Aetna 2015 Annual Report Download - page 66

Annual Report- Page 60
Our use and disclosure of members’, customers’ and other constituents’ sensitive information is subject to
complex regulations at multiple levels. We would be adversely affected if we or our business associates or other
vendors fail to adequately protect members’, customers’ or other constituents’ sensitive information.
Our information systems are critical to the operation of our business. We collect, process, maintain, retain, evaluate,
utilize and distribute large amounts of personal health and financial information and other confidential and sensitive
data about our members, customers and other constituents in the ordinary course of our business. Some of our
information systems rely upon third party systems to accomplish these tasks. The use and disclosure of such
information is regulated at the federal, state and international levels, and these laws, rules and regulations are
subject to change and increased enforcement activity, such as the audit program implemented by HHS under
HIPAA. In some cases, such laws, rules and regulations also apply to our vendors and/or may hold us liable for any
violations by our vendors. International laws, rules and regulations governing the use and disclosure of such
information are generally more stringent than in the United States, and they vary from jurisdiction to jurisdiction.
Noncompliance with any privacy or security laws or regulations, or any security breach, cyber-attack or
cybersecurity breach, and any incident involving the theft, misappropriation, loss or other unauthorized disclosure
of, or access to, sensitive or confidential member information, whether by us, by one of our vendors or by another
third party, could require us to expend significant resources to remediate any damage, interrupt our operations and
damage our reputation, and could also result in investigations, regulatory enforcement actions, material fines and
penalties, loss of customers, litigation or other actions which could have a material adverse effect on our business,
brand, reputation, cash flows and operating results.
Our business depends on our members’ and customers’ willingness to entrust us with their health related and other
sensitive personal information. Events that negatively affect that trust, including failing to keep our information
technology systems and our members’ and customers’ sensitive information secure from significant attack, theft,
damage, loss or unauthorized disclosure or access, whether as a result of our action or inaction or that of our
business associates, vendors or other third parties, including our PBM services suppliers, could adversely affect our
reputation, membership and revenues and also expose us to mandatory disclosure to the media, litigation (including
class action litigation) and other enforcement proceedings, material fines, penalties and/or remediation costs, and
compensatory, special, punitive and statutory damages, consent orders, adverse actions against our licenses to do
business and/or injunctive relief, any of which could adversely affect our business, cash flows, operating results or
financial position. There can be no assurance that any such failure will not occur, or if any does occur, that we will
detect it or that it can be sufficiently remediated.
We are subject to retroactive adjustments to and/or withholding of certain premiums and fees, including as a
result of CMS RADV audits. We generally rely on health care providers to appropriately code claim submissions
and document their medical records. If these records do not appropriately support our risk adjusted premiums,
we may be required to refund premium payments to CMS.
Premiums and/or fees for Medicare members, certain federal government employee groups and Medicaid
beneficiaries are subject to retroactive adjustments and/or withholding by the federal and applicable state
governments. Our Public Exchange business, including amounts payable to us or payable by us under the Health
Care Reform premium stabilization programs and our risk adjustment and reinsurance data, also is subject to audit
by governmental authorities. CMS regularly audits our performance to determine our compliance with CMS’s
regulations and our contracts with CMS and to assess the quality of the services we provide to our Medicare
members.
CMS uses various payment mechanisms to allocate and adjust premium payments to our and other companies’
Medicare plans by considering the applicable health status of Medicare members as supported by information
prepared, maintained and provided by health care providers. We collect claim and encounter data from providers
and generally rely on providers to appropriately code their submissions to us and document their medical records,
including the diagnosis data submitted to us with claims. CMS pays increased premiums to Medicare Advantage
plans and PDPs for members who have certain medical conditions identified with specific diagnosis codes. Federal
regulators review and audit the providers’ medical records to determine whether those records support the related
diagnosis codes that determine the members’ health status and the resulting risk-adjusted premium payments to us.