Guest Article

(From the Employer's Guide to HIPAA Privacy Requirements, Thompson Publishing Group)

CMS Promises Leniency for 'Good Faith' TCS Compliance Efforts

Health plans and other covered entities will not be fined immediately for not meeting the Oct. 16 compliance deadline for HIPAA's transactions and code sets (TCS) rules if they have made "good faith efforts to comply," according to July 24 guidance from the Centers for Medicare and Medicaid Services (CMS), the agency responsible for TCS enforcement.

"CMS recognizes that transactions often require the participation of two covered entities and that noncompliance by one covered entity may put the second covered entity in a difficult position," the agency states. "CMS intends to look at both covered entities' good faith efforts" in deciding whether the noncompliance is reasonable and how much time to give the entities to cure it, the agency adds.

Health plans that continue to process noncompliant transactions from providers will not be assessed penalties "for the period of time CMS determines is appropriate" if they take "reasonable and diligent" steps, such as outreach and testing, to help these providers come into compliance, CMS adds. "As long as a health plan can demonstrate to CMS its active outreach/testing efforts, it can continue processing payments to providers."

However, CMS refused to provide an additional outright extension of the compliance deadline. "The law is clear: October 16, 2003, is the deadline," the agency states. "After that date, covered entities, including health plans, may not conduct noncompliant transactions." After Oct. 16, in addition to possible penalties, CMS will expect noncompliant entities to submit corrective action plans for coming into compliance, the agency adds. (More TCS compliance resources are on CMS' Web site at www.cms.hhs.gov/hipaa/hipaa2.)

NCVHS Called for Flexibility

CMS' guidance responds to calls for flexibility by the National Committee on Vital and Health Statistics (NCVHS), an advisory committee of the U.S. Department of Health and Human Services (HHS).

However, NCVHS' June 25 letter to HHS Secretary Tommy Thompson advised against granting a blanket extension. "It does appear that most covered entities ... are making the investment to comply with [the Oct. 16] deadline," NCVHS explains. "An extension will penalize those who have already come into compliance."

What HHS should do, according to NCVHS, is "provide flexibility in enforcement during a transition period, not to extend beyond April 16, 2004." Although HHS has yet to begin its rulemaking on how it will enforce HIPAA's TCS rules, NCVHS "believes HHS enforcement could provide some flexibility by promoting voluntary compliance by covered entities without limiting [its] ability to take enforcement actions against those covered entities that are not taking steps to comply."

The recommendations made by NCVHS, a body invested by HIPAA with advisory authority regarding the law's implementation, are based on testimony by health plan and provider representatives at a May 20 hearing of the committee's Subcommittee on Standards and Security. "There was overall agreement and concern that a substantial segment of the industry will be unable to comply" by Oct. 16, NCVHS states.

HIPAA's TCS rules, issued in August 2000, require the use of specified industry standards in making certain health care transactions, including enrollment, eligibility and premium payment. Congress extended the rules' original October 2002 deadline in the December 2001 Administrative Simplification Compliance Act, which conditioned the extension on submittal of a compliance plan.

Employer Implications

Employers, particularly those with self-administered group health plans, are among the organizations that still may be struggling with TCS compliance. Common concerns include insufficient information from technology vendors, uncertainty about software performance and the need to coordinate with third-party administrators and other service providers.

Meeting the Oct. 16 deadline may require a substantial investment of time and resources. The following are among the steps to consider:

Reprinted with permission from the August 2003 newsletter of the Employer's Guide to HIPAA Privacy Requirements, © Thompson Publishing Group, Inc., 2002. All rights reserved.

BenefitsLink is an independent national employee benefits information provider, not formally affiliated with the firms and companies who kindly provide much of the content and advertisements published on this Web site, including the article shown above.