Integrity and Compliance Program

CVS Caremark’s Compliance and Integrity Program provides a framework for fostering a culture of compliance throughout the company. Key components of the Program include a Code of Conduct, policies and procedures, education and training; a mechanism for employees to report potential unethical behavior or non-compliance; a requirement that employees cooperate in compliance investigations; monitoring and auditing; periodic risk assessments to help identify key legal and regulatory risks and changes; incentive structures, remedial measures and discipline procedures that promote compliance; maintaining required compliance and fraud, waste and abuse programs applicable to our Medicare Part D business; a process to implement business changes necessitated by new laws and regulations; appropriate employee background checks and exclusion list screening; and a leadership team that fosters a positive and ethical culture of open communications.

Our Chief Compliance Officer is responsible for the oversight and implementation of the CVS Caremark Compliance and Integrity Program, including the components applicable to our Medicare Part D business. The Chief Compliance Officer reports to the Audit Committee of the Board of Directors and to the company’s Chief Executive Officer. As part of the administration of the Program, the Chief Compliance Officer chairs the Corporate Compliance Committee, a cross-functional group comprised of company legal and business leaders who provide expertise, coordination and oversight to assist the Chief Compliance Officer.

Code of Conduct

The CVS Caremark Code of Conduct sets forth the company’s expectation of legal and ethical behavior of all employees. The Chief Compliance Officer leads the development of and periodic updates to the Code of Conduct and the Code itself is approved by the Board of Directors. The Code of Conduct is communicated to all employees and is externally available via the CVS Caremark website. The company’s corporate policies and procedures are an additional source of guidance to employees.

Compliance Education and Training

Through the CVS Caremark Integrity Training Program, the company underscores its commitment to high ethical standards and to practices that comply with applicable laws, regulations and company policies. The Integrity Training Program is designed to be current and relevant to the business as well as to address the evolving and complex health care and regulatory environment. Training content, which is reviewed and approved by the Compliance Office, is designed to raise employee awareness of current policies through the presentation of real-life work situations that they may encounter that pose ethical dilemmas or may violate aspects of the CVS Caremark Code of Conduct.

The company’s policy is to provide all new full-time or part-time employees with appropriate integrity training. New employees also must certify that they have read the Code of Conduct and completed the training. As of March 2012, more than 99 percent of employees had completed online training on the Code of Conduct, which includes topics related to compliance and integrity, privacy and security, professional conduct and corruption, among others. Ongoing compliance training requirements are based on employee job function and responsibilities, and existing government mandates.

Auditing, Monitoring and Risk Assessment

The company assesses and monitors broad areas of compliance risk across the organization and maintains a compliance auditing and monitoring program to help detect non-adherence to the Code of Conduct and the company’s policies and procedures. In addition, the Chief Compliance Officer, in coordination with the Legal Department, conducts periodic assessments to help identify risk and develop a Compliance Audit Work Plan that is approved by the Audit Committee of the Board of Directors.

Ethics Hotline

CVS Caremark maintains a toll-free Ethics Line 24 hours a day, seven days a week and 365 days a year to receive communications from its employees, vendors and other third parties in connection with alleged unethical or illegal behavior. As an alternative to calling, parties may contact the Ethics Line via mail, email or fax. All communications to the Ethics Line by employees are handled as confidentially as possible. Moreover, the company has a strict non-retaliation policy that protects employees who make good faith reports to the Ethics Line. Aggregate data is reported to the Chief Compliance Officer and an annual report is made to the Audit Committee of the Board of Directors.

Any employee of CVS Caremark also has the ability to raise a compliance issue and seek guidance regarding a potential legal or ethical violation directly from the Chief Compliance Officer and from members of management, Human Resources and the Legal Department.

The Compliance Office is responsible for logging, triaging, following up and tracking reported potential compliance violations to conclusion. This includes coordinating or conducting the actual investigation, documenting the results of the investigation and associated discipline, if any. The Compliance Office is also responsible for ensuring that appropriate remedial actions are taken.

Response and Prevention

Upon receiving a report of an alleged violation of CVS Caremark’s Code of Conduct and/or policies and procedures, the Compliance Office directs a thorough investigation and may request, as appropriate, a review of the alleged violation by legal counsel.

After an investigation has been completed, the Compliance Office, in coordination with the Legal Department, determines whether credible evidence exists of a violation of applicable federal or state laws, regulations or any provision of CVS Caremark’s Code of Conduct and/or policies and procedures. When an investigation confirms that misconduct has occurred, corrective actions are initiated promptly. Corrective action may include remedial action to address the specific issue or help prevent similar issues in the future, disciplinary action and/or additional training. As appropriate, certain confirmed violations may be reported to outside agencies or authorities. In addition, the Chief Compliance Officer provides the Audit Committee of the Board of Directors with a summary of reports received highlighting significant violations or alleged significant violations of the Code of Conduct and applicable policies and procedures.