Health Net 2014 Annual Report Download - page 50

48
effectively administer these programs, if we do not effectively adapt to changes to these programs, or if we experience a
significant reduction in revenues from these government programs, it could have a material adverse effect on our
business, financial condition or results of operations.” In addition, continued state and federal budgetary pressures
could cause new or higher levels of assessments or taxes for our commercial programs, such as surcharges on select fee-
for-service and capitated medical claims or premium taxes on insurance companies and HMOs, and could adversely
affect our results of operations. Moreover, any enrollment freeze or significant delay in reimbursement payment from
government programs in which we participate could adversely affect our business, financial condition, cash flows and
results of operations. For example, in the past, budget issues have led the State of California to delay certain of its
monthly Medicaid payments to us. Any such irregularity in the timing of these payments in future periods may
adversely impact our operating cash flow from quarter to quarter depending on the timing of such payments.
We must comply with requirements relating to patient privacy and information security, including requiring through
contract that business associates that handle certain information on our behalf comply with relevant privacy and
security requirements, including, but not limited to HIPAA.
We are subject to compliance obligations arising from laws and regulations governing certain Protected Health
Information (“PHI”) and Personal Information (“PI”) including but not limited to: the Health Insurance Portability and
Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009
(“HITECH Act”) and their respective implementing regulations; the Federal Trade Commission Act; federal regulations
governing substance abuse records; state privacy and security laws such as the California Confidentiality of Medical
Information Act (“CMIA”) and the California Online Privacy Protection Act (“CalOPPA”); and state breach notification
laws that require providing notification in the event of a breach of PI (such as Cal. Code § 1798.82). A variety of state
and federal regulators enforce these laws, including, but not limited to HHS, the Federal Trade Commission (“FTC”),
state attorneys general, and other state regulators. In addition, as our individual exchange business grows, we are
increasingly impacted by requirements under the Payment Card Industry (“PCI”) Data Security Standard, which is a
multifaceted security standard that is designed to protect credit card account data as mandated by payment card industry
entities.
HIPAA regulations, as amended, require health plans, clearinghouses and providers to, among other obligations:
comply with various requirements and restrictions related to the use, disclosure, storage, and transmission of PHI; adopt
rigorous internal policies and procedures to safeguard PHI; and enter into specific written agreements with business
associates that receive, transmit, use and/or create PHI on our behalf. HIPAA also established significant civil and
criminal sanctions for violations. These regulations expose us to liability for, among other things, violations of the
regulations by our business associates, including the third party vendors involved in our outsourcing projects. Other
state and federal laws and regulations, including some of the laws noted above, impose similar privacy and security
requirements.
The HITECH Act expanded HIPAA's requirements for security and privacy safeguards, including improved
enforcement, additional limitations on use and disclosure of PHI and additional potential penalties for violations, and
imposed notice obligations in the event of a breach of unsecured PHI.
The HITECH Act has been implemented on a rolling basis through subsequent rulemaking. On January 17, 2013,
the Office of Civil Rights (“OCR”) of HHS issued the omnibus final rule on HIPAA privacy, security, breach
notification and enforcement requirements under the HITECH Act, and a final regulation for required changes to the
HIPAA Privacy Rule for the Genetic Information Nondiscrimination Act. The omnibus final rule became effective on
March 26, 2013, with an applicable compliance date of September 23, 2013. Although our contracts with our business
associates require business associates to maintain the privacy and security of PHI and PI that we disclose to them, we
may have limited control over the actions and practices of our business associates. This risk increases as we contract
with third parties for the performance of additional services on our behalf. Compliance with HIPAA and state and
federal privacy and security laws and regulations has resulted in and may in the future result in significant costs to us
due to necessary systems changes, the development of new administrative processes and the effects of potential
noncompliance by us or our business associates. If we or our business associates fail to comply with requirements
relating to patient privacy and information security, such as applicable contractual requirements or the requirements
imposed through the laws and regulations referenced above, our reputation and business operations could be materially
adversely affected and our results of operation and financial condition could be adversely impacted.