TRANSCRIPT. I would now like to turn the conference over to your host Mr. Robert Burns. Mr. Burns, you may begin.

Transcription

1 HIPAA Electronic Transactions Compliance Briefing National Governors Association Center for Best Practices Health Resources and Services Administration Dial-In: Conference ID: TRANSCRIPT OPERATOR: Good day ladies and gentlemen and welcome to the HIPAA conference call. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session and instructions will follow at that time. If anyone should require assistance during the conference, please press star then zero on your touch-tone telephone. As a reminder, this conference call is being recorded. I would now like to turn the conference over to your host Mr. Robert Burns. Mr. Burns, you may begin. ROBERT BURNS (NGA Center): Thank you very much Tiffany. Welcome everyone to this, I guess, briefing before the next of several compliance deadlines to implement HIPAA. For those of who I don't know I am Bob Burns. I am a Policy Analyst at the National Governors Association Center for Best Practices and we are able to bring this to you through a cooperative agreement that's funded by the Health Resources and Services Administration (HRSA). We have with us today to give a very brief update on some of the trends they're seeing and how they're responding to them, Stephanie Kaminsky from the HHS Office for Civil Rights (OCR), which is responsible for implementing and enforcing the HIPAA Privacy Rule. Afterwards, we will hear from Karen Trudel with the Centers for Medicare and Medicaid Services (CMS), to talk about the compliance and enforcement activities [around the HIPAA Electronic Transactions and Code Sets rule] and some ideas to help states with contingency planning for compliance deadline. So, with that, we'll go ahead and start with Stephanie Kaminsky [from OCR]. There will be an opportunity for questions and answers once she's finished. STEPHANIE KAMINSKY (OCR): Thanks, Bob. Hi and good afternoon. I am here to update you on where things stand with the Privacy Rule. As I was thinking about my remarks just a few minutes ago I looked at the calendar and realized we are right at about the six months mark of the implementation of the Privacy Rule, which is pretty amazing to me, personally. I don't know about you, but it has been an eventful six months. As of today, we have received over 2300 privacy-related complaints. That's as of an hour ago. I'm pleased to report that we have resolved and closed over one-third of those. About 809 complaints have been resolved or closed at this point and in many cases because [the complaints] did not raise a privacy issue. The action complained of did not violate the rule or we were able to resolve the matter through voluntary compliance and technical assistance. We are, generally, pleased at the response of covered entities who seem to be moving quickly to come into compliance when we contact them. We have done some sorting of the nature of the complaints that we've received. And though I was unable to get the most updated numbers in that arena, I'll talk in terms of big picture trends and where the bulk of those complaints are in terms of numbers. Some of these numbers that I'm mentioning are coming from a while ago but I think the trends have probably continued in the last several weeks.

2 HIPAA Electronic Transactions Compliance Briefing Transcript Page 2 The bulk of our complaints are around impermissible uses or disclosures. The way we are looking at those we don't have those sorted by the type of use or disclosure but basically that could be a wide array of types of complaints. The next area that we are receiving complaints about [relates to] inappropriate safeguards [with respect to] the safeguard standard. Sometimes that includes misuse of protected health information. Often its issues related to waiting room encounters or other facility encounters. The next category we've had a lot of complaints in is access requests not being responded to appropriately or some kind of problem with the ability of individuals to obtain protected health information. The next area or the next two areas that we seem to be getting complaints in, probably of equal volume are notice failure to provide notice or inadequate notice and also complaints around improper or incomplete application of the minimum necessary standard, which might be related to incidental uses or disclosures. In other words, you would get a complaint about an incidental use or disclosure, but in truth it's a problem because the minimum necessary standard is not being utilized properly (not to be too technical). We're also seeing cases involving authorizations. So, those are sort of the way we're seeing the trends right now. We continue to implement a complaint-driven process and we are continuing to encourage voluntary compliance from covered entities. Again, we really, feel that this is the quickest and most efficient means of ensuring that individuals benefit from the protections of the rule. We continue to feel that a voluntary compliance approach or seeking voluntary compliance is consistent with the authorities of HIPAA, and with that I would like to continue to emphasize that while we continue to seek informal resolution through voluntary compliance, wherever appropriate and expect to be able to resolve the vast majority of cases through these informal means, we will employ a variety of enforcement options available, as needed, to ensure that consumers receive privacy protections afforded by the rule. I might add that we have been working with [the U.S. Department of] Justice and continue to refer cases there and expect that we will continue to do so. I think I was asked to give a brief update and I think that, probably, is a good summary for right now. I welcome any questions, now or later, however, you want to continue with the program. BURNS (NGA Center): Okay, we can go ahead and open it up for questions. One clarification that I have you had said one of the areas that you're getting complaints in is impermissible uses and disclosures. Does that mean a complaint [where] someone feels a disclosure was done improperly? Is that what would fall into that category? If they, say, released information for something and maybe the consumer or the patient felt that was not a proper use or they didn't have proper consent or authorization? KAMINSKY (OCR): Well, like I say, a disclosure to an employer that was not authorized that would be an example. BURNS (NGA Center): Got you. Are there any questions for Stephanie? OPERATOR: Thank you. At this time, if you have a question, please press the one key on your touchtone telephone. If your question has been answered or you wish to remove yourself from the queue, please press the pound key. Once again, if you have a question, please press the one key. Our first question is from Chris Mickens of Indiana State Department of Health. Please go ahead.

3 HIPAA Electronic Transactions Compliance Briefing Transcript Page 3 CHRIS MICKENS (IN): Yes, I have a question. If a complaint is lodged, how will the Office of Civil Rights know who to get in contact with at a particular organization? KAMINSKY (OCR): That's a great question. Actually I somewhat anticipated that from this group, in particular, and I will say this: we work to get in touch with the appropriate person at whatever organization is [that] the complaint has been lodged against. We look to find both the person who will tell us what we need to know and who has the authority to address the problem. And that may be different depending on the organization, what level, the nature of the organization, and the way that it's structured. So it does vary. But it's not necessarily in fact, I don't believe it's often the privacy officer per se is hooking up when a corporation, perhaps the CEO or what at that level. I think that when dealing with state and local entities, it ties into the general issue of organizational identity that has always been there for this group. I was unable to look closely at how we've handled it so far, with respect to the handful of complaints we have received against state related entities. We have received some complaints against, for example, state hospitals or state departments of corrections (or a couple of other types of state entities that I was unable to look up specifically). But I will say that we try to get in contact with the person or officer or department that has the authority to correct the problem and also the entity that would have the information that we need to have to properly investigate. BURNS (NGA Center): Is information required on a complaint form about who [in an organization] to contact when a complaint is actually submitted? KAMINSKY (OCR): No, I don't believe so. BURNS (NGA Center): Okay. OPERATOR: Thank you. Once again, if you have a question, please press the one key. Our next question is from Anne Marie Rainville from New York State Office. Please go ahead. ANNE MARIE RAINVILLE (NY): Yes, we ve heard there may be other rules that will be drafted, specifically regarding health plans in HIPAA. Can you tell us if there's a new rule being drafted? And the other thing is we've heard that DHHS is working on guidance documents regarding discreet substantive areas. Can you tell us when we can expect additional guides? KAMINSKY (OCR): I actually will defer to my sister agency, CMS, about the additional regulations (I guess health plan specific). There are a variety of Administrative Simplification regulations that are in the pipeline and I'm not sure if that's what you are referring to or something else. Certainly, the regulation that is currently under development that OCR and CMS are working on together cooperatively under the auspices of the Department is the Enforcement Rule. Right now we have a procedural Enforcement Rule that has been written and we are working on the substantive piece. I'm not sure about any particular health plan regulation, so I will defer and see whether we can get some clarity there. With respect to discreet pieces of substance of guidance, I don't know, again, if you're referring to the Privacy Rule or something else. With respect to the Privacy Rule, we are working on some targeted technical assistance pieces for different constituencies, including for state and local entities. I don't know if that is what you had heard through the rumor mill or something else but that's what I can report to you about and I don't know if there's something that CMS wants to add about regulations.

4 HIPAA Electronic Transactions Compliance Briefing Transcript Page 4 KAREN TRUDEL (CMS): No, Stephanie. Aside from the regulations that were proposed, additional transactions or identifiers, we don't have anything that will specifically impact health plans. BURNS (NGA Center): Okay. Are there any other questions before we have Karen talk to us about the compliance deadline next week? OPERATOR: I'm showing no further questions at this time. BURNS (NGA Center): Okay. If there are any other questions down the line, please feel free to send me an at rburns@nga.org. That is also located on the agenda, which is available on our web site at Well, thank you very much Stephanie for giving us an idea of the trends and such that are happening in Privacy. I guess one other question I had was: what is the procedure after you get a complaint and determine its validity? Does a letter go out notifying the covered entity that some escalation or valid complaint has been lodged or to tell them the status? How would they go about keeping up with the status of something that's valid and underway? KAMINSKY (OCR): That's a good question. Certainly, when we receive a complaint we send an acknowledgment letter to the complainant and then, ultimately, after taking a look at what's been submitted assuming we have enough information we make some determination whether we have jurisdiction, whether or not the complaint is alleging a potential violation, whether it's worth pursuing, etc. Not worth, but whether it has merit to pursue. Assuming it does, then yes, a notice letter does go out to the covered entity, notifying it. And that is where we make the decision about who is in the covered entity to contact and how to get in touch with the covered entity. And that is a point where the covered entity can also redirect us in terms of who should be our point of contact, as we continue through an investigation. At that point, often a technical assistance phone call may go out or a phone call to investigate. But through the course of investigation it [may] become clear that there's some area where technical assistance can be of service and can resolve whatever is at issue. So that might be the next point of discourse. Hopefully that'll be the next point of discourse, from everybody's perspective. If that weren't the next point of discourse, then there would be further investigative components moving in a more formalized direction and that would certainly vary circumstance to circumstance. But there is an initial notice letter that goes out and covered entities would have the opportunity through that contact to decide what they want to have as their point of contact and to inform OCR and work with OCR in terms of the going forward [with] communication. BURNS (NGA Center): Great. Well, thank you very much, Stephanie. We, really appreciate it. KAMINSKY (OCR): You're very welcome. Good luck with Transactions and Code Sets. BURNS (NGA Center): Well, for those who are not in the Washington area, we of course just had a hurricane come through recently. We were talking about it a little bit beforehand and we don't think it's going to be as bad next week when the transactions and code set deadline comes. But just to get an idea and get a little preview of some things going on to try to make it so that it's not a hurricane but [instead] sunny weather, is Karen Trudel from the Centers for Medicare and Medicaid Services (CMS).

5 HIPAA Electronic Transactions Compliance Briefing Transcript Page 5 TRUDEL (CMS): Thank you very much. Actually, I haven't heard it equated to a hurricane before. I've been hearing the term train wreck. But both are potentially apt. I'm joined here today by Rick Friedman from the Center for Medicare State Operations (CMSO), Medicaid State Operations, and he will help me answer questions, etc. Want to talk a little bit about where we are versus where we were a couple of months ago. In July, we did publish the guidance that talked about health plans implementing contingencies to keep their cash flow and operations going as long as they were exhibiting a good faith effort to comply. In fact, on September 23, Medicare announced that it would deploy its contingency plan. That was based on the fact that at that time we were looking at perhaps 14 percent of the electronic claims being HIPAA compliant in production, which is an extremely low number [with] less than one month before a go live date on an EDI (electronic data interchange) format change. I am happy to say that new statistics came out today and as of today our percentage of compliant claims in production has jumped to 22 percent, which I think is quite good and is showing that we're making good progress. The Blue Cross/Blue Shield Association announced on that same day (on the 23 rd ) that all of the Blue Cross/Blue Shield plans would, likewise, implement a contingency and Medicare's contingency is that we will continue to accept all transactions not just claims, [but] all transactions in our Legacy format. The primary impact to states is the coordination of benefits (COB). We have been having difficulties with doing successful testing with the states because in a number of cases we and they did not interpret implementation guides in quite the same way, which caused some expectations to not be met when the states began to look at our test files. We did recently have a conference call between some of the states and our Medicare fee-for-service folks and we are working through those issues as quickly as we can to try to resolve them. However, we do have as a contingency the ability to send out Legacy formats COB files. Well, when are we going to turn the contingency plan off? That, I think, is probably the question that I've been hearing the most over the last week or two. The short answer is that we don't know. We didn't provide for a specific cut off date because we didn't feel that we had enough statistics that were going to show us what the progression towards compliance was going to be. As I said, the progression has just recently picked up quite considerably. We're very happy about that. We'll continue to monitor it on a weekly or bi-weekly basis and when we feel that we've got a good, strong track record, we can see how the progression is going [and] we'll [then] be able to make a decision about when we're going to turn off the contingency. And, of course, we will provide our trading partners, COB trading partners, [and] providers with adequate notice before we begin to do that. One of the things that I think I saw on the agenda was that we were going to provide you with some advice about state contingency plans and putting them in place. I'm not going to presume to advise you what your contingency plans should be or things you should be thinking about. I think you are in a much better place to know that than I. But Rick and I will be happy to take your questions about that and perhaps, even, turn this into a kind of interactive discussion of what kinds of contingency planning issues are coming up. Let me talk about enforcement a little bit. As Stephanie mentioned, our process is complaint driven and we will have an electronic system that will go up on Thursday for submitting complaints. It will automate some of that process because we, frankly, don't have a real good handle on the volume of complaints that we're going to receive. This is some place where we've really never gone before and so we're trying to make allowances for all contingencies.

6 HIPAA Electronic Transactions Compliance Briefing Transcript Page 6 So, we are set to accept complaints. We'll process them pretty much the same way that Stephanie mentioned. We'll make sure that the person has standing to file a complaint, that they're actually filing a complaint about a transaction, [and] that it's actually a HIPAA issue. We will go out and let the organization that is complained against know and I think Chris Mickens point was very well taken we will have to make very sure that we find the right person in the organization who can respond to the complaint. I realize that this gets more and more complex as the organization that is complained against (as a covered entity) is larger and more complex. But we are set to handle those issues. What do I think is going to happen next week? I think problems are going to creep up over the next weeks and months. People are not going to have files or claims rejected pretty much on day one. I think the problems that are cropping up are things that we'll have to deal with. We'll have to try to find a work around. We'll have to try to get some of the WEDI [Workgroup for Electronic Data Interchange] regional SNIP [Strategic National Implementation Process] affiliates involved in working out problems, especially if they seem to be local in nature. I would encourage you to work with the regional SNIP affiliate in your area (if there is one) to try to work through any problems that might occur. I would encourage you if something occurred in your system, if a contingency doesn't work, [or] if something that you thought was working isn't working to please let your regional office know because they can run interference for you as we get questions and can help put you in touch with people who can help work through what some of the solutions might be. I think that's about all I had to say. I'll ask if Rick wants to add anything and then, I guess, we'll tag team questions. RICK FRIEDMAN (CMS): Well, just from a Medicaid perspective we've been very pleased here at CMS in terms of the progress that the states have made relative to HIPAA under very trying circumstances. Earlier this week, we had some indication that eight states were already processing HIPAA compliant claims, receiving them, [and] paying them. An additional three states were processing HIPAA compliant pharmacy claims. A number of states have contingency plans that involve running dual systems that, like Medicare, will handle both the Legacy formats and the HIPAA compliant ones. We've made a number of site visits over a dozen site visits to individual states that we wanted to make sure that we were cognizant of the steps they were taking. [We] were, frankly, in every case, quite impressed with not only the thoroughness with which they're implementing HIPAA but the safety measures that they've taken, in terms of contingency plans to assist providers so that [they] will get paid. I think all states have put the top two priorities in the same place where Medicare has relative to making sure that care continues and providers get paid accurately and timely (and everything else follows after that). But in terms of the technology and their systems, we're quite impressed with the efforts they've made and the progress that they are at. So we are not really anticipating any major meltdowns on the 16th or any time thereafter. I do think this is a very complicated situation and there'll be a lot of issues that need to be worked out, but people are working in good faith to do that. BURNS (NGA Center): Well, thank you, Karen, and thank you, Rick. I, actually, have one quick question. It comes from one of the technical assistance documents on your website, called, "Guidance on Compliance With HIPAA Transactions and Code Sets After the Implementation Deadline." [The document] says, "Covered entities, including health plans, may not conduct non-compliant transactions after the deadline." I just want to get some clarification: this doesn't require that providers submit claims electronically, only if they do so [that] they have to do so in a standard format. Is that correct?

7 HIPAA Electronic Transactions Compliance Briefing Transcript Page 7 TRUDEL (CMS): Yes, you're absolutely correct. And the law is very clear about that. The law gives providers the ability to make a decision about whether they're going to be in the electronic world or not. And if they decide not, then they are not a covered entity under HIPAA for any reason, for any of the provisions. However, if the provider does opt into the electronic world, then they need to comply with the HIPAA Transaction and Code Set requirements. That being said, the guidance document still does provide the ability for implementing the contingency in good faith that I don't think we addressed that in that particular document. BURNS (NGA Center): Good deal. Well, why don t we go ahead and open it up for questions, if anyone has a question. OPERATOR: Thank you. Once again, if you have a question, please press the one key on your touchtone telephone. Our first question is from Edward Meyers, Missouri Department of Mental Health. Please go ahead. EDWARD MEYERS (MO): Hello. The question about Medicare Legacy format still being used, would that include paper as well? TRUDEL (CMS): No, it doesn't. We have a bit of a complicating situation with Medicare because we also have the ASCA [Administrative Simplification Compliance Act] law that contains requirements for who can continue to send us paper claims. That is unaffected by the contingency plan. So the contingency plan just affects electronic transactions. With respect to paper, providers can only send us paper claims if they meet one of the exceptions in the Medicare electronic billing regulation, such as a physician with fewer than 10 full-time equivalent employees. FRIEDMAN (CMS): Let me just add to that, if I may. There's a fair amount of confusion I don't think by people on the phone but perhaps people that they may talk to in that when people hear that CMS is requiring, for example, electronic claims people think that that requirement applies to the state Medicaid agencies. And, of course, it does not; it only applies to Medicare. So when people hear about CMS doing X or Y, they think that may also be applicable in the case of the state Medicaid agencies [and] it's not. Similarly, in terms of the contingency plan running dual systems [is] the solution that Medicare has selected; it does not mean that state Medicaid agencies are required to do that (although many of them have taken the same course of action, as well as the private payers). TRUDEL (CMS): And it certainly does not mean that that when Medicare turns of it's contingency, everybody else needs to do the same thing. BURNS (NGA Center): Okay, are there any more questions? OPERATOR: Thank you. Once again, if you have a question, please press the one key. Our next question is from John Davies from the County of Rockland. Please go ahead. JOHN DAVIES (Consultant): Hi, I'm a consultant at the County of Rockland. I had a question as far as uploads for Medicare and Medicaid. Do we have to use IVANS or EDIFAX, or is there going to be direct FTP sites to send these transactions to?

8 HIPAA Electronic Transactions Compliance Briefing Transcript Page 8 TRUDEL (CMS): For Medicare purposes, the electronic transactions will continue to be accepted in the way that they are now. In some cases, people do that via clearinghouse. Some of the Medicare contractors do have a clearinghouse on their front end, but essentially that doesn't change. It s just the format of the transaction that changes. FRIEDMAN (CMS): And I think the answer's exactly same for most state Medicaid agencies. JOHN DAVIES (Consultant): Right. What we're trying to do is just go straight up instead of using a third party. Instead of having a clearinghouse we can send a direct transaction to IVAN and IP to IP (or an FTP) site on the state level. I was just asking if that was available or do we have to use something like an IVAN? As far as I see, right now they have to use IVAN. Are you familiar with what I'm talking about? BURNS (NGA Center): I'm sorry. I have no clue what IVANS is. TRUDEL (CMS): No. I would suggest that if you have a Medicare issue [that] you talk to the EDI department at the carrier or fiscal intermediary and find out exactly what transmission modes are available to you. JOHN DAVIES (Consultant): That sounds good. Also, a question concerning a full cycle testing: is there the ability for us to send 837's, for you to process it through your system, create an 835, and return that to us? TRUDEL (CMS): Again, for Medicare purposes you would need to talk to the carrier or FI (fiscal intermediary) to find [whether] the testing mechanisms are different at the various contractors. Some are highly automated, some are not. And so you really need to talk to the specific contractor that you're trying to communicate with to find out exactly what they can do. JOHN DAVIES (Consultant): Okay, thank you. TRUDEL (CMS): You're welcome. OPERATOR: Thank you. I'm showing no further questions. BURNS (NGA Center): Okay. Well, Karen and Rick, I really do appreciate you taking the time to talk with us today. I'm sure a lot of people are probably taking advantage of the Columbus Day weekend and perhaps are away. So, we are going to make available a transcript of the call and that will be available sometime before Thursday of next week, and it will be available on our website, Also [on our website are] links to the various technical assistance and guidance documents that CMS has produced to serve as a resource and help answer some questions. And again, if there are any further questions regarding the call, you can certainly send me an . And that again is rburns@nga.org, and I'll be happy to either try to answer it myself or try to find someone who can answer it for you. But again, Karen and Rick, I do appreciate the time that you took to talk with us today. And if there are no other questions, I think we can adjourn the call Great. Well, thank you all very much and we look forward to a smooth implementation next week. Thank you. OPERATOR: Thank you. Ladies and gentlemen this concludes today's conference. Thank you for your participation. You may disconnect at this time and have a wonderful day.

9 HIPAA Electronic Transactions Compliance Briefing Transcript Page 9