02-9197. Health Insurance Reform: Standards for Electronic Transactions; Announcement of the Availability of a Model Compliance Plan

AGENCY:

Centers for Medicare & Medicaid Services, HHS.

ACTION:

Notice.

SUMMARY:

This notice announces the availability of instructions for, and a model of, a compliance plan that covered entities may use to request an extension to the compliance deadline for standards for electronic transactions and code sets that covered entities must use for those transactions.

FOR FURTHER INFORMATION CONTACT:

Elizabeth Holland, [phone].

SUPPLEMENTARY INFORMATION:

I. Background

On August 21, 1996 the Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191, which included provisions to address the need for standards for electronic health care transactions and other administrative simplification issues. Through subtitle F of this law, the Congress added to title IX of the Social Security Act (the Act) a new part C (consisting of sections 1171 through 1179 of the Act), entitled “Administrative Simplification.” The purpose of this part is to improve the Medicare program, the Medicaid program, and the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements to enable the electronic exchange of certain health information.

Section 1172 of the Act makes any standard adopted under part C of the Act applicable to the following entities as defined in section 1171 of the Act:

• All health plans.
• All health care clearinghouses.
• Any health care provider who transmits any health information in electronic form in connection with transactions referred to in section 1173(a)(1) of the Act.

Section 1175(a)(3) of the Act establishes that each person to whom a standard or implementation specification applies is required to comply with the standard no later than 24 months (or 36 months for small health plans) following its adoption. With respect to modifications to standards or implementation specifications made after initial adoption, compliance must be accomplished by a date designated by the Secretary. This date may not be earlier than 180 days after the Secretary adopts the modification.

In the August 17, 2000 Federal Register (65 FR 50312), we published a final rule entitled “Health Insurance Reform: Standards for Electronic Transactions” that implemented the provisions of sections 1171 through 1179 of the Act. These provisions established new national standards with which all covered entities must comply. The effective date of these standards for all covered entities, with the exception of small health plans is October 16, 2002, and the effective date for compliance by small health plans is October 16, 2003. In addition, the August 17, 2000 final rule established a definitions section at 45 CFR 160.103 that includes definitions for the following terms— (1) Covered entities; (2) health plans; (3) small health plans; (4) health care clearinghouses; and (5) health care providers.

However, on December 27, 2001, the Administrative Simplification Compliance Act (ASCA) (Pub. L. 107-105) provided for a 1-year extension of the deadline for compliance with the electronic health care transactions standards and code sets for all covered entities, with the exception of small health plans, that request an extension on or before October 15, 2002. Covered entities that submit a request by the deadline will have until October 16, 2003 to come into compliance with the standards.

In addition, Pub. L. 107-105 required the Secretary to develop a model compliance plan by no later than March 31, 2002. In developing this model compliance plan, the Secretary consulted with organizations described in sections 1172(c)(3)(B) and (f) of the Act as organizations to be consulted in developing national electronic health care standards. One of these organizations, the Workgroup for Electronic Data Interchange (WEDI), developed a series of recommendations for the model plan. On February 7, 2002, these recommendations were discussed at a public hearing of the National Committee on Vital and Health Statistics (NCVHS).

II. Provisions of the Notice

This notice provides information to covered entities, with the exception of small health plans, that will not be compliant with the electronic health care transactions and code sets standards by October 16, 2002. As required by Pub. L. 107-105, we are providing a model compliance plan that covered entities may use to submit to request an extension. These entities may use one of the following options to file for a 1-year extension (that is, until October 16, 2003):

• Submit the on-line compliance plan, which is available on our website at www.cms.hhs.gov/​hipaa.
• Submit a paper copy of the on-line compliance plan via mail.
• Submit their own version of a compliance plan that provides equivalent information.

The model compliance plan and instructions for its completion and submission are available via the Internet on our website. Completion and timely submission of the model compliance plan by covered entities satisfies the ASCA requirement for requesting an extension.

A. Electronic Submissions of the Model Compliance Plan

Covered entities can submit this model compliance plan electronically via the Internet at www.cms.hhs.gov/​hipaa. In order to obtain an extension, electronic submissions must be completed on or before October 15, 2002. Covered entities that complete their compliance plan electronically will receive an electronic confirmation number as their response. The confirmation number serves as the covered entity's approval notice. For additional information regarding electronic compliance plan submissions, see Appendix A of this notice. To view a copy of the electronic form, see Appendix B of this notice.

B. Paper and Alternative Submissions of a Compliance Plan

Covered entities also have the option of submitting a paper copy of the model plan. This paper submission can be a duplicate of the form in Appendix B of this notice or a printed copy of the electronic form available on our website.

In addition, a covered entity has the option to submit its own version of a compliance plan (paper copy), that must include the following:

• An analysis of the reasons for noncompliance.
• A budget for achieving compliance.
• A work plan and implementation strategy for achieving compliance.
• A decision regarding whether a contractor or vendor may be used to help achieve compliance.
• A testing timeframe that begins on or before April 16, 2003.

All paper and alternative submissions must be postmarked by October 15, 2002 and sent to the following address:

Attention: Model Compliance Plans, Centers for Medicare & Medicaid Services, PO Box 8040, Baltimore, Maryland 21244-8040.

We will not acknowledge receipt of these submissions. Therefore, we suggest that covered entities submitting their plans via mail use a method that provides proof of delivery. For additional information on paper or alternative submissions, see Appendix A of this notice.

III. Collection of Information Requirements

In accordance with section 1175(b)(1)(A) of the Act as amended by section 2 of Pub. L. 107-105, the form included as Appendix B of this notice is exempted from the requirements of the Paperwork Reduction Act of 1995. Consequently, neither the form nor the notice need to be reviewed by the Office of Management and Budget under the authority of the Paperwork Reduction Act of 1995 (44 U.S.C. 35).

IV. Regulatory Impact Statement

We have examined the impacts of this notice as required by Executive Order 12866 (September 1993, Regulatory Planning and Review), the Regulatory Flexibility Act (RFA) (September 19, 1980 Pub. L. 96-354), section 1102 (b) of the Social Security Act, the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), and Executive Order 13132.

Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any given year). We have determined that this notice is not a major rule because it does not impose an economically significant impact on covered entities or the Medicare program.

The RFA requires agencies to analyze options for regulatory relief of small businesses. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and government agencies. For purposes of the RFA, most covered entities (that is, health plans, health care clearinghouses, and health care providers) are considered to be small entities, either by nonprofit status or by having revenues of $5 to $25 million or less annually. (For details, see the Small Business Administration's regulation that set forth size standards for health care industries (65 FR 69432).) Individuals and States are not included in the definition of a small entity. Covered entities will be able to assess their own progress toward HIPAA compliance and determine whether or not to request an extension. Covered entities that obtain the extension will have the added flexibility to schedule the activities needed to implement the standards and they will have additional time to conduct thorough testing with their trading partners. We are unable to quantify the impact of the 1-year extension, but we will be able to analyze the data that we receive from covered entities that submit compliance extension plans.

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area and has fewer than 100 beds. Currently we are unable to quantify the impact of the provisions of this notice on small rural hospitals, but we believe that we will be better able to assess the impact of the 1-year extension through the analysis of the data submitted by covered entities requesting the extension.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule that may result in expenditure in any 1 year by State, local, or tribal governments, in the aggregate, or by the private sector, of $110 million. This notice will not mandate any requirements for State, local or tribal governments.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. We have reviewed this notice under these requirements and have determined that it will not impose substantial direct requirement costs on State or local governments. We also note that the option to obtain a 1-year extension will give States or local governments more flexibility in several areas which may include—(1) Additional time to conduct testing; (2) additional time for implementation; and (3) additional time to consult with vendors. In accordance with Executive Order 12866, this notice was not reviewed by the Office of Management and Budget.

Authority: Section 1175 of the Social Security Act (42 U.S.C. 1320d-4)

Dated: April 8, 2002.

Thomas A. Scully,

Administrator, Centers for Medicare & Medicaid Services.