Health Net 2014 Annual Report Download - page 21

19
disruptions, disputes with our providers or members, increased exposure to litigation, regulatory issues, damage to our
existing or potential member relationships or other adverse consequences.
Due to the magnitude, scope, complexity and remaining uncertainties of the ACA, including the continuing
modification and interpretation of the ACA rules and the operational risks involved with simultaneous implementation
of multiple initiatives in new markets without established market data, we cannot predict the ultimate impact on our
business of future regulations and laws, including state laws, implementing the ACA. Depending in part on its ultimate
requirements, the ACA could have a material adverse effect on our business, financial condition, cash flows and results
of operations.
For additional discussions of risks and uncertainties related to the ACA, see "Item 1A. Risk Factors."
Other Federal Laws and Regulation
Medicare Legislation and Regulation. Comprehensive legislation, specifically Title XVIII of the Social Security
Act of 1935, as amended, governs our Medicare program. In addition, our Medicare contracts are subject to regulation
by CMS. CMS has the right to audit Medicare contractors and the health care providers and administrative contractors
who provide certain services on their behalf to determine the quality of care being rendered and the degree of
compliance with CMS' contracts and regulations.
See “—Segment Information—Western Region Operations—Medicare Products” for more information on our
Medicare business and see “Item 1A. Risk Factors—Federal and state audits, reviews and investigations of us and our
subsidiaries could have a material adverse effect on our operations, financial condition and cash flows” for a
description of certain regulatory risks associated with our Medicare business.
Medicaid and Related Legislation. Federal law has also implemented other health programs that are partially
funded by the federal government, such as the Medicaid program (known as Medi-Cal in California). Our Medicaid
programs are regulated and administered in California by the DHCS and in Arizona by AHCCCS. Federal funding
remains critical to the viability of these programs. Federal law permits the federal government to oversee and, in some
cases, to enact, regulations and other requirements that must be followed by states with respect to these programs.
Medicaid is administered at the federal level by CMS. The dual eligibles demonstrations under the CCI are regulated
and administered in Los Angeles and San Diego counties by CMS and DHCS.
See the discussion above under the heading “—Western Region Operations Segment—Medicaid Expansion and
Recent State Legislation,” "—Western Region Operations Segment—California Coordinated Care Initiative," and “Item
1A. Risk Factors—Government programs represent an increasing share of our revenues. If we are unable to effectively
administer these programs, if we do not effectively adapt to changes to these programs, or if we experience a significant
reduction in revenues from these government programs, it could have a material adverse effect on our business,
financial condition or results of operations.”
Privacy Regulations. State, federal, and local laws and regulations govern the privacy and security of Protected
Health Information (“PHI”), Personal Information (“PI”), and other categories of legally protected data that our
businesses handle. Such laws and regulations include, but are not limited to: the Health Insurance Portability and
Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009
(“HITECH Act”) along with implementing regulations for both (collectively, “HIPAA Rules”); the Federal Trade
Commission Act; the privacy provisions in the federal Gramm-Leach-Bliley Financial Modernization Act of 1999 (the
“Gramm-Leach-Bliley Act”); state privacy and security laws such as the California Confidentiality of Medical
Information Act, the California Online Privacy Protection Act, and state laws that specifically regulate the use and
disclosure of social security numbers; and state breach notification laws that require providing notification in the event
of a breach of PI (such as Cal. Code § 1798.82). Privacy and security laws and regulations often change due to new or
amended legislation, regulations or administrative interpretation. A variety of state and federal regulators enforce these
laws, including but not limited to HHS, the Federal Trade Commission, state attorneys general, and other state
regulators.
The HIPAA Rules impose privacy and security obligations regarding PHI on Covered Entities (which refers to
certain health plans, health care clearinghouses and providers) including but not limited to:
• complying with various requirements and restrictions related to the use, storage and disclosure of PHI,
• implementing internal policies and procedures to maintain the privacy and security of PHI,