Health Net 2015 Annual Report Download - page 45

43
significant expenses in the defense of litigation matters, including without limitation, substantial discovery costs.
Recent court decisions and legislative activity may increase our exposure for any of the types of claims we face. There
is a risk that we could incur substantial legal fees and expenses, including discovery expenses, in any of the actions we
defend in excess of any amounts budgeted for defense. Plaintiffs' attorneys have increasingly used expansive electronic
discovery requests as a litigation tactic. Responding to these requests, the scope of which may exceed the normal
capacity of our historical systems for archiving and organizing electronic documents, may require application of
significant resources and impose significant costs on us. In certain cases, we could also be subject to awards of
substantial legal fees and costs to plaintiffs' counsel.
While we currently have insurance policies that may provide coverage for some of the potential liabilities
relating to litigation matters, there can be no assurance that coverage will be available for any particular case or liability.
Insurers could dispute coverage or the amount of insurance may not be sufficient to cover the damages awarded or
settlement amounts. In addition, certain liabilities, such as punitive damages, may not be covered by insurance.
Insurance coverage for all or certain types of liability may become unavailable or prohibitively expensive in the future
or the deductible on any such insurance coverage could be set at a level that would result in us effectively self-insuring
cases against us. The deductible on our errors and omissions (“E&O”) insurance has reached such a level. Given the
amount of the deductible, the only cases which would be covered by our E&O insurance are those involving claims that
substantially exceed our average claim values and otherwise qualify for coverage under the terms of the insurance
policy.
We regularly evaluate litigation matters pending against us, including those described in Note 13 to our
consolidated financial statements included in this report, to determine if settlement of such matters would be in the best
interests of the Company and its stockholders. We record reserves and accrue costs for certain significant legal
proceedings which represent our best estimate of the probable loss, including related future legal costs, for such matters,
both known and unknown. However, our recorded amounts might differ materially from the ultimate amount of any
such costs. The costs associated with any settlement of or judgment relating to the various legal proceedings to which
we are or may be subject from time to time, such as the proceedings described in Note 13, could be substantial and, in
certain cases, could result in a significant earnings charge or impact on our cash flow in any particular quarter. The costs
associated with any settlement of or judgment relating to the various legal proceedings to which we are or may be
subject from time to time, such as the proceedings described in Note 13, could have a material adverse effect on our
financial condition, results of operations, cash flow and/or liquidity and may affect our reputation.
We must comply with requirements relating to patient privacy and information security, including requiring through
contract that business associates that handle certain information on our behalf comply with relevant privacy and
security requirements, including, but not limited to HIPAA.
We are subject to compliance obligations arising from laws and regulations governing certain Protected Health
Information (“PHI”) and Personal Information (“PI”) including but not limited to: the Health Insurance Portability and
Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act of 2009
(“HITECH Act”) and their respective implementing regulations; the Federal Trade Commission Act; federal regulations
governing substance abuse records; state privacy and security laws such as the California Confidentiality of Medical
Information Act (“CMIA”) and the California Online Privacy Protection Act (“CalOPPA”); and state breach notification
laws that require providing notification in the event of a breach of PI (such as Cal. Code § 1798.82). A variety of state
and federal regulators enforce these laws, including, but not limited to HHS, the Federal Trade Commission (“FTC”),
state attorneys general, and other state regulators. In addition, as our individual exchange business grows, we are
increasingly impacted by requirements under the Payment Card Industry (“PCI”) Data Security Standard, which is a
multifaceted security standard that is designed to protect credit card account data as mandated by payment card industry
entities.
HIPAA regulations, as amended, require health plans, clearinghouses and providers to, among other obligations:
comply with various requirements and restrictions related to the use, disclosure, storage, and transmission of PHI; adopt
rigorous internal policies and procedures to safeguard PHI; and enter into specific written agreements with business
associates that receive, transmit, use and/or create PHI on our behalf. HIPAA also established significant civil and
criminal sanctions for violations. These regulations expose us to liability for, among other things, violations of the
regulations by our business associates, including the third party vendors involved in our outsourcing projects. Other
state and federal laws and regulations, including some of the laws noted above, impose similar privacy and security
requirements.
The HITECH Act expanded HIPAA's requirements for security and privacy safeguards, including improved
enforcement, additional limitations on use and disclosure of PHI and additional potential penalties for violations, and