Health Net 2015 Annual Report Download - page 20

18
Medicaid is administered at the federal level by CMS. The dual eligibles demonstrations under the CCI are regulated
and administered in Los Angeles and San Diego counties by CMS and DHCS.
See the discussion above under the heading “—Western Region Operations Segment—Medicaid Expansion and
Recent State Legislation,”“—Western Region Operations Segment—California Coordinated Care Initiative,” and “Item
1A. Risk Factors—Government programs represent an increasing share of our revenues. If we are unable to effectively
administer these programs, if we do not effectively adapt to changes to these programs, or if we experience a significant
reduction in revenues from these government programs, it could have a material adverse effect on our business,
financial condition or results of operations.”
Privacy Regulations. State, federal, and local laws and regulations govern the privacy and security of Protected
Health Information (“PHI”), Personal Information (“PI”), and other categories of legally protected data that our
businesses handle. Such laws and regulations include, but are not limited to: the Health Insurance Portability and
Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009
(“HITECH Act”) along with implementing regulations for both (collectively, “HIPAA Rules”); the Federal Trade
Commission Act; the privacy provisions in the federal Gramm-Leach-Bliley Financial Modernization Act of 1999 (the
“Gramm-Leach-Bliley Act”); state privacy and security laws such as the California Confidentiality of Medical
Information Act, the California Online Privacy Protection Act, and state laws that specifically regulate the use and
disclosure of social security numbers; and state breach notification laws that require providing notification in the event
of a breach of PI (such as Cal. Code § 1798.82). Privacy and security laws and regulations often change due to new or
amended legislation, regulations or administrative interpretation. A variety of state and federal regulators enforce these
laws, including but not limited to HHS, the Federal Trade Commission, state attorneys general, and other state
regulators.
The HIPAA Rules impose privacy and security obligations regarding PHI on Covered Entities (which refers to
certain health plans, health care clearinghouses and providers) including but not limited to:
• complying with various requirements and restrictions related to the use, storage and disclosure of PHI,
• implementing internal policies and procedures to maintain the privacy and security of PHI,
• entering into written agreements with those entities that provide services to or on behalf of a Covered Entity
and use, disclose, transmit, or maintain PHI in connection with these services (known as “Business
Associates”), and
• notifying individuals and regulatory authorities (and in some cases, the media) if PHI is compromised.
These regulations also establish significant criminal penalties and civil sanctions for non-compliance. These
requirements have evolved over time through the enactment and subsequent implementation of the HITECH Act (which
enhanced enforcement, set additional limitations on the use and disclosure of PHI, and imposed additional potential
penalties for non-compliance) and the Genetic Information Nondiscrimination Act of 2008 (“GINA”) (which clarified
that genetic information is protected under the HIPAA Privacy Rule and prohibited most health plans from using or
disclosing genetic information for underwriting purposes).
On January 17, 2013, HHS issued a final rule (“Omnibus rule”) that strengthened the privacy and security
protections for PHI by modifying the HIPAA Privacy, Security, and Enforcement Rules and implementing statutory
amendments required by the HITECH Act and GINA. For example, the Omnibus rule enhances an individual’s privacy
protections, provides individuals new rights with respect to their PHI, strengthens the government’s ability to enforce
the HIPAA Rules, sets limits on how information is used and disclosed for marketing and fundraising purposes, and
prohibits the sale of an individuals’ health information without their permission. In addition, the Omnibus rule
expanded the definition of which entities must be classified as a Business Associate and imposed on Business
Associates many of the same privacy and security standards for protecting PHI that apply to Covered Entities. The final
Omnibus Rule was effective on March 26, 2013. See “Item 1A. Risk Factors—We must comply with requirements
relating to patient privacy and information security, including requiring through contract that business associates that
handle certain information on our behalf comply with relevant privacy and security requirements, including, but not
limited to HIPAA” and “—We must comply with requirements relating to patient privacy and information security,
including requiring through contract that business associates that handle certain information on our behalf comply with
relevant privacy and security requirements, including, but not limited to HIPAA” for additional information about the
risks related to privacy and security breaches.
The Gramm-Leach-Bliley Act generally requires insurers to provide customers with notice regarding how their
personal health and financial information is used and, in certain circumstances, gives customers the opportunity to “opt
out” of having their information shared with non-affiliated third parties. Like HIPAA, this law sets a “floor” standard,