HIPAA Electronic Transactions & Code Sets 

 

Volume 1 – Paper 9 1 May, 2003 

 HHHIIIPPPAAAAAA IIINNNFFFOOORRRMMMAAATTTIIIOOONNN SSSEEERRRIIIEEESSS

9. Final Steps For Compliance

This paper is the ninth in a series of 

informational papers developed by the 

Centers for Medicare & Medicaid Services 

(CMS) to communicate to the health care 

community key concepts and 

requirements contained in HIPAA -- the 

Health Insurance Portability and 

Accountability Act of 1996. This paper 

highlights the final steps for complying 

with the electronic transactions and code 

sets requirements. 

Moving towards compliance 

In the first eight papers, CMS outlines the steps providers must undergo to 

implement HIPAA’s electronic transactions and code sets standards. At this 

stage of HIPAA implementation: 

 You have determined if you are a 

covered provider. 

 You should be compliant with 

HIPAA’s privacy requirements. 

 Your practice and your information systems are tested (or are in the 

process of being tested) and will be ready to conduct HIPAA 

compliant transactions effective October 16, 2003. 

 You have identified your staff training needs and are implementing 

any necessary changes in operational policies and procedures. 

 You are preparing to research other HIPAA provisions that may 

affect your practice. 

Review the Transactions & Code Sets Modification Rule 

This final rule published February 20, 2003 makes some important changes 

to the HIPAA electronic transactions and code sets standards that were 

published in August 2000. After the first regulation was published, many of 

the larger health care entities began the process of implementing the 

standards. It became clear that certain standards did not work for everyone 

and industry experts and HHS proposed changes be made to the regulation. 

This regulation is the result of that collaborative effort.

A Challenge 

and 

 Opportunity 

for the Health 

Care Industry

 

1. HIPAA 101 

2. Are you a 

covered entity? 

3 Key HIPAA dates 

and tips for 

getting ready 

4. What electronic 

transactions and 

code sets are 

standardized 

under HIPAA? 

5. Is your software 

vendor or billing 

service ready for 

HIPAA?

6. What to expect 

from your health 

plans 

7. What you need to 

know about 

testing 

8. Trading Partner 

Agreements 

9. Final steps for 

compliance with 

Electronic 

Transactions and 

Code Sets

10. Enforcement 

HIPAA

INFORMATION 

SERIES TOPICS 

PRIVACY DEADLINE 

April 14, 2003

For more information on 

Privacy:http://www.hhs.gov/

ocr/hipaa

Or call 1-866-627-7748 

IMPORTANT DEADLINES

April 16, 2003 

Begin Testing 

October 16, 2003 

Compliance with Electronic 

Transactions & Code Sets 
 HIPAA Electronic Transactions & Code Sets 

 Final Steps For Compliance 

Volume 1 – Paper 9 2 May, 2003 

The primary change involves covered entities 

that bill drugs and biologics. In the original 

law the National Drug Code (NDC) was the 

adopted standard for doctors and hospitals, 

as well as for the retail pharmacy sector. 

Industry groups and Government experts 

concluded that, at this time, the National Drug 

Codes would be too expensive for hospitals 

and doctors to implement and would not 

enhance their business processes. This 

regulation repeals the National Drug Code standard for those entities. The 

National Drug Codes will remain the standard for the retail pharmacy drug 

claim, and there will be no standard code set adopted for non-retail pharmacy 

drug claims. Based on this appeal, we would expect hospitals and doctors to 

continue to code and bill drugs and biologics using their current practices. 

What are the addenda? 

Changes to the initial electronic standards were 

adopted in the February 20, 2003 Modification 

Rule. The modifications were approved by 

industry groups and facilitate implementation of 

the adopted standards. These changes are 

detailed in documents called “addenda.” The 

addenda supplement the original implementation guides, which provide the 

technical details for each standard. The original implementation guides for 

HIPAA’s electronic transactions and code sets are known as version 4010. 

The subsequent addenda are referred to as version 4010A. The addenda 

also adopt modified standards for two transactions that were not included in 

the proposed modifications rule – Premium Payments and Coordination of 

Benefits. For more information on the implementation guides and addenda 

for the transactions providers use most frequently, see paper 4 in this series, 

“Overview of electronic transactions and code sets.” 

Stay tuned for the Medicare Electronic Billing 

Requirement final rule 

Effective October 16, 2003, HIPAA law requires that all claims submitted to 

Medicare be submitted electronically in the HIPAA standard format 

(with the exception of those from certain small providers and under other 

limited circumstances.) 

The rule detailing the new Medicare electronic billing requirement is currently 

being finalized. You will receive more information on this provision in 

upcoming Medicare provider bulletins. You may also sign up for the HIPAA 

regulation ListServe that will notify you when any HIPAA rules are published: 

http://www.cms.hhs.gov/hipaa/hipaa2/regulations/lsnotify.asp. 

1. Claims or 

equivalent 

encounter 

information 

2. Payment and 

remittance advice 

3. Claim status 

inquiry and 

response 

4. Eligibility inquiry 

and response 

5. Referral 

certification and 

authorization 

inquiry and 

response 

6. Enrollment and 

disenrollment in a 

health plan 

7. Health plan 

premium payments 

8. Coordination of 

benefits 

Pending approval: 

9. Claims 

attachments 

10. First report of injury

1. Physician services/ 

other health 

services- both 

 HCPCS and CPT-4 

2. Medical supplies, 

orthotics, and DMEHCPCS 

3. Diagnosis codes- 

 ICD-9-CM,Vols 1&2 

 

4. Inpatient hospital 

procedures– 

ICD-9-CM,Vol 3 

5. Dental services– 

Code on dental 

procedures and 

nomenclature

6. Drugs/biologics– 

NDC for retail 

pharmacy

STANDARD 

TRANSACTIONS TIP: The National Drug 

Codes will remain the 

standard for the retail 

pharmacy drug claim, 

and there will be no 

standard code set 

adopted for non-retail 

pharmacy drug claims.

TIP: The original 

implementation guides 

are known as version 

4010. The addenda, 

which supplement the 

guides, are referred to 

as 4010A.

CODE SETS
 HIPAA Electronic Transactions & Code Sets 

 Final Steps For Compliance 

Volume 1 – Paper 9 3 May, 2003 

Unique identifiers requirements 

HIPAA also requires the use of unique 

identifiers to clearly identify entities within 

the health care delivery system. The 

Provider Identifier Standard Final Rule 

and the Health Plan Identifier Proposed 

rule are in the process of being finalized. 

Once adopted, these identifiers will be 

used in HIPAA transactions.

Plan for the security 

requirements 

The security standards work in concert with the final privacy standards 

adopted by HHS last year. The two sets of standards use many of the same 

terms and definitions in order to make it easier for covered entities to comply.

The final security standards for HIPAA were 

published on February 20, 2003. Under this 

rule, health plans, payers, clearinghouses, and 

certain health care providers must establish 

procedures and mechanisms to protect the 

confidentiality, integrity and availability of 

electronic Protected Health Information (PHI.) 

Most covered entities will have two full years – 

until April 21, 2005 -- to comply with the 

standards; small health plans will have an 

additional year to comply. 

Review the final security standards 

As the health care industry evolves and continuously relies upon the 

use of technology, the security standards will play an important role in 

protecting electronic data at rest and in transit. The standards were 

developed to promote the protection of electronic protected health 

information by: 

9 Providing for electronic data integrity and confidentiality, 

9 Allowing only authorized individuals access, and 

9 Ensuring its availability. 

The security standards are scalable and technology neutral. This 

means that covered entities should take into account their size, 

complexity, capabilities and potential risks to their electronic Protected 

Health Information when complying with the standards. The standards 

do not specify any particular technology. In other words, they outline 

what must be done -- not how to do it. The security standards require 

covered entities to implement safeguards within three categories: 

TIP: For a copy of the 

Security Rule and the 

Transaction and Code 

Sets Modifications Rule 

visit the CMS web site: 

http://www.cms.hhs.gov/

hipaa/hipaa2

TIP: The final National 

Employer Identifier Rule 

compliance date is July 30, 

2004. The National 

Employer ID will use the 

Internal Revenue Service’s 

Employer Identification 

Number (EIN) for this 

number. 

http://www.cms

.hhs.gov/hipaa/

hipaa2

• Covered entity 

decision 

tool 

• Provider 

readiness 

checklist 

• CMS Outreach 

ListServe 

• HIPAA 

roundtable audio 

conference 

dates 

• HHS HIPAA 

links 

• Instructional 

CDs & videos 

• HIPAA FAQs & 

compliance 

dates 

• Complaint 

submission form 

EDI can eliminate the 

inefficiencies of 

handling paper 

documents. It 

reduces 

administrative 

burden, lowers 

operating costs and 

improves overall data 

quality.

Information & Tools 

Available at the 

CMS Web Site 

TIP 
 HIPAA Electronic Transactions & Code Sets 

 Final Steps For Compliance 

Volume 1 – Paper 9 4 May, 2003 

 Administrative safeguards - management of the selection 

and execution of security measures. 

 Physical safeguards - protections for electronic systems and 

related buildings and equipment from environmental hazards 

and unauthorized intrusion. 

 Technical safeguards - automated processes to protect data 

and control access to it. 

Focus on operational improvements 

For providers to yield the most benefit from HIPAA, they should shift their 

focus to the opportunities for operational improvements and long-term 

business strategies. HIPAA’s administrative simplification requirements can 

be the catalyst for many of the following improvements to your operations: 

3⁄4 Get faster, easier, more accurate eligibility information 

3⁄4 Reduce claim denials due to ineligibility 

3⁄4 Improve the process for obtaining prior authorization and referrals 

3⁄4 Reduce claim denials because of authorization or referral issues 

3⁄4 Make claim submission faster, more efficient and with less errors 

3⁄4 Eliminate the use of local codes 

3⁄4 Use the same set of codes with all health plans 

3⁄4 Get electronic remittance advices from health plans 

3⁄4 “Auto-post” payments to your system – quickly and accurately 

3⁄4 Electronically request claim status information 

3⁄4 Reduce the costs of your claims processing and free up valuable staff 

resources, while protecting the security and privacy of health care 

information. 

Log onto the CMS HIPAA web site and sign up for our ListServe:

http://www.cms. hhs.gov/hipaa/hipaa2

 

 E-mail your questions to askhipaa@cms.hhs.gov

Call the CMS HIPAA HOTLINE 1-866-282-0659

April 14, 2003

Privacy 

Deadline 

(April 14, 2004 for 

small health plans) 

April 16, 2003

Testing 

You should start testing 

your software no later 

than April 16, 2003. 

October 16, 2003

Electronic Transactions 

& Code Sets Deadline 

NOTE: Medicare will 

require that all Medicare 

claims be submitted 

electronically, with the 

exception of those from 

small providers and 

under certain limited 

circumstances. 

July 30, 2004

National Employer 

Identifier 

(August 1, 2005 

for small health plans) 

April 21, 2005

Security 

Deadline 

(April 21, 2006 for small 

health plans) 

HIPAA 

Deadlines