CMS pushes HIPAA compliance enforcement back 90 days

The Centers for Medicare & Medicaid Services’ (CMS) Office of E-Health Standards and Services (OESS) has decided not to initiate enforcement action until March 31, with respect to HIPAA-covered entities (including health plans, healthcare providers and clearinghouses, as applicable) not compliant with the operating rules adopted for the following transactions as required by the Patient Protection and Affordable Care Act: eligibility for a health plan and healthcare claim status. Notwithstanding OESS’ discretionary application of its enforcement authority, the compliance date for using the operating rules remains Jan. 1.

The agency said that "industry feedback suggests" that HIPAA-covered entities have not reached a threshold whereby a majority of covered entities would be able to comply with the operating rules by Jan. 1. This enforcement discretion period does not prevent applicable HIPAA-covered entities that are prepared to conduct transactions using the adopted operating rules from doing so, and all applicable covered entities are encouraged to determine their readiness to use the operating rules as of Jan. 1, and expeditiously become compliant. Although enforcement action will not be taken, OESS will accept complaints associated with compliance with the operating rules beginning Jan. 1.

If requested by OESS, covered entities that are the subject of complaints (known as “filed-against entities”) must produce evidence of either compliance or a good faith effort to become compliant with the operating rules during the 90-day period. HHS will continue to work to align the requirements under Section 1104 of the Affordable Care Act to optimize industry’s ability to achieve timely compliance.

OESS is the U.S. Department of Health and Human Services (HHS) component that enforces compliance with HIPAA transaction and code set standards, including operating rules, identifiers and other standards required under HIPAA by PPACA. For copies of the operating rules for the eligibility for a health plan and healthcare claim status transactions, visit the Council for Affordable Quality Healthcare's CORE website.