United Healthcare 2014 Annual Report Download - page 15

HIPAA contain minimum standards for electronic transactions and code sets, and for the privacy and security of
protected health information. ICD-9, the current system of assigning codes to diagnoses and procedures
associated with hospital utilization in the United States is anticipated to be replaced by ICD-10 code sets on
October 1, 2015, and health plans and providers will be required to use ICD-10 codes for such diagnoses and
procedures for dates of services on or after such date.
The Health Information Technology for Economic and Clinical Health Act (HITECH) significantly expanded the
privacy and security provisions of HIPAA. HITECH imposes additional requirements on uses and disclosures of
health information; includes new contracting requirements for HIPAA business associate agreements; extends
parts of HIPAA privacy and security provisions to business associates; adds new federal data breach notification
requirements for covered entities and business associates and new reporting requirements to the U.S. Department
of Health and Human Services (HHS) and the Federal Trade Commission and, in some cases, to the local media;
strengthens enforcement and imposes higher financial penalties for HIPAA violations and, in certain cases,
imposes criminal penalties for individuals, including employees. In the conduct of our business, depending on the
circumstances, we may act as either a covered entity or a business associate. Federal consumer protection laws
may also apply in some instances to privacy and security practices related to personally identifiable information.
The use and disclosure of individually identifiable health data by our businesses is also regulated in some
instances by other federal laws, including the Gramm-Leach-Bliley Act (GLBA) or state statutes implementing
GLBA. These federal laws and state statutes generally require insurers to provide customers with notice
regarding how their non-public personal health and financial information is used and the opportunity to “opt out”
of certain disclosures before the insurer shares such information with a third-party, and generally require
safeguards for the protection of personal information. Neither the GLBA nor HIPAA privacy regulations preempt
more stringent state laws and regulations that may apply to us, as discussed below.
ERISA. The Employee Retirement Income Security Act of 1974, as amended (ERISA), regulates how our
services are provided to or through certain types of employer-sponsored health benefit plans. ERISA is a set of
laws and regulations that is subject to periodic interpretation by the U.S. Department of Labor (DOL) as well as
the federal courts. ERISA sets forth standards on how our business units may do business with employers who
sponsor employee benefit health plans, particularly those that maintain self-funded plans. Regulations established
by the DOL subject us to additional requirements for claims payment and member appeals under health care
plans governed by ERISA.
State Laws and Regulation
Health Care Regulation. Our insurance and HMO subsidiaries must be licensed by the jurisdictions in which
they conduct business. All of the states in which our subsidiaries offer insurance and HMO products regulate
those products and operations. The states require periodic financial reports and establish minimum capital or
restricted cash reserve requirements. The National Association of Insurance Commissioners (NAIC) has adopted
model regulations that, where implemented by states, require expanded governance practices and risk and
solvency assessment reporting. Most states have adopted these or similar measures to expand the scope of
regulations relating to corporate governance and internal control activities of HMOs and insurance companies. In
2014, the NAIC adopted the Risk Management and Own Risk and Solvency Assessment Model Act that requires
us to maintain a risk management framework and file a self-assessment report with state insurance regulators.
The first report will be filed with Connecticut, our lead regulator, in 2015, and annually thereafter. Certain states
have also adopted their own regulations for minimum MLRs with which health plans must comply. In addition, a
number of state legislatures have enacted or are contemplating significant reforms of their health insurance
markets, either independent of or to comply with or be eligible for grants or other incentives in connection with
Health Reform Legislation, which may affect our operations and our financial results.
Health plans and insurance companies are regulated under state insurance holding company regulations. Such
regulations generally require registration with applicable state departments of insurance and the filing of reports
13