LabCorp 2014 Annual Report Download - page 27

25
Because a significant portion of the Company's costs are relatively fixed, Medicare, Medicaid and other government program
payment reductions could have a direct adverse effect on the Company's net earnings and cash flows. The Company cannot predict
whether changes will be implemented that will result in further payment reductions.
In addition to changes in reimbursement rates, the Company is also impacted by changes in coverage policies for laboratory
tests. Congressional action in 1997 required HHS to adopt uniform coverage, administration and payment policies for many of
the most commonly performed lab tests using a negotiated rulemaking process. The negotiated rulemaking committee established
uniform policies limiting Medicare coverage for certain tests to patients with specified medical conditions or diagnoses, replacing
local Medicare coverage policies which varied around the country. Since the final rules generally became effective in 2002, the
use of uniform policies has improved the Company’s ability to obtain necessary billing information in some cases. However,
Medicare, Medicaid and private payer diagnosis code requirements and payment policies continue to negatively impact the
Company’s ability to be paid for some of the tests it performs. The Company also experienced delays in the pricing and
implementation of new molecular pathology codes among various payers, including Medicaid, Medicare and commercial carriers.
While some delays were expected, several non-commercial payers required an extended period of time to price key molecular
codes and a number of those payers, mostly government entities, indicated that they would no longer pay for tests that they had
previously covered. Further, several payers are requiring additional information to process claims or have implemented prior
authorization policies. Many commercial payers were delayed in becoming aware of the impact of their claim edits and policies
which impeded access to services which previously have been covered and reimbursed. These delays had a negative impact on
2014 revenue, revenue per requisition, margins and cash flows and are expected to have a continuing negative impact. Similarly,
coding changes related to toxicology and other procedures are being implemented in 2015 and Palmetto has published a revised
Drugs of Abuse Local Coverage Policy which, if implemented as written, would adversely impact Medicare revenue. The policy
has been delayed several times. It is currently published to be effective April 1, 2015 and it not clear what policies Medicaid and
Managed Care organizations may implement in response. The Company expects delays in the pricing and implementation of
these new toxicology codes and it is unclear what impact will be experienced related to price and margins.
Future changes in federal, state and local laws and regulations (or in the interpretation of current regulations) affecting
government payment for clinical laboratory testing could have a material adverse effect on the Company. Based on currently
available information, the Company is unable to predict what type of changes in legislation or regulations, if any, will occur.
Standard Electronic Transactions, Security and Confidentiality of Health Information
The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") was designed to address issues related to the
security and confidentiality of health insurance information. In an effort to improve the efficiency and effectiveness of the health
care system by facilitating the electronic exchange of information in certain financial and administrative transactions, HIPAA
regulations were promulgated. These regulations apply to health plans, health care providers that conduct standard transactions
electronically and health care clearinghouses (“covered entities”). Five such regulations have been finalized: (i) the Transactions
and Code Sets Rule; (ii) the Privacy Rule; (iii) the Security Rule; (iv) the Standard Unique Employer Identifier Rule, which requires
the use of a unique employer identifier in connection with certain electronic transactions; and (v) the National Provider Identifier
Rule, which requires the use of a unique health care provider identifier in connection with certain electronic transactions.
The Privacy Rule regulates the use and disclosure of protected health information (“PHI”) by covered entities. It also sets forth
certain rights that an individual has with respect to his or her PHI maintained by a covered entity, such as the right to access or
amend certain records containing PHI or to request restrictions on the use or disclosure of PHI. The Privacy Rule requires covered
entities to contractually bind third parties, known as business associates, in the event that they perform an activity or service for
or on behalf of the covered entity that involves access to PHI. The Security Rule establishes requirements for safeguarding patient
information that is electronically transmitted or electronically stored. The Company believes that it is in compliance in all material
respects with the requirements of the HIPAA Privacy and Security Rules.
The federal Health Information Technology for Economic and Clinical Health (“HITECH”) Act, which was enacted in February
2009, strengthens and expands the HIPAA Privacy and Security Rules and their restrictions on use and disclosure of PHI. HITECH
includes, but is not limited to, prohibitions on exchanging patient identifiable health information for remuneration and additional
restrictions on the use of PHI for marketing. HITECH also fundamentally changes a business associate’s obligations by imposing
a number of Privacy Rule requirements and a majority of Security Rule provisions directly on business associates that were
previously only directly applicable to covered entities. Moreover, HITECH requires covered entities to provide notice to individuals,
HHS, and, as applicable, the media when unsecured protected health information is breached, as that term is defined by HITECH.
Business associates are similarly required to notify covered entities of a breach. The omnibus HIPAA regulation implementing
most of the HITECH provisions was issued in January 2013 and made significant changes to the HIPAA Privacy, Security,
Enforcement, and Breach Notification Rules. Compliance with most of the changes became required on September 23, 2013. The
Company's policies and procedures are fully compliant with the HITECH Act requirements.