Health Net 2011 Annual Report Download - page 22

Privacy Regulations. The use, disclosure and maintenance of individually identifiable health information
and other data by our businesses is regulated by various laws at the federal, state and local level. These laws and
regulations are changed frequently by legislation or administrative interpretation. Most of those laws are derived
from Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the privacy provisions in the
federal Gramm-Leach-Bliley Financial Modernization Act of 1999 (the “Gramm-Leach-Bliley Act”), although
there are an increasing number of state laws that require notification to individuals and regulatory authorities in
the event of a security breach and that specifically regulate the use and disclosure of social security numbers.
HIPAA and the implementing regulations that have been adopted in connection therewith impose
obligations for group health plans and issuers of health insurance coverage (such as health insurers and health
maintenance organizations) relating to the privacy and security of protected health information including
electronically transmitted protected health information (collectively, “PHI”). The regulations, which relate to the
privacy and security of PHI, require health plans, health care clearinghouses and providers to:
• comply with various requirements and restrictions related to the use, storage and disclosure of PHI,
• adopt rigorous internal procedures to protect PHI,
• create policies related to the privacy of PHI,
• enter into specific written agreements with business associates to whom PHI is disclosed, and
• notify individuals and regulatory authorities if PHI is compromised.
The regulations also establish significant criminal penalties and civil sanctions for non-compliance. Recent
developments in this area include the Health Information Technology for Economic and Clinical Health
(“HITECH”) Act, which became fully effective in February 2010. The HITECH Act expands the HIPAA rules
for security and privacy safeguards, including improved enforcement, additional limitations on use and
disclosure of PHI and additional potential penalties for non-compliance. See “Item 1A. Risk Factors—If we fail
to comply with requirements relating to patient privacy and information security, including taking steps to ensure
that our business associates who obtain access to sensitive patient information maintain the privacy and security
of such information, our reputation and business operations could be materially adversely affected” for
additional information about the risks related to privacy and security breaches.
The Gramm-Leach-Bliley Act generally requires insurers to provide customers with notice regarding how
their personal health and financial information is used and, in certain circumstances, the opportunity to “opt out”
of certain disclosures before the insurer shares non-public personal information with a non-affiliated third party.
Like HIPAA, this law sets a “floor” standard, allowing states to adopt more stringent requirements governing
privacy protection.
ERISA. Most employee benefit plans are regulated by the federal government under the Employee
Retirement Income Security Act of 1974, as amended (“ERISA”). Employment-based health coverage is such an
employee benefit plan. ERISA is administered, in large part, by the U.S. Department of Labor. ERISA contains
disclosure requirements for documents that define the benefits and coverage. It also contains a provision that
causes federal law to preempt state law in the regulation and governance of certain benefit plans and employer
groups, including the availability of legal remedies under state law.
Other Federal Regulations. We must comply with, and are affected by, laws and regulations relating to the
award, administration and performance of U.S. Government contracts. Government contract laws and regulations
affect how we do business with our customers and, in some instances, impose added costs on our business. In
addition, because of our activities to support the MFLC contract and certain outsourcing arrangements we have
with third party vendors, we are also subject to the U.S. Foreign Corrupt Practices Act (“FCPA”) and similar
worldwide anti-corruption laws, including the U.K. Bribery Act of 2010, which generally prohibit companies and
their intermediaries from making improper payments to non-U.S. officials for the purpose of obtaining or
20