The information below is from the on-line newsletter, published by Gil Weber, MBS, consultant to the TAO.

Don't fear HIPAA police if rules deadline is missed Officials promised leniency but stopped short of telling physicians they could have more time to comply.

By Joel B. Finkelstein, AMNews staff. Aug. 11, 2003.

Washington -- Federal enforcers won't scour the nation in search of physicians who fail to comply with new electronic transaction standards by the Oct. 16 deadline, government officials said at a recent meeting. But regulators' assurances left some experts unsatisfied.

The rule governing electronic data interchange of medical records and claims was mandated by the Health Insurance Portability and Accountability Act.

At their meeting to release new guidance on the rule, Dept. of Health and Human Services officials made it clear that their enforcement policies will focus more on helping physicians and other covered entities achieve compliance than on imposing penalties and fines.

"We're not going to be out looking for you," said Leslie Norwalk, deputy administrator for the Centers for Medicare & Medicaid Services. CMS is the agency responsible for enforcing the rule.

Instead, CMS will deal with noncompliance on a case-by-case basis, she said. "We have no authority to do safe harbors, so you're not going to see a blanket exception."

She admitted that the agency does not really have the resources to proactively seek out those who have not complied with the regulation. Enforcement efforts will be based on complaints from members of the medical community.

When CMS receives a complaint about a covered entity, such as a physician, it will notify the entity in writing that a grievance has been filed, the HHS guidance states. After notification, the entity will have the opportunity to demonstrate compliance, document its good-faith efforts to meet the standards and/or submit a corrective action plan.

While the priority is to work with doctors to get them up to speed, the flexible and understanding approach to enforcement will lessen with time, Norwalk warned. "The farther away you get from Oct. 16, the less likely we will be to see that you continue to engage in good-faith efforts to come into compliance," she said. The buck stops where?

Despite these assurances, some experts worried that problems implementing the new standards would interrupt the flow of reimbursement from payer to physician.

Several groups have been pushing the department to allow health plans to run parallel claims processing systems, which would allow physicians to submit in the new electronic format or in the electronic format they are currently using, commonly referred to as legacy claims.

Most insurers expect to be ready to accept the new claims by October. But few will have had the ability or opportunity to fully test these systems with physicians' offices.

Medicare, as the largest entity covered by the rule, is itself struggling toward compliance with the electronic transaction standard.

"Our numbers are not as high as we would like," Norwalk said. The most recent figures show Medicare has tested with fewer than 10% of entities submitting bills to the program, which, she said, is higher than any other insurer.

In light of these statistics, a coalition of physician groups, including the American Medical Association and the Medical Group Management Assn., asked HHS to let plans continue accepting legacy claims after the October deadline.

"We are disappointed that HHS did not explicitly permit practices to continue sending claims in the old format," said William F. Jessee, MD, president and CEO for MGMA.

Insurers also wanted CMS in its guidance to say that the agency will not punish insurers that take legacy claims. Allowing such claims "would minimize disruption in the short term, foster continued use of electronic rather than paper transactions and give providers the necessary additional time to complete their efforts and testing without jeopardizing cash flow," said Donald Young, MD, president of the Health Insurance Assn. of America.

The inability of CMS to tell health plans they can run parallel systems is the "biggest, dumbest problem" with the new rule, said Martin Jensen, program manager with the APTi Group Inc., a Tulsa, Okla.-based consulting firm.

"[HIPAA] has really put them in a box," he said. "They can't encourage anyone to break the law."

But reading between the lines of the new guidance, one might conclude that it will be OK for payers to accept legacy claims during a transition period, Jensen said.

For example, the guidance states, "If CMS determines that reasonable and diligent efforts have been made, the cure period for noncompliance would be extended at the discretion of the government." Rough road to a paperless future

The confusion over the rule might leave some small practices looking for an out. Industry analysts are worried that unprepared, small practices will revert to paper claims. The resulting flood of paper claims would overload payers, slowing reimbursement to a trickle, they predict.

HIPAA offers an exemption from electronic transaction requirements to medical practices with 10 or fewer full-time employees and institutions with 25 or fewer workers.

Although HHS officials are careful not to encourage practices to regress to paper, that option was the only real contingency plan officials could offer physicians' offices that won't be ready in time.

While HHS has let it be known that the process for qualifying will not be automatic, the department has yet to publish a rule describing how a small office can apply for such a waiver.

That regulation should be out soon, said Jared Adair, director of CMS's Office of Operations Management.

ADDITIONAL INFORMATION: Proof of good faith

If you are not compliant with HIPAA's electronic transactions standards by Oct. 16 and someone files a complaint against your office, you need to be able to show that you have been making a good-faith effort to comply. Here are some of the activities CMS officials are likely to take as a good-faith effort:

* You are steadily increasing testing between your office and trading partners,
such as insurers or claims clearinghouses. * You tried to start testing
before the deadline, but your trading partner was not ready or refused requests
to do so. * You have a written action plan for achieving compliance. *
You have clearly documented your efforts as well as any obstacles you have faced.

Centers for Medicare & Medicaid Services guidance on compliance with HIPAA transactions and code sets, July 24, in pdf
(www.cms.hhs.gov/hipaa/hipaa2/guidance-final.pdf)

Analysis of the HIPAA guidance by APTi Group Inc., in pdf
(www.aptigroup.com/trainwreck/cmscantsayparallel.pdf)