Schedule outlines dates for release of HIPAA rules
The U.S. Department of Health and Human Services (HHS) in Washington, DC, has released a tentative schedule for its final standards on electronic health information, as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Notices of Proposed Rule Making (NPRMs) that already have been published and their expected final dates are: Transactions and Coding, November 1999; National Provider Identifier, December 1999; National Employers Identifier, December 1999; Security, December 1999.
Here is the schedule for NPRMs still in development: National Health Plan Identifier, tentative rule December 1999, final rule May 2001; Claims Attachments, preliminary rule September 1999, final rule September 2000.
HHS says the length of time from the publication of the NPRMs to the publication of the final rule is needed to review and respond to the large number of comments received on the NPRMs. In addition, the rules need to be reviewed not only within HHS and a number of its subordinate agencies, but also by several other federal departments affected by the rules.
Standards are required to be implemented within two years of the effective date of the final rule, generally 60 days after publication of the rule. However, the effective date for the National Provider Identifier is planned to be no earlier than July 2000, to give HHS enough time to develop the system for implementing the identifier.
Start preparing now
The American Health Information Manage ment Association (AHIMA) in Chicago has updated its checklist of how to prepare for some of the categories, and has added steps to prepare for the electronic signature standard. Here is the new version, as prepared by Sandra Fuller, MA, RRA, vice president of practice leadership, and Julie J. Welch, RRA, an HIM practice manager for AHIMA:
General
• Assign responsibility for tracking the progress of regulations as they develop.
• Continue to inform key internal stakeholders about HIPAA and its impact on your information systems and processes.
• Seek current information on the industry's approach to HIPAA compliance.
• Develop resources — such as publications, seminars, Web sites, and professional networking — to facilitate development of your approach to meeting HIPAA requirements.
• Plan internal educational programs to describe HIPAA requirements to those responsible for implementing the changes.
• Obtain and read copies of the proposed rules from the Federal Register, which can be accessed via the Health Care Financing Admini stra tion's (HCFA) Web site at http://www.hcfa.gov.
• Read the reports and recommendations from the National Committee on Vital and Health Statistics (NCVHS). The NCVHS serves as the statutory public advisory body to the Secretary of Health and Human Services in the area of health data and statistics. (The reports and recommendations can be accessed via the NCVHS Web site at http://aspe.os.dhhs.gov/ncvhs through NCVHS Reports and Recommendations.)
• Obtain and read a copy of the Internet Security Policy from HCFA's Web site.
• Meet with key staff in information services to discuss the requirements, identify the people who need to be involved, and develop a plan of action. Share sections of the Federal Register with individuals who need to be involved in preparing for the regulations.
• Perform a gap analysis of your existing policies and procedures compared to the requirements of the proposed standards.
• Have individuals who need to be involved send you copies of their policies and procedures that address the requirements.
• Develop a checklist to help identify those policies and procedures you will need.
Standardization of code sets
• Monitor payer compliance with official coding guidelines.
• Perform regular coding quality control studies.
• Provide feedback on documentation issues that have an impact on the quality of coded data.
• Routinely train coding staff on current coding practice.
• Provide access to resources on coding guidelines and best practices. Efficiently update the ICD-9-CM codes in October and the CPT-4 codes (for both transaction and analysis systems) in January.
Health care identifiers
• Become familiar with the Notice of Proposed Rule Making for the employer identifier number, the taxpayer identification number for employees that is assigned by the Internal Revenue Service.
• Read the Notice of Proposed Rule Making for the national provider identifier.
• Assess the quality of the master person index (MPI).
• Perform required cleanup and eliminate duplications in the MPI.
• Institute procedures to maintain the integrity of the MPI.
• Train staff on the importance of data quality in an MPI.
• Make necessary data quality improvements in registration systems.
• Assign responsibility for the maintenance of MPI data integrity.
• Perform routine data integrity checks on the provider database.
• Develop effective procedures to maintain provider tables.
• Integrate or interface provider tables with necessary systems.
• Monitor data quality for unique personal identification numbers (UPINs) on billing documents.
• Provide easy access to UPIN tables.
• Maintain current, complete payer tables.
• Perform data quality checks on payer data entry.
• Develop feedback loops from the billing process to data collection processes regarding payer data.
Claims transactions
• Maintain effective communication regarding claims processing with all affected parties.
• Perform routine maintenance on the charge master.
• Use electronic claims processing and electronic data interchange.
• Explore feasibility of converting to electronic claims processing or outsourcing that function.
• Have comprehensive documentation of claims processing.
• Routinely monitor remittance information against claims data.
• Have an effective process for handling rejected claims.
• Aggregate data about rejected claims to improve claims processing.
• Become familiar with transaction standards and standards development organizations.
Information security
• Review the proposed standards and assess your organization's level of compliance by performing a gap analysis.
• Become familiar with the information security standards and standards development organizations.
• Identify existing organizational structures to aid development and implementation of an information security program.
• Ensure that policies exist to control access to, and release of, patient-identifiable health information.
• Ensure that users of electronic health information have unique access codes.
• Ensure that each user's access is restricted to the information needed to do his or her job.
• Outline the physician responsibilities for protecting the confidentiality of health information in the medical staff bylaws or rules and regulations.
• Outline employee responsibilities for protecting the confidentiality of health information in the employee handbook.
• Train everyone with access to health information about confidentiality and their responsibilities regarding confidentiality.
• Review vendor contracts for outsourcing of health information to ensure that they include provisions regarding confidentiality and information security.
• Ensure that system managers, network managers, and programmers do not have unlimited and unrecorded access to patient information.
• Monitor access to information and put corrective action plans in place for violation of organization policy.
• Perform risk assessments to prioritize and continually improve the security of the systems.
• Maintain current knowledge of information security issues and industry response to these issues. Read books and publications, and attend seminars.
Electronic signature
• Identify the use of the electronic signature in your organization.
• Perform a gap analysis for electronic signature applications to assess compliance with proposed standards for electronic signatures.
• Become familiar with the electronic signature standards and standards development organizations.
• Discuss the proposed requirements with current vendors who may be supporting your organization's information systems.
• Familiarize yourself and employees with new and emerging information security technologies.
• Research various certificate authorities to determine costs and identify a potential candidate.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content