Insurance Circular Letter No. 17 (2002): Advisory on the Administrative Simplification Provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Circular Letter No. 17 (2002)

October 3, 2002

TO:

All Licensees

RE:

Advisory on the Administrative Simplification Provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA)

The purpose of this Circular Letter is to remind licensees of their obligations in terms of achieving compliance with the administrative simplification provisions of HIPAA.

The United States Department of Health and Human Services (HHS) has published final rules relating to the privacy, security and transmission of individually identifiable patient health information pursuant to the administrative simplification provisions of HIPAA.

"Transactions"/"Security" Provisions

Section 262 of Public Law 104-191 directed HHS to issue standards to facilitate the electronic exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearing houses, and health care providers who transmit information electronically in connection with such transactions.

The final rule "Health Insurance Reform: Standards for Electronic Transactions" was published in the Federal Register on August 17, 2000 with an effective date of October 16, 2000 and set forth in 45 C.F.R. Parts 160 and 162. Compliance with the provisions of this rule is required by October 16, 2002, unless the entity files a request with HHS before October 16, 2002 to postpone compliance to October 16, 2003. The form to be used was published by HHS in the April 15, 2002 Federal Register, 67 F.R. 18216.

HHS has proposed modifying some of the technical standards, 67 F.R. 38050 (May 31, 2002).

"Privacy" Provisions

Section 264 of Public Law 104-91 directed HHS to develop standards to protect the security, including the confidentiality and integrity, of individually identifiable health information, when it is shared with others.

The final rule "Standards for Privacy of Individually Identifiable Health Information" was published in the Federal Register on August 14, 2002 and set forth in 45 C.F.R. Parts 160 and 164. Compliance with the provisions of this rule is required by April 14, 2003. For "Small Health Plans", defined as plans with annual receipts of $5 million or less, compliance is required by April 14, 2004. Guidance from HHS' Office of Civil Rights on an earlier iteration of this rule was issued on July 6, 2001. This document provides an overview of the rule and specific information in a question and answer format. Attention is directed to the transition rule for prior authorizations and dealings with contracted business associates set forth in 45 C.F.R. 164.532. The document can be accessed at www.aspe.hhs.gov/admnsimp/final/pvcguide1.htm. The final rule can be accessed at www.hhs.gov/ocr/hipaa/.

All licensees must be in compliance with all applicable provisions of the aforementioned rules by their respective effective dates. If you need further information or assistance, please visit HHS' website at www.hhs.gov.

Very truly yours,

_____________________________
Gregory V. Serio
Superintendent of Insurance