United Healthcare 2014 Annual Report Download - page 31

the data in our information systems. We periodically consolidate, integrate, upgrade and expand our information
systems capabilities as a result of technology initiatives and recently enacted regulations, changes in our system
platforms and integration of new business acquisitions. In addition, recent trends toward greater consumer
engagement in health care require new and enhanced technologies including more sophisticated applications for
mobile devices. Our information systems require an ongoing commitment of significant resources to maintain,
protect and enhance existing systems and develop new systems to keep pace with continuing changes in
information processing technology, evolving systems and regulatory standards, and changing customer
preferences. If the information we rely upon to run our businesses is found to be inaccurate or unreliable or if we
fail to maintain or protect our information systems and data integrity effectively, we could lose existing
customers, have difficulty attracting new customers, experience problems in determining medical cost estimates
and establishing appropriate pricing, have difficulty preventing, detecting and controlling fraud, have disputes
with customers, physicians and other health care professionals, become subject to regulatory sanctions or
penalties, incur increases in operating expenses or suffer other adverse consequences. Our process of
consolidating the number of systems we operate, upgrading and expanding our information systems capabilities,
enhancing our systems and developing new systems to keep pace with continuing changes in information
processing technology may not be successful. Failure to protect, consolidate and integrate our systems
successfully could result in higher than expected costs and diversion of management’s time and energy, which
could materially and adversely affect our results of operations, financial position and cash flows.
Certain of our businesses sell and install software products that may contain unexpected design defects or may
encounter unexpected complications during installation or when used with other technologies utilized by the
customer. Connectivity among competing technologies is becoming increasingly important in the health care
industry. A failure of our technology products to operate as intended and in a seamless fashion with other
products could materially and adversely affect our results of operations, financial position and cash flows.
Uncertain and rapidly evolving U.S. federal and state, non-U.S. and international laws and regulations related to
the health information technology market may present compliance challenges and could materially and adversely
affect the configuration of our information systems and platforms, and our ability to compete in this market.
If we sustain cyber-attacks or other privacy or data security incidents, that result in security breaches that
disrupt our operations or result in the unintended dissemination of sensitive personal information or
proprietary or confidential information, we could suffer a loss of revenue and increased costs, exposure to
significant liability, reputational harm and other serious negative consequences.
We routinely process, store and transmit large amounts of data in our operations, including sensitive personal
information as well as proprietary or confidential information relating to our business or third-parties. Some of
the data we process, store and transmit may be outside of the U.S. due to our information technology systems and
international business operations. We may be subject to breaches of the information technology systems we use.
Experienced computer programmers and hackers may be able to penetrate our layered security controls and
misappropriate or compromise sensitive personal information or proprietary or confidential information or that of
third-parties, create system disruptions or cause shutdowns. They also may be able to develop and deploy viruses,
worms, and other malicious software programs that attack our systems or otherwise exploit any security
vulnerabilities. Our facilities may also be vulnerable to security incidents or security attacks; acts of vandalism or
theft; coordinated attacks by activist entities; misplaced or lost data; human errors; or other similar events that
could negatively affect our systems and our and our customer’s data.
The costs to eliminate or address the foregoing security threats and vulnerabilities before or after a cyber-incident
could be significant. Our remediation efforts may not be successful and could result in interruptions, delays, or
cessation of service, and loss of existing or potential customers. In addition, breaches of our security measures
and the unauthorized dissemination of sensitive personal information or proprietary information or confidential
information about us or our customers or other third-parties, could expose our customers’ private information and
our customers to the risk of financial or medical identity theft, or expose us or other third-parties to a risk of loss
29