Health Net 2007 Annual Report Download - page 18

The MMA changed the methodology for payment to private plans to a competitive bidding process
beginning in 2006. For the Medicare Advantage plans, the federal CMS calculates county-specific payment rates
based on fee-for-service costs in the county and a legislated formula. These rates then serve as a benchmark
against which we must bid for providing the Medicare package of services. The projected savings from the
benchmark rate is used 75% to fund additional benefits to members. The remaining 25% is retained by CMS.
CMS then pays us a monthly rate for each enrollee, which is the bid amount, with risk adjustment for that
member, plus the 75% of savings (if any) in the bid. The risk adjustment factor reflects the member’s age, gender
and health status. The MMA also authorized regional PPOs to serve 26 regions covering the U.S. and its
territories, and authorized other products designed to provide a private market option on a broader scale.
Our Medicare contracts are subject to regulation by CMS. CMS has the right to audit HMOs and PPOs
operating under Medicare contracts to determine the quality of care being rendered and the degree of compliance
with CMS’ contracts and regulations. In January 2008, we were notified by the CMS that we were deficient in
certain administrative procedures with respect to our stand-alone PDP products, and were directed to cease the
sale of such products until resumption of sale was approved by CMS.
Medicaid and Related Legislation. Federal law has also implemented other health programs that are
partially funded by the federal government, such as the Medicaid program (known as Medi-Cal in California) and
SCHIP (known as Healthy Families in California). They are largely regulated and administered by state agencies
and thus there are variations in these programs from state to state. Federal funding remains critical to the viability
of these programs. Federal law permits the federal government to oversee and, in some cases, to enact,
regulations and other requirements that must be followed by the states. Medicaid is administered at the federal
level by CMS; SCHIP is administered by the Health Resources and Services Administration, another arm of the
Department of Health and Human Services.
Privacy Regulations. The use of individually identifiable data by our businesses is regulated at the federal,
state and local level. These laws and regulations are changed frequently by legislation or administrative
interpretation. Various state laws address the use and maintenance of individually identifiable health data. Most
are derived from Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the privacy
provisions in the federal Gramm-Leach-Bliley Financial Modernization Act of 1999 (the “Gramm-Leach-Bliley
Act”).
HIPAA and the implementing regulations that have been adopted in connection therewith impose
obligations for issuers of health insurance coverage and health benefit plan sponsors relating to the privacy and
security of transmitted protected health information (“PHI”). The regulations, consisting of privacy regulations,
transactions and codeset requirements and security regulations require health plans, clearinghouses and providers
to:
• comply with various requirements and restrictions related to the use, storage and disclosure of PHI,
• adopt rigorous internal procedures to protect PHI,
• create policies related to the privacy of PHI and
• enter into specific written agreements with business associates to whom PHI is disclosed.
The regulations also establish significant criminal penalties and civil sanctions for non-compliance. We are
in compliance with the HIPAA privacy regulations, the requirements relating to transactions and codesets and the
security regulations.
The Gramm-Leach-Bliley Act generally requires insurers to provide customers with notice regarding how
their personal health and financial information is used and the opportunity to “opt out” of certain disclosures
before the insurer shares non-public personal information with a non-affiliated third party. Like HIPAA, this law
sets a “floor” standard, allowing states to adopt more stringent requirements governing privacy protection.
16