Simplification at Last? HHS Rolls out Operating Rules for HIPAA Transaction Standards

By Chris Dimick

The HIPAA transaction standards-meant to streamline financial and administrative transactions-have instead devolved into a kind of free-for-all. Now the first operating rules are in hand to standardize use of the standards and gain the efficiencies originally intended.

When it comes to HIPAA transaction standards, healthcare organizations like to play by their own rules. Although the standards were intended to streamline the transmission of financial and administrative transactions, such as health plan eligibility requests and billing claims status checks, they left too much room for interpretation.

As a result, providers, vendors, clearinghouses, and health plans have developed their own rules for following the standards when exchanging information. The outcome has been disorganization and discrepancies between trading partners-hardly the simplification and efficiency envisioned when the standards were written.

But a mandate enacted by the Affordable Care Act requires the industry to adopt operating rules that dictate how HIPAA transaction standards are used. The first two operating rules pertain to transactions on health plan eligibility and claims status, and they must be implemented by the end of the year.

The creation of mandatory operating rules for HIPAA transaction standards is years in the making-and will continue to 2016-but it should lead to reduced costs and simplified work processes within organizations and across the industry.

A History of the Problem

First drafted into HIPAA legislation in 2000, the transaction standards were intended to unify the healthcare industry on ways to exchange financial and administrative data. But differences in state laws, individual system complexities, proprietary software, variances in internal business operations, and a lack of federal enforcement led to large inconsistencies in how organizations employed the standards.

There has never been guidance on how to use the standards, says Dan Rode, MBA, CHPS, FHFMA, vice president of advocacy and policy at AHIMA. Once organizations began adopting their own ways of using the standards, simplification went out the window.

Trading partners would only use parts of the standard, including information specific to their needs but not other data that could be used for broader administrative simplification, Rode says. Health plans would agree to trade different information with different providers, further varying use of the standards. Other organizations would disregard the standards entirely and make up their own rules. One health plan may handle patient eligibility requests entirely differently than another, causing administrative headaches for providers and their vendors.

That's why guidelines for employing the standards-or operating rules-are needed to restore order, Rode says.

Gwen Lohse is deputy director of the Council for Affordable Quality Healthcare (CAQH) and managing director of the Committee on Operating Rules for Information Exchange (CORE), based in Washington, DC. CORE developed the operating rules that take effect next year.

"The health plans do it differently, the vendors do it differently, the providers do it differently," she says. "We have written the operating rules to apply to all the entities that touch these transactions; we set expectations for all of them."

An ACA Mandate

Section 1104 of the Affordable Care Act (ACA), enacted in 2010, established a national healthcare operating rule mandate to help simplify and streamline administrative operations for all healthcare stakeholders.

ACA grants the Department of Health and Human Services the authority to create and adopt a single set of operating rules for all HIPAA transaction standards. The goal is to create uniformity in the implementation of electronic transaction standards, which simplifies the transaction and in turn reduces administrative costs.

In December 2011 HHS published its final rule on the first two operating rules-rules governing the 270–271 standards for "eligibility for a health plan" transactions and the 276–277 standards for "health claim status inquiry" transactions.

Trading partners have until January 2013 to implement the rules into practice. Those who do not comply face possible financial penalties issued by the Centers for Medicare and Medicaid Services (CMS), the administrator of the mandate.

HHS's advisory committee on HIPAA transactions recommended that CORE develop the first operating rules. CAQH formed CORE in 2005 to develop voluntary operating rules that providers, vendors, and payers could use to simplify transaction standards. Because CORE's operating rules for eligibility and claims status transactions were already in use in the industry, the committee was a natural choice.

CORE's voluntary rules became the basis for HHS's mandated rules, so organizations that have voluntarily adopted them should have a smooth transition to the mandated rules and a headstart on the January 2013 deadline.

CORE brought together a wide selection of industry stakeholders in 2005 when it began developing the two operating rules. This consensus-from providers, clearinghouses, vendors, payers, and others-ensured that the industry would embrace the operating rules in the pursuit of lowering cost and rising productivity, Lohse says. To date there has not been a major organized effort against their implementation.

"We had a solid set of rules that meet the regulatory framework that also have industry consensus and speak to the cost savings expected from this section of the [ACA] statute," Lohse says. "By all those groups coming together you are really assuring what comes out with the final regulation meets the goals anticipated."

What Is an Operating Rule?

An operating rule is a set of policies that dictate how a transaction standard is implemented and used. It supports the standard, providing detail on how it should be used to simplify administrative work and increase data use for a positive return on investment.

The operating rules do not change the transaction standards, just enhance and fine-tune them by providing detail. In some cases, the rules address the infrastructure of the transaction, in others the content of transactions. In all instances, the operating rules are intended to simplify the variances that exist in how trading partners currently employ the standards.

Key transaction components covered by the operating rules include:

• Rights and responsibilities of parties in a transaction
• Security
• Exception processing
• Transmission standards and formats
• Response time standards
• Liabilities
• Error resolution

Setting Universal Expectations

The operating rules have specific requirements for eligibility requests and health claim status checks. In eligibility requests, for example, the rules state payers must confirm patient benefit coverage and co-pay, in/out of network variances, coinsurance and base deductive information, as well as provide financials for 48 required system benefit types. This information must be provided in real time, taking no longer than 20 seconds round- trip.

The operating rules for health claim status feature infrastructure requirements that improve connectivity. Further, state trading partners must provide more patient financials, including year-to-date patient accumulators, also within a 20-second, round-trip response time.

Both operating rules have processes for improving how patient names are stored and retrieved in trading partner systems, which will reduce misidentifications and mistaken denials. The rules also require that an acknowledgment of a request is sent within a set response time.

The rules set expectations to establish reliability in transactions among all trading partners, Lohse says.

HIM professionals who supply clinical information to payers or clearinghouses and other vendors will now have one definitive way to submit that information, Rode says. "They won't have to do it differently for every insurance company or health plan that comes to them requesting data," he says.

Other departments in hospitals and doctor offices will also see improvements. In the admitting and registration departments, patient health plan eligibility information requests will be standardized and received faster due to the operating rules, since the rules establish the information to be included in the response, such as co-pay amounts and patient deductibles, and how quickly the request must be answered.

"Operating rules address things that the standards have not traditionally addressed that are more business rules, like response times," Lohse says, adding, "How good is information on patient eligibility if you get it after the patient has left the office?"

In addition to the real-time eligibility response, the rules establish when trading partners will be available to respond to requests. Setting universal expectations helps provider organizations, many of whom are open around the clock.

In claims processing departments, the operating rules will improve billing functions, because providers will know the proper co-pay and deductible while the patient is present, not after the fact when a follow-up bill would be required. Real-time eligibility checks will reduce claim denials, preventing patients from receiving unexpected bills and helping providers avoid taking on bad debt.

CAQH studies show provider groups working with health plans that voluntarily implemented the CORE operating rules saw a 10 to 12 percent reduction in claim denials and a 20 percent increase in patients verified for eligibility prior to their visit, according to Robert Bowman, CAQH CORE manager, who presented on the operating rules during a CAQH-WEDI audio seminar in December.

Voluntary Adoptions Show Results

BlueCross BlueShield of Tennessee (BCBST) is one organization that has already gained operational efficiencies and administrative cost savings from implementing operating rules. The payer has been voluntarily using the CORE operating rules for years and have seen direct benefits, says Susan Langford, an EDI systems analyst at BCBST. The organization began its implementation of the eligibility and claims status operating rules in 2007.

Real-time electronic transactions have greatly increased, allowing the health plan to instantly provide information to providers on patient eligibility for care either before the patient arrives or while he or she is receiving care. This has reduced phone calls, because providers get their results instantly, which has led to a reduction in operating costs for both BCBST and the providers it works with.

Use of the rules led to an explosion in the number of electronic transactions BSBST performed each year. When the health plan first implemented the CORE operating rules in 2008, it handled 600,000 eligibility and benefit requests electronically. By 2011 that number had risen to 12.6 million transactions.

Use of the operating rules also ensures providers receive additional financial information such as co-insurance amounts, co-payment, deductible information, and remaining deductible amounts. This information allows the provider to know exactly how much to charge patients while they are in the office, reducing open accounts and the need to collect payment later. It is also done electronically, without the need to pick up the phone and ask questions.

For Passport Health Communications, a clearinghouse that was also an early adopter of the CORE operating rules, the rules led to additional data and support mechanisms that improved customer service and gave providers better and more consistent data.

"We think that is not just a trivial issue but a major contributor to helping providers reduce cost for operations," says Richard Farmer, Passport's director of transaction content, who spoke at the December CAQH-WEDI audio seminar.

The increased flow of data through the system, especially faster financial data, can be used by providers to improve processes and "best deal with patients before they walk through the door," Farmer says. This can be used to check the insurance eligibility of patients at the time of registration, get more uniform responses so providers' financial systems do not have to search for data, and allows providers to conduct financial predeterminations-a benefit to patients who have high deductible plans and are increasingly responsible for paying for care.

After implementing the rules, Passport saw fewer follow-up inquiries asking for additional data, fewer phone calls to the payer, and improved financials in its provider partners, Farmer says.

Finally, Enforcement

With billions of its own transactions occurring every year, CMS has a vested interest in ensuring the healthcare industry follows both the HIPAA transaction standards and their operating rules.

After years of nonenforcement, HHS and CMS have shown they are now serious about simplifying administrative transactions and holding accountable those who do not abide by the standards and their operating rules, Langford says.

ACA requires HHS create a process for verifying compliance with the mandated transaction standards and operating rules and levy financial penalties for noncompliance.

While all HIPAA covered entities must comply with the mandated operating rules, only health plans will be subject to compliance verification and fines-not providers, vendors, or clearinghouses, Bowman says.

Since health plans are a main spoke in administrative and financial data exchange, it is expected that requiring them to use the standards and operating rules will cause the plan's trading partners, such as providers and clearinghouses, to follow suit. Health plans could also write the operating rule requirements into their contracts with providers, vendors, and clearinghouses, Lohse says.

HHS has not yet released details on how it will verify compliance or fine health plans for failing to comply. A separate HHS rule will likely cover enforcement details and outline steps health plans have to take to prove compliance.

While CAQH does offer a certification program for its CORE operating rules, HHS has said explicitly that CORE certification will not be a requirement for compliance with the mandated rules. However, some other type of certification or verification could be possible, Bowman says.

Implementation Manageable

While there was some debate within the industry on what the standards and operating rules should cover, no organized opposition to the implementation requirements or the deadline has surfaced.

Those who have adopted the CORE voluntary operating rules should have little trouble implementing the mandatory HHS rules, Lohse says. Most clearinghouses already are following many of the requirements, Farmer says, and implementing the remaining ones is a "no brainer" since they will simplify the clearinghouses' jobs.

"We didn't find it particularly difficult to do," Farmer says of implementing the CORE operating rules. "For most of those major clearinghouses in the country, we don't think that there is any significant problem for them to meet the rules, at least on the connectivity side."

But organizations unfamiliar with the rules could have a harder time changing their systems before the January 1 deadline.

The difficulty in implementation will depend on where an organization is with its IT and data exchange capabilities, Lohse says. Since some trading partners have been following only parts of the electronic transaction standards, implementing those missing areas comes with varying degrees of difficulty.

"Some may have focused on offering real-time eligibility-they are ahead of the game there, but they may not have focused on providing financial statistics on year-to-date deductibles and in- and out-of-network information," she says. "It really does depend on the individual organization and where they have already been focusing."

While BCBST had its share of small challenges implementing the operating rules, the process was not "too difficult to overcome," Langford says. Organizations familiar with HIPAA transactions and the recent upgrade to version 5010 should not have much of a problem implementing the operating rules, she says.

For providers, business departments will need to evaluate their electronic processes, check with vendors to evaluate their readiness, and train some staff on how the operating rules affect work processes, such as admitting and registration.

Regardless of where they are starting, Lohse expects all entities will have enough time to adopt the new operating rules before the deadline.

"There may be a reluctant few that do not want to change, but when these operating rules are implemented, I feel certain they will also see the benefits," Langford says.

Chris Dimick (chris.dimick@ahima.org) is staff writer at the Journal of AHIMA.