Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

JANET REHNQUIST 

Inspector General 

March 2003 

OEI-09-02-00420 

HIPAA READINESS: 

ADMINISTRATIVE SIMPLIFICATION 

FOR MEDICAID STATE AGENCIES 
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services (HHS) 

programs, as well as the health and welfare of beneficiaries served by those programs. This 

statutory mission is carried out through a nationwide network of audits, investigations, and 

inspections conducted by the following operating components: 

Office of Audit Services 

The OIG's Office of Audit Services (OAS) provides all auditing services for HHS, either by 

conducting audits with its own audit resources or by overseeing audit work done by others. 

Audits examine the performance of HHS programs and/or its grantees and contractors in 

carrying out their respective responsibilities and are intended to provide independent 

assessments of HHS programs and operations in order to reduce waste, abuse, and 

mismanagement and to promote economy and efficiency throughout the department. 

Office of Evaluation and Inspections 

The OIG's Office of Evaluation and Inspections (OEI) conducts short-term management and 

program evaluations (called inspections) that focus on issues of concern to the department, the 

Congress, and the public. The findings and recommendations contained in the inspections 

reports generate rapid, accurate, and up-to-date information on the efficiency, vulnerability, and 

effectiveness of departmental programs. 

Office of Investigations 

The OIG's Office of Investigations (OI) conducts criminal, civil, and administrative 

investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 

unjust enrichment by providers. The investigative efforts of OI lead to criminal convictions, 

administrative sanctions, or civil monetary penalties. The OI also oversees state Medicaid fraud 

control units, which investigate and prosecute fraud and patient abuse in the Medicaid program. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, 

rendering advice and opinions on HHS programs and operations and providing all legal support 

in OIG's internal operations. The OCIG imposes program exclusions and civil monetary 

penalties on health care providers and litigates those actions within the department. The OCIG 

also represents OIG in the global settlement of cases arising under the Civil False Claims Act, 

develops and monitors corporate integrity agreements, develops model compliance plans, 

renders advisory opinions on OIG sanctions to the health care community, and issues fraud 

alerts and other industry guidance. 
EXECUTIVE SUMMARY 

OBJECTIVE 

To determine if state Medicaid agencies expect to comply with the electronic data transaction 

standards and code sets under the Health Insurance Portability and Accountability Act 

(HIPAA) by October 2003. 

BACKGROUND 

The purpose of Title II of HIPAA is to improve the efficiency of the health care system by 

establishing standards to facilitate the electronic transmission of data between providers and 

payers. Electronic data interchange (EDI) can eliminate the inefficiencies associated with 

handling paper documents. It can reduce administrative costs and improves overall data quality 

for transactions, such as health care payments and coordination of benefits.1 

In accordance with the provisions of Title II of HIPAA, the Secretary of Health and Human 

Services has promulgated regulations mandating the use of specific standards for eight different 

types of electronic transactions and medical code sets. According to the regulations, state 

Medicaid agencies and other covered entities that filed an extension must implement the 

standards by October 16, 2003. 

FINDINGS 

We conducted telephone interviews with officials from the 51 state Medicaid agencies (50 

states and the District of Columbia). While few similarities exist in the planning and strategies 

among the 51 Medicaid agencies, 42 programs (approximately 80 percent) anticipate that they 

will be in compliance by October 2003. Of the remaining nine programs, eight are developing 

contingency plans to allow them to conduct business with compliant and noncompliant trading 

partners, and the ninth is expected to be minimally compliant by the deadline, with expectations 

that a new compliant system will be on line by March 2004. 

1

65 F.R. 50312 (August 17, 2000). 

HIPAA Readiness: Administrative Simplification 1 OEI-09-02-00420 
Approximately 80 percent of the state Medicaid programs will be in compliance 

with the HIPAA standards by October 2003 

Forty-two state Medicaid agencies expect to be fully compliant by October 16, 2003. Nine 

states will not meet the October 2003, target. The nine states are developing strategies that 

they expect will enable them to continue paying claims. Furthermore, twenty-nine of the 51 

states currently have contingency plans in the event they are unable to implement the transaction 

standards by October 16, 2003. 

Few similarities exist in the planning and strategies among the 51 state Medicaid 

programs 

Twenty-nine states will use an electronic data interchange translator to handle the new 

electronic standards. In addition to these 29, 15 states have new systems or plan to install new 

systems over the next several years, and 7 states will use a clearinghouse or other interim 

measures to meet the implementation date. Respondents from 40 states indicated that they plan 

to sequence implementation of the transactions. 

Lack of financial resources and technical support are barriers to meeting the 

October 2003 compliance date 

Twenty-one states report that lack of financial resources and of technical support are 

barriers. In addition, 21 state officials cited regulatory delays, changing federal regulations, and

inconsistent rule interpretations as barriers. Moving low volume and rural providers to

compliance is perceived as a barrier in 21 states. In 24 states, code set conversion is a major

barrier to compliance. 

CONCLUSION 

Overall, states are making progress in meeting the October 2003, deadline for implementing the 

HIPAA electronic transaction standards and code sets. All 51 states expect to be ready to 

implement the transactions, which will enable them to pay claims for Medicaid beneficiaries. 

The nine states that anticipate not being fully compliant on October 16, 2003, expect to 

continue to transact business using compliant and noncompliant electronic data until their 

systems are ready. 

HIPAA Readiness: Administrative Simplification 2 OEI-09-02-00420 
TABLE OF CONTENTS 

PAGE

EXECUTIVE SUMMARY ...................................................... 1

INTRODUCTION ............................................................. 4

METHODOLOGY ............................................................ 6

FINDINGS .................................................................. 7

Approximately 80 percent will be in compliance ........................................ 7

Planning and strategies vary among Medicaid agencies ................................... 8

Barriers to compliance ........................................................... 9

CONCLUSION ............................................................. 10

APPENDIX: HIPAA Electronic Transaction Standards Glossary ........................ 11

ACKNOWLEDGMENTS ..................................................... 13

HIPAA Readiness: Administrative Simplification 3 OEI-09-02-00420 
INTRODUCTION 

OBJECTIVE 

To determine if state Medicaid agencies expect to comply with the electronic data transaction 

standards and code sets under the Health Insurance Portability and Accountability Act 

(HIPAA) by October 2003. 

BACKGROUND 

Congress instituted significant reforms to the health care industry with the passage of HIPAA. 

Title I of HIPAA ensures the availability and portability of health care insurance coverage, while 

Title II creates a regulatory framework focused on improving the efficiency of the health care 

system by establishing standards to facilitate the electronic transmission of data between 

providers and payers. The goal is to create a seamless transfer of data with limited manual 

intervention. 

Administrative Simplification 

Under Title II, Subtitle F (Administrative Simplification), the Secretary of Health and Human 

Services has the authority to: (1) mandate the use of standards for the electronic exchange of 

health care data; (2) specify what medical and administrative code sets should be used, (3) 

require the use of national identification systems, and (4) specify the types of measures required 

to protect the security and privacy of personally identified health care information. 

Electronic Transactions and Code Sets 

Electronic data interchange (EDI) is the electronic transfer of information in a standard format 

between trading partners. The EDI substantially reduces the handling and processing time 

compared to paper transactions. The EDI can eliminate the inefficiencies of handling paper 

documents by reducing the administrative burden, lowering operating costs, and improving 

overall data quality.2 

Transactions are the exchange of information between two parties to carry out financial or 

administrative activities related to health care. The standards for electronic transmission 

2

65 F.R. 50312 (August 17, 2000). 

HIPAA Readiness: Administrative Simplification 4 OEI-09-02-00420 
of each of the transactions are codified in the Code of Federal Regulations (45 CFR Parts 160 

and 162). The rule provides standards for eight types of electronic transactions: 

< health care claims or equivalent encounter information, 

< health care payments and remittance advice, 

< coordination of benefits, 

< health care claim status, 

< enrollment and disenrollment in a health plan, 

< eligibility for a health plan, 

< health plan premium payments, and 

< referral certification and authorization.

The rule also contains requirements concerning the use of standardized code sets, such as

tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes used

to encode data elements in the transaction. The code set includes the codes and the descriptors

of the codes.3 The following code sets have been adopted:

< International Classification of Diseases-9-Clinical Modifications (ICD-9-CM), volumes 

1, 2, and 3, 

< Combination of Health Care Financing Administration Common Procedure Coding 

System (HCPCS) and Current Procedural Terminology-4 (CPT- 4), for physicians and 

other health services, 

< HCPCS for all other items,

< National Drug Codes (NDC) or HCPCS for prescription drugs, and

< Common Treatment for Dentists-2 (CTD-2) for dental services.

Covered entities, defined as providers, clearinghouses, and health plans that use the electronic

exchange of health information as part of their business, will be required to adopt these

standards. State Medicaid agencies are defined as health plans under Title II. The compliance

date for this rule (45 CFR Parts 160 and 162) was originally October 16, 2002. The

Administrative Simplification Compliance Act, signed into law on December 27, 2001, extends

the compliance date by one year to October 16, 2003. The extension applies only to those

covered entities that filed an extension with the Centers for Medicare & Medicaid Services

(CMS) by October 16, 2002. According to CMS officials, states have all filed extensions. 

Therefore, October 2003, is the effective compliance date for state Medicaid agencies. 

Because the implementation date is several months away, standards have not yet been

developed to measure compliance.

3

45 CFR §160.1002 

HIPAA Readiness: Administrative Simplification 5 OEI-09-02-00420 
METHODOLOGY 

This is one of several inspections that the OIG is conducting to determine the expected level of 

readiness for compliance by October 2003. After receiving input from CMS officials in the 

Centers for Medicaid and State Operations (CMSO), we developed a standardized telephone 

questionnaire to gather information from the Medicaid program officials responsible for 

implementing HIPAA electronic transactions and code sets. 

We conducted telephone surveys of the 51 Medicaid agency directors, HIPAA coordinators, 

and/or their staff between October 1 and October 31, 2002. The 51 states included the 50 

states and the District of Columbia. 

We questioned the HIPAA officials about the level of readiness, as of October 2002, in four 

broad areas: 

T assessment and awareness activities, for example, which programs and functions are 

being affected by the regulations; 

T barriers that have impeded or are current obstacles to achieving compliance, 

T compliance strategies, such as sequencing and testing plans that are being used for 

implementation in the Medicaid program; and 

T contingency planning. 

The inspection was conducted in accordance with the Quality Standards for Inspections 

issued by the President’s Council on Integrity and Efficiency. 

HIPAA Readiness: Administrative Simplification 6 OEI-09-02-00420 
FINDINGS 

We conducted telephone interviews with officials from the 51 state Medicaid agencies (50 

states and the District of Columbia). While few similarities exist in the planning and strategies 

among the 51 Medicaid agencies, 42 programs (approximately 80 percent) anticipate that they 

will be in compliance by October 2003. Of the remaining nine programs, eight are developing 

contingency plans to allow them to conduct business with compliant and noncompliant trading 

partners,4 and the ninth expects to be minimally compliant by the deadline, with expectations 

that a new compliant system will be on line by March 2004. 

Approximately 80 percent of the state Medicaid agencies 

reported they will be in compliance with the HIPAA standards 

by October 2003 

Forty-two of 51 state Medicaid agencies reported that they will be fully compliant with the new 

electronic transaction standards, while nine reported that they probably will not be compliant by 

October 2003. Thirty-six of the 42 believe that they have adequate financial and technical 

resources to implement the standards. The remaining six states expect some funding cuts or 

budget and staff adjustments in their HIPAA plan. 

Six of the nine potentially noncompliant states expect to have enough technical and financial 

resources to become compliant at a later date. However, three of the noncompliant states 

indicate that they need additional technical staff and financial resources to become compliant. 

Twenty-nine of the 51 states reported that they have developed specific contingency plans to 

continue services if their systems are not fully compatible with their trading partners, as of 

October 16, 2003. This includes eight of the nine states expected to be noncompliant, whose 

contingency plans will allow them to handle critical compliant and noncompliant transactions, 

such as paying provider claims. The remaining 22 states have no formal specific contingency 

plan. 

4

Trading partners are external entities, such as managed care organizations, physicians, dentists, homemaker services, nursing homes, and other Medicaid providers with whom the state agency does business. 

HIPAA Readiness: Administrative Simplification 7 OEI-09-02-00420 
Planning and strategies vary widely among the 51 state 

Medicaid agencies 

State Medicaid program staff adopt compliance strategies and sequencing plans 

to meet their specific program needs 

The 51 states have electronic data interchange (EDI) systems that range from 30-years-old to 

new systems that currently are being installed. The HIPAA teams in each state conducted gap 

analyses to determine what changes in their current EDI systems would be most appropriate to 

implement the new transaction standards. Twenty-nine states will use their existing EDI 

software along with an EDI translator to handle the new standard transactions. Fifteen states 

have new EDI systems or plan to install new systems during the next several years. Seven 

states are using clearinghouses or making minimal modifications in their current EDI systems to 

meet the new standards, anticipating major system and regulatory changes beyond 2003. 

More than 75 percent (40) of the states are using a sequencing strategy, which is the process 

for logically implementing each of the eight transactions according to state specific needs. 

Fifteen of these states are prioritizing transactions related to provider payments. The remaining 

25 states have developed sequencing plans, based on system design, ease of making the 

electronic conversion, or volume of business in each transaction. Eleven states have no 

sequencing strategy. 

Eight of the nine potentially noncompliant state agencies have planned major systems’ 

renovations which include using translators and clearinghouses and/or replacing hardware and 

software. Only one of the noncompliant states plans a “bare bones” or minimal approach to 

compliance in 2003, anticipating a new compliant system in 2004. All nine of the states 

anticipate that they will be compliant in 2004. 

States have begun testing transaction standards 

As of November 2002, five states have implemented at least one of the eight new transaction 

standards and have begun testing with their trading partners. Thirty-nine states have or are in 

the process of completing the development of their testing plans. Additionally, 36 states 

anticipate conducting systems’ testing with their Medicare partners by April 2003. Although it 

was not one of the eight listed transactions, an additional four states are implementing the 

National Council for Prescription Drug Programs standard (NCPDP 5.1) for high volume drug 

dispenser transactions, which are specified under the HIPAA transaction standard for health 

care claims or equivalent encounters. 

HIPAA Readiness: Administrative Simplification 8 OEI-09-02-00420 
Lack of financial resources and technical support are barriers 

to meeting the compliance deadline 

State Medicaid officials identified challenges with code set conversions, state 

funding, on-going standards’ modifications, and provider concerns as barriers to 

compliance 

For 24 states (3 of which expected to be noncompliant), the local code conversion effort is a 

major barrier to compliance. States have as few as 75 to more than 10,000 local codes to 

convert, crosswalk, delete, or refine. The conversion is particularly difficult because many state 

codes that are used for Medicaid services are beyond the scope of traditional medical services. 

For example, no code existed in the HCPCS or CPT-4 codes for homemaker services. Also, 

state officials expressed concerns over the long delays in getting timely responses for new code 

designations. The delays affect implementation costs, schedules, and their ability to integrate 

the new codes into their systems in a timely manner. 

In 21 states, implementation plans may have to be altered during the next 12 months, due to 

budget cuts and state deficits. This includes six of the nine potentially noncompliant states 

where implementation costs and state budget problems are barriers to meeting the October 

2003, target. 

In 21 states, including four of the expected noncompliant state programs, officials said the 

federal regulatory environment is a barrier to compliance. They cited regulation delays, rule 

changes, and modifications to the standards that continued during planning, and the lack of 

consistent rule interpretations from staff among the regional CMS offices as causes for delays in 

planning system conversions. They believe these barriers have added to the cost of 

implementation. 

Small and/or rural providers create some unique challenges for state Medicaid program 

compliance. In 18 states, smaller providers may revert to paper claims rather than incur the 

expense of converting to the HIPAA electronic transaction standards. Small states are having 

difficulty reaching rural providers in remote communities to inform them of the HIPAA 

transaction standards. Also, most providers were aware of the HIPAA “privacy regulation,” 

but not the transaction standards. 

HIPAA Readiness: Administrative Simplification 9 OEI-09-02-00420 
CONCLUSION 

Overall, states are making progress in meeting the October 2003, deadline for implementing the 

HIPAA electronic transaction standards and code sets. All 51 states expect to be ready to 

implement the transactions, which will enable them to pay claims for Medicaid beneficiaries. 

The nine states that anticipate not being fully compliant on October 16, 2003, will continue to 

transact business using compliant and noncompliant electronic data until their systems are ready. 

We will provide additional technical information, as appropriate, to CMS. 

HIPAA Readiness: Administrative Simplification 10 OEI-09-02-00420 
Appendix 

Glossary of Electronic Transaction Standards Terminology 

Administrative Simplification: the use of mandated standards for the electronic exchange of health 

care data and specific measures to protect the security and privacy of personally identifiable health care 

information. 

Business Associate: a person or organization that performs certain business functions on behalf of a 

covered entity. 

Clearinghouse: an entity that processes information received from one entity in a nonstandard format 

into a standard transaction, or receives a standard transaction and converts it to a nonstandard format 

for a receiving entity. 

Code Set: the tables of terms, medical concepts, diagnostic codes, or procedure codes and 

descriptions used to encode information in a transaction. 

Contingency Plan: a plan developed by covered entities to provide an alternative for submitting or 

receiving HIPAA electronic transactions after October 2003, in the event that the covered entity’s 

system conversion fails or is incomplete. 

Covered Entity: any health plan, health care clearinghouse, or a health care provider who transmits 

any health information in electronic form in connection with a transaction covered by the HIPAA 

standards. 

EDI Translator: a software tool for accepting an EDI transmission and converting the data into 

another format, or for converting a non-EDI file into an EDI format for transmission. 

Electronic Data Interchange (EDI): any electronic exchange of formatted data. 

Gap Analysis: an evaluation of a covered entity’s system to define the changes to be made, how the 

data will be managed, and what procedures will be implemented to enter and to verify information. 

Local Codes: a generic term for code values that are defined for a state or other political subdivision 

or specific payer. 

State Medicaid Agency: the state agency responsible for overseeing the state’s Medicaid program, 

defined as a covered entity under HIPAA. 

Small Health Plan: under HIPAA, a health plan with annual receipts of $5 million or less. 

HIPAA Readiness: Administrative Simplification 11 OEI-09-02-00420 
Sequencing: a process plan developed by a covered entity to implement each of the transaction 

standards in a logical sequence. 

Standard Transactions: the exchange of information between two parties that complies with the 

requirements established under HIPAA. 

Trading Partner: an external entity, such as a customer, with whom the covered entity does business. 

A trading partner can be so designated for some purposes and considered a business associate for 

other purposes. 

Translator: See EDI translator. 

Vendor: software and/or hardware entities that provide HIPAA compliant services, consulting, and/or 

products to covered entities. Vendors may be business associates or trading partners. 

HIPAA Readiness: Administrative Simplification 12 OEI-09-02-00420 
ACKNOWLEDGMENTS 

This report was prepared under the direction of Paul A. Gottlober, Regional Inspector General 

for Evaluation and Inspections, and Deborah Harvey, Assistant Regional Inspector General for 

Evaluation and Inspections in San Francisco. Other principal Office of Evaluation and 

Inspections staff who contributed include: 

Timothy Brady, Project Leader

Silvia Chin, Program Analyst

Rob Gibbons, Program Analyst

Cindy Lemesh, Program Analyst

Thomas A. Purvis, Program Analyst

Cheryl Dotts, Program Assistant

Linda Frisch, Program Specialist 

Stephanie London, Program Specialist 

For information or copies of this report, please contact

the Office of Inspector General’s

Public Affairs office at (202) 619-1343.

Reports are also available on the World Wide Web at our home page address:

http://www.oig.hhs.gov/ 

HIPAA Readiness: Administrative Simplification 13 OEI-09-02-00420