Humana 2009 Annual Report Download - page 33

Settlement of the reinsurance and low-income cost subsidies as well as the risk corridor payment is
based on a reconciliation made approximately 9 months after the close of each calendar year. This
reconciliation process requires us to submit claims data necessary for CMS to administer the program.
Our claims data may not pass CMS’s claims edit processes due to various reasons, including
discrepancies in eligibility or classification of low-income members. To the extent our data does not
pass CMS’s claim edit processes, we may bear the risk for all or a portion of the claim which otherwise
may have been subject to the risk corridor provision or payment as a low-income or reinsurance claim.
In addition, in the event the settlement represents an amount CMS owes us, there is a negative impact on
our cash flows and financial condition as a result of financing CMS’s share of the risk. The opposite is
true in the event the settlement represents an amount we owe CMS.
In addition, the health care industry in general and health insurance, particularly HMOs and PPOs, are
subject to substantial federal and state government regulation:
Medicare Improvements for Patients and Providers Act of 2008
The enactment of the Medicare Improvements for Patients and Providers Act of 2008, or MIPPA, in July
2008 could affect our Medicare operations. Principally, beginning in 2011 sponsors of Medicare Advantage
PFFS plans will be required to contract with providers to establish adequate networks, except in geographic areas
that CMS determines have fewer than two network-based Medicare Advantage plans. Additionally, MIPPA
prohibits several different kinds of marketing activities by Medicare plan sponsors and their brokers, and will
phase out indirect medical education, or IME, costs beginning in 2010. We are continuing to implement various
operational and strategic initiatives that are intended to answer the challenges presented by MIPPA. In addition,
most of our PFFS enrollees reside in geographies where we have developed a provider network and offer a
networked plan. We will continue to develop our networks and build network-based plan offerings to address the
adequate network requirement. We anticipate these initiatives, together with certain counties’ exemption from
the network requirement, to result in more than 95% of our PFFS members having the choice of remaining in a
Humana plan in 2011. Nonetheless, there can be no assurance that we will be able to successfully implement
those initiatives. Failure to implement this strategy may result in a material adverse effect on our results of
operations, financial position, and cash flows.
Health Insurance Portability and Accountability Act (HIPAA)
The use of individually identifiable health data by our business is regulated at federal and state levels. These
laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address
the use and maintenance of individually identifiable health data. Most are derived from the privacy provisions in
the federal Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, or HIPAA.
HIPAA includes administrative provisions directed at simplifying electronic data interchange through
standardizing transactions, establishing uniform health care provider, payer, and employer identifiers and seeking
protections for confidentiality and security of patient data. The rules do not provide for complete federal
preemption of state laws, but rather preempt all inconsistent state laws unless the state law is more stringent.
These regulations set standards for the security of electronic health information. Violations of these rules
could subject us to significant criminal and civil penalties, including significant monetary penalties. Compliance
with HIPAA regulations requires significant systems enhancements, training and administrative effort. HIPAA
can also expose us to additional liability for violations by our business associates (e.g., entities that provide
services to health plans).
On February 17, 2009, the American Recovery and Reinvestment Act of 2009, or ARRA, was enacted into
law. In addition to including a temporary subsidy for health care continuation coverage issued pursuant to the
Consolidated Omnibus Budget Reconciliation Act, or COBRA, the ARRA also expands and strengthens the
privacy and security provisions of HIPAA and imposes additional limits on the use and disclosure of protected
health information, or PHI. Among other things, ARRA requires us and other covered entities to report any
unauthorized release or use of or access to PHI to any impacted individuals and to the U.S. Department of Health
23