Administrative Simplification: Adoption of Operating Rules for Eligibility for a Health Plan and Health Care Claim Status Transactions, 40458-40496 [2011-16834]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 76, Number 131 (Friday, July 8, 2011)]
[Rules and Regulations]
[Pages 40458-40496]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-16834]



[[Page 40457]]

Vol. 76

Friday,

No. 131

July 8, 2011

Part II





Department of Health and Human Services





-----------------------------------------------------------------------





45 CFR Parts 160 and 162





Administrative Simplification: Adoption of Operating Rules for 
Eligibility for a Health Plan and Health Care Claim Status 
Transactions; Interim Final Rule

Federal Register / Vol. 76, No. 131 / Friday, July 8, 2011 / Rules 
and Regulations

[[Page 40458]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 162

[CMS-0032-IFC]
RIN 0938-AQ12


Administrative Simplification: Adoption of Operating Rules for 
Eligibility for a Health Plan and Health Care Claim Status Transactions

AGENCY: Office of the Secretary, HHS.

ACTION: Interim final rule with comment period.

-----------------------------------------------------------------------

SUMMARY: Section 1104 of the Administrative Simplification provisions 
of the Patient Protection and Affordable Care Act (hereafter referred 
to as the Affordable Care Act) establishes new requirements for 
administrative transactions that will improve the utility of the 
existing HIPAA transactions and reduce administrative costs. 
Specifically, in section 1104(b)(2) of the Affordable Care Act, 
Congress required the adoption of operating rules for the health care 
industry and directed the Secretary of Health and Human Services to 
``adopt a single set of operating rules for each transaction * * * with 
the goal of creating as much uniformity in the implementation of the 
electronic standards as possible.''
    This interim final rule with comment period adopts operating rules 
for two Health Insurance Portability and Accountability Act of 1996 
(HIPAA) transactions: eligibility for a health plan and health care 
claim status. This rule also defines the term ``operating rules'' and 
explains the role of operating rules in relation to the adopted 
transaction standards. In general, transaction standards adopted under 
HIPAA enable electronic data interchange through a common interchange 
structure, thus minimizing the industry's reliance on multiple formats. 
Operating rules, in turn, attempt to define the rights and 
responsibilities of all parties, security requirements, transmission 
formats, response times, liabilities, exception processing, error 
resolution and more, in order to facilitate successful interoperability 
between data systems of different entities.

DATES: Effective Date: These regulations are effective on June 30, 
2011. The incorporation by reference of the publications listed in this 
interim final rule is approved by the Director of the Office of the 
Federal Register June 30, 2011.
    Compliance Date: The compliance date for this regulation is January 
1, 2013.
    Comment Date: To be assured consideration, comments must be 
received at one of the addresses provided below, no later than 5 p.m. 
on September 6, 2011.

ADDRESSES: In commenting, please refer to file code CMS-0032-IFC. 
Because of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    You may submit comments in one of four ways (please choose only one 
of the ways listed)
    1. Electronically. You may submit electronic comments on this 
regulation to https://www.regulations.gov. Follow the ``Submit a 
comment'' instructions.
    2. By regular mail. You may mail written comments to the following 
address ONLY: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-0032-IFC, P.O. Box 8013, 
Baltimore, MD 21244-8013.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address ONLY: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-0032-IFC, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    4. By hand or courier. If you prefer, you may deliver (by hand or 
courier) your written comments before the close of the comment period 
to either of the following addresses:
    a. For delivery in Washington, DC--Centers for Medicare & Medicaid 
Services, Department of Health and Human Services, Room 445-G, Hubert 
H. Humphrey Building, 200 Independence Avenue, SW., Washington, DC 
20201.
    (Because access to the interior of the Hubert H. Humphrey Building 
is not readily available to persons without Federal government 
identification, commenters are encouraged to leave their comments in 
the CMS drop slots located in the main lobby of the building. A stamp-
in clock is available for persons wishing to retain a proof of filing 
by stamping in and retaining an extra copy of the comments being 
filed.)
    b. For delivery in Baltimore, MD--Centers for Medicare & Medicaid 
Services, Department of Health and Human Services, 7500 Security 
Boulevard, Baltimore, MD 21244-1850.
    If you intend to deliver your comments to the Baltimore address, 
please call telephone number (410) 786-1066 in advance to schedule your 
arrival with one of our staff members.
    Comments mailed to the addresses indicated as appropriate for hand 
or courier delivery may be delayed and received after the comment 
period.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT:
Shannon Whetzel (410) 786-3267.
Matthew Albright (410) 786-2546.
Denise Buenning (410) 786-6711.

SUPPLEMENTARY INFORMATION:
    Inspection of Public Comments: All comments received before the 
close of the comment period are available for viewing by the public, 
including any personally identifiable or confidential business 
information that is included in a comment. We post all comments 
received before the close of the comment period on the following Web 
site as soon as possible after they have been received: https://regulations.gov. Follow the search instructions on that Web site to 
view public comments.
    Comments received timely will be also available for public 
inspection as they are received, generally beginning approximately 3 
weeks after publication of a document, at the headquarters of the 
Centers for Medicare & Medicaid Services, 7500 Security Boulevard, 
Baltimore, Maryland 21244, Monday through Friday of each week from 8:30 
a.m. to 4 p.m. To schedule an appointment to view public comments, 
phone 1-800-743-3951.

I. Background

A. Introduction

    The background discussion below presents a partial statutory and 
regulatory history related only to the statutory provisions and 
regulations that are important and relevant for purposes of this 
interim final rule with comment period. For further information about 
electronic data interchange, the complete statutory background, and the 
regulatory history, see the proposed rule entitled ``Health Insurance 
Reform; Modifications to the Health Insurance Portability and 
Accountability Act (HIPAA) Electronic Transaction Standards,'' 
published in the Federal Register on August 22, 2008 (73 FR 49742).
    Congress addressed the need for a consistent framework for 
electronic health care transactions and other administrative 
simplification issues through the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA), (Pub. L. 104-191), enacted on 
August 21, 1996. HIPAA amended the

[[Page 40459]]

Social Security Act (hereinafter referred to as the Act) by adding Part 
C--Administrative Simplification--to Title XI of the Act requiring the 
Secretary of the Department of Health and Human Services (hereinafter 
referred to as the Secretary) to adopt standards for certain 
transactions to enable health information to be exchanged 
electronically and to achieve greater uniformity in the transmission of 
health information. Electronic Data interchange (EDI) enables providers 
and payers to process financial and administrative transactions faster 
and at a lower cost than manual transactions.
    In the August 17, 2000 Federal Register (65 FR 50312) we published 
a final rule entitled ``Health Insurance Reform: Standards for 
Electronic Transactions'' (hereinafter referred to as the Transactions 
and Code Sets rule). This rule implemented some of the HIPAA 
Administrative Simplification requirements by adopting standards for 
electronic health care transactions developed by standard setting 
organizations (SSOs), and medical code sets to be used in those 
transactions. Accordingly, we adopted the Accredited Standards 
Committee (ASC) X12 standards Version 4010 and the National Council for 
Prescription Drug Programs (NCPDP) Telecommunication standard Version 
5.1, which are specified at 45 CFR part 162, subparts K through S. All 
health plans, health care clearinghouses, and health care providers who 
transmit health information in electronic form (referred to as covered 
entities) are required to comply with these adopted standards.
    In the January 16, 2009 Federal Register, we published a final rule 
entitled, ``Health Insurance Reform; Modifications to the Health 
Insurance Portability and Accountability Act (HIPAA) Electronic 
Transaction Standards'' (74 FR 3296) (hereinafter referred to as the 
Modifications final rule), that, among other things, adopted updated 
versions of the standards [(ASC X12 Version 5010 (hereinafter referred 
to as Version 5010)] and NCPDP Version D.0) for the electronic health 
care transactions originally adopted in the Transactions and Code Sets 
final rule. Covered entities are required to comply with the updated 
standards for electronic health care transactions on January 1, 2012. 
Table 1 lists HIPAA standard transactions.

        Table 1--Current Adopted Standards for HIPAA Transactions
------------------------------------------------------------------------
             Standard                            Transaction
------------------------------------------------------------------------
ASC X12 837 D.....................  Health care claims--Dental.
ASC X12 837 P.....................  Health care claims--Professional.
ASC X12 837 I.....................  Health care claims--Institutional.
NCPDP D.0.........................  Health care claims--Retail pharmacy
                                     drug.
ASC X12 837 P and NCPDP D.0.......  Health care claims--Retail pharmacy
                                     supplies and professional services.
NCPDP D.0.........................  Coordination of Benefits--Retail
                                     pharmacy drug.
ASC X12 837 D.....................  Coordination of Benefits--Dental.
ASC X12 837 P.....................  Coordination of Benefits--
                                     Professional.
ASC X12 837 I.....................  Coordination of Benefits--
                                     Institutional.
ASC X12 270/271...................  Eligibility for a health plan
                                     (request and response)--dental,
                                     professional, and institutional.
NCPDP D.0.........................  Eligibility for a health plan
                                     (request and response)--Retail
                                     pharmacy drugs.
ASC X12 276/277...................  Health care claim status (request
                                     and response).
ASC X12 834.......................  Enrollment and disenrollment in a
                                     health plan.
ASC X12 835.......................  Health care payment and remittance
                                     advice.
ASC X12 820.......................  Health plan premium payment.
ASC X12 278.......................  Referral certification and
                                     authorization (request and
                                     response).
NCPDP D.0.........................  Referral certification and
                                     authorization (request and
                                     response)--retail pharmacy drugs.
NCPDP 5.1 and D.0.................  Retail pharmacy drug claims
                                     (telecommunication and batch
                                     standards).
NCPDP 3.0.........................  Medicaid pharmacy subrogation (batch
                                     standard).
------------------------------------------------------------------------

    In general, the transaction standards adopted under HIPAA enable 
electronic data interchange using a common interchange structure, thus 
minimizing the industry's reliance on multiple formats. While the 
standards significantly decrease administrative burden on covered 
entities by creating greater uniformity in data exchange, and reduce 
the amount of paper forms needed for transmitting data, gaps created by 
the flexibility in the standards permit each health plan to use the 
transactions in very different ways, which remains an obstacle to 
achieving greater health care industry administrative simplification. 
These gaps include all of the following:
     Performance and system availability. Because the standards 
permit the flexibility of conducting the transactions in batch mode or 
real-time, in order to minimize the number of different 
implementations, some submitters have resorted to contracting with 
clearinghouses for transaction exchanges that require batch 
submissions, and simultaneously are utilizing internal resources for 
real-time submissions. Some batch submissions are only conducted 
overnight. Typically batch submissions can be substantially slower than 
real-time transmissions, and systems may be available only at certain 
times for conducting certain transactions.
     Connectivity and transportation of information. In 
traditional trading partner agreements, health plans specify their 
connectivity options for conducting the standard transactions. These 
options can vary from plan to plan. For example, some payers only 
conduct the transactions through a contracted clearinghouse. Others 
offer a direct connection to their system. Still others use both--
contract with a clearinghouse for some transactions, and offer direct 
connect solutions for other transactions. Also, there are some plans 
that offer a number of options, and negotiate a choice with each 
trading partner, including providers.
     Security and authentication. Currently, security standards 
do not prescribe requirements for levels of security and authentication 
when conducting the standard transactions and accessing protected 
health information. A covered entity's level of security and 
authentication requirements is determined by the individual entity's 
periodic assessments for security risk and vulnerabilities. 
Organizations have latitude to determine and document the number and 
types of security safeguards that they implement. Although this 
flexibility supports the implementation

[[Page 40460]]

of security safeguards that are consistent with the uniqueness of 
various organizations, it also limits standardization for security 
compliance.
     Business scenarios and expected responses. The standards 
do not define methods by which trading partners, including providers, 
establish electronic communication links, or types of hardware and 
software to exchange EDI data. Each trading partner, including 
providers, separately provides specific requirements; for example, the 
number of transactions that are submitted in a file. Transaction 
processing in each entity's system will vary from one trading partner, 
including providers, to another. The responses to compliantly 
implementing these various transaction processing systems are 
identified by trading partners, including providers, in documentation 
that is in addition to the adopted implementation guides. These types 
of documented business requirements can vary in terms of number and 
complexity.
     Data content refinements. In accordance with trading 
partner agreements, plans can ignore certain data that are submitted if 
not needed by them to conduct the transaction. They also can refine 
certain data elements and require their submission. Trading partner 
agreements and additional documentation that plans develop permit plans 
to define specific types of data and to clarify the specific data that 
is required to be submitted for successful completion of a transaction. 
Although the standards limit the number of data elements that can be 
defined or optionally submitted, a plan's individual business flow and 
operations may impose specific data definition and submission 
requirements.
    These gaps, among other challenges in the implementation of the 
standards, have spurred the creation of companion guides by health 
plans. Health plans have created these companion guides to describe 
their unique implementation of HIPAA transactions and how they will 
work with their business partners. Historically, companion guides have 
been used to establish business practices such as response time, system 
availability, communication protocols, hours of operation, amount of 
claim history available for inquiries and real-time adjustments, 
security practices, and more. Health plans' companion guides vary in 
format and structure. Such variance can be confusing to trading 
partners (those entities, including providers, who exchange HIPAA 
compliant electronic transactions), who must implement them in addition 
to the specifications in the transaction standard implementation 
guides. Further, each companion guide is unique for each different 
health plan.
    Currently, according to the American Medical Association (AMA) 
there are over 1,200 such companion guides in existence (https://www.ama-assn.org/ama1/pub/upload/mm/368/hipaa-tcs.pdf). As mentioned 
previously, companion guides require providers and trading partners, 
including providers, to adhere to different transaction implementation 
rules for different health plans. Therefore, the widespread 
proliferation of health plan companion guides is particularly 
burdensome to health care providers, and we believe has subverted the 
goal of administrative simplification.
    Over the past 5 years, this proliferation of health plan companion 
guides has given rise to the development of operating rules. To 
facilitate successful interoperability between data systems of 
different entities, operating rules more clearly define the rights and 
responsibilities of all parties, security requirements, transmission 
formats, response times, liabilities, exception processing, error 
resolution and more. Operating rules have been shown to reduce costs 
and administrative complexities as will be described later in this 
interim final rule with comment period.
    The use of operating rules is widespread and varied among other 
industries. For example, uniform operating rules for the exchange of 
Automated Clearing House (ACH) payments among ACH associations are used 
in compliance with U.S. Federal Reserve regulations (12 CFR Part 370), 
and maintained by the Federal Reserve and the Electronic Payments 
Network. Additionally, credit card issuers employ detailed operating 
rules (for example, Cirrus Worldwide Operating Rules) describing types 
of members, their responsibilities and obligations, licensing and 
display of service marks, etc.

B. Operating Rules Mandated by the Affordable Care Act

    Congress sought to address the aforementioned problems in the 
health care industry by requiring the adoption of operating rules for 
the health care industry as outlined in the Patient Protection and 
Affordable Care Act (Pub L. 111-148), enacted on March 23, 2010, and by 
the Health Care and Education Reconciliation Act of 2010, (Pub. L. 111-
152), which was enacted on March 30, 2010 (hereinafter referred to as 
the Affordable Care Act). Section 1173(g)(1) of the Act, as added by 
section 1104(b)(2) of the Affordable Care Act, requires the Secretary 
to ``adopt a single set of operating rules for each transaction * * * 
with the goal of creating as much uniformity in the implementation of 
the electronic standards as possible.''
    The role of operating rules is to support the adopted standards for 
health care transactions in order to foster and enhance uniform use of 
the adopted standards and implementation guides across the health care 
industry. Standards and operating rules overlap in their functions to 
increase uniformity, but differ in their purposes. While standards are 
mainly concerned with the content transmitted in a transaction, 
operating rules provide for the method of how the information should be 
transmitted, as well as the elimination of certain situationality in 
the use of data content contained in the standards. Situationality 
refers to the fact that many transaction requirements only apply if the 
situation is presented. For example, in the 271 eligibility response 
transaction, the health plan name is only required when a specific plan 
name exists for the plan for which the individual has coverage.
    Operating rules augment the standards in the following three 
important ways:
     They contain additional requirements that help implement 
the standard for a transaction in a more consistent manner across 
health plans. For example, when a provider currently sends an 
eligibility for a health plan inquiry to a health plan, the standard 
allows responses ranging from a simple ``yes'' or ``no'', to the 
inclusion of a complete range of information. The operating rule 
requires the health plan to return patient eligibility and financial 
responsibility for a specified list of service type codes including, 
but not limited to, dental, vision, medical, hospital inpatient, and 
emergency care. This requirement ensures that a provider, who submits 
the same inquiry to multiple payers, receives a consistent response for 
an eligibility for a health plan inquiry. This reduces the number of 
customized transactions when dealing with multiple health plans, thus 
saving both time and money.
     They address ambiguous or conditional requirements in the 
standard and clarify when to use or not use certain data elements or 
code values. For example, the standard may leave it to the discretion 
of the health plan whether or not to return the health plan's name in a 
particular field, creating the possibility of inconsistency in health 
plan responses. An operating rule may require that the health plan name 
always be returned and that it

[[Page 40461]]

always be returned in one particular specified manner. This encourages 
uniformity and alleviates the problem of providers receiving 
inconsistent information.
     They specify how trading partners, including providers, 
should communicate with each other and exchange patient information, 
with the goal of eliminating connectivity inconsistencies. Currently, 
individual health plans specify the transmission methods they expect 
each of their trading partners, including providers, to use for 
electronic transactions. Mandating one uniform method decreases the 
amount of work and inconsistencies providers experience when dealing 
with multiple payers with differing transmission methods.
    The Affordable Care Act presents a definition of operating rules 
and provides a great deal of guidance about the role Congress 
envisioned for operating rules in relation to the standards. Operating 
rules are defined by section 1171(9) of the Act (as added by section 
1104(b)(1) of the Affordable Care Act) as ``the necessary business 
rules and guidelines for the electronic exchange of information that 
are not defined by a standard or its implementation specifications as 
adopted for purposes of this part.'' Additionally, section 
1173(a)(4)(A) of the Act (as added by section 1104(b)(2) of the 
Affordable Care Act) requires that--

    The standards and associated operating rules adopted by the 
Secretary shall--
    (i) to the extent feasible and appropriate, enable determination 
of an individual's eligibility and financial responsibility for 
specific services prior to or at the point of care;
    (ii) be comprehensive, requiring minimal augmentation by paper 
or other communications;
    (iii) provide for timely acknowledgment, response, and status 
reporting that supports a transparent claims and denial management 
process (including adjudication and appeals); and
    (iv) describe all data elements (including reason and remark 
codes) in unambiguous terms, require that such data elements be 
required or conditioned upon set values in other fields, and 
prohibit additional conditions (except where necessary to implement 
State or Federal law, or to protect against fraud and abuse).''

    Section 1104(b)(2) of the Affordable Care Act also amended section 
1173 of the Act by adding new subsection (a)(4)(B), which states that, 
``[i]n adopting standards and operating rules for the transactions* * 
*, the Secretary shall seek to reduce the number and complexity of 
forms (including paper and electronic forms) and data entry required by 
patients and providers.''
    Section 1104(b)(2) of the Affordable Care Act added section 
1173(g)(1) to the Act, which states that, ``[s]uch operating rules 
shall be consensus-based and reflect the necessary business rules 
affecting health plans and health care providers and the manner in 
which they operate pursuant to standards issued under Health Insurance 
Portability and Accountability Act of 1996.''
    New sections 1173(g)(2)(D), (g)(3)(C), and (g)(3)(D) of the Act 
also clarify the scope of operating rules. They provide that,

    In adopting operating rules under this subsection, the Secretary 
shall consider recommendations for operating rules developed by a 
qualified nonprofit entity that meets the following requirements * * 
* (D) The entity builds on the transactions issued under Health 
Insurance Portability and Accountability Act of 1996. * * * The 
National Committee on Vital and Health Statistics shall * * * (C) 
determine whether such operating rules represent a consensus view of 
health care stakeholders and are consistent with and do not conflict 
with other existing standards; (D) evaluate whether such operating 
rules are consistent with electronic standards adopted for health 
information technology

    We take from the statutory context the following information about 
operating rules to be adopted under HIPAA:
     They are business rules and guidelines;
     They are necessary for the electronic exchange of 
information;
     They are not defined by a standard;
     They do not conflict with the existing HIPAA standards;
     They are consensus based;
     They are consistent with HIPAA and Health Information 
Technology (HIT) standards adopted by the Secretary; and
     Together with standards they encourage the use of 
electronic transactions by reducing ambiguities currently permitted by 
the standard, resulting in better-defined inquiries and responses that 
add value to provider practice management and health plan operations.

II. Provisions of the Interim Final Rule With Comment Period

A. Definition of Operating Rules

    Section 1171(9) of the Act, as added by section 1104(b)(1) of the 
Affordable Care Act, defines operating rules as ``the necessary 
business rules and guidelines for the electronic exchange of 
information that are not defined by a standard or its implementation 
specifications as adopted for purposes of this part.'' We are adding 
the term ``operating rules'' to the definitions in regulations at 45 
CFR 162.103, and defining it just as it appears in the statute. We note 
that, in the statutory reference, ``this part'' refers to Part C of 
Title XI of the Act, Administrative Simplification. In the regulation 
at 45 CFR 162.103, ``this part'' refers to Part 162 of the CFR, the 
part in which the definition appears, which contains the regulations 
that pertain to, among other things, the HIPAA transactions and code 
sets. The following discussion further explains operating rules and 
their scope, in light of their relationship to the standards.
    Business rules and guidelines are not defined by the statute, nor 
has the health care industry specifically defined business rules or 
guidelines for itself. These are very broad terms and there are many 
ways to define them. Generally, business rules and guidelines are 
statements that refine and specify. For purposes of operating rules, 
business rules and guidelines are statements that refine and specify.
    While operating rules may have a very broad scope as business rules 
and guidelines in order to cover the full spectrum of data content, 
from data elements to standards, we believe there are limitations. To 
meet the definition of operating rules, business rules and guidelines 
must be ``necessary * * * for the electronic exchange of information 
that are not defined by a standard or its implementation 
specifications.'' We interpret the term ``necessary'' to be those 
operating rules needed to facilitate better communication between 
trading partners, including providers, to fill gaps in the standards, 
and to fulfill the purposes and principles set out in sections 
1173(a)(4)(A)(i) through (iv) and (B) of the Act.
    If a business rule or guideline is necessary for the electronic 
exchange of information, it must also be one that is ``not defined by'' 
a HIPAA standard or its implementation specifications in order to meet 
the definition of an operating rule. We consider a business rule or 
guideline that does not duplicate what is in the standard to be one 
that is not defined by the standard. Business rules and guidelines that 
duplicate what is in the standard are not operating rules under our 
interpretation.
    The National Committee on Vital and Health Statistics (NCVHS) is 
tasked with reviewing any operating rule developed and recommended to 
the Secretary for adoption. The NCVHS is to make recommendations to the 
Secretary and determine whether such operating rules represent a 
consensus view of the health care stakeholders and are consistent with 
and do not conflict with other

[[Page 40462]]

existing standards under section 1173(g)(3)(C) of the Act. The NCVHS 
must also determine if such operating rules are consistent with 
electronic standards adopted for health information technology under 
section 1173(g)(3)(D) of the Act. From these statutory provisions, we 
understand that operating rules should be consistent with and not be in 
conflict with the adopted HIPAA standards and HIT standards (for 
example, those standards that address governance, funding and 
infrastructure of controlled vocabularies, value sets and vocabulary 
subsets to be used primarily to further interoperability between 
providers and systems). We believe that, if an operating rule imposes a 
requirement that would make it impossible for a party to comply with 
both the associated HIPAA standard and the operating rule, then the 
operating rule conflicts with the standard. This interpretation is 
consistent with fundamental principles and precedents regarding when a 
conflict exists. If a party is able to satisfy both the requirements of 
the standard and the requirements of the operating rule, there is no 
conflict and the operating rule is consistent with the standard. Table 
2 illustrates what we consider to be a conflict by presenting 
hypothetical scenarios that illustrate when an operating rule could or 
could not conflict with a standard.

                           Table 2--Could an Operating Rule Conflict With a Standard?
----------------------------------------------------------------------------------------------------------------
                                                               Does the operating
                                        Statement in the        rule's statement
     Statement in the standard           operating rule         conflict with the           Justification
                                                              standard's statement?
----------------------------------------------------------------------------------------------------------------
``X is recommended.''..............  ``X is ``required.''..  No....................  It is possible for an
                                                                                      entity to comply with both
                                                                                      the standard and the
                                                                                      operating rule.
``X is not required.''.............  ``X is required.''....  No....................  It is possible for an
                                                                                      entity to comply with both
                                                                                      the standard and the
                                                                                      operating rule.
``X cannot be required.''..........  ``X is required.''....  Yes...................  It is impossible for an
                                                                                      entity to comply with both
                                                                                      the standard and the
                                                                                      operating rule.
``X is required.''.................  ``X is required.''....  No....................  It is possible for an
                                                                                      entity to comply with both
                                                                                      the standard and the
                                                                                      operating rule. (However,
                                                                                      to the extent that the
                                                                                      statement in the operating
                                                                                      rule duplicates the
                                                                                      statement in the standard,
                                                                                      the operating rule
                                                                                      statement would not be
                                                                                      considered an operating
                                                                                      rule.)
``X is at the discretion of person   ``X is required.''....  No....................  It is possible for an
 1. Person 2                                                        entity to comply with both
 cannot require it.''                                                                 the standard and the
                                                                                      operating rule.
``X is required.''.................  ``X is required, so is  No....................  It is possible for an
                                      Y.''.                                           entity to comply with both
                                                                                      the standard and the
                                                                                      operating rule.
``X is required. No other can be     ``X is required, so is  Yes...................  It is impossible for an
 required.''                          Y.''.                                           entity to comply with both
                                                                                      the standard and the
                                                                                      operating rule.
----------------------------------------------------------------------------------------------------------------

    Our current definition of standard at 45 CFR 160.103 is very broad. 
In fact, it is so broad that it could include operating rules as we are 
defining that term at Sec.  162.103. Therefore, we are revising the 
definition of standard at Sec.  160.103 to be clear that standards and 
operating rules are separate and distinct. See the ``Additional 
Requirements'' section for discussion of this change.

B. National Committee on Vital and Health Statistics and the Affordable 
Care Act

    The National Committee on Vital and Health Statistics (NCVHS) was 
established by Congress to serve as an advisory body to the Department 
of Health and Human Services (DHHS) on health data, statistics and 
national health information policy, and has been assigned a significant 
role in the Secretary's adoption of operating rules under section 
1173(g)(3) of the Act (as added by section 1104(b)(2) of the Affordable 
Care Act).
    In July 2010, the NCVHS' Subcommittee on Standards convened a 
hearing to discuss the Affordable Care Act's provisions pertaining to 
operating rules for the eligibility for a health plan and health care 
claim status transactions. Section 1173(g)(3) requires the NCVHS to do 
the following:
     Advise the Secretary whether a nonprofit entity meets the 
requirements for development of operating rules.
     Review the operating rules developed and recommended by 
such nonprofit entity.
     Determine whether such operating rules represent a 
consensus view of the health care stakeholders and are consistent with 
and do not conflict with other existing standards.
     Evaluate whether such operating rules are consistent with 
electronic standards adopted for health information technology.
     Submit to the Secretary a recommendation as to whether the 
Secretary should adopt such operating rules.
    The NCVHS engaged in a comprehensive review of health care 
operating rules and their authors, with the goal of determining whether 
an entity was qualified to develop operating rules for transactions and 
to evaluate existing operating rules for purposes of making a 
recommendation to the Secretary as to whether those operating rules 
should be adopted. The process consisted of a full day of public 
testimony on July 20, 2010, with participation by more than 20 
stakeholders representing a cross section of the health care industry, 
including health plans, provider organizations, health care 
clearinghouses, pharmacy industry representatives, health care industry 
associations, standards developers, professional associations, 
representatives of Federal and State health plans, the banking 
industry, and the entities proposing to serve as operating rules 
authoring entities.
    During the hearing, testifiers reiterated the need for greater 
consistency and standardization in HIPAA transactions consistent with 
the Affordable Care Act amendments to the HIPAA, which highlight the 
need to improve the use of standard transactions, increase industry 
adherence to the implementation specifications of the standards, 
encourage greater adoption of electronic transactions, and enable more 
timely

[[Page 40463]]

updates and adoption of the HIPAA standards. Testifiers claimed that 
all of these could help reduce the clerical burden on the industry in 
the use of paper and the non-standard use of the current transaction 
standards.
    We believe that the considerable public participation in the NCVHS 
hearings for adoption of operating rules demonstrates an increasing 
level of support and interest from broader segments of the health care 
industry. Per the NCVHS' recommendation, we will work with industry to 
continue this public exchange of information regarding operating rules, 
standards and their respective roles in administrative simplification.
    Based on the NCVHS testimony (https://www.ncvhs.hhs.gov/100719ag.htm) and the NCVHS' analysis of the operating rules and 
qualifications of the candidate authoring entities, the NCVHS developed 
a set of recommendations to the Secretary, which are outlined in the 
following discussions.

C. Operating Rules Authoring Entities

    Section 1173(g)(3)(A) of the Act charges the NCVHS with advising 
the Secretary as to whether a nonprofit entity meets the statutory 
requirements for developing the operating rules to be adopted by the 
Secretary. Those requirements, at section 1173(g)(2) of the Act, 
include all of the following:
     The entity focuses its mission on administrative 
simplification.
     The entity demonstrates a multi-stakeholder and consensus-
based process for development of operating rules, including 
representation by or participation from health plans, health care 
providers, vendors, relevant Federal agencies, and other standards 
development organizations.
     The entity has a public set of guiding principles that 
ensure the operating rules and process are open and transparent, and 
supports nondiscrimination and conflict of interest policies that 
demonstrate a commitment to open, fair, and nondiscriminatory 
practices.
     The entity builds on the transaction standards issued 
under the Health Insurance Portability and Accountability Act of 1996.
     The entity allows for public review and updates of its 
operating rules.
    Of those organizations testifying at the July 2010 NCVHS hearing, 
two organizations formally requested to be considered authoring 
entities for operating rules. These entities were the Council for 
Affordable Quality Healthcare's (CAQH) Committee on Operating Rules for 
Information Exchange (CORE) and the National Council for Prescription 
Drug Programs (NCPDP).
    The CAQH, a nonprofit alliance of health plans and trade 
associations, supports industry collaboration on initiatives that 
simplify health care administration (https://www.caqh.org/about.php). 
The CAQH launched the CORE with the goal of giving providers access to 
eligibility and benefits information before or at the time of service. 
The CAQH CORE is engaged in the development of voluntary operating 
rules for the facilitation of administrative health care transactions. 
It has already developed operating rules for the eligibility for a 
health plan and health care claim status transactions. The CAQH CORE 
has also demonstrated that the use of these rules yields a return on 
investment for both business operations and systems within today's 
complex health care environment (https://www.caqh.org/COREIBMstudy.php).
    The NCPDP is a not-for-profit standards development organization 
(SDO) accredited by the American National Standards Institute (ANSI), 
with over 1,500 members representing the pharmacy services industry 
(https://ncpdp.org/WP.aspx). It is one of several SDOs involved in 
health care information technology and standardization, with a focus on 
retail pharmacy services, and has member representation from the 
pharmacy services sector of health care (https://ncpdp.org/about.aspx). 
The operating rules the NCPDP brought forth to NCVHS focus on the 
retail-pharmacy sector.
    The July 2010 NCVHS hearings were followed by a request from the 
NCVHS Subcommittee on Standards to both the CAQH CORE and the NCPDP as 
authoring entity candidates, to respond to detailed questionnaires 
about their ability to meet the statutory requirements of the 
Affordable Care Act as authoring entities for health care operating 
rules. The NCVHS request solicited specific documentation from the two 
candidates to validate their previous testimony, including minutes, 
voting records and copies of bylaws. Both the CAQH CORE and the NCPDP 
responded to the Subcommittee's request and submitted their respective 
applicable materials. A synopsis of the candidates' responses can be 
found on the Internet at https://www.ncvhs.hhs.gov/100930lt2.pdf.
    Upon review of the CAQH CORE's and the NCPDP's respective responses 
to the NCVHS questionnaire, the NCVHS determined that both 
organizations met the statutory requirements to be an operating rules 
authoring entity. The NCVHS noted, however, that there are still 
adjustments to process and procedures that may be required of both 
organizations to enhance transparency, citing the need for more 
formalized relations with each other and with other SDOs, inclusion of 
a more diverse cadre of stakeholders, and a more formal public review 
process. Both the CAQH CORE and the NCPDP acknowledged these issues in 
their submitted responses to the NCVHS (https://www.ncvhs.hhs.gov/100930lt2.pdf).
    The NCVHS advised the Secretary in its letter dated September 30, 
2010, (https://www.ncvhs.hhs.gov/100930lt2.pdf) that the CAQH CORE meets 
the requirements of section 1173(g)(2) of the Act to be the operating 
rules authoring entity for the non-retail pharmacy-related eligibility 
for a health plan and health care claim status standard transactions 
with additional qualifying requirements. In the same letter, the NCVHS 
stated that the NCPDP met the requirements to be the authoring entity 
for operating rules for retail pharmacy-related eligibility 
transactions (as outlined in the Telecommunications Standard 
Implementation Guide Version D.0) also with additional qualifying 
requirements. Those requirements for both the CAQH CORE and the NCPDP 
are as follows:
     Require authoring entities to maintain minutes, 
attendance, voting records, and other appropriate documentation that 
will help the NCVHS conduct verification that the authoring entities 
have utilized an open, consensus-driven process with broad stakeholder 
participation and provided an opportunity for public comment in 
authoring any new operating rules or new versions of existing operating 
rules, consistent with such processes followed by ANSI-accredited 
standards development organizations.
     Continue to use the NCVHS and its open process to 
evaluate, select, and recommend any new qualifying operating rules 
authoring entities when it comes time to adopt operating rules for 
other transactions, or for newer versions of the operating rules for 
the transactions for which the CAQH CORE and the NCPDP are being 
recommended to be named authoring entities at this time.
    After our own review and analysis of the CAQH CORE and the NCPDP 
applications for consideration to be authoring entities for their 
respective developed operating rules, and the NCVHS' recommendation, we 
have determined that the CAQH CORE is qualified to be the operating 
rules authoring entity for non-retail

[[Page 40464]]

pharmacy-related eligibility for a health plan and health care claim 
status standard transactions per section 1173(g)(2) of the Act.
    At the time of the hearing, the NCVHS based its recommendation to 
appoint the NCPDP as an operating rules authoring entity on the 
testimony presented. However, upon further review and consultation, we 
have determined that the NCPDP's standard provides enough detail and 
clarity to operationalize the standards to the point where no gaps 
exist that operating rules would need to fill and no further 
infrastructure or data content rules need to be adopted. (For a more 
detailed discussion, see section III. of this interim final rule with 
comment period).

D. Adoption of Operating Rules

1. Adoption of the CAQH CORE Phase I and Phase II Operating Rules for 
the Non-Retail Pharmacy Eligibility for a Health Plan and Health Care 
Claim Status Transactions (Updated for Version 5010)
    The CAQH CORE builds consensus among health care industry 
stakeholders on a set of operating rules that facilitate administrative 
interoperability between health plans and providers by building on 
applicable HIPAA transaction requirements, enabling providers to submit 
transactions from any system, and facilitating administrative and 
clinical data integration. The CAQH CORE uses a phased approach for 
developing operating rules. This approach allows for developing rules 
and implementing them via incremental, achievable milestones, and helps 
to maximize rule adoption. The CAQH CORE Phase I operating rules were 
developed in 2006 and focused on the eligibility for a health plan 
transaction. The CAQH CORE Phase II rules, developed in 2008, added 
operating rules for the health care claim status transaction, and more 
rules for the eligibility for a health plan transaction that were not 
included in Phase I. Both the CAQH CORE Phase I and Phase II operating 
rules were updated to accommodate the Version 5010 HIPAA standards, 
which were adopted by the Secretary via the final rule published in the 
Federal Register on January 16, 2009 (74 FR 3296) and with which HIPAA 
covered entities must be compliant on January 1, 2012.
    The CAQH CORE operating rules (updated for Version 5010) include 
both infrastructure rules and data content rules. The infrastructure 
rules help improve data content flow between provider and payer. They 
improve interoperability by addressing all of the following:
     Connectivity--provide a uniform way for stakeholders to 
connect (through the Internet).
     Response Times--specify that information will be available 
in real time.
     System Availability--specify systems delivering 
information be available a certain amount of time.
     Patient Identification--help assure patient matching/
identification can occur.
    The CAQH CORE's first set of operating rules (updated for Version 
5010) are Phase I rules for eligibility for a health plan transaction. 
They help electronically confirm patient benefit coverage, copay, 
coinsurance, and base deductible. In addition, through requirements to 
use common Internet protocols, they allow providers to access needed 
patient information prior to or at the point of care. The CAQH CORE's 
second set of operating rules (updated for Version 5010) are the Phase 
II rules for the eligibility for a health plan and health care claim 
status transactions. They expand on the first set by adding a 
requirement for transaction recipients to send back patient remaining 
deductible amounts, rules to improve patient matching, health care 
claim status infrastructure requirements (for example, response time) 
and more prescriptive connectivity requirements.
    We have examined each of the CAQH CORE Phase I and Phase II 
operating rules and are adopting those that we believe further enhance 
the HIPAA transactions by better facilitating communication between 
trading partners, including providers, filling gaps in the associated 
standards, and fulfilling the requirements, purposes, and principles 
set out in the statute at sections 1173(a)(4)(A)(i through iv) and (B). 
Of the eight CAQH CORE Phase I operating rules (updated for Version 
5010), we are adopting the following six:
     Phase I CORE 152: Eligibility and Benefit Real Time 
Companion Guide Rule, version 1.1.0, March 2011, and CORE Version 5010 
Master Companion Guide Template, 005010, 1.2, March 2011.
     Phase I CORE 153: Eligibility and Benefits Connectivity 
Rule, version 1.1.0, March 2011.
     Phase I CORE 154: Eligibility and Benefits 270/271 Data 
Content Rule, version 1.1.0, March 2011.
     Phase I CORE 155: Eligibility and Benefits Batch Response 
Time Rule, version 1.1.0, March 2011.
     Phase I CORE 156: Eligibility and Benefits Real Time 
Response Time Rule, version 1.1.0, March 2011.
     Phase I CORE 157: Eligibility and Benefits System 
Availability Rule, version 1.1.0, March 2011.
    We are adopting all five of the CAQH CORE Phase II operating rules 
(updated for Version 5010). They include the following:
     Phase II CORE 250: Claim Status Rule, version 2.1.0, March 
2011, and CORE Version 5010 Master Companion Guide Template, 005010, 
1.2, March 2011.
     Phase II CORE 258: Eligibility and Benefits 270/271 
Normalizing Patient Last Name Rule, version 2.1.0, March 2011.
     Phase II CORE 259: Eligibility and Benefits 270/271 AAA 
Error Code Reporting Rule, version 2.1.0, March 2011.
     Phase II CORE 260: Eligibility & Benefits Data Content 
(270/271) Rule, version 2.1.0, March 2011.
     Phase II CORE 270: Connectivity Rule, version 2.2.0, March 
2011.
    Both the CAQH CORE Phase I and Phase II operating rules (updated 
for Version 5010) that we are adopting in this interim final rule with 
comment period can be found on the CAQH CORE Web site at https://www.caqh.org/COREVersion5010.php. Below we briefly describe those 
operating rules.
    The Phase I CORE 152: Eligibility and Benefit Real Time Companion 
Guide Rule (updated for Version 5010) and CORE Version 5010 Master 
Companion Guide Template provide a standardized format for health plan 
companion guides. As mentioned previously, health plans have the option 
of creating a companion guide that describes the specifics of how they 
implement the HIPAA transactions. Currently, health plans have 
independently created companion guides that vary in format and 
structure, which can be confusing to trading partners, including 
providers, and providers who must review numerous companion guides 
along with the Version 5010 Implementation Guides. To address this 
issue, the CAQH CORE developed the CORE Version 5010 Master Companion 
Guide Template to ensure that the structure of each health plan's 
companion guide is similar to every other health plan's companion 
guide, making it easier for providers to find information quickly.
    Developed with input from multiple health plans, system vendors, 
provider representatives and healthcare and HIPAA industry experts, the 
CAQH CORE template organizes information into several sections 
including, general information (sections 1 through 9) and

[[Page 40465]]

transaction-specific information (section 10), as well as appendices 
that provide helpful information, such as an information checklist, 
descriptions of typical business scenarios, transmission examples, 
FAQs, and a summary of the changes between companion guides. The CAQH 
CORE recognizes that different health plans may have different 
requirements, so the CORE v5010 Master Companion Guide Template gives 
health plans the flexibility to tailor companion guides to meet each of 
their own particular needs.
    The Phase I CORE 153: Eligibility and Benefits Connectivity Rule 
(updated for Version 5010) addresses usage patterns for both batch and 
real time transactions, the exchange of security identifiers, and 
communications-level errors and acknowledgements. It does not define 
the specific content of the message.
    Currently, multiple connectivity methods, some based on open 
standards, others on proprietary approaches, are in use for 
administrative electronic transactions in the health care industry. 
Health care providers and health plans support multiple connectivity 
methods to connect to different health plans, clearinghouses, provider 
organizations and others, which add costs for health plans and 
providers. This rule is designed to provide a ``safe harbor'' that 
providers and health plans can be assured will be supported by any 
trading partner, including providers. Safe harbors are essentially 
connectivity requirements. When trading partners including providers, 
agree to follow the same connectivity requirements, connectivity is 
better enabled. This rule is not intended to require trading partners, 
including providers, to remove existing connections that do not match 
the rule, nor is it intended to require that all trading partners, 
including providers, must use this method for all new connections. It 
is expected that some trading partners, including providers, may agree 
to use different communication mechanism(s) and/or security 
requirements than that described by this rule. The rule simply provides 
a secure connection for those entities that do not currently have one.
    The Phase I CORE 154: Eligibility and Benefits 270/271 Data Content 
Rule (updated for Version 5010) provides more robust and consistent 
information prior to or at the point of care. It specifies the minimum 
requirements for using the ASC X12 005010X279A1 Eligibility Benefit 
Request and Response (270/271) to inquire about health plan insurance 
coverage and to respond to such an inquiry using the ASC X12 
005010X279A1 Eligibility Benefit Request and Response (270/271). The 
requirements address certain situational elements and codes and are in 
addition to requirements contained in the Version 5010 270/271 
implementation guides. This rule provides for not only determination of 
an individual's eligibility but also his financial responsibility 
information for co-pay, deductible, and coinsurance prior to or at the 
point of care. This rule covers, for example, the following content in 
the Version 5010 271:
     The dates of eligibility under the health plan (contract) 
level for past and future dates and the dates of eligibility at the 
benefit level if different from the contract level.
     The patient financial responsibility for each specified 
benefit at the base contract amounts for both in-network and out-of-
network.
     The name of the health plan when it exists in the health 
plan's system.
    Compliance with the requirements of this operating rule will 
ultimately reduce the time it takes providers to track down such 
information after the service has been rendered, and decrease the 
provider's accounts receivable.
    The Phase I CORE 155 and 156: Eligibility and Benefits Batch 
Response and Real Time Response Rules (updated for Version 5010) 
streamline and improve the flow of transactions by imposing timeframe 
requirements for when a response is to be submitted for an eligibility 
for a health plan inquiry.
    For a Version 5010 270 batch mode response to a provider's inquiry 
submitted by 9:00 pm Eastern time of a business day, the response must 
be returned by 7:00 am Eastern time the following business day. The 
maximum response time when processing in real time mode must be 20 
seconds or less.
    The Phase I CORE 157: Eligibility and Benefits System Availability 
Rule (updated for Version 5010) also streamlines and improves the flow 
of transactions. It recognizes that many institutional providers need 
to be able to conduct health plan eligibility activities at any time. 
It also recognizes that health plans have a business need to take their 
eligibility and other systems offline periodically in order to perform 
system maintenance, which means that some systems will not be available 
for eligibility inquiries and responses on certain nights and weekends. 
The rule requires that systems be available to process eligibility 
inquiries no less than 86 percent of the time per calendar week for 
real and batch modes, and requires health plans to publish regularly 
scheduled downtime. It ensures that systems are up and running in a 
consistent manner and that trading partners, including providers, are 
aware of any downtime so they can plan accordingly.
    The Phase II CORE 250: Claim Status Rule (updated for Version 5010) 
encourages and increases the use of the health care claim status 
transaction by providing for batch and real-time response times, system 
availability, the use of a companion guide template, and support for 
the CORE ``safe harbor'' connectivity requirement. These elements 
included in the CORE 250 rule follow the same requirements as and build 
upon the same requirements as for the eligibility for a health plan 
transaction infrastructure rules included in Phase I CORE 152, Phase I 
CORE 155, Phase I CORE 156 and Phase I CORE 157 rules we are adopting 
in this interim final rule with comment period. This means that Phase 
II CORE 250 rule (updated for Version 5010) requires each health plan 
to: follow the companion guide format requirement as provided in CORE 
152, which is the CORE Version 5010 Master Companion Guide Template; 
support the CORE ``safe harbor'' connectivity requirements; support a 
maximum response time of 20 seconds from the time of submission of a 
Version 5010 276 for real time and for batch mode response to a 
provider's inquiry submitted by 9 p.m. Eastern time of a business day, 
the response must be returned by 7 a.m. Eastern time the following 
business day; ensure system availability of no less than 86 percent per 
calendar week for both real time and batch modes; and follow the 
companion guide format requirement as provided in CORE 152, which is 
the CORE v5010 Master Companion Guide Template.
    The CORE 258: Eligibility and Benefits 270/271 Normalizing Patient 
Last Name Rule (updated for Version 5010). Health plans and health care 
providers must be able to uniquely identify patients in order to 
ascertain patient eligibility. Although the Version 5010 270/271 
standards specify data elements and data element attributes that may be 
used to identify an individual, the standards do not address the use of 
punctuation and special characters. Therefore, the way health plans 
identify individuals does not always match the way providers identify 
individuals, which results in the rejection or denial of eligibility 
transactions. The CAQH CORE 258 rule addresses certain aspects of 
individual identification that enhance the real time processing of 
eligibility inquiries and responses.
    The Phase II CORE 259: Eligibility and Benefits 270/271 AAA Error 
Code

[[Page 40466]]

Reporting Rule (updated for Version 5010) provides consistent and 
specific patient identification information on reasons for patient 
identification errors on an eligibility for a health plan inquiry. This 
allows providers to know specifically why they did not receive a match 
in an eligibility for a health plan inquiry, instead of trying to 
determine for themselves the reasons for the error and what corrective 
action is needed. This rule improves the specificity and standardized 
use of the AAA codes that would give providers better feedback to 
understand what information is missing or incorrect in order to obtain 
a valid match. It defines a standard way for health plans to report 
errors in the eligibility response that cause a health plan not to be 
able to respond with a Version 5010 271 showing eligibility information 
for the requested patient or subscriber. The goal is to use a unique 
error code wherever possible for a given error condition so that the 
re-use of the same error code is minimized. Where this is not possible, 
the goal (when re-using an error code) is to return a unique 
combination of one or more AAA segments along with one or more of the 
submitted patient identifying data elements such that the provider will 
be able to determine as precisely as possible what data elements are in 
error and take the appropriate corrective action.
    The Phase II CORE 260: Eligibility & Benefits Data Content (270/
271) Rule (updated for Version 5010) builds on and enhances the Phase I 
CORE 154: Eligibility and Benefits 270/271 Data Content Rule (updated 
for Version 5010) by requiring the provision in the eligibility 
response of the remaining patient deductible amounts for certain 
service type codes. The use of this rule further reduces the time it 
takes to track down this information manually or eliminates the time 
completely after the service has been rendered and decreases the 
provider's accounts receivable.
    The CAQH CORE determined that Phase I CORE rules should focus on 
improving electronic eligibility and benefits verification, as 
eligibility is the first transaction in the claims process. Thus, if 
eligibility and benefits are accurately known to health care providers, 
all the associated electronic transactions that follow will be more 
effective and efficient. The Phase I CORE 154: Eligibility and Benefits 
270/271 Data Conte