1. HIPAA & the States New Federalism for a New Century HIPAA Centers for Disease Control and Prevention Washington, DC January 27, 2003 Presented by Robert J. Burns NGA Center for Best Practices

2. © 2002 National Governors Association 2 What is HIPAA? Health Insurance Portability and Accountability Act of 1996 (HIPAA) Established federal floor of consumer protections, marketplace standards –Insurance market reforms –Privacy, security –Administrative simplification New Federalism

3. © 2002 National Governors Association 3 Health Insurance Market Reforms Limits preexisting condition exclusions –Creditable coverage, significant breaks Prohibits insurer penalties because of poor health Extends certain coverage rights –Maintain group coverage when changing jobs –Purchase coverage (termination, small employers) –Renew coverage (individuals, small employers) –Special enrollment (marriage, birth, adoption, etc.)

4. © 2002 National Governors Association 4 Mental Health Parity Act (1996) –Same annual and lifetime dollar coverage mental health as for general health Newborns’ and Mothers’ Health Protection Act (1996) –Coverage for breast reconstruction following cancer- related mastectomy Women’s Health and Cancer Rights Act (1998) –Length of hospital stay in connection with child birth (“drive-by deliveries”) Health Insurance Market Reforms

5. © 2002 National Governors Association 5 Privacy (and Security) Restricts use(-s) of “individually identifiable” patient health information –Conditions necessary (authorized uses, patient consent) –Information allowed (“minimum necessary”) –Protocols, procedures (patient notification, business associate agreements) Prevents unauthorized access to PHI –Administrative, technical, physical safeguards

6. © 2002 National Governors Association 6 Administrative Simplification To improve the efficiency and effectiveness of the health care system Standardizes the exchange of electronic health information (administrative, financial) –Health plan enrollment (or disenrollment) –Health plan eligibility determinations –Health plan premium payments –Referral certification, authorization –Claim submissions (encounter info) –Health plan benefit coordination –Claim status inquiries –Payment and remittance advices

7. © 2002 National Governors Association 7 Who Must Comply? (“Covered Entities” and “Covered Functions”) Individual or group health plans (or programs) that provide health benefits directly, through insurance, or otherwise Health care providers (or suppliers) of medical or other health services or supplies (that also conduct certain health care transactions electronically) Health information clearinghouses that process or facilitate the processing of electronic health information into a standard format

8. © 2002 National Governors Association 8 “Agencies can no longer act as if they are separate organizations with independent missions.” “Agencies can no longer act as if they are separate organizations with independent missions.” Governing Magazine January 2003

9. © 2002 National Governors Association 9 Who Else Must Comply? Hybrid entities whose business activities include both covered and non-covered functions Business associates that perform certain functions or activities on behalf of a covered entity Information trading partners that rely on protected health information for purposes not directly related to the business activities of covered entities

10. © 2002 National Governors Association 10 State Paradox The broad mandates of most public programs go far beyond HIPAA’s narrow, private-sector orientation towards health plans, health care providers, and health information clearinghouses. Unlike the private sector, states must balance the law’s requirements with their additional roles as purchasers, managers, and regulators of health care, as well as guardian of the public’s health and safety.

11. © 2002 National Governors Association 11 What Does this Mean for States? (Labor-Intensive Review of State Government) Identify covered entities –Agencies, programs, covered functions Evaluate information sharing practices (PHI) –Transactions, technology Determine legal requirements –Preemption analysis of state, federal law Revise business practices (statewide) –Policies, procedures, materials –Technology Adapt information sharing relationships –Business associates, trading partners

12. © 2002 National Governors Association 12 How States Are Responding (Process) Compliance planning –Interagency planning committees –Dedicated HIPAA project offices (CA, IA, OH, SC) –Medicaid-led (NC) –State CIO, privacy office (FL, KY, NY) Pooled resources –Compliance tools (impact assessments, business associate agreements) –Some cost sharing (CA, TN) –Public/private collaboratives

13. © 2002 National Governors Association 13 How States Are Responding (Policy) Implementing trading partner agreements Consolidating technology (GA, UT) Reassigning program functions –Orthodontia, hearing aids (CO) Instituting complaint management systems –800 referral number (NC)

14. © 2002 National Governors Association 14 Ongoing Compliance Barriers Unfunded mandate –Medicaid (recoup enhanced match) –Non-Medicaid (no federal funding) Poor guidance (no validation) –Covered entity determinations –Preemption decisions (state, federal) Staggered implementation schedule –Counterproductive (state resources) –Wasteful (taxpayer dollars) Complaint-driven enforcement –Unknown vulnerability (penalties, lawsuits) –Unknown application (among HHS regions)

15. © 2002 National Governors Association 15 Community-based providers (“safety net”) Public hospitals/clinics Mental health facilities Substance abuse treatment centers State/local health departments Academic medical/research centers Organ donation programs Foster care Law enforcement and corrections (coroners, medical examiners) TANF-funded programs MCH programs (Title V) School-based health programs (immunizations, dental) HIV/AIDS (“Ryan White”) State employee benefits Worker’s compensation State technology authorities Health policy offices Unfunded Mandate (Non-Medicaid)

16. © 2002 National Governors Association 16 Federal Guidance Covered entity determinations –No arbitration process –No validation mechanism Preemption decisions –State law –Other federal laws

17. © 2002 National Governors Association 17 Implementation Schedule ProposedRuleFinalRule Compliance Deadline † Privacy11/99 8/02 ‡ 4/03 Security8/98—— Transactions and Codes 5/9810/00 10/02 * National Provider Identifier 5/98—— Health Plan Identifier ——— Employer Identifier 6/987/027/04 Enforcement——— † Small health plans have one additional year following this date to be compliant. ‡ HHS proposed modifications to the privacy rule on March 27, 2002. The modifications were finalized on August 14, 2002. The compliance deadline will not change. * The compliance deadline may be extended by one year if a compliance plan is submitted to HHS before October 16, 2002. Small health plans are not eligible for the conditional extension.

18. © 2002 National Governors Association 18 Complaint-Driven Enforcement Expectations –Who will complain? –What will they complain about? Vulnerability –Lawsuits –Federal penalties –Negative publicity Application –Measure of due diligence –Sanctions, technical assistance –Consistent enforcement across HHS regions

19. © 2002 National Governors Association 19 Policy Implications for States Worsening the budget situation Impeding access to health care Affecting the quality of care Threatening provider solvency Impairing state-level program administration (grant reporting) Hindering the ability to make good policy decisions

20. © 2002 National Governors Association 20 Implications for CDC Information sharing standards will vary –Different legal interpretations (state-level) –Grant reporting –Surveillance data (disease reporting) Prevention activities –Immunizations –Disease management Assurances will be needed –Business associate, trading partner agreements

21. © 2002 National Governors Association 21 What States Need Guidance –Validation of state decisions (OCR) –Analysis of HIPAA, other federal laws –Direction from federal funders (grants) –Coordination among federal-level agencies Time & money –2002 election –State fiscal crisis –Opportunity to upgrade health data systems

22. © 2002 National Governors Association 22 NGA Center for Best Practices (http://www.nga.org/center) Robert J. Burns Policy Analyst Health Policy Studies Division National Governors Association Center for Best Practices Hall of States, Suite 267 444 North Capitol Street, NW Washington, DC 20001-1512 (202) 624-7729 fax: (202) 624-5313 email: rburns@nga.org