Recommendation Letter-HHS Actions to Improve the Adoption of Standards Under HIPAA-December 10, 2019

NCVHS

National Committee on Vital and Health Statistics

The Honorable Alex M. Azar II

Secretary

Department of Health and Human Services

200 Independence Avenue, S.W.

Washington, D.C. 20201

December 10, 2019

Re: Additional recommendations for HHS actions to improve the adoption of standards

under the Health Insurance Portability and Accountability Act (HIPAA) of 1996

Dear Secretary Azar:

This letter conveys three critically important recommendations for HHS action to fix systemic

deficiencies and modernize the processes by which electronic standard transactions

are

adopted under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

The

National Committee on Vital and Health Statistics (NCVHS), your advisory committee on health

data, statistics, privacy, and national health information policy, conveys these

recommendations in follow up to our letter dated February 13, 2019:

Recommendation 1: Provide guidance on data needed to support adoption of

standards.

Recommendation 2: Secure support for testing and evaluation of standards and

operating rules prior to adoption.

Recommendation 3: Facilitate a more nimble approach to standards development to

better support federal policy objectives, industry business requirements and emerging

technologies.

Industry stakeholders emphatically asked the Committee to “do something and do something

now” to speed the availability of updated standards for their use. After more than a decade of

these discussions and industry input, NCVHS urges the Secretary to address the process

barriers, inefficiencies, and lack of transparency in a system that was designed in 1996, which

no longer adequately achieves its mission under HIPAA to ensure efficiencies in health care

Administrative and financial transactions.

The original HIPAA legislation (P.L. 104-191).

Letter to the HHS Secretary: “NCVHS Recommendations on New Approaches to Improve the Adoption of National Standards

for the Health Care Industry,” February 13, 2019.

National Committee on Vital and Health Statistics Page 1 of 6

administrative transactions. Additionally, such antiquated processes fail to support new post-

HIPAA HHS priorities for interoperability and burden reduction.

The Committee’s new recommendations result from our July 2019 visioning session with

industry stakeholders.

Invited participants re-emphasized to the Committee that the delays in

timely adoption of updated and new standards are precluding the health care industry from

taking action on critical services, such as getting patients’ prescriptions filled, reducing delays

and burden on prior authorizations, and eliminating paperwork related to claims attachments.

During the July meeting, a broader discussion ensued of the factors that continue to contribute

to undue delays in the adoption of updated or new standards.

Industry consensus was vocal

and strong about the damage being done by the lengthiness and unpredictability of the current

HIPAA rule promulgation process.

These delays significantly impact our citizens: higher costs, delayed services and documented

adverse impacts, including unnecessary hospitalizations and, in extreme cases, even death.

These longstanding delays directly prevent HIPAA-covered entities – providers, payers and

clearinghouses, and their trading partners – from meeting evolving business needs.

If the status quo is maintained and standards are not updated, covered entities have no

recourse but to implement manual workarounds. Manual processes are entirely counter to

HIPAA’s efficiency objectives and to the Secretary’s initiatives for burden reduction,

interoperability and innovation.

The Committee’s earlier findings, outlined in our February 13, 2019 letter regarding progress

achieved, and barriers remaining to standards adoption, are unequivocally validated by

stakeholders. These findings are summarized here, followed by an explanation of the new

recommendations.

Summary of Findings. Based on the Committee’s collaboration with industry stakeholders,

including impacted federal agencies, we have consolidated the key issues into three areas that

continue to affect the predictable adoption and implementation of national standards for the

exchange of health information:

• Finding 1: HHS rulemaking (publication of a regulation) is a prerequisite to industry’s use

of updated national standards. Industry is hesitant to make financial and operational

investments to test or use an updated or new standard without a federal mandate.

Thus, the entirety of the rulemaking process is an essential step for moving updated and

new standards forward. However, the current pathway for HIPAA-related rulemaking is

not meeting the needs of the U.S. healthcare industry (HIPAA covered entities) or

Visioning Session to Re-evaluate the Designated Standards Maintenance Organization (DSMO): Meeting Summary, July 10-11,

2019: https://ncvhs.hhs.gov/2019-July-Meeting-Summary

This includes the implementation guides for standards as well as operating rules.

AMA testimony presented to NCVHS November, 13, 2019: https://ncvhs.hhs.gov/wp-content/uploads/2019/12/Presentation-

Prior-Authorization-AMA-Update-Heather-McComas.pdf

National Committee on Vital and Health Statistics Page 2 of 6

federal policy objectives (around efficiency, effectiveness, and reductions of burden)

and should be procedurally optimized.

• Finding 2: The adoption of updated HIPAA standards must come more frequently, more

predictably, more reliably, and in smaller more easily assimilated sets. Furthermore,

these sets of standards

need to include a value proposition to support their adoption.

It is understood that HHS needs quantitative and qualitative data from the standards

development organizations (SDOs) and operating rule authoring entities (ORAEs) about

the testing results from use cases, expected benefits, and return on investment to

include in the impact analyses of its regulations in order to successfully complete the

proposed and final rulemaking process.

• Finding 3: End-users of the standards, especially but not limited to small clinician

offices, small health plans, and state and local public health agencies, do not have the

economies of scale necessary to participate directly in the current SDO/ORAE processes

for standards development. Under the current format, small entities are not heard from

until HHS publishes a Notice of Proposed Rulemaking in the Federal Register, which is

much too late for inclusion in the standards development process. Input from such

entities and specialty industry segments is important and needs to start with the

SDOs/ORAEs during the initiation of requests for development through fitness-for-

purpose testing of new standards. The value of national standards accrues to all

covered entities, but the current system of voluntary and self-funded participation in

development and testing of new standards has proven insufficient and unreliable over

time, with its inherent tendency to default to larger organizations needs and agendas.

In the Committee’s assessment, HHS action on these recommendations would significantly

improve the standards development process, resulting in a less time- and resource-intensive

HHS process to publish regulations. This would also benefit the health care industry by

enabling greater innovation through availability of updated standards on a timelier, more

predictable basis, i.e., knowing when tested standards would be adopted.

Rationale for NCVHS’s Recommendations

Recommendation 1: Provide guidance on data needed to support adoption of standards. The

HHS Secretary should develop and publicize its review criteria for updated or new standards

that national standards and operating rule products should meet to comply with the principles

of HIPAA and support federal rulemaking requirements. In other words, HHS would instruct the

Division of National Standards (DNS) to provide to the SDOs and ORAEs a table of the data and

information that DNS routinely needs to support its drafting of an NPRM, including its impact

analysis. With such guidance, the standards organizations and industry could build meaningful

research and analysis into its development cycle. Processes to capture and compile information

during development and testing phases of updated standards and operating rules could be

implemented and/or improved. Information would be included in recommendations brought

This includes products from both standards development organizations and operating rule-authoring entities.

National Committee on Vital and Health Statistics Page 3 of 6

forward through the Designated Standards Maintenance Organizations (DSMOs) and NCVHS’s

processes that lead to adoption considerations sent to the Secretary. Specifically, these

published requirements should be those necessary to support HHS’s needs for the regulatory

process, to justify adoption of an updated standard or operating rule, in accordance with the

ten principles of HIPAA (Attachment 1).

Based on conversations with HHS, the Committee understands that providing such specific

information to support the regulatory impact analysis for the regulations could mitigate one of

the major challenges HHS faces in advancing rules to adopt standards. Publication of the

requirements and clarity on data needed enables the SDOs and ORAE to engage work group

participants and obtain data longitudinally, before the DSMOs submit a recommendation to

NCVHS.

Recommendation 2: Secure support for testing and evaluation of standards and operating

rules prior to adoption. HHS should begin the process of identifying a neutral funding stream

to support the testing of administrative standards to enable the detailed evaluation of value

and return on investment prior to any recommendation for their adoption as a U.S. healthcare

standard. This funding stream would support a testing and proving ground for standards,

specifically to assess the readiness for national adoption of administrative and financial

transactions as well as interoperability with emerging clinical standards. The trend towards

interoperability is creating complexities in the transactional processes for the health care

industry, and the infrastructure should be examined more holistically.

One area for consideration by HHS may be the designation of funds to support testing of the

end- to-end processes. Investing in a comprehensive testing approach enables full validation of

capabilities in the evolving health data ecosystem. This would address the increased need for

quantitative and qualitative data, to prove the value of new or updated standards, and support

the rulemaking process to adopt those standards. Funding would support pilot projects, which

include vendors, providers, health plans, test environments, and other relevant players. Results

would be shareable and transparent.

The advancements in technology necessitate a safety net for willing-trading-partner testing and

demonstration projects (including production use) of new versions of adopted standards,

emerging standards, and innovative alternatives to existing information exchange methods,

thus HHS support for such testing is an important signal. This recommendation is connected to

the first one, pertaining to HHS transparency of its requirements for quantitative and

qualitative data from the standards organizations when they make recommendations for

adopting updated standards or operating rules.

Recommendation 3: Facilitate a more nimble approach to standards development to better

support federal policy objectives, industry business requirements and emerging technologies.

a. HHS should engage in regular communication with the SDOs and ORAEs to support

their efforts to develop smaller, incremental, and more frequent publications of

standards and operating rules. HHS could support the standards organizations as

National Committee on Vital and Health Statistics Page 4 of 6

they create more sustainable and dependable processes to update, review and

promulgate incremental updates to the standards and operating rules for

consideration for adoption. Such improvements would provide industry with a more

predictable schedule for implementation planning and budgeting. HHS may need to

tailor its efforts to the needs of each standards organization, based on current plans

and processes.

b. HHS should engage a broader base of industry end users to evaluate HIPAA-eligible

product updates before they are finalized by the SDO or the ORAE. Such

organizations would include small providers – or their vendor representatives – state

and local public health agencies, and small health plans, which are typically absent

from the standards development processes. These organizations often do not have

the resources to represent their needs and perspectives effectively, yet they are

impacted by changes to the standards and operating rules and their input should be

sought and addressed.

Thank you for consideration of these recommendations. In this rapidly changing health data

ecosystem, NCVHS supports HHS’s proactive efforts to increase the rate and predictability of

adoption of updated standards, implementation guides, and operating rules. The Committee is

available to provide additional assistance and advice as needed.

Sincerely,

/s/

William W. Stead, M.D., Chair

National Committee on Vital and Health Statistics

CC: HHS Data Council Co-Chairs

Attachment

National Committee on Vital and Health Statistics Page 5 of 6

ATTACHMENT

HIPAA Principles

1. Lead to cost reductions through efficiency and effectiveness.

2. Meet the needs of the health data standards user community.

3. Be uniform/consistent with other adopted standards.

4. Have low development costs relative to the benefits of using the standards.

5. Be supported by ANSI accredited

Standard Setting Organization (SSO) or other

organization that would maintain the standard over time.

6. Have timely development testing, implementation and updating procedures to achieve

administrative simplification benefits faster.

7. Be technically independent of the computer platforms and transmission protocols used

in electronic transactions unless explicitly part of the standard.

8. Be precise, unambiguous and as simple as possible.

9. Result in minimum data collection and paper work burdens.

10. Incorporate flexibility to adapt more easily to changes in health care infrastructure (e.g.

new services, organizations and provider types).

Source of the HIPAA Principles is from the May 7, 1998 Proposed Rule 63 FR 25274 Health Insurance Reform: Standards for

Electronic Transactions: https://www.federalregister.gov/documents/1998/05/07/98-11691/health-insurance-reform-

standards-for-electronic-transactions

ANSI is the Accredited National Standards Institute oversees the development of voluntary consensus standards for products,

services, processes, systems and personnel in the United States: www.ANSI.org

National Committee on Vital and Health Statistics Page 6 of 6