Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

JANET REHNQUIST 

Inspector General 

MAY 2003 

OEI-09-02-00421 

HIPAA READINESS: 

ADMINISTRATIVE SIMPLIFICATION 

FOR MEDICARE PART A PROVIDERS 
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services (HHS) 

programs, as well as the health and welfare of beneficiaries served by those programs. This 

statutory mission is carried out through a nationwide network of audits, investigations, and 

inspections conducted by the following operating components: 

Office of Audit Services 

The OIG's Office of Audit Services (OAS) provides all auditing services for HHS, either by 

conducting audits with its own audit resources or by overseeing audit work done by others. 

Audits examine the performance of HHS programs and/or its grantees and contractors in 

carrying out their respective responsibilities and are intended to provide independent 

assessments of HHS programs and operations in order to reduce waste, abuse, and 

mismanagement and to promote economy and efficiency throughout the department. 

Office of Evaluation and Inspections 

The OIG's Office of Evaluation and Inspections (OEI) conducts short-term management and 

program evaluations (called inspections) that focus on issues of concern to the department, the 

Congress, and the public. The findings and recommendations contained in the inspections 

reports generate rapid, accurate, and up-to-date information on the efficiency, vulnerability, and 

effectiveness of departmental programs. 

Office of Investigations 

The OIG's Office of Investigations (OI) conducts criminal, civil, and administrative 

investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 

unjust enrichment by providers. The investigative efforts of OI lead to criminal convictions, 

administrative sanctions, or civil monetary penalties. The OI also oversees state Medicaid fraud 

control units, which investigate and prosecute fraud and patient abuse in the Medicaid program. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, 

rendering advice and opinions on HHS programs and operations and providing all legal support 

in OIG's internal operations. The OCIG imposes program exclusions and civil monetary 

penalties on health care providers and litigates those actions within the department. The OCIG 

also represents OIG in the global settlement of cases arising under the Civil False Claims Ac t, 

develops and monitors corporate integrity agreements, develops model compliance plans, 

renders advisory opinions on OIG sanctions to the health care community, and issues fraud 

alerts and other industry guidance. 
EXECUTIVE SUMMARY 

OBJECTIVE 

To determine if Medicare Part A providers expect to comply with the electronic data 

transaction standards and code sets mandated by the Health Insurance Portability and 

Accountability Act (HIPAA) by October 2003. 

BACKGROUND 

The purpose of Title II of HIPAA is to improve the efficiency of the health care system by 

establishing standards to facilitate the electronic transmission of data between providers and 

payers. Electronic data interchange can eliminate the inefficiencies associated with handling 

paper documents. It reduces administrative costs and improves overall data quality for 

transactions, such as health care payments and coordination of benefits.1 

In accordance with the provisions of Title II of HIPAA, the Secretary of Health and Human 

Services has promulgated regulations mandating the use of specific standards for eight different 

types of electronic transactions and medical code sets. Covered entities that filed an extension 

must implement the standards by October 16, 2003. 

This report is based on the results of a mail survey of a stratified random sample of Medicare 

Part A providers that submitted claims to Medicare fiscal intermediaries between July 1, 2001 

and June 30, 2002. 

FINDINGS 

Ninety-six percent of Medicare Part A providers have moderate to high 

expectations that they will be compliant with HIPAA standards by October 2003 

Medicare Part A providers are making significant progress in meeting the HIPAA deadline. 

Ninety-two percent of Medicare Part A providers are developing an implementation schedule 

to meet the deadline, while approximately one-half are developing sequencing strategies and 

contingency plans in the event their system is not 

1

65 FR 50312 (August 17, 2000). 

HIPAA Readiness: Medicare Part A Providers 1 OEI-09-02-00421 
fully in compliance by the deadline. Approximately 84 percent are using systems vendors as 

part of their compliance strategy. Only 18 percent have conducted a cost/benefit analysis for 

implementing the electronic standards and code sets. 

External barriers may affect compliance 

Approximately one-third of the providers who listed potential barriers to compliance were 

concerned that their trading partners could affect their ability to meet the compliance deadline. 

CONCLUSION 

Overall, the Medicare Part A providers are making steady progress toward meeting the 

compliance target of October 16, 2003, for implementing the HIPAA electronic transaction 

standards and code sets. Providers are, however, concerned that their trading partners may 

not be fully compliant, and this would affect their own ability to implement the electronic 

standards. 

HIPAA Readiness: Medicare Part A Providers 2 OEI-09-02-00421 
TABLE OF CONTENTS 

PAGE

EXECUTIVE SUMMARY ...................................................... 1

INTRODUCTION ............................................................. 4

FINDINGS .................................................................. 8

Anticipated compliance .................................................... 8

External barriers .......................................................... 9

CONCLUSION ............................................................. 11

APPENDIX A: HIPAA-related terms and acronyms ................................. 12

APPENDIX B: Confidence intervals for statistics in report ............................ 13

ACKNOWLEDGMENTS ..................................................... 16

HIPAA Readiness: Medicare Part A Providers 3 OEI-09-02-00421 
INTRODUCTION 

OBJECTIVE 

To determine if Medicare Part A providers expect to comply with the electronic data 

transaction standards and code sets mandated by the Health Insurance Portability and 

Accountability Act (HIPAA) by October 2003. 

BACKGROUND 

Congress instituted significant reforms to the health care industry with the passage of HIPAA. 

Title I of HIPAA assures the availability and portability of health care insurance coverage, while 

Title II creates a regulatory framework to improve the efficiency of the health care system by 

establishing standards that will facilitate the electronic transmission of data between providers 

and payers. (See Appendix A for a glossary of HIPAA-related terms and acronyms.) The 

goal is to create a seamless transfer of data with limited manual intervention. 

Administrative Simplification 

Under Title II, Subtitle F (Administrative Simplification), the Secretary of Health and Human 

Services has the authority to: (1) mandate the use of standards for the electronic exchange of 

health care data; (2) specify what medical and administrative code sets should be used; (3) 

require the use of national identification systems; and (4) specify the types of measures required 

to protect the security and privacy of personally identified health care information. 

Electronic Transactions and Code Sets 

Electronic data interchange (EDI) is the electronic transfer of information in a standard format 

between trading partners. Compared to paper transactions, EDI substantially reduces handling 

and processing time by reducing the administrative burden, lowering operating costs, and 

improving overall data quality.2 

2

65 FR 50312 (August 17, 2000). 

HIPAA Readiness: Medicare Part A Providers 4 OEI-09-02-00421 
Transactions are the exchange of information between two parties to carry out financial or

administrative activities related to health care. The standards for electronic transmission of each

of the transactions are codified in the Code of Federal Regulations

(45 CFR Parts 160 and 162). The rule provides standards for eight types of electronic

transactions: 

< 1. Health care claims or equivalent encounter information,

< 2. Health care payments and remittance advice,

< 3. Coordination of benefits,

< 4. Health care claim status,

< 5. Enrollment and disenrollment in a health plan,

< 6. Eligibility for a health plan,

< 7. Health plan premium payments, and

< 8. Referral certification and authorization.

The rule also contains requirements concerning the use of standardized code sets, such as 

tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes used 

to encode data elements in the transaction. The code set includes the codes and their 

descriptors.3 The following code sets have been adopted: 

< International Classification of Diseases-9-Clinical Modifications (ICD-9-CM), volumes 

1, 2, and 3; 

< Combination of Health Care Financing Administration Common Procedure Coding 

System (HCPCS) and Current Procedural Terminology-4 (CPT-4) for physicians and 

other health services; 

< HCPCS for all other items;

< National Drug Codes (NDC) or HCPCS for prescription drugs; and

< Common Treatment for Dentists-2 (CTD-2) for dental services.

Covered entities, defined as providers, clearinghouses, and health plans that use the electronic 

exchange of health information as part of their business, will be required to adopt these 

standards. The compliance date for this rule (45 CFR Parts 160 and 162) was originally 

October 16, 2002. The Administrative Simplification Compliance Act, signed into law on 

December 27, 2001, extends the compliance date by 1 year to October 16, 2003. The 

extension applies only to those covered entities that filed an extension with the Centers for 

Medicare & Medicaid Services (CMS) by October 16, 2002. For these entities, October 

2003 is the compliance date. Since the implementation date is several months away, CMS has 

not yet developed standards to measure compliance. 

3

45 CFR § 160.1002 

HIPAA Readiness: Medicare Part A Providers 5 OEI-09-02-00421 
METHODOLOGY 

This is one of a series of HIPAA readiness surveys. We used a mail survey as the primary tool 

to conduct this evaluation. We mailed surveys during the week of November 4, 2002, and 

received responses between November 26, 2002, and 

March 24, 2003. 

We surveyed a stratified random sample of Medicare Part A providers who submitted claims to 

Medicare fiscal intermediaries between July 1, 2001, and June 30, 2002. Stratification allowed 

us to test for differences in compliance strategies, contingencies, and barriers among providers, 

based on the number of claims they submitted to Medicare. We divided the providers into 

three strata: 

Stratum Number of 

Claims 

Size of 

Population 

Sample 

Size 

Number of 

responses 

1 1 to 1,500 

claims 36,746 50 50 

2 

1,501 to 17,500 

claims 7,048 50 50 

3 

more than 

17,500 claims 2,315 50 50 

TOTAL 46,109 150 150 

We randomly ordered the population of providers within each stratum. We then selected the 

first 50 providers in each stratum that were covered by HIPAA, were still in business, and were 

not under investigation by the Office of Inspector General’s Office of Investigations. Our 

response rate was 100 percent. Of the 150 providers, approximately 57 percent are hospitals, 

16 percent are skilled nursing facilities, 15 percent are home health agencies and hospices, and 

12 percent are outpatient facilities, including rural and community health clinics. Surveys were 

completed by administrators, financial officers, compliance officers, and clinic managers. We 

weighted the responses according to each stratum’s representation in the population. 

We surveyed the providers about their level of readiness in four broad areas: 

1. Assessment and awareness activities; 

2. Impediments or current obstacles to achieving compliance; 

3. Compliance strategies, such as sequencing and testing plans; and 

4. Contingency planning. 

HIPAA Readiness: Medicare Part A Providers 6 OEI-09-02-00421 
We did not independently verify the accuracy of the responses. 

The inspection was conducted in accordance with the Quality Standards for Inspections issued 

by the President’s Council on Integrity and Efficiency. 

HIPAA Readiness: Medicare Part A Providers 7 OEI-09-02-00421 
FINDINGS 

We conducted a mail survey of a stratified random sample of Medicare Part A providers. 

Overall, the Medicare Part A providers are making progress toward meeting the compliance 

target of October 16, 2003, for implementing the HIPAA electronic transaction standards and 

code sets, and 96 percent expect to be in compliance by the deadline. 

Ninety-six percent of Medicare Part A providers have 

moderate to high expectations that they will be compliant with 

HIPAA standards by October 2003 

Almost all Medicare Part A providers submitted a compliance extension form. As a result, they 

have until October 16, 2003, to implement the electronic standards and code sets. As of the 

time of our survey, 74 percent of the providers were ready to implement the HIPAA electronic 

standards, and 96 percent indicated that they had a moderate to high level of satisfaction that 

they expected to meet the October deadline. 

Providers who did not believe they would meet the compliance deadline (approximately 

4 percent of all providers), indicated they were in the process of identifying the steps necessary 

to implement the standards. At the time of the survey, they were receiving information from 

their professional associations to assist them in developing implementation strategies. 

Providers have developed internal and external testing strategies 

While fewer than 30 percent of the providers had begun any testing, 90 percent will have a

testing strategy. Most of their testing strategies include internal and external data interfaces. 

Approximately one-fourth had begun to test transactions, as of 

November 2002. However, slightly more than 44 percent had received any notices from fiscal

intermediaries or carriers regarding coordination of electronic transaction testing. 

Providers are developing implementation strategies to achieve compliance 

When asked which strategy the provider was using to implement the HIPAA standards, 

providers most frequently selected the following four: 

1. We will have internal staff plan, develop, and implement the standards. 

2. We will have technical systems consultants work with staff and assist us in the process. 

HIPAA Readiness: Medicare Part A Providers 8 OEI-09-02-00421 
3. We will have a technical systems consultant or vendor take full responsibility for 

planning, developing, and implementing the new standards. 

4. We will purchase components of a new system or additions to our current system from 

a selected vendor to meet the standards. 

Ninety-two percent of the providers are developing an implementation schedule to meet the 

deadline. Sixty-four percent indicated they have purchased or will be purchasing new software, 

hardware, systems components, or a combination thereof. Approximately 56 percent of 

providers are developing a sequencing strategy which will prioritize transactions by order and 

date. 

Providers are using expert resources outside their organization to help implement the HIPAA 

standards and code sets. Eighty-one percent stated that they had turned to their professional 

associations for information to assist them in developing implementation strategies. 

Approximately 84 percent of all providers are using systems vendors as part of their 

compliance strategy. 

Although more than 60 percent of the providers are purchasing new software or system 

components to meet the HIPAA standards, fewer than 20 percent have conducted any type of 

cost benefit analysis for implementing the electronic standards and code sets. 

As part of our assessment, we reviewed the responses from seven questions regarding 

implementation strategies among the survey strata. We found no statistical differences in the 

strategies with the exception of the use of clearinghouses to process some or all of the provider 

claims. Use of a clearinghouse varies by strata, with 49 percent of stratum 1 providers using a 

clearinghouse, 63 percent of stratum 2 providers using a clearinghouse, and 96 percent of 

stratum 3 providers using a clearinghouse. 

Although 96 percent of the providers expect to meet the compliance deadline, 56 percent are 

developing contingency plans in the event their system is not fully compliant by October 2003. 

We found no statistical difference between the strata regarding their development of 

contingency plans. 

External barriers may affect compliance 

When asked to list as many as three barriers to compliance, 60 percent of the providers listed 

one or more. The most common were: 

< Trading partners will not be ready. 

< Vendors will not be ready.

< We have inadequate staffing, training, and technical resources.

HIPAA Readiness: Medicare Part A Providers 9 OEI-09-02-00421 
< We need more time to implement and may experience testing delays. 

Approximately one-third of those who listed any barriers identified their trading partners 

(specifically third party payers, fiscal intermediaries, carriers, and/or CMS) as potential barriers 

to compliance. 

Providers who did not believe they would meet the compliance deadline expressed similar 

concerns. They cited their trading partners as a potential barrier, as well as inadequate 

resources. 

HIPAA Readiness: Medicare Part A Providers 10 OEI-09-02-00421 
CONCLUSION 

Overall, the Medicare Part A providers are making progress toward meeting the compliance 

target of October 16, 2003, for implementing the HIPAA electronic transaction standards and 

code sets. Providers are, however, concerned that their trading partners may not be fully 

compliant, and this would affect their own ability to implement the electronic standards. 

HIPAA Readiness: Medicare Part A Providers 11 OEI-09-02-00421 
APPENDIX A 

Glossary of Selected HIPAA-related Terms and Acronyms 

Administrative Simplification: the use of mandated standards for the electronic exchange of health 

care data and specific measures to protect the security and privacy of personally identifiable health care 

information. 

Clearinghouse: an entity that processes information received from one entity in a nonstandard format 

into a standard transaction, or receives a standard transaction and converts it to a nonstandard format for 

a receiving entity. 

Code Set: the tables of terms, medical concepts, diagnostic codes, or procedure codes and descriptions 

used to encode information in a transaction. 

Contingency Plan: a plan developed by covered entities to provide an alternative for submitting or 

receiving HIPAA electronic transactions after October 2003, in the event that the covered entity’s system 

conversion fails or is incomplete. 

Covered Entity: any health plan, health care clearinghouse, or a health care provider who transmits any 

health information in electronic form in connection with a transaction covered by the HIPAA standards. 

Electronic Data Interchange (EDI): any electronic exchange of formatted data. 

EDI Translator: a software tool for accepting an EDI transmission and converting the data into another 

format, or for converting a non-EDI file into an EDI format for transmission. 

Medicare Part A Provider: hospital, critical access hospital, skilled nursing facility, comprehensive 

outpatient rehabilitation facility, home health agency, or hospice. 

Sequencing: a process plan developed by a covered entity to implement each of the transaction 

standards in a logical sequence. 

Standard Transactions: the exchange of information between two parties that complies with the 

requirements established under HIPAA. 

Trading Partner: an external entity, such as a customer, with whom the covered entity does business. 

A trading partner can be so designated for some purposes and considered a business associate for other 

purposes. 

Translator: See EDI translator. 

Vendor: software and/or hardware entities that provide HIPAA compliant services, consulting, and/or 

products to covered entities. Vendors may be business associates or trading partners. 

HIPAA Readiness: Medicare Part A Providers 12 OEI-09-02-00421 
APPENDIX B 

Confidence Intervals for Key Survey Questions 

The following tables show the point estimates and 95 percent confidence intervals for selected statistics. 

Compliance/ Testing 

Survey Question Response Point 

Estimate 

95 Percent 

Confidence Interval 

Has your organization submitted a 

compliance extension form under the 

Administrative Simplification 

Compliance Act? 

All respondents who 

answered “yes” 96.5% 92.1% - 100.0% 

How ready do you believe your 

organization is, at this point, to 

implement the HIPAA electronic 

transaction standards? 

All respondents who 

answered "5," “4," or “3" on 

a 1 to 5 (for levels of 

satisfaction) 

73.8% 63.8% - 83.7% 

How confident are you that your 

organization will meet the October 2003, 

target for implementing the electronic 

transactions? 

All respondents who 

answered "5," “4," or “3" on 

a 1 to 5 (for levels of 96.1% 91.7% - 100.0% 

satisfaction) 

Has the organization begun any testing 

of its applications of the HIPAA 

electronic transactions? 

All respondents who 

answered "yes" 27.5% 17.3% - 37.7% 

Does your organization have an overall 

strategy for testing its HIPAA 

compliant data systems? 

All respondents who 

answered “completed,” 

“underway,” or “plan to” 

89.5% 82.2% - 96.8% 

Does the testing strategy include 

internal and external data interfaces? 

All respondents who 

answered “completed.” 

“underway,” or “plan to” 84.3% 75.6% - 92.9% 

Has your organization received any 

notices from the fiscal intermediaries or 

carriers regarding coordination of 

testing of HIPAA electronic 

transactions? 

All respondents who 

answered "yes" 

44.2% 32.7% - 55.7% 

HIPAA Readiness: Medicare Part A Providers 13 OEI-09-02-00421 
Strategies/Contingency Planning 

Survey Question Response Point 

Estimate 

95 Percent 

Confidence Interval 

Is your organization currently using 

clearinghouse(s) or other organizations to 

process any part of its HIPAA electronic 

transactions? 

All respondents who 

answered "yes" 53.6% 42.1% - 65.0% 

Is your organization currently working 

with a systems vendor(s) to implement the 

HIPAA electronic standards? 

All respondents who 

answered "completed,” 

“underway,” or “plan to” 

84.0% 75.4% -92.7% 

Has your organization used its 

professional association(s) for information 

to assist you in developing a transaction 

compliance strategy? 

All respondents who 

answered "completed,” 

“underway,” or “plan to” 81.2% 72.0% - 90.4% 

Has your organization created a schedule 

to implement the changes in its data 

system to comply with the HIPAA 

electronic transaction standards deadline? 

All respondents who 

answered "completed,” 

“underway,” or “plan to” 92.4% 86.2% - 98.5% 

Has your organization purchased new 

software, hardware, or system 

component(s) to meet transaction 

compliance requirements 

All respondents who 

answered "completed,” 

“underway,” or “plan to” 64.0% 53.0% - 75.1% 

Have you, your contracted vendor(s), or 

any consultants conducted a cost/benefit 

analysis for implementing the HIPAA 

electronic transaction standards? 

All respondents who 

answered “yes” 18.0% 7.8% - 28.2% 

Has your organization developed a 

contingency plan in the event its system is 

not compliant by October 2003? 

All respondents who 

answered "completed,” 

“underway,” or “plan to” 55.9% 44.4% - 67.3% 

Barriers 

Survey Question Response Point 

Estimate 

95 Percent 

Confidence Interval 

How satisfied are you with the resources 

your organization is committing to meet 

the HIPAA electronic transaction 

standards? 

All respondents who 

answered "5," “4," or “3" on 

a 1 to 5 (for levels of 

satisfaction) 

96.8% 93.4% - 100.0% 

HIPAA Readiness: Medicare Part A Providers 14 OEI-09-02-00421 
We compared responses among the three strata of providers, stratum1 (less than 

1,500 claims), stratum 2 (1,501 to 17,500 claims) and stratum 3 (more than 17,500 claims) for

the 7 following questions, which we thought might show significant differences among strata. 

Only the first question is statistically significant at the

95 percent confidence level. Using the Bonferroni method for multiple comparisons, a

comparison was statistically significant if the p-value was less than 0.05 divided by 7 or

approximately 0.007.

Compliance/ Testing 

Survey Question Measurement Point 

Estimate 

Chi-Square Test 

Degrees of 

Freedom P-value 

How confident are you that your 

organization will meet the October 

2003, target for implementing the 

electronic transactions? 

All respondents who 

answered “5," “4," or 

“3" on a 1 to 5 (for 

levels of satisfaction) 

96.0 stratum 1 

96.0 stratum 2 

98.0 stratum 3 2 0.774 

Has your organization begun any 

testing of its applications of HIPPA 

electronic transactions? 

All respondents who 

answered “completed,” 

“underway,” or “plan 

to” 

28.0 stratum 1 

26.0 stratum 2 

24.0 stratum 3 2 0.902 

Strategies/Contingency planning 

Survey Question Measurement Point 

Estimate 

Chi-Square Test 

Degrees of 

Freedom P-value 

Is your organization currently using 

clearinghouse(s) or other 

organizations to process any part of its 

HIPAA electronic transactions? 

All respondents who 

answered "yes" 

49.0 stratum 1 

63.5 stratum 2 

96.0 stratum 3 2 <.001 

Has your organization identified the 

steps necessary to implement the 

HIPAA electronic standards? 

All respondents who 

answered "yes" 

94.0 stratum 1 

98.0 stratum 2 

100.0 stratum 3 2 0.132 

Does your organization have an 

ongoing analysis process to identify 

potential gaps in its existing system? 

All respondents who 

answered “completed,” 

“underway,” or “plan 

to” 

84.0 stratum 1 

90.0 stratum 2 

98.0 stratum 3 2 0.021 

Does your organization have a 

sequencing (prioritization) strategy for 

implementing the HIPAA electronic 

transactions? 

All respondents who 

answered "yes" 

55.3 stratum1 

51.1 stratum 2 

75.0 stratum 3 2 0.028 

Has your organization developed a 

contingency plan in the event the 

system is not compliant by October 

2003? 

All respondents who 

answered “completed,” 

“underway,” or “plan 

to” 

53.1 stratum 1 

62.5 stratum 2 

80.0 stratum 3 

2 0.011 

HIPAA Readiness: Medicare Part A Providers 15 OEI-09-02-00421 
ACKNOWLEDGMENTS 

This report was prepared under the direction of Paul A. Gottlober, Regional Inspector General 

for Evaluation and Inspections, and Deborah W. Harvey, Assistant Regional Inspector General 

for Evaluation and Inspections, in San Francisco. Other principal Office of Evaluation and 

Inspections staff who contributed include: 

Timothy Brady, Project Leader Linda Frisch, Program Specialist

Silvia Chin, Program Analyst

Robert Gibbons, Program Analyst

Cheryl Dotts, Program Assistant

For information or copies of this report, please contact

the Office of Inspector General’s

Public Affairs office at (202) 619-1343.

Reports are also available on the World Wide Web at our home page address:

http://www.oig.hhs.gov/ 

HIPAA Readiness: Medicare Part A Providers 16 OEI-09-02-00421