Health Net 2011 Annual Report Download - page 46

In addition, we intend to enhance and modernize interactions with our customers, brokers, agents, providers,
employees and other stakeholders through web-enabled technology, among other things. Our failure to maintain
successful e-business capabilities could result in competitive and cost disadvantages for us as compared to our
competitors.
We must comply with requirements relating to patient privacy and information security, including taking steps
to ensure compliance by our business associates with HIPAA.
The Department of Health and Human Services has regulations in place under HIPAA relating to the
privacy and security of protected health information (“PHI”). These regulations, as amended, require health
plans, clearinghouses and providers to, among other obligations: comply with various requirements and
restrictions related to the use, disclosure, storage, and transmission of PHI; adopt rigorous internal policies and
procedures to safeguard PHI; and enter into specific written agreements with business associates that receive, use
and/or create PHI on our behalf. HIPAA also established significant civil and criminal sanctions for violations.
These regulations expose us to liability for, among other things, violations of the regulations by our business
associates, including the third party vendors involved in our outsourcing projects. The Health Information
Technology for Economic and Clinical Health Act (the “HITECH Act”), which became fully effective in
February 2010, expanded HIPAA’s requirements for security and privacy safeguards, including improved
enforcement, additional limitations on use and disclosure of PHI and additional potential penalties for violations,
and imposed notice obligations in the event of a breach of unsecured PHI. Although our contracts with our
business associates provide for protections of PHI by our business associates, we may have limited control over
the actions and practices of our business associates. Compliance with HIPAA and state and federal privacy and
security laws and regulations has resulted in and may in the future result in significant costs to us due to
necessary systems changes, the development of new administrative processes and the effects of potential
noncompliance by us or our business associates. See also “—If we fail to comply with requirements relating to
patient privacy and information security, including taking steps to ensure that our business associates who
obtain access to sensitive patient information maintain the privacy and security of such information, our
reputation and business operations could be materially adversely affected.”
If we fail to comply with requirements relating to patient privacy and information security, including taking
steps to ensure that our business associates who obtain access to sensitive patient information maintain the
privacy and security of such information, our reputation and business operations could be materially
adversely affected.
The collection, maintenance, use, disclosure and disposal of individually identifiable health information or
data, including PHI, by our businesses are regulated at the federal and state levels. Despite the privacy and
security measures we have in place to ensure compliance with applicable laws and regulations, our facilities and
systems, and those of our third party vendors and service providers, are vulnerable to privacy and security
incidents including, but not limited to, computer hacking, breaches, acts of vandalism or theft, computer viruses
or other forms of cyber attack, misplaced or lost data, programming and/or human errors or other similar events.
For example, in January 2011, we were notified by a third party vendor that certain of our server drives could not
be accounted for in connection with the migration of our data center to a facility owned and operated by our third
party vendor. We subsequently commenced an investigation of the contents of the unaccounted for server drives,
including a detailed forensic review by computer experts, and determined that certain of these unaccounted for
drives contain PHI and other personally identifiable information relating to certain individuals. We reported the
loss to authorities and notified affected individuals. This matter is under review by various regulatory authorities.
In addition, we, and our third party vendor, are currently party to various putative class action lawsuits brought in
federal and state courts on behalf of individuals who claim to be affected by this incident. See “Part I—Item 3.
Legal Proceedings” and “—We face risks related to litigation, which, if resolved unfavorably, could result in
substantial penalties and/or monetary damages, including punitive damages. In addition, we incur material
expenses in the defense of litigation and our financial condition, results of operations, cash flow and/or liquidity
44