Health Net 2003 Annual Report Download - page 14

• prevent the exclusion of individuals from coverage under group plans based on health status, and
• establish national standards for the electronic exchange of health information.
In December 2000, the Department of Health and Human Services (“DHHS”) promulgated regulations under HIPAA
related to the privacy and security of electronically transmitted protected health information (“PHI”). The regulations,
consisting of privacy regulations, transactions and codeset requirements and security regulations require health plans,
clearinghouses and providers to:
• comply with various requirements and restrictions related to the use, storage and disclosure of PHI,
• adopt rigorous internal procedures to protect PHI,
• create policies related to the privacy of PHI and
• enter into specific written agreements with business associates to whom PHI is disclosed.
The regulations also establish significant criminal penalties and civil sanctions for non-compliance. Health Net
completed the work required to be compliant with the HIPAA Privacy Regulations prior to the effective date of April 14,
2003. Further, Health Net was ready to send and receive compliant Transactions and Codesets prior to the effective date
of October 16, 2003. The Security regulations have a compliance date of April 2005 and Health Net has created a security
plan to ensure appropriate compliance prior to the effective date. We spent approximately $6.7 million in 2003 and expect
to spend approximately $1.6 million in 2004 on HIPAA related expenses.
Gramm-Leach-Bliley Act. The Gramm-Leach-Bliley Financial Modernization Act of 1999 generally requires insurers
to provide customers with notice regarding how their personal health and financial information is used and the opportunity
to “opt out” of certain disclosures before the insurer shares non-public personal information with a non-affiliated third
party. Like HIPAA, this law sets a “floor” standard, allowing states to adopt more stringent requirements governing
privacy protection.
Federal HMO Act. Under the Federal Health Maintenance Organization Act of 1973 (the “HMO Act”), services to
members must be provided substantially on a fixed, prepaid basis without regard to the actual degree of utilization of
services. Premiums established by an HMO may vary from account to account through composite rate factors and special
treatment of certain broad classes of members, and through prospective (but not retrospective) rating adjustments. Several
of our HMOs are federally qualified in certain parts of their respective service areas under the HMO Act and are therefore
subject to the requirements of such act to the extent federally qualified products are offered and sold.
ERISA. Most employee benefit plans are regulated by the federal government under the Employee Retirement
Income Security Act of 1974, as amended (“ERISA”). Employment-based health coverage is such an employee benefit
plan. ERISA is administered, in large part, by the U.S. Department of Labor (“DOL”). ERISA contains disclosure
requirements for documents that define the benefits and coverage. It also contains a provision that causes federal law to
preempt state law in the regulation and governance of certain benefit plans and employer groups, including the availability
of legal remedies under state law. In 2002, the DOL adopted regulations under ERISA which mandated certain claims and
appeals processing requirements. These regulations became fully effective on January 1, 2003 and, during 2003, we made
certain adjustments in our claims systems to comply with these regulations. The cost of the adjustments was not material
from a financial point of view.
Miscellaneous. Our Medicare contracts are subject to regulation by CMS. CMS has the right to audit HMOs and
PPOs operating under Medicare contracts to determine the quality of care being rendered and the degree of compliance
with CMS’ contracts and regulations. Our Medicaid business is also subject to regulation by CMS, as well as state
agencies, and is generally examined on a periodic basis by such state agencies.
California Laws and Regulations
Health Insurance Act of 2003. In October 2003, the Governor of California signed the Health Insurance Act of 2003
(the “California Health Insurance Act”) which requires all California employers employing more than 200 employees to
pay a fee or show proof of health insurance or other acceptable health coverage for both employees and their dependents.
The California Health Insurance Act will become effective January 1, 2006. On January 1, 2007, the requirements of the
California Health Insurance Act will extend to employers of 20 to 199 employees, except that those employers will not be
required to provide coverage for their employees’ dependents and employers of 20 to 49 employees will be exempt from
12