Department of Health and Human Services 
OFFICE OF 
INSPECTOR GENERAL 
HIPAA R : 
EADINESS
A S
DMINISTRATIVE  IMPLIFICATION 
T M P
FOR  ERRITORIES WITH  EDICAID  ROGRAMS 
JANET REHNQUIST 
Inspector General 
March 2003 
OEI-09-02-00423  Office of Inspector General

http://oig.hhs.gov 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services (HHS) 
programs, as well as the health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit Services 
The OIG's Office of Audit Services (OAS) provides all auditing services for HHS, either by 
conducting audits with its own audit resources or by overseeing audit work done by others. 
Audits examine the performance of HHS programs and/or its grantees and contractors in 
carrying out their respective responsibilities and are intended to provide independent 
assessments of HHS programs and operations in order to reduce waste, abuse, and 
mismanagement and to promote economy and efficiency throughout the department. 
Office of Evaluation and Inspections 
The OIG's Office of Evaluation and Inspections (OEI) conducts short-term management and 
program evaluations (called inspections) that focus on issues of concern to the department, the 
Congress, and the public.  The findings and recommendations contained in the inspections 
reports generate rapid, accurate, and up-to-date information on the efficiency, vulnerability, and 
effectiveness of departmental programs. 
Office of Investigations 
The OIG's Office of Investigations (OI) conducts criminal, civil, and administrative 
investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 
unjust enrichment by providers.  The investigative efforts of OI lead to criminal convictions, 
administrative sanctions, or civil monetary penalties.  The OI also oversees state Medicaid fraud 
control units, which investigate and prosecute fraud and patient abuse in the Medicaid program. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, 
rendering advice and opinions on HHS programs and operations and providing all legal support 
in OIG's internal operations.  The OCIG imposes program exclusions and civil monetary 
penalties on health care providers and litigates those actions within the department. The OCIG 
also represents OIG in the global settlement of cases arising under the Civil False Claims Act, 
develops and monitors corporate integrity agreements, develops model compliance plans, 
renders advisory opinions on OIG sanctions to the health care community, and issues fraud 
alerts and other industry guidance.  E X E C U T I V E   S U M M A R Y  
OBJECTIVE 
To determine if United States territories with Medicaid programs expect to comply with the 
electronic data transaction standards and code sets under the Health Insurance Portability and 
Accountability Act (HIPAA) by October 2003. 
BACKGROUND 
The purpose of Title II of HIPAA is to improve the efficiency of the health care system by 
establishing standards to facilitate the electronic transmission of data between providers and 
payers. Electronic data interchange (EDI) can eliminate the inefficiencies associated with 
handling paper documents. It can reduce administrative costs and improves overall data quality 
for transactions, such as health care payments and coordination of benefits.1 
In accordance with the provisions of Title II of HIPAA, the Secretary of Health and Human 
Services has promulgated regulations mandating the use of specific standards for eight different 
types of electronic transactions and medical code sets.  According to the regulations, Medicaid 
agencies and other covered entities that filed an extension must implement the standards by 
October 16, 2003. 
FINDINGS 
We conducted telephone interviews with officials from the five territories with Medicaid 
programs.  Four of the five territories report that they will not be fully compliant with the 
electronic transaction standards and code sets, and they will not meet the October 2003, 
implementation date. The most significant barriers for the territories are the lack of financial and 
technical resources. Since the territories federal Medicaid funds are capped, they were 
ineligible for additional federal financial participation funds to implement the electronic 
transaction standards. 
Territories have not developed compliance strategies 
None of the territories has developed a compliance strategy. Territories have considered 
1
65 F.R. 50312 (August 17, 2000). 
1
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  alternatives but have not moved forward with implementation plans, due to the lack of funding 
to convert to the electronic transaction standards and code sets. 
Because they lack the funds, territories have not developed sequence planning 
and testing protocols 
Neither the federal government nor the territorial governments have allocated funds for 
compliance. Therefore, the territories lack the funding to acquire the technical resources 
needed to develop their implementation strategies. 
CONCLUSION 
One territory may be in compliance if its legislature allocates funds designated to implement the 
HIPAA transaction standards and code sets. According to territory officials, limited funding 
and the lack of technical resources will prevent the remaining four territories from meeting any 
of the transaction standards by October 2003. 
2
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  T A B L E   O F   C O N T E N T S  
PAGE

EXECUTIVE SUMMARY ...................................................... 1

INTRODUCTION ............................................................. 4

METHODOLOGY  ............................................................ 6

FINDINGS  .................................................................. 7

Compliance strategies............................................................ 7

Sequence planning and testing protocols  ..............................................7

CONCLUSION  .............................................................. 8

APPENDIX: HIPAA Electronic Transaction Standards Glossary.......................... 9

ACKNOWLEDGMENTS ..................................................... 11

3
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  I N T R O D U C T I O N  
OBJECTIVE 
To determine if United States territories with Medicaid programs expect to comply with the 
electronic data transaction standards and code sets under the Health Insurance Portability and 
Accountability Act ( HIPAA) by October 2003. 
BACKGROUND 
Congress instituted significant reforms to the health care industry with the passage of HIPAA. 
Title I of HIPAA assures the availability and portability of health care insurance coverage, while 
Title II creates a regulatory framework focused on improving the efficiency of the health care 
system by establishing standards to facilitate the electronic transmission of data between 
providers and payers.  The goal is to create a seamless transfer of data with limited manual 
intervention. 
Administrative Simplification 
Under Title II, Subtitle F (Administrative Simplification), the Secretary of Health and Human 
Services has the authority to: (1) mandate the use of standards for the electronic exchange of 
health care data; (2) specify what medical and administrative code sets should be used, (3) 
require the use of national identification systems, and (4) specify the types of measures required 
to protect the security and privacy of personally identified health care information. 
Electronic Transactions and Code Sets 
Electronic data interchange (EDI) is the electronic transfer of information in a standard format 
between trading partners.2 The EDI substantially reduces the handling and processing time 
compared to paper transactions.  The EDI can eliminate the inefficiencies of handling paper 
documents by reducing the administrative burden, lowering operating costs, and improving 
overall data quality.3 
2
Trading partners are external entities, such as hospitals, physicians, dentists, nursing homes, and other 
Medicaid providers with whom the Medicaid agency does business. 
3
65 F.R. 50312 (August 17, 2000). 
4
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  Transactions are the exchange of information between two parties to carry out financial or 
administrative activities related to health care.  The standards for electronic transmission of each 
of the transactions are codified in the Code of Federal Regulations (45 CFR Parts 160 and 
162). The rule provides standards for eight types of electronic transactions: 
<  health care claims or equivalent encounter information, 

<  health care payments and remittance advice, 

<  coordination of benefits, 

<  health care claim status, 

<  enrollment and disenrollment in a health plan, 

<  eligibility for a health plan, 

<  health plan premium payments, and 

<  referral certification and authorization.

The rule also contains requirements concerning the use of standardized code sets, such as

tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes used

to encode data elements in the transaction. The code set includes the codes and the descriptors

of the codes.4 The following code sets have been adopted:

<	 International Classification of Diseases-9-Clinical Modifications (ICD-9-CM), volumes 
1, 2, and 3, 
<	 Combination of Health Care Financing Administration Common Procedure Coding 
System (HCPCS) and Current Procedural Terminology-4 (CPT- 4), for physicians and 
other health services, 
<  HCPCS for all other items,

<  National Drug Codes (NDC) or HCPCS for prescription drugs, and

<  Common Treatment for Dentists-2 (CTD-2) for dental services.

Covered entities, defined as providers, clearinghouses, and health plans that use the electronic

exchange of health information as part of their business, will be required to adopt these

standards. Medicaid agencies are defined as health plans under Title II. The compliance date

for this rule (45 CFR Parts 160 and 162) was originally October 16, 2002. The Administrative

Simplification Compliance Act, signed into law on December 27, 2001, extends the compliance

date by one year to October 16, 2003. The extension applies only to those covered entities

that filed an extension with the Centers for Medicare & Medicaid Services (CMS) by October

16, 2002. According to CMS officials, all five territories with Medicaid programs have filed

extensions. Therefore, October 2003, is the effective compliance date for the territories. 

Because the implementation date is several months away, standards have not yet been

developed to measure compliance.

4
45 CFR 160.1002 
5
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  METHODOLOGY 
This is one of several inspections that the OIG is conducting to determine the expected level of 
readiness for compliance by October 2003. After receiving input from CMS officials in the 
Centers for Medicaid and State Operations (CMSO), we developed a standardized telephone 
questionnaire to gather information from the Medicaid program officials responsible for 
implementing HIPAA electronic transactions and code sets. 
We conducted telephone surveys of the Medicaid directors for the five territories, HIPAA 
coordinators, and/or their staff between October 1 and October 31, 2002. 
We questioned the officials about the level of readiness in four broad areas: 
T  assessment and awareness activities, for example, which programs and functions are 
being affected by the regulations; 
T  barriers that have impeded or are current obstacles to achieving compliance; 
T  compliance strategies, such as sequencing and testing plans that are being used for 
implementation in the Medicaid program; and 
T  contingency planning. 
The inspection was conducted in accordance with the Quality Standards for Inspections 
issued by the Presidents Council on Integrity and Efficiency. 
6
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  F I N D I N G S  
We conducted telephone interviews with officials from the five territories with Medicaid 
programs.  Four of the five territories report that they will not be in compliance with the 
electronic transaction standards and code sets, and they will not meet the October 2003, 
implementation date. The most significant barriers for the territories are the lack of financial and 
technical resources. Since the territories federal Medicaid funds are capped, they were 
ineligible for additional federal financial participation funds to implement the electronic 
transaction standards. 
Territories have not developed compliance strategies 
None of the five territories have developed a compliance strategy.  One territory is considering 
a contract with a clearinghouse until it can make major conversions in its territorial data 
processing system.  Another territory is considering a translator or a clearinghouse, depending 
on the availability of funds. One territorial official stated that the territories could easily 
implement the transaction standards and code sets using a personal computer program, if CMS 
would develop it. Only one of the territories anticipates that it will be able to coordinate 
payments with a compliant Medicare system for crossover beneficiaries by the October 2003, 
deadline. 
Because they lack the funds, territories have not developed 
sequence planning and testing protocols 
Neither the Federal Government nor the territorial governments have allocated funds for 
compliance.  Four of the five territories entire Medicaid budget is less than $15 million and the 
federal match is capped for each of them.  Therefore, the territories lack the funding to acquire 
the technical resources needed to develop their implementation strategies. One territorial 
official has considered a basic sequencing strategy that would start with the easiest transaction, 
coordination of benefits. However, none of the territories has developed any type of 
sequencing plan.  Furthermore, none of the territories has developed testing plans or 
contingency plans, since they do not have resources to guide the implementation process. One 
territorial official said the contingency plan was to continue doing business as usual with 
compliant and noncompliant trading partners. 
7
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  C O N C L U S I O N  
One territory may be in compliance if its legislature allocates funds designated to implement the 
HIPAA transaction standards and code sets. According to territory officials, limited funding 
and the lack of technical resources will prevent the remaining four territories from meeting any 
of the transaction standards by October 2003. 
We will provide additional technical information, as appropriate, to CMS. 
8
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  A p p e n d i x  
Glossary of Electronic Transaction Standards Terminology 
Administrative Simplification:  the use of mandated standards for the electronic exchange of health 
care data and specific measures to protect the security and privacy of personally identifiable health care 
information. 
Business Associate: a person or organization that performs certain business functions on behalf of a 
covered entity. 
Clearinghouse: an entity that processes information received from one entity in a nonstandard format 
into a standard transaction, or receives a standard transaction and converts it to a nonstandard format 
for a receiving entity. 
Code Set: the tables of terms, medical concepts, diagnostic codes, or procedure codes and 
descriptions used to encode information in a transaction. 
Contingency Plan:  a plan developed by covered entities to provide an alternative for submitting or 
receiving HIPAA electronic transactions after October 2003, in the event that the covered entitys 
system conversion fails or is incomplete. 
Covered Entity: any health plan, health care clearinghouse, or a health care provider who transmits 
any health information in electronic form in connection with a transaction covered by the HIPAA 
standards. 
EDI Translator:  a software tool for accepting an EDI transmission and converting the data into 
another format, or for converting a non-EDI file into an EDI format for transmission. 
Electronic Data Interchange (EDI): any electronic exchange of formatted data. 
Gap Analysis: an evaluation of a covered entitys system to define the changes to be made, how the 
data will be managed, and what procedures will be implemented to enter and to verify information. 
Local Codes: a generic term for code values that are defined for a state or other political subdivision 
or specific payer. 
Medicaid State Agency: the state agency responsible for overseeing the states Medicaid program, 
defined as a covered entity under HIPAA. 
Small Health Plan:  under HIPAA, a health plan with annual receipts of $5 million or less. 
9
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  Sequencing: a process plan developed by a covered entity to implement each of the transaction 
standards in a logical sequence. 
Standard Transactions: the exchange of information between two parties that complies with the 
requirements established under HIPAA. 
Trading Partner:  an external entity, such as a customer, with whom the covered entity does business. 
A trading partner can be so designated for some purposes and considered a business associate for 
other purposes. 
Translator: See EDI translator. 
Vendor:  software and/or hardware entities that provide HIPAA compliant services, consulting, and/or 
products to covered entities. Vendors may be business associates or trading partners. 
10
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423  A C K N O W L E D G M E N T S  
This report was prepared under the direction of Paul A. Gottlober, Regional Inspector General 
for Evaluation and Inspections, and Deborah Harvey, Assistant Regional Inspector General for 
Evaluation and Inspections in San Francisco.  Other principal Office of Evaluation and 
Inspections staff who contributed include: 
Timothy Brady, Project Leader
 Linda Frisch, Program Specialist 
Silvia Chin, Program Analyst
 Stephanie London, Program Specialist 
Rob Gibbons, Program Analyst

Cindy Lemesh, Program Analyst

Thomas A. Purvis, Program Analyst

Cheryl Dotts, Program Assistant

For information or copies of this report, please contact

the Office of Inspector Generals

Public Affairs office at (202) 619-1343.

Reports are also available on the World Wide Web at our home page address:

http://www.oig.hhs.gov/ 
11
HIPAA Readiness: Administrative Simplification   OEI-09-02-00423