NRPM: Standards for Privacy of Individually Identifiable Health Information. Ongoing Costs


In this section, we evaluate the ongoing costs of providing patient notices, the annual cost of amending and correcting medical information, the cost of providing written authorizations, and the ongoing cost of paperwork and training. We estimated the ongoing costs of compliance through calculations similar to those used for our systems compliance estimates. Ongoing costs are most heavily influenced by the size of the business. Therefore, we assume that the number of patients an entity serves is directly proportional to its ongoing compliance costs.

We estimated market share using Small Business Administration data estimating total receipts 12. We divided the small entity receipts by total receipts and arrived at an estimate that 22 percent of the revenue generated by the health care classifications we examined is from small businesses. Using annual receipts to estimate cost burden is more accurate than using information on the number of health care entities. The size of the small entity is more likely to be correlated with the number of patients served than the number of businesses, and therefore, the amount of business conducted by an entity. Because it is difficult to find a single good estimate of market share, we considered estimating market share over a range, using the proportion of annual receipts as a lower bound and number of entities as the higher bound. We concluded that even if the SBA data does not capture the total amount of health care receipts accurately, estimating market share by examining receipts would be much more accurate than using the number of entities.

We multiplied the percent total receipts by the total ongoing costs (by entity type) to obtain a range of ongoing costs for small entities. We were then able to divide these costs by the number of small entities by type of entity. We estimated ongoing costs in the first year that the proposed rule takes effect separately from our estimate of ongoing cost in the following years. The estimates were approximately the same; $337 and $343 respectively.

We estimate that the ongoing cost of compliance will be approximately 0.05 percent of a small entity’s annual expenditures. This cost burden is fairly consistent across all types of entities.

Clearinghouses and Nonprofit Entities: We should note that the above discussion does not consider health care clearinghouses, nonprofit hospitals, home health agencies, or nursing and skilled nursing facilities. To the extent that clearinghouses and nonprofit facilities have annual receipts of less than $5 million, they were included in the preceding analysis.

Although we do not have precise information on the number of clearinghouses that qualify as small entities under the RFA, we believe that approximately half would meet the criteria. As noted in the regulatory impact analysis, as long as clearinghouses perform the function of merely reformatting information they receive and transmitting the data to other entities, the cost of complying with the proposed rule should be minimal.

A similar logic applies for nonprofit health plans and hospitals. We do know how many nonprofit organizations currently exist in the U.S., but do not have reliable revenue and expenditure data for these entities. In the absence of such data, we assume that nonprofit entities have a similar ratio of revenues to expenditures as the for-profit entities we have examined. Thus, we believe that the impact of complying with the proposed rule should be similar to that described for-profit plans and hospitals.

The preceding analysis indicates that the expected burden on small entities of implementing the proposed rule would be minimal. However, by necessity, the analysis is based on average costs, and as such, they may not reflect the actual burden on some or even a substantial number of small entities. Therefore, the Secretary does not certify that the proposed rule will not have a significant impact on a substantial number of small entities.