| The purpose of this Circular
Letter is to remind licensees of their obligations in terms of achieving compliance with
the administrative simplification provisions of HIPAA. The United States Department of Health and Human Services (HHS) has published
final rules relating to the privacy, security and transmission of individually
identifiable patient health information pursuant to the administrative simplification
provisions of HIPAA.
"Transactions"/"Security"
Provisions
Section 262 of Public Law 104-191 directed HHS to issue
standards to facilitate the electronic exchange of information with respect to financial
and administrative transactions carried out by health plans, health care clearing houses,
and health care providers who transmit information electronically in connection with such
transactions.
The final rule "Health Insurance Reform: Standards for
Electronic Transactions" was published in the Federal Register on August 17, 2000
with an effective date of October 16, 2000 and set forth in 45 C.F.R. Parts 160 and 162.
Compliance with the provisions of this rule is required by October 16, 2002, unless the
entity files a request with HHS before October 16, 2002 to postpone compliance to October
16, 2003. The form to be used was published by HHS in the April 15, 2002 Federal Register,
67 F.R. 18216.
HHS has proposed modifying some of the technical standards,
67 F.R. 38050 (May 31, 2002).
"Privacy" Provisions
Section 264 of Public Law 104-91 directed HHS to develop
standards to protect the security, including the confidentiality and integrity, of
individually identifiable health information, when it is shared with others.
The final rule "Standards for Privacy of Individually
Identifiable Health Information" was published in the Federal Register on August 14,
2002 and set forth in 45 C.F.R. Parts 160 and 164. Compliance with the provisions of this
rule is required by April 14, 2003. For "Small Health Plans", defined as plans
with annual receipts of $5 million or less, compliance is required by April 14, 2004.
Guidance from HHS’ Office of Civil Rights on an earlier iteration of this rule was
issued on July 6, 2001. This document provides an overview of the rule and specific
information in a question and answer format. Attention is directed to the transition rule
for prior authorizations and dealings with contracted business associates set forth in 45
C.F.R. 164.532. The document can be accessed at www.aspe.hhs.gov/admnsimp/final/pvcguide1.htm.
The final rule can be accessed at www.hhs.gov/ocr/hipaa/.
All licensees must be in compliance with all applicable
provisions of the aforementioned rules by their respective effective dates. If you need
further information or assistance, please visit HHS’ website at www.hhs.gov. |
