"Although the final rules are expected to contain substantial changes, while waiting for the final rules, health plans should take the following steps: [1] Identify your [controlling health plans (CHPs)] and [subhealth plans (SHPs)]. [2] Determine who's conducting covered transactions on behalf of your health plans and ensure that business associates are using applicable standards and operating rules. [3] Obtain [a health plan identifier (HPID)] by the deadline and communicate HPIDs to business associates that conduct standard transactions.... [4] Determine if your business associates have obtained a Phase III CORE Seal, or if they are in the process of obtaining one.... [5] Consider whether you will use a HIPAA Credential or Phase III Core Seal to document compliance."