September 8, 2000  
Dear State Medicaid Director:  
This letter informs you of our current activities regarding the implementation of the 
Administrative Simplification section of the Health Insurance Portability and Accountability Act 
of 1996 (HIPAA), P.  
L. 104-191. Included in this letter is the funding policy for changes made to Medicaid Management 
Information Systems (MMIS) as a result of HIPAA, including a discussion of where States should 
be in their HIPAA implementation efforts.  
BACKGROUND  
The Administrative Simplification provisions of HIPAA mandate that the Department of Health and Human 
Services adopt standards for all health care information that is electronically exchanged. National standards will be 
developed for electronic health care transactions, code sets, standard identifiers, and security and privacy of health 
information. The security and privacy provisions apply to all electronic health data that are maintained, even if the 
data are not transmitted to other parties electronically.  
Implementation of these standards affects all health care entities in both the public and private sectors. In general, a 
60-day plus 24-month period time frame for implementation is required, and will be initiated, after final rules for 
these standards are published. Final rules for Administrative Simplification are intended to reduce the costs and 
administrative burdens of health care by replacing the many nonstandard formats currently used nationally with a 
single set of electronic standards that would be used throughout the health care industry.  
Standardization is needed to improve the efficiency of health care delivery and to protect the 
confidentiality and security of health care data. The health care arena will greatly benefit from 
standardization through savings in administrative cost and time.  
Due to the complex nature of implementing national standards, we highly recommend using the 6-step phase-in 
approach defined in the General Accounting Office's Year 2000 Computing Crisis: An Assessment Guide and Year 
2000 Computing Crisis: Business Continuity and Contingency Planning guide. The principles contained in these 
guides go beyond the year 2000 and should be applied when preparing for any major system initiative. The web site 
for these documents is: http://www.gao.gov/y2kr.  
file:///F|/New%20Website%20Content/PCPG%20Files/2000/2000/smd090800.asp (1 of 4)4/12/2006 1:05:47 PM  
htm  
 
PUBLICATION OF FINAL RULES FOR TRANSACTIONS AND CODE SETS  
On August 17, 2000, the final rule for national standards for electronic transactions was published 
in the Federal Register. This rule adopts standards for eight electronic transactions and for code sets 
to be used in those transactions. It also contains requirements concerning the use of these standards 
by health plans, health care clearinghouses, and certain health care providers. For more 
information, check the following web site: http://aspe.hhs.gov/admnsimp/    
FUNDING  
Funding for changes to States' MMIS that are necessary to implement HIPAA will be governed by 
current funding policy for MMIS specified in part 11 of the State Medicaid Manual 
(www.hcfa.gov/ pubforms/stmcaid/mcaidtoc.htm). As with routine MMIS requests, States should 
contact their regional office (RO) to discuss which activities are eligible for 50-percent, 75-percent, 
and 90-percent Federal financial participation (FFP). As with other major changes to the MMIS for 
which enhanced FFP is available, we will perform on-site MMIS certifications to ensure that the 
systems are HIPAA-compliant. Non-MMIS changes and non-system changes, as always, will 
continue to be funded at 50-percent FFP.  
 
WHAT IS HCFA DOING?  
HCFA has taken several steps to raise awareness of the magnitude and importance of HIPAA 
legislation. In addition to the Medicaid HIPAA Plus news notes, HCFA regional training, and the 
LISTSERV, HCFA plans a series of education efforts for providers and other professional 
associations.  
Also, to update you of policy decisions about implementation of HIPAA Administrative 
Simplification in a more efficient and timely manner, we will transmit information to you by 
means of a series of Division of State Systems (DSS) CMSO Information/Action Transmittals in 
lieu of State Medicaid Director letters. This new format will allow for easier tracking of 
correspondence from this Division as we provide you with future updates.  
Issuance of DSS CMSO Information/Action Transmittals is a newly implemented process. Your 
RO will forward transmittals to you, and HIPAA-related transmittals will be posted to the HIPAA 
leaders' LISTSERV. The first HIPAA-related Information/Action Transmittals that will be released 
in the near future will separately address guidelines for the Advance Planning Document process 
for HIPAA-related MMIS changes, and the status of our newly awarded contract to AverStar and 
Fox Systems for a Medicaid HIPAA-compliant concept model.  
WHAT YOU CAN DO NOW?  
States should make all efforts to become knowledgeable about HIPAA requirements and begin 
making  
file:///F|/New%20Website%20Content/PCPG%20Files/2000/2000/smd090800.asp (2 of 4)4/12/2006 1:05:47 PM  
plans for HIPAA implementation. Several valuable resources and important web site addresses are 
listed below.  
States should:  
  Be familiar with the contents of the Notices of Proposed Rulemaking (NPRMs) for the 
various HIPAA standards and the Department's regulation development process  (www.aspe.hhs.gov/ admnsimp/8steps.htm). Copies of the NPRMs can be found at 
www.aspe.hhs.gov/admnsimp/ index.htm, and the status of publication of these regulations can be 
found at www.aspe.hhs.gov/ admnsimp/pubsched.htm.  
  Read all of the Medicaid HIPAA Plus news notes that are intended to keep States apprised of 
the latest HIPAA Administrative Simplification developments. The Medicaid HIPAA Plus reports 
on activities of Standards Development Organizations, clarifies technical issues, answers questions 
submitted by subscribers, and directs readers to numerous HIPAA-related web site addresses. 
Medicaid HIPAA Plus news notes are located at www.hcfa.gov/medicaid/hipaapls.htm. CMSO's 
Data and Systems Group automatically sends the Medicaid HIPAA Plus to subscribers of the 
Medicaid HIPAA Administrative Simplification LISTSERV. (You may subscribe by sending an e-
mail to listserv@list.nih.gov with the command "subscribe HIPAAadminsimpl" in the body of the 
message.)  
  Keep abreast of Administrative Simplification policy developments relating to Medicaid. 
Your designated lead staff person for HIPAA Administrative Simplification has been automatically 
subscribed to the HIPAA leaders LISTSERV maintained by CMSO's Data and Systems Group. 
This LISTSERV will forward information to him/her regarding Administrative Simplification 
policy developments relating to Medicaid Information Technology. (You may ask that additional 
staff from your State agency be added to the LISTSERV by sending an e-mail to listserv@list.nih. 
gov with the command "subscribe STATEMCAIDHIPAL" in the body of the message.)  
  Take the opportunity for your agency to have your business needs and system requirements 
accommodated by the national standard. Document your State's list of data elements and codes and 
their definitions that are routinely used, and participate in as many Standard Development 
Organizations and workgroups as possible. Recommended groups include: Accredited Standards 
Committee (ASC) X12 at www.X12.org; Workgroup for Electronic Data Interchange (WEDI) at 
www.WEDI.org; HL7 (accredited standards committee for clinical data) at www.HL7.org; SNIP 
(industry-wide HIPAA Strategic National Implementation Process) sponsored by WEDI; and 
AFEHCT (Association for Electronic Health Care Transmissions) at www.AFEHCT.org. At a 
minimum, make sure your State is actively taking part in the NASMD sponsored National 
Medicaid EDI HIPAA Workgroup (NMEH). States may contact Lisa Doyle at 608-266-6960 to 
join.  
  Attend the regional HIPAA training sponsored by HCFA. Each State agency is allowed to 
send five people at no charge. This combined Medicare and Medicaid training is intended to reach 
all of HCFA's partners (States, carriers, intermediaries, and Medicare standard system maintainers), 
and emphasizes the industry-wide impact of HIPAA.  
 
The instructors contracted for this training are nationally recognized experts. States may arrange  
file:///F|/New%20Website%20Content/PCPG%20Files/2000/2000/smd090800.asp (3 of 4)4/12/2006 1:05:47 PM  
for make-up training sessions in other regions by contacting the RO representative.  
 Begin a detailed analysis of current practices against X12 version 4010 Implementation 
Guides, which can be downloaded from www.wpc-edi.com, and map local State code sets 
and identifiers' characteristics to those defined and named in the proposed rule for 
Transactions and Code Sets.  
We will continue to update you regarding HIPAA activities so that we can work together in order 
to meet HIPAA implementation and compliance. If you have any questions, please contact Sheila 
Frank of my staff at 410-786-0442, or by e-mail at sfrank1@hcfa.gov.   Sincerely,  
Timothy M. 
Westmoreland 
Director  
cc: All HCFA Regional Administrators All HCFA Associate Regional Administrators for Medicaid 
and State Operations Mark Ragan - Director, Office of State Systems, Administration for Children 
and Families Lee Partridge - Director, Health Policy Unit, American Public Human Services 
Association Joy Wilson - Director, Health Committee, National Conference of State Legislatures 
Erin Nagy - Director of Health Legislation, National Governors' Association  
<% 'Sitewide navigation info / do NOT edit %>  
file:///F|/New%20Website%20Content/PCPG%20Files/2000/2000/smd090800.asp (4 of 4)4/12/2006 1:05:47 PM