# Presentation: 247488

## HIPAA and the StatesCritical Issues & Compliance Strategies

**Presented by**
**Robert J. Burns**
**National Governors Association**
**Center for Best Practices**

***Regional Technical Assistance Meetings***
***Substance Abuse and Mental Health Services Administration***

***April 18, 2002***
***Phoenix, AZ***

***May 2, 2002***
***Atlanta, GA***

***May 16, 2002***
***Chicago, IL***

***June 20, 2002***
***Boston, MA***

**Notes:**
TALKING POINTS
Reasons why HIPAA has not garnered much executive-level attention thus far;
Critical compliance / implementation issues facing states; and
State efforts to coordinate (and build support for) their HIPAA compliance activities.

## About NGA

- Professional association of, by, and for the nation’s Governors
- Nonpartisan
- Unique relationship with Governors/States
- Organization
- NGA Committee (“voice” in DC)
- NGA Center for Best Practices                 (technical assistance to states)

## FY2002 Budget Overview

- Revenue nearly 4 percent below expectations
- By end of June, shortfall will reach $40 to $50 billion (4 to 5 percent of total state budgets)
- Post-9/11 activities responsible for $5 to $7 billion in state costs

## How States Are Coping

- First tier cuts: hiring freezes, delaying new capital projects, delaying payments, salary freezes
- Recent tier cuts: across-the-board slashes, halting road projects, eliminating new and some existing programs, some job cuts

## Revenue Enhancements

- Few states calling for tax increases
- IN (cigarettes, gambling)
- KS (fuel, sales, cigarettes)
- Some tax cuts postponed (FL, MD)
- Other revenue sources tapped
- Rainy day funds (drained)
- Some bonds (borrowing at record levels)
- Lottery funds

## Top Gubernatorial Priorities

- Bolstering Homeland Security
- Fostering Economic Recovery
- Maintaining Education Initiatives
- Containing Health Care Costs

## Top State Health Priorities

- Containing Pharmaceutical Costs
- Medicaid Reform
- Enhancing waiver authority
- Overall reform
- Emerging Issues
- Workforce
- Malpractice
- HIPAA compliance

## Why Just Now “Emerging?”

**Legally Complex**
- PHI definitions
- Covered entities, business associates, trading partners
- Minimum amount necessary, reasonable efforts
- Preemption, exemptions
**Technically Complex**
- Transactions, codes, identifiers, data format
- Electronic data interchange
**Poor Guidance**
- CMS underestimated Medicaid costs
- No data on fiscal impact outside Medicaid
- Program differences among states

## Regulation Status

|  | Proposed
Rule | Final
Rule | Compliance Deadline† |
| --- | --- | --- | --- |
| Privacy | 11/99 | 4/01‡ | 4/03 |
| Security | 8/98 | — | — |
| Transactions and Codes | 5/98 | 10/00 | 10/02* |
| National Provider Identifier | 5/98 | — | — |
| Health Plan Identifier | — | — | — |
| Employer Identifier | 6/98 | 5/02 | 7/02 |
| Enforcement | — | — | — |
| † Small health plans have one additional year following this date to be compliant.
‡  HHS proposed modifications to this rule on March 27, 2002.  The compliance deadline will not change.
* The compliance deadline may be extended by one year if a compliance plan is submitted to HHS before October 16, 2002.  Small health plans are not eligible for the conditional extension. |  |  |  |

## HIPAA Cost Estimates

|  | Medicaid | Non-Medicaid |
| --- | --- | --- |
| California | < $100 million |  |
| Pennsylvania | $50-$200 million |  |
| Indiana |  | $160 million |

## The Ripple Effect

- Community-based providers (“safety net”)
- Public hospitals/clinics
- Mental health facilities
- Substance abuse treatment centers
- State/local health departments
- Academic medical/research centers
- Organ donation

- Law enforcement and corrections (coroners, medical examiners)
- School-based health programs (immunizations, dental)
- SAPT-funded programs
- MCH programs (Title V)
- HIV/AIDS (“Ryan White”)
- TANF-funded programs
- State employee benefits
- Worker’s compensation
- Health policy offices

**Notes:**
TREATMENT
Case management
Referrals and authorization requests
Medical history maintenance
Lab work and tests (indirect)

ENROLLMENT & ELIGIBILITY
Health plan enrollment
Eligiblity, benefit determinations & procedures (plan-specific, public aid)
Termination of coverage

BILLING & PAYMENT (Claim Submissions & Status)
Premium payment
Claim submissions
Date(s) of service (when)
Provider information (who)
Procedures (what)
Diagnosis (why)
Claim inquiries (status)
Claim payment (COB, EOB)

RESEARCH
Medical research (clinical trials, new treatments, medications, therapies)
Surveillance of health trends (public health, best practices)

MANAGEMENT
Policy decisions
Quality management (provider history, licensure, referral trends, best practices)
Performance standards (claims turnaround, case management trends)
Underwriting and risk management (premium payment)

## Critical Issues

**Liability**
- Privacy and Security
- Lawsuits
- Civil, criminal penalties
**Operational Disruption**
- Electronic Transactions & Codes (and Identifiers)
- Enrollment, eligibility, billing, payment, etc.
- Reporting, budgeting, research, etc.
**Funding**

## Compliance Strategies

- Oversight commission or committee
- Governor’s office
- Budget Director, State CIO
- Attorney General, General Counsel
- Directors of affected (or likely affected) agencies
- Designated HIPAA office
- Medicaid agency
- Privacy or IT office
- Special project office (HIPAA-specific)
- Leadership (and authority)
- Specialty workgroups
- Multi-year business plan

## North CarolinaHIPAA Statewide Assessment Team

- Collaborative Leadership
- Oversight committee
- Centralized Management
- Housed within DHHS
- Decision Making Authority
- Legislature
- Governor
- Budget director, IT office
- Clear Mission
- Assess statewide impact
- Build awareness
- Develop strategic plan, compliance tools
- Coordinate state activities

## New YorkCentral HIPAA Coordination Project

- Collaborative Leadership
- Steering Committee
- Centralized Management
- Led by IT office
- Decision Making Authority
- Governor
- Budget director
- Agency directors
- Clear Mission
- Assess statewide impact
- Build awareness
- Develop compliance tools
- Provide technical support

## OhioEngagement Management Structure

- Collaborative Leadership
- Governor, Cabinet
- Centralized Management
- Deputy Directors Team
- Decision Making Authority
- Governor
- Agency Directors
- Clear Mission
- Assess statewide impact
- Build awareness
- Develop strategic plan, compliance tools
- Coordinate state activities

## Public-Private Partnerships

- Hawaii HIPAA Readiness Collaborative
- New Hampshire & Vermont Strategic HIPAA Implementation Plan (NHVSHIP)
- North Carolina Healthcare Information and Communications Alliance (NCHICA)
- Southern HIPAA Administrative Regional Process (SHARP)
- Washington State HIPAA Partnership

## Impact Assessment Tools

- Covered Entity Screening Tools
- Covered Entity Screening Tool (OH)
- HIPAA Impact Assessment (NY)
- Organizational Impact Assessments
- HIPAA Awareness Self-Assessment Checklist (WA)
- HIPAA Facilities Checklist (CA)
*A Guide to Privacy Readiness* (MD)
- HIPAA *EarlyView* Privacy (NC)
- Business Information Flow Assessment (NC)
- Electronic Data Interchange Assessment (NC)

## Model Forms &Educational Materials

- Business Associate Agreement (OH)
- Patient Consent/Authorization Form (OH)
- Monthly HIPAA Newsletter (NC)
- HIPAA Awareness Brochure (OH)

## KentuckyCabinet-Level Awareness Survey

- Developed by Governor’s Office for Technology
- Cabinet Awareness
- Cabinet Impact
- Costs, budget needs

## Building Support & Awareness

- Difficult to estimate implementation costs
- Initially, costs will exceed savings
- “Systems remediation” signals that administrative simplification is like Y2K—just another technical problem
- “Business transformation” implies that a greater commitment of resources is needed

## NGA Center Activities(www.nga.org/center)

*Issue Brief *(HIPAA)
- Quarterly conference calls w/Governors’ health policy advisors
- Executive-level technical assistance meeting (late summer)
- State-specific technical assistance (via Governor’s office)

## NGA Center for Best Practices(www.nga.org/center)

- Robert J. Burns
- Policy Analyst
- Health Policy Studies Division
- National Governors Association
- Center for Best Practices
- 444 North Capitol Street, Suite 267
- Washington, DC 20001-1512
- (202) 624-7729
- fax: (202) 624-5313
- email: _[rburns@nga.org](mailto:rburns@nga.org)_