Humana 2012 Annual Report Download - page 36

Legislation and related regulations, as well as future legislative changes, in the aggregate may have a material
adverse effect on our results of operations, including restricting revenue, enrollment and premium growth in
certain products and market segments, restricting our ability to expand into new markets, increasing our medical
and operating costs, lowering our Medicare payment rates and increasing our expenses associated with the non-
deductible federal premium tax and other assessments; our financial position, including our ability to maintain
the value of our goodwill; and our cash flows. If we fail to effectively implement our operational and strategic
initiatives with respect to the implementation of the Health Insurance Reform Legislation, our business may be
materially adversely affected. In addition, if the new non-deductible federal premium tax and other assessments,
including a three-year commercial reinsurance fee, were imposed as enacted, and if we are unable to adjust our
business model to address these new taxes and assessments, such as through the reduction of our operating costs
or adjustments to premium pricing or benefit design, there can be no assurance that the non-deductible federal
premium tax and other assessments would not have a material adverse effect on our results of operations,
financial position, and cash flows.
Our business activities are subject to substantial government regulation. New laws or regulations, or
changes in existing laws or regulations or their manner of application, including reductions in Medicare
Advantage payment rates, could increase our cost of doing business and may adversely affect our business,
profitability, financial condition, and cash flows.
In addition to the Health Insurance Reform Legislation, the health care industry in general and health
insurance are subject to substantial federal and state government regulation:
Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for
Economic and Clinical Health Act (HITECH Act)
The use of individually identifiable health data by our business is regulated at federal and state levels. These
laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address
the use and maintenance of individually identifiable health data. Most are derived from the privacy provisions in
the federal Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, or HIPAA.
HIPAA includes administrative provisions directed at simplifying electronic data interchange through
standardizing transactions, establishing uniform health care provider, payer, and employer identifiers, and
seeking protections for confidentiality and security of patient data. The rules do not provide for complete federal
preemption of state laws, but rather preempt all inconsistent state laws unless the state law is more stringent.
These regulations set standards for the security of electronic health information. Violations of these rules
could subject us to significant criminal and civil penalties, including significant monetary penalties. Compliance
with HIPAA regulations requires significant systems enhancements, training and administrative effort. HIPAA
can also expose us to additional liability for violations by our business associates (e.g., entities that provide
services to health plans).
The HITECH Act, one part of the American Recovery and Reinvestment Act of 2009, significantly
broadened the scope of the privacy and security regulations of HIPAA. Among other requirements, the HITECH
Act mandates individual notification in the event of a breach of unsecured, individually identifiable health
information, provides enhanced penalties for HIPAA violations, requires business associates to comply with
certain provisions of the HIPAA privacy and security rule, and grants enforcement authority to states’ Attorneys
General in addition to the HHS Office of Civil Rights. On January 17, 2013, HHS issued the omnibus final rule
on HIPAA privacy, security, breach notification requirements and enforcement requirements under the HITECH
Act, and a final regulation for required changes to the HIPAA Privacy Rule for the Genetic Information
Nondiscrimination Act, or GINA. The omnibus final rule becomes effective on March 26, 2013, with an
applicable compliance date of September 23, 2013.
In addition, there are numerous federal and state laws and regulations addressing patient and consumer
privacy concerns, including unauthorized access or theft of personal information. State statutes and regulations
26