Aetna 2012 Annual Report Download - page 75

Annual Report- Page 69
Our ability to manage general and administrative expenses while expanding our marketplace presence
affects our operating results.
Our operating results depend in part on our ability to drive our general and administrative expenses to competitive
levels while expanding our marketplace presence. Controlling general and administrative expenses is particularly
important in our Health Care businesses that are subject to regulatory changes that may restrict our underwriting
margins, such as minimum MLR requirements. We have significant fixed costs, and our ability to reduce variable
costs in the short term is limited. We manage general and administrative expenses by, among other things, reducing
the number of products we offer and controlling salaries and related benefits and information technology and other
general and administrative costs, while simultaneously seeking to implement Health Care Reform and other
regulatory requirements, attract and retain key employees, maintain robust management practices and controls,
implement improvements in technology and achieve our strategic goals, including profitable membership growth.
In addition, transaction and integration costs related to the proposed Coventry acquisition will increase our general
and administrative expenses over the next several years. We can provide no assurance that we will be able to
manage our general and administrative expenses to competitive levels.
We would be adversely affected if we fail to adequately protect member and customer related health,
financial and other sensitive information, including taking steps to ensure that our business associates who
obtain access to sensitive information maintain its confidentiality.
The use and disclosure of personal health, financial and other sensitive information is regulated at the federal, state
and international levels, and these laws and rules are subject to change by legislation or administrative or judicial
determination and increased enforcement activity. HIPAA requires business associates as well as Covered Entities
to comply with certain privacy and security requirements. HHS has implemented a new audit program under
HIPAA. At this time we cannot predict whether we will be audited or any potential penalties from or results of such
an audit. In addition, international laws governing the use and disclosure of such information are generally more
stringent than in the U.S., and they vary from jurisdiction to jurisdiction.
We collect, process, maintain, retain and distribute large amounts of personal health and financial information and
other confidential and sensitive data about our members and customers in the ordinary course of our business. Our
business therefore depends substantially on our members' and customers' willingness to entrust us with their health
related and other sensitive information. Events that negatively affect that trust, including failing to keep our
computer networks, information technology systems, computers and programs and our members' and customers'
sensitive information secure from attack, damage or unauthorized access, whether as a result of our action or
inaction or that of one of our business associates or outsourced or other vendors, including CVS Caremark, could
adversely affect our reputation, membership and revenues and also expose us to mandatory disclosure to the media,
litigation (including class action litigation) and other enforcement proceedings, material fines, penalties and/or
remediation costs, and compensatory, special, punitive and statutory damages, consent orders, adverse actions
against our licenses to do business and/or injunctive relief, any of which could adversely affect our business, cash
flows, operating results or financial condition.
We have experienced cyber attacks such as distributed denial of service attacks and attempted virus infections in the
past and expect to continue to experience them going forward. Although the impact of such attacks has not been
material through December 31, 2012, we can provide no assurance that we will be able to identify, prevent or
contain the effects of such attacks or other cybersecurity risks or threats in the future. As we expand our HIT
business, including through our acquisition and growth of ACS, Medicity, and Active Health, increase the amount
of information we make available to members and consumers on mobile devices, expand our use of social media
and expand internationally, our exposure to these data security and related cybersecurity risks, including the risk of
undetected attacks, damage or unauthorized access, increases, and the cost of attempting to protect against these
risks also increases.