Hip hip hooray for HIPAA? What you need to know about the new Health Insurance Portability and Accessibility Act.

It's a mammoth task that experts are calling the Y2K of the health-care industry. It could come with a price tag as high as $40 billion. And it must be addressed within the next two years.

It's the Health Insurance Portability and Accessibility Act (HIPAA), and it has many in the health-care and insurance industries on edge.

The far-reaching and complex HIPAA legislation mandates that any organization that handles patient medical information--hospitals, insurance carriers, medical clinics, doctor's offices and even employers--make significant upgrades to administrative procedures and data transmission and storage technologies to ensure compliance with stringent privacy and security standards. The ultimate goal is to protect all patients' personally identifiable information and give those individuals control over how their health-care information is shared and used.

HIPAA's privacy regulations took affect in April, starting a two-year countdown to the compliance deadline of April 15, 2003. The bottom line: companies that have not started preparing for HIPAA may already be behind the curve. But those who begin developing HIPAA compliance strategies today can help ensure a healthy prognosis for their businesses for years to come.

Time consuming

HIPAA compliance is a three-step process (see box). For large health-care providers, insurance companies and clearinghouses that work with large volumes of patient information daily, this three-step plan can be time-consuming and complicated. Achieving compliance will often be less complex for smaller providers and employers, but they are still well-served by following a similar process to assess and implement changes needed for HIPAA compliance.

Many businesses, especially those that have not yet begun compliance efforts, are likely to turn to outside HIPAA consultants to assist with assessment, analysis and implementation of necessary upgrades.

When considering third-party assistance, businesses should carefully evaluate a provider's expertise, reputation and reliability, as well as its ability to assess and implement services to address all aspects of HIPAA legislation. Many consultants provide little more than recommendations, leaving businesses on their own for the real work--implementation and testing of upgrades.

Though a daunting task, HIPAA also brings good news for providers and insured individuals. The U.S. Department of Health and Human Services forecasts a net industry savings of approximately $12.3 billion over the next 10 years as a result of lower costs and efficiencies gained through HIPAA compliance.

A 3-step process

For most businesses, addressing HIPAA compliance is a three-step process:

* Step 1: Complete a thorough assessment of all systems and processes that fall under HIPAA guidelines. This process will help you identify the areas of operations that will need adjustments to achieve HIPAA compliance.

* Step 2: Conduct a "gap analysis" or review of how your systems and processes work today in comparison with how they will need to operate in a HIPAA-compliant environment. This analysis helps your business pinpoint the scope of your HIPAA needs and to prioritize your compliance efforts.

* Step 3: Implement upgrades and procedural changes needed for compliance. Technology upgrades can range from adding security features like firewalls to a company network to integrating software applications to allow secure transfer of information. Procedural changes can involve drafting new policies for your employees regarding patient information and training them to ensure compliance.

Start-up grants

If your budget is modest but your needs are great, the state of Michigan offers options to help promote a healthy worksite.

Its Worksite and Community Health Promotion (WCHP) program offers grants to help employers increase awareness and help reduce the behavior risk factors that can lead to cardiovascular disease and other chronic diseases.

Start-up grants are awarded to help employers purchase worksite health promotion services like smoking cessation clinics and weight management to help employees change their behavior.

While all worksites in Michigan are eligible to apply for grant money, WCHP gives special consideration to small companies (defined as having fewer than 500 employees), those that are less likely to start wellness programs without financial assistance and those with employees at higher risk of cardiovascular disease.

For more information about worksite grants, contact the Michigan Department of Community Health Promotion Clearinghouse at [phone] or the Southeastern Michigan Health Association, which administers the programs in the Detroit area, at [phone].

Worth noting

Annual health-core costs for employees with high-risk behaviors are $272 to $960 higher than for employees with low-risk behaviors.

Source: Journal of Occupational Medicine

Lara Sibley is national marketing director for health care at SBC Communications Inc.