• Deadline Approaches for Compliance with HIPAA Electronic Transmission Standards
  • May 6, 2003
  • Law Firm: Haynsworth Baldwin Johnson & Greaves LLC - Office
  • Under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), employers, health plans, and other entities that transmit health information in electronic form are required to meet a number of new privacy standards. With the exception of "small health plans" - defined to mean health plans with annual receipts of $5 million or less - entities that transmit health information are required to be in compliance with the health care electronic transaction standards under 45 C.F.R. Part 162, not later than October 16, 2002. Small health plans have until October 16, 2003, to come into compliance.

    To calculate annual receipts for purposes of determining whether a health plan constitutes a "small health plan," the procedures and definitions provided at 13 C.F.R. § 121.104(a)(2) - (3) and 121.104(b) should be employed. ERISA group health plans that are exempt from filing income tax returns should generally use the following measures to determine their annual receipts:

    1. Fully insured health plans should use the amount of total premiums which they paid for health insurance coverage during the plan's last full fiscal year to determine their total annual receipts.

    2. Self-insured plans (funded and unfunded) should use the total amount paid for health care claims by the employer, plan sponsor, or benefit fund (as applicable) during the plan's last full fiscal year to determine their total annual receipts.

    Plans that provide health benefits through a mix of purchased insurance and self-insurance (for example, self-insured plans with stop-loss coverage) may need to combine certain aspects of measures 1 and 2 above to determine their total annual receipts.

    Under the recently enacted Administrative Simplification Compliance Act ("ASCA"), entities subject to the October 16, 2002, compliance deadline may obtain an automatic one-year extension of their compliance deadline. In order to obtain the extension, such an entity must file an ASCA compliance plan with the Centers for Medicare & Medicaid Services at the Department of Health and Human Services ("HHS") on or before October 15, 2002, summarizing how the entity intends to come into compliance with the regulations. Filing a properly completed ASCA compliance plan is sufficient to entitle the plan sponsor to the one-year extension.

    The compliance plan must include an analysis reflecting the extent to which, and the reasons why, the entity is not in compliance; a budget, schedule, work plan, and implementation strategy for achieving compliance; whether the entity plans to use or might use a contractor or other vendor to assist the person in achieving compliance; and a time frame for testing the implementation elements that begins not later than April 16, 2003. HHS has issued a model form, which may be obtained at The form may be downloaded and filed in paper form, or submitted electronically.

    A group health plan that is not a small health plan and that uses a third-party administrator ("TPA") may find that the TPA has already filed a compliance plan with HHS for the group health plan. While the obligation to obtain an extension rests with the plan sponsor, TPAs may submit a compliance plan on behalf of an employer/plan sponsor.

    Employers should ascertain whether their plans are small health plans and, if not, should ensure that a compliance plan is submitted to HHS in time to ensure the one-year extension. Employers with questions about whether they are subject to the electronic transmission standards, their plan's status as a small health plan, or whether they have filed a properly completed compliance plan should consult with their employee benefit professionals promptly.