Codes Sets and Unique Identifiers
Code Sets
The following information has been proposed by HHS, but no final rule or compliance date have been issued as of the date of this publication. The information in this section has been excerpted from the Department of Health & Human Services web site, at http://aspe.hhs.gov/admnsimp/final/txfin00.htm. HIPAA includes a provision for a standard set of codes to identify medical diagnoses, procedures, and other clinical information.

“In § 162.1002 we clarify the use of medical code sets. The standard code sets are the following:
(a) ICD-9-CM, Volumes 1 and 2 (including The Official ICD- 9-CM Guidelines for Coding and Reporting), is the required code set for diseases, injuries, impairments, other health problems and their manifestations, and causes of injury, disease, impairment, or other health problems.
(b) ICD-9-CM Volume 3 Procedures (including The Official ICD-9-CM Guidelines for Coding and Reporting) is the required code set for the following procedures or other actions taken for diseases, injuries, and impairments on hospital inpatients reported by hospitals: prevention, diagnosis, treatment, and management.
(c) NDC is the required code set for drugs and biologics.
(d) Code on Dental Procedures and Nomenclature is the code set for dental services.
(e) The combination of HCPCS and CPT-4 is the required code set for physician services and other health care services.
(f) HCPCS is the required code set for other substances, equipment, supplies, and other items used in health care services.
At this time we are not establishing a common schedule for implementing new versions of all HIPAA medical data code sets, since some of the code sets are updated annually (for example, ICD-9-CM, CPT) and some are updated more frequently. The organizations that maintain medical data code sets will continue to specify their update schedule. Different Federal laws mandate the implementation of annual updates to ICD-9-CM on October 1 and annual updates to the CPT on January 1 of the following year for their use in the Medicare program. Changing either of these dates would require legislative action and would also represent a major change in current practice for many elements of the health care industry.”

Provider Identifiers
“In May 1998, HHS proposed standards to require hospitals, doctors, nursing homes, and other health care providers to obtain a unique identifier when filing electronic claims with public and private insurance programs. Providers would apply for an identifier once and keep it if they relocated or changed specialties. Currently, health care providers are assigned different ID numbers by each different private health plan, hospital, nursing home, and public program such as Medicare and Medicaid. These multiple ID numbers result in slower payments, increased costs and a lack of coordination. “In June 1998, HHS proposed regulations to standardize the identifying numbers assigned to employers in the health care industry by using the existing Employer Identification Number (EIN) already assigned by the Internal Revenue Service. Businesses that pay wages to employees already have an EIN.

Business Associate Agreement
The source for this information is 45 CFR §§ 160.103, 164.502(e), 164.514(e), as cited in the Department of Health & Human Services web site at www.hhs.gov/ocr/hipaa/busassoc.html.

By law, the Privacy Rule applies only to health plans, health care clearinghouses, and certain health care providers. In today's health care system, however, most health care providers and health plans do not carry out all of their health care activities and functions by themselves; they require assistance from a variety of contractors and other businesses.
In allowing providers and plans to give protected health information (PHI) to these "business associates," the Privacy Rule conditions such disclosures on the provider or plan obtaining, typically by contract, satisfactory assurances that the business associate will use the information only for the purposes for which they were engaged by the covered entity, will safeguard the information from misuse, and will help the covered entity comply with the covered entity's duties to provide individuals with access to health information about them and a history of certain disclosures (e.g., if the business associate maintains the only copy of information, it must promise to cooperate with the covered entity to provide individuals access to information upon request).
PHI may be disclosed to a business associate only to help the providers and plans carry out their health care functions - not for independent use by the business associate.