Humana 2002 Annual Report Download - page 56

• defining medical necessity;
• health insurance access;
• provider compensation and contract language;
• disclosure of provider fee schedules and other data impacting payments to providers;
• health plan liability to members who fail to receive appropriate care;
• disclosure and composition of physician networks;
• physicians’ ability to collectively negotiate contract terms with carriers, including fees; and
• mental health parity.
All of these proposals could apply to us.
There can be no assurance that we will be able to continue to obtain or maintain required governmental
approvals or licenses or that legislative or regulatory changes will not have a material adverse effect on our
business. Delays in obtaining or failure to obtain or maintain required approvals, or moratoria imposed by
regulatory authorities, could adversely affect our revenue or the number of our members, increase costs or
adversely affect our ability to bring new products to market as forecasted.
The National Association of Insurance Commissioners, or NAIC, has adopted risk-based capital
requirements, also known as RBC, which is subject to state-by-state adoption and to the extent implemented, sets
minimum capitalization requirements for insurance and HMO companies. The NAIC recommendations for life
insurance companies were adopted in all states and the prescribed calculation for HMOs has been adopted in
most states in which we operate. The HMO rules may increase the minimum capital required for some of our
subsidiaries.
The Health Insurance Portability and Accountability Act of 1996, or HIPAA, includes administrative
provisions directed at simplifying electronic data interchange through standardizing transactions, establishing
uniform health care provider, payer and employer identifiers and seeking protections for confidentiality and
security of patient data. Under the new HIPAA standard transactions and code sets rules, we must make
significant systems enhancements and invest in new technological solutions. The compliance date for standard
transactions and code sets rules has been extended to October 17, 2003 based on our submission of a compliance
plan, including work plan and implementation strategy to the Secretary of Health and Human Services. Under the
new HIPAA privacy rules, by April 14, 2003 we must comply with a variety of requirements concerning the use
and disclosure of individuals’ protected health information, establish rigorous internal procedures to protect
health information and enter into business associate contracts with those companies to whom protected health
information is disclosed. Regulations issued in February 2003 set standards for the security of electronic health
information requiring compliance by April 21, 2005. Violations of these rules will subject us to significant
penalties. Compliance with HIPAA regulations requires significant systems enhancements, training and
administrative effort. The final rules do not provide for complete federal preemption of state laws, but rather
preempt all inconsistent state laws unless the state law is more stringent. HIPAA could also expose us to
additional liability for violations by our business associates.
Another area receiving increased focus in 2002 is the time in which various laws require the payment of
health care claims. Many states already have legislation in place covering payment of claims within a specific
number of days. However, due to provider groups advocating for laws or regulations establishing even stricter
standards, procedures and penalties, we expect additional regulatory scrutiny and supplemental legislation with
respect to claims payment practices. The provider-sponsored bills are characterized by stiff penalties for late
payment, including high interest rates payable to providers and costly fines levied by state insurance departments
and attorneys general. This legislation and possible future regulation and oversight could expose our Company to
additional liability and penalties.
50