Enforcement of privacy rules now delayed until March 31

The Centers for Medicare & Medicaid Services has pushed back enforcement of two electronic healthcare transaction rules by three months, the agency announced in January. That gives providers until March 31. 

CMS said it would not begin enforcement before April because not enough Health Insurance Portability and Accountability Act-covered providers were ready to meet the rule’s new technical requirements.

“Industry feedback suggests that HIPAA-covered entities have not reached a threshold whereby a majority of covered entities would be able to be in compliance with operating rules by January 1, 2013,” according to an announcement posted by CMS’s Office of E-Health Standards and Services. 

“This enforcement period does not prevent applicable HIPAA-covered entities that are prepared to conduct transactions using the adopted operating rules from doing so,” the posting added.

The cited rules are intended to make it easier for providers to determine whether a patient is eligible for healthcare coverage, and the status of healthcare claims submitted to health insurers, according to the interim final rule.

Despite the enforcement delay, OESS nonetheless has begun accepting complaints associated with compliance with the operating rules. 

If requested by OESS, providers that are the subject of complaints (known as “filed-against entities”) must produce evidence of either compliance or a good faith effort to become compliant with the operating rules during the 90-day period. The Department of Health and Human Services will continue to work to align the requirements, according to a department spokesperson.

Copies of the operating rules for the eligibility for a health plan and healthcare claim status transactions can be found at the Council for Affordable Quality Healthcare’s website at http://www.caqh.org