New Laws or Regulations, or Future Legislative, Judicial or Regulatory Changes
We are and will continue to be regularly subject to new laws and regulations, changes to existing laws and regulations, and judicial determinations that impact the interpretation and applicability of those laws and regulations. The Patient Protection and Affordable Care Act and The Health Care and Education Reconciliation Act of 2010 (which we collectively refer to as the Health Care Reform Law), the Families First Coronavirus Response Act (the "Families First Act"), the Coronavirus Aid, Relief, and Economic Security Act (the "CARES Act"), and the Inflation Reduction Act of 2022 (the "Inflation Reduction Act"), and related regulations, are examples of laws which have enacted significant reforms to various aspects of the U.S. health insurance industry, including among others, mandated coverage requirements, mandated benefits and guarantee issuance associated with commercial medical insurance, rebates to policyholders based on minimum benefit ratios, adjustments to Medicare Advantage premiums, the establishment of federally facilitated or state-based exchanges coupled with programs designed to spread risk among insurers, the introduction of plan designs based on set actuarial values, and changes to the Part D prescription drug benefit design.
It is reasonably possible that these laws and regulations, as well as other current or future legislative, judicial or regulatory changes, including restrictions on our ability to manage our provider network, market and sell our products, or otherwise operate our business, or restrictions on profitability, including reviews by regulatory bodies that may compare our Medicare Advantage business profitability to our non-Medicare Advantage business profitability, or compare the profitability of various products within our Medicare Advantage business, and require that they remain within certain ranges of each other, increases in member benefits or changes to member eligibility criteria without corresponding increases in premium payments to us, increases in regulation of our prescription drug benefit businesses, or changes to the Part D prescription drug benefit design (and uncertainty arising from the implementation of these changes) may have a material adverse effect on our results of operations (including restricting revenue, enrollment and premium growth in certain products and market segments, restricting our ability to expand into new markets, increasing our medical and operating costs, further lowering our Medicare payment rates and increasing our expenses associated with assessments); our financial position (including our ability to maintain the value of our goodwill); and our cash flows.
Additionally, potential legislative changes or judicial determinations, including activities to repeal or replace these laws and regulations, including the Health Care Reform Law or declare all or certain portions of these laws and regulations unconstitutional or contrary to law, create uncertainty for our business, and we cannot predict when, or in what form, such legislative changes or judicial determinations may occur.
Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act)
The use of individually identifiable health data by our business is regulated at federal and state levels. These laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address the use and maintenance of individually identifiable health data. Most are derived from the privacy provisions in the federal Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, or HIPAA. HIPAA includes administrative provisions directed at simplifying electronic data interchange through standardizing transactions, establishing uniform health care provider, payer, and employer identifiers, and seeking protections for the confidentiality and security of patient data. The rules do not provide for complete federal preemption of state laws, but rather preempt all inconsistent state laws unless the state law is more stringent. These regulations set standards for the security of electronic health information, including requirements that insurers provide customers with notice regarding how their non-public personal information is used, including an opportunity to "opt out" of certain disclosures.
The HITECH Act, one part of the American Recovery and Reinvestment Act of 2009, significantly broadened and strengthened the scope of the privacy and security regulations of HIPAA and imposes additional limits on the use and disclosure of protected health information, or PHI. Among other requirements, the HITECH Act and HIPAA requires us and other covered entities to report any unauthorized release or use of or access to PHI to any impacted individuals and to HHS in those instances where the unauthorized activity poses a significant risk of financial, reputational or other harm to the individuals, and to notify the media in any states where 500 or more people are impacted by any unauthorized release or use of or access to PHI, requires business associates to comply with certain provisions of the HIPAA privacy and security rule, and grants enforcement authority to state attorneys general in addition to the HHS Office of Civil Rights.
In addition, there are numerous federal and state laws and regulations addressing patient and consumer privacy concerns, including unauthorized access or theft of personal information. State statutes and regulations vary from state to state and could impose additional penalties. Violations of HIPAA or applicable federal or state laws or regulations could subject us to significant criminal or civil penalties, including significant monetary penalties. Compliance with HIPAA and other privacy regulations requires significant systems enhancements, training and administrative effort. HIPAA can also expose us to additional liability for violations by our business associates (e.g., entities that provide services to health plans and providers).
Corporate Practice of Medicine and Other Laws
As a corporate entity, Humana Inc. is not licensed to practice medicine. Many states in which we operate through our subsidiaries limit the practice of medicine to licensed individuals or professional organizations comprised of licensed individuals, and business corporations generally may not exercise control over the medical decisions of physicians. Statutes and regulations relating to the practice of medicine, fee-splitting between physicians and referral sources, and similar issues vary widely from state to state. Under management agreements between certain of our subsidiaries and affiliated physician-owned professional groups, these groups retain sole responsibility for all medical decisions, as well as for hiring and managing physicians and other licensed healthcare providers, developing operating policies and procedures, implementing professional standards and controls, and maintaining malpractice insurance. We believe that our health services operations comply with applicable state statutes regarding corporate practice of medicine, fee-splitting, and similar issues. However, any enforcement actions by governmental officials alleging non-compliance with these statutes, which could subject us to penalties or restructuring or reorganization of our business, may result in a material adverse effect on our results of operations, financial position, or cash flows.
Anti-Kickback, Physician Self-Referral, and Other Fraud and Abuse Laws
We are subject to various federal and state healthcare fraud and abuse laws including the federal False Claims Act (the "False Claims Act"), the federal anti-kickback statute (the "Anti-Kickback Statute"), the federal "Stark Law," and related state laws. Potential sanctions for violating these laws include recoupment or reduction of government reimbursement amounts, civil penalties, treble damages, and exclusion from participating in the Medicare and Medicaid programs or other government healthcare programs. The False Claims Act prohibits knowingly submitting, conspiring to submit, or causing to be submitted, false claims, records, or statements to the federal government, or intentionally failing to return overpayments, in connection with reimbursement by federal government programs. The Anti-Kickback Statute prohibits the offer, payment, solicitation, or receipt of any form of remuneration to induce, or in return for, the referral of business under Medicare or other governmental health program. The Stark Law prohibits physicians from referring Medicare or Medicaid beneficiaries for certain services to any entity with which the physician, or an immediate family member of the physician, has a financial relationship, unless the financial relationship fits within a permissible exception.
Many states also have enacted laws similar in scope and purpose to the Anti-Kickback Statute and, in more limited instances, the Stark Law, that are not limited to services for which Medicare or Medicaid payment is made. In addition, most states have statutes, regulations, or professional codes that restrict a physician from accepting various kinds of remuneration in exchange for making referrals. These laws vary from state to state and have seldom been interpreted by the courts or regulatory agencies. In states that have enacted these statutes, we believe that regulatory authorities and state courts interpreting these statutes may regard federal law under the Anti-Kickback Statute and the Stark Law as persuasive.
We believe that our operations comply with the Anti-Kickback Statute, the Stark Law, and similar federal or state laws addressing fraud and abuse. These laws are subject to modification and changes in interpretation, and are enforced by authorities vested with broad discretion. We continually monitor developments in this area. If these laws are interpreted in a manner contrary to our interpretation or are reinterpreted or amended, or if new legislation is enacted with respect to healthcare fraud and abuse, illegal remuneration, or similar issues, we may be required to restructure our affected operations to maintain compliance with applicable law. There can be no assurances that any such restructuring will be possible or, if possible, would not have a material adverse effect on our results of operations, financial position, or cash flows.
State Regulation of our Products and Services
Laws in each of the states (and Puerto Rico) in which we operate our HMOs, PPOs and other health insurance-related services regulate our operations including: capital adequacy and other licensing requirements, policy language describing benefits, mandated benefits and processes, entry, withdrawal or re-entry into a state or market, rate increases, delivery systems, utilization review procedures, quality assurance, complaint systems, enrollment requirements, claim payments, marketing, and advertising. The HMO, PPO, and other health insurance-related products we offer are sold under licenses issued by the applicable insurance regulators.
Our licensed insurance subsidiaries are also subject to regulation under state insurance holding company and Puerto Rico regulations. These regulations generally require, among other things, prior approval and/or notice of new products, rates, benefit changes, and certain material transactions, including dividend payments, purchases or sales of assets, intercompany agreements, and the filing of various financial and operational reports.
Certain of our healthcare services businesses require a Certificate of Need, or CON, to operate in certain states. These states restrict the entry of new providers or services and the expansion of existing providers or services in their state through a CON process, which is periodically evaluated and updated as required by applicable state law. To the extent that we require a CON or other similar approvals to expand our operations, our expansion could be adversely affected by our inability to obtain the necessary approval. To the extent laws in these CON states change, including the elimination of the CON requirement, the intangible value associated with these CONs may be impaired.