Aetna 2013 Annual Report Download - page 42

Annual Report- Page 36
to PHI to any impacted individuals and to HHS and to notify the media in any states where 500 or more people are
impacted by any unauthorized release or use of or access to PHI. Business associates (e.g., entities that provide
services to health plans, such as electronic claims clearinghouses, print and fulfillment vendors, consultants, and us
for the administrative services we provide to our ASC customers) must also comply with certain HIPAA
provisions. In addition, ARRA establishes greater civil and criminal penalties for Covered Entities and business
associates who fail to comply with HIPAA's provisions and gives new enforcement rights to state attorneys
general. In January 2013, HHS issued final rules, effective in March 2013, revising HIPAA's privacy and security
rules, changing the HIPAA enforcement rule and modifying the data breach reporting requirements. Additional
regulations under HIPAA remain pending. We will continue to assess the impact of these regulations on our
business as they are issued.
The HIPAA privacy regulations do not preempt more stringent state laws and regulations that may apply to us and
other Covered Entities, including laws that place stricter controls on the release of information relating to specific
diseases or conditions and requirements to notify members of unauthorized release or use of or access to PHI.
Complying with additional state requirements could require us to make additional investments beyond those we
have made to comply with the HIPAA regulations. HHS also has adopted security regulations designed to protect
member health information from unauthorized use or disclosure.
The HIPAA privacy regulations provide patients with new rights to understand and control how their health
information is used. States also have adopted regulations to implement provisions of the Financial Modernization
Act of 1999 (also known as Gramm-Leach-Bliley Act (“GLBA”)) which generally require insurers to provide
customers with notice regarding how their non-public personal health and financial information is used and the
opportunity to “opt out” of certain disclosures before the insurer shares such information with a non-affiliated third
party. The GLBA regulations apply to health, life and disability insurance. Like HIPAA, GLBA sets a “floor”
standard, allowing states to adopt more stringent requirements governing privacy protection.
Other Legislative Initiatives and Regulatory Initiatives
In addition to the Health Care Reform, HIPAA and ARRA measures discussed above, the U.S. federal and state
governments, as well as governments in other countries where we do business, continue to enact and seriously
consider many other broad-based legislative and regulatory proposals that have had a material impact on or could
materially impact various aspects of the health care and related benefits system. For example:
• Under the Budget Control Act of 2011 (the “BCA”) and the American Taxpayer Relief Act of 2012 (the
“ATRA”) automatic across-the-board budget cuts (also known as “sequestration”) began in March 2013,
including Medicare spending cuts of not more than 2% of total program costs per year through 2024. In
addition, CMS's Medicare Advantage and prescription drug program (“PDP”) premium rates for 2014
reflect a material reduction in 2014 premiums compared to 2013 for Medicare Advantage and PDP plans
which is in addition to the challenge we face from the impact of the industry-wide health insurer fee that
became effective January 1, 2014. CMS's 2014 and proposed 2015 rates represent a meaningful revenue
and operating results challenge for us. Significant uncertainty remains as to whether and how the Congress
will proceed with actions that create additional federal revenue and/or with entitlement reform. We cannot
predict future Medicare funding levels or the impact that future federal budget actions or entitlement
program reform, if it occurs, will have on our business, operations or operating results, but the effects could
be materially adverse, particularly on our Medicare and/or Medicaid revenues and operating results.
• A number of states have enacted or introduced legislation or regulations requiring life insurers to take
additional steps to identify unreported deceased policyholders and make other changes to their claim
payment and related escheat practices. For additional information on these life insurance matters, refer to
“Life and Disability Insurance” beginning on page 45.