Partners are key to smooth surfing. (HIPAA Progress Report).

Like an enormous Tsunami building far off in the ocean, HIPAA is gathering momentum and will descend upon U.S. healthcare organizations (HCOs) beginning next spring. Whether payers and providers are swamped by it or can surf the HIPAA wave to smooth compliance and become efficient electronic businesses is partly dependent on the assessment, planning and implementation steps they have already undertaken.

This special report explores the progress made to date by some of the players--including hospital and medical groups, payers and healthcare software vendors. Forward progress has been hardly measurable, as many organizations continue to wait either for more delays by regulators or more help from vendors and business partners. Still, a minority of other healthcare organizations has seen the positive results of their efforts in the three principal HIPAA fronts of privacy, security and transaction standards.

Counting on Vendors

Healthcare organizations must rely very heavily on software and IT solution vendors to help them become HIPAA compliant. Some HCOs are worried that: their vendors won't be ready in time, won't be able to assure them that their software supports HIPAA requirements. Questions range from whether software can properly limit access to protected data and provide audit trails about those who access files for privacy and security rules, to whether a hospital information system (HIS) or practice management system can feed the right kind of electronic data to meet transaction requirements.

Progress by vendors has been sluggish. As recently as April, according to a quarterly survey conducted by Phoenix Health Systems, less than half of vendors had started assessment phases for privacy rules, not having reached planning or implementation stages for regulations with the earliest compliance date--next April. Only a few vendors had begun coordinating with their clients about when they would be ready to use HIPAA transactions.

"Hospitals do have to solve how they will interact with their HIS or other key vendors," says Kathleen Kennedy, system analyst for the three-hospital Carondelet Health System serving Tucson, AZ. "The data elements that need to be in the code have to be collected on the front end. Some secondary patient information that will be required might not be part of the HIS system now, but will have to be built into data collection screens," she says.

Carondelet has been fortunate, Kennedy says, because one of its claims processing and document management vendors, The SSI Group, has already worked with all the top HIS vendors, and has shared some coding information that will help the Carondelet hospitals. "That's a compliment to SSI, especially when some IT vendors seem to take the view, `it's not our role to enhance this communication." She also is working with MEDITECH on adding new fields at the bottom of existing input screens, preventing a whole re-make of the system they are accustomed to using.

Help With Security Objectives

Another provider who expected a lot from its vendors--and apparently got it--is Antelope Valley Hospital in Lancaster, CA. Ash Shehata, Antelope Valley's director of information services, says the hospital deployed primary and secondary firewalls, intrusion detection and network security software with biometric authentication in order to satisfy HIPAA's security requirements.

Antelope Valley selected BioconX security software and Siemens finger scan recognition sensors, but only under stringent conditions: "We told BioconX that we would deem the pilot a failure if their software failed even one time with any of our 60 applications." A five-month, 50-user pilot succeeded, so the hospital rolled out the full system in February this year. [Look for the full case history on Antelope's HIPAA security program next month in HMT.]

Susan Miller, administrator for Family Practice Associates of Lexington, also says that, without help, HIPAA is daunting. "It's a little scary, because we don't know where most vendors are in terms of providing HIPAA compliant products," Miller says. But she does report that the nine-physician practice is pleased with its progress to meet security regulations because of help from Advanced Imaging Concepts (AIC). Family Practice Associates, with 30 support staff and 72 PCs in two business locations, began working with AIC in October 1999, and has been paperless since the end of that year. "We've made no new paper charts since, and also converted 25,000 to 30,000 existing records to electronic," Miller says. "With the software's defined user groups and access rights, that puts us way ahead of the curve from an internal security standpoint--and at a level that can't be achieved in a paper environment."

Seeking Transactions Partners

The search for HIPAA-ready partners is just as critical on the transactions front, at least as far as Humana's Gregory Ray is concerned. The company's director of e-commerce, Ray says that by HIPAA definition, Humana has 175 trading partners--any providers, intermediary payers or other organizations who are directly connected to Humana electronically. But not for long.

Humana will use HIPAA activity to hell) identify those organizations they will continue to partner with in the future, or more precisely, those they won't. "We firmly believe that our 175 connections will be reduced; HIS and practice management system vendors, and clearinghouses as well, are not yet prepared to support what HIPAA requires."

When Humana's older EDI contracts come up for renewal, Ray says Humana will use the opportunity to negotiate better service level agreements with its suppliers. "We expect that electronic transmissions/ HIPAA will permit us to dramatically reduce our overall cost of services, bring them much more to a commodity level. We expect the field of major players will be reduced, and those that are still around will provide much more volume in direct transactions and be more competitive."

Electronic Network Systems (ENS), Colorado Springs, is one partner that Humana is already forging a stronger relationship with because of its solid EDI and HIPAA transactions experience. Besides its "good, low cost electronic claims handling solution," Ray says ENS can already handle more types of electronic transactions--in real time--than most vendors, including eligibility inquiry, claim status inquiry, remittance, advice distribution.

ENS' software, PASS (for pre-adjudication software system), helps payers improve the ratio of electronic claims that can be auto-adjudicated. "The problem is that today's EDI never really has succeeded," says ENS Chairman Terrence Cassidy. "Most of today's eclaims are still touched by three different people, and clearinghouses keep shoving claims through that need lots of handling."

PASS automatically performs most of the tasks required, including eligibility verification, duplicate claim checking, and correcting for payers' custom business rules. Because the process can cut claims handling costs by up to halt, the ENS software is generating a lot of interest. But its HIPAA transactions translator service is generating even more interest for ENS. The Colorado Springs company has already succeeded with real-time testing of 270s/271s for Humana and other payers. It is also one of very few vendors that can provide compliance, connectivity and routing on all seven healthcare transactions defined in HIPAA. The system also provides a single interface to allow practice management providers, and thus group practices, the ability to conduct HIPAA financial and administrative transactions with more than 1,000 payers nationwide.