WIXLIB

The Basics of EDI and HIPAAfor Clinicians, HealthcareExecutives and Trustees,Compliance Officers, PrivacyOfficers and Legal CounselJim MoynihanMcLure-Moynihan Inc.www.mmiec.comFor HIPAA Summit WestJune 20, 2001Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Introduction to HIPAA Primer on Electronic Commerce (EC) Primer on Financial EC Healthcare EC The HIPAA Transaction SetsCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

HIPAA is a Compliance Initiative but the mindset of the regulatorsis different from “Fraud and Abuse”.Final enforcement rules are notfinalized. HIPAA is an IT Initiative but while it shares features withY2K it is both bigger and morebeneficial.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

HIPAA is all about Standards! Standards for automating the businessprocess of Claims Administration Standards for the security andconfidentiality of Health InformationCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Mars Global ObserverRIP 125 MillionCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Administrative Simplification New England Journal of Medicine articleclaims 19-24% of US Healthcare Costsare Administrative. Private Sector Response - the BushAdministration and WEDI.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

1993 WEDI Recommendations To automate the claims process willrequire: Standards for key Employer-HealthPlan data exchanges. Standards for key Payer-Provider dataexchanges. Uniform Code Sets National Identifiers Patient Provider Payer EmployerCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

1993 WEDI Recommendations National Guidelines to preempt statestandards Signatures Security The Clinton Reform Initiativeincorporated many of the WEDIrecommendations with someembellishments. Support for AdministrativeSimplification survived the death of theClinton Healthcare Reform InitiativeCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

PrivacyThe “leak” of the HIV Positive Diagnosis ledto an alarmed public and a series of hearingson Privacy. Bipartisan consensus on administrativesimplification found its expression inHIPAA legislation of 1996. WEDIrecommendations were incorporated withadditional requirements related to Privacy.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Who Has to Comply?OrganizationAll qualified health plans, ERISA,Medicare, MedicaidHealthcare ffectedüüüüEmployers“Covered Entity”Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Who Has to Comply? Section 162-923 A covered entity may use a business associate,including a healthcare clearinghouse, to conduct atransaction covered by this part. If a covered entitychooses to use a business associate to conduct all orpart of a transaction on behalf of the covered entity, thecovered entity must require the business associate to dothe following:– Comply with all applicable requirements of this part– Require any agent or subcontractor to comply with allapplicable requirements of this part.“Business Associate”Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

What Kind of Provider Are You?The Privacy Rule differentiates betweenproviders: Direct Treatment Indirect Treatment “The health care provider delivers health care to the individualbased on the orders of another health care provider; and.The health care provider typically provides services or products, orreports the diagnosis or results associated with the health care,directly to another health care provider, who provides the servicesor products or reports to the individual.”Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

PenaltiesMonetaryPenaltyTerm ofImprisonmentOffense 100N/ASingle violation of a provisionUp to 25,000N/AMultiple violations of an identical requirement orprohibition made during a calendar yearUp to 50,000Up to one yearWrongful disclosure of individually identifiablehealth informationUp to 100,000Up to five yearsWrongful disclosure of individually identifiablehealth information committed under falsepretensesUp to 250,000Up to 10 yearsWrongful disclosure of individually identifiablehealth information committed under falsepretenses with intent to sell, transfer, or use forcommercial advantage, personal gain, ormalicious harmFailure to implement transaction sets can result in fines up to 225,000 per year ( 25,000 per requirement, times ninetransactions)Failure to implement privacy and security measures canresult in jail timeCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

1996-2001 Waiting for Rules NCVHS– DHHS charged National Committee on Vital HealthStatistics (NCVHS) to hold hearings on: Transaction Standards Code Sets Identifiers Final and Proposed Rules– Security Proposed Rule 8/98– Privacy Proposed Rule 11/99– Final Rule on Transaction Sets and Code Sets issued8/00 effective 10/02– Final Rule on Privacy issued April 14th, 2001, effective2003.Final Rules on Identifiers and Securityexpected midCreated by McLure-Moynihan Inc.2001 2001 MMI All rights reserved.

National Identifiers Patient ID– No NCVHS recommendation Provider ID– HCFA-maintained Provider ID# recommended Payer ID/HealthPlan ID– HCFA-maintained database recommended. RequiresFunding (and release of final rule). Employer ID– Tax ID #Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Security/Privacy Security rules deal with how data isstored and accessed. Privacy rules deal with how and towhom data is disclosed.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Security “Protected Health Information”– individually identifiable that has ever been: electronically transmitted electronically stored Administrative procedures---documentedgeneral practices for establishing and enforcingsecurity policies Physical safeguards---documented processesfor protecting physical computer systems,buildings, and so on Technical security services---processes thatprotect, control, and monitor access Technical security mechanisms---mechanismsfor protecting information and restricting access todata transmitted over a networkCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

SecurityA complete Internet communicationsimplementation must include adequateencryption, employment of authenticationor identification of communicationspartners, & a management scheme toincorporate effective password/keymanagement systems.Acceptable encryption hardware & softwareapproachesAcceptable authentication/identificationapproachesCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Security Authentication Did the sender of the message (user of thesystem) really send this message or was itsent by a “bad guy”. Encryption Scrambling a message so that only thesender and the receiver can “unscramble”the message using a Key. Public Key Infrastructure (PKI) Use of public and private keys to encryptmessages.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Are You In The“Chain of Trust” “a contract entered into by two businesspartners in which the partners agree toelectronically exchange data and protect theintegrity and confidentiality of the dataexchanged.”Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Security First assign responsibility for HIPAA securitycompliance. Self assessment tool kits are available frommultiple sources. “For the Record” published by NACI is anexcellent book that was a source book for thesecurity proposed rule. Most people and literature overemphasize thetechnology and underemphasize the culturaland physical aspects of security.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Privacy The Privacy Rule defines “protected healthinformation”, provides guidelines fordisclosure of data and policies for authorizeddisclosure. Privacy guidelines are very controversial withover 60,000 comments from both sides of thedebate. Final Privacy rules differed from ProposedRules and administration and expenseestimates vary widely.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Privacy “The Privacy Advocate will be to theInformation Age what the EnvironmentalAdvocate was to the Industrial Age.” Providers have potential liability undercommon law and state statutes. HIPAA sets afloor, not a ceiling, and more stringent statelaws preempt HIPAA. This is a people issue. How can managementcreate a climate of confidentiality that canensure patient trust? Attitudes matter – don’tmake dismissive comments about privacyrequirements.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Health Information Health Information Any information, whetheroral or recorded in any form or medium. Identifiable Health InformationRelates to the past, present, or future physicalor mental health or condition of an individual;the provision of health care to an individual; orthe past, present, or future payment for theprovision of health care to an individual; and (i)that identifies the individual; or (ii) with respectto which there is a reasonable basis to believethe information can be used to identify theindividual.”Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Protected Health Information(§164.501): “means individually identifiable healthinformation that is: (i) Transmitted by electronic media; (ii) Maintained in any medium described inthe definition of electronic media [under HIPAA],or (iii) Transmitted or maintained in any otherform or medium.”Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Key Requirements Consent Authorization Notice Right to Request Restriction Right of Access Right to Amend Right to an AccountingCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Eliminating Paperwork A Decades-Old Quest––––––1950s First Steps1960s Tape-based standards1970s Industry-Specific Standards1980 Cross-Industry Standards1990s EDI evolves into EC2000s Stay Tuned!Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

What Took So Long? Primitive networks. Lack of electronic format standards. Expensive hardware and software. Lack of consensus among tradingpartners.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

The Local Area NetworkCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

?The Wide Area NetworkCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

The ElectronicPost OfficeBox123Electronic Mail BoxesCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

The ElectronicPost OfficeBox Box123456. And Other Mail BoxesCreated by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Value Added Networks VANs offer store and forward mail boxservices. Operated by GEIS, AT&T,MCI andothers. VANs support numerouscommunications interfaces, security, 24hour support and an audit trail.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

The Internet A Public Packet Network thatlooks free! But there is no support, nosecurity, no audit trail.Despite shortcomings, theInternet and its protocols appearto be the dominant network ofthe future.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.

Let’s Define Our Terms Electronic Data Interchange:– The exchange of computer-processabledata in a standardized format between twoenterprises. Electronic Commerce:– Any use of a variety of technologies thateliminate paper and substitute electronicalternatives for data collection andexchange. Options include InteractiveVoice Response, Fax, Email, Imaging,Swipe Cards and multiple Web-basedInternet tools.Created by McLure-Moynihan Inc. 2001 MMI All rights reserved.