Company: ELV
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001156039-25-000010
Chunk: 26

Company: Elevance Health, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1
Chunk 26
---
 Pharmacy as a non-resident pharmacy. These non-resident states generally expect our pharmacies to follow the laws of the state in which the 

 -18-

pharmacies are located, but some non-resident states also require us to comply with certain of their pharmacy regulations as well. Additionally, pharmacies that participate in Medicare or Medicaid pharmacy networks are required to comply with applicable Medicare and Medicaid provider rules and regulations.

Privacy, Confidentiality and Data Standards Regulation

The federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the administrative simplification provisions of HIPAA impose a number of requirements on covered entities (including insurers, HMOs, group health plans, providers and clearinghouses) and their business associates relating to the use, disclosure and safeguarding of protected health information. These requirements include uniform standards of common electronic healthcare transactions; privacy and security regulations; and unique identifier rules for employers, health plans and providers.

Also, the Health Information Technology for Economic and Clinical Health (“HITECH”) Act provisions of the American Recovery and Reinvestment Act of 2009 and corresponding implementing regulations have imposed additional requirements on the use and disclosure of protected health information such as additional data breach notification and reporting requirements, contracting requirements for HIPAA business associate agreements, strengthened enforcement mechanisms and increased penalties for HIPAA violations. Federal consumer protection laws may also apply in some instances to privacy and security practices related to personally identifiable information.

The federal Gramm-Leach-Bliley Act generally places restrictions on the disclosure of non-public information to non-affiliated third parties, and requires financial institutions, including insurers, to provide customers with notice regarding how their non-public personal information is used, including an opportunity to “opt out” of certain disclosures. State departments of insurance and certain federal agencies adopted implementing regulations as required by federal law. 

The Cybersecurity Information Sharing Act of 2015 encourages organizations to share cyber threat indicators with the federal government and, among other things, directed HHS to develop a set of voluntary cybersecurity best practices for organizations in the healthcare industry, which were issued in 2018.

In addition, Public Exchanges are required to adhere to privacy and security standards with respect to personally identifiable information and to impose privacy and security standards that are at least as protective as those the Public Exchange has implemented for itself on insurers offering plans through the Public Exchanges and their designated downstream entities, including pharmacy services providers and other business associates. These standards may differ from, and be more stringent than, HIPAA.

Furthermore, states have begun enacting more comprehensive privacy laws