Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

JANET REHNQUIST 

Inspector General 

March 2003 

OEI-09-02-00423 

HIPAA READINESS: 

ADMINISTRATIVE SIMPLIFICATION 

FOR TERRITORIES WITH MEDICAID PROGRAMS 
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services (HHS) 

programs, as well as the health and welfare of beneficiaries served by those programs. This 

statutory mission is carried out through a nationwide network of audits, investigations, and 

inspections conducted by the following operating components: 

Office of Audit Services 

The OIG's Office of Audit Services (OAS) provides all auditing services for HHS, either by 

conducting audits with its own audit resources or by overseeing audit work done by others. 

Audits examine the performance of HHS programs and/or its grantees and contractors in 

carrying out their respective responsibilities and are intended to provide independent 

assessments of HHS programs and operations in order to reduce waste, abuse, and 

mismanagement and to promote economy and efficiency throughout the department. 

Office of Evaluation and Inspections 

The OIG's Office of Evaluation and Inspections (OEI) conducts short-term management and 

program evaluations (called inspections) that focus on issues of concern to the department, the 

Congress, and the public. The findings and recommendations contained in the inspections 

reports generate rapid, accurate, and up-to-date information on the efficiency, vulnerability, and 

effectiveness of departmental programs. 

Office of Investigations 

The OIG's Office of Investigations (OI) conducts criminal, civil, and administrative 

investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 

unjust enrichment by providers. The investigative efforts of OI lead to criminal convictions, 

administrative sanctions, or civil monetary penalties. The OI also oversees state Medicaid fraud 

control units, which investigate and prosecute fraud and patient abuse in the Medicaid program. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, 

rendering advice and opinions on HHS programs and operations and providing all legal support 

in OIG's internal operations. The OCIG imposes program exclusions and civil monetary 

penalties on health care providers and litigates those actions within the department. The OCIG 

also represents OIG in the global settlement of cases arising under the Civil False Claims Act, 

develops and monitors corporate integrity agreements, develops model compliance plans, 

renders advisory opinions on OIG sanctions to the health care community, and issues fraud 

alerts and other industry guidance. 
EXECUTIVE SUMMARY 

OBJECTIVE 

To determine if United States territories with Medicaid programs expect to comply with the 

electronic data transaction standards and code sets under the Health Insurance Portability and 

Accountability Act (HIPAA) by October 2003. 

BACKGROUND 

The purpose of Title II of HIPAA is to improve the efficiency of the health care system by 

establishing standards to facilitate the electronic transmission of data between providers and 

payers. Electronic data interchange (EDI) can eliminate the inefficiencies associated with 

handling paper documents. It can reduce administrative costs and improves overall data quality 

for transactions, such as health care payments and coordination of benefits.1 

In accordance with the provisions of Title II of HIPAA, the Secretary of Health and Human 

Services has promulgated regulations mandating the use of specific standards for eight different 

types of electronic transactions and medical code sets. According to the regulations, Medicaid 

agencies and other covered entities that filed an extension must implement the standards by 

October 16, 2003. 

FINDINGS 

We conducted telephone interviews with officials from the five territories with Medicaid 

programs. Four of the five territories report that they will not be fully compliant with the 

electronic transaction standards and code sets, and they will not meet the October 2003, 

implementation date. The most significant barriers for the territories are the lack of financial and 

technical resources. Since the territories’ federal Medicaid funds are capped, they were 

ineligible for additional federal financial participation funds to implement the electronic 

transaction standards. 

Territories have not developed compliance strategies 

None of the territories has developed a compliance strategy. Territories have considered 

1

65 F.R. 50312 (August 17, 2000). 

HIPAA Readiness: Administrative Simplification 1 OEI-09-02-00423 
alternatives but have not moved forward with implementation plans, due to the lack of funding 

to convert to the electronic transaction standards and code sets. 

Because they lack the funds, territories have not developed sequence planning 

and testing protocols 

Neither the federal government nor the territorial governments have allocated funds for 

compliance. Therefore, the territories lack the funding to acquire the technical resources 

needed to develop their implementation strategies. 

CONCLUSION 

One territory may be in compliance if its legislature allocates funds designated to implement the 

HIPAA transaction standards and code sets. According to territory officials, limited funding 

and the lack of technical resources will prevent the remaining four territories from meeting any 

of the transaction standards by October 2003. 

HIPAA Readiness: Administrative Simplification 2 OEI-09-02-00423 
TABLE OF CONTENTS 

PAGE

EXECUTIVE SUMMARY ...................................................... 1

INTRODUCTION ............................................................. 4

METHODOLOGY ............................................................ 6

FINDINGS .................................................................. 7

Compliance strategies ............................................................ 7

Sequence planning and testing protocols .............................................. 7

CONCLUSION .............................................................. 8

APPENDIX: HIPAA Electronic Transaction Standards Glossary .......................... 9

ACKNOWLEDGMENTS ..................................................... 11

HIPAA Readiness: Administrative Simplification 3 OEI-09-02-00423 
INTRODUCTION 

OBJECTIVE 

To determine if United States territories with Medicaid programs expect to comply with the 

electronic data transaction standards and code sets under the Health Insurance Portability and 

Accountability Act ( HIPAA) by October 2003. 

BACKGROUND 

Congress instituted significant reforms to the health care industry with the passage of HIPAA. 

Title I of HIPAA assures the availability and portability of health care insurance coverage, while 

Title II creates a regulatory framework focused on improving the efficiency of the health care 

system by establishing standards to facilitate the electronic transmission of data between 

providers and payers. The goal is to create a seamless transfer of data with limited manual 

intervention. 

Administrative Simplification 

Under Title II, Subtitle F (Administrative Simplification), the Secretary of Health and Human 

Services has the authority to: (1) mandate the use of standards for the electronic exchange of 

health care data; (2) specify what medical and administrative code sets should be used, (3) 

require the use of national identification systems, and (4) specify the types of measures required 

to protect the security and privacy of personally identified health care information. 

Electronic Transactions and Code Sets 

Electronic data interchange (EDI) is the electronic transfer of information in a standard format 

between trading partners.2 The EDI substantially reduces the handling and processing time 

compared to paper transactions. The EDI can eliminate the inefficiencies of handling paper 

documents by reducing the administrative burden, lowering operating costs, and improving 

overall data quality.3 

2

Trading partners are external entities, such as hospitals, physicians, dentists, nursing homes, and other 

Medicaid providers with whom the Medicaid agency does business. 

3

65 F.R. 50312 (August 17, 2000). 

HIPAA Readiness: Administrative Simplification 4 OEI-09-02-00423 
Transactions are the exchange of information between two parties to carry out financial or 

administrative activities related to health care. The standards for electronic transmission of each 

of the transactions are codified in the Code of Federal Regulations (45 CFR Parts 160 and 

162). The rule provides standards for eight types of electronic transactions: 

< health care claims or equivalent encounter information, 

< health care payments and remittance advice, 

< coordination of benefits, 

< health care claim status, 

< enrollment and disenrollment in a health plan, 

< eligibility for a health plan, 

< health plan premium payments, and 

< referral certification and authorization.

The rule also contains requirements concerning the use of standardized code sets, such as

tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes used

to encode data elements in the transaction. The code set includes the codes and the descriptors

of the codes.4 The following code sets have been adopted:

< International Classification of Diseases-9-Clinical Modifications (ICD-9-CM), volumes 

1, 2, and 3, 

< Combination of Health Care Financing Administration Common Procedure Coding 

System (HCPCS) and Current Procedural Terminology-4 (CPT- 4), for physicians and 

other health services, 

< HCPCS for all other items,

< National Drug Codes (NDC) or HCPCS for prescription drugs, and

< Common Treatment for Dentists-2 (CTD-2) for dental services.

Covered entities, defined as providers, clearinghouses, and health plans that use the electronic

exchange of health information as part of their business, will be required to adopt these

standards. Medicaid agencies are defined as health plans under Title II. The compliance date

for this rule (45 CFR Parts 160 and 162) was originally October 16, 2002. The Administrative

Simplification Compliance Act, signed into law on December 27, 2001, extends the compliance

date by one year to October 16, 2003. The extension applies only to those covered entities

that filed an extension with the Centers for Medicare & Medicaid Services (CMS) by October

16, 2002. According to CMS officials, all five territories with Medicaid programs have filed

extensions. Therefore, October 2003, is the effective compliance date for the territories. 

Because the implementation date is several months away, standards have not yet been

developed to measure compliance.

4

45 CFR §160.1002 

HIPAA Readiness: Administrative Simplification 5 OEI-09-02-00423 
METHODOLOGY 

This is one of several inspections that the OIG is conducting to determine the expected level of 

readiness for compliance by October 2003. After receiving input from CMS officials in the 

Centers for Medicaid and State Operations (CMSO), we developed a standardized telephone 

questionnaire to gather information from the Medicaid program officials responsible for 

implementing HIPAA electronic transactions and code sets. 

We conducted telephone surveys of the Medicaid directors for the five territories, HIPAA 

coordinators, and/or their staff between October 1 and October 31, 2002. 

We questioned the officials about the level of readiness in four broad areas: 

T assessment and awareness activities, for example, which programs and functions are 

being affected by the regulations; 

T barriers that have impeded or are current obstacles to achieving compliance; 

T compliance strategies, such as sequencing and testing plans that are being used for 

implementation in the Medicaid program; and 

T contingency planning. 

The inspection was conducted in accordance with the Quality Standards for Inspections 

issued by the President’s Council on Integrity and Efficiency. 

HIPAA Readiness: Administrative Simplification 6 OEI-09-02-00423 
FINDINGS 

We conducted telephone interviews with officials from the five territories with Medicaid 

programs. Four of the five territories report that they will not be in compliance with the 

electronic transaction standards and code sets, and they will not meet the October 2003, 

implementation date. The most significant barriers for the territories are the lack of financial and 

technical resources. Since the territories’ federal Medicaid funds are capped, they were 

ineligible for additional federal financial participation funds to implement the electronic 

transaction standards. 

Territories have not developed compliance strategies 

None of the five territories have developed a compliance strategy. One territory is considering 

a contract with a clearinghouse until it can make major conversions in its territorial data 

processing system. Another territory is considering a translator or a clearinghouse, depending 

on the availability of funds. One territorial official stated that the territories could easily 

implement the transaction standards and code sets using a personal computer program, if CMS 

would develop it. Only one of the territories anticipates that it will be able to coordinate 

payments with a compliant Medicare system for crossover beneficiaries by the October 2003, 

deadline. 

Because they lack the funds, territories have not developed 

sequence planning and testing protocols 

Neither the Federal Government nor the territorial governments have allocated funds for 

compliance. Four of the five territories entire Medicaid budget is less than $15 million and the 

federal match is capped for each of them. Therefore, the territories lack the funding to acquire 

the technical resources needed to develop their implementation strategies. One territorial 

official has considered a basic sequencing strategy that would start with the easiest transaction, 

coordination of benefits. However, none of the territories has developed any type of 

sequencing plan. Furthermore, none of the territories has developed testing plans or 

contingency plans, since they do not have resources to guide the implementation process. One 

territorial official said the contingency plan was “to continue doing business as usual with 

compliant and noncompliant trading partners.” 

HIPAA Readiness: Administrative Simplification 7 OEI-09-02-00423 
CONCLUSION 

One territory may be in compliance if its legislature allocates funds designated to implement the 

HIPAA transaction standards and code sets. According to territory officials, limited funding 

and the lack of technical resources will prevent the remaining four territories from meeting any 

of the transaction standards by October 2003. 

We will provide additional technical information, as appropriate, to CMS. 

HIPAA Readiness: Administrative Simplification 8 OEI-09-02-00423 
Appendix 

Glossary of Electronic Transaction Standards Terminology 

Administrative Simplification: the use of mandated standards for the electronic exchange of health 

care data and specific measures to protect the security and privacy of personally identifiable health care 

information. 

Business Associate: a person or organization that performs certain business functions on behalf of a 

covered entity. 

Clearinghouse: an entity that processes information received from one entity in a nonstandard format 

into a standard transaction, or receives a standard transaction and converts it to a nonstandard format 

for a receiving entity. 

Code Set: the tables of terms, medical concepts, diagnostic codes, or procedure codes and 

descriptions used to encode information in a transaction. 

Contingency Plan: a plan developed by covered entities to provide an alternative for submitting or 

receiving HIPAA electronic transactions after October 2003, in the event that the covered entity’s 

system conversion fails or is incomplete. 

Covered Entity: any health plan, health care clearinghouse, or a health care provider who transmits 

any health information in electronic form in connection with a transaction covered by the HIPAA 

standards. 

EDI Translator: a software tool for accepting an EDI transmission and converting the data into 

another format, or for converting a non-EDI file into an EDI format for transmission. 

Electronic Data Interchange (EDI): any electronic exchange of formatted data. 

Gap Analysis: an evaluation of a covered entity’s system to define the changes to be made, how the 

data will be managed, and what procedures will be implemented to enter and to verify information. 

Local Codes: a generic term for code values that are defined for a state or other political subdivision 

or specific payer. 

Medicaid State Agency: the state agency responsible for overseeing the state’s Medicaid program, 

defined as a covered entity under HIPAA. 

Small Health Plan: under HIPAA, a health plan with annual receipts of $5 million or less. 

HIPAA Readiness: Administrative Simplification 9 OEI-09-02-00423 
Sequencing: a process plan developed by a covered entity to implement each of the transaction 

standards in a logical sequence. 

Standard Transactions: the exchange of information between two parties that complies with the 

requirements established under HIPAA. 

Trading Partner: an external entity, such as a customer, with whom the covered entity does business. 

A trading partner can be so designated for some purposes and considered a business associate for 

other purposes. 

Translator: See EDI translator. 

Vendor: software and/or hardware entities that provide HIPAA compliant services, consulting, and/or 

products to covered entities. Vendors may be business associates or trading partners. 

HIPAA Readiness: Administrative Simplification 10 OEI-09-02-00423 
ACKNOWLEDGMENTS 

This report was prepared under the direction of Paul A. Gottlober, Regional Inspector General 

for Evaluation and Inspections, and Deborah Harvey, Assistant Regional Inspector General for 

Evaluation and Inspections in San Francisco. Other principal Office of Evaluation and 

Inspections staff who contributed include: 

Timothy Brady, Project Leader

Silvia Chin, Program Analyst

Rob Gibbons, Program Analyst

Cindy Lemesh, Program Analyst

Thomas A. Purvis, Program Analyst

Cheryl Dotts, Program Assistant

Linda Frisch, Program Specialist 

Stephanie London, Program Specialist 

For information or copies of this report, please contact

the Office of Inspector General’s

Public Affairs office at (202) 619-1343.

Reports are also available on the World Wide Web at our home page address:

http://www.oig.hhs.gov/ 

HIPAA Readiness: Administrative Simplification 11 OEI-09-02-00423