HARK home page Introduction to HIPAA Transactions and Codes Sets
Transactions and Codes Sets
NOTE: This is an educational document designed to assist entities in understanding and planning for HIPAA implementation.

This document is not a supplement for sound legal advice and should only be used as a guide. It is highly recommended that you review the Final Rule for all HIPAA requirements.

Transactions and Codes Sets
A note about Paper versus Electronic

Electronic management of data will realize significant savings, but for some, paper transactions will be part of daily business. Since the final rule strictly addresses electronic transactions, you can create your own standards for paper transactions. It is highly recommended, however, that standards for nonelectronic transactions mirror those established for the electronic environment.
No More Square Pegs for Round Holes
A great challenge facing electronic data interchange is the numerous formats in which the data is transferred. Conversion is generally required to receive and transmit the information for the next user, which could be under any number of formats. Administrative simplification is putting an end to the guesswork by implementing a standard format that must be used when sending or receiving healthcare information.
Electronic Data Interchange
Data elements are the smallest units of information defined under HIPAA. Code sets are medical diagnostic codes, procedure codes, table of terms, and other information constructed by different data elements. Since code sets are comprised of predefined universal data elements, the code sets can be exchanged, broken down, and processed by any recipient, without the need for specialized conversion.
Graphic illustrating data elements and code sets
Construction and transmittal of data elements must meet a standard, conveniently called a "standard transaction." The standard transaction is a predefined requirement in how data elements are arranged for transmission, and what data elements must be included.

Additionally, a "maximum data set" has been established for each electronic standard transaction. The maximum data set is the threshold of data in a standard transaction that a receiver must accept and cannot refuse. This does not imply any obligation to pay or honor the transaction, which may not be covered or part of a contractual agreement, but for processing purposes the transaction must be accepted. This provides parameters in which information is constructed with expectation of universal acceptance.
Transactions
Knowing transactions are made up of code sets, which are comprised of data elements, let's look at how this comes together to make a standard transaction.

Up to this point, most standard transactions have been defined, but more research is taking place for additional standard transactions. Following is what has been established thus far:
Health Claims or Equivalent Encounter Information
Standard Transaction Form:  X12-837 - Health Care Claim
This transaction is subdivided based on the provider type submitting the claim. It is similar to the UB-92 or the HCFA 1500. In some managed care agreements, not all of the information in this standard transaction is needed. If the two entities agree on transmitting less than the full transaction, data can be sent and received while maintaining HIPAA compliance. However, either entity is not obligated to accept or send more than the maximum data set for this standard transaction.
Claims Payment and Remittance Advice
Standard Transaction Form:  X12-835 - Health Care Claim Payment/Advice Standard
This standard transaction carries significantly more data the usual paper advice.  If the payer and provider agree, the transaction can also be sent to a provider through a bank to carry additional information regarding fund transfer, similar to an ATM transaction.  If this option is used, a contractual agreement with the bank should be used to ensure HIPAA privacy and security standards are maintained.
Healthcare Claims Status
Standard Transaction Form:  X12-276/277 - Health Care Claim Status Request and Response
This form is a tracking device for submitted claims.  This form has limited use and the main benefit is the ability to check claim status with plans or payers without the need of email or telephone interaction.
Coordination of Benefits
Standard Transaction Form:  X12-837 - Health Care Claim
Yes, coordination of benefits utilizes the Health Care Claim form, but includes some additional data to allow a primary payer to send a second X12-827 to the next payer in line.  It is expected, but not mandated, that each payer processing the claim will send the provider an X12-835 (payment and remittance advice) informing the provider of claim progression.  However, the final rule for transactions does not mandate a specific process for coordination of benefits; therefore plans and payers can decide when they want to use the transaction.
Referral Certification and Authorization
Standard Transaction Form:  X12-278 - Health Care Services Review - Request for Review and Response
As expected, this form is used for referral certification and authorization.  This form should alleviate the time delay and inaccuracy produced by paper or manual inquiries.
Enrollment and Disenrollment in a Health Plan
Standard Transaction Form:  X12-834
This standard transaction can be used for enrollment or disenrollment in a health plan.  Because its use goes beyond the healthcare industry, it can also be used to update coverage regarding life insurance, disability, or retirement.  Using integration with a payroll application would allow updates to be done each payroll period.
Premium Payments
Standard Transaction Form:  X12-820
Eligibility for a Health Plan
Standard Transaction Form:  X12-270/271
Other Transactions
Transactions for First Report of Injury and Claims Attachments are not covered in the final rule.  Continued discussion is occurring to further define these transactions and how the standards should be constructed.
What are the technical needs to create, transmit, and maintain these standards?

Now you know which transactions are standardized and which electronic forms should be used, how do you go about getting the proper hardware and software to integrate these new processes?  Actually, that's a customized answer that your office will need to determine.

HIPAA compliance is about having proper processes and protections in place and not exactly a hardware issue. For instance, you can't necessarily go to the store and buy a HIPAA compliant hard drive.  There is not a standard system that will bring a universal HIPAA solution, because every organization will need to address different issues for HIPAA compliance, based on current technologies and work processes.  This can be seen as an advantage since it gives you the freedom to choose which technologies, vendors, and products you wish to employ for your business, as opposed to being forced to buy specific software and hardware as mandated by someone unfamiliar with your operations.

Questions that should be addressed to assess HIPAA compliance are related to how your hardware and software support the HIPAA requirements.  For instance, is your billing software able to receive the maximum data set for each standard transaction?  Are passwords and secure servers used to protect the confidential individually identifiable information?  Can your software transmit a standard transaction using the proper data elements? 

A good approach for assessing your hardware and software needs is to review the final rule for transactions and codes sets, and check off the requirements that you meet while creating a list of those that need additional resources for compliance.  For example, you may not need the high-end security features that a hospital may employ to maintain security, but you may need a larger "name" field to accept a maximum data set.

Following are some key points to consider when assessing your software and hardware vendor.
  • Are the software enhancements, updates, or upgrades necessary to implement the organization's HIPAA compliance plan included in the cost of support and/or maintenance?
  • Does the vendor guarantee the availability of support and/or maintenance for a specified minimum number of years?
  • Is the software scalable?
  • If the software has security features, are they compatible with the organization's HIPAA compliance strategy?
  • If the software does not contain security features, are customizations available to create such features? If so, at what cost?
  • If currently licensing software from the prospective vendor, how responsive is the vendor to the organization's maintenance, customization and support requirements?
  • How long has the vendor been in business?
  • Is the vendor financially viable?
  • What is the likelihood that the vendor will be acquired during the term on the contract?

If you decide to use an Application Service Provider (ASP), a clearinghouse, or any third party vendor to maintain your billing and/or records, it is highly suggested that you review their HIPAA compliance strategy.  Subcontracting does not relieve you of the responsibilities dictated in the final rules. Under HIPAA regulations, the business associate contracted to process your claims, or perform any process covered by HIPAA, is seen as an extension of your business.
Code Sets
As previously discussed, code sets are codes used to encode data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes.  This includes both the codes and their descriptions.  Code sets are determined by using currently established coding publications.  Following is a list of code sets that are employed with a description of how they can be used for HIPAA purposes:
American Medical Association's Current Procedural Terminology, Fourth Edition (CPT-4)
Used for:
  • Physician services
  • Physical and occupational therapy services
  • Radiologic procedures
  • Clinical laboratory tests
  • Hearing and vision services
  • Transportation services, including ambulances
  • Other medical diagnostic procedures and healthcare services
International Classification of Diseases, 9th Edition, Clinical Modification (ICD-9-CM), Volumes 1 and 2
Used for:
  • Diseases
  • Injuries
  • Impairments
  • Causes of diseases
  • Causes of injury
  • Other health problems and their manifestations
International Classification of Diseases, 9th Edition, Clinical Modification (ICD-9-CM), Volume 3
Used for:
  • Hospital reporting of diseases, injuries, and impairments as related to prevention, diagnosis, treatment, and management
  • Nonacute facilities cannot use this code set, rather the appropriate code must be reported from the CPT-4, or the Health Care Financing Administration Common Procedure Coding System (HCPCS).
Health Care Financing Administration Common Procedure Coding System (HCPCS)
Used for:
  • Substances
  • Equipment
  • Supplies (such as medical supplies)
  • Orthotic and prosthetic devices
  • Home medical equipment
NOTE:  Level III local codes are in the process of abolishment and will not be accepted as part of this code set.
National Drug Codes (NDC)
Used for:
  • Drugs
  • Biologics
American Dental Association's Current Dental Terminology (CDT)
Used for:
  • Dental Claims
Individual Identifiers
Another facet of administrative simplification is identifiers.  These are alphanumeric or numeric codes that establish an individual identity for providers, employers, health plans, and possibly individual healthcare recipients.
National Provider Identifier (NPI)
A ten digit numerical code issued to providers for correlation of data.  Although the NPI is unique for each provider, it does not contain embedded data that would reveal specific information, such as site location or specialty type.
Employer identification Number (EIN)
A nine digit numeric code administered by the Internal Revenue Service, to identify employers.
Health Plans
An identifier for health plans has not been established currently, but one is expected in the near future.
Individual Identifier
Due to privacy issues, the possibility of an individual identifier for healthcare recipients is still undergoing debate.  Currently, individual identifiers are on hold until privacy legislation can be passed.
Time Is Money
Compliance with HIPAA mandates governing transactions and codes sets is October 16, 2002.  This is an important date to remember for those planning on reaping the benefits of electronic data interchange.  It is also the date on which non-compliance begins to result in severe fines and penalties.  Despite the looming doom of penalization, the surmised benefits of significantly decreased financial expenditure and improved customer service should keep you heading towards the electronic environment.