The HIPAA Clock Is Ticking – Will You Be Ready?

Introduction

There are two significant recent developments in the HIPAA regulations: the Administrative Simplification Compliance Act related to the transactions rule and the Notice of Proposed Rule Making related to the privacy rule. The purpose of this article is to provide an overview of these two developments and how they may impact the compliance efforts of hospice programs.

The Administrative Simplification Compliance Act (ASCA)

Signed into law in December 2001, the ASCA establishes conditions for health care entities to receive a one-time, one-year extension of the compliance deadline for HIPAA's transactions rule. The new compliance date would be October 16th, 2003 provided the entity submits a compliance plan prior to October 16, 2002.

The major tenets of the ASCA are as follows:

· Health care entities may apply for the one-year extension by submitting a written compliance plan that indicates why the entity does not expect to be in compliance by the October 16, 2002 deadline and timeframes (including testing to begin by April 14, 2003) and implementation strategies for achieving compliance.

· Extensions will be automatically granted and the entity is required to maintain documented proof of submission of the compliance plan.

· DHHS will provide a model form for drafting the plan.

· Once it receives the plans DHHS will send a sample of them to the National Committee on Vital and Health Statistics (NCVHS) for analysis. NCVHS will determine common compliance challenges and publish reports on effective solutions to compliance problems identified in their analyses.

· If a health care entity is not in compliance with the transactions rule by October 16, 2002 and it does not submit a plan to DHHS prior to that date, it may be excluded from participation in Medicare.

· The extension of the compliance deadline for the transactions rule does not impact the compliance deadline for the privacy rule.

The model compliance plan and instructions for its completion may be downloaded from the CMS website. The model form, which is relatively straightforward, may be completed and submitted electronically.

What should you do? There are no compelling reasons for a hospice program not to submit the compliance plan requesting the one-year extension. The extension only provides an additional six months (since testing is required by April 14, 2003) to ensure that systems are in place to conduct electronic transactions according to the requirements of the transactions rule.

Notice of Proposed Rule Making

On March 21, 2002, HHS Secretary Tommy Thompson announced proposed changes to the HIPAA privacy regulations. Secretary Thompson stated that the proposed revisions are needed to remedy problems with the existing rule that otherwise could make it more difficult for patients to access health care. At the time of this writing, the revisions have not been finalized, but it is expected that many of the proposed modifications will be adopted.

The revisions were published in the March 27, 2002 Federal Register and propose several significant changes to the previously published privacy rule:

· A patient's prior consent is not needed to share his or her information with a health care provider prior to receiving treatment. Under the revised rule, providers must make a "good faith" effort to obtain a patient’s written acknowledgement of receipt of the provider’s Notice of Privacy Practices.

· The proposed rule allows health care professionals to discuss a patient's treatment with other health care professionals involved in the patient's care without fear that those conversations could lead to a HIPAA violation. If a covered entity meets the minimum necessary standards and implements reasonable safeguards to protect personal health information, incidental disclosures would not be subject to penalties.

· The proposed rule clarifies that state law will govern disclosures to parents.

· The proposed rule requires health plans and health care providers to first obtain an individual's specific authorization before sending him or her any marketing materials.

Remember—the proposed changes to the HIPAA privacy rule do not delay its effective date (April 14, 2003, for most covered entities).

Compliance is mandatory and the penalties for non-compliance are significant. While we can expect that further guidance and interpretation will continue over the next several years, the clock is ticking. Hospices are advised to begin their compliance efforts immediately, if they have not already done so, in order to ensure compliance with the privacy rule no later than April 14, 2003.