annual report 2025A · The company itself

“We, directly and through our vendors and other third parties, collect and store on networks, devices and technology platforms sensitive information, including intellectual property, proprietary business information, protected health information of our patients and personally identifiable information of our employees, patients and consumers. Our facilities use EHR and other information systems and medical devices that store or transmit information that are integral to the provision of patient care, and these systems and devices are increasingly connected to the internet, hospital networks and other medical devices. The secure maintenance of this information and technology is critical to our business operations.”

Annual report 2025A · The company itself

“We rely on a substantial number of employees, contractors, personnel, hardware, software, applications, and third-party vendors, platforms and technologies, each of which may represent an attack surface for threat actors. Threats from malicious actors, including nation-state actors and ransomware groups, new vulnerabilities and advanced new attacks against our, or our vendors’, information systems and devices create risk of cybersecurity incidents, including ransomware, malware and phishing incidents, in which third parties attempt to fraudulently induce our employees or our vendors’ employees into disclosing usernames, passwords or other sensitive information, which can in turn be used for unauthorized access to our or our vendors’ systems.”

Annual report 2025A · The company itself

“We expect that we, our vendors and other third parties will continue to experience an increase in cybersecurity threats in the future, both directly and indirectly through threats targeting third parties, as the volume and intensity of cyberattacks on hospitals, health systems and other health care entities continue to increase.”

Annual report 2025A · The company itself

“Increasing use of AI technologies in our internal systems may create new attack surfaces or methods for threat actors, and threat actors may use AI technologies to make cyberattacks more difficult to detect, contain or mitigate.”

Annual report 2025A · The company itself

“However, as cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents, and such measures may decrease the efficiency of our operations. We may also be required to expend additional resources to comply with evolving federal, state and industry requirements related to cybersecurity and information security, including those focused on health care providers.”

Annual report 2025A · The company itself

“There is also a risk that our confidential information becomes part of a model that is accessible by other third-party AI applications or users as a result of a cybersecurity incident or a third-party AI developer’s violation of our vendor engagement terms.”

Annual report 2025A · The company itself

“Risks related to macroeconomic conditions: • Our overall business results may suffer during periods of significant inflation, general economic weakness or recessions or as a result of changing governmental policies.”

Annual report 2025A · The company itself

“A decrease in payment rates or an increase in rates that is below the increase in our costs may adversely affect our results of operations.”

Annual report 2025A · The company itself

“Economic conditions, including macroeconomic uncertainties and inflationary pressure, workforce burnout, and public health conditions and other factors, have exacerbated workforce competition, personnel shortages and capacity constraints.”

Annual report 2025A · The company itself

“Our business is impacted by economic conditions in the United States, including periods of significant inflation, higher interest rates or economic weakness or recessions.”

Annual report 2025A · The company itself

“We may encounter difficulty acquiring hospitals and other health care businesses, encounter challenges integrating the operations of acquired hospitals and other health care businesses and/or become liable for unknown or contingent liabilities as a result of acquisitions. • Our facilities are heavily concentrated in Florida and Texas, which makes us sensitive to regulatory, economic, public health, environmental and competitive conditions and changes in those states. • Our business and operations are subject to risks related to hurricanes, extreme weather events or other natural disasters. • The industry trend toward value-based purchasing may negatively impact our revenues.”

Annual report 2025A · The company itself

“Our hospitals and other facilities, including those in Florida, Texas and other coastal states, are located in regions that have been, and may in the future be, impacted by hurricanes, extreme weather events or other natural disasters, the intensity or frequency of which could be affected by changing global weather patterns. These events could result in, for example, temporary declines in the number of patients seeking our services, closures of our hospitals and related facilities, supply chain disruptions, increased costs of products, commodities and energy (including utilities) and disruptions in our information systems, which in turn could negatively impact our business and results of operations.”

Annual report 2025A · The company itself

“Budget deficits at the federal level and within some state and local government entities have had a negative impact on spending for many health and human service programs, including Medicare, Medicaid and similar programs, which represent significant payer sources for our hospitals and other providers. We anticipate that federal and state budget deficits, the growing magnitude of Medicare and Medicaid expenditures and the aging and health status of the U.S. population, among other factors, will continue to place pressure on government health care programs.”

Annual report 2025A · The company itself

“For example, as further discussed in Item 1, “Business – Sources of Revenue – Medicaid,” the FBA includes significant health care policy reforms that are expected to result in Medicaid spending reductions and changes in administration of state Medicaid programs. Among other changes, the law limits eligibility for Medicaid, including by imposing work or community engagement requirements for adults in Medicaid expansion states, and limits some Medicaid financing mechanisms, including through restrictions intended to reduce the federal matching funds received 28 by state Medicaid programs. Reductions in federal matching funds and increased state obligations and administrative burden could have significant effects, such as resulting in state limitations on eligibility or coverage or changes to Medicaid expansion programs, particularly if states are unable to offset reductions.”

Annual report 2025A · The company itself

“Risks related to technology, data privacy and cybersecurity: • Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems, causing our operations to be impaired or impacted. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under privacy and security laws, consumer protection laws, common law theories or other laws.”

Annual report 2025A · The company itself

“Our business is impacted by economic conditions in the United States, including periods of significant inflation, higher interest rates or economic weakness or recessions.”

Annual report 2025A · The company itself

“Economic conditions, including macroeconomic uncertainties and inflationary pressure, workforce burnout, and public health conditions and other factors, have exacerbated workforce competition, personnel shortages and capacity constraints.”

Annual report 2025A · The company itself

“Our facilities may experience growth in total uncompensated care as a result of a number of factors, including conditions impacting the overall economy and unemployment levels.”

Annual report 2025A · The company itself

“If we experience reductions in the volume of patients with private health insurance coverage, our revenues may be reduced.”

Annual report 2025A · The company itself

“Risks related to public health crises: • The emergence and effects related to a potential future pandemic, epidemic or outbreak of an infectious disease could adversely affect our business and operations.”

Annual report 2025A · The company itself

“Medicare In addition to the reimbursement reductions and adjustments discussed below, the Budget Control Act of 2011 (the “BCA”) requires automatic spending reductions to reduce the federal deficit, resulting in a uniform percentage reduction across all Medicare programs of 2% per fiscal year that extends through the first five months of federal fiscal year 2033. We anticipate that the federal deficit will continue to place pressure on government health care programs, and it is possible that future legislation will impose additional spending reductions.”

Annual report 2025A · The company itself

“Additionally, imposed or threatened tariffs have raised, and may continue to raise, the cost of certain medical supplies and products we source from outside the United States.”

Annual report 2025A · The company itself

“We may encounter difficulty acquiring hospitals and other health care businesses, encounter challenges integrating the operations of acquired hospitals and other health care businesses and/or become liable for unknown or contingent liabilities as a result of acquisitions. • Our facilities are heavily concentrated in Florida and Texas, which makes us sensitive to regulatory, economic, public health, environmental and competitive conditions and changes in those states. • Our business and operations are subject to risks related to hurricanes, extreme weather events or other natural disasters. • The industry trend toward value-based purchasing may negatively impact our revenues.”

Annual report 2025A · The company itself

“The majority of states adopted Medicaid expansion; however, a number of states, including Texas and Florida, have opted out of the expansion.”

Annual report 2025A · The company itself

“Our facilities are heavily concentrated in Florida and Texas, which makes us sensitive to regulatory, economic, public health, environmental and competitive conditions and changes in those states. We operated 190 hospitals at December 31, 2025, and 102 of those hospitals are located in Florida and Texas. Our Florida and Texas facilities’ combined revenues represented 51% of our consolidated revenues for the year ended 49 December 31, 2025.”

Annual report 2025A · The company itself

“We may encounter difficulty acquiring hospitals and other health care businesses, encounter challenges integrating the operations of acquired hospitals and other health care businesses and/or become liable for unknown or contingent liabilities as a result of acquisitions. • Our facilities are heavily concentrated in Florida and Texas, which makes us sensitive to regulatory, economic, public health, environmental and competitive conditions and changes in those states. • Our business and operations are subject to risks related to hurricanes, extreme weather events or other natural disasters. • The industry trend toward value-based purchasing may negatively impact our revenues.”

Annual report 2025A · The company itself