Information memos

Numbered memos

Subscribe for email notification of each new memo

DSL Memo Series 2002-23
ACTION MEMO

December 19, 2002

STATE OF WISCONSIN
Department of Health and Family Services
Division of Supportive Living

To:
Area Administrators/Assistant Area Administrators
Bureau Directors
CIP 1A Contacts
COP County Contacts
COP Fiscal Contacts
COP Waiver Contacts
County Departments of Community Programs Directors
County Departments of Developmental Disabilities
Services Directors
County Departments of Human Services Directors
County Departments of Social Services Directors
County Mental Health/AODA Coordinators
County Primary DD Contact
County/Tribal Aging Unit Directors
CSLA County Contacts
Licensing Chiefs/Section Chiefs
Tribal Chairpersons/Human Services Facilitators

From: 
Sinikka McCabe, Administrator

Re: PLANNING AND REPORTING HIPAA BUSINESS ASSOCIATE TRANSACTION RULE COMPLIANCE

Overview

HIPAA is the federal Health Insurance Portability and Accountability Act of 1996. The Administrative Simplification part of the act aims to reduce the costs of the administration of health care through increased automation of billing and other transactions, based on the adoption of nationwide standards. It also establishes requirements for the privacy of personal health care information and the security of that information when automated.

The Medicaid program is a health plan under HIPAA and must comply with the rules that implement this law. The Department of Health and Family Services (DHFS) has determined that the county agencies that administer the Medicaid Home and Community Based Waiver Services Programs (HCBW Programs) and the Community Options Program (COP) are performing health plan functions for DHFS and are its business associates under HIPAA. HIPAA compels DHFS to require the counties to comply with the same HIPAA rules that govern DHFS as a health plan. DHFS previously held two workshops this past year for county representatives regarding compliance issues. DHFS also has discussed HIPAA issues at several regional meetings. The 2003 State-County contract will contain the compliance requirement, and a Business Associate Addendum to the contract will describe the details. Most of the Addendum will address the new responsibilities of the counties as business associates relative to the Privacy rule. Counties are also responsible for complying with the Electronic Transactions and Code Sets (Transaction) rule. This memo describes the DHFS requirements of county agencies who administer the Medicaid Home and Community Based Waiver Services Programs and the Community Options Program for planning and reporting their compliance with this rule.

Transaction rule compliance plans

DHFS and its business associates must comply with the HIPAA Transaction rule by October 16, 2003. Testing of compliance solutions must begin by April 16, 2003.

Each county is responsible for determining and implementing its approach to compliance. As you know, no additional funding from or through DHFS is available for compliance activities. However, compliance costs are a valid administrative expense for the HCBW Programs and COP. DHFS has provided assistance to counties in identifying compliance solution options, through statewide conferences and workshops. If sufficient multi-county interest in a particular solution warrants, DHFS may facilitate procurement or other arrangements to reduce costs or maximize availability. In addition, DHFS may provide limited clearinghouse services to assist counties with compliance. A description of this clearinghouse option will be available in the near future.

To ensure that counties are working toward compliance and to provide a basis for DHFS to understand progress across the state, each county must submit a Transaction rule compliance plan to DHFS (if multiple county agencies are involved, please coordinate). Plans are due to Area Administrators by January 15, 2003. Plans must use the template shown in Attachment 1, addressing all sections in it. (Attachment 1 also provides instructions for using the template. The template in a Word document format can be downloaded from the DHFS HIPAA NOW web site at http://www.dhfs.state.wi.us/HIPAA/ ). As a resource, Attachment 2 provides some information on HIPAA testing and certification vendors.

According to the federal requirements, the Wisconsin Medicaid program will not be in full compliance with HIPAA until all counties administering HCBW Programs are in compliance with the Transaction rule. Therefore, DHFS needs to know how counties are progressing toward Transaction rule compliance. The first step is for DHFS to learn all counties’ timetables for compliance, which we will get from their compliance plans. Area Administrators will then work with each county to determine their progress and report to DHFS central office. Reporting will include any changes in milestone dates, the percent completion of each milestone, and any major change in the general approach to compliance. For the first six months of 2003, reporting will be quarterly. Starting with July 2003, reporting will be monthly and continue until each county is compliant.

In addition to being a business associate of DHFS in administering the HCBW Programs, counties may also be covered providers under HIPAA if they electronically bill a health plan for health care (or otherwise conduct covered administrative transactions with the same). This includes Medicaid or Medicare, as well as private insurers or HMOs. In this situation, counties are directly covered by and responsible for compliance with HIPAA. DHFS has no responsibility for HIPAA compliance of counties as covered providers. The DHFS requirements of counties in the State-County contract and the related planning and reporting requirements of this memo are unrelated to their independent responsibilities for HIPAA compliance as covered providers.

Family Care Care Management Organizations are covered entities under HIIPAA as health plans. They must directly comply and are not covered by the State-County contract or this memo, as they are not business associates of DHFS.

County agencies should direct questions about the plan completion and monitoring process to their Area Administrator. Area Administrators will consult with or forward to central office HIPAA experts more detailed or complex questions.

REGIONAL OFFICE CONTACT:
Area Administrator

For questions regarding Transaction Rule compliance, please contact:
Ted Ohlswager
DHFS HIPAA Coordinator
608-266-5314

For questions regarding Privacy Rule compliance, please contact:
Rich Ruby
DHFS HIPAA Privacy Officer
608-267-9044

Return to Numbered Memos Index