Another deadline looms

The Health Insurance Portability and Accountability Act turned 15 years old in August, and as evidence of its lasting impact, providers and payers will be scrambling over the next four months to meet yet another HIPAA compliance deadline.

This one is Jan. 1, 2012, according to an HHS rule, drawing on HIPAA authority, and it requires healthcare providers, health plans and claims clearinghouses to convert from a decade-old set of standards for electronic data interchange to its more modern counterpart.

In geek speak, the industry must switch from the current but outgoing ASC X12 Version 4010 family of standards to the updated Version 5010.

Both versions are products of the Accredited Standards Committee X12, a 32-year-old standards development organization chartered by the American National Standards Institute.

After a very late start, the healthcare industry appears to be making progress toward the conversion, but top-level experts as well as information technology leaders at hospitals and group practices warily suggest that the CMS would do well to have a backup plan.

But if providers, plans and claims clearinghouses are banking on the CMS to retreat from the Jan. 1 deadline, they may find themselves on the wrong side of the law, according to Denise Buenning, director of the administrative simplification group in the CMS' Office of E-Health Standards and Services.

“There is no wiggle room,” Buenning says. “If you get one message across to your readers, that's it. We're holding fast to the date.”

The CMS is taking a hard line not out of obstinacy, since it already rolled back the compliance deadline once—from the original Oct. 1, 2010 deadline in its proposed rule issued in 2009. At stake is not only 5010 compliance for its own sake, since the conversion to 5010 is a prerequisite for the scheduled Oct. 1, 2013 conversion to the International Classification of Diseases, 10th Revision, or ICD-10, a family of diagnostic and procedural codes that is a quantum leap in complexity from the ICD-9 codes now in use. But even ICD-10 doesn't fully explain the need for 5010, Buenning says.

“It impacts ICD-10, but it also impacts some of the adoptions coming out of the Affordable Care Act, including the operating rules, which are predicated on the adoption of the 5010 platform,” she says. So further delay is out of the question.

“We will enforce,” Buenning says. “If we get complaints, we will treat them just as we would any other HIPAA transactions and code sets compliance issue, because that's what it is.” (The use of common data standards for electronic healthcare transactions was mandated by the broad HIPAA section on “administrative simplification” and the more specific subsection on “transactions and code sets.”)

But, “the most important thing about enforcement is not the penalty,” she says, rather, working with offenders “to get them to compliance.”

Still, it is almost a given at this point that the industry will not be in full compliance by the 5010 deadline.

Rady Children's Hospital in San Diego has done about all it can do, but it still is unable to submit 5010-compliant claims to all of its business partners, according to Chief Information Officer Albert Oriol.

“We're actually in very good shape,” Oriol says. “Of course, right now our biggest challenge is getting our payers to test with us, which we are doing with some payers that are ready, but with others, it's proving challenging.”

One vital missing link is Medi-Cal, the state Medicaid program, which represents “close to half of our business,” he says.

“We haven't started testing with them yet; that's one of our concerns, of course. They recently changed their intermediary, who is running their shop. We hear they're going to be ready, but I don't have a clear sense (when), to be honest.”

But Oriol isn't panicked.

“This wouldn't be the first time that it's hard for the state to meet a deadline,” he says. “They do plan contingencies to allow a continuing of the operations, so, in that regard, I am confident, whatever it is that happens, a claim will go through. They'll figure out a way, through a clearinghouse.”

Oriol says gearing up for 5010 on his end “wasn't a trivial effort. We've been working on it for the better part of the past 18 months or so. We still have a couple of the smaller systems that are not connected to our main vendor that are not there yet. It's home health and our convalescent home, so in the scheme of things, it's a smaller number of transactions. We're told it will be (done) this month.”

The 4010 and 5010 standards are used to configure the basic financial transactions of most healthcare organizations and health plans—healthcare claims and payments. They also carry a few other electronic data messages, including the computerized calls and responses that check on the eligibility of a patient for health insurance benefits as well as the status of that patient's claim while it's being processed.

Data maven Jim Mechan's job puts him in a watchtower position over the status of 5010 compliance efforts nationwide. Mechan is senior vice president of electronic data interchange services for Emdeon, a claims clearinghouse that Mechan says moves 75 million electronic healthcare transactions a month. Emdeon has connections with 360,000 healthcare providers, 1,400 health plans as well as every Medicare and Medicaid program or contractor in the country, he says.

Since last year, Emdeon has been testing 5010 compliance with health plans and as such can gauge plan readiness across the industry.

Of the commercial health plans to which Emdeon is connected, those plans, which represent close to 70% of the company's claims volume, have been testing, while plans producing 30% of claims volume have not. Blues plans, meanwhile, are close to full compliance, with 80% by claims volume and 80% by number of plans that are testing, he says.

All Medicare administrative contractors are testing and “in really good shape,” Mechan says.

But among state Medicaid programs, some of which are managed directly by the states and others by state-hired contractors, “we're testing about 45% of the volume, but 55% are not there yet.” Mechan says several of the most populous states, New York, Florida and Illinois, for example, are testing and ready, “but we're finding they are the exception rather than the rule.” Only about 25% of states are performing compliance testing, he says.

From those numbers, Mechan infers that many larger health plans and Medicaid states are doing well, but smaller plans and smaller state Medicaid programs are lagging behind.

To be fair to the Medicaid plans and contractors, Mechan says, a number of them are upgrading their software for 5010 and ICD-10, and that has slowed them down, while budget cycles and financial pressures caused by the recession have caught some others. And the standards development body, ASC X12, didn't help the cause by issuing in February 2010 an addendum to its own, previously released standards, what it called an “errata,” which didn't officially make it to HHS until the summer of that year and wasn't HHS-approved until that October, Mechan says.

“So, the software vendors had to change everything they had and retest with their trading partners,” causing a cascade of delays to providers, plans and claims clearinghouses, he says. A similar thing happened 10 years ago when Version 4010 was brought out and about a year afterward, it too, was altered by an addendum, Mechan recalls.

“If we learn anything as an industry, it should be, measure twice and cut once,” he says.

Some software vendors say all systems—at least all of their systems—are go.

Carl Dvorak, chief operating officer for Epic Systems Corp., a prominent developer of financial and electronic health-record systems for larger hospitals and large group practices, says, “We've been ready for quite some time.” Epic customers “feel technically ready” for the 5010 conversion as well, Dvorak says. “They don't see that as that big of a technical challenge. From what I hear, 5010 is the least of people's worries. They're working toward meaningful use with ICD-10 looming over them.”

In terms of Epic's own software redevelopment work, the 5010 conversion was “not trivial” but a “medium, small effort” in contrast to the work required to revamp its software for ICD-10. “ICD-10 was significant, big,” Dvorak says, and so will it be with customers. “ICD-10, they're worried.”

Sunny Singh also sees the challenge ahead as president and CEO of Edifecs, a provider of claims processing software, services and business intelligence to dozens of major health plans, state Medicaid agencies and providers.

From his vantage point, Singh says the Blues and commercial health plans “have done fairly good work” with the Blues ahead of the commercial plans, while state Medicaid plans are only “seeing some momentum.” Bottom line, though, Singh says the entire industry won't be ready for 5010 until mid-summer 2012. “You will see people coming to the tail end of the deadline and scrambling at that time,” Singh says. “They will scramble, not only in the last quarter of this year, but also in Q1 and Q2.”

In the meantime, providers will lean on claims clearinghouses to offset their inadequacies. Plans and providers may not be HIPAA-compliant, but they will at least be making payments and getting paid.

“Otherwise, there will be chaos,” Singh says. “If you work for perfection, we'll be working for the next five years to implement 5010.”

How will the delayed start of 5010 impact the planned conversion to ICD-10? Will the government be forced to push it back?

“I don't see that happening today,” Singh says. And, he says, the CMS would be right in holding to the Jan. 1 deadline.

“If we push it back now, then things will just slow down. If we do this and do this properly, if we do it really well, this will have a positive impact on the industry. So, why not bite the bullet and do it and do it properly?”

In June, the Medical Group Management Association released the results of what turned out to be a membership survey on their lack of readiness for Version 5010. Only one in 50 group practices participating in the survey had implemented the software changes needed to convert to 5010 and 45% of the practices had not even begun implementation of those changes yet.

Robert Tennant, senior policy adviser at the MGMA, says the organization plans to have another survey out by the time of the association's annual meeting in October. Tennant says he expects it will reflect compliance gaps.

“I think we'll going to be communicating to CMS in the next couple of months where we think we need some flexibility,” he says. Members are expressing concern. “They've been talking to their vendors and they're not always getting the answers they were looking for.”

Tennant says the practice management system vendors and others helping groups with their claims streams are saying, “Don't worry; we have it covered. But they're not giving them any dates” when the vendors' systems will be made 5010-compliant and that software is to be distributed so practices can use it to upgrade their financial systems. Many practices have combined clinical EHRs and practice management systems. For those, “we're concerned that vendor attention has been diverted to meaningful use,” an EHR headache, not a practice management system concern.

Tennant says the MGMA will host a meeting with health IT vendors this week in Chicago and 5010 status will be a key topic. “It will be interesting to hear from the vendors themselves what their plans are,” he says.