[ Friday, March 22, 2002 ]
A brief history of HIPAA: Portability’s important. HIPAA originally related to insurance portability. Senators Kennedy and Kassebaum thought it would be a good idea (and politically attractive) if people could go from job to job and not have to worry about losing their health insurance. Whether it’s an intentional result or just an historical anomaly, most people get their health insurance from their employer. And when you leave an employer and join another, you leave an insurer and join another. That would be just fine if it weren’t for the concept of pre-existing conditions.
Insurance companies don’t make money from paying claims; they make money from collecting premiums and not paying claims. That’s not an indictment, it’s just a fact. If an insurance company pays out too much, it either goes out of business or it has to raise premiums. Look at it this way: there must be enough money going into the system in the form of premiums to pay for all the care the insurer will be expected to pay, plus the insurer’s overhead, plus a profit to the insurer, or there won’t be any insurers. If the average annual premium is less than the average annual cost of healthcare (remember, that’s averaging in the folks who have million-dollar liver transplants and other catastrophes), there won’t be enough money to pay for the care needed. The money has to come from somewhere. There’s no Santa Claus, and everyone who says that there’s a universal entitlement to health care hasn’t yet figured out who is going to pay for it.
So what can an insurance company do to limit the amount it pays out? It can do its best not to pay providers (hospitals and doctors), or it can try to keep from insuring people who will need lots of care. An insurer can only do so much to keep track of the actual individuals it’s covering, if it’s primary customers are employers rather than individuals. Pre-existing conditions are one of the ways insurers can reduce their risk. If you have a pre-existing condition (in other words, if you’ve already proven that you will need lots of care), an insurer will exclude you.
Shouldn’t the insurer be able to refuse to provide insurance to purchasers who the insurer knows will be a bad deal for it? What would prevent a person from going without insurance until they got sick, then buying insurance only when they knew they’d take more money out of the system than they put in? There’s a clear incentive to be a “freerider:” just buy insurance when you know you’re going to have lots of healthcare expenses, and don’t when you’re healthy. That’s good for the subscriber, but again, where is the insurance company going to get the money if this is allowed?
But on the other hand, what if you’ve been a good insurance purchaser: you’ve played the game the right way, bought insurance (through your employer) in good times (i.e., when you’re healthy and the insurance company makes money off of you), and you need it now that you’re in bad health and have a pre-existing condition. If you change jobs, your new employer’s insurer won’t cover you – you’ve got a pre-existing condition. So you’re stuck in your old job, and you just can’t afford to leave. Worse yet, what if your existing employer goes out of business?
Kennedy-Kassebaum was touted to take care of this. If you’re a good egg and play the game right (that is, you buy insurance when you’re supposed to), then if you leave a job you can’t be kept from buying insurance with your new job because of a pre-existing condition. It keeps people from being “job-locked” due to the unavailability of insurance, but it doesn’t reward “freeriders” who pocket their premium dollars when they’re healthy and expect to get insurance when they are in bad health and need it. That’s what the “P” in HIPAA represents: portability.
Adding on: Medical Record Privacy. While HIPAA was getting talked up on Capitol Hill, there were some other folks who saw some other healthcare issues they’d like to get addressed, and saw HIPAA as a fairly unstoppable vehicle for getting what they wanted.
Now, those folks (primarily a group out of Georgetown University known as the Georgetown Health Privacy Project) had a real issue to promote: the internet, and the storage and transmission of medical record information on remotely-accessible servers, changed the risk level of unauthorized access to private medical record information. Let’s assume that there’s likely to be some information in your medical record that you’d rather not be made generally available to the public. In the old days, your medical records were in a file cabinet in your doctor’s office. If someone wanted to see what was in there, they would have to break into the doctor’s office, rifle through the file cabinets until they found your records, then take what they wanted. It would be hard not to leave behind evidence that the files had been taken or looked at, even if copies were made and taken rather than the records themselves.
However, with the internet and the ability to store, transfer, and access medical records in electronic form, the risk of unauthorized access and ability of the wrong people to access records is greatly increased. A hacker can access and get copies of many, many records in a very short time, and leave little evidence that he’s been there. He could download many records and look through them at his leisure later, or search them looking for specific information without having to pour through pages of paper records or wade through useless information. He could also alter records without leaving behind evidence that he’d been there.
There’s also the issue of medical records being used in new ways related to marketing. With the rise in advertising by drug companies, along with a few high-profile news stories about pharmacies selling lists of patients using a particular drug to the manufacturer of a different drug, the Georgetown folks saw another threat to the general public. Apparently the Georgetown folks are most upset that someone is making money from this information or target-marketing. They are also concerned that medical record information might be used for other purposes: a banker sitting on a hospital board might find out that some of his mortgagers are deathly ill and call their mortgages.
Because of these real and imagined concerns, these lobbyists managed to convince the lawmakers to include in the HIPAA statute requirements relating to medical record privacy and security. These provisions were put in the perversely named Title II of HIPAA, known as the “Administrative Simplification” provisions. Now, actually, Congress required itself to come up with medical record privacy standards within 2 years of the passage of HIPAA, but said that if we don’t do it by statute, the Department of Health and Human Services needed to do it by regulation. As you might guess, Congress didn’t do it, so HHS had to.
Who is covered. The administrative simplification provisions of HIPAA impact only the people identified as “covered entities.” These are providers (doctors, hospitals, dentists, pharmacists, others who provide health care to patients), health plans (insurers and self-insured plans – this comes into play later), and “clearinghouses” (entities such as billing companies that translate information from standard format into nonstandard format and vice-versa). The regulations specifically state that “employers” are not covered entities under HIPAA, which is technically true. However, any employer that has a self-insured plan (with a few potential but unrealistic exceptions) is not technically a covered entity, but that employer’s plan is. Normally, the plans aren’t really separate legal entities, but are sort of like trusts. So, if you run a company and have a self-insured plan, you aren’t a covered entity but your health plan is, so effectively you still have to comply.
The Concept of Scalability. These regulations are designed with “scalability” in mind. That is, they are designed to be applicable as written for any size of covered entity, from the largest insurance company to a single-physician medical practice. There are no hard-and-fast rules regarding exactly what you need to do to comply; what a big entity needs to do will be much greater than what a small entity would need to do. An entity with many employees will need to have different training programs, for example, than an entity with only one or two. Scalability makes for simple regulations, but makes for lots of confusion regarding exactly what is required to be in compliance.
The Good, the Bad, and the Ugly. In the Administrative Simplification title of HIPAA, there are 3 primary components: the data set requirements, the privacy requirements, and the security requirements. The data set requirements are designed to take each instance in the health care industry where information is passed from one person to another (such as a provider submitting a bill to a payer for payment, or seeking the status of a claim, or confirming that a person is covered by an insurer) and setting standards for the information, both in content and format. Instead of every insurer having its own forms, everyone will use the same form. Instead of one person including one set of information on claims forms and another including different information (or the same information in a different format), the data set rules are designed to get everyone using the same forms. This should result in savings to the industry, since providers and payers will be able to get rid of staff that currently do nothing but convert information from one format into another. The data set regulations were issued in final form in October 2000, and are enforceable commencing in October 2002 (unless you request a one-year extension). That is the good part of administrative simplification.
The other 2 components are privacy and security. I go back and forth on which is bad and which is ugly. Basically, the privacy rules relate to how providers, plans and clearinghouses can use individually identifiable health information. Covered entities need to have consent of the patient to use or disclose the information for usual healthcare purposes, and must have specific authorization to use the information for anything else like marketing. Covered entities must also have a notice of information practices that they give to patients and abide by, and must give patients certain rights to view, seek amendments to, and have an accounting of disclosures of (and request restrictions on disclosures of) their information. Privacy basically relates to how you keep and use the information. The privacy regulations were issued in final form in April 2001 and are enforceable commencing in April 2003.
Security relates more to the technical requirements and methods of protecting individually identifiable health information. How your computer network is set up, where your monitors are, passwords, screen savers, access limits, encryption: there are the realm of security. The security regulations have not yet been drafted in final form. There will also be a 2-year implementation for these regs when they are finally drafted in final form.
More background to come. Then we'll discuss current development, including yesterday's minor retrenchment.
Jeff [10:32 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
