Item 1A. Risk Factors

The IT systems that we rely on may be subject to unauthorized tampering, cyberattack or other security breach

Our IT systems have been and are subject to potential cyberattacks, tampering or other security breaches. These attacks, if successful, could result in shutdowns or significant disruptions of our IT systems and/or in unauthorized persons exfiltrating and misappropriating intellectual property and other confidential information, including patient and employee data that we collect, transmit and store on and through our IT systems.

External actors may develop and deploy viruses, other malicious software programs, ransomware attacks, distributed denial of service attacks or other attempts to harm or obtain unauthorized access to our systems. External actors may also deploy programs targeting our employees which are designed to attack our IT systems or otherwise exploit security vulnerabilities through programs such as electronic spamming, phishing, smishing, spear phishing or similar tactics. As a result of the difficulty in detecting many of these attacks, intrusions and breaches, failures or losses may be repeated or compounded before they are discovered or rectified, which could further increase these costs and consequences.

Although the Company has robust security measures implemented, which are monitored and routinely tested both by internal resources and external parties, cyber threats against us continue to evolve and may not be recognized until after an incident. In August 2021, ReproSource, our subsidiary, experienced a data security incident in which an unauthorized party may have accessed or acquired protected health information and personally identifiable information of ReproSource patients (in connection with the incident, ReproSource discovered and contained ransomware). The Company’s other systems were not impacted or compromised by this incident. The attacks we have experienced have not materially disrupted, interrupted, damaged or shutdown the Company's IT systems, or materially disrupted the Company's performance of its business, but the mitigation or remediation efforts that we undertake may require expenditures of significant resources and divert the attention of management. There can be no assurance that the Company can anticipate all evolving future attacks, viruses or intrusions, implement adequate preventative measures, or remediate any security vulnerabilities. If our IT systems are successfully attacked, it could result in major disruption of our business, compromise confidential information, and result in litigation and potential liability for the Company, government investigation, significant damage to our reputation or otherwise adversely affect our business.

In addition, third parties to whom we outsource certain of our services or functions, or with whom we interface, store or process confidential patient and employee data or other confidential information, as well as those third parties’ providers, are also subject to the risks outlined above. For example, in June 2019, the Company reported that Retrieval-Masters Creditors Bureau, Inc./American Medical Collection Agency (“AMCA”), informed the Company about a data security incident involving AMCA. AMCA, which provided debt collection services for a company that provides revenue management services to the Company, informed the Company in May 2019 that AMCA had learned that an unauthorized user had access to AMCA’s system during 2018 and 2019. AMCA’s affected system included financial, medical and other personal information. The Company’s systems or databases were not involved in this incident. A breach or attack affecting third parties with whom we engage could also harm our business, results of operations and reputation and subject us to liability.

We have taken, and continue to take, precautionary measures to reduce the risk of, and detect and respond to, future cyber threats, and prevent or minimize vulnerabilities in our IT systems, including the loss or theft of intellectual property, patient and employee data or other confidential information that we obtain and store on our systems. We also have taken, and will continue to take, measures to assess the cybersecurity protections used by third parties to whom we outsource certain of our services or functions, or with whom we interface, store or process confidential patient and employee data or other confidential information. In addition, we collaborate with government agencies regarding potential cyber threats and have worked with firms that have cyber security expertise to evaluate our systems and the attacks we experience and strengthen our systems. There can be no assurances that our precautionary measures or measures used by our third party providers will prevent, contain or successfully defend against cyber or information security threats that could have a significant impact on our business, results of operations and reputation and subject us to liability.

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds

The table below sets forth the information with respect to purchases made by or on behalf of the Company of its common stock during the third quarter of 2021.

(A)Since the share repurchase program’s inception in May 2003, our Board of Directors has authorized $11 billion of share repurchases of our common stock through September 30, 2021. The share repurchase authorization has no set expiration or termination date. In each of February and March 2021, the Company's Board of Directors increased the size of its share repurchase program by $1 billion.

(B)Includes: (1) shares delivered or attested to in satisfaction of the exercise price and/or tax withholding obligations by holders of stock options (granted under the Company’s Amended and Restated Employee Long-Term Incentive Plan) who exercised options; and (2) shares withheld (under the terms of grants under the Amended and Restated Employee Long-Term Incentive Plan) to offset tax withholding obligations that occur upon the delivery of outstanding common shares underlying restricted stock units and performance share units.

**(C)**Does not include $300 million of the $1.5 billion second quarter 2021 payment associated with the April 2021 accelerated share repurchase agreements ("ASRs"), which represents 20% percent of the total initial value of shares expected to be repurchased under the ASRs during the fourth quarter of 2021. See Note 9 to the interim unaudited consolidated financial statements for further information regarding the ASRs.