Aetna 2015 Annual Report Download - page 76

Annual Report- Page 70
our Healthagen technology and other services for health systems and provider organizations (including joint
ventures, ACOs and collaborative provider networks), optimizing our business platforms and expanding
internationally.
Achieving these goals will require us to devote significant senior management and other resources to acquisitions or
other transactions and to develop internally or acquire new products, solutions and technology before any
significant revenues or earnings are generated from such initiatives. If we are not able to acquire and/or develop and
launch new products and solutions, including internationally, our ability to profitably grow our business could be
adversely affected.
We may not be able to effectively manage our general and administrative expenses to competitive levels, which
may reduce our membership or profitability, or we may need to implement expense reduction measures that
adversely affect our future growth potential.
Our operating results depend in part on our ability to manage our general and administrative expenses to
competitive levels while delivering improved customer, member and provider service and expanding our
marketplace presence and accomplishing our strategic initiatives, including developing, operating and expanding
our consumer business. Controlling general and administrative expenses is particularly important in our Health Care
businesses that are subject to regulatory changes that may restrict our underwriting margins, such as minimum
MLR requirements. We have significant fixed costs, and our ability to reduce variable costs in the short term is
limited. We attempt to manage general and administrative expenses by, among other things, reducing the number of
products we offer and controlling costs for salaries and related benefits, information technology and other general
and administrative costs. However, we may not be successful in achieving the intended benefits of the cost-cutting
initiatives we undertake. In addition, these cost saving measures may adversely affect our ability to implement
Health Care Reform and other regulatory requirements, attract and retain key employees, maintain robust
management practices and controls, implement improvements in technology and achieve our strategic goals,
including profitable membership growth. Given the foregoing, we can provide no assurance that we will be able to
manage our general and administrative expenses to competitive levels, which may reduce our membership,
profitability and operating results and adversely affect our business and future growth potential.
We have experienced cyber attacks. We can provide no assurance that we will be able to detect, prevent or
contain the effects of such attacks or other information security (including cybersecurity) risks or threats in the
future.
We have experienced a variety of cyber attacks, and we expect to continue to experience cyber attacks going
forward. Among other things, we have experienced automated attempts to gain access to our public facing
networks, brute force, SYN flood and distributed denial of service attacks, attempted virus infections, mass
reconnaissance attempts, malware or injection attempts, phishing, PHP injection and cross-site scripting. Although
the impact of such attacks has not been material to our operations or results of operations through December 31,
2015, we can provide no assurance that we will be able to detect, prevent or contain the effects of such attacks or
other information security (including cybersecurity) risks or threats in the future. As we expand our Healthagen®
business, including through our growth of ACS, Medicity, and ActiveHealth, increase the amount of information we
make available to members, consumers and providers on mobile devices, expand our use of vendors, expand
internationally and expand our use of social media, our exposure to these data security and related cybersecurity
risks, including the risk of undetected attacks, damage, loss or unauthorized disclosure or access to and/or
disruption of our systems and the customer, member, provider, employee, ACO, joint venture, vendor and other
third party information they contain, increases, and the cost of attempting to protect against these risks also
increases.
The costs of attempting to protect against the foregoing risks and the costs of responding to a cyber-incident are
significant. Following a cyber-incident, our remediation efforts may not be successful, and a cyber-incident could
result in interruptions, delays or cessation of service, and loss of existing or potential customers. In addition,
breaches of our security measures and the unauthorized dissemination of sensitive personal information or
proprietary information or confidential information about us, our customers or other third-parties, could expose our