Health Net 2009 Annual Report Download - page 18

In response to MIPPA, CMS promulgated regulations governing the marketing and sale of Medicare
Advantage and PDP products. These regulations prohibit certain marketing activities by contracted and in-house
sales producers, including outbound calling, and place new requirements on amounts and duration of
compensation payable to contracted producers. We could be subject to monetary and other sanctions by CMS for
a contracted or in-house sales producer’s violation of these regulations.
In late 2008, CMS performed a routine audit of certain of our Medicare Advantage, Private Fee For Service
and PDP products and found deficiencies in many of the business areas included in the review. On August 6,
2009, CMS accepted our corrective action plan relating to the 2008 audit. In December 2009, CMS performed a
focused audit to assess our implementation of the corrective action plan. We received CMS’ report on the
focused audit and related corrective action request on January 11, 2010 and submitted our corrective action plan
to CMS for review and approval on February 26, 2010. CMS found deficiencies in many of the business areas
included in the review, including several repeat findings from previous audits, which were submitted to CMS
Central Office for review.
On January 7, 2010, we were notified by CMS that, due to certain pharmacy claims processing errors, none
of our stand-alone PDP plans would be considered “available” for the purposes of the process through which
CMS randomly assigns low-income subsidy (“LIS”) eligible Medicare beneficiaries not otherwise enrolled in
PDP plans into stand-alone PDP plans, effective February 1, 2010. In its notice to us, CMS indicated that it
would work with us to develop a corrective action plan in this regard, but at this time, we have not received a
corrective action request from CMS.
See “Item 1A. Risk Factors—Federal and state audits, review and investigations of us and our subsidiaries
could have a material adverse effect on our operations” for description of the risks associated with the CMS
audit and the suspension of our auto-enrollment for LIS beneficiaries.
Medicaid and Related Legislation. Federal law has also implemented other health programs that are
partially funded by the federal government, such as the Medicaid program (known as Medi-Cal in California) and
CHIP (known as Healthy Families in California). Our Medi-Cal program is regulated and administered by the
California Department of Health Care Services and Healthy Families is regulated by the Managed Risk Medical
Insurance Board. Our provision of administrative services to United and certain of its affiliates pursuant to the
United Administrative Services Agreements is subject to regulation by the New Jersey Department of Human
Services and Division of Medical Assistance and Health Services. Federal funding remains critical to the
viability of these programs, particularly in light of California’s state budget deficits. Federal law permits the
federal government to oversee and, in some cases, to enact, regulations and other requirements that must be
followed by California. Medicaid is administered at the federal level by CMS; CHIP is administered by the
Health Resources and Services Administration, another arm of the Department of Health and Human Services.
Privacy Regulations. The use, disclosure and maintenance of individually identifiable health information
and other data by our businesses is regulated by various laws at the federal, state and local level. These laws and
regulations are changed frequently by legislation or administrative interpretation. Most of those laws are derived
from Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the privacy provisions in the
federal Gramm-Leach-Bliley Financial Modernization Act of 1999 (the “Gramm-Leach-Bliley Act”), although
there are an increasing number of state laws that require notification to individuals and regulatory authorities in
the event of a security breach and that specifically regulate the use and disclosure of social security numbers.
HIPAA and the implementing regulations that have been adopted in connection therewith impose
obligations for group health plans and issuers of health insurance coverage (such as health insurers and health
maintenance organizations) relating to the privacy and security of protected health information including
electronically transmitted protected health information (collectively, “PHI”). The regulations, which relate to the
privacy and security of PHI, require health plans, health care clearinghouses and providers to:
• comply with various requirements and restrictions related to the use, storage and disclosure of PHI,
16