Health Net 2009 Annual Report Download - page 42

recorded an additional $4.3 million of asset impairment on the long-lived assets related to our Northeast
operations. Upon the consummation of the Northeast Sale on December 11, 2009, we recorded a pretax loss on
sale of $105.9 million. While these non-cash impairment charges and pretax loss had no impact on our liquidity
position, they did have a significant adverse effect on our results of operations for the year ended December 31,
2009.
We must comply with restrictions on patient privacy and information security, including taking steps to
ensure compliance by our business associates with HIPAA.
In December 2000, the Department of Health and Human Services promulgated regulations under HIPAA
related to the privacy and security of electronically transmitted protected health information (“PHI”). The
regulations require health plans, clearinghouses and providers to: comply with various requirements and
restrictions related to the use, storage, transmission and disclosure of PHI; adopt rigorous internal procedures to
safeguard PHI; and enter into specific written agreements with business associates to whom PHI is disclosed. The
regulations also establish significant criminal penalties and civil sanctions for non-compliance. In addition, the
regulations could expose us to additional liability for, among other things, violations of the regulations by our
business associates, including the third party vendors involved in our outsourcing projects. The HITECH Act,
which became fully effective in February 2010, expanded the HIPAA rules for security and privacy safeguards,
including improved enforcement, additional limitations on use and disclosure of PHI and additional potential
penalties. Although our contracts with business associates provide for appropriate protections of PHI, we may
have limited control over the actions and practices of our business associates. Compliance with HIPAA and other
state and federal privacy and security regulations may result in cost increases due to necessary systems changes,
the development of new administrative processes and the effects of potential noncompliance by ourselves or our
business associates. See “—If we fail to comply with restrictions on patient privacy and information security,
including taking steps to ensure that our business associates who obtain access to sensitive patient information
maintain its confidentiality, our reputation and business operations could be materially adversely affected” for
detail regarding our recent information security breach.
If we fail to comply with restrictions on patient privacy and information security, including taking steps to
ensure that our business associates who obtain access to sensitive patient information maintain its
confidentiality, our reputation and business operations could be materially adversely affected.
The collection, maintenance, use, disclosure and disposal of individually identifiable data by our businesses
are regulated at the federal and state levels. See “Item 1. Business—Government Regulation” for additional
information on the federal and state regulations that govern how we conduct our business.Despite the security
measures we have in place to ensure compliance with applicable laws and rules, our facilities and systems, and
those of our third party service providers, may be vulnerable to security breaches, acts of vandalism or theft,
computer viruses, misplaced or lost data, programming and/or human errors or other similar events. For example,
a portable, external hard drive holding PHI of certain of our enrollees, such as Social Security numbers and
medical data, was discovered missing from our Northeast headquarters in Shelton, Connecticut in May 2009.
While the information stored on the hard drive was saved in an image format that cannot be read without special
software, we subsequently commenced a lengthy investigation of the contents of the hard drive, including a
detailed forensic review by computer experts, reported the loss to authorities and began notifying our customers
of the incident. On January 13, 2010, the Connecticut Attorney General filed a complaint in federal court in
Connecticut alleging that we had violated HIPAA and the Connecticut Unfair Trade Practices Act in connection
with the loss of the disk drive. The complaint seeks injunctive relief as well as statutory damages, attorney fees
and litigation costs. Noncompliance with any privacy laws or any security breach involving the misappropriation,
loss or other unauthorized disclosure of sensitive or confidential member information, whether by us or by one of
our business associates, could have a material adverse effect on our business, reputation and results of operations,
including but not limited to: material fines and penalties; compensatory, special, punitive, and statutory damages;
litigation; consent orders regarding our privacy and security practices; adverse actions against our licenses to do
business; and injunctive relief. Additionally, the costs incurred to remediate any data security incident could be
40