1. HIPAA Implementation Strategies for Compliance Professionals
David J. Butler
Christopher E. Coleman
presented to:
Fifth Annual National Congress
on Health Care Compliance
February 8, 2001

2. Health Insurance Portability and Accountability Act of 1996
Compliance Professionals Establish the Context
HIPAA
Health Insurance Portability and Accountability Act of 1996
Accountability
Administrative
Simplification
Insurance
Portability
The so-called Administrative Simplification” components of HIPAA are just one piece of the much larger legislation (HIPAA), which was intended to support the portability of existing condition coverage for patients in transition from one employer-based health plan to another.
Those insurance provisions were enacted back in 1996 when the legislation was first enacted.
When we speak about HIPAA today, we usually mean the EDI and Security/Privacy components. That is, Administrative Simplification.
Administrative Simplification is composed of 5 separate proposed rules issued by the DHHS in 1999 which includes
Transaction Standards and Code Sets
Provider Identifiers
Employer Identifiers
Security
Privacy
As of 12/5/00, only the Transaction Standards and Code Sets rule has been finalized
Security
EDI
Privacy
Transactions
Code Sets
Identifiers
Copyright 2001 Strategic Management Systems, Inc.

3. Compliance Professionals Understand Your Role
You are Part of a Corporate Project Plan
Know and Understand where You Fit
Primary Focus of Implementation for Compliance Professionals
Privacy Regulations
Privacy Rule
Policies and Procedures
Training
Project Coordination
Copyright 2001 Strategic Management Systems, Inc.

4. Compliance Professionals Identify Your Scope of Work
Privacy Regulations Require Many Policies and Procedures
EDI Security Privacy
IT Revision
Policies &
Procedure
Copyright 2001 Strategic Management Systems, Inc.

5. Compliance Professionals Identify Your Scope of Work
Identify all Policies and Procedures Necessary for Your Organizations
Assess and Ensure Applicability to Your Organization
Leverage Existing Policies and Procedures in Compliance Program
Copyright 2001 Strategic Management Systems, Inc.

6. Compliance Professionals Develop Your Work Plan
Develop a Work Plan
Drafting and Deploying Policies and Procedures
Deploying Training
Identifies Scope of Work Accordingly to Deliverables
Identify Process for Policy & Procedure Approval
Interdepartmental Review
Legal Review
Executive Committee Review
Identifies Timelines
What Policies should be Completed before Others
When to Conduct Training
Copyright 2001 Strategic Management Systems, Inc.

7. Compliance Professionals Develop Your Work Plan (cont.)
Allocates Responsibilities
Establish separate Work Groups according to Subject Matter or Business Unit
Corporate Level
Allows Assessments and Updates
Ensure Coordination with Security
Copyright 2001 Strategic Management Systems, Inc.

8. Compliance Professionals Conduct Awareness Training
Once Corporate Level Policies and Procedures are Drafted
Establish Context
All employees understand need for Policies and Procedures
Expectations will be Established on Policies to Come for each Department
Expectations will be Established on Modifying Culture
Consider Both Privacy and Security Awareness
Copyright 2001 Strategic Management Systems, Inc.

9. Compliance Professionals Distribute Policies and Procedures
Disseminate Corporate Level Policies and Procedures
Applicable Policies to Each Business Unit
Procedures Must Be Tailored for Applicability
Ensure Business Unit Responsibility
Ensure Functional Training Regarding Specific Policies and Procedures
Required by Privacy Regulations
Copyright 2001 Strategic Management Systems, Inc.

10. Compliance Professionals Maintain Executive Communication
Ensure Adequate Communication to Executive Committee
Report on Progress and Challenges
Justify Budgetary and Resource Allocations
Avoid Surprises
Copyright 2001 Strategic Management Systems, Inc.

11. Compliance Professionals Its Simply Another Regulation
HIPAA Administrative Simplification
just another section of the C.F.R.
Take a Systematic Approach
Avoid Getting Overwhelmed
Successful Accomplishment
Focus on Ultimate Objective
Ensure Patient Confidentiality
Copyright 2001 Strategic Management Systems, Inc.