CMS proposes HIPAA rule changes for claims attachments

The Centers for Medicare & Medicaid Services (CMS) and the Department of Health and Human Services (HHS) have proposed additions to HIPAA regulations to establish standards for attachments to electronically submitted health claim and prior authorization forms.

The rules would apply to information not in the provided form fields but transmitted by the health care provider in any of three use cases: prior authorization, solicited, and unsolicited by the health plan. Defined as “documentation that enables the health plan to make a decision about health care,” such attachments would include x-rays, medical charts, provider notes that document physician referrals, and office or telemedicine visits.

The standards would also apply to electronic signatures used in conjunction with claim or authorization attachments. CMS is seeking to adopt the HL7 Implementation Guide for CDA® Release 2: Digital Signatures and Delegation of Rights, Release 1 (Digital Signatures Guide). According to CMS, this guide implements identity management using digital certificates, encryption requirements to support message integrity, and multiple signed elements to support non-repudiation. This is the same method and tech employed for personal identity verification (PIV) cards used by federal employees to access secure facilities and information systems.

The proposed rulemaking further seeks to modify the standard for the referral certification and authorization transaction, in an effort to limit barriers to value-based payment adoption and to significantly ease unnecessary administrative costs and burdens on providers and health plans

CMS reported a potential cost reduction of $454 million annually, based on a Council for Affordable Quality Healthcare report (2019) that attributed the savings to a fully electronic system for prior authorization with health care attachments. The report further noted a potential $374 million cost savings from full adoption of health claim attachments.

The agency further noted the standards would further the agency’s efforts to reduce paperwork and would help providers better focus on patient care and experience.

“The proposals in this rule would provide a valuable tool to support the electronic submission of health care information,” said CMS Administrator Chiquita Brooks-LaSure, in a press release. “Health care providers are often forced to use manual processes such as mail, fax, or internet web portals when they respond to requests from health plans, leading to delays and less time for patient care. These important steps would promote more consistent and reliable communications among the partners involved in health care transactions, improving the care experience for all.”

Public and stakeholder comments on the proposed rulemaking will be accepted through March 22, 2023.