Beyond Privacy: Don’t Forget About The HIPAA Electronic Transaction Rules

With the ink barely dry on the business associate agreements required by the HIPAA privacy rules, employers need to remember to act quickly on another component of HIPAA– the rules governing electronic exchanges of data involving employer-sponsored health plans and other HIPAA "covered entities."

Fortunately for employers, the HIPAA Electronic Transaction Rules are not likely to demand the same commitment of time and resources as the privacy rules require. If significant effort is required for some employers, much of that burden likely will fall on the IT or HRIS functions. Of course, HR and benefits professionals should alert the technology specialists to these new obligations and work with them in developing compliance strategies.

Most large employers last fall filed requests for a one-year extension of the compliance date, meaning the HIPAA Electronic Transaction Rules will take effect October 15, 2003, for their health plans (including medical, dental, prescription drug, vision and long-term care plans, along with health care flexible spending accounts and some employee assistance plans). This deadline applies to all plans; no additional time is available for "small health plans."

Exchanges of data are called "transactions" in health care parlance, and the HIPAA rules govern certain electronic transactions, based on the kind of data transferred and the reason for the transfer. These transactions include providers requesting information from plans, plans requesting information from providers or other plans, and payers providing payment information to health plans. Electronic transactions include those done by means of the Internet or on-line interactive transmission, or even by moving an electronic media like a tape or disk from one location to another. A few transactions that seem electronic are not treated that way under the rules. These include telephone voice response and "faxback" systems.

When an employer health plan (or its "business associate" on behalf of the plan) conducts certain transactions electronically, the HIPAA Electronic Transaction Rules require that these transactions use a standard set of electronic codes and include standard pieces of data. Such a transaction is called a "standard transaction."

Non-electronic exchanges of information are not covered by these HIPAA Electronic Transaction Rules. So, for example, employer health plans that currently send coordination of benefits information on paper forms can continue doing so. But plans must be prepared to handle transactions like this electronically as standard transactions if another covered entity ever requests that they do so. Although the current guidance is not clear, this principle would likely apply to a request by a business associate, acting on behalf of a covered entity, that a health plan conduct transactions pertaining to that covered entity electronically.

Electronic codes and data standards have been set for eight separate transactions (which are described in the table on page 4). Standards may be issued for additional types of transactions in the future.

The HIPAA Electronic Transaction Rules are part of the overall "administrative simplification" rules under HIPAA (which also include privacy, security, and provider identifiers). This means that many of the legal standards that apply in the electronic transactions area will already be familiar to employers from their privacy compliance efforts.

For example, like the HIPAA privacy rules, the HIPAA Electronic Transaction Rules are enforced by the Department of Health and Human Services ("DHHS"). And, as with the HIPAA privacy rules, covered entities could face penalties of up to $100 per violation, subject to a $25,000 annual cap on basic civil penalties for each violation. More serious violations can draw criminal penalties, including prison sentences that could range up to 10 years for the most serious violations. Also, HIPAA itself preempts some state laws, but not those that are "more stringent" than the HIPAA rules. Of course, even if HIPAA itself does not preempt a state law, the general ERISA preemption scheme remains in place – so a state law that "relates to" a benefit plan could be preempted.

Beyond the basic standard data requirements, other specific HIPAA Electronic Transaction Rules apply to health plans generally, though it is likely that many of these will be more relevant to health insurers, and third-party administrators and other business associates than to employer-sponsored plans.

For example, as noted above, a health plan must conduct particular transactions as standard transactions if another covered entity requests that it does so. Health plans may not require providers to change or add to the standard data elements, and may not reject a transaction because it contains other data that the plan does not need. Health plans also may not offer health care providers an incentive to conduct transactions under an exception to the HIPAA Electronic Transaction Rules. Also, health plans may not delay or reject a transaction, or attempt to adversely affect the other entity or the transaction, because the transaction is not a standard transaction. Finally, health plans cannot charge fees for the use of a health care clearinghouse that exceed the normal telecommunications fees and costs.

Practical Compliance Approach Using the table at the end of this article, an employer should:

Beyond these basic legal requirements there are business factors to consider. Even though the rules may not apply to a particular exchange of data (such as when an employer – rather than a plan – electronically sends enrollment information to a business associate) there may be other reasons why an employer wants to use standard electronic codes and data elements. These standards are designed to quickly become the industry norm. It may simply be more efficient or otherwise desirable to adopt them, and doing so may improve service from vendors.

A large employer that sponsors a self-insured health plan hires several third-party administration firms to process claims under that plan, and a separate outsourcing or data services company to maintain eligibility and enrollment information on employees and perform other services that would make it a business associate of the plan. The TPAs make eligibility inquiries to the outsourcing company, rather than to the internal benefits administration staff at the employer. Health care providers also request eligibility information from the TPAs.

Must those eligibility inquiries from TPAs to the outsourcing company be conducted as standard transactions? No. An inquiry from one plan to another plan, or from a provider to a plan, to obtain eligibility information would have to be done as a standard transaction. But in this case, the transaction is between two business associates of the same plan.

What about the eligibility inquiries from providers? Those would have to be conducted as standard transactions. The reason is that inquiries from a provider to a plan are covered by the HIPAA Electronic Transactions Rules, and the TPAs here are business associates performing a plan administrative function on behalf of the plan. Therefore, this is an inquiry from a provider to a plan, so it would have to be conducted as a standard transaction.

This table lists all eight "transactions" for which standard codes and data elements have been developed. It can be used as a guide to evaluate whether an employer, the plan it sponsors, and the business associates of that plan conduct any of these transactions.

Copyright 2003 Gardner Carton & Douglas