 |
Overview: ConnectiCare
has implemented procedures to attain compliance with the Administrative
Simplification provisions of HIPAA. |
|
Standard Transactions:
ConnectiCare sends and receives transactions with multiple business partners. As
outlined by the HIPAA regulations, ConnectiCare has now transitioned over to the
HIPAA transactions listed below. We are converting our trading partners to these
standards as the trading partners themselves are ready to convert. |
| Covered Transaction
Type |
Transaction Standard/ Format
& Version |
| Health Care claim or encounter |
837 professional and Institutional – ANSI x12 v4010 |
| Claim payment and remittance advice (ERA) |
835 – ANSI x12 v4010 |
| Enrollment / dis-enrollment in Health Plan |
834 – ANSI x12 v4010 |
| Health Plan premium payments |
820 – ANSI x12 v4010 |
| Health Care claims status |
276/277 – ANSI x12 v4010 |
| Health Plan Eligibility |
270/271 – ANSI x12 v4010 |
| Referral certification and authorization |
278 – ANSI x12 v4010 | |
| |
 |
Testing: All of ConnectiCare's EDI
trading partners which were deemed covered entities under the HIPAA law have
either moved to production or are in the process of testing the 4010A1
transaction sets. |
|
Privacy: ConnectiCare
complied with the HIPAA Privacy Rule requirements by the April 14, 2003
compliance date. |
| |
|
Privacy Policies and Procedures:
ConnectiCare has revised existing privacy policies and procedures and developed
new privacy policies and procedures to meet the Privacy Rule standards.
|
| |
|
“Minimum Necessary” Evaluation:
ConnectiCare has evaluated the categories of protected health information (PHI)
that each class of employees needs to access in order to perform their jobs.
Policies and procedures have been developed to limit access accordingly.
Disclosures of PHI have also been evaluated to ensure that such disclosures are
limited to what is reasonably necessary to achieve the disclosure’s legitimate
purpose. |
| |
|
Safeguards: Reasonable safeguards have
been implemented to protect PHI from improper uses and disclosures. |
| |
|
Training: Delivery of privacy training
to all ConnectiCare employees has been completed. |
| |
|
Business Associates: ConnectiCare has
identified its business associates and has amended its contracts with each
business associate to include the necessary assurances. |
| |
|
Notice of Privacy Practices:
ConnectiCare distributes a Privacy Notice to its members annually. This document
was revised recently and was sent to members in early April 2003 in the
HouseCall newsletter. |
|
Security: ConnectiCare
complied with the HIPAA Security Rule requirements by the April 20, 2005
compliance date. |
| |
|
Security Management Process: A formal
security risk analysis and risk management process led by the Chief Information
Officer meets monthly to address all security related issues. |
| |
|
Security Policies and Procedures: Many
of the HIPAA Security Standards have been considered industry “best practices”
for years and have already been addressed in our policies and procedures.
Examples include the use of VPN technology, strong passwords, periodic user
rights review, formal change management process, security incident procedures,
data backup plan, disaster recovery plan and encryption. |
| |
|
Training: All employees have completed
training specific to the HIPAA Security Rule. |
| |
|
Facility Security: Physical security is
controlled using a key-card system at all of ConnectiCare’s facilities. Access
to any sensitive areas within ConnectiCare, such as the data center, are limited
to only those employees that need access to those areas to perform their job.
|
| |
|
Evaluation: Periodic security reviews
will be lead by the Audit department. In addition to those specific reviews,
there is a security review built into the annual financial audit.
|
