The Centers for Medicare & Medicaid Services (“CMS”), on behalf of the U.S. Department of Health and Human Services (“HHS”), recently issued a proposed rule to adopt standards under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) for “health care attachment” transactions (the “Proposed Rule”). The Proposed Rule would implement requirements of HIPAA’s administrative simplification regulations, which are intended to support healthcare claims and prior authorization transactions while also introducing a standard format for electronic signatures to be used in conjunction with health care attachments.

CMS anticipates that the Proposed Rule would result in significant cost savings and a reduction in administrative paperwork, allowing healthcare providers to focus more time on direct patient care. The Proposed Rule would affect all HIPPA-covered entities including health plans, health care providers, and clearinghouses that use or maintain electronic health records.

HIPAA’s Administrative Simplification Rule

Buried deep within HIPAA lies regulations on administrative simplification. This subtitle of HIPAA (45 C.F.R. Parts 160; 162; and 164) was written to ensure consistent electronic communication across healthcare systems and promote efficient transfer of administrative data between health plans, health care providers, and clearinghouses. More specifically, it was aimed at streamlining the paperwork for certain processes, such as verifying patient eligibility or obtaining authorization for treatments.

This regulation requires HIPAA-covered entities to adopt standards for transactions involving the electronic exchange of healthcare data and specifies standards to be used in all HIPAA- covered transactions including: (1) unique identifiers such as employer identification numbers and national provider identifiers; (2) code sets that indicate specific diagnoses, procedures, tests, or other services; and (3) operating rules which specify the information that must be included in all HIPAA transactions.

The Proposed Rule seeks to amend existing administrative simplification regulations and further standardize transactions involving healthcare data. Specifically, it creates standards for the transmission of health care attachments and electronic signatures that accompany many of these transactions.

Health Care Attachments

Health care attachments are documents that provide additional information to aid in the healthcare payment decision-making process. This information typically includes patient or case- related information, patient test results, and medical records.

There are three processes by which health care attachments are typically requested:

• Prior Authorizations: A healthcare provider transfers a patient’s medical information with additional documentation in support of a particular treatment in order for a health plan to render its payment decision before the healthcare provider renders services or treatment to the patient.

• Solicited Documents: A healthcare provider submits a claim after which a health plan requests additional information from the provider to make its payment determination.

• Unsolicited Documents: A healthcare provider submits an attachment with its initial submission of the claim for services rendered to a patient.

Standards for Health Care Attachments

The Proposed Rule would mandate a standard format for the transmission of “health care attachments” between HIPAA-regulated entities to support electronic healthcare claims and prior authorization transactions, which currently lack an efficient and uniform method of sending attachments. In particular, the Proposed Rule would adopt the following standards:

The modifications proposed by CMS have been largely endorsed by the AHA and reported to result in cost savings, improved efficiency through standardization, and reduction of provider burnout by alleviating administrative burdens.

Standards for Electronic Signatures 

CMS has also proposed several changes to existing regulations surrounding electronic signatures. Electronic signatures are electric stamps that contain information about the signatory and the document that is being signed. They represent an attestation that the information is accurate and complete. Electronic signatures are important because they are often the only indication that the health care attachments have been reviewed and approved by a healthcare provider.

Under the Proposed Rule, CMS proposes to expand the indications recognized as electronic signatures — specifically, the new provision under 45 CFR §162.103 provides that an “electronic signature” is “an electric sound, symbol, or process, attached to or logically associated with attachment information and executed by a person with the intent to sign the attachment information.” This definition encompasses most digital signatures accepted by commonly used platforms.

In addition, CMS proposes to adopt a new standard format for the transmission of electronic signatures, which would allow them to be sent, received, and interpreted without interruption. The use of the standard format will be required for the submission of claims and referral certifications as part of prior authorization processes.

These proposed changes are likely to improve reliability and authenticity of electronic signatures and minimize the potential for fraudulent tampering in connection with healthcare claims and prior authorization transactions.

Implementation of Electronic Signatures

To comply with the newly proposed standards under the Proposed Rule, electronic signature technology would be required to incorporate the following features:

• User authentication: The ability to compare unique traits of the electronic signature to the signature on record, similar to digital certificates. In contrast, a typed signature in an editable document does not contain any unique features to allow verification of the signatory’s identity.

• Message integrity: Electronic validation that the information contained in the attachment remains unaltered from the time it was reviewed and approved to the moment in which authenticity is confirmed, which is typically accomplished through encryption.

• Nonrepudiation: Provision of assurances that the signatory’s identity is valid, which can be accomplished through multiple signed elements.

The Future of Administrative Simplification

Ultimately, administrative simplification is focused on streamlining what can quickly become a cumbersome and inefficient process. The Proposed Rule will certainly help to realize this goal. Interoperability has been a growing focus of HHS and is at the heart of the Proposed Rule. Adoption of the Proposed Rule would be a significant step towards aiding the healthcare industry to reduce administrative waste, result in a substantial reduction of annual costs, and help healthcare providers deliver uninterrupted care to their patients.

HIPPA-covered entities including health plans, healthcare providers, and clearinghouses that use electronic records will be impacted by the anticipated finalization of this rule and are encouraged to submit comments to through March 21, 2023. As proposed, the new standards would be in force 24 months after the effective date of the final rule.

Alexandria Foster, a law clerk in Sheppard Mullin's Washington, D.C. office, also contributed to this article.