Health Net 2009 Annual Report Download - page 19

• adopt rigorous internal procedures to protect PHI,
• create policies related to the privacy of PHI,
• enter into specific written agreements with business associates to whom PHI is disclosed, and
• notify individuals and regulatory authorities if PHI is compromised.
The regulations also establish significant criminal penalties and civil sanctions for non-compliance. Recent
developments in this area include the Health Information Technology for Economic and Clinical Health
(HITECH) Act, which became fully effective in February, 2010. The HITECH Act expands the HIPAA rules for
security and privacy safeguards, including improved enforcement, additional limitations on use and disclosure of
PHI and additional potential penalties for non-compliance. See “Item 1A. Risk Factors—If we fail to comply with
restrictions on patient privacy and information security, including taking steps to ensure that our business
associates who obtain access to sensitive patient information maintain its confidentiality, our reputation and
business operations could be materially adversely affected” for additional information on a recent information
security breach.
The Gramm-Leach-Bliley Act generally requires insurers to provide customers with notice regarding how
their personal health and financial information is used and the opportunity to “opt out” of certain disclosures
before the insurer shares non-public personal information with a non-affiliated third party. Like HIPAA, this law
sets a “floor” standard, allowing states to adopt more stringent requirements governing privacy protection.
ERISA. Most employee benefit plans are regulated by the federal government under the Employee
Retirement Income Security Act of 1974, as amended (“ERISA”). Employment-based health coverage is such an
employee benefit plan. ERISA is administered, in large part, by the U.S. Department of Labor (“DOL”). ERISA
contains disclosure requirements for documents that define the benefits and coverage. It also contains a provision
that causes federal law to preempt state law in the regulation and governance of certain benefit plans and
employer groups, including the availability of legal remedies under state law.
Other Federal Regulations. We must comply with, and are affected by, laws and regulations relating to the
award, administration and performance of U.S. Government contracts. Government contract laws and regulations
affect how we do business with our customers and, in some instances, impose added costs on our business. A
violation of specific laws and regulations could result in the imposition of fines and penalties or the termination
of our contracts or debarment from bidding on contracts.
State Laws and Regulations
Our West Operations HMOs, insurance companies and behavioral health plan are subject to extensive state
regulation. Set forth below are the principal regulatory agencies that govern these health plans and insurance
companies.
Company Regulatory Agency
Arizona HMO Arizona Department of Insurance
California HMO California Department of Managed Health Care
Oregon HMO Oregon Department of Consumer and Business Services
Health Net Life Insurance
Company (Arizona and
California PPO)
California Department of Insurance generally, and the Department of Insurance
of each state in which it does business
MHN California Department of Managed Health Care, New York Department of
Insurance
17