# Presentation: 310699

## Health Data Standards
and Health Information Privacy

The Health Insurance Portability and Accountability Act of 1996
Title II - Subtitle F
Administrative Simplification

**and Health Information Privacy**
- The Health Insurance Portability and Accountability Act of 1996
- Title II - Subtitle F
- Administrative Simplification

## Improve the efficiency and effectiveness of the health care system, by standardizing the electronic transmission of certain administrative and financial transactions	
Protect the security and privacy of health information

- Protect the security and privacy of health information

**Purpose of Provisions**

## Overview of Provisions 

- Secretary of HHS must adopt standards for electronic health care transactions, unique health identifiers, code sets, security, and privacy
- All health plans, clearinghouses, and those providers who choose to conduct these transactions electronically are **required** to implement these standards

## Overview of Provisions 

- Supersedes most contrary provisions of state laws
- Expands the scope and membership of the National Committee on Vital and Health Statistics

## Overview of Provisions 

- Civil and criminal penalties are prescribed for failure to use standards or for wrongful disclosure of confidential information
- Penalties of $100 per violation of standards (up to $25,000 total per year per standard)
- Penalties of $50,000 to $250,000 and 1 to 10 years in jail for wrongful disclosure of individually identifiable health information

## Transaction Standards 

- Claims or equivalent encounter information
- Coordination of benefits information
- Referral certification and authorization
- Enrollment & disenrollment in a health plan
- Eligibility for a health plan

## Transaction Standards 

- Health care payment & remittance advice
- Health plan premium payments
- First report of injury
- Health claims status
- Health claims attachments

## Supporting  Standards 

- Unique identifiers (including allowed uses) for:
- Individuals
- Employers
- Health Plans
- Health Care Providers
- Code sets (including issues of maintenance)

## Supporting  Standards

- Security (including electronic signatures), confidentiality, and privacy
- Low cost distribution mechanism

## Implementation Timeline

- HHS adopts
- transaction stds.
- (excl. claims)

- HHS adopts
- claims stds.
- HHS reviews/
- modifies first stds.

- Plans, clearinghouses
- and providers adopt
- stds.

- NCVHS recommends
- stds. and legislation for
- electronic exchange of
- medical records

- Small plans
- adopt stds.

- August	  February		  February	     August  	      February       August        February
- 1997	  1998		  1999		      2000		          2001

## Standards Adoption Process 

- In general, any standard adopted shall be a standard that has been developed, adopted or modified by an ANSI accredited standards setting organization (SDO)

## Standards Adoption Process

- The Secretary may adopt a different standard if:
- it will significantly reduce administrative costs compared to alternatives, and it is promulgated in accordance with “negotiated rulemaking” procedures, **or**
- No SDO has developed, adopted or modified a standard in that area

## Standards Adoption Process 

- A standard may not be adopted unless the SDO has consulted with:
- NUBC
- NUCC
- WEDI
- ADA
- In adopting standards, the Secretary will rely upon the recommendations of the NCVHS and the HHS Data Council

## Implementation Strategy 

- HHS will utilize a three tier approach to implementation
- HHS Data Council will provide senior level policy guidance and decision making and will serve as the contact point for the NCVHS

## Implementation Strategy

- The Data Council’s Health Data Standards Committee will be responsible for the daily operation and management of the standards activities
- Implementation Teams will be responsible for the research, analysis, and development of mandated national standards

## Implementation Teams 

- HHS has established six internal interdepartmental implementation teams to identify and assess potential standards
- Infrastructure and cross-cutting issues
- Health insurance claims and encounters
- Health insurance enrollment and eligibility

## Implementation Teams

- Health identifiers for providers, health plans, employers and individuals
- Code sets and classification systems
- Security and safeguards

## Team Approach 

- Identify existing candidate standards for each area, identify gaps and conflicts, and present findings to NCVHS and HHS
- Develop recommendations for standards to be adopted and present to NCVHS & HHS
- Submit draft regulations to the Secretary and to OMB for initial review

## Team Approach

- Publish proposed rules in Federal Register for public comment
- Analyze comments and prepare and publish Final Rules
- Distribute adopted standards and implementation guides

## Privacy Goals

- Provide patient rights
- Informed consent to release information
- Access to own health information
- Ability to correct erroreous entries
- Establish process for exceptions
- Research, Law Enforcement, Public Health
- Limit amount of information and access
- Establish deterrents and penalties

## Privacy Timeline

- HHS privacy
- recommendations

- Privacy legislation

- If no privacy legislation,
- HHS privacy regulations

- August	  February		  February	     August  	      February       August        February
- 1997	  1998		  1999		      2000		          2001

## Opportunities for Input

- Participate with standards development organizations
- Provide testimony at NCVHS public hearings
- Provide written input to NCVHS
- Provide written input to the Secretary of HHS

## Opportunities for Input

- Comment on the Federal Register publications for each proposed standard
- Invite Implementation Teams staff to meetings with public and private sector organizations

## 
National Committee on Vital
and Health Statistics

**National Committee on Vital**
**and Health Statistics**

## New NCVHS Responsibilities 

- Membership increased from 16 to 18 with two members appointed by Congress
- Annual report to Congress on HIPAA implementation status
- Serve as a public forum for all interested parties and provide mechanisms for public input through hearings and meetings

## New NCVHS Responsibilities

- Assistance to Secretary:
- Standards - Secretary to rely on the recommendations of NCVHS and publish recommendations in Federal Register
-  Privacy & Confidentiality - Secretary to consult with NCVHS on legislative privacy recommendations

## New NCVHS Responsibilities

- Report to Secretary within 4 years with recommendations and legislative proposals on standards for computerized patient record

## Current NCVHS Activities

- Full Committee meetings quarterly
- Subcommittee on Privacy and Confidentiality
- Subcommittee on Health Data Needs, Standards and Security

## Sources of Information 

- HHS Data Council Web Site
**http://aspe.hhs.gov/datacncl/**
-  NCVHS Web Site
**http://aspe.hhs.gov/ncvhs/**

## Cross-Cutting Implementation Issues

## Charge

- Purpose
- Provide overall guidance and coordination to the HIPAA EDI standards Implementation Teams
- Track progress of the HIPAA EDI standards project
- Serve as the information point for overall HIPAA EDI standards implementation information.

## Charge

- Responsibilities
- Develop and maintain master data dictionary and data structures list for all standards
- Develop a timeline for the entire project
- Provide periodic progress reports on the project to HHS and the NCVHS
- Monitor progress of individual implementation teams

## Charge

- Responsibilities cont.
- Provide guidance and coordination on common issues (e.g. regulation development)
- Facilitate communciation among implementation teams
- Serve as communication point between implementation teams and HHS Data Council.
- Assure all implementation teams have common understanding of issues

## Guiding Principles

- Improve efficiency and effectiveness of system
- Meet the needs of users
- Be consistent with other administrative simplification standards
- Have low implementation costs
- Be supported by a SDO

## Guiding Principles

- Have timely adoption procedures
- Be technologically independent of platforms
- Be precise & unambiguous, but as simple as possible
- Keep data & paperwork burdens low
- Have flexibility to adopt to health system changes

## Barriers 

- Barriers to adopting national uniform standards:
- Conflicting standards; e.g., ANSI vs. industry vs. government
- Conflicting implementations; e.g., proprietary collection of unique or differently defined data
- Incomplete standards; e.g., no implementation guide

## Barriers 

- More barriers:
- Proprietary code sets; e.g., professional associations make $ selling code sets
- Cost of change; e.g., cost of changing length of ID
- Privacy; e.g., potential use of SSN as unique ID raises fear of easier access and linkage of confidential information

## Frequently Asked Questions

- Is Big Brother forcing this on the industry?
- Will only providers benefit from HIPAA standards?
- Is DHHS doing this alone?
- Will DHHS merely adopt Medicare standards?
- Will all HIPAA standards be adopted in 18 months?

## Frequently Asked Questions

- Will private sector standards be adopted with no change?
- Which HIPAA standards will be adopted first?
- Will HIPAA standards be tested?

## Issues

- Conformance testing
- Who does it
- Who pays for it
- Who monitors the testers
- Data dictionary/Implementation guides
- Who maintains them
- Who pays for them

## Issues

- Timely updates to “Final Rule”
- How do we keep standards up with developments
- How do we draw the lines between employers, plans, and providers
- Timing
- Is 2 years enough time
- Is February, 2000 the safest time to comply

## Issues

- Are the teeth big enough
- Some have indicated it would be cheaper to pay the fines initially
- If Medicare/Medicaid implements it, is that enough to move industry

## Current Activities

- Master data dictionary
- over 4700 elements included to date
- Draft ‘boilerplate’ regulation language
- Cross-cutting implementation issues

## 
Claims and Encounters Implementation Team

**Claims and Encounters Implementation Team**

## Charter

- Adopt formats and data content for:
- Health insurance claims, encounters, COB
- Remittance advice
- Claim status inquiry

## Charter

- Facilitate identical implementations through:
-  Implementation guides
- With precise instructions on data content

## Process

- Created information structure
- Solicited formal advice
- National Uniform Billing Committee
- National Uniform Claim Committee
- Workgroup for Electronic Data Interchange
- American Dental Association

## Principles

- Data Content Management
- Structural Stability
- Reliability
- Documentation

## Principles

- Data Content Management
- Data update timeliness
- Implementation guide update

## Principles

- Structural Stability
- 3 years
- One structure
- Annual data updates

## Principles

- Reliability
- Testing part of the process
- Results made public
- For claims, encounter, COB - pilot production required

## Principles

- Documentation
- 	Complete and unambiguous
- Implementation guide
- Data dictionary
- Data conditions

## Principles

- Each transparent to the other, i.e., common/like data will be found in the same location
- Claim
- Encounter
- Coordination of Benefits

## Recommendations

- Retail Pharmacy Claim - NCPDP v. 3.2
- Remittance Advice - X12.835 v. 3070
- Claims Status - X12.277 v. 3070
- Dental Claims - X12.837 v. 3070
- Physician/Supplier Claims - X12.837 v. 3070
- Institutional Claims - X12.837 v. 3070

## Data Content

- Working with base sets
- Working with organizations
- Superset concept

## Issues

- Divided opinions
- Institutional and physician/supplier claims/encounters/coordination of benefits

## Unique Health Identifiers Implementation Team

## Charge

- Recommend Standard Unique Health Identifiers (including allowed uses)
- Individual
- Employer
- Health plan
- Health Care Provider

## Individual Identifier

- Current Activities
- Analysis of proposals in ANSI/HISB inventory
- Use of criteria from American Society for Testing and Materials Standard Guide for Properties of a Universal Health Care Identifier
- Evaluation of SSN by SSA
- Evaluation of Postal Service as Trusted Authority

## Individual Identifier

- Current Thinking--Eliminate consideration of
- Unenhanced, unverified SSN
- Biometric identifier proposals
- Identifier based on existing medical record number plus practitioner prefix

## Individual Identifier

- Current Thinking--Continue consideration as identifiers
- Enhanced SSN, as proposed by the Computer-based Patient Record Institute
- Identifier based on personal immutable properties
- Universal Health Care Identifier (UHID), as described in ASTM Guide

## Individual Identifier

- Current Thinking--Continue consideration as supporting technologies
- Directory service, or master patient index
- Public/private key encryption

## Individual Identifier

- Issues
- Risks, limitations of SSN as a health identifier
- Insufficient documentation of infrastructure for other proposals
- Adequacy of current technology to support national master patient index (MPI) or public/private encryption
- Acceptance by public of a national MPI or national health identifier

## Individual Identifier

- Issues
- Method to positively link individual to his/her identifier
- Method to prevent issuance of duplicate identifiers
- Medical record linkage vs right to anonymous care
- Costly infrastructure investment likely
- Controversy with any recommendation

## Employer Identifier

- Current Activities
- Coordination with Enrollment/Disenrollment, First Report of Injury, Premium Payment transactions
- Current Thinking
- Recommendation of Employer Identification Number (EIN)

## Employer Identifier

- Issues
- EIN is not unique to the employer--Is this a problem for health transactions?
- Some sole proprietors do not have an EIN--Would they be required to obtain an EIN for health transactions?
- Would health transaction uses of EIN require legislative or regulatory change?

## Health Plan Identifier

- Current Activities--PAYERID to be proposed
- 9-position numeric, including 1 check digit
- No intelligence in number
- Can enumerate 100 million health plans and employers that offer funded and unfunded health benefits

## Health Plan Identifier

- PAYERID System Features
- Registry of business information about the entity
- Electronic “phone book” containing names of entities and their PAYERIDs
- Data base of information needed to route health care transactions electronically
- Issue--High-level vs detailed enumeration

## Provider Identifier

- Current Activities--National Provider Identifier (NPI) to be proposed
- 8-position alphanumeric, including 1 check digit
- No intelligence in number
- Can enumerate 20+ billion providers

## Provider Identifier

- System Features
- Data validation (SSN, address,etc.)
- Search/match for duplicate providers
- Query/report generation--national data base

## Provider Identifier

- Issues
- Enumeration options
- Provider practice addresses and location codes
- DHHS OIG Sanction Data

## 
Enrollment and Eligibility Implementation Team

**Enrollment and Eligibility Implementation Team**

## Charge

**Charge**

- Standards  and implementation guides for the following transactions
-  Enrollment
-  Eligibility
-  First Report of Injury
-  Health Plan Premium Payments
-  Referral Certification and Authorization

## Recommendations

- Enrollment - X12.834
- 1st Report of Injury - X12.148
- Premium Billing and Payment - X12.811/820
- Health Care Services Review - X12.278
- Eligibility - X12.270/271

## Enrollment

**Enrollment**

- Current Implementation Guide Covers Forms of Benefits
- Narrower scope for a health care-specific guide
- Policy:  Are standards imposed by  OMB Directive 15 applicable to HIPAA?
- Are performance measurement and outcome research needs covered by HIPAA?

## 1st Report of Injury

**1st Report of Injury**

- No Current Implementation Guide
- Not health care-specific transaction guide: outside HHS purview
- DoL - OSHA, BLS, OWCP
- Policy: Expand to allow physician first report?
- May have to engage private sector “workers comp” community

## Premium Billing & Payment

**Premium Billing & Payment**

- Used in Industry as ANSI finance function
- No Implementation Guide
- HIPAA Use Not Very Complicated

## Health Care Services Review

**Health Care Services Review**

- Multiple Implementation Guides Possible
- Limited, If Any, Actual Use
- Pilot Project Underway
- May be a late deliverable for 2/98

## Eligibility

**Eligibility**

- Mapping Government data element Requirements
- All necessary components in place to produce the regulation
- Not doing interactive Eligibility Transactions

## Data Dictionary

**Data Dictionary**

- Includes
- Listing of names, definitions, transactions and locations
- Organized by individual transactions
- Does NOT include
- Code values
- Implementation instructions

## Coding and Classification Implementation Team 

## Charge

- Codes and classification
- Diseases, injuries, impairments, other health problems
- Causes of these conditions
- Actions taken to prevent, diagnose, treat or manage these conditions
- including substances, equipment, and supplies used

## Charge

- Responsibilities
- Select standards for codes/classifications for administrative transactions and ensure appropriate mechanisms for distribution and maintenance
- Recommend set of health vocabularies for full electronic health records and ensure appropriate mechanisms for distribution and maintenance
- Map vocabularies to administrative codes/classifications

## Recommendations - 2000

- Diseases, injuries, impairments, etc.
- ICD-9-CM
- Procedures
- ICD-9-CM
- CPT
- CDT
- HCPCS (encompasses CPT and CDT)

## Recommendations - 2000

- Drugs
- For most administrative transactions
- HCPCS
- For pharmacy transactions
- NDC
- Devices
- HCPCS

## Issues

- Use of official implementation guidelines
- Likelihood of changes in some standards for 2001 and beyond
- e.g., move to ICD-10-CM
- Need to have ability to accept codes and identifiers > 5 characters in 2001 and beyond

## Issues

- Openess of update process for privately owned and maintained systems
- Cost and use restrictions for privately owned and maintained systems
- Availability of electronic formats suitable for full range of users

## Security Standards Implementation Team 

## Charge

- Security of Healthcare Systems/Transactions
- Electronic Signatures

## Objectives

- Establish a Healthcare Data/Systems Security Framework
- e.g., NRC Report
- Identify Requirements “Baseline”
- Technology Neutral -- if possible

## Scope of Work

- Defined Transactions Only, however ...
- Key Considerations (in act)
- tech cap of rec systems
- costs
- training, personnel issues
- value of audit trails
- needs and capabilities of small hc providers and rural hc providers
- Security, not Privacy

## Definitions

- Privacy vs.Confidentiality vs Security
- Security
- Confidentiality
- Integrity
- Availability

## Definitions

- Security Mechanisms
- Identification
- Authentication
- Authorization
- Access Controls
- Audit/Accountabilty

## Requirements Analysis

- Underlying Requirements
- Interoperability
- System Model / Matrix
- Baseline Security Requirements
- Potentially Conflicting Requirements
- Other Groups’ Work (e.g., Privacy, Transaction Sets, etc.)

## Issues

- Level of detail/specificity of published “standards”
- Determining needs/constraints of “Small” players