Aetna 2009 Annual Report Download - page 31

Annual Report – Page 25
individual and small group insured health business in that state beginning January 1, 2009. The health reform
measures passed by the U.S. Senate and the House of Representatives also specify minimum medical benefit ratios,
President Obama’ s February 22, 2010 health reform proposal would establish a new federal Health Insurance Rate
Authority that would significantly increase federal oversight of health plan premium rates, and states may further
restrict our ability to price for the risk we assume, any of which could adversely affect our ability to appropriately
increase health plan premiums.
Many of these laws and regulations limit the differentials in rates insurers and other carriers may charge between new
and renewal business, and/or between groups or individuals based on differing characteristics. They may also require
that carriers disclose to customers the basis on which the carrier establishes new business and renewal rates, restrict the
application of pre-existing condition exclusions and limit the ability of a carrier to terminate coverage of an employer
group.
HIPAA generally requires insurers and other carriers that cover small employer groups in any market to accept for
coverage any small employer group applying for a basic and standard plan of benefits. HIPAA also mandates
guaranteed renewal of health care coverage for most employer groups, subject to certain defined exceptions, and
provides for specified employer notice periods in connection with product and market withdrawals. The law further
limits exclusions based on pre-existing conditions for individuals covered under group policies to the extent the
individuals had prior creditable coverage within a specified time frame. HIPAA is structured as a “floor” requirement,
allowing states latitude to enact more stringent rules governing each of these restrictions. For example, certain states
have modified HIPAA’ s definition of a small group (2-50 employees) to include groups of one employee.
In addition, a number of states provide for a voluntary reinsurance mechanism to spread small group risk among
participating insurers and other carriers. In a small number of states, participation in this pooling mechanism is
mandatory for all small group carriers. In general, we have elected not to participate in voluntary pools, but even in
the voluntary pool states, we may be subject to certain supplemental assessments related to the state’ s small group
experience.
HIPAA Administrative Simplification and Privacy; Gramm-Leach-Bliley Act
The regulations under the administrative simplification provisions of HIPAA also impose a number of additional
obligations on issuers of health insurance coverage and health benefit plan sponsors. The law authorizes the U.S.
Department of Health and Human Services (“HHS”) to issue standards for electronic transactions, as well as privacy
and security of medical records and other individually identifiable health information (“Administrative
Simplification”).
Administrative Simplification requirements apply to self-funded group health plans, health insurers and HMOs, health
care clearinghouses and health care providers who transmit health information electronically (“Covered Entities”).
Regulations adopted to implement Administrative Simplification also require that business associates acting for or on
behalf of these Covered Entities be contractually obligated to meet HIPAA standards. The Administrative
Simplification regulations establish significant criminal penalties and civil sanctions for noncompliance.
Under Administrative Simplification, HHS has released rules mandating the use of standard formats in electronic
health care transactions (for example, health care claims submission and payment, plan eligibility, precertification,
claims status, plan enrollment and disenrollment, payment and remittance advice, plan premium payments and
coordination of benefits). HHS also has published rules requiring the use of standardized code sets and unique
identifiers for employers and providers. By 2013, the federal government will require that healthcare organizations,
including health insurers, upgrade to updated and expanded standardized code sets used for describing health
conditions. These new standardized code sets, known as ICD-10, will require substantial investments from health care
organizations, including us. We estimate that our ICD-10 project costs will be $30 million in 2010.
The HIPAA privacy regulations adopted by HHS established limits on the use and disclosure of medical records and
other individually identifiable health information by Covered Entities. In addition, the HIPAA privacy regulations
provide patients with new rights to understand and control how their health information is used. The HIPAA privacy
regulations do not preempt more stringent state laws and regulations that may apply to us and other Covered Entities,
including laws that place stricter controls on the release of information relating to specific diseases or conditions, and
complying with additional state requirements could require us to make additional investments beyond those we have