Department of Health and Human Services 
OFFICE OF 
INSPECTOR GENERAL 
HIPAA R : 
EADINESS
A S
DMINISTRATIVE  IMPLIFICATION 
M S A
FOR  EDICAID  TATE  GENCIES 
JANET REHNQUIST 
Inspector General 
March 2003 
OEI-09-02-00420  Office of Inspector General

http://oig.hhs.gov 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services (HHS) 
programs, as well as the health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit Services 
The OIG's Office of Audit Services (OAS) provides all auditing services for HHS, either by 
conducting audits with its own audit resources or by overseeing audit work done by others. 
Audits examine the performance of HHS programs and/or its grantees and contractors in 
carrying out their respective responsibilities and are intended to provide independent 
assessments of HHS programs and operations in order to reduce waste, abuse, and 
mismanagement and to promote economy and efficiency throughout the department. 
Office of Evaluation and Inspections 
The OIG's Office of Evaluation and Inspections (OEI) conducts short-term management and 
program evaluations (called inspections) that focus on issues of concern to the department, the 
Congress, and the public.  The findings and recommendations contained in the inspections 
reports generate rapid, accurate, and up-to-date information on the efficiency, vulnerability, and 
effectiveness of departmental programs. 
Office of Investigations 
The OIG's Office of Investigations (OI) conducts criminal, civil, and administrative 
investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 
unjust enrichment by providers.  The investigative efforts of OI lead to criminal convictions, 
administrative sanctions, or civil monetary penalties.  The OI also oversees state Medicaid fraud 
control units, which investigate and prosecute fraud and patient abuse in the Medicaid program. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, 
rendering advice and opinions on HHS programs and operations and providing all legal support 
in OIG's internal operations.  The OCIG imposes program exclusions and civil monetary 
penalties on health care providers and litigates those actions within the department. The OCIG 
also represents OIG in the global settlement of cases arising under the Civil False Claims Act, 
develops and monitors corporate integrity agreements, develops model compliance plans, 
renders advisory opinions on OIG sanctions to the health care community, and issues fraud 
alerts and other industry guidance.  E X E C U T I V E   S U M M A R Y  
OBJECTIVE 
To determine if state Medicaid agencies expect to comply with the electronic data transaction 
standards and code sets under the Health Insurance Portability and Accountability Act 
(HIPAA) by October 2003. 
BACKGROUND 
The purpose of Title II of HIPAA is to improve the efficiency of the health care system by 
establishing standards to facilitate the electronic transmission of data between providers and 
payers. Electronic data interchange (EDI) can eliminate the inefficiencies associated with 
handling paper documents. It can reduce administrative costs and improves overall data quality 
for transactions, such as health care payments and coordination of benefits.1 
In accordance with the provisions of Title II of HIPAA, the Secretary of Health and Human 
Services has promulgated regulations mandating the use of specific standards for eight different 
types of electronic transactions and medical code sets. According to the regulations, state 
Medicaid agencies and other covered entities that filed an extension must implement the 
standards by October 16, 2003. 
FINDINGS 
We conducted telephone interviews with officials from the 51 state Medicaid agencies (50 
states and the District of Columbia). While few similarities exist in the planning and strategies 
among the 51 Medicaid agencies, 42 programs (approximately 80 percent) anticipate that they 
will be in compliance by October 2003. Of the remaining nine programs, eight are developing 
contingency plans to allow them to conduct business with compliant and noncompliant trading 
partners, and the ninth is expected to be minimally compliant by the deadline, with expectations 
that a new compliant system will be on line by March 2004. 
1
65 F.R. 50312 (August 17, 2000). 
1
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  Approximately 80 percent of the state Medicaid programs will be in compliance 
with the HIPAA standards by October 2003 
Forty-two state Medicaid agencies expect to be fully compliant by October 16, 2003. Nine 
states will not meet the October 2003, target. The nine states are developing strategies that 
they expect will enable them to continue paying claims. Furthermore, twenty-nine of the 51 
states currently have contingency plans in the event they are unable to implement the transaction 
standards by October 16, 2003. 
Few similarities exist in the planning and strategies among the 51 state Medicaid 
programs 
Twenty-nine states will use an electronic data interchange translator to handle the new 
electronic standards.  In addition to these 29, 15 states have new systems or plan to install new 
systems over the next several years, and 7 states will use a clearinghouse or other interim 
measures to meet the implementation date. Respondents from 40 states indicated that they plan 
to sequence implementation of the transactions. 
Lack of financial resources and technical support are barriers to meeting the 
October 2003 compliance date 
Twenty-one states report that lack of financial resources and of technical support are 

barriers.  In addition, 21 state officials cited regulatory delays, changing federal regulations, and

inconsistent rule interpretations as barriers.  Moving low volume and rural providers to

compliance is perceived as a barrier in 21 states. In 24 states, code set conversion is a major

barrier to compliance. 

CONCLUSION 
Overall, states are making progress in meeting the October 2003, deadline for implementing the 
HIPAA electronic transaction standards and code sets.  All 51 states expect to be ready to 
implement the transactions, which will enable them to pay claims for Medicaid beneficiaries. 
The nine states that anticipate not being fully compliant on October 16, 2003, expect to 
continue to transact business using compliant and noncompliant electronic data until their 
systems are ready. 
2
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  T A B L E   O F   C O N T E N T S  
PAGE

EXECUTIVE SUMMARY ...................................................... 1

INTRODUCTION ............................................................. 4

METHODOLOGY  ............................................................ 6

FINDINGS  .................................................................. 7

Approximately 80 percent will be in compliance  ........................................7

Planning and strategies vary among Medicaid agencies  ...................................8

Barriers to compliance ........................................................... 9

CONCLUSION  ............................................................. 10

APPENDIX: HIPAA Electronic Transaction Standards Glossary ........................  11

ACKNOWLEDGMENTS ..................................................... 13

3
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  I N T R O D U C T I O N  
OBJECTIVE 
To determine if state Medicaid agencies expect to comply with the electronic data transaction 
standards and code sets under the Health Insurance Portability and Accountability Act 
(HIPAA) by October 2003. 
BACKGROUND 
Congress instituted significant reforms to the health care industry with the passage of HIPAA. 
Title I of HIPAA ensures the availability and portability of health care insurance coverage, while 
Title II creates a regulatory framework focused on improving the efficiency of the health care 
system by establishing standards to facilitate the electronic transmission of data between 
providers and payers.  The goal is to create a seamless transfer of data with limited manual 
intervention. 
Administrative Simplification 
Under Title II, Subtitle F (Administrative Simplification), the Secretary of Health and Human 
Services has the authority to: (1) mandate the use of standards for the electronic exchange of 
health care data; (2) specify what medical and administrative code sets should be used, (3) 
require the use of national identification systems, and (4) specify the types of measures required 
to protect the security and privacy of personally identified health care information. 
Electronic Transactions and Code Sets 
Electronic data interchange (EDI) is the electronic transfer of information in a standard format 
between trading partners. The EDI substantially reduces the handling and processing time 
compared to paper transactions.  The EDI can eliminate the inefficiencies of handling paper 
documents by reducing the administrative burden, lowering operating costs, and improving 
overall data quality.2 
Transactions are the exchange of information between two parties to carry out financial or 
administrative activities related to health care. The standards for electronic transmission 
2
65 F.R. 50312 (August 17, 2000). 
4
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  of each of the transactions are codified in the Code of Federal Regulations (45 CFR Parts 160 
and 162).  The rule provides standards for eight types of electronic transactions: 
<  health care claims or equivalent encounter information, 

<  health care payments and remittance advice, 

<  coordination of benefits, 

<  health care claim status, 

<  enrollment and disenrollment in a health plan, 

<  eligibility for a health plan, 

<  health plan premium payments, and 

<  referral certification and authorization.

The rule also contains requirements concerning the use of standardized code sets, such as

tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes used

to encode data elements in the transaction. The code set includes the codes and the descriptors

of the codes.3 The following code sets have been adopted:

<	 International Classification of Diseases-9-Clinical Modifications (ICD-9-CM), volumes 
1, 2, and 3, 
<	 Combination of Health Care Financing Administration Common Procedure Coding 
System (HCPCS) and Current Procedural Terminology-4 (CPT- 4), for physicians and 
other health services, 
<  HCPCS for all other items,

<  National Drug Codes (NDC) or HCPCS for prescription drugs, and

<  Common Treatment for Dentists-2 (CTD-2) for dental services.

Covered entities, defined as providers, clearinghouses, and health plans that use the electronic

exchange of health information as part of their business, will be required to adopt these

standards. State Medicaid agencies are defined as health plans under Title II. The compliance

date for this rule (45 CFR Parts 160 and 162) was originally October 16, 2002.  The

Administrative Simplification Compliance Act, signed into law on December 27, 2001, extends

the compliance date by one year to October 16, 2003.  The extension applies only to those

covered entities that filed an extension with the Centers for Medicare & Medicaid Services

(CMS) by October 16, 2002.  According to CMS officials, states have all filed extensions. 

Therefore, October 2003, is the effective compliance date for state Medicaid agencies. 

Because the implementation date is several months away, standards have not yet been

developed to measure compliance.

3
45 CFR 160.1002 
5
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  METHODOLOGY 
This is one of several inspections that the OIG is conducting to determine the expected level of 
readiness for compliance by October 2003. After receiving input from CMS officials in the 
Centers for Medicaid and State Operations (CMSO), we developed a standardized telephone 
questionnaire to gather information from the Medicaid program officials responsible for 
implementing HIPAA electronic transactions and code sets. 
We conducted telephone surveys of the 51 Medicaid agency directors, HIPAA coordinators, 
and/or their staff between October 1 and October 31, 2002.  The 51 states included the 50 
states and the District of Columbia. 
We questioned the HIPAA officials about the level of readiness, as of October 2002, in four 
broad areas: 
T  assessment and awareness activities, for example, which programs and functions are 
being affected by the regulations; 
T  barriers that have impeded or are current obstacles to achieving compliance, 
T  compliance strategies, such as sequencing and testing plans that are being used for 
implementation in the Medicaid program; and 
T  contingency planning. 
The inspection was conducted in accordance with the Quality Standards for Inspections 
issued by the Presidents Council on Integrity and Efficiency. 
6
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  F I N D I N G S  
We conducted telephone interviews with officials from the 51 state Medicaid agencies (50 
states and the District of Columbia). While few similarities exist in the planning and strategies 
among the 51 Medicaid agencies, 42 programs (approximately 80 percent) anticipate that they 
will be in compliance by October 2003. Of the remaining nine programs, eight are developing 
contingency plans to allow them to conduct business with compliant and noncompliant trading 
partners,4 and the ninth expects to be minimally compliant by the deadline, with expectations 
that a new compliant system will be on line by March 2004. 
Approximately 80 percent of the state Medicaid agencies 
reported they will be in compliance with the HIPAA standards 
by October 2003 
Forty-two of 51 state Medicaid agencies reported that they will be fully compliant with the new 
electronic transaction standards, while nine reported that they probably will not be compliant by 
October 2003. Thirty-six of the 42 believe that they have adequate financial and technical 
resources to implement the standards. The remaining six states expect some funding cuts or 
budget and staff adjustments in their HIPAA plan. 
Six of the nine potentially noncompliant states expect to have enough technical and financial 
resources to become compliant at a later date.  However, three of the noncompliant states 
indicate that they need additional technical staff and financial resources to become compliant. 
Twenty-nine of the 51 states reported that they have developed specific contingency plans to 
continue services if their systems are not fully compatible with their trading partners, as of 
October 16, 2003.  This includes eight of the nine states expected to be noncompliant, whose 
contingency plans will allow them to handle critical compliant and noncompliant transactions, 
such as paying provider claims. The remaining 22 states have no formal specific contingency 
plan. 
4
Trading partners are external entities, such as managed care organizations, physicians, dentists, home-
maker services, nursing homes, and other Medicaid providers with whom the state agency does business. 
7
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  Planning and strategies vary widely among the 51 state 
Medicaid agencies 
State Medicaid program staff adopt compliance strategies and sequencing plans 
to meet their specific program needs 
The 51 states have electronic data interchange (EDI) systems that range from 30-years-old to 
new systems that currently are being installed. The HIPAA teams in each state conducted gap 
analyses to determine what changes in their current EDI systems would be most appropriate to 
implement the new transaction standards.  Twenty-nine states will use their existing EDI 
software along with an EDI translator to handle the new standard transactions.  Fifteen states 
have new EDI systems or plan to install new systems during the next several years. Seven 
states are using clearinghouses or making minimal modifications in their current EDI systems to 
meet the new standards, anticipating major system and regulatory changes beyond 2003. 
More than 75 percent (40) of the states are using a sequencing strategy, which is the process 
for logically implementing each of the eight transactions according to state specific needs. 
Fifteen of these states are prioritizing transactions related to provider payments. The remaining 
25 states have developed sequencing plans, based on system design, ease of making the 
electronic conversion, or volume of business in each transaction. Eleven states have no 
sequencing strategy. 
Eight of the nine potentially noncompliant state agencies have planned major systems 
renovations which include using translators and clearinghouses and/or replacing hardware and 
software. Only one of the noncompliant states plans a bare bones or minimal approach to 
compliance in 2003, anticipating a new compliant system in 2004. All nine of the states 
anticipate that they will be compliant in 2004. 
States have begun testing transaction standards 
As of November 2002, five states have implemented at least one of the eight new transaction 
standards and have begun testing with their trading partners.  Thirty-nine states have or are in 
the process of completing the development of their testing plans.  Additionally, 36 states 
anticipate conducting systems testing with their Medicare partners by April 2003. Although it 
was not one of the eight listed transactions, an additional four states are implementing the 
National Council for Prescription Drug Programs standard (NCPDP 5.1) for high volume drug 
dispenser transactions, which are specified under the HIPAA transaction standard for health 
care claims or equivalent encounters. 
8
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  Lack of financial resources and technical support are barriers 
to meeting the compliance deadline 
State Medicaid officials identified challenges with code set conversions, state 
funding, on-going standards modifications, and provider concerns as barriers to 
compliance 
For 24 states (3 of which expected to be noncompliant), the local code conversion effort is a 
major barrier to compliance.  States have as few as 75 to more than 10,000 local codes to 
convert, crosswalk, delete, or refine.  The conversion is particularly difficult because many state 
codes that are used for Medicaid services are beyond the scope of traditional medical services. 
For example, no code existed in the HCPCS or CPT-4 codes for homemaker services. Also, 
state officials expressed concerns over the long delays in getting timely responses for new code 
designations.  The delays affect implementation costs, schedules, and their ability to integrate 
the new codes into their systems in a timely manner. 
In 21 states, implementation plans may have to be altered during the next 12 months, due to 
budget cuts and state deficits. This includes six of the nine potentially noncompliant states 
where implementation costs and state budget problems are barriers to meeting the October 
2003, target. 
In 21 states, including four of the expected noncompliant state programs, officials said the 
federal regulatory environment is a barrier to compliance. They cited regulation delays, rule 
changes, and modifications to the standards that continued during planning, and the lack of 
consistent rule interpretations from staff among the regional CMS offices as causes for delays in 
planning system conversions.  They believe these barriers have added to the cost of 
implementation. 
Small and/or rural providers create some unique challenges for state Medicaid program 
compliance. In 18 states, smaller providers may revert to paper claims rather than incur the 
expense of converting to the HIPAA electronic transaction standards.  Small states are having 
difficulty reaching rural providers in remote communities to inform them of the HIPAA 
transaction standards. Also, most providers were aware of the HIPAA privacy regulation, 
but not the transaction standards. 
9
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  C O N C L U S I O N  
Overall, states are making progress in meeting the October 2003, deadline for implementing the 
HIPAA electronic transaction standards and code sets.  All 51 states expect to be ready to 
implement the transactions, which will enable them to pay claims for Medicaid beneficiaries. 
The nine states that anticipate not being fully compliant on October 16, 2003, will continue to 
transact business using compliant and noncompliant electronic data until their systems are ready. 
We will provide additional technical information, as appropriate, to CMS. 
10
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  A p p e n d i x  
Glossary of Electronic Transaction Standards Terminology 
Administrative Simplification:  the use of mandated standards for the electronic exchange of health 
care data and specific measures to protect the security and privacy of personally identifiable health care 
information. 
Business Associate: a person or organization that performs certain business functions on behalf of a 
covered entity. 
Clearinghouse: an entity that processes information received from one entity in a nonstandard format 
into a standard transaction, or receives a standard transaction and converts it to a nonstandard format 
for a receiving entity. 
Code Set: the tables of terms, medical concepts, diagnostic codes, or procedure codes and 
descriptions used to encode information in a transaction. 
Contingency Plan:  a plan developed by covered entities to provide an alternative for submitting or 
receiving HIPAA electronic transactions after October 2003, in the event that the covered entitys 
system conversion fails or is incomplete. 
Covered Entity: any health plan, health care clearinghouse, or a health care provider who transmits 
any health information in electronic form in connection with a transaction covered by the HIPAA 
standards. 
EDI Translator:  a software tool for accepting an EDI transmission and converting the data into 
another format, or for converting a non-EDI file into an EDI format for transmission. 
Electronic Data Interchange (EDI): any electronic exchange of formatted data. 
Gap Analysis: an evaluation of a covered entitys system to define the changes to be made, how the 
data will be managed, and what procedures will be implemented to enter and to verify information. 
Local Codes: a generic term for code values that are defined for a state or other political subdivision 
or specific payer. 
State Medicaid Agency: the state agency responsible for overseeing the states Medicaid program, 
defined as a covered entity under HIPAA. 
Small Health Plan:  under HIPAA, a health plan with annual receipts of $5 million or less. 
11
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  Sequencing: a process plan developed by a covered entity to implement each of the transaction 
standards in a logical sequence. 
Standard Transactions: the exchange of information between two parties that complies with the 
requirements established under HIPAA. 
Trading Partner:  an external entity, such as a customer, with whom the covered entity does business. 
A trading partner can be so designated for some purposes and considered a business associate for 
other purposes. 
Translator: See EDI translator. 
Vendor:  software and/or hardware entities that provide HIPAA compliant services, consulting, and/or 
products to covered entities. Vendors may be business associates or trading partners. 
12
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420  A C K N O W L E D G M E N T S  
This report was prepared under the direction of Paul A. Gottlober, Regional Inspector General 
for Evaluation and Inspections, and Deborah Harvey, Assistant Regional Inspector General for 
Evaluation and Inspections in San Francisco.  Other principal Office of Evaluation and 
Inspections staff who contributed include: 
Timothy Brady, Project Leader
 Linda Frisch, Program Specialist 
Silvia Chin, Program Analyst
 Stephanie London, Program Specialist 
Rob Gibbons, Program Analyst

Cindy Lemesh, Program Analyst

Thomas A. Purvis, Program Analyst

Cheryl Dotts, Program Assistant

For information or copies of this report, please contact

the Office of Inspector Generals

Public Affairs office at (202) 619-1343.

Reports are also available on the World Wide Web at our home page address:

http://www.oig.hhs.gov/ 
13
HIPAA Readiness: Administrative Simplification   OEI-09-02-00420