Posts Tagged ‘HIPAA’

HIPAA/HITECH Omnibus Final Rule – Last Few Weeks To Comply!

In Uncategorized on August 27, 2013 at 6:38 pm

On January 17, 2013, the U.S. Department of Health and Human Services (“HHS”) issued a final rule (“Omnibus Rule”) affecting multiple aspects of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the HITECH Act.  

The Omnibus Rule, commonly referred to by this name because of its sweeping scope, is comprised of four final rules that (in general and succinct terms):

  • modify aspects of HIPAA and its implementing regulations including the privacy standards located at 45 C.F.R. parts 160 and 164, subparts A and E (the “Privacy Rule”), the security standards located at 45 C.F.R. parts 160, 162 and 164, subpart C (the “Security Rule”), and enforcement standards located at 45 CFR part 160, subparts C, D, and E (the “Enforcement Rule”);
  • implement statutory amendments, including an increased and tiered civil money penalty structure, under the Health Information Technology for Economic and Clinical Health Act (“HITECH”);
  • modify the interim final rule for Breach Notification for Unsecured Protected Health Information located at 45 C.F.R. part 164, subpart D (the “Breach Notification Rule”), including replacing its harm threshold for breach notification requirements with a default presumption that an acquisition, access, use, or disclosure of PHI that violates the Privacy Rule is a breach, and supplant the Breach Notification Rule as of the Compliance Date (covered entities and business associates must continue to comply with the interim rule in the meantime); and
  • modify the HIPAA Privacy Rule by implementing section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (“GINA”), clarify that genetic information is health information, and prohibit health plans, including group health plans, health insurance issuers (including HMOs), and issuers of Medicare supplemental policies, from using or disclosing genetic information for underwriting purposes.

The Omnibus Rule went into effect on March 26, 2013, and, except with respect to certain grandfathered business associate agreements, HIPAA covered entities and business associates must comply with its requirements by September 23, 2013.   The Business Associate’s Agreement between you and youe billing company – if entered into prior to March 26, 2013 – is in fact one of those that has been grandfathered in, and allowed a one-year extension in which to comply. 

The AMA summarized more fully the portions of the Omnibus Rule that impact the medical provider community.  Please be sure to review this carefully to ensure compliance.  Additionally, I have attached a sample HIPAA/Omnibus Notice of Privacy Practices, which, once modified to include specific data points pertaining to your practice, may be used by your practice going forward.  This sample was taken largely (but modestly adapted) from the sample Omnibus Notice published by MGMA. sample HIPAA Omnibus Notice of Privacy Practices-adapted from MGMA

As always, please do not hesitate to contact M.E.D.I.C., Inc. with any questions that you may have about this.


CMS Sets National 5010 Testing Day For June 15, 2011

In Uncategorized on May 12, 2011 at 6:56 pm

Beginning on January 1, 2012, a federal mandate requires health plans, clearinghouses, and providers to use new standards in electronically conducting certain health care administrative transactions at the heart of daily operations, including claims, remittance, eligibility, and claims status requests and responses.
Upgrading from the current HIPAA 4010A1 transaction standards to the new 5010 standards addresses several key goals:

  • Increase transaction uniformity
  • Support pay for performance
  • Streamline reimbursement transactions

As the deadline approaches, affected health care organizations need to upgrade and test their claims management systems to accommodate 5010 and prevent operational disruptions.

Two key factors prompted the upgrade to 5010: 1) the government and industry’s shared goal of providing higher quality, lower cost health care, and 2) the need for a comprehensive electronic data exchange environment for the vastly expanded ICD-10-CM and PCS code set transition mandated for compliance by October 1, 2013.

To this end, the Centers for Medicare and Medicaid Services is encouraging all Medicare trading partners to participate in National 5010 Testing Day on June 15 as part of preparations to comply with the HIPAA 5010 transaction sets by January 2012.

Local Medicare Administrative Contractors will be disseminating information on transactions being tested on June 15 and some Medicaid programs also will participate, with details to come.