Important Information for Group Health Plans about HIPAA

Transcription

1 September 30, 2002 Important Information for Group Health Plans about HIPAA Market: All Please be advised that CareFirst BlueCross BlueShield (CareFirst) sent the attached letter and instructions to all 50+ Benefits Administrators as notification that CareFirst will not file for the Transaction and Code Sets extension on behalf of group health plans. We are informing these accounts in an effort to ensure that any affected account is aware of their responsibility as a covered entity to take action by October 15, The Administrative Simplification Compliance Act was signed into law on December 2001 extending the deadline for compliance with HIPAA standards for Electronic Transactions and Code Sets one year to October 16, Examples of electronic transactions are enrollment, premium payments, claims processing and eligibility inquiries. In order to qualify for this extension, covered entities must submit a summary of their compliance plan by October 16, 2002 to the Center for Medicare and Medicaid Services. Health plans such as CareFirst and group health plans sponsored by employers are covered entities. Each group health plan should make an independent determination as to whether they must file. Health plans not filing for an extension may need to certify not only that they are compliant, but that they can ensure the compliance of all their business associates, including other plans, vendors, clearinghouses, etc. A copy of the CareFirst compliance plan that contains information group health plans may need for filing and a list of resources was mailed or made available to plans for their own filing and records. If you have any questions please contact your Broker Sales Representative. Shekar Subramaniam Director, Broker Sales CareFirst BlueCross BlueShield is an independent licensee of the Blue Cross and Blue Shield Association. Registered trademark of the Blue Cross and Blue Shield Association. Registered trademark of CareFirst of Maryland, Inc.

2 CareFirst BlueCross BlueShield Mill Run Circle Owings Mills, MD September 26, 2002 Important Information for Group Health Plans about HIPAA Dear Benefits Administrator: At CareFirst BlueCross BlueShield (CareFirst), we are committed to keeping you informed about the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the regulations that may affect your group health plan. As you know, the first compliance date for standard transactions is just around the corner, unless covered entities (Health Plans, providers, clearinghouses and Group Health Plans) file an extension application (compliance plan) with the Department of Health and Human Services (DHHS). The attached notice contains time-sensitive information involving your group health plan s compliance with the Administrative Simplification section of HIPAA. As a group health plan, you are a covered entity that may need to take action by October 15, 2002 by filing a compliance plan with the DHHS Center for Medicare and Medicaid Services (CMS). This is why it is important that you read the attached information carefully. The information in this document is not intended to be legal advice, but rather an attempt to highlight important issues that you will need to consider regarding the HIPAA Transactions, Code Sets and Identifiers Rules. As always, you should consult with legal counsel concerning the compliance needs of your organization. You will receive future communications about HIPAA, including information about CareFirst s Privacy Notice, and if you are a self-insured plan, a business associate agreement. We thank you in advance for your cooperation with this matter. If you have questions, please call our HIPAA Compliance office at , or Debbie.Credito@CareFirst.com. Sincerely, Michael J. Felber Sr.Vice President Sales MJF:dlt Attachments: Important Information for filing an extension CareFirst extension application CMS resources CareFirst BlueCross BlueShield is the shared business name of CareFirst of Maryland, Inc. and Group Hospitalization and Medical Services, Inc. which are independent licensees of the Blue Cross and Blue Shield Association. Registered trademark of the Blue Cross and Blue Shield Association. Registered trademark of CareFirst of Maryland, Inc.

3 IMPORTANT NOTICE REGARDING HIPAA Transactions and Code Sets Compliance Extension IMMEDIATE ACTION MAY BE REQUIRED (By October 15, 2002) Summary Under the HIPAA regulations, a covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with one or more transactions for which a standard has been adopted. This includes claims, enrollment and eligibility. Health plans include group health plans (fully insured and self-insured), insurers, HMOs, and many other entities such as Medicare and Medicaid. Covered entities must comply with the Standard Transactions and Code Sets Regulations by October 16, 2002 (there is an exception for small health plans, which have an additional year), unless they file for an extension. Many group health plans will qualify for the small health plan exception described more fully below. A one-year compliance extension is available for covered entities that file an extension request on or before October 15, CareFirst has filed an extension request on its own behalf; a copy of our extension application is attached. Your group health plan, if it does not qualify for the small health plan exception, needs to file its own extension request before October 15, 2002, based on your legal counsel s advice. CareFirst is unable to file on your behalf, as we do not have legal authority to act on your behalf. While there is an exception for small health plans, there is no harm in filing for an extension, even if your group health plan does not need one. Background Congress passed the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Part of HIPAA is the Administrative Simplification provisions, which include several different regulations: Standard Transactions and Code Sets, Privacy, Security and Unique Identifiers. Your organization is a group health plan and therefore, the fast approaching Transactions and Code Sets compliance deadline of October 16, 2002, for the filing of the extension application, is critical to understand. Standard Transaction and Code Sets The Standard Transactions and Code Sets regulation establishes standard formats, data content and code sets for certain electronic transactions including claims processing and enrollment/eligibility transmissions. All covered entities must be in compliance with the Standard Transactions and Code Sets regulation by October 16, 2002 (except for small health plans who have until October 16, 2003 to comply), unless a compliance extension request is filed by October 15, 2002.

4 Compliance Date Extension Last year, Congress authorized a one-year extension for those entities with a 2002 compliance date. In order to obtain this extension, covered entities must file a compliance extension form with the Department of Health and Human Services (HHS), on or before October 15, This extension will change the mandatory compliance date to October 16, Note that small health plans already have until October 16, 2003 to comply, so an extension filing is not required for small health plans. To determine if you are a small health plan, you should seek legal advice, and review the documentation available on the CMS web site. CareFirst has filed for the Compliance Extension In order for CareFirst to comply with the new Standard Transactions and Code Sets requirements, we must make technical and business changes that will affect all of our claim processing, enrollment, medical management and other systems to accommodate the covered transactions. In an effort to make the necessary changes in a cost-effective manner and provide sufficient time to adequately test the changes it makes, CareFirst has filed for the extension. What is CareFirst Doing for You? CareFirst s compliance extension form states that we are filing on behalf of CareFirst as an entity covered by HIPAA. We are enclosing a copy of our submitted application for your records, or use in filing your own extension. You should consult with your own legal counsel to confirm that you are a covered entity and that you meet the filing requirements for compliance. To help determine if you need to file the compliance extension plan, you should evaluate your plan and ask the following questions: 1. Am I a small health plan? Are my health plan receipts, taking into consideration all of the components of my plan (e.g. dental, vision, medical, long term care, etc.), $5 million or less per year? If they are, it is our understanding that you do not need to file the compliance extension form, because you already have until October 16, 2003 to comply. However, always check with your legal counsel for advice, and document their opinion. 2. If you are not a small health plan, do you offer dental, vision or long term care insurance, or are your plans administered by insurance carriers other than CareFirst? If so, you should confirm whether the other carriers have already filed or will file a compliance extension form, which will include your plan. If not, you should consider filing for the extension yourself. 3. Is any part of our health plan self-insured? If so, you may be required to file a compliance extension form, even if CareFirst is the sole claims administrator for your plan. What if I choose not to apply for an extension? If you do not file for an extension by October 15, 2002, the original compliance date will apply to you. As such, compliance with the standard electronic formats and code sets must be achieved by October 16, 2002 (unless you are a small health plan). Please remember that other covered entities opting to file for the extension may not be able to process transactions received in the HIPAA formats prior to October It is important that you maintain your current EDI capability with CareFirst, even if you plan to be HIPAA compliant by October 16, This is permissible under the extension legislation. If you fail to file for an extension and are not in compliance with the law by the October 16, 2002 deadline, your plan may be subject to penalties imposed by the Department of Health and Human Services.

5 Useful Tips to File for the Extension We encourage you to consult with your legal counsel for advice on filing for the extension. If you file a compliance plan, you may find the following tips to be helpful: 1. The compliance plan filed by CareFirst is attached as the last two pages of this document. 2. You may file the extension electronically by going to the CMS web site, which is 3. The compliance extension form is not complicated and takes about 20 minutes to complete. The law requires that you include summary information that addresses the steps to be taken and the anticipated costs for achieving compliance. When you file the extension electronically, you will immediately receive a confirmation number, which, in essence, is your approval. It is our under standing that CMS has no intentions of reviewing or auditing the applications. 4. Assuming CareFirst is your only carrier/administrator, your extension request would likely reflect your reliance upon CareFirst, as your business associate, to meet many of your compliance requirements. As you may note from the CareFirst filing, CareFirst has completed its Awareness phase, and we expect actual completion of implementation by September Internal testing is schedule to begin in April CareFirst s software, development, installation and staff training have been initiated, but are not yet completed. 5. You may submit your extension application/notification form or template form via the Internet or by U.S. mail. If you are printing the form and mailing it, we recommend that you use certified mail with return receipt requested, or another type of mailing service that provides evidence of delivery. Mail your completed form to: The Department of Health and Human Services Attention: Model Compliance Plans Centers for Medicare & Medicaid Services P.O. Box 8040 Baltimore, MD We thank you in advance for your cooperation with this matter. If you have questions, call our HIPAA Compliance Office at

6 ADDITIONAL HIPAA RESOURCES 1. CMS web site Our model compliance extension form, Frequently Asked Questions, links to other HIPAA sites, and information on regulations and the law are located here. 2. FREE Video - CMS Meeting the HIPAA Challenge: Implementing the Administrative Simplifications of HIPAA. For the free video, your request to AskHipaa@cms.hhs.gov or call FREE HIPAA Roundtable Conference Call - September 30th, 2002, 2:00-3:30 PM EST. Call in number , conference ID # To request an official invitation to the call, e- mail AskHipaa@cms.hhs.gov or call This is a good place to get answers to your questions on HIPAA Administrative Simplification. 4. FREE Listserve Sign up to receive notification when proposed or final rules on HIPAA have been published in the Federal Register (The Federal Register is the place where the government, upon passing a law, tells the public how the law will be implemented). 5. CMS box - askhipaa@cms.hhs.gov. Send your questions on HIPAA administrative simplification here. 6. CMS HIPAA Hotline This hotline has been established to help answer your HIPAA administrative simplification questions. 7. Privacy-related information The U.S. Department of Health & Human Services Office for Civil Rights oversees the privacy requirements. Visit their website for more information. Privacy-related questions should be directed to OCRPrivacy@hhs.gov or call Other information on administrative simplification requirements of HIPAAhttp://aspe.os.dhhs.gov/admnsimp/ 9. CMS Medicaid HIPAA web address -

7 Application filed on September 6, 2002 Section A: Covered Entity and Contact Information 1. Name of Covered Entity: CAREFIRST, INC. and each subsidiary and affiliate that is defined as a covered entity 2. Tax Identification Number: N/A for this communication 3. Medicare Identification Number: N/A for this communication 4. Type of covered entity: Health Plan Health Care Provider - Physician/Group Practice 5. Authorized Person: Lorraine Doo 6. Title: HIPAA Program Director 7. Street: Mill Run Circle, OM1-TBP City/State/ZIP: Owings Mills, MD Telephone Number: (410) Section B: Reason for Filing for This Extension 10. Please check the box next to the reason(s) that you do not expect to be compliant with the HIPAA Electronic Health Care Transactions and Code Sets standards (45 C.F.R. Parts 160, 162) by October 16, Multiple boxes may be checked. Need more time to complete implementation Need more time for testing Other: system consolidation Section C: Implementation Budget This question relates to the general financial impact of the HIPAA Electronic Health Care Transactions and Code Sets standards (45 C.F.R. Parts 160,162) on your organization 11. Select from the drop-down menu the range of your estimated cost of compliance with the HIPAA Electronic Health Care Transaction and Code Sets standards (45 C.F.R.,Parts 160,162): Over $1 Million Section D: Work Plan/Implementation Strategy/Testing Schedule This section encompasses HIPAA Awareness, Operational Assessment, Development and Testing, all of which are collectively referred to as the Transactions and Code Sets Implementation Process.

8 Phase One - HIPAA Awareness These questions relate to your general understanding of the HIPAA Electronic Health Care Transactions and Code Sets standards (45 C.F.R. Parts 160,162). 12. Please indicate whether you have completed this Awareness phase of the Implementation Process. Yes 13. Projected/Actual Start Date: N/A 14. Projected/Actual Completion Date: September, 2001 Phase Two - Operational Assessment These questions relate to HIPAA operational issues and your progress in this area. 15. Please indicate whether you have completed this Operational Assessment phase of the Implementation Process. Yes 16. Reviewed current processes against HIPAA Electronic Health Care Transactions and Code Sets(45 C.F.R Parts 160,162) requirements? N/A 17. Identified internal implementation issues and developed workplan? N/A 18. Decided whether to use the services of a vendor or other contractor? N/A 19. Projected/Actual Start Date: N/A 20. Projected/Actual Completion Date: March, 2002 Phase Three - Development and Testing These questions relate to HIPAA development and testing issues. ASCA legislation requires that testing begin no later than April 16, For more details, refer to the Help on this question links for each individual question. 21. Please indicate whether you have completed this Development and Testing phase of the implementation process. No 22. Completed software development/installation? Initiated But Not Completed 23. Completed staff training? No 24. Projected/Actual Development Start Date: July, Projected/Actual Initial Internal Software Testing Start Date: April, Projected/Actual Testing Completion Date: September, 2003 Note: N/A in Sections B - D indicate responses to questions in the CMS Model Compliance Plan that did not require a response if a prior response in the Section was Yes.