HIPAA Electronic Transactions & Code Sets 

Volume 1 – Paper 2 1 May, 2003 

 HHHIIIPPPAAAAAA IIINNNFFFOOORRRMMMAAATTTIIIOOONNN SSSEEERRRIIIEEESSS

2. Are You A Covered Entity?

This is the second paper in a series of 

papers developed by the Centers for 

Medicare and Medicaid Services (CMS) to 

help providers understand what the Health 

Insurance Portability and Accountability Act 

of 1996 (HIPAA) and the Administrative 

Simplification provisions of HIPAA means 

for their practices. 

HIPAA may affect your office in many ways. It mandates new standards and 

procedures that will take time, money and resources to implement. However, 

at the same time, HIPAA offers opportunities to reduce costs, automate 

processes, lower errors and improve service. To take advantage of HIPAA’s 

benefits, the first question a provider should ask is “does HIPAA apply to me 

in my current business environment?” 

Covered Entities 

As discussed in the first paper, “HIPAA 101 

for Providers’ Offices,” HIPAA changes the 

way organizations deal with people’s health 

care information. The law affects many health 

care industries -- health plans, 

clearinghouses, health care service providers (including hospitals and doctors 

and the companies that furnish information technology products and services 

to them.) As a result, HIPAA plays an important role in a wide range of 

organizations. This includes health plans, payers, providers, clearinghouses, 

health care information system vendors, billing agents and other service 

organizations. 

HIPAA law and regulations apply to several different types of organizations 

commonly referred to as “covered entities”. The law applies directly to three 

groups of “covered entities.” 

3⁄4 Health Care Providers: Any provider of medical or other health 

services, or supplies, who transmits any health information in 

electronic form in connection with a transaction for which standard 

requirements have been adopted. 

3⁄4 Health Plans: Any individual or group plan that provides or pays the 

cost of health care. 

3⁄4 Health Care Clearinghouses: A public or private entity that transforms 

health care transactions from one form to another.

A Challenge 

and 

 Opportunity 

for the Health 

Care Industry

 

1. HIPAA 101

2. Are you a 

covered entity?

3 Key HIPAA dates 

and tips for 

getting ready 

4. What electronic 

transactions and 

code sets are 

standardized 

under HIPAA? 

5. Is your software 

vendor or billing 

service ready for 

HIPAA? 

6. What to expect 

from your payers 

7. What you need to 

know about 

testing 

8. Trading Partner 

Agreements 

9. Final steps for 

compliance with 

Electronic 

Transactions and 

Code Sets 

10. Enforcement 

HIPAA

INFORMATION 

SERIES TOPICS 

HIPAA Administrative 

Simplification is a landmark 

law that promotes 

standardization and efficiency 

in the health care industry. 

TIP: HHS has developed a 

“Covered Entity Decision 

Tool” for providers. Visit 

http://www.cms.hhs.gov/hipaa

/hipaa2 to access this tool 

and other educational 

materials.
 HIPAA Electronic Transactions & Code Sets 

 Are You A Covered Entity? 

Volume 1 – Paper 2 2 May, 2003 

Does HIPAA apply to me? 

It is important to note that HIPAA directly and indirectly affects many in the 

health care industry. For instance, software billing vendors and third party 

billing services that are not clearinghouses (or another type of covered entity) 

will not be required to comply with this law; however, they may need to make 

changes in order to continue to do 

business with someone who is 

“covered” by HIPAA. 

If you are a provider who transmits (or 

a third party biller or clearinghouse 

does so on your behalf) one or more 

of the transactions listed on the left 

electronically you are most likely 

covered by HIPAA 

Health care providers are not required 

by HIPAA to conduct any transaction 

electronically (though you may be required to file Medicare claims 

electronically, a topic discussed later in this paper). However, if you do 

conduct one or more of the above transactions electronically, you will need to 

start doing so in the HIPAA standardized electronic format. 

What are Electronic Transactions? 

Electronic transactions are activities involving the transfer of electronic 

information for specific purposes. As a provider you may have access to 

several sources of health care data that are moved electronically. 

 

3⁄4 Electronic Data Interchange (EDI) 

Electronic Data Interchange (EDI) is the leading 

media for electronic transactions. It is the term 

used for the technology that allows for the 

movement of electronic data between two 

entities. For example, if you send claims 

electronically to a payer you are using EDI 

technology. To simplify this EDI process, HIPAA identifies sets of data 

that form the ten standard transactions, such as claim or remittance 

advice. With HIPAA, a provider or payer would only need one method for 

translating the information received. The industry groups that HIPAA 

named as responsible for developing EDI standards are the ANSI 

Standards Development Organization (SDO) and the Data Content 

Committees (DCC). Together these groups form the Designated 

Standards Maintenance Organizations (DSMOs). 

HIPAA paves 

the way for 

standardization 

in the health 

care industry 

1. Claims or 

equivalent 

encounter 

information 

2. Payment and 

remittance advice 

3. Claim status 

inquiry and 

response 

4. Eligibility inquiry 

and response 

5. Referral 

certification and 

authorization 

inquiry and 

response 

6. Enrollment and 

disenrollment in a 

health plan 

7. Health plan 

premium payments 

8. Coordination of 

benefits 

Pending approval: 

9. Claims 

attachments 

10. First report of injury

1. Physician services/ 

other health 

services- both 

 HCPCS and CPT-4 

2. Medical supplies, 

orthotics, and DMEHCPCS 

3. Diagnosis codes- 

 ICD-9-CM,Vols 1&2 

 

4. Inpatient hospital 

procedures– 

ICD-9-CM,Vol 3 

5. Dental services– 

Code on dental 

procedures and 

nomenclature

6. Drugs/biologics– 

NDC for retail 

pharmacy

Standard 

Transactions 

Code Sets 

Note: Providers generally perform 

only the transactions listed below. 

- Claims or managed care 

encounter information 

- Transmit payment and remittance 

advice 

- Claim status inquiry 

- Eligibility inquiry 

- Referral authorizations
 HIPAA Electronic Transactions & Code Sets 

 Are You A Covered Entity? 

Volume 1 – Paper 2 3 May, 2003 

For each transaction identified, there are 

standards that: 

• specify the format, 

• the data elements required to 

structure the format, 

• the data content required for each of 

the transactions. 

3⁄4 Web-based Applications

In addition to EDI, some health plans and payers provide web-based 

applications that allow a provider to enter transaction data. These 

applications enable your office to transmit electronic information via the 

Internet. For example, if you check a patient’s eligibility for health 

insurance by using a computer that sends information across the internet, 

you are conducting an electronic transaction. 

3⁄4 Direct Data Entry (DDE)

Direct data entry (DDE) is a way for providers to key data directly into a 

computer screen or web browser form and send it immediately to a health 

plan’s computer. Many payers supply a “dumb” terminal that is connected 

directly to their mainframe computer. The terminal is in essence a remote 

extension of the payers computer system. The provider keys in one claim 

at a time for immediate transmission into the health plan’s or payer’s 

computer. This type of direct data entry screens must adhere to the 

HIPAA data content requirements. However, if the data is directly 

entered into a system and is transmitted later to the health plan, the 

transaction must be sent in the full format and content standard. 

Any other transmission of HIPAA transactions by EDI, web-based 

applications, or any other covered electronic media listed in the box to the 

left, must be accomplished using HIPAA standards. 

Are all providers covered by HIPAA? 

Many providers are covered by HIPAA. However, if you are a provider and 

do not conduct any of the covered transactions electronically, as described 

above, then you may not be covered by HIPAA. In other words, if your office’s 

business activities and health care transactions are all conducted by paper, 

telephone or FAX (from a dedicated fax machine, as opposed to faxing from 

a computer,) HIPAA does not apply to you and you are not required to meet 

the other HIPAA requirements like privacy and security. 

• Electronic Data 

Interchange 

(EDI) technology 

• The Internet & 

web-based 

applications 

• Direct Data 

Entry (DDE) 

dial-up modem 

• Sending a 

diskette/tape 

• Using a credit 

card swipe 

machine /Point 

of Service (POS) 

• Using “faxback” 

telephone voice 

response 

• Workers 

compensation 

programs 

• Property and 

casualty insurers 

• Self -

administered 

Health plans 

with fewer than 

50 participants 

• Providers who 

conduct all 

standard 

transactions by 

paper, telephone 

or FAX (from a 

dedicated fax 

machine) 

Who is not covered 

by HIPAA? 

TIP: Direct Data Entry 

systems must comply 

with HIPAA’s content 

requirements. Find out if 

your health plans will 

continue to offer and 

support their Direct Data 

Entry applications. 

Sources of 

Electronic 

Media 
 HIPAA Electronic Transactions & Code Sets 

 Are You A Covered Entity? 

Volume 1 – Paper 2 4 May, 2003 

Covered entity final review: 

Are you a provider who must comply with HIPAA? Do you or does your 

organization: 

 Provide health care?

Common examples include physicians, dentists, nurses, mental 

health providers, radiology centers, laboratories, pharmacies, durable 

medical equipment providers, hospitals, and other types of health care 

providers. Also included are services that are not commonly thought 

of as “health care” such as ambulance companies, home health 

workers, case managers, and social workers. 

 Conduct one or more standard HIPAA transactions? (or pay 

someone to conduct on your behalf, such as a billing service or 

clearinghouse?) Refer to the list of Standard Transactions listed on 

page two of this paper. 

 Conduct standard transactions in electronic form? (or pay 

someone that conducts your transactions in electronic form, such as a 

billing service or clearinghouse?) Review the types of electronic 

media used in your organization. 

If you checked all three boxes, then you are likely a provider who is a covered 

entity. Covered providers are subject to all HIPAA regulations --transactions, 

privacy, security, identifiers, and any others to come. 

New Medicare electronic requirements 

HIPAA provides a standardized, 

effective means for physicians, 

practitioners, suppliers, and other 

health care providers to submit 

Medicare claims electronically to all 

payers with which they interact. 

Effective October 16, 2003, HIPAA 

law requires that all claims submitted 

to Medicare be submitted electronically in the HIPAA standard format. At that 

time, Medicare will no longer accept paper claims (with the exception of 

certain small providers and other limited circumstances.) The rule detailing 

the new Medicare electronic requirement is currently being finalized. You will 

receive more information on this provision in upcoming Medicare provider 

bulletins. 

Effective October 16, 2003 -

Medicare will require that all 

Medicare claims be submitted 

electronically, with the 

exception of those from small 

providers and under certain 

limited circumstances. 

http://www.cms

.hhs.gov/hipaa/

hipaa2

• Covered entity 

decision 

tool 

• Provider 

readiness 

checklist 

• CMS Outreach 

ListServe 

• HIPAA 

roundtable audio 

conference 

dates 

• HHS HIPAA 

links 

• Instructional 

CDs & videos 

• HIPAA FAQs & 

compliance 

dates 

• Complaint 

submission form 

• http://www.hhs.

gov/ocr/hipaa/

or call the Privacy 

hotline at : 

1-866-627-7748 

Information & Tools 

Available at the 

CMS Web Site 

For HIPAA 

Privacy inquires
 HIPAA Electronic Transactions & Code Sets 

 Are You A Covered Entity? 

Volume 1 – Paper 2 5 May, 2003 

 

The new Medicare electronic requirements will 

reduce the administrative burden and 

paperwork associated with Medicare claims 

submission. Moving from paper to electronic 

claims has the potential for significant savings 

and efficiencies for Medicare physicians, 

suppliers, and other health care providers – as 

well as for the Medicare program itself. 

Please note that this provision only applies to Medicare claims. However, it 

does not prevent any providers from submitting paper claims to other health 

plans that accept paper claims. Also note that health plans are not required to 

accept paper claims and most are moving to the more efficient and cost 

effective electronic methods. 

Medicare small providers and suppliers 

HIPAA law provides an exception for small 

providers and suppliers who meet specific 

size requirements. The following small 

providers and suppliers may continue to 

submit paper claims to Medicare. 

The law defines a small provider or supplier 

as: 

3⁄4 A provider of services with fewer 

than 25 full-time equivalent 

employees, or 

3⁄4 A physician, practitioner, facility or supplier (other than a provider of 

service) with fewer than 10 full-time equivalent employees. 

Be aware that even small providers and suppliers, as defined above, are still 

subject to HIPAA requirements if they are “covered entities”. For example, 

you may be a physician with fewer than 10 employees who submits claims to 

Medicare electronically. In this case, you are also a covered entity under 

HIPAA. 

Likewise, you may be a small provider who currently submits only paper 

claims to Medicare. However, you check a patient’s eligibility for Medicare 

electronically. You are also a “covered entity” and must comply with HIPAA’s 

other requirements, such as privacy and security. 

TIP: CMS offers 

providers free and low 

cost Medicare billing 

software, visit: 

http://www.cms.hhs.gov/

providers/edi for more 

information. 

TIP: [from the SSA Sec. 1861 

(u)] The term "provider of 

services" means a hospital, 

critical access hospital, skilled 

nursing facility, comprehensive 

outpatient rehabilitation facility, 

home health agency, hospice 

program, or, for purposes of 

section 1814(g) and section 

1835(e), a fund. 

April 14, 2003

Privacy 

Deadline 

April 16, 2003

Testing 

You should start testing 

your software no later 

than April 16, 2003. 

October 16, 2003

Electronic 

Transactions 

 & Code Sets 

Deadline 

NOTE: Medicare will 

require that all Medicare 

claims be submitted 

electronically, with the 

exception of those from 

small providers and 

under certain limited 

circumstances. 

April 21, 2005

Security 

Deadline 

(April 21, 2006 

 for small plans) 

 

TIP: You may also 

sign up for the HIPAA 

regulation ListServe at: 

http://www.cms.hhs.gov

/hipaa/hipaa2/regulation

s/lsnotify.asp. 

This email service will 

notify you when any 

HIPAA regulations are 

published. 

HIPAA 

Deadlines
 HIPAA Electronic Transactions & Code Sets 

 Are You A Covered Entity? 

Volume 1 – Paper 2 6 May, 2003 

What if I just continue to submit claims on paper?

While you and other health care providers could 

continue to conduct solely paper transactions – 

doing so would have many negative effects for 

most providers, particularly for those providers 

who receive Medicare payments. 

Effective October 16, 2003, Medicare is 

prohibited by law from paying paper claims 

except for those from small providers and under certain other limited 

circumstances. After that date, any provider that does not meet the “small 

provider” or other exception would have to submit electronic claims 

submission in order to continue to receive Medicare reimbursement. At that 

time, the provider would be required to comply with the Privacy rule 

requirements. 

Perhaps most importantly, electronic transactions can eliminate the 

inefficiencies of handling paper documents. They can reduce administrative 

burden, lower operating costs and improve overall data quality – significant 

benefits for today’s health care providers. In addition, Medicare providers 

who bill electronically are paid faster than paper billers. By law, Medicare 

paper claims are not paid until 28 days after receipt, while electronic claims 

can be paid after 14 days. 

 

FOR MORE INFORMATION ABOUT HIPAA... 

Log onto the CMS HIPAA web site:

http://www.cms.hhs.gov/hipaa/hipaa2

 

 E-mail your questions to askhipaa@cms.hhs.gov

Call the CMS HIPAA HOTLINE 1-866-282-0659

Q. Does HIPAA only 

apply to those who 

bill Medicare and 

Medicaid? 

A. NO. HIPAA is a 

law that applies to 

the public and 

private health care 

systems. 

 

Q. Does HIPAA 

require health care 

providers to conduct 

all electronic 

transactions 

electronically? 

A. NO. HIPAA does 

not require a health 

care provider to 

move from a paper 

office to an 

electronic office. It 

does require a 

provider to submit 

claims electronically 

to Medicare, with the 

exception of those 

from small providers 

and under certain 

other limited 

circumstances. 

Q & A 

TIP: Paper claims are 

quickly being replaced by 

new technologies in 

electronic data 

interchange (EDI) and the 

Internet.