1. Applying for an Extension to HIPAA Transaction and Code Set Compliance Date The Fourth National HIPAA Summit Mark Lutes Partner, Epstein, Becker & Green, P.C. Washington, D.C. Washington, D.C. 202-861-1824

2. Where Does the Right to Extension Arise? b The Final Rule on Transactions and Code Sets established a compliance deadline of 10/16/02 b Congress passed H.R. 3323 delaying the compliance date until 10/16/03 for a covered entity that submits, by 10/15/02, a “plan” detailing how compliance will be achieved by such time.

3. Model Compliance Plan Option b H.R. 3323 directed HHS to promulgate model form b No approval of plans will occur--mere submission suffices b Form available on line: b Form available on line: b Form can also be submitted by mail b Advantage: Online submission only method of generating CMS confirmation though postal receipt is alternative b any advantage to submitting a compliance plan in another format?

4. What did the Statute Suggest the Plan Would Need to Include? b Analysis of the extent to which the covered entity is not in compliance b The reasons for such non-compliance b A budget, schedule, workplan or other implementation strategy b Whether a vendor will be used to achieve compliance b Timeframe for testing no later than 4/16/03

5. Contrast with Statute: the Model Compliance Plan Approach b No need to state the extent to which covered entity is currently noncompliant b “Reasons why” can include simply needing more time b Budget requirement morphs into statement of aggregate costs b Workplan requirement morphs into statement as to whether one exists

6. Contrast with Statute: the Model Compliance Plan Approach b Strategy requirement translates into a simple task of assigning date to three presumed macro phases: awarenessawareness operational assessmentoperational assessment development and testingdevelopment and testing

7. Who is Required to File? b Most covered entities that will not be compliant by 10/16/02 b Exclusion for small health plans b Hotly debated topic: whether a covered entity that is ready to receive standard transactions need file in case trading partners not ready-- HHS FAQs says “no”.

8. What Penalty Applies? b H.R. 3323 allows the Secretary of HHS to exclude from the Medicare program covered entities that are not in compliance and do not submit by 10/15/02. b No regulations yet to explain how non- compliance will be assessed for purpose of this penalty b Query: does this make filing for an extension always a good idea?

9. Filing By MCOs and Providers for the Group Health Plans They Sponsor in theory there are multiple covered entities with filing obligationsin theory there are multiple covered entities with filing obligations Instructions suggest that where covered entities are: 1) related; and 2) operating under a single implementation plan, a combined filing would be appropriateInstructions suggest that where covered entities are: 1) related; and 2) operating under a single implementation plan, a combined filing would be appropriate Issue: are you operating under a single implementation plan?Issue: are you operating under a single implementation plan?

10. Additional Provider Issue b How to reconcile privacy rule’s optional OCHA or ACE designations with TCS extension plan filing? b Designations not directly implicated nor does the model plan form take them into account b However, where OCHA or ACE participants meet the relatedness and single implementation tests are met, a single filing is appropriate

11. Self-funded Group Health Plans b Unless self-administered, group health plan needs to coordinate with all vendors handling one or more of the HIPAA transactions b Med/surg, mental health, dental could be spread among multiple vendors with multiple: start/completion dates for phases which form surveys, development and testing dates, etc. b Strategies: “aggregate response” e.g,, earliest start date and latest completion date?

12. Self-Funded Group Health Plan b Who will be the authorized person? b Group health plan could ask vendors to report to plan administrator b Group health plan could designate lead vendor and ask others to report to that vendor ASO vendors not able to file single response for entire book of business--fail relatedness and single compliance plan testsASO vendors not able to file single response for entire book of business--fail relatedness and single compliance plan tests

13. Self-funded Group Health Plan Issues b Circulate proposed responses and ask for outliers to report by date certain? b How to account for aspects of compliance plan outside the vendor’s purview e.g., enrollment and payment transactionse.g., enrollment and payment transactions

14. Insured Group Health Plans b Could assume that each MCO is either ready by deadline or will file for itself b Report 834 (enrollment) compliance? Or does plan sponsor not plan do enrollment?Or does plan sponsor not plan do enrollment? Different result if plan sponsor conducts those transactions on behalf of the plan?Different result if plan sponsor conducts those transactions on behalf of the plan? Same issues for 811 invoice and 820 payment?Same issues for 811 invoice and 820 payment?

15. Readiness Surveys b Sample Text from surveys

16. Readiness Surveys b Theories of liability around negligent representation b Potential Disclaimers relative to responses b Alternative approaches to dialogue with your trading partners? Why not deemphasize representations and warranties and emphasize timetables for information exchange and testing?Why not deemphasize representations and warranties and emphasize timetables for information exchange and testing?