HCA, §1A diff (2022 → 2023)

Item 1A. Risk Factors

If any of the events discussed in the following risk factors were to occur, our business, financial position, results of operations, cash flows or prospects could be materially, adversely affected. Additional risks and uncertainties not presently known to us or that we currently deem immaterial may also affect us. Our business is subject to the following material risks and uncertainties.

Risks related to our indebtedness:

We have significant indebtedness and may incur further indebtedness in the future. Our indebtedness could adversely affect our ability to raise additional capital to fund our operations, limit our ability to react to changes in the economy or our industry, expose us to interest rate risk to the extent of our variable rate debt and prevent us from meeting our obligations.

As of December 31, 2023, our total indebtedness was $39.593 billion. As of December 31, 2023, we had availability of $3.487 billion under our senior secured cash flow credit facility and $2.620 billion under our senior secured asset-based revolving credit facility, after giving effect to letters of credit and borrowing base limitations. Our indebtedness could have important consequences, including:

•increasing our vulnerability to downturns or adverse changes in general economic, industry or competitive conditions and adverse changes in government regulations;

•requiring a portion of cash flows from operations to be dedicated to the payment of principal and interest on our indebtedness, therefore reducing our ability to use our cash flows to fund our operations, capital expenditures and future business opportunities;

•exposing us to the risk of increased interest rates on our existing borrowings that are at variable rates of interest or refinancing our debt in a rising or high rate environment;

•limiting our ability to make strategic acquisitions or causing us to make nonstrategic divestitures;

•limiting our ability to obtain additional financing for working capital, capital expenditures, share repurchases, dividends, product or service line development, debt service requirements, acquisitions and general corporate or other purposes; and

•limiting our ability to adjust to changing market conditions and placing us at a competitive disadvantage compared to our competitors who have less debt.

We and our subsidiaries have the ability to incur additional indebtedness in the future, subject to the restrictions contained in our senior secured credit facilities and the indentures governing our outstanding notes. If new indebtedness is added to our current debt levels, interest rates and the related risks that we now face could intensify.

33

We may not be able to generate sufficient cash to service all of our indebtedness and may not be able to refinance our indebtedness on favorable terms. If we are unable to do so, we may be forced to take other actions to satisfy our obligations under our indebtedness, which may not be successful.

Our ability to make scheduled payments on or to refinance our debt obligations depends on our financial condition and operating performance, which are subject to prevailing economic and competitive conditions and to certain financial, business and other factors beyond our control. We cannot guarantee we will maintain a level of cash flows from operating activities sufficient to permit us to pay the principal, premium, if any, and interest on our indebtedness.

In addition, we conduct our operations through our subsidiaries. Accordingly, repayment of our indebtedness is dependent on the generation of cash flows by our subsidiaries and their ability to make such cash available to us by dividend, debt repayment or otherwise. Our subsidiaries may not be able to, or may not be permitted to, make distributions to enable us to make payments in respect of our indebtedness. Each subsidiary is a distinct legal entity, and, under certain circumstances, legal and contractual restrictions may limit our ability to obtain cash from our subsidiaries.

We may find it necessary or prudent to refinance our outstanding indebtedness, the terms of which may not be favorable to us. Our ability to refinance our indebtedness on favorable terms, or at all, is directly affected by the then current global economic and financial conditions which affect the availability of debt financing and the rates at which such financing is available. In addition, our ability to incur secured indebtedness depends in part on the value of our assets, which depends, in turn, on the strength of our cash flows and results of operations, and on economic and market conditions and other factors.

If our cash flows and capital resources are insufficient to fund our debt service obligations or we are unable to refinance our indebtedness, we may be forced to reduce or delay investments and capital expenditures, or to sell assets, seek additional capital or restructure our indebtedness. These alternative measures may not be successful and may not permit us to meet our scheduled debt service obligations. If our operating results and available cash are insufficient to meet our debt service obligations, we could face substantial liquidity problems and might be required to dispose of material assets or operations to meet our debt service and other obligations. We may not be able to consummate those dispositions, or the proceeds from the dispositions may not be adequate to meet any debt service obligations then due.

Our debt agreements contain restrictions that limit our flexibility in operating our business.

Our senior secured credit facilities and, to a lesser extent, the indentures governing our outstanding notes contain various covenants that limit our ability to engage in specified types of transactions. These covenants limit our and certain of our subsidiaries’ ability to, among other things:

•incur additional indebtedness or issue certain preferred shares;

•pay dividends on, repurchase or make distributions in respect of our capital stock or make other restricted payments;

•make certain investments;

•sell or transfer assets;

•create liens;

•consolidate, merge, sell or otherwise dispose of all or substantially all of our assets; and

•enter into certain transactions with our affiliates.

Under our asset-based revolving credit facility, borrowing availability is subject to a borrowing base of 85% of eligible accounts receivable less customary reserves, with any reduction in the borrowing base that results in the borrowing base falling below the amount committed by the lenders thereunder commensurately reducing our ability to access this facility as a source of liquidity. In addition, under the asset-based revolving credit facility, when (and for as long as) the combined availability under our asset-based revolving credit facility and the revolving facility under our senior secured cash flow credit facility is less than a specified amount for a certain period of time or, if a payment or bankruptcy event of default has occurred and is continuing, funds deposited into any of our depository accounts will be transferred on a daily basis into a blocked account with the administrative agent and applied to prepay loans under the asset-based revolving credit facility and to collateralize letters of credit issued thereunder.

Under our senior secured credit facilities, we are required to satisfy and maintain specified financial ratios. Our ability to meet those financial ratios may be affected by global economic and financial conditions or other events beyond our control, and there can be no assurance we will continue to meet those ratios. A breach of this or any other covenant could result in a default under both the cash flow credit facility and the asset-based revolving credit facility. Upon the occurrence of an event of default under these senior secured credit facilities, the lenders thereunder could elect to declare

34

all amounts outstanding under the senior secured credit facilities to be immediately due and payable and terminate all commitments to extend further credit, which would also result in an event of default under a significant portion of our other outstanding indebtedness. If we were unable to repay those amounts, the lenders under the senior secured credit facilities could proceed against the collateral granted to them to secure such indebtedness. We have pledged a significant portion of our assets under our senior secured credit facilities. If any of the lenders under the senior secured credit facilities accelerate the repayment of borrowings, there can be no assurance there will be sufficient assets to repay the senior secured credit facilities and our other indebtedness.

Risks related to human capital:

Our results of operations may be adversely affected by competition for staffing, the shortage of experienced nurses and other health care professionals and labor union activity.

Our operations are dependent on the efforts, abilities and experience of our management and medical personnel, such as physicians, nurses, pharmacists and lab technicians. We compete with other health care providers in recruiting and retaining qualified management and personnel responsible for the daily operations of each of our hospitals and other facilities, including nurses and other nonphysician health care professionals. In some markets, the availability of nurses and other medical support personnel has been a significant operating issue to health care providers, including at certain of our facilities. The impact of labor shortages across the health care industry may result in other health care facilities, such as nursing homes, limiting admissions, which may constrain our ability to discharge patients to such facilities and further exacerbate the demand on our resources, supplies and staffing.

Economic conditions, increased inflationary pressure and COVID-19 have exacerbated workforce competition, shortages and capacity constraints. We may be required to increase wages and benefits to recruit and retain nurses and other medical support personnel and to hire more expensive temporary or contract personnel. As a result of labor shortages, competition and inflationary pressures, our labor costs could increase and our capacity could be negatively impacted. We also depend on the available labor pool of employees in each of the markets in which we operate to fill other necessary positions. If there is continued competition for these employees or additional union organizing activity or a significant portion of our employee base unionizes, it is possible our labor costs could increase.

When negotiating collective bargaining agreements with unions, whether such agreements are renewals or first contracts, we have experienced, and could experience in the future, labor strikes. Our continued operation during any strikes could result in an increase to our labor costs. In addition, upon the expiration of existing collective bargaining agreements, we may not reach new agreements without union action, and any such new agreements may not be on terms satisfactory to us. The unavailability of staff, or the inability of the Company to control labor costs, could have a material, adverse effect on our capacity, growth prospects and results of operations.

In addition, federal and state laws and regulations may increase our costs of maintaining qualified nurses and other medical support personnel. We operate in states that have adopted mandatory nurse-staffing ratios or mandate staffing committees to develop staffing plans. If these states reduce, or if additional states in which we operate adopt, mandatory nurse-staffing ratios or related measures, such changes could significantly affect labor costs and have an adverse impact on revenues if we are required to limit admissions or incur other costs in order to comply. If our labor costs continue to increase, we may not be able to offset these increased costs as a significant percentage of our revenues consists of fixed, prospective payments.

Our performance depends on our ability to recruit and retain quality physicians.

The success of our hospitals depends in part on the number and quality of the physicians on the medical staffs of our hospitals, the admission and utilization practices of those physicians, maintaining good relations with those physicians and controlling costs related to their employment or affiliation with our hospitals. Although we employ some physicians, physicians are often not employees of the hospitals at which they practice and instead affiliate with us and use our facilities as an extension of their practices. In many of the markets we serve, physicians may have admitting privileges at other hospitals in addition to our hospitals. We continue to face increasing competition to recruit and retain quality physicians, as well as increasing cost to contract with hospital-based physicians. Such physicians may terminate their affiliation with our hospitals at any time. We anticipate facing increased challenges in this area as the physician population reaches retirement age, especially if there is a shortage of physicians willing and able to provide comparable services. If we are unable to recruit and retain quality physicians to affiliate with our hospitals, enter into contractual arrangements with hospital-based physicians, or provide adequate support personnel or technologically advanced equipment and hospital facilities that meet the needs of those physicians and their patients, our admissions may decrease, our operating performance may decline, and our capacity and growth prospects may be materially adversely affected.

35

We may be unable to attract, hire and retain a highly qualified and diverse workforce, including key management.

The talents and efforts of our employees, particularly our key management, are vital to our success. The members of our management team have significant industry experience, and if any member leaves the Company, such member would be difficult to replace. In addition, institutional knowledge may be lost in any potential managerial transition. We may be unable to retain key management or attract other highly qualified employees, particularly if we do not offer employment terms that are competitive with the rest of the labor market. Failure to attract, hire, develop, motivate, and retain highly qualified and diverse employee talent, or failure to develop and implement an adequate succession plan for the management team, could disrupt our operations and adversely affect our business and our future success.

Risks related to technology, data privacy and cybersecurity:

Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under HIPAA, consumer protection laws, common law theories or other laws. Such incidents could subject us to litigation and foreign, federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business.

We, directly and through our vendors and other third parties, collect and store on our networks and devices and third-party technology platforms sensitive information, including intellectual property, proprietary business information, personally identifiable information and protected health information of our patients and personally identifiable information of our employees and consumers. Our facilities use EHRs and medical devices that store or transmit information that are integral to the provision of patient care, and these systems and devices are increasingly connected to the internet, hospital networks and other medical devices. The secure maintenance of this information and technology is critical to our business operations.

Despite our efforts to mitigate our exposure to cyberattack, even an advanced internal control environment is vulnerable to compromise. In July 2023, we disclosed a security incident in which an unauthorized party accessed information at an external storage location exclusively used to automate the formatting of email messages. Approximately 11 million patients were affected by the security incident. In response to this security incident, we reinforced our cybersecurity systems, protocols and monitoring procedures, particularly focusing on data interfaces with third party storage locations. We continue to be the target of attempted cybersecurity and other threats that could have a security impact, including those by third parties to access, misappropriate, corrupt or manipulate our information or disrupt our operations. We expect to continue to experience an increase in cybersecurity threats in the future, as the volume and intensity of cyberattacks on hospitals, health systems and other health care entities continue to increase. Threats from malicious persons and groups, new vulnerabilities and advanced new attacks against our, or our vendors’, information systems and devices create risk of cybersecurity incidents, including ransomware, malware and phishing incidents, in which third parties attempt to fraudulently induce our employees or our vendors’ employees into disclosing usernames, passwords or other sensitive information, which can in turn be used for unauthorized access to our or our vendors’ systems. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks by making cyberattacks more difficult to detect, contain or mitigate. We have seen, and believe we will continue to see, widespread vulnerabilities that could affect our or other third parties’ data or systems. Mitigation and remediation recommendations continue to evolve, and addressing this and other critical vulnerabilities pertaining to widely used systems, platforms and infrastructure is a priority for us. Internal access management failures could result in the compromise or unauthorized exposure of confidential data. Moreover, hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security. There can be no assurance that we or our vendors and other third parties will not be subject to additional cybersecurity threats and incidents that bypass our or their security measures, impact the integrity, availability or privacy of personal health information or other data subject to privacy laws or disrupt our or their information systems, devices or business, including our ability to provide various health care services. In such an event, we may incur substantial costs, including but not limited to, costs associated with remediating the effects of the cybersecurity incident, costs for security measures to guard against similar future incidents and costs to recover data. Further, consumer confidence in the integrity and security of personal information and critical operations data in the health care industry generally could be shaken to the extent there are successful cyberattacks at other health care services companies, which could have a material, adverse effect on our business, financial position or results of operations.

Cybersecurity, privacy, physical security and the continued development and enhancement of our controls, processes and practices designed to protect our facilities, information systems and data from attack, damage or unauthorized access remain a priority for us. As cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our

36

protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents. Although to date no cyberattack or other information or security breach, including those experienced by us in 2023, has resulted in material losses or other material consequences to us, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover our losses in excess of what we self-insure, or all types of claims that may arise. The occurrence of any of these events could result in (i) harm to patients; (ii) business interruptions and delays; (iii) the loss, misappropriation, corruption or unauthorized access of data; (iv) litigation and potential liability under privacy, security, breach notification and consumer protection laws, common law theories or other applicable laws; (v) reputational damage; and (vi) foreign, federal and state governmental inquiries, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Our operations could be impaired by a failure of our information systems.

The performance of our information systems is critical to our business operations. In addition to our shared services initiatives, our information systems are essential to a number of critical areas of our operations, including:

•accounting and financial reporting;

•billing and collecting accounts;

•coding and compliance;

•admissions, provision of care and care coordination;

•clinical systems and medical devices;

•medical records and document storage;

•inventory management;

•negotiating, pricing and administering managed care contracts and supply contracts; and

•monitoring quality of care and collecting data on quality measures necessary for full Medicare payment updates.

Information systems may be vulnerable to damage from a variety of sources, including telecommunications or network failures, human acts such as inadvertent or intentional misuse by employees, natural disasters and cyberattacks, including ransomware and data theft, such as the data security incident we disclosed in July 2023. Moreover, we rely on various third-party technology platforms, which are increasingly important to our business and continue to grow in complexity and scope. Failure to adequately manage implementations of new technology, updates or enhancements of such platforms or interfaces between platforms could place us at a competitive disadvantage, disrupt our operations, and have a material, adverse impact on our business and results of operations.

We have taken precautionary measures to prevent unanticipated problems that could affect our information systems. Nevertheless, we or our vendors and other third parties that we rely upon may experience system failures and disruptions. The occurrence of any system failure could result in interruptions, delays, the loss or corruption of data and cessations or interruptions in the availability of systems, any of which could have a material, adverse effect on our financial position and results of operations and harm our business reputation.

Health care technology initiatives, particularly those related to sharing patient data and interoperability, may adversely affect our operations.

The federal government is working to promote the adoption of health information technology and the promotion of nationwide health information exchange to improve health care. For example, HHS incentivizes the adoption and meaningful use of certified EHR technology through its Promoting Interoperability Programs. Eligible hospitals and eligible professionals, including our hospitals and employed professionals, are subject to reduced payments from Medicare if they fail to demonstrate meaningful use of certified EHR technology. As these technologies have become widespread, the focus has shifted to increasing patient access to health care data and interoperability. The 21st Century Cures Act and its implementing regulations promote information sharing by prohibiting information blocking by health care providers and certain other entities. Information blocking is defined as engaging in activities likely to interfere with the access, exchange or use of electronic health information, except as required by law or specified by HHS as a reasonable and necessary activity. Under a rule proposed by HHS in November 2023, a hospital found to have engaged in information blocking would not qualify as a “meaningful electronic health record user” under the Medicare Promoting Interoperability Program and as a result would lose 75% of the annual market basket increase it would otherwise receive.

37

Current and future initiatives related to health care technology (including artificial intelligence and other predictive algorithms), data sharing and interoperability may require changes to our operations, impose new and complex compliance obligations and require investments in infrastructure. For example, HHS finalized a rule in December 2023 imposing transparency requirements for artificial intelligence and other predictive algorithms that are part of certified health information technology. We may be subject to financial penalties or other disincentives or experience reputational damage for failure to comply with applicable laws and regulations. It is difficult to predict how these initiatives will affect our relationships with providers and vendors, participation in health care information exchanges or networks, the exchange of patient data and patient engagement.

Machine learning and artificial intelligence are driving innovations in technology in the health care industry, which presents certain risks. As currently employed, our physicians use generative AI to assist with the taking of medical notes regarding our patients. Should the use of generative AI fail to operate as anticipated or not perform as specified, patient care may be affected, legal claims may be asserted against us and our reputation may be harmed.

We may not be adequately reimbursed by third-party payers for services involving new technology.

As health care technology continues to advance, the price of purchasing new technology has significantly increased for providers. Some payers have not adapted their payment systems to adequately cover the cost of new technology used to treat patients. If reimbursement from third-party payers for services involving new technology does not sufficiently cover our purchasing costs, we may be unable to acquire new technology. Even without sufficient third-party reimbursement, we may acquire or utilize new technology in order to treat our patients. In either case, our results of operations and financial position could be adversely affected.

Risks related to public health crises:

COVID-19 has affected, and may continue to affect, our operations. In addition, the emergence and effects related to a potential future pandemic, epidemic or outbreak of an infectious disease could adversely affect our business and operations.

As a front-line provider of health care services, we have been and continue to be affected by the health and economic effects of COVID-19. COVID-19 continues to evolve, and we may not be able to predict or effectively respond to future developments.

If public health conditions related to COVID-19 significantly worsen, any such developments could materially and adversely affect our business, results of operations, financial position and cash flows. The ongoing impact of COVID-19 on our business will depend on, among other factors, the duration and severity of any severe or widespread outbreaks of COVID-19; the impact of COVID-19 on economic conditions; the volume of canceled or rescheduled procedures at our facilities; the volume of COVID-19 patients cared for across our health systems; the availability, acceptance of, and need for effective vaccines and medical treatments; the spread of potentially more contagious and/or virulent forms of the virus; and the impact of government actions on the health care industry and broader economy.

If another pandemic, epidemic, outbreak of an infectious disease or other public health crisis were to occur in an area in which we operate, our operations could be adversely affected. Such a crisis could diminish the public trust in health care facilities, especially hospitals that fail to accurately or timely diagnose, or are treating (or have treated) patients affected by infectious diseases. If any of our facilities are involved, or perceived as being involved, in treating patients from such an infectious disease, other patients might cancel elective procedures or fail to seek needed care at our facilities, and our reputation may be negatively affected. Patient volumes may decline or volumes of uninsured and underinsured patients may increase, depending on the economic circumstances surrounding the pandemic, epidemic or outbreak. Further, a pandemic, epidemic or outbreak might adversely affect our operations by causing a temporary shutdown or diversion of patients, causing disruption or delays in supply chains for materials and products or causing staffing shortages in our facilities. Although we have contingency plans in place, including infection control and disaster plans, the potential impact of, as well as the public’s and the government’s response to, a future pandemic, epidemic or outbreak is difficult to predict and could adversely affect our business, results of operations, financial condition and cash flows.

38

Risks related to governmental regulation and other legal matters:

Our business and results of operations may be adversely affected by health care reform efforts. We are unable to predict whether, what, and when additional health reform measures will be adopted or implemented, and the effects and ultimate impact of any such measures are uncertain and may adversely affect our business and results of operations.

In recent years, the U.S. health care industry has undergone significant changes at the federal and state levels, many of which have been aimed at reducing costs and government spending and increasing access to health insurance. The most prominent of these legislative reform efforts is the Affordable Care Act, which affects how health care services are covered, delivered and reimbursed, and expanded health insurance coverage through a combination of public program expansion and private sector health insurance reforms. The Affordable Care Act has been, and continues to be, subject to legislative and regulatory changes and court challenges. For example, effective January 1, 2019, the penalty associated with the individual mandate to maintain health insurance was effectively eliminated. However, some states have imposed individual health insurance mandates, and other states have explored or offer public health insurance options. To increase access to health insurance during the COVID-19 pandemic, the ARPA enhanced subsidies for individuals eligible to purchase coverage through the Exchanges. Subsequent legislation extended these enhanced subsidies through 2025. These and other changes and initiatives may impact the number of individuals that elect to obtain public or private health insurance or the scope of such coverage, if purchased.

There is uncertainty regarding whether, when and how the Affordable Care Act may be further changed, and how the law will be interpreted. Changes by Congress or government agencies could eliminate or alter provisions beneficial to us, while leaving in place provisions reducing our reimbursement or otherwise negatively impacting our business.

There is also uncertainty regarding whether, when, and what other health reform initiatives will be adopted and the impact of such efforts on providers and other health care industry participants. Some members of Congress have proposed measures that would expand government-sponsored coverage, including proposals to expand coverage of federally-funded insurance programs as an alternative to private insurance or establish a single-payer system (such reforms often referred to as “Medicare for All”). CMS administrators may grant states additional flexibility in the administration of state Medicaid programs and make changes to Medicaid payment models. Other recent health reform initiatives and proposals at the federal and state levels include those focused on price transparency and out-of-network charges, which may impact prices, our relationships with patients, payers or ancillary providers (such as anesthesiologists, radiologists and pathologists) and our competitive position. For example, among other consumer protections, the No Surprises Act imposes various requirements on providers and health plans intended to prevent “surprise” medical bills. Some states are considering or have imposed rate-setting measures, including limits on hospital rates, or site-neutral pricing requirements. Trends toward transparency and value-based pricing may impact our competitive position and patient volumes. For example, the CMS Care Compare website makes publicly available certain data on performance of hospitals and other Medicare-certified providers on quality measures and patient satisfaction, and our patient volumes could decline if any of our facilities achieve poor results. Further, Medicare reimbursement for hospitals is adjusted based on quality and efficiency measures. Other industry participants, such as private payers and large employer groups and their affiliates, may also introduce financial or delivery system reforms. We are unable to predict the nature and success of such initiatives. Health care reform initiatives may have an adverse effect on our business, results of operations, cash flow, capital resources and liquidity.

Changes in government health care programs may adversely affect our revenues.

A significant portion of our patient volume is derived from government health care programs, principally Medicare and Medicaid. Specifically, we derived 44.1% of our revenues from the Medicare and Medicaid programs in 2023. Changes in government health care programs, including as a result of health reform efforts, may reduce the reimbursement we receive and could adversely affect our business and results of operations. In addition, in some cases, private third-party payers rely on all or portions of Medicare payment systems to determine payment rates. Changes to government health care programs that reduce payments under these programs may negatively impact payments from private third-party payers.

In recent years, legislative and regulatory changes have resulted in limitations on and, in some cases, reductions in levels of payments to health care providers for certain services under the Medicare program. For example, Congress established automatic spending reductions, referred to as sequestration, under the BCA, resulting in a 2% reduction in Medicare payments that extends through the first seven months of federal fiscal year 2032. In addition, as a result of the ARPA, an additional Medicare payment reduction of up to 4% was required to take effect in January 2022; however, Congress has delayed implementation of this reduction until 2025. These reductions are in addition to reductions mandated by other laws. It is difficult to predict whether, when or what other deficit reduction initiatives may be proposed by Congress, but future legislation may include additional Medicare spending reductions.

39

From time to time, CMS revises the reimbursement systems used to reimburse health care providers, including changes to the inpatient hospital MS-DRG system and other payment systems, which may result in reduced Medicare payments. For example, under a site neutrality policy, clinic visit services provided by off-campus provider-based departments that were formerly paid under the outpatient PPS are now paid under the Physician Fee Schedule. Further, to address past changes to the 340B Drug Pricing Program that were invalidated by the U.S. Supreme Court, CMS finalized payment reductions under the outpatient PPS. Payment rates were reduced for non-drug services in calendar year 2023, and additional reductions to payments for non-drug item and services will take effect in calendar year 2026 and continue for approximately 16 years. As another example, CMS recently finalized changes to the Medicaid fraction of the Medicare DSH payment formula that will result in lower DSH payments for many hospitals. These payment policies and future changes to payment policies may adversely impact our results of operations, and any potential legal challenges to changes may take years to resolve. Payment policies for different types of providers and for various items and services continue to evolve. Congress and/or CMS may implement further changes to reimbursement for items or services that result in payment reductions for other items or services or that otherwise affect our business and operations.

Because most states must operate with balanced budgets and the Medicaid program is often a state’s largest program, some states have enacted or may consider enacting legislation designed to reduce their Medicaid expenditures. Further, many states have also adopted, or are considering, legislation designed to reduce coverage, enroll Medicaid recipients in managed care programs, and/or impose additional taxes on hospitals to help finance or expand the states’ Medicaid systems. Periods of economic weakness may increase the budgetary pressures on many states, and these budgetary pressures may result in decreased spending, or decreased spending growth, for Medicaid programs and the Children’s Health Insurance Program in many states. Some states that provide Medicaid supplemental payments are reviewing these programs or have filed requests with CMS to replace these programs, and CMS has performed and continues to perform compliance reviews of some states’ programs and is considering changes to the requirements for such programs, which could result in Medicaid supplemental payments being reduced or eliminated. We may also be impacted by SDP arrangements, which allow states to direct certain Medicaid managed plan expenditures, particularly as funding may be diverted from other payment programs, and we may not satisfy applicable criteria when payments are directed to a specific subset of providers. Further, legislation and administrative actions at the federal level may impact the funding for, or structure of, the Medicaid program, and may shape the administration of the Medicaid program at the state level. Federal Medicaid policies are subject to change, including as a result of changes in the presidential administration. For example, where states had previously been permitted to condition Medicaid enrollment on work or other community engagement, the approvals of waivers permitting these conditions have been rescinded. However, a federal court is permitting Georgia to impose work and community engagement requirements under a Medicaid demonstration program that launched in mid-2023. Some members of Congress are also reexamining block grant funding structures.

Current or future health care reform and deficit reduction efforts, changes in laws or regulations regarding government health care programs, other changes in the administration of government health care programs and changes by private third-party payers in response to health care reform and other changes to government health care programs could have a material, adverse effect on our financial position and results of operations.

If we fail to comply with extensive laws and government regulations, we could suffer penalties or be required to make significant changes to our operations.

As a participant in the health care industry, we are required to comply with extensive and complex laws and regulations at the federal, state and local government levels relating to, among other things:

•billing and coding for services and properly handling overpayments;

•appropriateness and classification of level and setting of care provided, including proper classification of admissions, observation services and outpatient care;

•certifications of patient eligibility for home health and hospice services;

•relationships with physicians and other referral sources and referral recipients;

•necessity and adequacy of medical care;

•quality of medical equipment and services;

•qualifications of medical and support personnel;

•the confidentiality, maintenance, interoperability, exchange, data breach, identity theft and security of health-related and personal information and medical records;

40

•the development and use of artificial intelligence and other predictive algorithms, including those used in clinical decision support tools;

•screening, stabilization and transfer of individuals who have emergency medical conditions;

•restrictions on the provision of medical care, including with respect to reproductive care;

•licensure, certification and enrollment with government programs;

•the distribution, maintenance and dispensing of pharmaceuticals and controlled substances;

•debt collection, limits or prohibitions on balance billing and billing for out of network services;

•communications with patients and consumers;

•preparing and filing of cost reports;

•operating policies and procedures;

•activities regarding competitors;

•the addition of facilities and services; and

•environmental protection.

Among these laws are the federal Anti-kickback Statute, EKRA, the federal Stark Law, the FCA, the No Surprises Act and similar state laws. We have a variety of financial relationships with physicians and others who either refer or influence the referral of patients to our hospitals, other health care facilities, laboratories and employed physicians or who are the recipients of referrals, and these laws govern those relationships. The OIG has enacted safe harbor regulations that outline practices deemed protected from prosecution under the Anti-kickback Statute. While we endeavor to comply with the applicable safe harbors, certain of our current arrangements, including joint ventures and financial relationships with physicians and other referral sources and persons and entities to which we refer patients, do not qualify for safe harbor protection. Failure to qualify for a safe harbor does not mean the arrangement necessarily violates the Anti-kickback Statute but may subject the arrangement to greater scrutiny. However, we cannot offer assurance that practices outside of a safe harbor will not be found to violate the Anti-kickback Statute. Allegations of violations of the Anti-kickback Statute may be brought under the federal Civil Monetary Penalty Law, which requires a lower burden of proof than other fraud and abuse laws, including the Anti-kickback Statute.

Our financial relationships with referring physicians and their immediate family members must comply with the Stark Law by meeting an exception. We attempt to structure our relationships to meet an exception to the Stark Law, but the regulations implementing the exceptions are detailed and complex and are subject to continuing legal and regulatory change. Thus, we cannot provide assurance that every relationship complies fully with the Stark Law. Unlike the Anti-kickback Statute, failure to meet an exception under the Stark Law results in a violation of the Stark Law, even if such violation is technical in nature.

Additionally, if we violate the Anti-kickback Statute or Stark Law, or if we improperly bill for our services, we may be found to violate the FCA, either under a suit brought by the government or by a private person under a qui tam, or “whistleblower,” suit. See Item 1, “Business — Regulation and Other Factors.”

We develop software programs utilizing machine learning/artificial intelligence for use within our network to improve care and may also use similar technologies in other capacities. Jurisdictions worldwide are proposing laws and regulations on the use of artificial intelligence and machine learning applications and tools, particularly on the use of artificial intelligence to facilitate health care, employment, or hiring decisions. For example, in 2023, HHS finalized transparency requirements for artificial intelligence and other predictive algorithms used in certified health information technology, such as decision support interventions. In some cases, software can be considered a medical device under the federal Food, Drug, and Cosmetic Act (“FDCA”). Medical devices are subject to extensive regulation by the Food and Drug Administration (“FDA”) under the FDCA. In September 2022, FDA issued non-binding final guidance that describes the types of clinical decision support software that FDA will regulate as a medical device, potentially including software programs that were not previously treated as medical devices. Application of the new guidance may result in our current and/or future software programs providing clinical decision support being subject to FDA regulation. If FDA determines that any of our software programs are medical devices under the FDCA, the distribution and/or use of those software programs may require premarket approval or clearance, and we may be required to cease distribution and/or use of such programs until we obtain any required premarket approval or clearance, which could adversely affect our

41

operations. Failure to seek FDA approval or clearance or noncompliance with other applicable FDA requirements could adversely affect our business, financial condition or results of operations.

We also operate health care facilities in the United Kingdom and have operations and commercial relationships with companies in other foreign jurisdictions and, as a result, are subject to certain U.S. and foreign laws applicable to businesses generally, including anti-corruption and anti-bribery laws. The Foreign Corrupt Practices Act regulates U.S. companies in their dealings with foreign officials, prohibiting bribes and similar practices, and requires that they maintain records that fairly and accurately reflect transactions and appropriate internal accounting controls. In addition, the United Kingdom Bribery Act has wide jurisdiction over certain activities occurring within the United Kingdom.

A variety of state, national, foreign and international laws and regulations apply to the collection, use, retention, protection, security, disclosure, transfer and other processing of personal information. Various states, including California, Colorado, Connecticut, Utah and Virginia, have passed privacy laws and regulations that impose restrictive requirements on the use and disclosure of personal information, and many other state and federal privacy laws have been proposed. In many cases, these laws are more restrictive or impose more obligations than, and may not be preempted by, the HIPAA privacy and security regulations, may apply to employees and business contacts in addition to patients, and may be subject to new and varying interpretations by courts and government agencies, creating complex compliance issues and potentially exposing us to additional expense, adverse publicity and liability. The potential effects of these laws are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in order to comply. Failure to comply with these and any other comprehensive privacy laws passed at the state or federal level may result in regulatory enforcement action and damage to our reputation. In the United Kingdom, we are subject to the UK Data Protection Legislation, which contains stricter privacy restrictions than laws and regulations in the United States and provides for significant fines in the event of violations. These administrative fines are based on a multi-factored approach. Moreover, rules for data transfers outside of the United Kingdom and European Economic Area are subject to increased regulation, and such regulations are frequently subject to further revision and updated regulator guidance, making necessary compliance measures challenging to ascertain and implement with respect to our United Kingdom operations. We expect that there will continue to be new or modified laws, regulations, regulatory guidance and industry standards concerning privacy, data protection and information security proposed and enacted in various jurisdictions, which could impact our operations and cause us to incur substantial costs.

We send short message service, or SMS, text messages to patients. While we obtain consent from these individuals to send text messages, federal or state regulatory authorities or private litigants may claim that the notices and disclosures we provide, form of consents we obtain or our SMS texting practices are not adequate or violate applicable law. In addition, we must ensure that our SMS texting practices comply with regulations and agency guidance under the Telephone Consumer Protection Act (the “TCPA”), a federal statute that protects consumers from unwanted telephone calls, faxes and text messages. While we strive to adhere to strict policies and procedures that comply with the TCPA, the Federal Communications Commission, as the agency that implements and enforces the TCPA, may disagree with our interpretation of the TCPA and subject us to penalties and other consequences for noncompliance. Determination by a court or regulatory agency that our SMS texting practices violate the TCPA could subject us to civil penalties and could require us to change some portions of our business. Even an unsuccessful challenge by patients or regulatory authorities of our activities could result in adverse publicity and could require a costly response from and defense by us. Moreover, if wireless carriers or their trade associations, which issue guidelines for texting programs, determine that we have violated their guidelines, our ability to engage in texting programs may be curtailed or revoked, which could impact our operations and cause us to incur costs related to implementing a workaround solution.

We engage in consumer debt collection for HCA-affiliated hospitals and certain non-affiliated hospitals. We also engage in credit reporting for certain non-affiliated hospitals. The federal Fair Debt Collection Practices Act, the Fair Credit Reporting Act and the TCPA restrict the methods that companies may use to contact and seek payment from consumer debtors regarding past due accounts and to report to consumer reporting agencies on the status of those accounts. Many states impose additional limitations or requirements on debt collection and credit reporting practices, and some of those requirements are more stringent than the federal requirements.

Finally, we are subject to various federal, state and local statutes and ordinances regulating the discharge of materials into the environment. For example, our health care operations generate medical waste, such as pharmaceuticals, biological materials and disposable medical instruments that must be handled, stored, transported, treated and disposed of in compliance with federal, state and local environmental laws and regulations. Environmental regulations also may apply when we build new facilities or renovate existing facilities. If we are found not to be in compliance with such laws and regulations, we may be liable for significant investigation and clean-up costs or be subject to enforcement actions by governmental authorities or lawsuits by private plaintiffs. Moreover, any changes in the environmental regulatory framework (including legislative or regulatory efforts designed to address climate change) could have a material, adverse effect on our business.

42

If we fail to comply with these or other applicable laws and regulations, which are subject to change, we could be subject to liabilities, including civil penalties, money damages, lapses in reimbursement, the loss of our licenses to operate one or more facilities, exclusion of one or more facilities from participation in the Medicare, Medicaid and other federal and state health care programs, civil lawsuits and criminal penalties. In addition, different interpretations or enforcement of, or amendments to, these and other laws and regulations in the future could subject our current or past practices to allegations of impropriety or illegality or could require us to make changes in our facilities, equipment, personnel, services, capital expenditure programs and operating expenses. The costs of compliance with, and the other burdens imposed by, these and other laws or regulatory actions may increase our operational costs, result in interruptions or delays in the availability of systems and/or result in a patient volume decline. We may also face audits or investigations by one or more domestic or foreign government agencies relating to our compliance with these regulations. An adverse outcome under any such investigation or audit, a determination that we have violated these or other laws or a public announcement that we are being investigated for possible violations could result in liability, could result in negative publicity and could adversely affect our business, financial condition, results of operations or prospects.

State efforts to regulate the construction or expansion of health care facilities could impair our ability to operate and expand our operations.

Some states, particularly in the eastern part of the country, require health care providers to obtain prior approval, often known as a CON, for the purchase, construction or expansion of health care facilities, to make certain capital expenditures or to make changes in services or bed capacity. In giving approval, these states consider the need for additional or expanded health care facilities or services. We currently operate health care facilities in a number of states with CON laws or that require other types of approvals for the establishment or expansion of certain facility types or services. The failure to obtain any required CON or other required approval could impair our ability to operate or expand operations. Any such failure could, in turn, adversely affect our ability to attract patients and physicians to our facilities and grow our revenues, which would have an adverse effect on our results of operations.

We may incur additional tax liabilities.

We are subject to tax in the United States as well as those states and foreign jurisdictions in which we do business. Changes in tax laws, including increases in tax rates, or interpretations of tax laws by taxing authorities or other standard setting bodies could increase our tax obligations and have a material, adverse impact on our results of operations.

We are also subject to examination by federal, state and foreign taxing authorities. Management believes HCA Healthcare, Inc., its predecessors, subsidiaries and affiliates properly reported taxable income and paid taxes in accordance with applicable laws and agreements established with the Internal Revenue Service (“IRS”), state and foreign taxing authorities and final resolution of any disputes will not have a material, adverse effect on our results of operations or financial position. However, if payments due upon final resolution of any issues exceed our recorded estimates, such resolutions could have a material, adverse effect on our results of operations or financial position.

We have been and could become the subject of government investigations, claims and litigation, as well as governmental and commercial payer audits.

Health care companies are subject to numerous investigations by various government agencies. Further, under the FCA, private parties have the right to bring qui tam, or “whistleblower,” suits against companies that submit false claims for payments to, or improperly retain overpayments from, the government. Some states have adopted similar state whistleblower and false claims provisions. Certain of our individual facilities and/or affiliates have received, and other facilities and/or affiliates may receive, government inquiries from, and may be subject to investigation by, federal and state agencies. Depending on whether the underlying conduct in these or future inquiries or investigations could be considered systemic, their resolution could have a material, adverse effect on our financial position, results of operations and liquidity.

Government agencies and their agents, such as the MACs, fiscal intermediaries and carriers, as well as the OIG, CMS and state Medicaid programs, conduct audits of our health care operations. CMS and state Medicaid agencies contract with RACs and other contractors on a contingency fee basis to conduct post-payment reviews to detect and correct improper payments in the Medicare program, including managed Medicare plans, and the Medicaid programs. RAC denials are appealable; however, in recent years, there have been significant delays in the Medicare appeals process. Although HHS has improved efficiency and effectively eliminated a years-long backlog, we may nevertheless experience delays in appealing RAC payment denials. Private third-party payers may conduct similar post-payment audits, and we also perform internal audits and monitoring. Depending on the nature of the conduct found in such audits and whether the underlying conduct could be considered systemic, the resolution of these audits could have a material, adverse effect on our financial position, results of operations and liquidity.

43

Should we be found out of compliance with applicable laws, regulations or programs, depending on the nature of the findings, our business, our financial position and our results of operations could be negatively impacted.

We may be subject to liabilities from claims brought against our facilities, which are costly to defend and may require us to pay significant damages if not covered by insurance.

We are subject to litigation relating to our business practices, including claims and legal actions by patients and others in the ordinary course of business alleging malpractice, product liability or other legal theories. Many of these actions seek large sums of money as damages and involve significant defense costs. We insure a portion of our professional liability risks through our insurance subsidiary. Management believes our reserves for self-insured retentions and insurance coverage are sufficient to cover insured claims arising out of the operation of our facilities, although some claims may exceed the scope or amount of the coverage limits of our insurance policies. Our insurance subsidiary has entered into certain reinsurance contracts; however, the subsidiary remains liable to the extent that the reinsurers do not meet their obligations under the reinsurance contracts. If payments for claims exceed actuarially determined estimates, are not covered by insurance, or reinsurers, if any, fail to meet their obligations, our results of operations and financial position could be adversely affected.

Risks related to operations, strategy, demand and competition:

Our hospitals and other facilities face competition for patients from other hospitals and health care providers.

The health care business is highly competitive, and competition among hospitals and other health care providers for patients has intensified in recent years. Generally, other hospitals and health care facilities in the communities we serve provide services similar to those we offer. Trends toward transparency and value-based purchasing may have an impact on our competitive position, ability to obtain and maintain favorable contract terms and patient volumes in ways that are difficult to predict. CMS publicizes on its Care Compare website performance data related to quality measures and data on patient satisfaction surveys that hospitals, home health agencies, hospices and various other types of Medicare-certified facilities submit in connection with their Medicare reimbursement. The Care Compare website provides an overall rating that synthesizes various quality measures into a star rating for each hospital, home health agency and hospice. If any of our hospitals or other provider types achieve poor results (or results that are lower than our competitors) on quality measures or on patient satisfaction surveys, our competitive position could be negatively affected. Further, hospitals are required to publish online a list of their standard charges for all items and services, including discounted cash prices and payer-specific and de-identified negotiated charges, and must also publish a consumer-friendly list of standard charges for certain “shoppable” services or, alternatively, maintain an online price estimator tool for the shoppable services. HHS also requires health insurers to publish online charges negotiated with providers for health care services, and health insurers must provide online price comparison tools to help individuals get personalized cost estimates for covered items and services. The No Surprises Act imposes additional price transparency requirements, including requiring providers to send uninsured or self-pay patients (in advance of the date of the scheduled item or service or upon request) and health plans (prior to the scheduled date of the item or service) of insured patients a good faith estimate of the expected charges and diagnostic codes. HHS is deferring enforcement of certain requirements of the No Surprises Act applicable to providing estimates for insured individuals and providing estimates to uninsured or self-pay patients that do not include expected charges for co-providers or co-facilities. It is not entirely clear how price transparency requirements will affect consumer behavior, our relationships with payers or our ability to set and negotiate prices, but our competitive position could be negatively affected if our standard charges are higher or are perceived to be higher than the charges of our competitors.

The number of freestanding specialty hospitals, surgery centers, emergency departments, urgent care centers and diagnostic and imaging centers in the geographic areas in which we operate has increased. Many individuals are seeking a broader range of services at outpatient facilities as a result of the growing availability of stand-alone outpatient health care facilities, the increase in payer reimbursement policies that restrict inpatient coverage and the increase in the services that can be provided on an outpatient basis, including high margin services. Consequently, most of our hospitals operate in a highly competitive environment, which may put pressure on our pricing, ability to contract with third-party payers and strategy for volume growth. Some of the facilities that compete with our hospitals are physician-owned or are owned by governmental agencies or not-for-profit corporations supported by endowments, charitable contributions or tax revenues and can finance capital expenditures and operations on a tax-exempt basis. Recent consolidations of not-for-profit hospital entities may intensify this competitive pressure. There is also increasing consolidation in the third-party payer industry, including vertical integration efforts among third-party payers and health care providers, and increasing efforts by payers to influence or direct the patient’s choice of provider by the use of narrow networks or other strategies. Health care industry participants are increasingly implementing physician alignment strategies, such as employing physicians, acquiring physician practice groups and participating in ACOs or other clinical integration models. Other industry participants, such as large employer groups and their affiliates and large retail chains, may intensify competitive pressure and affect the industry in ways that are difficult to predict.

44

Our hospitals compete with specialty hospitals and with freestanding ASCs and other outpatient providers for market share in certain high margin services and for quality physicians and personnel. If ASCs and other outpatient providers are better able to compete in this environment than our hospitals, our hospitals may experience a decline in patient volume, and we may experience a decrease in operating margin. In states that do not require a CON or other type of approval for the purchase, construction or expansion of health care facilities or services, competition in the form of new services, facilities and capital spending is more prevalent. Some states that have historically imposed CON or similar prior approval requirements have removed or are considering removing these requirements, which may reduce barriers to entry and increase competition in our service areas. Changes in licensure or other regulations and recognition of new provider types or payment models could also impact our competitive position. If our competitors are better able to attract patients, make capital expenditures and maintain modern and technologically upgraded facilities and equipment, recruit physicians, expand services or obtain favorable third-party payer contracts at their facilities than our hospitals and other providers, we may experience an overall decline in patient volume. See Item 1, “Business — Competition.”

Any increase in the volume of uninsured patients or deterioration in the collectability of uninsured and patient due accounts could adversely affect our results of operations.

The primary collection risks for our accounts receivable relate to the uninsured patient accounts and patient accounts for which the primary third-party payer has paid the amounts covered by the applicable agreement, but patient responsibility amounts (exclusions, deductibles and copayments) remain outstanding. At December 31, 2023, estimated implicit price concessions of $7.283 billion had been recorded to adjust our revenues and accounts receivable to the estimated amounts we expect to collect. The estimated cost of total uncompensated care was $3.720 billion for 2023, $3.491 billion for 2022 and $3.350 billion for 2021.

Any increase in the volume of uninsured patients or deterioration in the collectability of uninsured and self-pay accounts receivable could adversely affect our cash flows and results of operations. Our facilities may experience growth in total uncompensated care as a result of a number of factors, including conditions impacting the overall economy and unemployment levels. In addition, federal and state legislatures have in recent years considered or passed various proposals impacting the size of the uninsured or underinsured population. For example, under early COVID-19-related legislation, states that maintained continuous Medicaid enrollment were eligible for a temporary increase in federal funds for state Medicaid expenditures. The resumption of redeterminations for Medicaid enrollees in 2023 resulted in significant coverage disruptions and dis-enrollments of Medicaid enrollees, and Medicaid enrollment is generally expected to continue to decline through mid-year 2024. It is difficult to predict what, if any, and when legislative and regulatory changes may be made in the future.

We provide uninsured discounts and charity care for individuals, including for those residing in states that choose not to implement the Medicaid expansion or that modify the terms of the program, for undocumented aliens who are not permitted to enroll in an Exchange plan or government health care programs and for certain others who may not have insurance. Some patients may choose to enroll in lower cost Medicaid plans or other health insurance plans with lower reimbursement levels. We may also be adversely affected by the growth in patient responsibility accounts as a result of increases in the adoption of health plan structures that shift greater payment responsibility for care to individuals through greater exclusions and copayment and deductible amounts. Further, our ability to collect patient responsibility accounts may be limited by statutory, regulatory and investigatory initiatives, including private lawsuits directed at hospital charges and collection practices for uninsured and underinsured patients. For example, the No Surprises Act requires providers to send uninsured and self-pay patients a good faith estimate of expected charges for items and services. The estimate must cover items and services that are reasonably expected to be provided together with the primary item or services, including those that may be provided by other providers. If the uninsured or self-pay patient receives a bill that exceeds the good faith estimate by an amount deemed to be substantial by regulation (which is currently $400) or the provider furnishes an item or service that was not included in the good faith estimate, they may initiate a patient-provider dispute resolution process established by regulation.

If our volume of patients with private health insurance coverage declines or we are unable to retain and negotiate favorable contracts with private third-party payers, including managed care plans, our revenues may be adversely affected.

Broad economic factors, including inflationary pressures, supply chain disruptions, labor shortages, recessions, increased unemployment and underemployment rates and reduced consumer spending and confidence, the continued shift of care to an outpatient setting and the aging population may impact our revenue mix. Private third-party payers, including HMOs, PPOs and other managed care plans, typically reimburse health care providers at a higher rate than Medicare, Medicaid or other government health care programs. Reimbursement rates are set forth by contract when our facilities are in-network, and payers utilize plan structures to encourage or require the use of in-network providers. Revenues derived

45

from private third-party payers (domestic only) accounted for 49.0%, 48.3% and 51.6% of our revenues for 2023, 2022 and 2021, respectively. Our ability to maintain or increase patient volumes covered by private third-party payers and to maintain and obtain favorable contracts with private third-party payers significantly affects the revenues and operating results of our facilities.

Private third-party payers, including managed care plans and payers participating in the Exchanges, continue to demand discounted fee structures, and the ongoing trend toward consolidation among payers tends to increase their bargaining power over fee structures. Payers may utilize plan structures such as narrow networks and tiered networks that limit beneficiary provider choices, impose significantly higher cost sharing obligations when care is obtained from providers in a disfavored tier or otherwise shift greater financial responsibility for care to individuals. Legislative and regulatory initiatives may accelerate or otherwise impact these trends.

Other health care providers may impact our ability to enter into managed care contracts or negotiate increases in our reimbursement and other favorable terms and conditions. For example, some of our competitors may negotiate exclusivity provisions with managed care plans or otherwise restrict the ability of managed care plans to contract with us. In addition to increasing negotiating leverage of private third-party payers, alignment efforts between third-party payers and health care providers may result in other competitive advantages, such as greater access to performance and pricing data. Our future success will depend, in part, on our ability to retain and renew our third-party payer contracts and enter into new contracts on terms favorable to us, which may be impacted by price transparency initiatives. For example, the No Surprises Act requires providers to send health plans of insured patients a good faith estimate of the expected charges and diagnostic codes prior to the scheduled date of the service or item. Further, hospitals are required to publish online payer-specific negotiated charges and de-identified minimum and maximum charges. In addition, health insurers are required to provide online price comparison tools to help individuals get personalized cost estimates for covered items and services. Cost-reduction strategies by large employer groups and their affiliates, such as directly contracting with a limited number of providers, may also limit our ability to negotiate favorable terms in our contracts and otherwise intensify competitive pressure. It is not clear what impact, if any, these and future health reform efforts will have on our ability to negotiate reimbursement increases and participate in third-party payer networks on favorable terms. If we are unable to retain and negotiate favorable contracts with third-party payers or experience reductions in payment increases or amounts received from third-party payers, our revenues may be reduced.

Our revenues may be reduced if we experience growth in self-pay volume. In recent years, federal and state legislatures have considered or passed various proposals potentially impacting the size of the uninsured population. The number and identity of states that choose to expand or otherwise modify Medicaid programs and the terms of expansion and other program modifications continue to evolve. Some states have imposed individual health insurance mandates with financial penalties for noncompliance. Other states have explored or offer public health insurance options. These variables, among others, make it difficult to predict the number of uninsured individuals.

Changes to physician utilization practices and treatment methodologies and other factors outside our control that impact demand for medical services may reduce our revenues.

Volume, admission and case-mix trends may be impacted by factors beyond our control, such as changes in volume of certain high acuity services, variations in the prevalence and severity of outbreaks of influenza and other illnesses, such as COVID-19, and medical conditions, seasonal and severe weather conditions, changes in treatment regimens and medical technology and other advances. Further, trends in physician treatment protocols and health plan design, such as health plans that shift increased costs and accountability for care to patients, could reduce our surgical volumes and admissions in favor of lower intensity and lower cost treatment methodologies or result in patients seeking care from other providers. Additionally, our operations may be impacted by expansion of in-home acute care models, and our inpatient volumes may decline if various inpatient hospital procedures become eligible for reimbursement by Medicare when performed in outpatient settings. These and other factors beyond our control may reduce the demand for services we offer and decrease the reimbursement that we receive, which could have a material, adverse effect on our business, financial position and results of operations.

Third-party payer controls designed to reduce costs and other payer practices intended to decrease inpatient services, surgical procedure volumes or reimbursement for services rendered may reduce our revenues.

Controls imposed by Medicare, managed Medicare, Medicaid, managed Medicaid and private third-party payers designed to reduce admissions, intensity of services, surgical volumes and lengths of stay, in some instances referred to as “utilization review,” have affected and are expected to increasingly affect our facilities. Utilization review entails the review of the admission and course of treatment of a patient by third-party payers, and may involve prior authorization requirements. The Medicare program also issues national or local coverage determinations that restrict the circumstances

46

under which Medicare pays for certain services. Inpatient utilization, average lengths of stay and occupancy rates continue to be negatively affected by third-party payers’ preadmission authorization requirements, coverage restrictions, utilization review and by pressure to maximize outpatient and alternative health care delivery services for less acutely ill patients. Cost control efforts have resulted in an increase in reimbursement denials and delays by governmental and commercial payers, which may increase costs and administrative burden for providers and decrease the reimbursement we receive. Efforts to impose more stringent cost controls are expected to continue and may have a material, adverse effect on our business, financial condition and results of operations.

We may encounter difficulty acquiring hospitals and other health care businesses, encounter challenges integrating the operations of acquired hospitals and other health care businesses and/or become liable for unknown or contingent liabilities as a result of acquisitions.

A component of our business strategy is acquiring hospitals and other health care businesses. We may encounter difficulty acquiring new facilities or other businesses due to a lack of attractive opportunities or as a result of competition from other purchasers that may be willing to pay purchase prices that are higher than we believe are reasonable. Antitrust enforcement in the health care industry is currently a priority of the Federal Trade Commission and the DOJ, including with respect to hospital and physician practice acquisitions. Some states require CONs in order to acquire a hospital or other facility, or to expand facilities or services. In addition, the acquisition of health care facilities often involves licensure approvals or reviews and complex change of ownership processes for Medicare and other payers. Further, many states have laws that restrict the conversion or sale of not-for-profit hospitals to for-profit entities. These laws may require prior approval from the state attorney general, advance notification of the attorney general or other regulators and community involvement. Attorneys general in states without specific requirements may exercise broad discretionary authority over transactions involving the sale of not-for-profits under their general obligations to protect the use of charitable assets. These legislative and administrative efforts often focus on the appropriate valuation of the assets divested and the use of the proceeds of the sale by the non-profit seller and may include consideration of commitments for capital improvements and charity care by the purchaser. Similarly, some states require disclosures by certain health care entities, including hospitals and physician practices, to state attorneys general or other designated entities in advance of sales or other transactions. Also, the increasingly challenging regulatory and enforcement environment may negatively impact our ability to acquire health care businesses if they are found to have material unresolved compliance issues, such as repayment obligations. Resolving compliance issues as well as completion of oversight, review or approval processes could seriously delay or even prevent our ability to acquire hospitals or other businesses and increase our acquisition costs.

We may be unable to timely and effectively integrate hospitals and other businesses that we acquire with our ongoing operations, or we may experience delays implementing operating procedures and systems. Hospitals and other health care businesses that we acquire may have unknown or contingent liabilities, including liabilities for failure to comply with health care and other laws and regulations, medical and general professional liabilities, workers’ compensation liabilities and tax liabilities. Although we typically exclude significant liabilities from our acquisition transactions and seek indemnification from the sellers for these matters, we could experience difficulty enforcing those obligations, experience liability in excess of any indemnification obtained or otherwise incur material liabilities for the pre-acquisition conduct of acquired businesses. Such liabilities and related legal or other costs could harm our business and results of operations.

47

Our facilities are heavily concentrated in Florida and Texas, which makes us sensitive to regulatory, economic, public health, environmental and competitive conditions and changes in those states.

We operated 186 hospitals at December 31, 2023, and 96 of those hospitals are located in Florida and Texas. Our Florida and Texas facilities’ combined revenues represented 51% of our consolidated revenues for the year ended December 31, 2023. This geographic concentration makes us particularly sensitive to regulatory, economic, public health, environmental and competitive conditions in those states. Any material change in the current payment programs or regulatory, economic, public health, environmental or competitive conditions in those states could have a disproportionate effect on our overall business results.

Our business and operations are subject to risks related to climate change.

Global climate change presents both immediate and long-term physical risks (such as potential increases in the intensity or frequency of hurricanes, extreme weather conditions or other natural disasters) and risks associated with the transition to a low-carbon economy (such as regulatory or technology changes). These changes could result in, for example, temporary declines in the number of patients seeking our services, closures of our hospitals and related facilities, supply chain disruptions, increased costs of products, commodities and energy (including utilities) and disruptions in our information systems, which in turn could negatively impact our business and results of operations. In addition, our hospitals and other facilities in Florida, Texas and other coastal states are located in regions that may be impacted by hurricanes. In the past, hurricanes have had a disruptive effect on the operations of our hospitals and other facilities in Florida, Texas and other coastal states and the patient populations in those states. Global climate change could also increase the intensity or frequency of hurricanes, extreme weather conditions or other natural disasters. Our business activities could be harmed by a particularly active hurricane season or even a single storm. We face the risk of losses incurred as a result of physical damage to our hospitals and related facilities and business interruptions caused by such events. We maintain property insurance coverage for claims in excess of deductibles and self-insured retention levels generally at $110 million per occurrence to address the impact of physical damage to our facilities and for business interruption losses. However, such insurance coverage may be insufficient to cover our losses in excess of what we self-insure, and we may experience a material, adverse effect on our results of operations that is not recoverable through our insurance policies. Additionally, if we experience a significant increase in climate-related events that result in material losses we may be unable to obtain similar levels of property insurance coverage in the future.

In addition, changes in consumer preferences and additional legislation and regulatory requirements, including those associated with the transition to a low-carbon economy, may increase costs associated with compliance, the operation of our facilities and supplies. Regulations limiting greenhouse gas emissions and energy inputs may also increase in coming years, which may adversely impact us through increased compliance costs for us and our suppliers and vendors. Our response to climate change, our climate change strategies, policies, objectives, commitments and disclosure, our ability to achieve our climate-related objectives and commitments (which are subject to risks and uncertainties, many of which are outside of our control) and/or any perception that our response is ineffective or inefficient, or conversely, not in the best interests of the Company could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence.

We may be adversely affected if we are not able to achieve our environmental, social and governance (“ESG”) objectives or otherwise meet the expectations of our stakeholders with respect to ESG matters.

We strive to deliver shared value through our business, and our diverse stakeholders expect us to make significant progress with respect to certain ESG-related matters. From time to time, we announce certain aspirations and objectives relevant to our priority ESG matters. We periodically publish information about our ESG priorities, strategies, objectives and progress on our corporate website and update our ESG reporting. For example, we publish our Annual Sustainability Report, which has information about our climate-related objectives and initiatives and progress made during the prior year. Achievement of these aspirations, plans and objectives is subject to risks and uncertainties, many of which are outside of our control, and it is possible that we may not achieve, or be perceived to have not achieved, our ESG objectives or that certain of our stakeholders might not be satisfied or agree with our efforts, which could result in reputational harm as a result of negative public sentiment, regulatory scrutiny, litigation and reduced investor and stakeholder confidence.

Standards for tracking and reporting ESG matters continue to evolve. Our selection of voluntary disclosure frameworks and standards, and the interpretation or application of those frameworks and standards, may change from time to time or differ from those of others. This may result in a lack of consistent or meaningful comparative data from period to period or between us and other companies in the same industry. In addition, our processes and controls may not always comply with evolving standards for identifying, measuring and reporting ESG metrics, including ESG-related disclosures that may be required of public companies by the SEC, and such standards may change over time, which could result in significant revisions to our current objectives, reported progress in achieving such objectives, or ability to achieve such objectives in the future. A delay or inability to meet our objectives and aspirations, comply with international, federal

48

or state ESG laws and regulations, or meet evolving and varied stakeholder expectations and standards could adversely affect public perception of our business, employee morale or patient or shareholder support; necessitate the expenditure of additional corporate resources; result in substantial costs and expenses; give rise to legal or regulatory proceedings against the Company and negatively impact our financial condition and results of operations. Certain challenges we face in the achievement of our ESG objectives are also captured within our ESG reporting, including the Annual Sustainability Report, which is not incorporated by reference into and does not form any part of this Annual Report on Form 10-K or our other filings with the SEC.

The industry trend toward value-based purchasing may negatively impact our revenues.

There is a trend in the health care industry toward value-based purchasing of health care services. These value-based purchasing programs include both public reporting of quality data and preventable adverse events tied to the quality and efficiency of care provided by facilities. For example, Medicare requires hospitals, ASCs, home health agencies, hospices and other providers to report certain quality data to receive full reimbursement updates. In addition, Medicare does not reimburse for care related to certain preventable adverse events (also called “never events”), and federal law prohibits the use of federal funds under the Medicaid program to reimburse providers for medical assistance provided to treat HACs. The 25% of hospitals with the worst risk-adjusted HAC scores in the designated performance period receive a 1% reduction in their inpatient PPS Medicare payments in the applicable federal fiscal year.

Hospitals with excess readmission rates for conditions designated by CMS receive a reduction in their inpatient PPS operating Medicare payments for all Medicare inpatient discharges in the federal fiscal year, not just discharges relating to the conditions subject to the excess readmission standard. The reduction in payments to hospitals with excess readmissions can be up to 3% of a hospital’s base payments.

CMS has implemented a value-based purchasing program for inpatient hospital services that reduces inpatient hospital payments for all discharges by 2% in each federal fiscal year. CMS pools the amount collected from these reductions to fund payments to reward hospitals that meet or exceed certain quality performance standards established by CMS. CMS scores each hospital based on achievement (relative to other hospitals) and improvement (relative to the hospital’s own past performance). Hospitals that meet or exceed the quality performance standards will receive greater reimbursement under the value-based purchasing program than they would have otherwise.

In the post-acute care space, home health agencies participate in the nationwide HHVBP Model. Under the model, home health agencies receive increases or reductions to their Medicare fee-for-service payments of up to 5%, based on performance against specific quality measures relative to the performance of other home health providers. Data collected in each performance year affects Medicare payments two years later.

CMS has developed several alternative payment models that are intended to reduce costs and improve quality of care for Medicare beneficiaries and has signaled its intent to have states apply similar strategies in the Medicaid context. Examples of alternative payment models include bundled payment models in which, depending on whether overall CMS spending per episode exceeds or falls below a target specified by CMS and whether quality standards are met, hospitals may receive supplemental Medicare payments or owe repayments to CMS. Generally, participation in bundled payment programs is voluntary, but CMS currently requires hospitals in selected markets to participate in a bundled payment initiative for specified orthopedic procedures and in a model for end-stage renal disease treatment. In addition, a mandatory radiation oncology model was expected to begin January 1, 2023, but CMS has indefinitely delayed its implementation. CMS has indicated that it is developing more voluntary and mandatory bundled payment models. Participation in mandatory or voluntary demonstration projects, particularly demonstrations with the potential to affect payment, may negatively impact our results of operations.

In a strategic report issued in 2021 and updated in 2022, the CMS Innovation Center highlighted the need to accelerate the movement to value-based care and drive broader system transformation. By 2030, the CMS Innovation Center aims to have all fee-for-service Medicare beneficiaries and the vast majority of Medicaid beneficiaries in an accountable care relationship with providers who are responsible for quality and total medical costs. The CMS Innovation Center signaled its intent to streamline its payment models and to increase provider participation through implementation of more mandatory models.

There are also several state-driven value-based care initiatives. For example, some states have aligned quality metrics across payers through legislation or regulation. Some private third-party payers are also transitioning toward alternative payment models or implementing other value-based care strategies. For example, many large private third-party payers currently require hospitals to report quality data, and several private third-party payers do not reimburse

49

hospitals for certain preventable adverse events. Further, we have implemented a policy pursuant to which we do not bill patients or third-party payers for fees or expenses incurred due to certain preventable adverse events.

We expect value-based purchasing programs, including programs that condition reimbursement on patient outcome measures, to become more common and to involve a higher percentage of reimbursement amounts. It is unclear whether these and other alternative payment models will successfully coordinate care and reduce costs or whether they will decrease aggregate reimbursement. We are unable to predict our future payments or whether we will be subject to payment reductions under these programs or how this trend will affect our results of operations. If we are unable to meet or exceed the quality performance standards under any applicable value-based purchasing program, perform at a level below the outcomes demonstrated by our competitors, or otherwise fail to effectively provide or coordinate the efficient delivery of quality health care services, our reputation in the industry may be negatively impacted, we may receive reduced reimbursement amounts and we may owe repayments to payers, causing our revenues to decline.

Risks related to macroeconomic conditions:

Our overall business results may suffer during periods of general economic weakness or recessions.

Our business is impacted by economic conditions in the United States, including periods of significant inflation, higher interest rates or economic weakness or recessions. Also, budget deficits at the federal level and within some state and local government entities have had a negative impact on spending and may continue to negatively impact spending for health and human service programs, including Medicare, Medicaid and similar programs, which represent significant third-party payer sources for our hospitals. We anticipate that the federal deficit, the growing magnitude of Medicare and Medicaid expenditures and the aging of the U.S. population will continue to place pressure on government health care programs, and it is possible that future deficit reduction legislation will mandate additional Medicare spending reductions. Other risks we face during periods of economic weakness and high unemployment include potential declines in the population covered under managed care agreements, increased patient decisions to postpone or cancel elective and nonemergency health care procedures (including delaying surgical procedures), which may lead to poorer health and higher acuity interventions, potential increases in the uninsured and underinsured populations, increased adoption of health plan structures that shift financial responsibility to patients and further difficulties in collecting patient receivables for copayment and deductible receivables. Further, inflationary pressures may increase operating expenses faster than reflected in updates to the reimbursement systems of governmental and private payers. General economic conditions, including inflation, when worsening or remaining volatile for an extended period of time, have and could continue to have, a negative impact on our results of operations, liquidity, ability to repay our outstanding debt and trading price of our common stock. These factors may affect the availability, terms or timing on which we may obtain any additional funding and our ability to access our cash. There can be no assurance that we will be able to raise additional funds on terms acceptable to us, if at all.

We are exposed to market risk related to changes in the market values of securities and interest rates.

We are exposed to market risk related to changes in market values of securities. The investment securities held by our insurance subsidiaries were $564 million at December 31, 2023. These investments are carried at fair value, with changes in unrealized gains and losses related to factors other than credit loss allowances being recorded as adjustments to other comprehensive income. At December 31, 2023, we had net unrealized losses of $28 million on the insurance subsidiaries’ investment securities.

We are exposed to market risk related to market illiquidity. Investment securities of our insurance subsidiaries could be impaired by the inability to access the capital markets. Should the insurance subsidiaries require significant amounts of cash in excess of normal cash requirements to pay claims and other expenses on short notice, we may have difficulty selling these investments in a timely manner or be forced to sell them at a price less than what we might otherwise have been able to in a normal market environment. We may be required to recognize credit-related impairments on long-term investments in future periods should issuers default on interest payments or should the fair market valuations of the securities deteriorate due to ratings downgrades or other issue specific factors.

We are also exposed to market risk related to changes in interest rates that impact the amount of the interest expense we incur with respect to our floating rate obligations as well as the value of certain investments. We periodically enter into interest rate swap agreements to manage our exposure to these fluctuations. These interest rate swap agreements involve the exchange of fixed and variable rate interest payments between two parties, based on common notional principal amounts and maturity dates.

50

Risks related to ownership of our common stock:

There can be no assurance that we will continue to pay dividends.

The Company declares a regular quarterly cash dividend under our cash dividend program. During 2023, the Board of Directors declared four quarterly dividends of $0.60 per share, or $2.40 per share in the aggregate, on our common stock. On January 29, 2024, our Board of Directors declared a quarterly dividend of $0.66 per share on our common stock payable on March 29, 2024 to stockholders of record at the close of business on March 15, 2024.

The declaration, amount and timing of such dividends are subject to capital availability and determinations by our Board of Directors that cash dividends are in the best interest of our stockholders and are in compliance with all respective laws and our agreements applicable to the declaration and payment of cash dividends. Our ability to pay dividends will depend upon, among other factors, our cash flows from operations, our available capital and potential future capital requirements for strategic transactions, including acquisitions, debt service requirements, share repurchases and investing in our existing markets as well as our results of operations, financial condition and other factors beyond our control that our Board of Directors may deem relevant. A reduction in or suspension or elimination of our dividend payments could have a negative effect on our stock price.

Certain of our investors may continue to have influence over us.

On November 17, 2006, HCA Inc. was acquired by a private investor group, including affiliates of HCA founder, Dr. Thomas F. Frist, Jr. and certain other investors. Through their investment in Hercules Holding II and other holdings, certain of the Frist-affiliated investors continue to hold a significant interest in our outstanding common stock (approximately 26% as of January 31, 2024). In addition, pursuant to a shareholders agreement we entered into with Hercules Holding II and the Frist-affiliated investors, certain representatives of these investors have the continued right to nominate certain of the members of our Board of Directors. As a result, certain of these investors potentially have the ability to influence our decisions to enter into corporate transactions (and the terms thereof) and prevent changes in the composition of our Board of Directors or any transaction that requires stockholder approval.