UNHUnitedHealth Group

Please tell us what consideration you gave to filing an amended Form 8-K pursuant to Instruction 2 to provide information about the impact on your business operations, similar to those described on the "Information on the Change Healthcare Cyber Response" webpage.

Rest of the question

For example, your 8-K does not indicate that some pharmacies have been unable to submit claims, and that providers have not been able to submit claims or receive payment, but that information is described on the website. Please refer to Rule 105 of Regulation S-T regarding the use of hyperlinks. Additionally, we note news reports indicating that pharmacies have been unable to verify insurance status, and as a result customers have had to pay cash or have been unable to obtain prescriptions. When you file amended Forms 8-K pursuant to Instruction 2 to Item 1.05 of Form 8-K, please expand your disclosure to address the following items: • expand your discussion to describe the scope of your business operations impacted; and • describe the known material impact(s) the incident has had and the material impact(s) that are likely to continue. In considering material impacts, please describe all material impacts. For example, consider customer/partner relationships and potential reputational harm related to the outage of your system, as well as any impact to your financial condition or results of operations. To the extent you become aware of additional reasonably likely material impacts, please confirm you will file an amended Form 8-K to update your disclosure. We remind you that the company and its management are responsible for the accuracy and adequacy of their disclosures, notwithstanding any review, comments, action or absence of action by the staff.

The Company respectfully acknowledges the Staff’s comment. For the reasons described below, the Company does not believe that an additional amendment to the Form 8-K is appropriate at this time.

The Company confirms to the Staff that it has carefully considered the amendment requirements of Instruction 2 as the Company continues its investigation of the incident and its assessment of whether the incident is reasonably likely to have a material impact on the Company, including its financial condition and results of operations.

Rest of the answer

In its materiality assessment, as directed by the Commission in Release No. 33-11216, the Company is considering qualitative factors alongside quantitative factors, including those factors identified in the Staff’s comment. To date the Company has not concluded the cyber incident to be material or reasonably likely to be material. Therefore, the Company’s Form 8-K disclosures have focused on matters deemed to be most significant.

In its comment, the Staff refers to the Company’s consideration of whether to provide disclosure concerning the incident’s impacts on the Company’s business operations, including particularly its pharmacy services, similar to the information provided on the Company’s webpage. In evaluating the application of Instruction 2 to disclosure via an amendment, the Company considered both the information about the impacts it has already disclosed in the Form 8-K and the nature of its communications on the Company’s webpage.

In its two Form 8-K amendments, the Company has provided extensive information describing operational impacts of the incident on key systems affected by the cyberattack. The systems discussed in the amendments include—in addition to medical claims and payment systems—systems relating to pharmacy services. The Company’s filed disclosures specifically discuss matters relating to the incident’s impacts on the functioning of claims submission and payment transmission in the Company’s pharmacy services, as well as the progress of the Company’s efforts to restore the pre-incident functionality of those systems.

The Company also considered the nature of the communications on its webpage in determining that Instruction 2 does not warrant further amending the Form 8-K at this time to disclose additional information about operational impacts similar to those described on the webpage. The Company has been guided in its consideration by the Commission’s statement in Release No. 33‑11216 that a registrant’s communications with customers, business partners and other persons affected by a cybersecurity incident, such as the communications on the Company’s webpage, may be required or appropriate because of the registrant’s contractual commitments or the mandates of other applicable legal regimes, and that those communications do not necessarily represent a determination by the registrant that the impacts are material for purposes of the federal securities laws.

The Company respectfully confirms to the Staff that it will amend the Form 8-K to update its disclosure in accordance with Instruction 2 if it becomes aware of reasonably likely material impacts required to be reported under Item 1.05.

The undersigned is available to discuss the Staff’s comment and the Company’s response, as needed.

Read in the reply ↗

We note your disclosure that as of the date of the amendment, "the Company has not determined the incident is reasonably likely to materially impact the Company's financial condition or results of operations." Additionally, we note your letter dated June 14, 2024 indicated that as of that date, "the Company has not concluded the cyber incident to be material or reasonably likely to be material." Please confirm that,

Rest of the question

in future filings, where you have not detrmined if the incident has had a material impact to the company or is reasonably likely to have a material impact to the company, including its financial condition and results of operations, you will consider filing disclosures under Item 8.01 of Form 8-K, rather than Item 1.05 of Form 8-K.

The Company respectfully acknowledges the Staff’s comment. The Company confirms to the Staff that in future filings, where the Company has not determined if a cyber incident has had a material impact to the Company or is reasonably likely to have a material impact to the Company, including its financial condition and results of operations, the Company will consider filing disclosures under Item 8.01 of Form 8-K, rather than Item 1.05 of Form 8-K. Read in the reply ↗