United Healthcare 2007 Annual Report Download - page 49

If we fail to comply with restrictions on patient privacy and information security, including taking steps to
ensure that our business associates who obtain access to sensitive patient information maintain its
confidentiality, our reputation and business operations could be materially adversely affected.
The use of individually identifiable data by our businesses is regulated at the international, federal and state
levels. These laws and rules are subject to change by legislation or administrative interpretation. Various state
laws address the use and disclosure of individually identifiable health data to the extent they are more restrictive
than those contained in the privacy and security provisions in the federal Gramm-Leach-Bliley Act and in Health
Insurance Portability and Accountability Act of 1996, as amended (HIPAA). HIPAA also requires that we
impose privacy and security requirements on our business associates (as such term is defined in the HIPAA
regulations). Even though we provide for appropriate protections through our contracts with our business
associates, we still have limited control over their actions and practices. In addition, despite the security measures
we have in place to ensure compliance with applicable laws and rules, our facilities and systems, and those of our
third party service providers, may be vulnerable to security breaches, acts of vandalism, computer viruses,
misplaced or lost data, programming and/or human errors or other similar events. Compliance with any privacy
proposals, requirements, and new regulations may result in cost increases due to necessary systems changes, the
development of new administrative processes, and the effects of potential noncompliance by our business
associates. They also may impose further restrictions on our use of patient identifiable data that is housed in one
or more of our administrative databases. Noncompliance with any privacy laws or any security breach involving
the misappropriation, loss or other unauthorized disclosure of sensitive or confidential member information,
whether by us or by one of our vendors, could have a material adverse effect on our business, reputation and
results of operations.
Our relationship with AARP is important and the loss of such relationship could have an adverse effect on
our business and results of operations.
Under our agreements with AARP, we provide AARP-branded Medicare Supplement insurance, hospital
indemnity insurance and other products to AARP members and Medicare Part D prescription drug plans to
AARP members and non-members. One of our agreements with AARP expands the relationship to include
AARP-branded Medicare Advantage plans for AARP members and non-members. Our agreements with AARP
contain commitments regarding corporate governance, corporate social responsibility, diversity and measures
intended to improve and simplify the health care experience for consumers. The AARP agreements may be
terminated early under certain circumstances, including, depending on the agreement, a material breach by either
party, insolvency of either party, a material adverse change in the financial condition of the Company, material
changes in the Medicare programs, material harm to AARP caused by the Company, and by mutual agreement.
The success of our AARP arrangements depends, in part, on our ability to service AARP and its members,
develop additional products and services, price the products and services competitively, meet our corporate
governance, corporate social responsibility, and diversity commitments, and respond effectively to federal and
state regulatory changes. The loss of our AARP relationship could have an adverse effect on our business and
results of operations.
Because of the nature of our business, we are routinely subject to various litigation actions, which, if
resolved unfavorably to us, could result in substantial monetary damages.
Periodically, we become a party to the types of legal actions that can affect any business, such as employment
and employment discrimination-related suits, employee benefit claims, breach of contract actions, tort claims,
shareholder suits, and intellectual property-related litigation. In addition, because of the nature of our business,
we are routinely made party to a variety of legal actions related to the design and management of our service
offerings. These matters include, among others, claims related to health care benefits coverage and payment
(including disputes with enrollees, customers, and contracted and non-contracted physicians, hospitals and other
health care professionals), medical malpractice actions, contract disputes and claims related to disclosure of
certain business practices. We are also party to certain class action lawsuits brought by health care professional
groups.
47