Aetna 2012 Annual Report Download - page 42

Annual Report- Page 36
rules, changing the HIPAA enforcement rule and modifying the data breach reporting requirements. Additional
regulations under HIPAA remain pending. We will continue to assess the impact of these regulations on our
business as they are issued. In addition, the HIPAA privacy regulations provide patients with new rights to
understand and control how their health information is used.
The HIPAA privacy regulations do not preempt more stringent state laws and regulations that may apply to us and
other Covered Entities, including laws that place stricter controls on the release of information relating to specific
diseases or conditions and requirements to notify members of unauthorized release or use of or access to PHI.
Complying with additional state requirements could require us to make additional investments beyond those we
have made to comply with the HIPAA regulations. HHS also has adopted security regulations designed to protect
member health information from unauthorized use or disclosure.
In addition, states have adopted regulations to implement provisions of the Financial Modernization Act of 1999
(also known as Gramm-Leach-Bliley Act (“GLBA”)) which generally require insurers to provide customers with
notice regarding how their non-public personal health and financial information is used and the opportunity to “opt
out” of certain disclosures before the insurer shares such information with a non-affiliated third party. The GLBA
regulations apply to health, life and disability insurance. Like HIPAA, GLBA sets a “floor” standard, allowing
states to adopt more stringent requirements governing privacy protection.
Other Legislative Initiatives and Regulatory Initiatives
In addition to the Health Care Reform, HIPAA and ARRA measures discussed above, the U.S. federal and state
governments, as well as governments in other countries where we do business, continue to enact and seriously
consider many other broad-based legislative and regulatory proposals that have had a material impact on or could
materially impact various aspects of the health care and related benefits system. For example:
• Under the Budget Control Act of 2011 (the “BCA”) and the American Taxpayer Relief Act of 2012 (the
“ATRA”), absent further legislation, automatic across-the-board budget cuts (also known as
“sequestration”) will start in March 2013, including Medicare spending cuts of not more than 2% of total
program costs for nine years. The ATRA also reduced Medicare reimbursements to health plans. Certain
programs are exempt from these cuts, including Medicaid, and certain Medicare payments are exempt from
these cuts, including Part D low-income subsidies (“LIS”), the Part D catastrophic subsidies, and payments
to states for coverage of Medicare cost-sharing for certain low-income Medicare beneficiaries. The Office
of Management and Budget (“OMB”) is responsible for making these cuts. Significant uncertainty remains
as to how the Congress will proceed with specifying government spending cuts, entitlement program
reform and/or actions that create additional federal revenue. We are exploring strategies, such as
amendments to our contracts with providers, to mitigate any impact that may result from these cuts and/or
related Congressional action. We cannot predict the impact that any sequestration, if it occurs, or
entitlement program reform will have on our business, operations or operating results, but the effects could
be materially adverse, particularly on our Medicare revenues and operating results.
• A number of states, including New York, have enacted or introduced legislation or regulations requiring life
insurers to take additional steps to identify unreported deceased policyholders and make other changes to
their claim payment and related escheat practices. For additional information on these life insurance
matters, refer to “Life and Disability Insurance” beginning on page 46.
Other legislative and/ or regulatory measures which are or recently have been under consideration include the
following:
• Amending or supplementing the Employee Retirement Income Security Act of 1974 (“ERISA”) to impose
greater requirements on the administration of employer-funded benefit plans or limit the scope of current
ERISA pre-emption, which would among other things expose us and other health plans to expanded
liability for punitive and other extra-contractual damages and additional state regulation.