Humana 2014 Annual Report Download - page 35

27
In addition, there are numerous federal and state laws and regulations addressing patient and consumer privacy
concerns, including unauthorized access or theft of personal information. State statutes and regulations vary from state
to state and could impose additional penalties. Violations of HIPAA or applicable federal or state laws or regulations
could subject us to significant criminal or civil penalties, including significant monetary penalties. Compliance with
HIPAA and other privacy regulations requires significant systems enhancements, training and administrative effort.
American Recovery and Reinvestment Act of 2009 (ARRA)
On February 17, 2009, the American Recovery and Reinvestment Act of 2009, or ARRA, was enacted into law.
In addition to including a temporary subsidy for health care continuation coverage issued pursuant to the Consolidated
Omnibus Budget Reconciliation Act, or COBRA, ARRA also expands and strengthens the privacy and security
provisions of HIPAA and imposes additional limits on the use and disclosure of protected health information, or
PHI. Among other things, ARRA requires us and other covered entities to report any unauthorized release or use of or
access to PHI to any impacted individuals and to the U.S. Department of Health and Human Services in those instances
where the unauthorized activity poses a significant risk of financial, reputational or other harm to the individuals, and
to notify the media in any states where 500 or more people are impacted by any unauthorized release or use of or access
to PHI. ARRA also requires business associates to comply with certain HIPAA provisions. ARRA also establishes
higher civil and criminal penalties for covered entities and business associates who fail to comply with HIPAA’s
provisions and requires the U.S. Department of Health and Human Services to issue regulations implementing its
privacy and security enhancements.
Corporate Practice of Medicine and Other Laws
As a corporate entity, Humana Inc. is not licensed to practice medicine. Many states in which we operate through
our subsidiaries limit the practice of medicine to licensed individuals or professional organizations comprised of licensed
individuals, and business corporations generally may not exercise control over the medical decisions of physicians.
Statutes and regulations relating to the practice of medicine, fee-splitting between physicians and referral sources, and
similar issues vary widely from state to state. Under management agreements between certain of our subsidiaries and
affiliated physician-owned professional groups, these groups retain sole responsibility for all medical decisions, as well
as for hiring and managing physicians and other licensed healthcare providers, developing operating policies and
procedures, implementing professional standards and controls, and maintaining malpractice insurance. We believe that
our health services operations comply with applicable state statutes regarding corporate practice of medicine, fee-
splitting, and similar issues. However, any enforcement actions by governmental officials alleging non-compliance
with these statutes, which could subject us to penalties or restructuring or reorganization of our business, may result
in a material adverse effect on our results of operations, financial position, or cash flows.
Anti-Kickback, Physician Self-Referral, and Other Fraud and Abuse Laws
A federal law commonly referred to as the “Anti-Kickback Statute” prohibits the offer, payment, solicitation, or
receipt of any form of remuneration to induce, or in return for, the referral of Medicare or other governmental health
program patients or patient care opportunities, or in return for the purchase, lease, or order of items or services that are
covered by Medicare or other federal governmental health programs. Because the prohibitions contained in the Anti-
Kickback Statute apply to the furnishing of items or services for which payment is made in “whole or in part,” the Anti-
Kickback Statute could be implicated if any portion of an item or service we provide is covered by any of the state or
federal health benefit programs described above. Violation of these provisions constitutes a felony criminal offense
and applicable sanctions could include exclusion from the Medicare and Medicaid programs.
Section 1877 of the Social Security Act, commonly known as the “Stark Law,” prohibits physicians, subject to
certain exceptions described below, from referring Medicare or Medicaid patients to an entity providing “designated
health services” in which the physician, or an immediate family member, has an ownership or investment interest or
with which the physician, or an immediate family member, has entered into a compensation arrangement. These
prohibitions, contained in the Omnibus Budget Reconciliation Act of 1993, commonly known as “Stark II,” amended
prior federal physician self-referral legislation known as “Stark I” by expanding the list of designated health services