FSA's and HIPPAA EDI Compliance

[Guest Donna Arnone]

:confused: I represent a TPA which administers approximately 60 flexible benefits plans. We have recently been contacted by brokers representing two of our plans who have asked whether we will be HIPPAA EDI compliant by October 16, 2002. Perhaps I am the "last to know" here, but I was under the impression that HIPPAA EDI compliance concerns electronic transmission of data between insurers and health care providers. I understand that health FSA's are considered medial plans, but we do not receive information directly from insurers or providers and do not make payments directly to providers. What are we required to do here?

[Guest lschaab]

HIPAA affects TPA's on two fronts (1) EDI and (2)Privacy. You are right that you probably don't have any issues with EDI because of the way information is exchanged, by mail or by fax. However, if you receive inquiries or other health information via email, you could have an issue. The regulations do not consider phone or fax EDI. Froma privacy perspective your policies and procedures for handling claims and who has access is also something you should consider. However, the privacy procedures are due at the earliest 4/14/03.

That is the most I know, which is enough to be somewhat dangerous.

[Guest LRM464]

The October 16, 2002 data is only relevant if (1) a plan is classified as large (i.e., at least $5 million in annual claims), and (2) the plan fails to file a model compliance plan with the Centers of Medicare and Mediaid Services by October 15, 2002. It is hard to imagine that an FSA would generate $5 million in annual claims but of course an FSA could be part of a larger GHP -- in that case a compliance plan should be filed. If a compliance plan is filed, you have another year to sort out the application of the electronic data interchange regs. Smaller plans get the extra year without having to file anything.

Linda