Aetna 2011 Annual Report Download - page 61

Annual Report- Page 55
• Adversely affecting our ability to market and sell our products and/or services;
• Requiring us to change our products and/or services; and/or
• Increasing the regulatory and legislative requirements with which we must comply.
We would be adversely affected if we fail to adequately protect member and customer related health,
financial and other sensitive information, including taking steps to ensure that our business associates who
obtain access to sensitive information maintain its confidentiality.
The use and disclosure of personal health, financial and other sensitive information is regulated at the federal, state
and international levels, and these laws and rules are subject to change by legislation or administrative or judicial
determination and increased enforcement activity. HIPAA requires business associates as well as Covered Entities
to comply with certain privacy and security requirements. HHS recently announced that it is launching a new audit
program under HIPAA. At this time we cannot predict whether we will be audited or any potential penalties from
or results of such an audit. In addition, international laws governing the use and disclosure of such information are
generally more stringent than in the U.S., and they vary from jurisdiction to jurisdiction.
We collect, process, maintain, retain and distribute large amounts of personal health and financial information and
other confidential and sensitive data about our members and customers in the ordinary course of our business. Our
business therefore depends substantially on our members' and customers' willingness to entrust us with their health
related and other sensitive information. Events that negatively affect that trust, including failing to keep our
computer networks, information technology systems, computers and programs and our members' and customers'
sensitive information secure from attack, damage or unauthorized access, whether as a result of our action or
inaction or that of one of our business associates or other vendors, including CVS Caremark, could adversely affect
our reputation, membership and revenues and also expose us to mandatory disclosure to the media, litigation
(including class action litigation) and other enforcement proceedings, material fines, penalties and/or remediation
costs, and compensatory, special, punitive and statutory damages, consent orders, adverse actions against our
licenses to do business and/or injunctive relief, any of which could adversely affect our business, cash flows,
operating results or financial condition. We have experienced cyber attacks such as distributed denial of service
attacks in the past and expect to continue to experience them going forward. Although the impact of such attacks
has not been material through December 31, 2011, we can provide no assurance that we will be able to identify,
prevent or contain the effects of such attacks in the future. As we expand our HIT business, including through our
acquisition and growth of Medicity, expand our Accountable Care Solutions business, increase the amount of
information we make available to members and consumers on mobile devices, expand our use of social media and
expand internationally, our exposure to these data security and related cybersecurity risks, including the risk of
undetected attacks, damage or unauthorized access, increases, and the cost of attempting to protect against these
risks also increases.
We would be adversely affected if we do not effectively deploy our capital.
Our operations generate significant capital, and we have the ability to raise additional capital. In deploying our
capital to fund our investments in operations (including information technology and other strategic projects),
dividends, acquisitions, share repurchases or other capital uses, our financial position and operating results could be
adversely affected if we do not appropriately balance the risks and opportunities that are inherent in each method of
deploying our capital.
The manner in which we deploy our capital impacts our financial strength, claims paying ability and credit ratings
issued by recognized rating organizations. We believe ratings are important factors in establishing the competitive
position of insurance companies and health care benefits companies. Information about ratings issued by
nationally-recognized ratings organizations is broadly distributed and generally used throughout our industry. We
believe the financial strength and claims paying ability of our principal insurance and HMO subsidiaries are
important factors in marketing our products to certain of our customers. In addition, Aetna Inc.'s credit ratings
impact the cost and availability of future borrowings, and accordingly our cost of capital. Each of the ratings
organizations reviews our ratings periodically, and there can be no assurance that our current ratings will be
maintained in the future. Our ratings reflect each rating organization's opinion of our financial strength, operating
performance and ability to meet our debt obligations or obligations to our insureds. Downgrades in our ratings,
should they occur, could adversely affect our business, cash flows, financial condition and operating results.