State of Indiana Office of Medicaid Policy and Planning (OMPP) HIPAA Implementation Continuity Of Operations Plan (COOP) Summary

Transcription

1 I. Overview State of Indiana Office of Medicaid Policy and Planning (OMPP) HIPAA Implementation Continuity Of Operations Plan (COOP) Summary A. Purpose This Continuation Of Operation Plan (COOP) for Indiana Medicaid encompasses the requirements of a contingency plan (response to a specific systems failure or disruption of operations) and a day one operations plan (plan to monitor operation of a new system, determine areas of failure, and execute both planned and unplanned workarounds to assure continuity of operation). It is not a substitute for the Disaster Recovery Plan, but is focused on our responses to system failures specifically related to the implementation of Electronic Transaction and Code Set Rule changes required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In particular, HIPAA requires earlier formats and methods of receiving, processing and sending electronic data to be discontinued on October 16, Only new, HIPAA-compliant transactions are allowed after that date. Non-Pharmacy Indiana Medicaid electronic transactions are handled under contract with its Medicaid fiscal agent, Electronic Data Systems, Inc. (EDS). EDS has been working for the last three years to make required changes to the system that handles these transactions, called IndianaAIM. The changes are massive and carry a degree of inherent risk, similar in scope to the risk that occurs with the assumption of a new fiscal agent. Pharmacy transactions for Indiana Medicaid are handled under a separate Pharmacy Benefits Management (PBM) contract with Affiliated Computer Services, Inc. (ACS), and involve interfaces between ACS and EDS systems. Indiana Medicaid receives and processes electronic information from more than 30,000 health care providers, who submit claims and verify eligibility through software services and products supplied by as many as 400 vendors. Medicaid interfaces with dozens of other payers, including Medicare. Some industry consultants predict 30% to 50% of providers and payers in the US health care system will not be ready to comply with HIPAA requirements by the October 16 deadline. This will have a significant impact on Indiana Medicaid. In past times of electronic system changes, providers have relied on paper 1

2 claims submission as an alternative to electronic transactions. Now that more than 85% of Medicaid claims are received electronically, reversion to paper is no longer a viable option. Indiana Medicaid no longer has the paper processing infrastructure to handle a doubling or tripling of paper claim volume. Indiana has notified providers of these changes through multiple bulletins, seminars, mailings, banner messages and the web site at B. Critical Business Processes Indiana agrees with HIPAA implementation goals and priorities from the US Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS) compliance guidelines as reinforced in conference calls and forums led by CMS: services to Medicaid recipients must not be interrupted and providers must continue to receive prompt and correct payment for the services they render to Medicaid recipients. The law stipulates the additional requirements for electronic transactions to be proper in format and content, but this goal is subordinate to the primary goals of uninterrupted services and payments. Indiana has identified the following business processes that are critical to meet these goals: Eligibility verification: allowing providers to determine whether a person is eligible for services under Medicaid Claims processing: allowing providers to efficiently submit billing forms with all the data needed to determine correct payment Claims payment and remittance advice: accounting for and issuing provider payments and remittance information Managed Care enrollments: allowing managed care organizations to receive enrollment information regarding Medicaid participants under their care Prior Authorization: allowing providers to determine whether certain Medicaid services are authorized based on the particulars of the case Claim Status Inquiry: allowing providers to determine the status of claims submitted for processing by Medicaid Coordination of Benefits with Medicare: allowing automatic processing of provider claims between Medicare and Medicaid II. Responsibilities and Contacts 2

3 Responsibility for application of this plan is assigned on several levels: Executive, Management, Operations, and Communication. Executive decisions-makers will receive regular information from managers on the overall progress of implementation and when monitoring of operations indicates a likelihood that part of the COOP will be triggered. Managers are responsible for the maintenance of the COOP, day-today monitoring of operations, making decisions based on system failures whether covered in the COOP or not, implementing mitigation strategies, and informing and receiving direction from the Executive decision-makers. Operations staff are responsible to conduct monitoring and operations activities as directed by managers, and to report any issues that may significantly affect implementation. Communications staff are responsible to send and receive information from system users, including medical providers and provider associations, and the general public, at the direction of managers. Complete contact information for the individuals in each category are maintained at the Office of Medicaid Policy and Planning (OMPP). III. Risk Analysis A. Eligibility Verification Indiana has identified risks associated with implementation of the 270/271 transaction and the business process it supports: Eligibility Verification. Risks in this area are generally low for the following reasons. First, Indiana adopted a phased in approach and the 270/271 transactions were among the first to be implemented. These transactions are already being processed in our production environment. Initial glitches have been resolved as best we can tell, though volume of transactions is still not high enough to expose all possible issues. Second, Indiana has multiple ways for providers to verify eligibility, including a telephone voice response system, a web interface, switch vendor terminals, other provider software, and a general telephone call center. Providers have been slow to implement changes in their systems to utilize the HIPAA-compliant transaction, slow to test with Indiana Medicaid, and may be forced to rely on these alternate methods until they complete their own HIPAA remediation. If these alternate methods were not available, the impact of 270/271 failure could include the inability of providers to determine eligibility, resulting in loss of Medicaid services. However, since these alternatives 3

4 are available, such impact is highly unlikely. The following table analyzes the level of risk. EDS may not have the 270/271 transactions ready on the HIPAA mandated implementation date Low Medium Communications response times may be too Low/Medium Medium slow, or throughput inadequate to respond to all inquiries Many providers may not be ready to use the new transactions High Low B. Claims Receipt and Processing Indiana has identified risks associated with the 837 series of transactions for the submission of Institutional, Professional and Dental claims. Risks in this area are high for the following reasons: The 837 transactions are the most complex of the new HIPAA-required transactions. These transactions are among the last on our implementation schedule and should be installed into production on September 26, Providers and their software vendors have been slow to prepare their systems to send these transactions and schedule testing. There will not be enough time to test these transactions with each provider before they need to be used. Alternatives exist, but they are limited. EDS will be installing a new, web-based method that providers may use to submit claims, but it will not be tested and installed before September 26. Providers may seek new software vendors or clearing-houses, but that takes time for each provider and solution suppliers are likely to be overloaded. Providers can submit paper claims, but Indiana Medicaid does not have the capacity to process a doubled or tripled volume of paper claims. The NCPDP 5.1 transactions are also complex, and involve an interface between ACS and EDS. Late implementation of our PBM system has left little time for thorough testing of these interfaces. The impact of failure in this area is very high, since providers cannot be paid if their claims cannot be properly submitted. The following chart summarizes the risk: 4

5 EDS may not have the 837 transactions ready on the HIPAA mandated implementation date Communications response times may be too slow, or throughput inadequate to respond to all inquiries Many providers may not be ready to use the new transactions C. Claims Payment and Remittance Advice Medium Medium High High High High Indiana has identified risks associated with the 835 transaction, the claims remittance and payment advice. Risks in this area are low for some providers, high for others. Many providers need electronic remittance advices: Hospitals, MCOs, large chains esp. pharmacy are well automated and are planning adequate testing. They need electronic RAs and are programming to receive the 835. Large providers can not cope with paper RAs any more than we can cope with paper claims. Indiana produces a paper remittance, in addition to the electronic transaction required under HIPAA, and will continue to produce this paper remittance as long as necessary. EDS must have information from ACS to produce the 835 transaction for pharmacy claims, and testing of that interface has not been completed. There is a switch that allows providers to get the various claim responses: 835 transaction, old format electronic Remittance Advice (RA) or paper RA. These are not mutually exclusive. The impact is also low, especially in the short term, as the transaction has no effect on actual payment, only its accounting. Risks are summarized in the table below: EDS may not have the 835 transactions ready on the HIPAA mandated implementation date Medium Low to High Communications response times may be too slow, or throughput inadequate to respond to all inquiries Medium Low to High Many providers may not be ready to use the new transactions D. Managed Care Enrollment High Low to High Indiana has analyzed the 820/834 series of transactions for Plan Premium Payment and Benefit Enrollment into Managed Care Organizations (MCOs) and Primary Care Case Management (PCCM) organizations. The 5

6 risks are low for the following reasons. This transaction series has already been implemented successfully with the MCOs and tested in parallel with old transactions for two months. PCCM implementation is not yet complete. Alternative methods exist to convey the same information, and will not be discontinued until the transaction set is fully tested and implemented with all providers. The following table summarizes the risk: EDS may not have the 820 and 834 Low Low transactions ready on the HIPAA mandated implementation date Communications response times may be too Low Low slow, or throughput inadequate to respond to all inquiries Many providers may not be ready to use the new transactions Medium (PCCMs); Low (MCOs) Low E. Prior Authorization Indiana has analyzed the 278 transaction for Prior Authorizations and determined low risk for the following reasons: Use of the 278 transaction represents a completely new method for providers to gain prior authorization of Medicaid procedures. Current methods include written and telephone authorization systems which will continue in operation after the HIPAA compliance date. There is no clamor from providers to begin using the 278 transaction and no requirement for them to do so. Technically, the 278 is a more difficult transaction, involving interfaces with EDS, ACS and a prior authorization contractor for Indiana, Health Care Excel (HCE). We have summarized risks below: EDS may not have the 278 transaction ready Medium Low on the HIPAA mandated implementation date Communications response times may be too Low Low slow, or throughput inadequate to respond to all inquiries Many providers may not be ready to use the new transactions High Low 6

7 F. Claim Status Inquiry Indiana has analyzed the impact of the 276/277 transaction set and the business process it supports, claim status inquiry and response. We have determined the impact to be low for the following reasons: These transactions are new and do not require the elimination of existing methods to give providers information on the status of their claims. Providers may inquire via the web, using a voice response system, or calling a telephone help desk to determine and discuss the status of claims that have been submitted. However, providers have indicated that they plan to use the transaction in their billing and accounting systems to improve their overall functionality. We get a large number of duplicate claims because billing systems can not electronically find out whether we have received the claim. The status transaction eliminates the need to resubmit. These are also not as technically difficult as claims transactions. EDS expects to be ready for implementation ahead of the October 16 deadline. The following table summarizes the risks: EDS may not have the 276 and 277 Medium Medium transactions ready on the HIPAA mandated implementation date Communications response times may be too Low Low slow, or throughput inadequate to respond to all inquiries Many providers may not be ready to use the new transactions High Low G. Coordination of Benefits with Medicare Indiana has analyzed the business process of handling Medicare Crossover Claims, including particular issues for pharmacy-related claims. We have determined a high degree of risk for the following reasons: The Crossover process is complex and the Medicare Intermediaries have been reluctant to meet for coordination of HIPAA activities. Interface information from Medicare and the DMERCs has been recent and subject to change. Testing with Medicare Intermediaries has not begun. The result may be an inability to process and pay electronic crossover claims. Providers may revert to paper, but this will mean extended processing time and extreme delay in payment. 7

8 More research and work still needs to be done with Medicare payers and the DMERC to discover their contingency plans. The following table summarizes the risks: EDS may not have the Crossover Process Medium High ready on the HIPAA mandated implementation date Communications response times may be too Low Medium slow, or throughput inadequate to process Crossovers Medicare, DMERCs and ACS may not be ready to use the new transactions High High H. Other Risks i. System Capacity Indiana has asked EDS for an analysis of system capacity and requirements under HIPAA. The size and complexity of HIPAA transactions and the operation of dual environments places new demands on hardware, software and operations. Since the full impact has not been determined, this presents a medium risk. EDS may not have the system capacity necessary to process all transactions under HIPAA and in other environments. Medium Medium ii. Paper Claims Volume Indiana expects paper volume to increase as providers have difficulty in complying with the requirements of HIPAA. EDS does not have the capacity to handle double or triple the volume of paper claims. This represents an area of medium risk. Some providers use the PES software supplied by EDS to produce paper claims. EDS plans to discontinue receipt of PES claims on September 26, Providers can still use the software to produce paper claims, although this is not a recommended option, as some data elements on the paper claim may be changed by HIPAA. EDS may not have the capacity to Medium Medium 8

9 process the number of paper claims they will receive after October 16 iii. Provider Assistance Request Volume Providers may deluge the phones with calls for assistance if they are having trouble verifying eligibility or submitting electronic claims. This presents an area of medium risk. EDS may not have the capacity to handle the volume of calls for billing and electronic claims submission assistance. Medium Medium iv. Improper Claims Payment Because of the significant changes that are being made to the claims processing and payment system, there is an additional risk that old claim edits may not be properly enforced or that claims may pay too much or too little due to programming errors or other changes resulting from the HIPAA implementation. This represents an area of medium risk. Errors in the HIPAA-compliant system may cause claims to pay inappropriately. Medium Medium v. Providers that make the switch to HIPAA compliant transactions and cannot revert to old transactions as a mitigation strategy. Providers may make the transition to HIPAA, but find it impossible to submit claims that can be processed and paid. This may be due to errors in their own systems, communication problems, or problems in the IndianaAIM claims processing system. One mitigation strategy will be for providers generally to continue using old claim formats. However, some providers may not be able to revert to old systems many will not have the kind of dual processing environment that Indiana Medicaid has set up. They may be stuck with the new system because of their relationship with other payers. 9

10 Providers have switched to HIPAA compliant systems that don t work for Medicaid, but the providers cannot revert to former systems Medium High IV. General Mitigation Strategies Indiana has determined some general strategies to reduce the risk or the impact of failures related to HIPAA implementation, regardless of source. Whether the failure is caused by programming or systems issues at EDS or ACS, interfaces with Medicare or other payers, or provider/vendor software or operations, the following strategies will help limit the impact of failure. General Strategy 1: Increase communication and provider assistance from EDS Provide immediate assistance to help the providers achieve compliance. EDS will increase or reassign Help Desk staff to handle increased volume. This staff will route providers to options specified below. To accomplish this step, EDS may have to reallocate staff, including systems staff and provider relations staff. The state may need to forgive other contract requirements for timeliness for some period of time to focus help where it will be most needed. EDS may need to allocate additional telephone lines and create a special address for emergency assistance. EDS will need a list of clearinghouses and other HIPAA-compliant solutions so they can refer providers to sources of help. EDS will need an efficient process to help providers determine and correct failure points in their transmission of claims. EDS must provide some level of assistance, even if the cause of the problem is not due to EDS. EDS will continue to alert providers to the imminent nature of the October 16 deadline. They will consider adding a response message to electronic claims submissions, PES Software will be discontinued on October 16 (or something similar). Providers will be encouraged to register for web-interchange (web-based claims submission and eligibility verification) through EDS, even if they do not intend to use it at this time. This will become an alternative method for claims submission. If the provider is already registered, they can begin using it immediately upon discovering that their own software does not work. EDS will publish a HIPAA Checklist on the IndianaMedicaid.com web 10

11 site, telling providers what they should be checking now for the October 16 deadline. As soon as EDS begins receiving HIPAA-compliant claims on September 27, they will begin analyzing and contacting large vendors that have not begun using the HIPAA-compliant transactions. General Strategy 2: Establish lines of communication with providers and provider associations EDS has accumulated a list of address and telephone contact information on medical provider associations in Indiana whose providers do business with Medicaid. EDS will keep this list up-to-date. This contact information will be used to disseminate regular updates on HIPAA implementation, to communicate basic information about the COOP, and in case contingency plans must be put into effect. EDS will also maintain the Web site, posting information about the COOP and notifying providers if contingency plans are put into effect. Establish a bi-weekly conference call with provider associations, where implementation issues can be discussed. Providers may submit questions and Indiana Medicaid will research and present status and options. Establish a web site for Frequently Asked Questions (FAQs) or a listservice that allows providers to review status of known issues. 11

12 General Strategy 3: Create regular one-page report for management on the status of implementation OMPP will specify the format of a one-page report that can be provided to managers and high-level decision makers. The report will contain indicators that will highlight problems quickly. The report will contain such items as: daily volume of eligibility inquiries by type (AVR, HIPAA 270/271, web inquiry) daily volume of claims by type and source (old format, new format, paper, 837i/837p/837d/NCPDP) number of complaints number of calls at various help desks and provider lines number of s requesting HIPAA assistance These reports will begin about September 26, V. Mitigation of Risk Items Indiana has planned activities based on the risks identified above (Medium and High) to monitor status, determine whether a contingency plan should be executed, and identify the steps in the contingency plan. The following tables contain the strategy, monitoring or how we will tell if things are working, trigger or what will tell us we must execute this strategy, plan or what will we do and duration or for how long. Risk: Monitoring: Trigger: Duration: Risk Eligibility Verification Indiana will monitor the level of activity on all eligibility verification systems and compare to average usage. A change of more than 10% across all systems shall indicate the need to consider alternatives. Because the impact of this failure is low, Indiana will execute a strategy of communication with providers, notifying them of alternate methods to verify eligibility. At the same time, EDS will investigate the causes for the variance and dedicate staff as necessary to resolving the problem. The plan will continue in effect until the level of activity on all eligibility verification systems returns to within 10% of normal levels, or it is otherwise determined to be unnecessary. Claims Receipt and Processing 12

13 Monitoring: Trigger: Indiana will monitor the daily volume of claims received from all sources. A variance of more than 10% average over three days or more shall indicate the need to consider alternatives. 1. EDS will provide immediate assistance to help the providers achieve compliance. EDS will increase or reassign help staff to handle increased volume. This staff will route providers to options specified below. To accomplish this step, EDS may have to reallocate staff, including systems staff and provider relations staff. The state may forgive other contract requirements for timeliness for some period of time to focus help where it will be most needed. EDS will allocate additional telephone lines and create a special address for emergency assistance. EDS will create a list of clearinghouses and other HIPAA-compliant solutions so they can refer providers to sources of help. EDS will create an efficient process to help providers determine and correct failure points in their transmission of claims. EDS will provide some level of assistance, even if the cause of the problem is not due to EDS. 2. EDS will streamline the registration process for use of the provider web-based software. EDS will develop a procedure to allow for quick, temporary registration. EDS will have a quick and proven method for most providers to submit claims, using their webbased solution. The state will work with EDS before implementation to streamline registration for using that system. EDS has established a two-tier system for vendor testing: Vendors may execute a testing checklist and become an A tester. This assures that the vendor has tested more completely with EDS and can reasonably assume that claims will process and pay through the system. Vendors may test communications only and become B testers. This assures only that EDS can receive files from 13

14 the vendor, and does not in any way certify that claims will process and pay correctly. EDS estimates that it takes about 3 hours to complete B level testing and 8 hours for A level testing, spread over about a week. EDS requires that vendors have a Trading Partner Agreement in place before testing can begin, and at least B level testing must take place before claims can be submitted. EDS may be able to speed up this process through the use of , express delivery, and fax transmission of documents. 3. At the option of the state, EDS may be instructed to allow continued receipt of claims in noncompliant format: CMS indicates that, while not endorsed by CMS as a solution, this may be the best option a state has in the short run to deal with providers that are not ready. There is little likelihood that CMS would try to impose penalties on a state that allowed receipt of non-compliant claims for a short period so that the Medicaid program could continue to operate without interruption. Providers will be required to register to continue to submit claims in the old format and will only be allowed to do so for a maximum of 60 days. Providers must commit to work with EDS or their vendor to resolve compliance within that timeframe. There will be some delay, as providers must complete paperwork to qualify for the extension of use of the old format. This creates some incentive for the provider to quickly make the changes necessary for compliance, rather than rely on non-compliant systems. If a provider knows that they will not be able to comply on time, they may begin this paperwork process before October 16. EDS and OMPP will work to strictly define the exception process by October 1. Each provider given an exception must be documented as it occurs and its progress toward compliance measured. 4. EDS will also prepare for increased volume of 14

15 Duration: paper claims. EDS will prepare for a 150% increase in paper claims, by organizing potential evening shifts and arranging data entry outsourcing on a contingency basis. Emergency measures will remain in effect until claim volumes stabilize within 10% of previous daily averages. Risk: Claims Payment and Remittance Advice Monitoring: EDS will monitor the issuance of remittance transactions and compare to the number of transactions received. EDS will monitor provider assistance telephone lines for complaints from providers about the remittance transactions. Trigger: Complaints from providers exceed 50. Because the impact of this failure is low, Indiana will only execute a strategy of communication with providers, notifying them of alternate methods to receive remittance information. Duration: The plan will remain in effect until the number of complaints drops to less than 10 per week. Risk Managed Care Enrollment Monitoring: EDS will monitor the exchange of Managed Care Enrollment transactions and compare to the average number of transactions received. EDS will monitor provider assistance telephone lines for complaints from MCOs and PCCMs. Trigger: Complaints from providers exceed 5. Because the impact of this failure is low, Indiana will only execute a strategy of communication with providers, notifying them of alternate methods to exchange enrollment information, and working with the providers to complete or correct the HIPAA transactions. Duration: The plan will remain in effect until all complaints are resolved. Strategy: Monitoring: Trigger: Duration: Prior Authorizations EDS will monitor the number of 278 transactions received and their disposition each week and report to managers. The ratio of 278 transactions with an improper disposition exceeds 20% and the volume of transactions exceeds 100 per week. Providers will be instructed to use alternate methods of Prior Authorization until system failures are resolved. The plan will remain in effect until the ratio of 15

16 improperly resolved transactions is below 5% and the volume of transactions exceeds 100 per week. Strategy: Claim Status Inquiry Monitoring: EDS will monitor the number of 276/277 transactions on a weekly basis, and will monitor provider assistance telephone lines for complaints. Trigger: Complaints from providers exceeds 25. Because the impact of this failure is low, Indiana will only execute a strategy of communication with providers, notifying them of alternate methods to receive claim status information, and working with the providers to complete or correct the HIPAA transactions. Duration: The plan will remain in effect until the number of complaints drops to less than 5 per week. Strategy: Coordination of Benefits with Medicare Monitoring: Reports from EDS should monitor the number of crossover claims processed and paid, and the amount paid as compared to an average. Trigger: Crossover claims or paid amounts drop 20% Providers can be instructed to submit claims directly (electronically), rather than rely of intermediaries to send claims for processing. Because amount of payments are relatively small, providers may be able to wait as problems are worked out. Medicare payers may be able to revert to the old file formats, if allowed by OMPP. Duration: The plan will remain in effect until the processing of crossovers reaches at least 90% of former average. Strategy: Monitoring: Trigger: Duration: System Capacity System metrics on daily report will show number of transactions being processed in all categories. Number of transactions in any category (aggregate) drops by more than 15%. EDS will re-allocate computer resources and delegate emergency programming and analyst resources to bring capacity up to the level required. Executive decisionmakers will be notified immediately for possible further actions. The plan will remain in effect until an instruction is received from decision-makers to return to normal operations. 16

17 Strategy: Monitoring: Trigger: Duration: Strategy: Monitoring: Trigger: Duration: Paper Claims Volume System metrics will track volume and processing status of paper claims. Paper claims received increase by more than 25%, or the backlog of paper claims exceeds 20 days. EDS will operate multiple shifts or longer shifts to handle backlog. EDS will outsource paper claims to a contractor as necessary. Processing time requirements for paper claims may be relaxed at the discretion of OMPP. The plan will remain in effect until there is no more than a 20 day total backlog of paper claims. Improper Claims Payment System metrics will compare payment rates for each claim type and category to an average. Claim payment in any category changes by 10%, and the change does not have an explanation. EDS will delegate emergency system resources to discover the cause for or explanation of the change. Executive decision-makers will be notified immediately for further possible actions. The plan will remain in effect until an instruction is received from decision-makers to return to normal operations. Strategy: Monitoring: Trigger: Providers unable to use old formats as part of mitigation strategy. Provider complaints will be recorded. More than 30 complaints from providers that they have made the change, it is not working, and they cannot revert to old format. Support will be prioritized for providers that made early effort to comply. Emergency payments can be authorized in a process defined by OMPP. Duration: Until the number of complaints drops to less than 10 outstanding. VI. Testing and Implementation of the COOP Indiana will incorporate testing of the COOP mitigation strategies into its overall HIPAA implementation test plan. For items not suited to testing, EDS and the state will conduct and document walk-through sessions before 17

18 October 16, Indiana will test communication channels by issuing advance information and determining that such information was received. During the actual transition surrounding October 16, HMA consultants will dedicate additional time on-site in Indiana. VII. Publication of the COOP Indiana will make information from this COOP to vendors, providers and other trading partners. Information will be prepared as releases to the general media, press releases to provider associations, and information to be posted on the Web site. Information for release will include a summary of medium and high risks, a summary of the mitigation strategies for those risks, and contact information that vendors, providers and partners may use to reduce or eliminate the risk. 18