Proposed HIPAA rule aims to streamline health plan compliance

Tools

As the permanent HIPAA auditing program gets under way this year, the U.S. Department of Health & Human Services issued a proposed rule that would require a controlling health plan (CHP) to submit information and documentation demonstrating its compliance with standards and operating rules for three electronic transactions adopted under the Health Insurance Portability and Accountability Act.

The electronic transactions include eligibility for a  health plan, healthcare claim status, and healthcare electronic funds transfers (EFT) and remittance advice (ERA) transactions.

Although HIPAA standards and operating rules can ease administrative burdens by moving away from paper forms and manual processes to transmit data, payers and providers still face difficulties, thanks in part to inconsistent testing processes, HHS said in the rule published yesterday. So the department wants to include certification of compliance processes in future rulemakings.

"We believe the benefit of including the certification of compliance requirements in those rulemakings is that it will move covered entities toward a consistent, industry-wide testing framework that, we believe, will support a more seamless transition to new and modified standards and operating rules," HHS stated.

Under the proposed rule, controlling health plans must submit a "snapshot" of their compliance to the HHS secretary, including the number of covered lives on the date of submission and documentation of obtaining a Council for Affordable  Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CORE) Phase III Seal for EFT and ERA operating rules or a HIPAA Credential for the three relevant transactions.

The proposed rule also notes health plans must perform some external testing to obtain either a Phase III CORE Seal or the HIPAA Credential.

HHS also wants to change the date for most CHPs to meet this first certification of compliance from Dec. 31, 2013, to Dec. 31, 2015. That will give health plans enough time for planning, evaluating, designing, and internal and external testing. The new date also better aligns with the requirement for CHPs to obtain a unique health plan identifier on or before Nov. 5, 2015, according to HHS.

The federal health department is soliciting comments on its proposals, which must be sent within 60 days of the rule's publication in the Federal Register.

To learn more:
- check out the proposed rule (.pdf)

Related Articles:
HIPAA, accountable care among top 2014 priorities for HIT professionals
WellPoint pays $1.7M for HIPAA breach
HIPAA Omnibus Rule finally revealed
5 recommendations to prepare for a HIPAA audit