Humana 2014 Annual Report Download - page 34

26
Our participation in the new federal and state health insurance exchanges, which entail uncertainties associated
with mix, volume of business and the operation of premium stabilization programs, which are subject to federal
administrative action, could adversely affect our results of operations, financial position, and cash flows.
The Health Care Reform Law required the establishment of health insurance exchanges for individuals and small
employers to purchase health insurance that became effective January 1, 2014, with an annual open enrollment period.
Insurers participating on the health insurance exchanges must offer a minimum level of benefits and are subject to
guidelines on setting premium rates and coverage limitations. We may be adversely selected by individuals who have
a higher acuity level than the anticipated pool of participants in this market. In addition, the risk corridor, reinsurance,
and risk adjustment provisions of the Health Care Reform Law, established to apportion risk for insurers, may not be
effective in appropriately mitigating the financial risks related to our products. In addition, regulatory changes to the
implementation of the Health Care Reform Law that allowed individuals to remain in plans that are not compliant with
the Health Care Reform Law may have an adverse effect on our pool of participants in the health insurance exchange.
All of these factors may have a material adverse effect on our results of operations, financial position, or cash flows if
our premiums are not adequate or do not appropriately reflect the acuity of these individuals. Any variation from our
expectations regarding acuity, enrollment levels, adverse selection, or other assumptions used in setting premium rates
could have a material adverse effect on our results of operations, financial position, and cash flows.
Our business activities are subject to substantial government regulation. New laws or regulations, or changes
in existing laws or regulations or their manner of application, including reductions in Medicare Advantage payment
rates, could increase our cost of doing business and may adversely affect our business, profitability, financial
condition, and cash flows.
In addition to the Health Care Reform Law, the health care industry in general and health insurance are subject to
substantial federal and state government regulation:
Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic
and Clinical Health Act (HITECH Act)
The use of individually identifiable health data by our business is regulated at federal and state levels. These laws
and rules are changed frequently by legislation or administrative interpretation. Various state laws address the use and
maintenance of individually identifiable health data. Most are derived from the privacy provisions in the federal Gramm-
Leach-Bliley Act and the Health Insurance Portability and Accountability Act, or HIPAA. HIPAA includes
administrative provisions directed at simplifying electronic data interchange through standardizing transactions,
establishing uniform health care provider, payer, and employer identifiers, and seeking protections for confidentiality
and security of patient data. The rules do not provide for complete federal preemption of state laws, but rather preempt
all inconsistent state laws unless the state law is more stringent.
These regulations set standards for the security of electronic health information. Violations of these rules could
subject us to significant criminal and civil penalties, including significant monetary penalties. Compliance with HIPAA
regulations requires significant systems enhancements, training and administrative effort. HIPAA can also expose us
to additional liability for violations by our business associates (e.g., entities that provide services to health plans and
providers).
The HITECH Act, one part of the American Recovery and Reinvestment Act of 2009, significantly broadened the
scope of the privacy and security regulations of HIPAA. On January 17, 2013, HHS issued the omnibus final rule on
HIPAA privacy, security, breach notification requirements and enforcement requirements under the HITECH Act, and
a final regulation for required changes to the HIPAA Privacy Rule for the Genetic Information Nondiscrimination Act,
or GINA. The omnibus final rule became effective on March 26, 2013, with a compliance date of September 23, 2013.
Among other requirements, the HITECH Act and Omnibus final rule mandates individual notification in the event of
a breach of unsecured, individually identifiable health information, provides enhanced penalties for HIPAA violations,
requires business associates to comply with certain provisions of the HIPAA privacy and security rule, and grants
enforcement authority to state attorneys general in addition to the HHS Office of Civil Rights.