ORDER NO. ^c7810
RF'GROVE RF'GLYIN6 FOR EXTENSION OF TIME
FOR COMGLIRNCE WITH HIGRR
On this the 15th day of October, cOQc, upon motion made by
Commissioner Let z, seconded by Commissioner- Baldwin, the Co~ar•t
unanimously approved by a vote of 3-Q~-0, applying for•
extension of time for compliance with the Health Ins~_~rance
F'or•tability and Rcco~antability Act.
COMMISSIONERS' COURT AGENDA REQUEST
PLEASE FURNISH ONE ORIGINAL AND NINE COPIES OF THIS REQUEST AND DOCUMENTS TO BE
REVIEWED BY THE COURT.
MADE BY: Fred He OFFICE:
MEETING DATE: October 15 , 2002
SUBJECT: (PLEASE BE SPECIFIC)
County Jude
'TIME PREFERRED:
Consider and discuss applying for extension to time for compliance with Health Insurance Portability
and Accountability Act.
EXECUTIVE SESSION REQUESTED: (PLEASE STATE REASON)
NAME OF PERSON ADDRESSING THE COURT:
ESTIMATED LENGTH OF PRESENTATION:
IF PERSONNEL MATTER -NAME OF EMPLOYEE:
County Judge
Time for submitting this request for Court to assure that the matter is posted in accordance with Title 5, Chapter
551 and 552, Govemment Code, is as follows:
Meeting scheduled for Mondays:
THIS REQUEST RECEIVED BY:
THIS REQUEST RECEIVED ON:
5:00 P.M. previous Tuesday.

All Agenda Requests will be screened by the County Judge's Office to determine if adequate information has been
prepared for the Court's formal consideration and action at time of Court Meetings. Your cooperation will be
appreciated and contribute towazds you request being addressed at the eazliest opportunity. See Agenda Request Rules
Adopted by Commissioners' Court.
October 4, 2002
TO: David Motley, Co my Attorney
FROM: Fred ke, County Judge
SUBJECT: Health Insurance Portability and Accountability Act
Enclosed please find a memorandum from the TAC Legal Staff regazding the above-
referenced topic. Please review this memorandum, the Health Insurance Portability and
Accountability Act, and any other material you deem relevant and advise the
Commissioners Court as to any action that the Court should consider.
Please note the apparent deadline for any required action is October 15, 2002.
Encl.
Cc: Commissioners
Tommy Tomlinson
Bazbara Nemec
TO: County Judges
FROM: Quincy Quinlan, TAC Legal Staff; John Dahill, Conference of
Urban Counties Legal Staff
DATE: October 1, 2002
SUBJECT: Deadline for Health Insurance Portability and Accountability
Act
You have doubtless heazd stories of the impact of new federal regulations under the
Health Insurance Portability and Accountability Act ("HIPAA") which deals with the
privacy of medical information. While many experts are still determining the full impact
of these complex regulations on counties, the_purpose of this memorandum_is to inform
you about_one aspect that may require counties to take immediate action regazding
computer coding of health information, If your county is covered,_it must comply with
the regulation by October 16, 2002, but an extension maybe obtained upon request.
The United States Congress passed HIPAA in 1996. One of the provisions of the Act
directed the United States Department of Health and Human Services ("HHS") to
promulgate a rule enabling the efficient, secure exchange of information between health
insurance companies (and other payers) and providers of medical caze.
In response, HHS passed a rule, found at 45 Code of Federal Regulations Paris 160 and
162, concerning the electronic transmission of health information between a "health caze
provider", a "health plan", and a "healthcaze clearinghouse". The rule provides that if
any of these 3 types of entities sends "health information" in electronic form, it must use
the "data code sets" adopted by HHS. Data code sets are standazds and procedures for
transmitting information electronically.
Health information is defined as any information that: (1) is created or received by a
health caze provider, health plan, public health authority, or employer, and (2) relates to
the physical or mental health or condition of an individual; the provision of health caze to
an individual; or the payment for the provision of health caze to an individual.
The rule requires the adoption of the data code sets (including all of the necessary
modifications to computer systems and computer operating procedures) by October
16, 2002. However, any affected entity may get an extension of this deadline by
filling out a short form found at the following website:
http://www.cros.gov/hipaa/hipaa2/ASCAForm. asp
The extension lasts until October 16, 2003 for health plans with more than 50
participants, and until October 16, 2004 for health plans with less than 50 participants.
By the end of the extension period, counties that aze covered by the rule need to have
adopted the code sets and related procedures.
Is Your County Affected?
Your county will need to comply with this deadline if it conducts activities that fall under
the definition of a health plan, a healthcare provider, or a health caze clearinghouse.
A health plan is an individual or group plan that provides, or pays the cost of, medical
care. The term includes the following, singly or in combination (this is not an exhaustive
list, but includes the entities most relevant to counties): (1) a group health plan (as
defined by the Employee Retirement and Income Security Act ("ERISA"}); (2} a health
insurance issuer; (3) an HMO; (4) Medicare Part A or B; (5) Medicaid; (6) an issuer of a
Medicaze supplemental policy; (7) an employee welfare benefit plan or any other
arrangement that is established or maintained for the purpose of offering or providing
health benefits to the employees of two or more employers; (8) an approved state child
Medicaid program; (9) any other individual or group plan, or combination of individual
or group plans, that provides or pays for the cost of medical care.
The term health care provider includes: (1) a hospital, critical access hospital, skilled
nursing facility, comprehensive outpatient rehabilitarion facility, home health agency,
hospice program; (2) a provider of medical or health services (as defined in 42 USC
1395x(s)), and any other person or organization who furnishes, bills, or is paid for health
care in the normal course of business.
The term health care clearinghouse means a public or private entity, including a billing
service, repricing company, community health management information system or
community health information system, that changes health information received in a non-
standard format into a standazd format for the receiving entity, or changes information
received in a standard format to a non-standazd format for the receiving entity.
There are 2 points of view concerning whether the rule applies to counties' provision of
health coverages for thew employees. One view is that most members of the Texas
Association of Counties Health and Employee Benefits Pool ("HEBP") are not included
in the defmition of health plan under the rule. None of the nine (9) entities listed in the
rule's defmition of health plan applies to our member counties. The first entity, a group
health plan as defined by ERISA, should not apply because ERISA exempts
governmental entities from its regulations. Defmiion # 9 also should not apply because
the plan that actuaIIy pays the cost of medical care for the members' employees is HEBP,
Counties that have purchased health coverages for their employees should not be covered
by this rule. On the other hand, counties that have self-funded coverages appear to be
HIPAA data set letitt to cauntiea_ doc 2
subject to the rule under defmition # 9, including those self-insured counties that aze
members of HEBP.
The second, less technical view of the rule's requirements suggests that all counties
providing health coverages for their employees must comply with the rule when they
transmit health information electronically.
If a county operates a hospital, critical access hospital, skilled nursing facility,
comprehensive rehabilitation facility, home health agency, or hospice program, or is a
provider of medical services, or bills or is paid for health care in the normal course of
business, that county must comply with the rule if it transmits health information
electronically.
HHS, in the comments to the rule, stated that workers compensation programs aze not
included in the definition of health plan, because Congress did not include these
programs in the statute. HHS also noted that prisons do not fall within the defmition of
health plan, as prisons aze not individual or group plans established for the purpose of
paying the cost of health caze.
We strongly urge all counties to apply for the extension because of the uncertainty
surrounding the interpretation of the rule, and the likelihood that HHS would
interpret the rule as applying to all counties. The extension will give each county
time to ascertain whether it transmits health information electronically, either as a
health plan or a healthcare provider, or both.
The conclusions set out above are our own, and should not be construed as legal advice.
This new regulation is complex, and HHS has not given much guidance on the rule.
Therefore, we urge you to consult your County Attorney, other competent counsel, or a
qualified consultant, to review these issues. You may also want to send copies of this
memorandum to those individuals in your county who have day-to-day oversight of these
issues. Additional information about HIPAA is presented in the September-October 2002
edition of County Magazine.
,~ ~ e -~ ~ V
~~~ ~
U
HIPAA data set letter to cowties_.doc 3
Electronic Health Care Transactions and Code Sets Standards Moaet t/ompuance rran rn... rage ~ ui ~
Centers for Medicare & Medicaid ~ ~.- ' „
~~ Services
'-
Home ~ About CMS ~ Frequently asked questions ~ Send feedback
Receive updates ~ Careers with CMS
Programs
Medicare Electronic Health Care Transactions
Medicaid and Code Sets Standards Model
SCHIP Com (lance Plan
HIPAA P .
CLIA
Topics You are highly encouraged to read through these instructions
carefully. When you are ready to proceed, please use the button
Coverage at the bottom of the page to proceed to the first page of the
Laws & Model Compliance Plan.
Regulations
Initiatives General Instructions
Open Door In 1996, the Health Insurance Portability and Accountability Act
Forums	(HIPAA) became law. It requires, among other things, that the
HIGLAS	Department of Health and Human Services establish national
New	standards for electronic health care transactions and code sets.
Freedom	October 16, 2002 was the original deadline for covered entities
Advisory	to comply with these new national standards. However, in
Committees	December 2001, the Administrative Simplification Compliance
Resources	Act (ASCA) extended the deadline for compliance with HIPAA
	Electronic Health Care Transactions and Code Sets standards
Acronyms	(codified at 45 C.F.R. Parts 160,162) one year - to October 16,
Contacts	2003 -for all covered entities other than small health plans. In
Forms	order to qualify for this extension, covered entities must submit
Glossary	a compliance plan by October 16, 2002. Completion and timely
Publications	submission of this model compliance plan will satisfy this federal
Manuals	requirement. If you are a covered entity and do not submit a
Tools	compliance plan, you must be compliant with the HIPAA
Easy Print	Electronic Health Care Transactions and Code Sets standards by
Email this	October 16, 2002.
Pte?	You can submit this on-line compliance plan electronically, and
	we will provide an on-line confirmation number as
	acknowledgment of your extension. This on-fine compliance plan
	is a model only, and is provided for your information. Covered
	entities have the option of submitting their own version of a
	compliance plan that provides equivalent information. Refer to
	the "How to File" section of these instructions for information on
	how to file alternative submissions. You will not receive any
http://www.cros.gov/hipaa/hipaa2/fCSFom~Instructions.asp? 10/15/02
Electronic Health Care Transactions and Code Jets Jtandards lvtoaet ~.ompuance rian in... rake ~ ~~ ~
specific notice that your compliance plan has been approved. For
those filing electronically, your electronic confirmation number
will serve as your only approval notice.
Completing this model compliance plan takes about 15-20
minutes. Simply answer a few questions about compliance
concerns you may have, and tell us where you are in the
implementation process.
For information on defined terms used in this document, refer to
45 C.F.R. 160.102 or 162.103.
Section A: Covered Entity and Contact Information
(1) Name of Covered Entity. Please enter the name of the
covered entity for which you are filing this compliance plan. See
"Who Should File" for more information.
If you are filing for multiple related covered entities that are
operating under a single implementation plan, submit their
names, tax identification numbers and Medicare identification
numbers. Compliance plans for unrelated multiple covered
entities or for related covered entities that are not included
under the same implementation plan must be filed separately.
Are you filing for a health plan, health care clearinghouse or
other health care organization that has multiple components? If
they are operating under the same implementation plan, then
you can file one compliance plan on their behalf. If not, then you
must file separate compliance plans for each entity. See also (5)
"Authorized Person" for more information.
(2) Tax Identification Number. Enter each entity's IRS Employer
Identification Number (EIN). If there is no EIN, enter the entity's
Social Security Number. While an EIN or Social Security Number
is not required, it will facilitate ensuring that the correct entity
obtains the extension.
(3) Medicare Identification Number.
Please enter the identification number that applies to each
covered entity listed.
. If you are a Medicare physician, enter your UPIN number.
. If you are a physician group, enter your Medicare group
identification number. If you do not have a Medicare group
http://www.cros.gov/hipaa/hipaa2/TCSFormInstructions.asp? 10/15/02
Electronic Health Care 'Transactions and (:ode Sets Jtandazds Moael t,ompuance nan ln... rake ~ ci ~
identification number, enter the Tax Identification number
again. If you are not a Medicare provider, you need not
enter any identification number in (3).
. If you are a supplier of durable medical equipment, enter
your NSC number. If you have multiple locations under one
EIN, just report the initial location's number (a 6-digit
number followed by 0001).
. If you are an institution, enter your OSCAR number. This is
your 6-digit Medicare billing number.
(4) Type of Covered Entity. Tell us which covered entity category
applies to your organization. Check all boxes that apply.
(5) Authorized Person. Provide the name of a person who is
authorized to request the extension and provide the information.
This might be the individual physician, business/practice
manager, a corporate ofFcer, chief information ofFcer or other
individual who is responsible for certifying that the information
provided is accurate and correct. If filing for multiple covered
entities, this person should be authorized to request the
extension for all the listed covered entities. Otherwise, a
separate compliance plan must be filed to indicate the authorized
person for each respective covered entity.
(6) Title. Provide the title for the person shown in (5).
(7) Street. Enter the street mailing address for the person shown
in (5)
(8) City/State/Zip. Enter this information for the person's
address as shown in (5).
(9) Telephone Number: Enter the telephone number (including
area code} for the person shown in (5).
Section B: Reason for Filing for This Extension
(10) Please let us know the reason why you will not be in
compliance with the HIPAA Electronics Health Care Transactions
and Code Sets standards (45 C.F.R. Parts 160,162) by October
16, 2002. Check all boxes that apply. If the reason you are not
compliant is not shown, check "Other" and briefly specify the
reason for non-compliance.
Section C: Implementation Budget
http://www.cros.gov/hipaa/lupaa2ll'CSFomtTnstructions.asp? 10/15/02
Electronic Health Caze "Transactions and Code Sets Standazds Model l;ompllance Tian in.., rage 4 or ~
This question asks about the estimated financial impact of HIPAA
compliance on your organization. Please respond to (11) by
indicating on the drop-down menu which category most closely
reflects your estimate of your HIPAA compliance costs. If you're
not sure, choose "Don't Know."
Section D: Work Plan/Implementation Strategy/Testing
Schedule
This section asks about overall awareness of the HIPAA
Transaction and Code Set Standards, Operational Assessment,
and Development and Testing. These are collectively referred to
as the Implementation Process.
Phase One -Awareness
If you have completed this Awareness phase of the
Implementation Process, check YES (12) and skip to (14),
indicating your completion date for this phase. Then proceed to
Phase Two -Operational Assessment. If you answer (12) NO,
answer (13) and (14).
Completion of this Awareness phase assumes that:
. you have obtained information regarding HIPAA Electronic
Transaction and Code Sets Standards;
. you have discussed this information with your vendors; and
. you have conducted preliminary staff education.
Tell us when you started or plan to start this activity (13), and
when you completed or plan to complete activity for this
Awareness phase of the Implementation Process (14).
Phase Two -Operational Assessment
If you have completed this Operational Assessment phase of the
Implementation Process, check YES (15) and skip to (20),
indicating your completion date for this phase. Then proceed to
Phase Three -Development and Testing. If you answer (15) NO,
answer all questions (16) through (20).
These are a few questions about:
. where the HIPAA gaps exist in your organization;
http://www.cros.gov/hipaa/hipaa2/TCSFom~Instructions.asp? 10/15/02
Electronic Health Care 't'ransactions and Code Jets ~tanaarus rvioaei wmpuaiicc riai .~~... . age ., ~.
. if you have identified internal implementation issues and
developed a workplan to address them; and
. if you have considered using a vendor or other contractor to
assist you in becoming compliant with the HIPAA Electronic
Health Care Transactions and Code Sets standards.
Indicate your progress for tasks (16) through (18), and a
projected/actual start and completion date for this phase in the
boxes provided (19) and (20).
Phase Three -Development and Testing
If you have completed this Development and Testing phase,
check YES (21) and skip to (26), indicating your completion date.
If you answer (21) NO, answer all questions (22) through (26).
Show your progress for tasks (22) and (23) for resolving
computer software conversion to a HIPAA compliant system and
training your staff. Indicate your projected/actual development
start date (24), projected/actual initial internal software testing
date (25) and final testing completion date (26).
The compliance plan is now complete. You may click on "Cancel
This Plan and Start Over" to delete your entries and revise your
information, or "Submit This Plan Electronically" to electronically
submit this compliance plan; or print it off and follow the
instructions for paper submissions in the "How to File" section of
these instructions.
> G, ~~ <~~~, ~, ~ocQed~t6'{~prtipllance;F,ttenSl4,~~',{~1~ ~~ § ~,~<~ ,
Last Modified on Friday, August 30
79 Centers for Medicare & Medicaid Services CMS
7500 Security Boulevard, Baltimore MD 21244-1850
CMS Telephone Numbers
~°'"`'y Health and Human Services ~ Privacy & Securi~ I Accessibility ~iutihti;en
';,, I Help I Sitemap ~ Medicare.gov
http://www.cros.gov/hipaa/hipaa2/TCSFormInstructions.asp? 10/15/02