Humana 2008 Annual Report Download - page 34

Certain of our subsidiaries operate in states that regulate the payment of dividends, loans, or other cash
transfers to Humana Inc., our parent company, and require minimum levels of equity as well as limit investments
to approved securities. The amount of dividends that may be paid to Humana Inc. by these subsidiaries, without
prior approval by state regulatory authorities, is limited based on the entity’s level of statutory income and
statutory capital and surplus. In most states, prior notification is provided before paying a dividend even if
approval is not required.
Although minimum required levels of equity are largely based on premium volume, product mix, and the
quality of assets held, minimum requirements can vary significantly at the state level. Based on the statutory
financial statements as of December 31, 2008, we maintained aggregate statutory capital and surplus of
$3.5 billion in our state regulated subsidiaries, $1.4 billion above the aggregate $2.1 billion in applicable
statutory requirements which would trigger any regulatory action by the respective states.
The use of individually identifiable health data by our business is regulated at federal and state levels. These
laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address
the use and maintenance of individually identifiable health data. Most are derived from the privacy provisions in
the federal Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, or HIPAA.
HIPAA includes administrative provisions directed at simplifying electronic data interchange through
standardizing transactions, establishing uniform health care provider, payer, and employer identifiers and seeking
protections for confidentiality and security of patient data. The rules do not provide for complete federal
preemption of state laws, but rather preempt all inconsistent state laws unless the state law is more stringent.
These regulations set standards for the security of electronic health information. Violations of these rules
could subject us to significant criminal and civil penalties, including significant monetary penalties. Compliance
with HIPAA regulations requires significant systems enhancements, training and administrative effort. HIPAA
can also expose us to additional liability for violations by our business associates. A business associate is a
person or entity, other than a member of the work force, who on behalf of a covered entity performs or assists in
the performance of a function or activity involving the use or disclosure of individually identifiable health
information, or provides legal, accounting, consulting, data aggregation, management, administrative,
accreditation, or financial services.
Laws in each of the states (including Puerto Rico) in which we operate our HMOs, PPOs and other health
insurance-related services regulate our operations, including the scope of benefits, rate formulas, delivery
systems, utilization review procedures, quality assurance, complaint systems, enrollment requirements, claim
payments, marketing, and advertising. The HMO, PPO, and other health insurance-related products we offer are
sold under licenses issued by the applicable insurance regulators. Our licensed subsidiaries are also subject to
regulation under state insurance holding company and Puerto Rico regulations.
We are also subject to various governmental audits and investigations. Under state laws, our HMOs and health
insurance companies are audited by state departments of insurance for financial and contractual compliance. Our
HMOs are audited for compliance with health services by state departments of health. Audits and investigations are
also conducted by state attorneys general, CMS, the Office of the Inspector General of Health and Human Services,
the Office of Personnel Management, the Department of Justice, the Department of Labor, and the Defense Contract
Audit Agency. All of these activities could result in the loss of licensure or the right to participate in various
programs, or the imposition of fines, penalties and other civil and criminal sanctions. In addition, disclosure of any
adverse investigation or audit results or sanctions could negatively affect our industry or our reputation in various
markets and make it more difficult for us to sell our products and services.
Other areas subject to substantial regulation include:
• licensing requirements;
• approval of policy language and benefits;
• mandated benefits and processes;
24