# Presentation: 161841

## What Providers Need From States to Facilitate HIPAA Compliance

**Sylvia B. Perlman, Ph.D.**
- Director of Quality Management
- Mental Health & Substance Abuse
- 	Corporations of Massachusetts, Inc.
- 							June 21, 2002
- Boston, Massachusetts

- HIPAA Regional TA Meeting   June 21, 2002

## Setting the Context

- Who we are:
- Statewide association of nearly 100 mental health and substance abuse providers
- What we do:
- Work with major purchasers
- Advocate and lobby
- Troubleshoot problems
- Provide training and technical assistance

- HIPAA Regional TA Meeting   June 21, 2002

## Setting the Context

- What we do:
- Anticipate trends that will affect our members
- Examples:
- Managed care in the early 1990s
- Outcome measurement in the mid-1990s
- Corporate compliance in the late 1990s
- HIPAA today

- HIPAA Regional TA Meeting   June 21, 2002

## HIPAA Implementation and Training Project

- For the past year we have been developing and managing a project for our members
- Worked with operational and legal consultants
- Offered 7 training sessions on privacy, security and EDI, each attended by over 100 individuals
- In July participants will receive a CD-ROM that provides templates for policies and procedures

- HIPAA Regional TA Meeting   June 21, 2002

## HIPAA Implementation and Training Project

- We have invited our major purchasers, both public and private, to address program participants
- They spoke at our March and June sessions

- HIPAA Regional TA Meeting   June 21, 2002

## HIPAA Implementation Demands Significant Resources 

- HIPAA implementation is very demanding of staff and technology
- Each provider needs a privacy officer and a security officer
- Each provider needs to train staff and consumers
- HIPAA requires major investments in technology

- HIPAA Regional TA Meeting   June 21, 2002

## HIPAA Implementation Demands Significant Resources

- Providers have minimal resources
- States can reduce the burden by communicating and working with providers

- HIPAA Regional TA Meeting   June 21, 2002

## What States Can Do:General Themes

- Coordinate your own efforts
- Communicate: Provide detailed information
- Tell providers what you are doing and when
- Tell providers what they will need to do
- Enable providers to participate in your efforts, as and when that is possible
- Offer training
- Provide resources

- HIPAA Regional TA Meeting   June 21, 2002

## What States Can Do:General Themes

- In Massachusetts there is a state entity that is coordinating state agencies’ efforts.
- Our association is working with them.
- They will be conducting training for state agencies and may invite providers to participate.

- HIPAA Regional TA Meeting   June 21, 2002

## What States Can Do:General Themes

- The MA Health Data Consortium is helping to coordinate efforts of all the state’s payers, providers and software vendors.
- Their Web site includes significant HIPAA resources.
- They are also hosting the state’s Web page.
- They have invited us to work with them.

- HIPAA Regional TA Meeting   June 21, 2002

## Critical Basic Questions

- Which state agencies are considered Covered Entities (CEs)?
- Which state agencies will be requesting extensions?
- Which state laws will preempt HIPAA privacy regulations?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Standard Transactions

- Which agencies will be requesting extensions?
- Which will be able to process HIPAA compliant transactions before 10/16/03?
- What transactions will each agency support?
- When and how will they be doing testing?
- How will providers be kept informed?
- Will the state require providers to be certified?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Standard Transactions

- When will providers learn:
- What service codes will be reimbursed?
- What modifiers will be used?
- Whether the state is applying for additional codes?
- Will providers have any input into these decisions?
- How will the state train providers on new requirements?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Standard Transactions

- Will state agencies require providers to submit data beyond what is included in standard transactions?
- Will all state agency billing and data gathering be standardized across the state, or will area offices impose individual requirements?
- When will state agencies negotiate trading partner agreements?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Privacy

- How will providers learn which state laws preempt HIPAA?
- Will the state help determine the interaction between HIPAA and major federal laws?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Privacy

- Will state agencies that are CEs change their own policies regarding communication of PHI?
- If so, how? And how will providers find out?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Privacy

- Will state agencies that are CEs develop new provider contracts?
- Do we need Business Associate agreements with contractors the state uses?

- HIPAA Regional TA Meeting   June 21, 2002

## Specific Questions About Security

- Will state agencies’ contracts with providers incorporate new security requirements?
- Will the state require chain of trust agreements for providers?

- HIPAA Regional TA Meeting   June 21, 2002

## Summary

- Like you, providers are facing profound change in their standard operating procedures.
- They are depending on you to coordinate YOUR efforts, and to communicate with them and support them throughout the process.

- HIPAA Regional TA Meeting   June 21, 2002

## Summary

- Our goal is to maintain open lines of communication.
- There may be areas where providers can help you.

- HIPAA Regional TA Meeting   June 21, 2002