Electronic Transactions and Code Sets Enforcement CMS Office of HIPAA Standards

1
Electronic Transactions and Code Sets
Enforcement CMS Office of HIPAA Standards
2
Enforcement of Administrative Simplification
Standards

• CMS named to enforce HIPAA transactions and code
  sets
• OCR continues to enforce HIPAA privacy
• CMS creates Office of HIPAA Standards

3
Office of HIPAA Standards

• Outreach
• Regulations and Policy
• Enforcement

4
Enforcement Responsibilities

• Establish enforcement process
• Develop regulations

5
Enforcement Reality

• CMPs may not be more than -
• - 100/violation
• - 25,000/calendar year for violation of an
  identical requirement or prohibition

6
Enforcement Authority

• Two provisions of HIPAA government enforcement
• - 1176 civil monetary penalties (CMPs)
• - 1177 criminal penalties
• HHS has authority to assess CMPs
• DOJ has authority for criminal penalties

7
Enforcement Regulation

• HHS lead on developing enforcement regulation
• Simplifies and standardizes the enforcement
  process
• Provides a predictable process

8
Enforcement Regulation

• Notice of what constitutes a violation and how
  penalties will be determined
• Hapless vs. Willful
• Rulemaking process allows for public input

9
From Complaint To Compliant

• Complaint driven
• Voluntary compliance
• Technical assistance
• Corrective action plan
• Progressive Steps

10
Complaint Driven

• Complaints
• - web submittal
• - download and mail
• Notification in writing

11
Voluntary Compliance

• Opportunity to demonstrate compliance
• Good faith efforts go a long way

12
Technical Assistance

• Focus on educating providers and covered entities
• Roundtables, informational papers
• ASK HIPAA and HIPAA hotline

13
Corrective Action Plan

• Opportunity to submit corrective action plan
• Demonstrate and document efforts to become
  compliant
• Exercise reasonable diligence, make efforts to
  correct problem

14
Progressive Steps

• Compliance FIRST
• Corrective Action MIDDLE
• Tied for LAST
• - CMPs
• - Exclusion from Medicare
• Access to care and patient safety

15
What CMS WILL DO

• Actively listen
• Actively participate in your conferences
• We want voluntary compliance as much IF NOT MORE
  than you do

16
Questions?