PART I ITEM 1 Business Health Insurance Portability and Accountability Act Regulations Antitrust Regulations Anti-Money Laundering Regulations Other Confidentiality Requirements Miscellaneous I. Investment-Related Regulations Office of Foreign Assets Control The federal Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (‘‘HIPAA’’) impose requirements on health insurers, HMOs, health plans, health care providers and clearinghouses. Health insurers and HMOs are further subject to regulations related to guaranteed issuance (for groups with 50 or fewer lives), guaranteed renewal, and portability of health insurance. HIPAA also imposes minimum standards for the privacy and security of protected health information. HIPAA’s privacy and security requirements were expanded by the Health Information Technology for Economic and Clinical Health Act (‘‘HITECH’’) that enhanced penalties for HIPAA violations and requires regulated entities to provide notification to various parties in the event of a breach of unsecured protected health information. Regulations pursuant to HITECH continue to be promulgated and are monitored and implemented as they are finalized. HIPAA also established rules that standardize the format and content of certain electronic transactions, including, but not limited to, eligibility and claims. Federal regulations were issued requiring entities subject to HIPAA to update their transaction formats for electronic data interchange from HIPAA 4010 to version 5010 standards and convert from the ICD-9 diagnosis and procedure codes to the ICD-10 diagnosis and procedure codes. The ICD-10 conversion is required by October 1, 2013, though CMS has proposed a rule that would delay the implementation for one year until October 1, 2014. The federal Gramm-Leach-Bliley Act generally places restrictions on the disclosure of non-public information to non-affiliated third parties, and requires financial institutions, including insurers, to provide customers with notice regarding how their non-public personal information is used, including an opportunity to ‘‘opt out’’ of certain disclosures. State departments of insurance and certain federal agencies adopted implementing regulations as required by federal law. Neither the HIPAA nor the Gramm-Leach-Bliley privacy regulations preempt more stringent state laws and regulations that apply to Cigna, and a number of states have adopted data security laws and Depending upon their nature, Cigna’s investment management activities are subject to U.S. federal securities laws, ERISA, and other federal and state laws governing investment related activities. In many cases, the investment management activities and investments of individual insurance companies are subject to regulation by multiple jurisdictions. The Company is also subject to regulation put forth by the Office of Foreign Assets Control of the U.S. Department of the Treasury which administers and enforces economic and trade sanctions based on U.S. foreign policy and national security goals against targeted foreign countries and regimes, terrorists, international narcotics traffickers, those engaged in activities related to the proliferation of weapons of mass destruction, and other threats to the national security, foreign policy or economy of the United States. In addition, Cigna may be subject to similar regulations in non-U.S. jurisdictions in which it operates. Certain Cigna products (‘‘Covered Products’’ as defined in the Bank Secrecy Act) are subject to U.S. Department of the Treasury anti-money laundering regulations. Cigna has implemented anti-money laundering policies designed to ensure that its Covered Products are underwritten and sold in compliance with these regulations. Cigna may also be subject to anti-money laundering laws in non-U.S. jurisdictions where it operates. Cigna subsidiaries are also engaged in activities that may be scrutinized under federal and state antitrust laws and regulations. These activities include the administration of strategic alliances with competitors, information sharing with competitors and provider contracting. regulations, regulating data security and requiring security breach notification that may apply to Cigna in certain circumstances. Cigna and its principal subsidiaries are not dependent on business from one or a few customers. No one customer accounted for 10% or more of Cigna’s consolidated revenues in 2012. Cigna and its principal subsidiaries are not dependent on business from one or a few brokers or agents. In addition, Cigna’s insurance businesses are generally not committed to accept a fixed portion of the business submitted by independent brokers and agents, and generally all such business is subject to its approval and acceptance. Cigna had approximately 35,800 employees as of December 31, 2012; 31,400 employees as of December 31, 2011; and 30,600 employees as of December 31, 2010. 18 CIGNA CORPORATION -  2012 Form  10-K