Department of Health and Human Services 
OFFICE OF 
INSPECTOR GENERAL 
HIPAA R : 
EADINESS
A S
DMINISTRATIVE  IMPLIFICATION 
M P A P
FOR  EDICARE  ART  ROVIDERS 
JANET REHNQUIST 
Inspector General 
MAY 2003 
OEI-09-02-00421  Office of Inspector General

http://oig.hhs.gov 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services (HHS) 
programs, as well as the health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, investigations, and 
inspections conducted by the following operating components: 
Office of Audit Services 
The OIG's Office of Audit Services (OAS) provides all auditing services for HHS, either by 
conducting audits with its own audit resources or by overseeing audit work done by others. 
Audits examine the performance of HHS programs and/or its grantees and contractors in 
carrying out their respective responsibilities and are intended to provide independent 
assessments of HHS programs and operations in order to reduce waste, abuse, and 
mismanagement and to promote economy and efficiency throughout the department. 
Office of Evaluation and Inspections 
The OIG's Office of Evaluation and Inspections (OEI) conducts short-term management and 
program evaluations (called inspections) that focus on issues of concern to the department, the 
Congress, and the public.  The findings and recommendations contained in the inspections 
reports generate rapid, accurate, and up-to-date information on the efficiency, vulnerability, and 
effectiveness of departmental programs. 
Office of Investigations 
The OIG's Office of Investigations (OI) conducts criminal, civil, and administrative 
investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 
unjust enrichment by providers.  The investigative efforts of OI lead to criminal convictions, 
administrative sanctions, or civil monetary penalties.  The OI also oversees state Medicaid fraud 
control units, which investigate and prosecute fraud and patient abuse in the Medicaid program. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, 
rendering advice and opinions on HHS programs and operations and providing all legal support 
in OIG's internal operations.  The OCIG imposes program exclusions and civil monetary 
penalties on health care providers and litigates those actions within the department. The OCIG 
also represents OIG in the global settlement of cases arising under the Civil False Claims Ac t, 
develops and monitors corporate integrity agreements, develops model compliance plans, 
renders advisory opinions on OIG sanctions to the health care community, and issues fraud 
alerts and other industry guidance.  E X E C U T I V E   S U M M A R Y  
OBJECTIVE 
To determine if Medicare Part A providers expect to comply with the electronic data 
transaction standards and code sets mandated by the Health Insurance Portability and 
Accountability Act (HIPAA) by October 2003. 
BACKGROUND 
The purpose of Title II of HIPAA is to improve the efficiency of the health care system by 
establishing standards to facilitate the electronic transmission of data between providers and 
payers.  Electronic data interchange can eliminate the inefficiencies associated with handling 
paper documents. It reduces administrative costs and improves overall data quality for 
transactions, such as health care payments and coordination of benefits.1 
In accordance with the provisions of Title II of HIPAA, the Secretary of Health and Human 
Services has promulgated regulations mandating the use of specific standards for eight different 
types of electronic transactions and medical code sets. Covered entities that filed an extension 
must implement the standards by October 16, 2003. 
This report is based on the results of a mail survey of a stratified random sample of Medicare 
Part A providers that submitted claims to Medicare fiscal intermediaries between July 1, 2001 
and June 30, 2002. 
FINDINGS 
Ninety-six percent of Medicare Part A providers have moderate to high 
expectations that they will be compliant with HIPAA standards by October 2003 
Medicare Part A providers are making significant progress in meeting the HIPAA deadline. 
Ninety-two percent of Medicare Part A providers are developing an implementation schedule 
to meet the deadline, while approximately one-half are developing sequencing strategies and 
contingency plans in the event their system is not 
1
65 FR 50312 (August 17, 2000). 
1
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  fully in compliance by the deadline. Approximately 84 percent are using systems vendors as 
part of their compliance strategy.  Only 18 percent have conducted a cost/benefit analysis for 
implementing the electronic standards and code sets. 
External barriers may affect compliance 
Approximately one-third of the providers who listed potential barriers to compliance were 
concerned that their trading partners could affect their ability to meet the compliance deadline. 
CONCLUSION 
Overall, the Medicare Part A providers are making steady progress toward meeting the 
compliance target of October 16, 2003, for implementing the HIPAA electronic transaction 
standards and code sets.  Providers are, however, concerned that their trading partners may 
not be fully compliant, and this would affect their own ability to implement the electronic 
standards. 
2
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  T A B L E   O F   C O N T E N T S  
PAGE

EXECUTIVE SUMMARY ...................................................... 1

INTRODUCTION ............................................................. 4

FINDINGS  .................................................................. 8

Anticipated compliance  ....................................................8

External barriers .......................................................... 9

CONCLUSION  ............................................................. 11

APPENDIX A: HIPAA-related terms and acronyms .................................  12

APPENDIX B:  Confidence intervals for statistics in report  ............................  13

ACKNOWLEDGMENTS ..................................................... 16

3
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  I N T R O D U C T I O N  
OBJECTIVE 
To determine if Medicare Part A providers expect to comply with the electronic data 
transaction standards and code sets mandated by the Health Insurance Portability and 
Accountability Act (HIPAA) by October 2003. 
BACKGROUND 
Congress instituted significant reforms to the health care industry with the passage of HIPAA. 
Title I of HIPAA assures the availability and portability of health care insurance coverage, while 
Title II creates a regulatory framework to improve the efficiency of the health care system by 
establishing standards that will facilitate the electronic transmission of data between providers 
and payers.  (See Appendix A for a glossary of HIPAA-related terms and acronyms.)  The 
goal is to create a seamless transfer of data with limited manual intervention. 
Administrative Simplification 
Under Title II, Subtitle F (Administrative Simplification), the Secretary of Health and Human 
Services has the authority to: (1) mandate the use of standards for the electronic exchange of 
health care data; (2) specify what medical and administrative code sets should be used; (3) 
require the use of national identification systems; and (4) specify the types of measures required 
to protect the security and privacy of personally identified health care information. 
Electronic Transactions and Code Sets 
Electronic data interchange (EDI) is the electronic transfer of information in a standard format 
between trading partners. Compared to paper transactions, EDI substantially reduces handling 
and processing time by reducing the administrative burden, lowering operating costs, and 
improving overall data quality.2 
2
65 FR 50312 (August 17, 2000). 
4
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  Transactions are the exchange of information between two parties to carry out financial or

administrative activities related to health care.  The standards for electronic transmission of each

of the transactions are codified in the Code of Federal Regulations

(45 CFR Parts 160 and 162).  The rule provides standards for eight types of electronic

transactions: 

<  1.  Health care claims or equivalent encounter information,

<  2.  Health care payments and remittance advice,

<  3.  Coordination of benefits,

<  4.  Health care claim status,

<  5.  Enrollment and disenrollment in a health plan,

<  6.  Eligibility for a health plan,

<  7.  Health plan premium payments, and

<  8.  Referral certification and authorization.

The rule also contains requirements concerning the use of standardized code sets, such as 
tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes used 
to encode data elements in the transaction.  The code set includes the codes and their 
descriptors.3 The following code sets have been adopted: 
<	 International Classification of Diseases-9-Clinical Modifications (ICD-9-CM), volumes 
1, 2, and 3; 
<	 Combination of Health Care Financing Administration Common Procedure Coding 
System (HCPCS) and Current Procedural Terminology-4 (CPT-4) for physicians and 
other health services; 
<  HCPCS for all other items;

<  National Drug Codes (NDC) or HCPCS for prescription drugs; and

<  Common Treatment for Dentists-2 (CTD-2) for dental services.

Covered entities, defined as providers, clearinghouses, and health plans that use the electronic 
exchange of health information as part of their business, will be required to adopt these 
standards. The compliance date for this rule (45 CFR Parts 160 and 162) was originally 
October 16, 2002.  The Administrative Simplification Compliance Act, signed into law on 
December 27, 2001, extends the compliance date by 1 year to October 16, 2003. The 
extension applies only to those covered entities that filed an extension with the Centers for 
Medicare & Medicaid Services (CMS) by October 16, 2002. For these entities, October 
2003 is the compliance date.  Since the implementation date is several months away, CMS has 
not yet developed standards to measure compliance. 
3
45 CFR  160.1002 
5
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  METHODOLOGY 
This is one of a series of HIPAA readiness surveys.  We used a mail survey as the primary tool 
to conduct this evaluation. We mailed surveys during the week of November 4, 2002, and 
received responses between November 26, 2002, and 
March 24, 2003. 
We surveyed a stratified random sample of Medicare Part A providers who submitted claims to 
Medicare fiscal intermediaries between July 1, 2001, and June 30, 2002.  Stratification allowed 
us to test for differences in compliance strategies, contingencies, and barriers among providers, 
based on the number of claims they submitted to Medicare.  We divided the providers into 
three strata: 
Number of  Size of  Sample  Number of 
Stratum 
Claims  Population  Size  responses 
1 to 1,500 
1  36,746  50  50 
claims 
1,501 to 17,500 
7,048  50  50 
2  claims 
more than 
2,315  50  50 
3  17,500 claims 
TOTAL  46,109  150  150 
We randomly ordered the population of providers within each stratum. We then selected the 
first 50 providers in each stratum that were covered by HIPAA, were still in business, and were 
not under investigation by the Office of Inspector Generals Office of Investigations. Our 
response rate was 100 percent. Of the 150 providers, approximately 57 percent are hospitals, 
16 percent are skilled nursing facilities, 15 percent are home health agencies and hospices, and 
12 percent are outpatient facilities, including rural and community health clinics.  Surveys were 
completed by administrators, financial officers, compliance officers, and clinic managers.  We 
weighted the responses according to each stratums representation in the population. 
We surveyed the providers about their level of readiness in four broad areas: 
1.  Assessment and awareness activities; 
2.  Impediments or current obstacles to achieving compliance; 
3.  Compliance strategies, such as sequencing and testing plans; and 
4.  Contingency planning. 
6
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  We did not independently verify the accuracy of the responses. 
The inspection was conducted in accordance with the Quality Standards for Inspections issued 
by the Presidents Council on Integrity and Efficiency. 
7
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  F I N D I N G S  
We conducted a mail survey of a stratified random sample of Medicare Part A providers. 
Overall, the Medicare Part A providers are making progress toward meeting the compliance 
target of October 16, 2003, for implementing the HIPAA electronic transaction standards and 
code sets, and 96 percent expect to be in compliance by the deadline. 
Ninety-six percent of Medicare Part A providers have 
moderate to high expectations that they will be compliant with 
HIPAA standards by October 2003 
Almost all Medicare Part A providers submitted a compliance extension form. As a result, they 
have until October 16, 2003, to implement the electronic standards and code sets. As of the 
time of our survey, 74 percent of the providers were ready to implement the HIPAA electronic 
standards, and 96 percent indicated that they had a moderate to high level of satisfaction that 
they expected to meet the October deadline. 
Providers who did not believe they would meet the compliance deadline (approximately 
4 percent of all providers), indicated they were in the process of identifying the steps necessary 
to implement the standards. At the time of the survey, they were receiving information from 
their professional associations to assist them in developing implementation strategies. 
Providers have developed internal and external testing strategies 
While fewer than 30 percent of the providers had begun any testing, 90 percent will have a

testing strategy. Most of their testing strategies include internal and external data interfaces. 

Approximately one-fourth had begun to test transactions, as of 

November 2002.  However, slightly more than 44 percent had received any notices from fiscal

intermediaries or carriers regarding coordination of electronic transaction testing. 

Providers are developing implementation strategies to achieve compliance 
When asked which strategy the provider was using to implement the HIPAA standards, 
providers most frequently selected the following four: 
1. We will have internal staff plan, develop, and implement the standards. 
2. We will have technical systems consultants work with staff and assist us in the process. 
8
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  3. We will have a technical systems consultant or vendor take full responsibility for 
planning, developing, and implementing the new standards. 
4. We will purchase components of a new system or additions to our current system from 
a selected vendor to meet the standards. 
Ninety-two percent of the providers are developing an implementation schedule to meet the 
deadline.  Sixty-four percent indicated they have purchased or will be purchasing new software, 
hardware, systems components, or a combination thereof. Approximately 56 percent of 
providers are developing a sequencing strategy which will prioritize transactions by order and 
date. 
Providers are using expert resources outside their organization to help implement the HIPAA 
standards and code sets. Eighty-one percent stated that they had turned to their professional 
associations for information to assist them in developing implementation strategies. 
Approximately 84 percent of all providers are using systems vendors as part of their 
compliance strategy. 
Although more than 60 percent of the providers are purchasing new software or system 
components to meet the HIPAA standards, fewer than 20 percent have conducted any type of 
cost benefit analysis for implementing the electronic standards and code sets. 
As part of our assessment, we reviewed the responses from seven questions regarding 
implementation strategies among the survey strata. We found no statistical differences in the 
strategies with the exception of the use of clearinghouses to process some or all of the provider 
claims.  Use of a clearinghouse varies by strata, with 49 percent of stratum 1 providers using a 
clearinghouse, 63 percent of stratum 2 providers using a clearinghouse, and 96 percent of 
stratum 3 providers using a clearinghouse. 
Although 96 percent of the providers expect to meet the compliance deadline, 56 percent are 
developing contingency plans in the event their system is not fully compliant by October 2003. 
We found no statistical difference between the strata regarding their development of 
contingency plans. 
External barriers may affect compliance 
When asked to list as many as three barriers to compliance, 60 percent of the providers listed 
one or more.  The most common were: 
<  Trading partners will not be ready. 

<  Vendors will not be ready.

<  We have inadequate staffing, training, and technical resources.

9
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  <  We need more time to implement and may experience testing delays. 
Approximately one-third of those who listed any barriers identified their trading partners 
(specifically third party payers, fiscal intermediaries, carriers, and/or CMS) as potential barriers 
to compliance. 
Providers who did not believe they would meet the compliance deadline expressed similar 
concerns.  They cited their trading partners as a potential barrier, as well as inadequate 
resources. 
10
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  C O N C L U S I O N  
Overall, the Medicare Part A providers are making progress toward meeting the compliance 
target of October 16, 2003, for implementing the HIPAA electronic transaction standards and 
code sets.  Providers are, however, concerned that their trading partners may not be fully 
compliant, and this would affect their own ability to implement the electronic standards. 
11
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  A P P E N D I X  A 
Glossary of Selected HIPAA-related Terms and Acronyms 
Administrative Simplification:  the use of mandated standards for the electronic exchange of health 
care data and specific measures to protect the security and privacy of personally identifiable health care 
information. 
Clearinghouse:  an entity that processes information received from one entity in a nonstandard format 
into a standard transaction, or receives a standard transaction and converts it to a nonstandard format for 
a receiving entity. 
Code Set:  the tables of terms, medical concepts, diagnostic codes, or procedure codes and descriptions 
used to encode information in a transaction. 
Contingency Plan:  a plan developed by covered entities to provide an alternative for submitting or 
receiving HIPAA electronic transactions after October 2003, in the event that the covered entitys system 
conversion fails or is incomplete. 
Covered Entity:  any health plan, health care clearinghouse, or a health care provider who transmits any 
health information in electronic form in connection with a transaction covered by the HIPAA standards. 
Electronic Data Interchange (EDI):  any electronic exchange of formatted data. 
EDI Translator:  a software tool for accepting an EDI transmission and converting the data into another 
format, or for converting a non-EDI file into an EDI format for transmission. 
Medicare Part A Provider:  hospital, critical access hospital, skilled nursing facility, comprehensive 
outpatient rehabilitation facility, home health agency, or hospice. 
Sequencing:  a process plan developed by a covered entity to implement each of the transaction 
standards in a logical sequence. 
Standard Transactions:  the exchange of information between two parties that complies with the 
requirements established under HIPAA. 
Trading Partner:  an external entity, such as a customer, with whom the covered entity does business. 
A trading partner can be so designated for some purposes and considered a business associate for other 
purposes. 
Translator:  See EDI translator. 
Vendor:  software and/or hardware entities that provide HIPAA compliant services, consulting, and/or 
products to covered entities.  Vendors may be business associates or trading partners. 
12
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  A P P E N D I X  B 
Confidence Intervals for Key Survey Questions 
The following tables show the point estimates and 95 percent confidence intervals for selected statistics. 
Compliance/ Testing 
Point  95 Percent 
Survey Question  Response 
Estimate  Confidence Interval 
Has your organization submitted a  All respondents who 
compliance extension form under the  answered yes 
96.5%  92.1% - 100.0% 
Administrative Simplification 
Compliance Act? 
How ready do you believe your  All respondents who 
organization is, at this point, to  answered "5," 4," or 3" on 
73.8%  63.8% - 83.7% 
implement the HIPAA electronic  a 1 to 5 (for levels of 
transaction standards?  satisfaction) 
How confident are you that your  All respondents who 
organization will meet the October 2003,  answered "5," 4," or 3" on 
96.1%  91.7% - 100.0% 
target for implementing the electronic  a 1 to 5 (for levels of 
transactions?  satisfaction) 
Has the organization begun any testing  All respondents who 
of its applications of the HIPAA  answered "yes"  27.5%  17.3% - 37.7% 
electronic transactions? 
Does your organization have an overall  All respondents who 
strategy for testing its HIPAA  answered completed,  89.5%  82.2% - 96.8% 
compliant data systems?  underway, or plan to 
Does the testing strategy include  All respondents who 
internal and external data interfaces?  answered completed. 
84.3%  75.6% - 92.9% 
underway, or plan to 
Has your organization received any  All respondents who 
notices from the fiscal intermediaries or  answered "yes" 
carriers regarding coordination of  44.2%  32.7% - 55.7% 
testing of HIPAA electronic 
transactions? 
13
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  Strategies/Contingency Planning 
Point  95 Percent 
Survey Question  Response 
Estimate  Confidence Interval 
Is your organization currently using  All respondents who 
clearinghouse(s) or other organizations to  answered "yes" 
53.6%  42.1% - 65.0% 
process any part of its HIPAA electronic 
transactions? 
Is your organization currently working  All respondents who 
with a systems vendor(s) to implement the  answered "completed,  84.0%  75.4% -92.7% 
HIPAA electronic standards?  underway, or plan to 
Has your organization used its  All respondents who 
professional association(s) for information  answered "completed, 
81.2%  72.0% - 90.4% 
to assist you in developing a transaction  underway, or plan to 
compliance strategy? 
Has your organization created a schedule  All respondents who 
to implement the changes in its data  answered "completed,  86.2% - 98.5% 
92.4% 
system to comply with the HIPAA  underway, or plan to 
electronic transaction standards deadline? 
Has your organization purchased new  All respondents who 
software, hardware, or system  answered "completed, 
64.0%  53.0% - 75.1% 
component(s) to meet transaction  underway, or plan to 
compliance requirements 
Have you, your contracted vendor(s), or  All respondents who 
any consultants conducted a cost/benefit  answered yes 
18.0%  7.8% - 28.2% 
analysis for implementing the HIPAA 
electronic transaction standards? 
Has your organization developed a  All respondents who 
contingency plan in the event its system is  answered "completed, 
55.9%  44.4% - 67.3% 
not compliant by October 2003?  underway, or plan to 
Barriers 
Point  95 Percent 
Survey Question  Response 
Estimate  Confidence Interval 
How satisfied are you with the resources  All respondents who 
your organization is committing to meet  answered "5," 4," or 3" on 
96.8%  93.4% - 100.0% 
the HIPAA electronic transaction  a 1 to 5 (for levels of 
standards?  satisfaction) 
14
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  We compared responses among the three strata of providers, stratum1 (less than 

1,500 claims), stratum 2 (1,501 to 17,500 claims) and stratum 3 (more than 17,500 claims) for

the 7 following questions, which we thought might show significant differences among strata. 

Only the first question is statistically significant at the

95 percent confidence level. Using the Bonferroni method for multiple comparisons, a

comparison was statistically significant if the p-value was less than 0.05 divided by 7 or

approximately 0.007.

Compliance/ Testing 
Chi-Square Test 
Point 
Survey Question  Measurement  Degrees of 
Estimate  P-value 
Freedom 
How confident are you that your  All respondents who 
96.0 stratum 1 
organization will meet the October  answered 5," 4," or 
96.0 stratum 2 
2003, target for implementing the  3" on a 1 to 5 (for  2  0.774 
98.0 stratum 3 
electronic transactions?  levels of satisfaction) 
All respondents who  28.0 stratum 1 
Has your organization begun any 
answered completed,  26.0 stratum 2 
testing of its applications of HIPPA  2  0.902 
underway, or plan  24.0 stratum 3 
electronic transactions? 
to 
Strategies/Contingency planning 
Chi-Square Test 
Point 
Survey Question  Measurement  Degrees of 
Estimate  P-value 
Freedom 
Is your organization currently using  All respondents who  49.0 stratum 1 
clearinghouse(s) or other  answered "yes"  63.5 stratum 2 
2  <.001 
organizations to process any part of its  96.0 stratum 3 
HIPAA electronic transactions? 
Has your organization identified the  All respondents who  94.0 stratum 1 
steps necessary to implement the  answered "yes"  98.0 stratum 2 
2  0.132 
HIPAA electronic standards?  100.0 stratum 3 
Does your organization have an  All respondents who  84.0 stratum 1 
ongoing analysis process to identify  answered completed,  90.0 stratum 2 
2  0.021 
potential gaps in its existing system?  underway, or plan  98.0 stratum 3 
to 
Does your organization have a  All respondents who  55.3 stratum1 
sequencing (prioritization) strategy for  answered "yes"  51.1 stratum 2 
implementing the HIPAA electronic  75.0 stratum 3  2  0.028 
transactions? 
Has your organization developed a  All respondents who 
contingency plan in the event the  answered completed,  53.1 stratum 1 
system is not compliant by October  underway, or plan  62.5 stratum 2  2  0.011 
2003?  to  80.0 stratum 3 
15
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421  A C K N O W L E D G M E N T S  
This report was prepared under the direction of Paul A. Gottlober, Regional Inspector General 
for Evaluation and Inspections, and Deborah W. Harvey, Assistant Regional Inspector General 
for Evaluation and Inspections, in San Francisco.  Other principal Office of Evaluation and 
Inspections staff who contributed include: 
Timothy Brady, Project Leader  Linda Frisch, Program Specialist

Silvia Chin, Program Analyst

Robert Gibbons, Program Analyst

Cheryl Dotts, Program Assistant

For information or copies of this report, please contact

the Office of Inspector Generals

Public Affairs office at (202) 619-1343.

Reports are also available on the World Wide Web at our home page address:

http://www.oig.hhs.gov/ 
16
HIPAA Readiness: Medicare Part A Providers   OEI-09-02-00421