Final HIPAA security standards released
HHS repeals National Drug Code as standard
The final security standards and transaction modifications for electronic health information are here at last. And non-retail pharmacies should be happy to hear that the U.S. Department of Health and Human Services (HHS) has repealed the National Drug Code (NDC) as the standard medical data code set for reporting drugs and biologics in all non-retail pharmacy transactions.
On Feb. 13, HHS announced the adoption of final security standards for protecting individually identifiable health information when it is maintained or transmitted electronically. At the same time, HHS announced the adoption of modifications to a number of the electronic transactions and code sets adopted as national standards. Both final regulations are required as part of the administrative simplification provisions contained in the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The security standards were published in the Feb. 20 Federal Register and have an effective date of April 21, 2003. Most covered entities will have two years to comply with the standards; small health plans will have an additional year to comply, as HIPAA stipulates.
Many health care providers, however, fear that the delays in the publication of the final HIPAA privacy rule (effective for most covered entities on April 14) and the security standards will make it more difficult for providers to become compliant by the deadline.
Under the security standards, health insurers, certain health care providers, and health care clearinghouses must establish procedures and mechanisms to protect the confidentiality, integrity, and availability of electronic protected health information. The rule requires covered entities to implement administrative, physical, and technical safeguards to protect electronic protected health information in their care.
The security standards are related closely to the final privacy standards. The two sets of standards use many of the same terms and definitions to make it easier for covered entities to comply.
In modifying the proposed transaction rule, HHS says it worked extensively with the Designated Standards Maintenance Organizations. By law, health plans, certain health care providers, and health care clearinghouses must use the final transaction standards for electronic health care transactions. Covered entities must comply with these modified transaction standards by Oct. 16, 2003.
Non-retail pharmacy settings will remain pretty much business as usual since HHS repealed the NDC standard in the final rule, says Lynne Gilbertson, director of standards development for National Council for Prescription Drug Programs in Scottsdale, AZ.
In the rule, HHS says it is aware that "retaining the NDC as the sole standard for institutional claims would pose significant operational issues for institutional pharmacies because of systems incompatibility among pharmacies, inpatient medical records, and inpatient accounting systems."
The NDC formats do not provide information related to actual dosages administered or provide a methodology for multiple billing increments, HHS says. "Attempts by the industry to develop a complete crosswalk from the current HCPCS [Healthcare Common Procedure Coding System] codes to the NDC have been unsuccessful."
HHS wanted to give covered entities the full range of choices in determining which code set to use with respect to claims. However, the rule does caution non-retail pharmacies about using "local codes," Gilbertson says. In the rules, HHS says covered entities that use HCPCS should use the established process for requesting new codes, rather than supplementing the code sets with locally developed ones.
The final security standards and transaction modifications for electronic health information are here at last.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content