Health Data Standards and Health Information Privacy The Health Insurance Portability and Accountability Act of 1996 Tit

1. Health Data Standards and Health Information Privacy The Health Insurance Portability and Accountability Act of 1996 Title II - Subtitle F Administrative Simplification

2. Purpose of Provisions • Improve the efficiency and effectiveness of the health care system, by standardizing the electronic transmission of certain administrative and financial transactions • Protect the security and privacy of health information

3. Overview of Provisions • Secretary of HHS must adopt standards for electronic health care transactions, unique health identifiers, code sets, security, and privacy • All health plans, clearinghouses, and those providers who choose to conduct these transactions electronically are required to implement these standards

4. Overview of Provisions • Supersedes most contrary provisions of state laws • Expands the scope and membership of the National Committee on Vital and Health Statistics

5. Overview of Provisions • Civil and criminal penalties are prescribed for failure to use standards or for wrongful disclosure of confidential information • Penalties of $100 per violation of standards (up to $25,000 total per year per standard) • Penalties of $50,000 to $250,000 and 1 to 10 years in jail for wrongful disclosure of individually identifiable health information

6. Transaction Standards • Claims or equivalent encounter information • Coordination of benefits information • Referral certification and authorization • Enrollment & disenrollment in a health plan • Eligibility for a health plan

7. Transaction Standards • Health care payment & remittance advice • Health plan premium payments • First report of injury • Health claims status • Health claims attachments

8. Supporting Standards • Unique identifiers (including allowed uses) for: • Individuals • Employers • Health Plans • Health Care Providers • Code sets (including issues of maintenance)

9. Supporting Standards • Security (including electronic signatures), confidentiality, and privacy • Low cost distribution mechanism

10. Implementation Timeline NCVHS recommends stds. and legislation for electronic exchange of medical records HHS adopts transaction stds. (excl. claims) Plans, clearinghouses and providers adopt stds. HHS adopts claims stds. HHS reviews/ modifies first stds. Small plans adopt stds. August February February August February August February 1997 1998 1999 2000 2001

11. Standards Adoption Process • In general, any standard adopted shall be a standard that has been developed, adopted or modified by an ANSI accredited standards setting organization (SDO)

12. Standards Adoption Process • The Secretary may adopt a different standard if: • it will significantly reduce administrative costs compared to alternatives, and it is promulgated in accordance with “negotiated rulemaking” procedures, or • No SDO has developed, adopted or modified a standard in that area

13. Standards Adoption Process • A standard may not be adopted unless the SDO has consulted with: • NUBC • NUCC • WEDI • ADA • In adopting standards, the Secretary will rely upon the recommendations of the NCVHS and the HHS Data Council

14. Implementation Strategy • HHS will utilize a three tier approach to implementation • HHS Data Council will provide senior level policy guidance and decision making and will serve as the contact point for the NCVHS

15. Implementation Strategy • The Data Council’s Health Data Standards Committee will be responsible for the daily operation and management of the standards activities • Implementation Teams will be responsible for the research, analysis, and development of mandated national standards

16. Implementation Teams • HHS has established six internal interdepartmental implementation teams to identify and assess potential standards • Infrastructure and cross-cutting issues • Health insurance claims and encounters • Health insurance enrollment and eligibility

17. Implementation Teams • Health identifiers for providers, health plans, employers and individuals • Code sets and classification systems • Security and safeguards

18. Team Approach • Identify existing candidate standards for each area, identify gaps and conflicts, and present findings to NCVHS and HHS • Develop recommendations for standards to be adopted and present to NCVHS & HHS • Submit draft regulations to the Secretary and to OMB for initial review

19. Team Approach • Publish proposed rules in Federal Register for public comment • Analyze comments and prepare and publish Final Rules • Distribute adopted standards and implementation guides

20. Privacy Goals • Provide patient rights • Informed consent to release information • Access to own health information • Ability to correct erroreous entries • Establish process for exceptions • Research, Law Enforcement, Public Health • Limit amount of information and access • Establish deterrents and penalties

21. Privacy Timeline Privacy legislation If no privacy legislation, HHS privacy regulations HHS privacy recommendations August February February August February August February 1997 1998 1999 2000 2001

22. Opportunities for Input • Participate with standards development organizations • Provide testimony at NCVHS public hearings • Provide written input to NCVHS • Provide written input to the Secretary of HHS

23. Opportunities for Input • Comment on the Federal Register publications for each proposed standard • Invite Implementation Teams staff to meetings with public and private sector organizations

24. National Committee on Vital and Health Statistics

25. New NCVHS Responsibilities • Membership increased from 16 to 18 with two members appointed by Congress • Annual report to Congress on HIPAA implementation status • Serve as a public forum for all interested parties and provide mechanisms for public input through hearings and meetings

26. New NCVHS Responsibilities • Assistance to Secretary: • Standards - Secretary to rely on the recommendations of NCVHS and publish recommendations in Federal Register • Privacy & Confidentiality - Secretary to consult with NCVHS on legislative privacy recommendations

27. New NCVHS Responsibilities • Report to Secretary within 4 years with recommendations and legislative proposals on standards for computerized patient record

28. Current NCVHS Activities • Full Committee meetings quarterly • Subcommittee on Privacy and Confidentiality • Subcommittee on Health Data Needs, Standards and Security

29. Sources of Information • HHS Data Council Web Site • http://aspe.hhs.gov/datacncl/ • NCVHS Web Site • http://aspe.hhs.gov/ncvhs/

30. Cross-Cutting Implementation Issues

31. Charge • Purpose • Provide overall guidance and coordination to the HIPAA EDI standards Implementation Teams • Track progress of the HIPAA EDI standards project • Serve as the information point for overall HIPAA EDI standards implementation information.

32. Charge • Responsibilities • Develop and maintain master data dictionary and data structures list for all standards • Develop a timeline for the entire project • Provide periodic progress reports on the project to HHS and the NCVHS • Monitor progress of individual implementation teams

33. Charge • Responsibilities cont. • Provide guidance and coordination on common issues (e.g. regulation development) • Facilitate communciation among implementation teams • Serve as communication point between implementation teams and HHS Data Council. • Assure all implementation teams have common understanding of issues

34. Guiding Principles • Improve efficiency and effectiveness of system • Meet the needs of users • Be consistent with other administrative simplification standards • Have low implementation costs • Be supported by a SDO

35. Guiding Principles • Have timely adoption procedures • Be technologically independent of platforms • Be precise & unambiguous, but as simple as possible • Keep data & paperwork burdens low • Have flexibility to adopt to health system changes

36. Barriers • Barriers to adopting national uniform standards: • Conflicting standards; e.g., ANSI vs. industry vs. government • Conflicting implementations; e.g., proprietary collection of unique or differently defined data • Incomplete standards; e.g., no implementation guide

37. Barriers • More barriers: • Proprietary code sets; e.g., professional associations make $ selling code sets • Cost of change; e.g., cost of changing length of ID • Privacy; e.g., potential use of SSN as unique ID raises fear of easier access and linkage of confidential information

38. Frequently Asked Questions • Is Big Brother forcing this on the industry? • Will only providers benefit from HIPAA standards? • Is DHHS doing this alone? • Will DHHS merely adopt Medicare standards? • Will all HIPAA standards be adopted in 18 months?

39. Frequently Asked Questions • Will private sector standards be adopted with no change? • Which HIPAA standards will be adopted first? • Will HIPAA standards be tested?

40. Issues • Conformance testing • Who does it • Who pays for it • Who monitors the testers • Data dictionary/Implementation guides • Who maintains them • Who pays for them

41. Issues • Timely updates to “Final Rule” • How do we keep standards up with developments • How do we draw the lines between employers, plans, and providers • Timing • Is 2 years enough time • Is February, 2000 the safest time to comply

42. Issues • Are the teeth big enough • Some have indicated it would be cheaper to pay the fines initially • If Medicare/Medicaid implements it, is that enough to move industry

43. Current Activities • Master data dictionary • over 4700 elements included to date • Draft ‘boilerplate’ regulation language • Cross-cutting implementation issues

44. Claims and Encounters Implementation Team

45. Charter • Adopt formats and data content for: • Health insurance claims, encounters, COB • Remittance advice • Claim status inquiry

46. Charter • Facilitate identical implementations through: • Implementation guides • With precise instructions on data content

47. Process • Created information structure • Solicited formal advice • National Uniform Billing Committee • National Uniform Claim Committee • Workgroup for Electronic Data Interchange • American Dental Association

48. Principles • Data Content Management • Structural Stability • Reliability • Documentation

49. Principles • Data Content Management • Data update timeliness • Implementation guide update

50. Principles • Structural Stability • 3 years • One structure • Annual data updates