Proposal Summary: On the same day that we proposed the standards that are the subject of this final rule, we also published a rule to propose the national provider identifier (NPI)(63 FR 25320). In that rule, we set forth an impact analysis that covered the collective impact of most of the administrative simplification standards (including standards for security and the unique identifiers, but not including the costs of privacy standards, which will be detailed in the privacy final rule) since estimating the impact of them individually would be misleading. We did provide an impact analysis that was specific to each standard, but the impact analysis assessed only the relative impact of implementing a given standard.
Conclusion of impact analysis of proposed rules
We estimated that the impact of the proposed rules would result in net savings to health plans and health care providers of $1.5 billion during the first five years; use of the standards would continue to save the industry money.
Comments and Responses on the Proposed Impact Analysis - General
1. Cost/Benefit Analysis
a. Comment: Several commenters questioned the validity of the projected cost of implementing electronic data interchange standards (EDI) because it was based largely on data compiled in 1992 by WEDI. The WEDI report projected implementation costs ranging between $5.3 billion and $17.3 billion with annual savings projected to be between $8.9 billion and $20.5 billion. It was stated the WEDI report projected the costs as being much higher. One reason the projected cost was inflated by WEDI is because the HIPAA compliance process will be spread out over a longer period of time than is provided for in the statute. The HIPAA standards will require additional data elements, will replace local coding schemes with national ones, and will affect many business process associated with health plans and health care providers. Therefore, the modifications to existing systems will be extensive and time consuming, with a high degree of uncertainty regarding the projected benefits. The estimates in this section need to be recalculated taking into account more current figures and trends.
Response: The cost estimates used in the proposal cost analysis were based largely on data compiled in 1992 but updated to reflect 1998 costs. The report developed by WEDI projects implementation costs ranging from between $5.3 billion and $17.3 billion with annual savings projected to be between $8.9 billion and $20.5 billion. The Department has obtained more current data and information on costs and market trends, and these data are used in the final cost analysis. It is an accurate statement that the HIPAA standards would create new data elements and would remove local coding schemes in favor of national ones. However, some of the factors that would cause health care providers or health plans to incur a substantial financial burden have been spread out over a longer period of time than was suggested by the commenters. The removal of local coding schemes, for example, will not occur immediately, but will occur over a two year time period following the publication of this final rule. A longer time frame will spread out the implementation costs and therefore will not pose as great a burden as previously expected. With regard to Medicaid specifically, some of the unusual service type codes (i.e. taxi services) will also not have to be removed.
b. Comment: One commenter stated that although the methodology used in the WEDI report served as a basis for determining the cost/benefit analysis explored within the proposed rule, the concept of cost-benefit analysis is vague and resembles something of a “black art.” Because of the large number of variables and the complexity of the assumptions with which health care providers and health plans will have to deal in implementing of HIPAA, it is hard to determine the actual advantages or disadvantages for the HIPAA standards as a group.
Response: It is difficult to assess the cost and benefits of the HIPAA standards with absolute certainty. While there are no standard methods for doing these analyses, an effort was made not to overstate the benefits or understate the costs of implementation. The WEDI report is the most extensive industry analysis of the effects of EDI standards available.
c. Comment: Several commenters stated that the sweeping changes that HIPAA mandates make it difficult to do a precise cost-benefit analysis. One commenter noted that additional actuarial studies should be done, with the cooperation of health plans and health care providers. The commenter also stated that pilot programs should be initiated in different geographic regions in order to identify the feasibility of the scope and time frames for HIPAA implementation. Another commenter stated that they believed that the costs associated with the NPI and subsequent system changes required of covered entities may run into the six-figure range, which is not mentioned in the proposed rule.
Response: It is difficult to assess the cost and benefits of the HIPAA standards with complete accuracy. This is particularly true considering that these changes have no historical precedent. While initiating pilot programs in each region and conducting further actuary studies may provide detailed analysis, it is neither feasible nor practical. The time frame for implementation, as mandated by the statute, precludes this. The analysis given was derived from aggregate figures that provided the most realistic impact in terms of costs and savings. NPI costs are currently being evaluated by the Department of Health and Human Services and will be published in the final rule regarding the NPI.
d. Comment: Several commenters expressed concern with the cost-benefit analysis in regard to Medicaid. One commenter stated that dismantling 80% of the Medicaid systems that process EDI in order to accommodate the HIPAA standards will result in a loss. Furthermore, it was noted that the use of a dual health care provider assignment number will continue to be used in their Medicaid Management Information System (MMIS) which would mitigate any cost savings benefit.
Response: The rationale behind the Impact Analysis was to evaluate the cost and savings for the health care system as a whole. While the cost to a specific health plan or health care provider may outweigh the benefits to that entity, our analysis showed overall savings to the health care system. There is a greater possibility for savings in the future due to use of a common identifiers, the increased simplicity of processing transactions, and the overall coordination of benefits. We do not anticipate an immediate need to overhaul an entire system, but we do expect some implementation costs which have been factored into the analysis. Translation software may be purchased at reasonable cost thus avoiding major reprogramming. (Since the translators will not affect the issues raised, they should have no impact.) Health plans and health care providers may also use a health care clearinghouse to perform the translation. We believe entities that use health care clearinghouses will see costs reduced or at least stabilized.
We do acknowledge that the $1 million cost estimate for redesigning a State Medicaid system to accommodate these standards may have been too low. Further analysis indicated that costs to individual State Medicaid programs may be in the $10 million range. While the cost in each State may differ somewhat, the Federal government will pay approximately 75 - 90 percent of these costs, leaving the costs to each State near the $1-2.5 million range. We believe that long-term benefits to States will outweigh the costs.
e. Comment: Several commenters stated that many of the numbers associated with our analysis were based upon calculations using aggregate data instead of evaluating the standards individually. It was stated that a separate assessment of each standard would yield more realistic results because the staged release of the proposed rules led to the impression that the HIPAA standards will be implemented in a staggered fashion. Assessing the cost of implementing each standard independently would not yield inflated costs, but would yield numbers that would approximate what the actual costs will be. A number of commenters suggested different approaches to make the rules more effective and beneficial, as well as make the implementation more orderly. One such approach was that the implementation of all of the standards be postponed until all of the proposed rules are published (e.g., a single harmonized implementation date based on the date of the last published rule), perhaps with the exception of those standards that have been deferred such as the First Report of Injury and the Patient Identifier. Another would be to break down the implementation into phases. The first phase would be full implementation of the standards within 2 years of the publication dates of the final rule for identifiers for health care providers, employers, and health plans. Phase 2 would be the full implementation of all the transactions including attachments and the security rule within 2 years of the publication of the last of these final rules. Phase 3 would be the implementation of the individual identifier within 2 years after the publication of the identifier final rule. The last recommended approach is the simultaneous publication of the final rules for the health care provider, health plan and employer identifiers; the transaction sets, including the First Report of Injury and the attachments; and the security regulations. This method would ensure that health care providers and vendors will have the changes necessary for both internal application systems and external communications.
Response: While the original plan was to implement all of the standards at the same time, the realities of the regulatory process and the impact of millennium activities will cause a variety of effective dates. This rule is the first to be published, with other rules for standards following shortly. It is difficult to assess the cost-benefit of each standard individually because there are costs and benefits associated with the interaction of many of the standards. It is more realistic to assess cost-benefits of standardizing EDI in general, using aggregate data to give a more complete picture, than attempting to measure the impact of each standard. Many of the numbers associated with this analysis are based upon calculations using aggregate data.
2. Implementation Costs
a. Comment: One commenter noted that a translator does not address the problems health care providers will have in relating their health care provider type to State billing systems or in billing local codes.
Response: The local code issue has been addressed in this rule. The health care provider type issue will be addressed in the final rule for the National Provider Identifier. Translators will allow health care providers to accommodate most of the business process changes required by this rule.
b. Comment: Several commenters stated that we greatly underestimated the implementation costs. They claimed that the costs associated with translator devices were not included, and upgrades to EDI systems could continue annually and could involve multiple standards which would not be classified as short-term costs. Furthermore, it was stated that all methods of complying with the HIPAA requirements will have costs associated with them that will not be limited to the first three years of implementation. There will be ongoing costs for training and support that will surpass the estimates given by the impact analysis. In addition, third-party administrators opting for in-house programming have already spent large sums of money to prepare for administrative simplification before compliance is mandated. Some commenters fear that health care clearinghouses will potentially charge high yearly fees and high transaction fees due to an increase in demand. They believe high fees will not be eliminated after the three year time frame has ended and the costs could be passed on to health care providers, health plans and purchasers. Finally, while the proposed rule proposed the elimination of data entry clerks and mailing costs, it did not account for software engineers that will be needed to redesign or reprogram a system. The personnel costs associated with these individuals could be 4-6 times as high as a data entry clerk.
Response: These comments raise several important issues. The first one deals specifically with the cost of a translator. The cost of translators, in fact, were included in estimating upgrade costs. In addition, some of these EDI standards would have occurred without the passage of HIPAA due to the demands of the health care industry. Many of the other costs mentioned, such as costs for training and support, would have also occurred whether or not standards were mandated, so we do not believe them relevant to the impact of this rule. The financial data given in the Impact Analysis was based on the most reasonable estimates available and took into account the implementation costs, including software engineering, that will be incurred during the first three years. This justifies the categorization of expenditures associated with the HIPAA standards as one-time or short-term. All of the costs associated with a system upgrade have been included in the implementation time-frame noted in the Proposed Rule. Finally, redesigning or reprogramming work that will be done in accordance with this regulation has been included in the implementation costs. While it is an aggregate amount, it provides the most realistic estimate based on available data. Health care clearinghouse charges can be expected to decrease due to market forces.
c. Comment: One commenter noted that the statement that increased EDI claims submission has the potential to improve cash flow because those who use EDI get their payments faster runs counter to HCFA’s decision to instruct its contractors to increase the waiting period before they issue checks to a health care provider. It was stated that HCFA’s decision may cause cash flow problems for physicians and mute the benefits of increased efficiency that are supposed to be generated by electronic claims submission. It was also stated that HCFA needs to refrain from taking actions that run counter to realizing the benefits envisioned by Congress and specified in the statute.
Response: Health care providers will share in many benefits of administrative simplification. HCFA is fully supportive of administrative simplification and will examine this issue carefully to ensure that there is no conflict. We have not instructed our contractors to change the waiting period for payment of Medicare claims, be they paper or electronic.
d. Comment: One commenter stated that before the industry begins to use any of the transactions in production, the National Provider System (NPS) should be fully loaded and tested. It was recommended that all health care providers be enumerated and NPS data should be ready for use on all transaction sets required under HIPAA within the first six months of the implementation period.
Response: The proposed rule acknowledged that there is a strong likelihood that implementation problems will result in rejected transactions, manual exception processing, payment delays, and requests for additional information. Therefore, the transaction formats allow for the use of current/legacy identifiers until the NPS is fully implemented. As recommended by a number of commenters, we have concluded that it would be best to implement the transactions and make sure they are implemented correctly before we begin requiring the identifiers be to used in the transactions.
e. Comment: Several commenters representing Medicaid have raised the notion that costs, both initial and long-term, will be far more expensive than originally anticipated. For example, one commenter stated that they currently use intelligent health care provider numbers with extensive hard coding and editing. Changing their MMIS would require changing the basic logic of 11 subsystems and 3 million lines of code. Another commenter estimated they will spend $6.5 million to implement the HIPAA standards despite the fact that 78% of their claims are already submitted electronically.
Response: The Impact Analysis generalized that standardization can be expected to lead to cost-effectiveness and avoidance of burden (see also the response to the comment in J. 1. d. in this section of the preamble). A number of States have provided cost estimates which indicate that the $1 million figure given may be too low. We do not disagree with this assertion, but believe that the costs will be spread out over a longer period of time than expected, and will not be as severe as anticipated. The costs to States to implement the HIPAA standards were carefully considered, but were not the only factor considered in developing the individual standards. A number of guiding principles (see B. Guiding Principles for Standard Selection in section IV. of this preamble) were followed and the overall adequacy and acceptance of these standards is dependent upon the standards meeting these guiding principles.
f. Comment: Several commenters expressed concern that the implementation time frame falls within the time period required to make millennium and Medicare Balanced Budget Act (BBA) changes. It was stated that the industry was given little flexibility in determining the most cost-effective way to implement the HIPAA standards.
Response: The Impact Analysis states that health care providers have considerable flexibility in determining how and when to accomplish changes in their systems to accommodate the HIPAA standards. Due to the longer than expected time to publish this final rule, the implementation time frame will fall beyond millennium changes and most BBA changes. Therefore, it is still possible to evaluate the most cost-effective approach.
g. Comment: One commenter stated that the impact analysis did not specifically mention who would provide the translator software that would be integrated into an existing system. If small physician practices are using older “legacy” type systems, they may not be able to create an interface with a translator that would accept the standard data. A complete system overhaul would be extremely costly to these specific health care provider groups.
Response: The Impact Analysis did not specifically mention who would provide the translator software that would be integrated into an existing system because we expect such software to be readily available on the open market. However, it did include estimates from the WEDI reports which were updated to reflect the current costs for small practices to convert their systems in order to use the standard formats. These estimates indicate an overall cost savings for physician practices. The most efficient way for small physician practices to circumvent high implementation costs may be to use a health care clearinghouse. If health care providers cannot create an interface with a translator, they have the option to use a health care clearinghouse. This would avoid the need to overhaul older type systems in order to accommodate the HIPAA standards. Furthermore, the costs for vendors and health care clearinghouses should be reduced due to the use of national EDI standards as well as the NPI. The overall homogeneity of these EDI formats should significantly reduce the high costs associated with the processing of different electronic claims formats. In turn, this would allow vendors and health care clearinghouses to provide services at lower costs, which should enable savings to be passed on to health care providers. In this regard, we also anticipate that market competition should tend to keep costs down.
h. Comment: One commenter believed that as part of a 1999 Presidential proposal, Medicare will charge one dollar for each paper Medicare claim that a physician submits. The commenter stated that this unfairly undermines a physician’s ability to continue to submit paper claims.
Response: Medicare has not instituted a user fee for paper claims.
3. Benefits of Increased EDI for Health Care Transactions
Comment: One commenter stated that the impact analysis should factor in the cost of dismantling existing electronic interchange systems. It was also stated that health care providers may move from electronic to paper submission if they feel that the costs and burdens associated with the new standards are too great.
Response: There is no need to dismantle entire systems. Rather, provisions need to be made to accommodate the new standards. We believe that the benefits health care providers are currently realizing through EDI will continue and will increase with the adoption of these standards. Unlike current practices which compel health care providers to use multiple formats when sending and receiving, health care providers will only need to use one format for each HIPAA standard when they send and receive. If health care providers are unwilling to upgrade their EDI system, they have the option of using a health care clearinghouse, or reverting to paper claim submission.
4. The Role of Standards in Increasing the Efficiency of EDI
Comment: One commenter stated that there are many factors affecting a health care provider’s decision as to when to convert to EDI. Thus, the idea that a health care provider may decide to delay conversion to EDI until it is “cost-effective” is made moot by other forces affecting a health care provider’s decision making process.
Response: Health care providers must use the standards if they wish to do business electronically. While other factors will impact their decision to do business electronically, we believe that the HIPAA standards will produce cost savings and efficiencies in EDI which should help convince health care providers of the benefits of EDI.
All known factors that may influence a health care provider’s decision were taken into account when the proposed rule was written and published. However, other factors may arise that were not accounted for. It is impossible to account for every possible scenario for every health care provider. The Impact Analysis took into account factors based on the data available at the time. These factors, which represent a wide spectrum of possibilities, were included in the cost-effectiveness figures and the overall decision making process.
5. Cost/Benefit Tables
a. Comment: Several commenters representing Medicaid had a number of comments regarding these tables. First, with respect to Table 1 (63 FR 25344) (see VI. Final Impact Analysis, I. Cost/Benefit Tables of this preamble for the updated table) they stated it was difficult to assess where Medicaid was represented or whether any other Federal program was included. Second, regarding that same table, it was stated that the method of allocating savings was imprecise and illogical when consideration is given to existing EDI systems that will have to be changed. For high end-users, the costs to convert will consume most of the savings. Third, because so much of Medicaid is automated already, the estimated savings that will offset 50% of the upgrade cost will be less. The cost assumptions are also not inclusive of the numerous operational activities associated with the possible role of the enumerator. One Medicaid Agency specifically mentioned that they pay their fiscal associate $.2672 to process any type of claim. They stated that the savings estimates based on $1 per claim for health plans and physicians and $.75 per claim for hospitals and other health care providers does not relate to their experience.
Response: Medicare and Medicaid program costs and savings were not included in the table on cost and savings to health plans because the Impact Analysis was done for private sector health plans only, as required. Cost estimates were made using the WEDI report and may not be specific to Medicaid or other State Agencies. They are also not specific to any unique experience. The savings mentioned in the analysis are based on overall utilization.
b. Comment: Several commenters stated that the pharmacist enumeration costs were underestimated. Table 2 (63 FR 25344) (see VI. Final Impact Analysis, I. Cost Benefit/Tables of this preamble for the updated table) lists 70,100 pharmacies; however, no data was included regarding the number of pharmacists. There are about 200,000 pharmacists. It was stated that the enumeration costs should be adjusted accordingly.
Response: We did not enumerate pharmacists, because the pharmacy is the entity that does most of the billing and, therefore, is the appropriate unit for analysis.
c. Comment: One commenter raised several questions regarding Table 4a (63 FR 25346), which shows relative savings and volume of other transactions (note, Table 4a corresponds to Table 5 in VI. Final Impact Analysis, I. Cost/Benefit Tables of this preamble): (1) was the ASC X12N 997 transaction included in the “Claim” transaction in Table 4a; (2) was the ASC X12N 277 included in the “Claims Inquiry” transaction; (3) does the “Remittance Advice” include payment data and Electronic Funds Transfer (EFT) payment; (4) has allowance been made for any charges by banks for passing on the payment data; (5) is the ASC X12N 275 included in one of the transactions listed; and (6) how was the “Average Cost for Non-EDI Health Plans” calculated?
Response: (1) The ASC X12N 997 is not a HIPAA transaction standard and was not included. (2) The ASC X12N 277 does represent a HIPAA transaction standard and was included in the analysis. (3) The “Remittance Advice” includes payment data and EFT payment. (4) The cost of the banks processing data was not included in the impact analysis because the EFT process will remain the same under the standards. Banks are not required to use the HIPAA standards; however, most, if not all, are expected to continue to use the Automated Clearinghouse (ACH) standard which they are now using for EFT (and which would be compliant with these standards). (5) The ASC X12N 275 was not included in the transactions listed. (6) The cost to non-EDI health plans was computed as follows: total entities x (1-EDI %) x average upgrade cost x 0.5.
d. Comment: One commenter stated that more information is needed on the methodology used to calculate the costs/benefits in order for each hospital to model the cost/benefits.
Response: The methodology for calculating the costs/benefits for health care providers was derived from the WEDI report and was mentioned at the beginning of the Impact Analysis. The WEDI report also documents how that methodology was applied.
6. Quantitative Impacts of Administrative Simplification
a. Comment: In regard to Medicaid, commenters noted that with the mandatory nature of EDI rules, the obligation to coordinate “who pays when” was not included (i.e., Medicaid is the payer of last resort). It was stated that standardization of data and transactions alone will not help unless health plans pass on those rules. Administrative simplification could facilitate coordination of benefits by having a standardized set of data that is known to all parties, along with standardized name and address information that tells where to route transactions.
Response: We agree that standardization will facilitate coordination of benefits by having in place a standardized set of data. This is one of the goals of administrative simplification. The HIPAA standards do require health plans to use the standard COB transaction for exchanging COB with other health plans.
b. Comment: Some comments stated that the administrative burden for health plans may increase as more data validation occurs in a post-adjudication environment. It was stated that the example of staff translation of codes due to standardized codes was misleading, since individuals must still perform coding actions in order to enter patient data into the hospital information system or other patient data systems.
Response: The implementation of the HIPAA standards will actually reduce the overall need for data validation as it will reduce the need for clerical entry. Although there may still be individual manipulation or translation of codes, it will be less labor intensive; this result will be due to the replacement of multiple EDI formats with one set of nationally accepted standards.
c. Comment: One commenter stated that the cost to maintain a proprietary health care provider file may remain basically the same or may increase as there may be an increased need to validate data between the proprietary file and the National Provider System database (NPS); this result would more than offset any savings that may have been realized through the elimination of other health care provider numbers.
Response: When the NPI is implemented, there will be a one time cost to entities to align their proprietary health care provider files to NPS data and add the NPI to their files. Once the NPI has been added, though, we would expect ongoing costs for several functions (COB, health care provider monitoring, communications with health care providers, etc.) to be reduced because of the uniform numbering system and the elimination of health care provider enumeration activities by individual health plans.
7. Regulatory Flexibility Analysis
a. Comment: One commenter recommended that the statement “cost savings will be passed on to customers of health care clearinghouses and billing agencies” should be reworded to state that cost savings “should” be passed on rather than imply that they will. It is possible that these savings won’t be passed on because health care clearinghouses may be in a position to profit from the increased demand for their services. The possibility also exists that costs will decrease, and as a result prices will drop to reflect these savings.
Response: We believe that market forces will drive down costs, and as a result savings will be passed on to customers of health care clearinghouses and billing agencies.
b. Comment: One commenter stated that there is no guarantee that small health care providers will embrace EDI. There should be information about educational campaigns and how that educational outreach will occur.
Response: The Impact Analysis acknowledges that not everyone will move to the HIPAA standards and use EDI. However, since the catalyst behind this statute was the health care industry, we expect that health plans and others will recognize the benefits they can enjoy through administrative simplification, and will educate health care providers so that benefits will be realized.
8. Unfunded Mandates
a. Comment: Several commenters stated that it is possible that a portion of the costs which managed care organizations will incur due to HIPAA will be passed onto the Medicaid program in the form of increased capitation payments. It was stated that while the Secretary puts forth a Cost Budget Office (CBO) analysis indicating that States “have the option to compensate by reducing other expenditures,” they have first-hand knowledge of the challenges associated with “reducing” expenditures associated with entitlement programs. Furthermore, enrollment of Medicaid recipients into managed care programs does not eliminate the need for fee-for-service claims processing under the new standards. One commenter noted that $2 million is a conservative estimate of the cost to a State to modify its MMIS to comply with the HIPAA mandates. The improvements offered are geared towards EDI between commercial health plans and their health care providers. Benefits of increased EDI and health care provider enumeration accrue to all EDI participants at the expense of the Medicaid program.
Response: We do not agree that the benefits of EDI for the health care community would increase at the expense of the Medicaid program. We acknowledge that the implementation costs for each State may be underestimated. However, the benefits of administrative simplification should accrue to every health care entity, whether public or private. The costs to the Medicaid program will be spread out over a longer period of time than expected, which will mitigate any large financial impact. Additional provisions were also included for specialized delivery services. The Department will match 75 - 90% of the costs associated with the MMIS and the new software that will be integrated for the HIPAA standards. The long-term savings will offset implementation costs. We recognize that fee-for-service claims processing will continue.
b. Comment: Several commenters stated that it may be an inaccurate conclusion that the unfunded mandates of HIPAA will not result in significant costs to State governments. In fact, it may cost States between $2 and $10 million to restructure for HIPAA compliance. Furthermore, the start-up costs will be high in order to align current health care provider files with the NPS so that matches can be made. Start-up costs will probably exceed $1 million per health plan. There are also additional indirect costs which are not mentioned. Indirect costs may arise from having to reorganize business functions and possibly having to pay the implementation costs of health care providers, health care clearinghouses and health plans.
Response: We agree that the calculated costs may be underestimated and the Impact Analysis does state that it is difficult to assess cost/benefits of such a sweeping change. Many of the costs mentioned in the comment are short-term costs. The long-terms savings that will accrue from administrative simplification will offset the short-term expenditures. Each health care provider will have to determine how to treat these initial costs until the savings begin to accrue.
c. Comment: One commenter stated that many areas of the payment processes are still done manually. Changes/upgrades to bulletin board type systems that receive electronic billing data from health care providers will also impact the costs of this unfunded mandate.
Response: The costs associated with these bulletin board type systems have been included in the estimated cost of system upgrades mentioned in the Impact Analysis.