Company: HUM
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000049071-25-000007
Chunk: 136

Company: HUMANA INC
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 136
---
); our financial position (including our ability to maintain the value of our goodwill); and our cash flows.

Additionally, potential legislative changes or judicial determinations, including activities to repeal or replace these laws and regulations, including the Health Care Reform Law or declare all or certain portions of these laws and regulations unconstitutional or contrary to law, create uncertainty for our business, and we cannot predict when, or in what form, such legislative changes or judicial determinations may occur.

Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act)

The use of individually identifiable health data by our business is regulated at federal and state levels. These laws and rules are changed frequently by legislation or administrative interpretation. Various state laws address the use and maintenance of individually identifiable health data. Most are derived from the privacy provisions in the federal Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act, or HIPAA. HIPAA includes administrative provisions directed at simplifying electronic data interchange through standardizing transactions, establishing uniform health care provider, payer, and employer identifiers, and seeking protections for the confidentiality and security of patient data. The rules do not provide for complete federal preemption of state laws, but rather preempt all inconsistent state laws unless the state law is more stringent. These regulations set standards for the security of electronic health information, including requirements that insurers provide customers with notice regarding how their non-public personal information is used, including an opportunity to "opt out" of certain disclosures. 

The HITECH Act, one part of the American Recovery and Reinvestment Act of 2009, significantly broadened and strengthened the scope of the privacy and security regulations of HIPAA and imposes additional limits on the use and disclosure of protected health information, or PHI. Among other requirements, the HITECH Act and HIPAA requires us and other covered entities to report any unauthorized release or use of or access to PHI to any impacted individuals and to HHS in those instances where the unauthorized activity poses a significant risk of financial, reputational or other harm to the individuals, and to notify the media in any states where 500 or more people are impacted by any unauthorized release or use of or access to PHI, requires business associates to comply with certain provisions of the HIPAA privacy and security rule, and grants enforcement authority to state attorneys general in addition to the HHS Office of Civil Rights. 

In addition, there are numerous federal and state laws and regulations addressing patient and consumer privacy concerns, including unauthorized access or