Cigna 2014 Annual Report Download - page 48

PART I
ITEM 1. Business
continue to allocate significant resources to comply with these
Medicare Regulations
regulations and requirements and to maintain audit readiness.
Several of our subsidiaries engage in businesses that are subject to
federal Medicare regulations, such as:
Privacy, Security and Data Standards Regulations
those offering individual and group Medicare Advantage (HMO) The federal Health Insurance Portability and Accountability Act of
coverage; 1996 and its implementing regulations (‘‘HIPAA’’) imposes minimum
those offering Medicare Pharmacy (Part D) products that are subject standards on health insurers, HMOs, health plans, health care
to federal Medicare regulations; and providers and clearinghouses for the privacy and security of protected
health information. HIPAA also established rules that standardize the
billing of Medicare Part B claims on behalf of providers with whom format and content of certain electronic transactions, including, but
we have contractual management agreements. not limited to, eligibility and claims. ICD-9 is the current electronic
code system for diagnosis and procedures for hospital claims. Entities
In our Medicare Advantage business, we contract with CMS to
subject to HIPAA are required to update their transaction formats for
provide services to Medicare beneficiaries pursuant to the Medicare
electronic data interchange standards and convert to new ICD-10
program. As a result, our right to obtain payment (and the
diagnosis and procedure codes. The effective date for ICD-10
determination of the amount of such payments), enroll and retain
conversion is October 1, 2015.
members and expand into new service areas is subject to compliance
with CMS’ numerous and complex regulations and requirements that HIPAA’s privacy and security requirements were expanded by the
are frequently modified and subject to administrative discretion. Health Information Technology for Economic and Clinical Health
Marketing and sales activities (including those of third-party brokers Act (‘‘HITECH’’) through additional contracting requirements for
and agents) are also heavily regulated by CMS and other covered entities, the extension of privacy and security provisions to
governmental agencies, including applicable state departments of business associates, the requirement to provide notification to various
insurance. We expect to continue to allocate significant resources to parties in the event of a data breach of protected health information,
our compliance, ethics and fraud, waste and abuse programs to and enhanced financial penalties for HIPAA violations, including
comply with the laws and regulations governing Medicare Advantage potential criminal penalties for individuals.
and prescription drug plan programs.
The federal Gramm-Leach-Bliley Act generally places restrictions on
Several of our subsidiaries are also subject to reporting requirements the disclosure of non-public information to non-affiliated third
pursuant to Section 111 of the Medicare, Medicaid and SCHIP parties, and requires financial institutions, including insurers, to
Extension Act of 2007. provide customers with notice regarding how their non-public
personal information is used, including an opportunity to ‘‘opt out’’ of
Federal Audits of Government Sponsored Health Care
certain disclosures. State departments of insurance and certain federal
Programs
agencies adopted implementing regulations as required by federal law.
Participation in government sponsored health care programs subjects A number of states have adopted data security laws and regulations,
us to a variety of federal laws and regulations and risks associated with regulating data security and requiring security breach notification that
audits conducted under these programs. These audits may occur in may apply to us in certain circumstances. Neither HIPAA nor the
years subsequent to our providing the relevant services under audit. Gramm-Leach-Bliley privacy regulations preempt more stringent state
These risks may include reimbursement claims as well as potential laws and regulations.
fines and penalties. For example, with respect to our Medicare
Advantage business, CMS and the Office of the Inspector General
Dodd-Frank Act and Investment-Related Regulations
perform audits to determine a health plan’s compliance with federal
The Dodd-Frank Wall Street Reform and Consumer Protection Act
regulations and contractual obligations, including compliance with
(the ‘‘Dodd-Frank Act’’) provides for a number of reforms and
proper coding practices (sometimes referred to as ‘‘Risk Adjustment
regulations in the corporate governance, financial reporting and
Data Validation Audits’’ or ‘‘RADV audits’’) and compliance with
disclosure, investments, tax and enforcement areas. The Dodd-Frank
fraud and abuse enforcement practices through Recovery Audit
Act established a Federal Insurance Office (the ‘‘FIO’’) to develop
Contractor (‘‘RAC’’) audits in which third-party contractors conduct
federal policy on insurance matters. While the FIO does not have
post-payment reviews on a contingency fee basis to detect and correct
authority over health insurance, it may have authority over other parts
improper payments. See ‘‘Business – Global Health Care’’ beginning
of our business, such as life insurance. Additional rulemaking by the
on page 2 of this Form 10-K for additional information about our
SEC and other regulatory authorities continues. We are closely
participation in government health-related programs.
monitoring how these regulations might impact us; however, the full
The federal government has made investigating and prosecuting impact may not be known for several years until regulations become
health care fraud and abuse a priority. Fraud and abuse prohibitions fully effective.
encompass a wide range of activities, including kickbacks for referral
Depending upon their nature, our investment management activities are
of customers, billing for unnecessary medical services, improper
subject to U.S. federal securities laws, ERISA and other federal and state
marketing, and violation of patient privacy rights. The regulations
laws governing investment related activities. In many cases, the
and contractual requirements in this area are complex, are frequently
modified, and are subject to administrative discretion. We expect to
16 CIGNA CORPORATION - 2014 Form 10-K
•
•
•