United Healthcare 2008 Annual Report Download - page 31

we are involved in litigation with out-of-network providers that is described in more detail in “Legal Matters” in
Note 15 of Notes to the Consolidated Financial Statements. Failure to maintain satisfactory relationships with these
out-of-network health care providers could adversely affect our business and results of operations.
Sales of our products and services are dependent on our ability to attract, retain and provide support to a
network of independent third party brokers, consultants and agents.
Our products are sold in part through independent brokers, consultants and agents who assist in the production and
servicing of business. We typically do not have long-term contracts with our independent brokers, consultants and
agents, who generally are not exclusive to us and who frequently also recommend and/or market health care
products and services of our competitors. As a result, we must compete intensely for their services and
allegiance. Our sales would be adversely affected if we are unable to attract or retain independent brokers,
consultants and agents or if we do not adequately provide support, training and education to them regarding our
product portfolio, which is complex, or if our sales strategy is not appropriately aligned across distribution channels.
In addition, there have been a number of investigations regarding the marketing practices of brokers and agents
selling health care products and the payments they receive. These have resulted in enforcement actions against
companies in our industry and brokers and agents marketing and selling these companies’ products. For example,
CMS and state departments of insurance have increased their scrutiny of the marketing practices of brokers and
agents who market Medicare products. These investigations and enforcement actions could result in penalties and
the imposition of corrective action plans and/or changes to industry practice which could adversely impact our
ability to market our products.
If we fail to comply with restrictions on patient privacy and information security, including taking steps to
ensure that our business associates who obtain access to sensitive patient information maintain its
confidentiality, our reputation and business operations could be materially adversely affected.
The collection, maintenance, use, disclosure and disposal of individually identifiable data by our businesses are
regulated at the international, federal and state levels. These laws and rules are subject to change by legislation or
administrative or judicial interpretation. Various state laws address the use and disclosure of individually
identifiable health data to the extent they are more restrictive than those contained in the privacy and security
provisions in the federal GLBA and in HIPAA. HIPAA also requires that we impose privacy and security
requirements on our business associates (as such term is defined in the HIPAA regulations). See Item 1,
“Business – Government Regulation” for a discussion of various federal and state privacy laws and regulations
governing our businesses.
Even though we provide for appropriate protections through our contracts with our business associates, we still
have limited control over their actions and practices. Privacy and security requirements regarding personally
identifiable information are also imposed on us through controls with our customers. In addition, despite the
security measures we have in place to ensure compliance with applicable laws and rules, our facilities and
systems, and those of our third party service providers may be vulnerable to security breaches, acts of vandalism
or theft, computer viruses, misplaced or lost data, programming and/or human errors or other similar events.
Congress and many states are considering new privacy and security requirements that would apply to our
business. Compliance with new privacy and security laws, requirements, and new regulations may result in cost
increases due to necessary systems changes, new limitations or constraints on our business models, the
development of new administrative processes, and the effects of potential noncompliance by our business
associates. They also may impose further restrictions on our collection, disclosure and use of patient identifiable
data that are housed in one or more of our administrative databases. Noncompliance with any privacy laws or any
security breach involving the misappropriation, loss or other unauthorized disclosure of sensitive or confidential
member information, whether by us or by one of our vendors, could have a material adverse effect on our
business, reputation and results of operations, including: material fines and penalties; compensatory, special,
punitive, and statutory damages; consent orders regarding our privacy and security practices; adverse actions
against our licenses to do business; and injunctive relief.
21