Humana 2015 Annual Report Download - page 31

23
The costs to eliminate or address cybersecurity threats and vulnerabilities before or after an incident could be
substantial. Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of
service, and loss of existing or potential members. In addition, breaches of our security measures and the unauthorized
dissemination of sensitive personal information or proprietary or confidential information about us or our members or
other third-parties, could expose our members’ private information and result in the risk of financial or medical identity
theft, or expose us or other third-parties to a risk of loss or misuse of this information, result in significant regulatory
fines or penalties, litigation and potential liability for us, damage our brand and reputation, or otherwise harm our
business.
Our business may be materially adversely impacted by the adoption of a new coding set for diagnoses.
Federal regulations related to the Health Insurance Portability and Accountability Act of 1996, as amended (HIPAA),
contain minimum standards for electronic transactions and code sets, and for the privacy and security of protected
health information. On October 1, 2015, ICD-10, the current system of assigning codes to diagnoses and procedures
associated with hospital utilization in the United States, replaced the prior set of codes. For dates of service on or after
October 1, 2015, health plans and providers are required to use ICD-10 codes for such diagnoses and procedures. While
we prepared for the transition to ICD-10, if unforeseen circumstances arise, it is possible that we could be exposed to
investigations and allegations of noncompliance, which could have a material adverse effect on our results of operations,
financial position and cash flows. In addition, if some providers continue to use ICD-9 codes on claims after October
1, 2015, including providers in our network who are employees, we will have to reject such claims, which may lead to
claim resubmissions, increased call volume and provider and customer dissatisfaction. Further, providers may use
ICD-10 codes differently than they used ICD-9 codes in the past, which could result in increased claim submissions
or lost revenues under risk adjustment. During the transition to ICD-10, certain claims processing and payment
information we have historically used to establish our reserves may not be reliable or available in a timely manner. If
we do not adequately implement the new ICD-10 coding set, or if providers in our network do not adequately transition
to the new ICD-10 coding set, our results of operations, financial position and cash flows may be materially adversely
affected.
We are involved in various legal actions and governmental and internal investigations, any of which, if resolved
unfavorably to us, could result in substantial monetary damages or changes in our business practices. Increased
litigation and negative publicity could increase our cost of doing business.
We are or may become a party to a variety of legal actions that affect our business, including breach of contract
actions, employment and employment discrimination-related suits, employee benefit claims, stockholder suits and other
securities laws claims, and tort claims.
In addition, because of the nature of the health care business, we are subject to a variety of legal actions relating
to our business operations, including the design, management, and offering of products and services. These include
and could include in the future:
• claims relating to the methodologies for calculating premiums;
• claims relating to the denial of health care benefit payments;
• claims relating to the denial or rescission of insurance coverage;
• challenges to the use of some software products used in administering claims;
• claims relating to our administration of our Medicare Part D offerings;
• medical malpractice actions based on our medical necessity decisions or brought against us on the theory
that we are liable for providers' alleged malpractice;
• claims arising from any adverse medical consequences resulting from our recommendations about the
appropriateness of providers’ proposed medical treatment plans for patients;
• allegations of anti-competitive and unfair business activities;