Tenet Healthcare (THC) Risk Analysis

The success of our business and clinical program development depends in large part on the number, quality, specialties, and admitting and scheduling practices of the licensed physicians who are members of the medical staffs of our hospitals and other facilities, as well as physicians who affiliate with us and use our facilities as an extension of their practices. Physicians are often not employees of the hospitals or surgery centers at which they practice. Members of the medical staffs of our facilities also often serve on the medical staffs of facilities we do not operate, and they are free to terminate their association with our facilities or admit their patients to competing facilities at any time. In addition, although physicians who own interests in our facilities are generally subject to agreements restricting them from owning an interest in competing facilities, we may not learn of, or may be unsuccessful in preventing, our physician partners from acquiring interests in such facilities. We compete with system-affiliated hospitals and healthcare companies, as well as health insurers and private equity companies, in recruiting physicians, acquiring physician practices and, where permitted by law, employing physicians. In 2024,we continued to experience challenges in recruiting and retaining physicians. In some of the regions where we operate, physician recruitment and retention are affected by a shortage of qualified physicians in certain higher-demand clinical service lines and specialties. Furthermore, our ability to recruit and employ physicians is closely regulated. For example, the types, amount and duration of compensation and assistance we can provide to recruited physicians are limited by the federal Anti-kickback Statute and Stark law, as well as other applicable antifraud and abuse laws and regulations. All arrangements with physicians must also be fair market value and commercially reasonable. If we are unable to attract and retain sufficient numbers of quality physicians by providing adequate support personnel, technologically advanced equipment, and facilities that meet the needs of those physicians and their patients, physicians may choose not to refer patients to our facilities, admissions and outpatient visits may decrease, and our operating performance may decline.

Our ability to enter into, maintain and renew favorable contracts with HMOs, insurers offering preferred provider arrangements and other managed care plans, as well as add new facilities to our existing agreements at contracted rates, significantly affects our revenues and operating results. For the year ended December 31, 2024, approximately 70%, or $9.809 billion, of our net patient service revenues for the hospitals and related outpatient facilities in our Hospital Operations segment was attributable to managed care payers, including Medicare and Medicaid managed care programs. Moreover, in 2024, our commercial managed care net inpatient revenue per admission from the hospitals in our Hospital Operations segment was approximately 67% higher than our aggregate yield on a per-admission basis from government payers, including Medicare and Medicaid managed care programs. The ongoing trend toward consolidation among non-government payers tends to increase their bargaining power over contract terms. Generally, we compete for these contracts on the basis of price, market reputation, geographic location, quality and range of services, caliber of the medical staff and convenience. Our contracts with managed care payers require us to comply with a number of terms related to the provision of and billing for services. If we are unable to negotiate increased reimbursement rates, maintain existing rates or other favorable contract terms, effectively respond to managed care payer cost controls and reimbursement policies, or comply with the terms of our contracts, the payments we receive for our services may be reduced. Also, we are increasingly experiencing payment denials from and other administrative challenges with managed care payers, both prospectively and retroactively. We currently have thousands of managed care contracts with various HMOs and PPOs; however, our top 10 managed care payers generated 71% of our managed care net patient service revenues for the year ended December 31, 2024. Because of this concentration, we may experience a short- or long-term adverse effect on our net operating revenues if we cannot renew, replace or otherwise mitigate the impact of expired contracts with significant payers. Furthermore, material payment delays and disputes between us and significant managed care payers could have a material adverse effect on our financial condition, results of operations or cash flows. At December 31, 2024, 68% of our Hospital Operations segment's net accounts receivable was due from managed care payers. In addition, managed care payers continue to seek to control healthcare costs by encouraging patients to use certain facilities in exchange for discounts from the facilities' established charges, and through increased utilization reviews and greater enrollment in HMOs and PPOs. Any negotiated discount programs we agree to generally limit our ability to increase reimbursement rates to offset increasing costs. In addition, enrollment of individuals in high-deductible health plans has increased over the last decade. In comparison to traditional health plans, these plans have higher co-pays and deductibles due from patients, which subjects us to increased collection risk. Our relationships with payers, and reimbursement for the care we provide, may be further impacted by clinical and price transparency initiatives and out-of-network billing restrictions, including those in the No Surprises Act. In general, any material reductions in the contracted or out-of-network rates we receive for our services or any significant difficulties in collecting receivables from managed care payers could have a material adverse effect on our financial condition, results of operations or cash flows.

Over the past several years, various laws and regulations lengthened the enrollment period, expanded income eligibility, and reduced premium caps for subsidies for individuals purchasing Affordable Care Act coverage through state and federal marketplaces. Certain of these provisions are set to expire at the end of 2025; if they are not extended, it could result in significant increases in premiums, potentially leading to decreased enrollment and a corresponding rise in the uninsured or a shift of individuals from commercial coverage to government program coverage beginning in 2026. In such a case, we could experience decreased patient volumes, reduced revenues and an increase in uncompensated care, which would adversely affect our results of operations and cash flows. We cannot predict whether or how the new Congress may extend or modify provisions of or relating to the Affordable Care Act or other laws affecting the healthcare industry generally, nor can we predict how the new administration will influence, promulgate or implement rules, regulations or executive orders that affect the healthcare industry directly or indirectly. We may also experience potential impacts on our business, in ways we cannot anticipate, from healthcare-related policy changes at the state level. Some federal and state changes, initiatives and requirements could, among other things, negatively impact our patient volumes, case mix and revenue mix, increase our operating costs, adversely affect the reimbursement we receive for our services, impact our competitive position or require us to expend resources to modify certain aspects of our operations, any of which could have an adverse effect on our financial condition, results of operations or cash flows. Furthermore, we cannot predict the impact healthcare policy risks and uncertainties may have on the trading price of our common stock.

Our information technology systems are critical to the day-to-day operation of our business. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII, and proprietary and confidential business data. We utilize electronic health records ("EHRs") and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. Our systems, in turn, interface with and rely on third-party systems that store and transmit information integral to patient care and that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures. We rely on these third-party providers to have appropriate controls to protect our systems, confidential information and other sensitive or regulated data. While we seek to obtain assurances that third parties will protect our information and business operations, there is a risk the security of data held by such third parties could be breached or that systems are rendered unavailable, causing direct impacts to our business operations. The information technology and infrastructure we use, the third-party systems we interact with and the suppliers we use, have been, and continue to be, subject to cyber-attacks, computer viruses or breaches due to malfeasance or employee error. In April 2022, we experienced a cybersecurity incident that disrupted a subset of our hospital operations and involved the exfiltration of certain confidential company and patient information. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities. The risk of cyber-attack (including ransomware attack), breach or other disruption to healthcare systems, including ours, remains elevated in the current environment. Attacks on, or breaches or other disruptions to, our information technology assets or those of third parties that we rely upon could impact the integrity, security or availability of data we process, transmit or store and could impact our operations, as well as PHI and PII, and result in potential harm to our patients and clients. The preventive actions we take to reduce the risk of such incidents and protect our information technology and data may not be sufficient. As cybersecurity threats continue to evolve, we may not be able to anticipate certain attack methods in order to implement effective protective measures. We continue to be required to expend significant additional resources to modify and strengthen our security measures, investigate and respond to cybersecurity incidents, remediate any vulnerabilities in our information systems and infrastructure, and invest in new technology designed to mitigate security risks. Our insurance against cybersecurity risks and cyber-attacks may not provide the coverage we anticipate or offset the financial impact of a material loss event. In addition, the occurrence of cybersecurity incidents and the continued and elevated risk of attacks (including ransomware), system and data breaches, and other disruptions to information technology systems in the current environment has caused increases in our cyber insurance premiums and lower coverage limits. Third parties to whom we outsource certain of our functions, with whom we share data for interoperability purposes or from whom we obtain or to whom we provide products and related services, including those that are part of our revenue cycle processes or supply chain, or other third parties with whom our systems interface (such as clients and their vendors, among others), in some instances, store our sensitive and confidential data; these third parties are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business, impact payment of claims, and potentially harm our patients and clients. Further, successful cyber-attacks at other healthcare services companies, whether or not we are impacted, could lead to a general loss of consumer confidence in our industry that could negatively affect us, including harming the market perception of the effectiveness of our security measures or of the healthcare industry in general, which could result in reduced use of our services. Our networks and technology systems have also experienced disruption due to planned events, such as system implementations, upgrades, and other maintenance and improvements, and they are subject to disruption in the future for similar events, as well as catastrophic events, including a major earthquake, fire, hurricane, telecommunications failure, terrorist attack or the like. Any ransomware attack, breach, system interruption or unavailability of our information systems or of third-party systems with access to our data could result in: the unauthorized disclosure, misuse, loss or corruption of such data; interruptions and delays in our normal business operations (including the collection of revenues); patient or client harm; potential liability under privacy, security, consumer protection or other applicable laws; regulatory penalties; ransomware payments; and negative publicity and damage to our reputation. Any of these could have a material adverse effect on our business, financial condition, results of operations or cash flows.