Our state and federal contracts and the regulatory provisions applicable to us generally set forth the requirements for operating in the Medicaid and Medicare sectors, including provisions relating to:

A health plan or individual health insurance provider's compliance with these requirements is subject to monitoring by state regulators and by CMS. A health plan is also subject to periodic comprehensive quality assurance evaluations by a third-party reviewing organization and generally by the insurance department of the jurisdiction that licenses the health plan. A health plan or individual health insurance provider must also submit reports to various regulatory agencies, including quarterly and annual statutory financial statements and utilization reports.

Our health plans operate through individual state contracts, generally with an initial term of one to five years. The contracts often have renewal or extension terms or are renewable through the state's reprocurement process. The contracts generally are subject to termination for cause, an event of default or lack of funding, among other things.

We operate in 2027 states under federally-facilitated and state-based marketplace contracts with CMS that expire annually.and state-based exchanges. Both contract types are renewable on an annual basis.

We operate under a contract with the Arkansas Department of Human Services Division of Medical Services and the Arkansas Insurance Department to participate in the Medicaid expansion model that Arkansas has adopted (referred to as "Arkansas Works")Arkansas Works).

We are subject to various international, federal, state and local laws and rules regarding the use, security and disclosure of protected health information, personal information, and other categories of confidential or legally protected data that our businesses handle. Such laws and rules include, without limitation, the Health Insurance Portability and Accountability Act (HIPAA),HIPAA, the Federal Trade Commission Act, the Gramm-Leach-Bliley Financial Modernization Act of 1999 (Gramm-Leach-Bliley Act), the General Data Protection Regulation (GDPR) in the European Union (EU), and state privacy and security laws such as the California Confidentiality of Medical Information Act and the California Online Privacy Protection Act. Privacy and security laws and regulations often change due to new or amended legislation, regulations or administrative interpretation. A variety of state and federal regulators enforce these laws, including but not limited to the U.S. Department of Health and Human Services (HHS), the Federal Trade Commission, state attorneys general and other state regulators.

HIPAA is designed to improve the portability and continuity of health insurance coverage, simplify the administration of health insurance through standard transactions and ensure the privacy and security of individual health information. Among the requirements of HIPAA are the Administrative Simplification provisions which include: standards for processing health insurance claims and related transactions (Transactions Standards); requirements for protecting the privacy and limiting the use and disclosure of medical records and other personal health information (Privacy Rule); and standards and specifications for safeguarding personal health information which is maintained, stored or transmitted in electronic format (Security Rule). The Health Information Technology for Economic and Clinical Health (HITECH) Act amended certain provisions of HIPAA and enhanced data security obligations for covered entities and their business associates. HITECH also mandated individual notifications in instances of a data breach, provided enhanced penalties for HIPAA violations, and granted enforcement

authority to states' Attorneys GeneralsGeneral in addition to the HHS Office for Civil Rights. The HIPAA Omnibus Rule further enhanced the changes under the HITECH Acts and the Genetic Information Nondiscrimination Act of 2008 (GINA) which clarified that genetic information is protected under HIPAA and prohibits most health plans from using or disclosing genetic information for underwriting purposes. These regulations also establish significant criminal penalties and civil sanctions for non-compliance. The preemption provisions of HIPAA provide that the federal standards will not preempt state laws that are more stringent than the related federal requirements.

The Privacy and Security Rules and HITECH/Omnibus enhancements established requirements to protect the privacy of medical records and safeguard personal health information maintained and used by healthcare providers, health plans, healthcare clearinghouses, and their business associates.

The Security Rule requires healthcare providers, health plans, healthcare clearinghouses, and their business associates to implement administrative, physical and technical safeguards to ensure the privacy and confidentiality of health information electronically stored, maintained or transmitted. The HITECH Act and Omnibus Rule enhanced a federal requirement for notification when the security of protected health information is breached. In addition, there are state laws that have been adopted to provide for, among other things, private rights of action for breaches of data security and mandatory notification to persons whose identifiable information is obtained without authorization.

The requirements of the Transactions Standards apply to certain healthcare related transactions conducted using "electronic media." Since "electronic media" is defined broadly to include "transmissions that are physically moved from one location to another using portable data, magnetic tape, disk or compact disk media," many communications are considered to be electronically transmitted. Under HIPAA, health plans and providers are required to have the capacity to accept and send all covered transactions in a standardized electronic format. Penalties can be imposed for failure to comply with these requirements. The transaction standards were modified onin October 1, 2015 with the implementation of the ICD-10 coding system.

In addition, we process and maintain personal card data, particularly in connection with our Marketplace business. As a result, we must maintain compliance with the Payment Card Industry (PCI) Data Security Standard, which is a multifaceted security standard intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information.

Investigating and prosecuting healthcare fraud, waste and abuse continues to be a top priority for state and federal law enforcement entities. The focus of these efforts has been directed at Medicare, Medicaid, Health Insurance Marketplace and commercial products. The fraud, waste and abuse laws include the federal False Claims Act, which prohibits the known filing of a false claim or the known use of false statements to obtain payment from the federal government. Many states have false claim act statutes that closely resemble the federal False Claims Act. Additional fraud, waste and abuse prohibitions include a wide range of operating activities, such as kickbacks or other inducements for referral of members or for the coverage of products (such as prescription drugs) by a plan, billing for unnecessary medical services by a provider, improper marketing and violation of patient privacy rights. The laws and regulations relating to fraud, waste and abuse and the requirements applicable to health plans, PDPs and providers participating in these programs are complex and change regularly. Compliance with these laws may require substantial resources. We are constantly looking for ways to improve our fraud, waste and abuse detection methods. While we have both prospective and retrospective processes to identify abusive patterns and fraudulent billing, we continue to increase our capabilities to proactively detect inappropriate billing prior to payment.

We believe that a diverse workforce and equitable and inclusive environment enables competitive advantage and fuels improved service, innovation and performance with all stakeholders. We thoughtfully engage diverse talent across Centene, preparing women and underrepresented employees for leadership roles, and hiring diverse candidates who have a passion for serving our relationshipsmembers and ambition for extraordinary impact.

We have a wide range of programs focused on early identification and accelerated development of diverse talent, including our Employee Inclusion Groups (EIGs), which help us further enhance our inclusive workforce culture. These voluntary, employee led groups support the attraction, development and retention of talent at all levels. EIGs provide professional and leadership opportunities, contribute to community engagement initiatives and support business innovation and corporate best practices. Our EIGs are key drivers of Centene's culture. Because of their significant value to us, we support EIGs through leadership involvement, work time and space, resources and executive mentors. Today, there are over 10,000 members across all five EIGs providing professional and leadership development opportunities for women, military veterans, individuals with disabilities, LGBTQ+ and multicultural employees. Each EIG offers mentorship programs aligned with our leadership model and bring in unique lived experiences in an effort to ensure we are meeting employees at their level to deliver the best outcomes for their development. EIGs also partake in networking events, training programs, fireside chats and panels addressing current issues and other development opportunities for their members. In 2021, our EIGs produced more than 250 development programs ranging from panel discussions to personal development workshops.

Our team of talent advisors are positive.responsible for leading the end-to-end search process, and leveraging our resources, tools and technologies to help our hiring leaders carefully consider the capabilities required to continue to propel our organization forward. Centene's talent advisors, in partnership with hiring leaders, work to nurture a pipeline that connects us to a diverse workforce. All of our talent advisors receive training to become Certified Diversity Recruiters and this past year, several participated in the Association of Talent Acquisition Professionals Diversity, Equity and Inclusion (DEI) Excellence Program. The program empowers talent advisors to further their capabilities and bring DEI talent acquisition best practices into their respective organizations.

We principally operate through our health plan subsidiaries. As part of normal operations, we may make requests for dividends and distributions from our subsidiaries to fund our operations. In addition to state corporate law limitations, these subsidiaries are subject to more stringent state insurance and HMO laws and regulations that limit the amount of dividends and distributions that can be paid to us without prior approval of, or notification to, state regulators. If these regulators were to deny or delay our subsidiaries' requests to pay dividends, the funds available to us would be limited, which could harm our ability to implement our business strategy.

Operations in a limited number of states have accounted for a significant portion of our premium revenues to date. If we were unable to continue to operate in any of those states or if our current operations in any portion of one of those states were significantly curtailed, our revenues could decrease materially. Our reliance on operations in a limited number of states could cause our revenues and profitability to change suddenly and unexpectedly depending on legislative or other governmental or regulatory actions and decisions, economic conditions and similar factors in those states. For example, states we currently serve may open the bidding for their Medicaid program to other health insurers through a request for proposal process. Our inability to continue to operate in any of the states in which we operate could harm our business.

We compete for members principally on the basis of size and quality of provider networks, benefits provided and quality of service. We compete with numerous types of competitors, including other health plans and traditional state Medicaid programs that reimburse providers as care is provided, as well as technology companies, new joint ventures, financial services firms, consulting firms and other non-traditional competitors. In addition, the administration of the ACA has the potential to shift the competitive landscape in our segment.

Some of the health plans with which we compete have greater financial and other resources and offer a broader scope of products than we do. In addition, significant merger and acquisition activity has occurred in the managed care industry, as well as complementary industries, such as the hospital, physician, pharmaceutical, medical device and health information systems businesses. To the extent that competition intensifies in any market that we serve, as a result of industry consolidation or otherwise, our ability to retain or increase members and providers, or maintain or increase our revenue growth, pricing flexibility and control over medical cost trends may be adversely affected.

Our profitability depends, in large part, upon our ability to contract at competitive prices with hospitals, physicians and other healthcare providers. Our provider arrangements with our primary care physicians, specialists and hospitals generally may be canceled by either party without cause upon 90 to 120 days prior written notice. We cannot provide any assurance that we will be able to continue to renew our existing contracts or enter into new contracts on a timely basis or under favorable terms enabling us to service our members profitably. Healthcare providers with whom we contract may not properly manage the costs of, and access to services, be able to provide effective telehealth services, maintain financial solvency, including due to the impact of COVID-19, or avoid disputes with other providers. Any of these events could have a material adverse effect on the provision of services to our members and our operations.

In any particular market, physicians and other healthcare providers could refuse to contract, demand higher payments, or take other actions that could result in higher medical costs or difficulty in meeting regulatory or accreditation requirements, among other things. In some markets, certain healthcare providers, particularly hospitals, physician/hospital organizations or multi-specialty physician groups, may have significant market positions or near monopolies that could result in diminished bargaining power on our part. In addition, accountable care organizations, practice management companies, which aggregate physician practices for administrative efficiency and marketing leverage, and other organizational structures that physicians, hospitals and other healthcare providers choose may change the way in which these providers interact with us and may change the competitive landscape. Such organizations or groups of healthcare providers may compete directly with us, which could adversely affect our operations, and our results of operations, financial position and cash flows by impacting our relationships with these providers or affecting the way that we price our products and estimate our costs, which might require us to incur costs to change our operations. Provider networks may consolidate, resulting in a reduction in the competitive environment. In

addition, if these providers refuse to contract with us, use their market position to negotiate contracts unfavorable to us or place us at a competitive disadvantage, our ability to market products or to be profitable in those areas could be materially and adversely affected.

From time to time, healthcare providers assert or threaten to assert claims seeking to terminate non-cancelable agreements due to alleged actions or inactions by us. If we are unable to retain our current provider contract terms or enter into new provider contracts timely or on favorable terms, our profitability may be harmed. In addition, from time to time, we may be subject to class action or other lawsuits by healthcare providers with respect to claim payment procedures or similar matters. For example, our wholly owned subsidiary, Health Net Life Insurance Company (HNL), is and may continue to be subject to such disputes with respect to HNL's payment levels in connection with the processing of out-of-network provider reimbursement claims for the provision of certain substance abuse related services. HNL expects to vigorously defend its claims payment practices. Nevertheless, in the event HNL receives an adverse finding in any related legal proceeding or from a regulator, or is otherwise required to reimburse providers for these claims at rates that are higher than expected or for claims HNL otherwise believes are unallowable, our financial condition and results of operations may be materially adversely affected. In addition, regardless of whether any such lawsuits brought against us are successful or have merit, they will still be time-consuming and costly and could distract our management's attention. As a result, under such circumstances we may incur significant expenses and may be unable to operate our business effectively.

Our operations depend significantly on effective information systems. The information gathered and processed by our information systems assists us in, among other things, monitoring utilization and other cost factors, processing provider claims, and providing data to our regulators. Our healthcare providers also depend upon our information systems for membership verifications, claims status and other information. Our information systems and applications require continual maintenance, upgrading and enhancement to meet our operational needs and regulatory requirements. We regularly upgrade and expand our information systems' capabilities. If we experience difficulties with the transition to or from information systems or do not appropriately integrate, maintain, enhance or expand our information systems, we could suffer, among other things, operational disruptions, loss of existing members and difficulty in attracting new members, regulatory problems and increases in administrative expenses. In addition, our ability to integrate and manage our information systems may be impaired as the result of events outside our control, including acts of nature, such as earthquakes or fires, or acts of terrorists.terrorists, which may include cyber-attacks by terrorists or other governmental or non-governmental actors. In addition, we may from time to time obtain significant portions of our systems-related or other services or facilities from independent third parties, which may make our operations vulnerable if such third parties fail to perform adequately.

We periodically evaluate our goodwill and other intangible assets to determine whether all or a portion of their carrying values may be impaired, in which case a charge to earnings may be necessary. Changes in business strategy, government regulations or economic or market conditions have resulted and may result in impairments of our goodwill and other intangible assets at any time in the future. Our judgments regarding the existence of impairment indicators are based on, among other things, legal factors, market conditions, and operational performance. For example, the non-renewal of our health plan contracts with the state in which they operate may be an indicator of impairment. If an event or events occur that would cause us to revise our estimates and assumptions used in analyzing the value of our goodwill and other intangible assets, such revision could result in a non-cash impairment charge that could have a material impact on our results of operations in the period in which the impairment occurs.

As part of our normal operations, we collect, process and retain confidential member information. We are subject to various federal, state and international laws, regulations, rules and rulescontractual requirements regarding the use and disclosure of confidential member information, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, the Gramm-Leach-Bliley Act, and the EU's GDPR,European Union's General Data Protection Regulation, which require us to protect the privacy of medical records and safeguard personal health information we maintain and use. Certain of our businesses are also subject to the Payment Card Industry Data Security Standard, which is a multifaceted security standard that is designed to protect credit card account data as mandated by payment card industry entities. Despite our best attempts to maintain adherence to information privacy and security best practices, as well as compliance with applicable laws, rules and contractual requirements, our facilities and systems, and those of our third-party service providers, may be vulnerable to privacy or security breaches, acts of vandalism or theft, malware or other forms of cyber-attack, misplaced or lost data including paper or electronic media, programming and/or human errors or other similar events. In the past, we have had data breaches resulting in disclosure of confidential or protected health information that have not resulted in any material financial loss or penalty to date. For example, in 2021, we learned that Accellion, a third-party data transfer provider with whom we contract, had a system vulnerability that resulted in unauthorized access to certain sensitive data of our customers, including protected health information, as well as unauthorized access to the data of several of Accellion’s other clients. This incident led to putative class action lawsuits that were filed against us and our subsidiaries, Health Net, LLC, Health Net of California, Inc., Health Net Life Insurance Company, Health Net Community Solutions, Inc., and California Health & Wellness, and Accellion on behalf of the affected customers. We do not believe that this incident is likely to have a material adverse effect on our business, reputation, results of operations, financial position and

cash flows. However, future datathere can be no assurance that this incident and other privacy or security breaches couldwill not require us to expend significant resources to remediate any damage, interrupt our operations and damage our business or reputation, subject us to state, federal, or federalinternational agency review, and could also result in enforcement actions, material fines and penalties, litigation or other actions which could have a material adverse effect on our business, reputation, and results of operations, financial position and cash flows.

In addition, HIPAA broadened the scope of fraud, waste and abuse laws applicable to healthcare companies. HIPAAcompanies and established new enforcement mechanisms to combat fraud, waste and abuse, including civil and, in some instances, criminal penalties for failure to comply with specific standards relating to the privacy, security and electronic transmission of protected health information. The HITECH Act expanded the scope of these provisions by mandating individual notification in instances of breaches of protected health information, providing enhanced penalties for HIPAA violations, and granting enforcement authority to states' Attorneys General in addition to the HHS Office for Civil Rights. The HHS Office for Civil Rights received $28.7 million from enforcement actions in 2018, surpassing the previous record of $23.5 million from 2016 by 22 percent. It is possible that Congress may enact additional legislation in the future to increase the amount or application of penalties and to create a private right of action under HIPAA, which could entitle patients to seek monetary damages for violations of the privacy rules.

We maintain a significant investment portfolio of cash equivalents and short-term and long-term investments in a variety of securities, which are subject to general credit, liquidity, market and interest rate risks and will decline in value if interest rates increase or one of the issuers' credit ratings is reduced. Furthermore, COVID-19 has impacted, and may continue to impact, the global economy resulting in significant market volatility and fluctuating interest rates. As a result, we may experience a reduction in value or loss of our operational or security systems or infrastructure, or those of third parties withinvestments, which we do business, including asmay have a result of cyber-attacks, could have annegative adverse effect on our business.results of operations, liquidity and financial condition.

Our access to additional financing will depend on a variety of factors such as prevailing economic and credit market conditions, the general availability of credit, the overall availability of credit to our industry, our credit ratings and credit capacity, and perceptions of our financial prospects. Similarly, our access to funds may be impaired if regulatory authorities or rating agencies take negative actions against us. If one or any combination of these factors were to occur, our internal sources of liquidity may prove to be insufficient, and in recent yearssuch case, we may not be able to successfully obtain sufficient additional financing on favorable terms, within an acceptable time, or at all.

As of December 31, 2021, we had consolidated indebtedness of $18.8 billion. We may further increase our indebtedness in the proliferationfuture.

This may have the effect, among other things, of new technologies, reducing our flexibility to respond to changing business and economic conditions and increasing borrowing costs.

The market price of our common stock is generally subject to volatility, and there can be no assurances regarding the level or stability of our share price at any time. The market price of our common stock may decline as a result of acquisitions if, among other things, we are unable to achieve the expected cost and revenue synergies or growth in earnings, or if the operational cost savings estimates in connection with the integration of acquired businesses with ours are not realized as rapidly or ifto the extent anticipated, the transaction costs related to the acquisitions and integrations are greater than expected or if any financing related to the acquisitions is on unfavorable terms. The market price also may decline if we do not achieve the perceived benefits of the

acquisitions, including the Magellan Acquisition, as rapidly or to the extent anticipated by financial or industry analysts or if the effect of the acquisitions on our financial position, results of operations or cash flows is not consistent with the expectations of financial or industry analysts.

Many of these factors will be outside of our control and any one of them could result in delays, increased costs, decreases in the amount of expected revenues and diversion of management's time and energy, which could materially affect our financial position, results of operations and cash flows. Our ability to successfully manage the expanded business following any given acquisition, including the Magellan Acquisition, will depend, in part, upon management's ability to design and implement strategic initiatives that address not only the integration of two independent stand-alone companies, but also the increased scale and scope of the combined business with its associated increased costs and complexity. There can be no assurances that we will be successful in managing our expanded operations as a result of acquisitions or that we will realize the expected growth in earnings, operating efficiencies, cost savings and other benefits.

We have substantial indebtedness outstanding andregularly evaluate our portfolio in order to determine whether an asset or business is still consistent with our business strategy or whether there may incur additional indebtedness in the future. Such indebtedness could reduce our agility and may adversely affect our financial condition.