Aetna 2013 Annual Report Download - page 41

Annual Report- Page 35
adversely affect our ability to operate our business profitably in certain product lines and geographies we serve
today, particularly during periods of increased utilization of medical services and/or medical cost trend or when
such utilization and/or trend exceeds our projections.
In addition, we requested significant increases in our premium rates in our individual and small group Health Care
businesses for 2014 and expect to continue to request significant increases in those rates for 2015 and beyond in
order to adequately price for projected medical cost trends, the expanded coverages and rating limits required by
Health Care Reform and the significant assessments, fees and taxes imposed by Health Care Reform. These
significant increases heighten the risks of adverse public and regulatory action and adverse selection and the
likelihood that our requested premium rate increases will be denied, reduced or delayed, which could lead to
operating margin compression.
In addition to Health Care Reform requirements, the Health Insurance Portability and Accountability Act of 1996
(“HIPAA”) generally requires insurers and other carriers that cover small employer groups in any market to cover
any small employer group. HIPAA also mandates guaranteed renewal of health care coverage for most employer
groups, subject to certain defined exceptions, and provides for specified employer notice periods in connection with
product and market withdrawals. The law further limits exclusions based on pre-existing conditions for individuals
covered under group insurance policies to the extent the individuals had prior creditable coverage within a specified
time frame. Like Health Care Reform, HIPAA is structured as a “floor” requirement, allowing states latitude to
enact more stringent rules governing each of these restrictions. For example, certain states have modified HIPAA's
definition of a small group (2-50 employees) to include groups of one employee.
In addition, a number of states provide for a voluntary reinsurance mechanism to spread small group risk among
participating insurers and other carriers. In a small number of states, participation in this pooling mechanism is
mandatory for all small group carriers. In general, we have elected not to participate in voluntary pools. However,
even in the voluntary pool states, we may be subject to certain supplemental assessments related to the state's small
group experience.
HIPAA Administrative Simplification, GLBA and Other Privacy, Security and Confidentiality Requirements
Federal, state and international privacy and security requirements change periodically because of legislation,
regulations and judicial or administrative interpretation. The regulations under the administrative simplification
provisions of HIPAA, as further modified by the American Recovery and Reinvestment Act of 2009 (“ARRA”) and
Health Care Reform, also impose a number of additional obligations on issuers of health insurance coverage and
health benefit plan sponsors.
HIPAA's administrative simplification requirements apply to self-funded group health plans, health insurers and
HMOs, health care clearinghouses and health care providers who transmit health information electronically
(“Covered Entities”). Regulations adopted to implement administrative simplification also require that “business
associates” acting for or on behalf of these Covered Entities be contractually obligated to meet HIPAA
standards. The administrative simplification regulations establish significant criminal penalties and civil sanctions
for noncompliance.
Under administrative simplification, HHS also has published rules requiring the use of standardized code sets and
unique identifiers for employers and health care providers. The federal government has mandated that by October
2014 the health and related benefits industry, including health insurers, health care providers and laboratories,
upgrade to an updated and expanded set of standardized diagnosis and procedure codes used for describing health
conditions, known as ICD-10. Implementing ICD-10 will continue to require substantial investments from the
health and related benefits industry, including us. We currently estimate that our ICD-10 project expenses will be
between $20 million and $30 million during 2014.
The HIPAA privacy regulations adopted by HHS establish limits on the use and disclosure of medical records and
other individually identifiable health information (protected health information or “PHI”) by Covered
Entities. Further, ARRA requires us and other Covered Entities to report unauthorized releases of, use of, or access