EDI Retail Pharmacy Claim Transacti

EDI Retail Pharmacy Claim Transaction (NCPDP Telecommunications Standard version 5.1) is used to submit retail pharmacy claims to payers by health care professionals who dispense medications, either directly or via intermediary billers and claims clearinghouses. It can also be used to transmit claims for retail pharmacy services and billing payment information between payers with different payment responsibilities where coordination of benefits is required or between payers and regulatory agencies to monitor the rendering, billing, and/or payment of retail pharmacy services within the pharmacy health care/insurance industry segment.

EDI Health Care Claim Payment/Advice Transaction Set (835) can be used to make a payment, send an Explanation of Benefits (EOB), send an Explanation of Payments (EOP) remittance advice, or make a payment and send an EOP remittance advice only from a health insurer to a health care provider either directly or via a financial institution.

EDI Benefit Enrollment and Maintenance Set (834) can be used by employers, unions, government agencies, associations or insurance agencies to enroll members to a payer. The payer is a healthcare organization that pays claims, administers insurance or benefit or product. Examples of payers include an insurance company, health care professional (HMO), preferred provider organization (PPO), government agency (Medicaid, Medicare etc.) or any organization that may be contracted by one of these former groups.

EDI Payroll Deducted and other group Premium Payment for Insurance Products (820) is a transaction set which can be used to make a premium payment for insurance products. It can be used to order a financial institution to make a payment to a payee.

EDI Health Care Eligibility/Benefit Inquiry (270) is used to inquire about the health care benefits and eligibility associated with a subscriber or dependent.

EDI Health Care Eligibility/Benefit Response (271) is used to respond to a request inquiry about the health care benefits and eligibility associated with a subscriber or dependent.

EDI Health Care Claim Status Request (276) This transaction set can be used by a provider, recipient of health care products or services or their authorized agent to request the status of a health care claim.

EDI Health Care Claim Status Notification (277) This transaction set can be used by a health care payer or authorized agent to notify a provider, recipient or authorized agent regarding the status of a health care claim or encounter, or to request additional information from the provider regarding a health care claim or encounter. This transaction set is not intended to replace the Health Care Claim Payment/Advice Transaction Set (835) and therefore, is not used for account payment posting. The notification is at a summary or service line detail level. The notification may be solicited or unsolicited.

EDI Health Care Service Review Information (278) This transaction set can be used to transmit health care service information, such as subscriber, patient, demographic, diagnosis or treatment data for the purpose of request for review, certification, notification or reporting the outcome of a health care services review.

EDI Functional Acknowledgement Transaction Set (997) this transaction set can be used to define the control structures for a set of acknowledgments to indicate the results of the syntactical analysis of the electronically encoded documents. Although it is not specifically named in the HIPAA Legislation or Final Rule, it is necessary for X12 transaction set processing. The encoded documents are the transaction sets, which are grouped in functional groups, used in defining transactions for business data interchange. This standard does not cover the semantic meaning of the information encoded in the transaction sets.
Brief 5010 Transactions and Code Sets Rules Update Summary

1) Transaction Set (997) will be replaced by Transaction Set (999) "acknowledgement report".
2) The size of many fields {segment elements} will be expanded, causing a need for all IT providers to expand corresponding fields, element, files, GUI, paper media and databases.
3) Some segments have been removed from existing Transaction Sets.
4) Many segments have been added to existing Transaction Sets allowing greater tracking and reporting of cost and patient encounters.
5) Capacity to use both "International Classification of Diseases" versions 9 (ICD-9) and 10 (ICD-10-CM) has been added.[35][36]
Security Rule

The Final Rule on Security Standards was issued on February 20, 2003. It took effect on April 21, 2003 with a compliance date of April 21, 2005 for most covered entities and April 21, 2006 for "small plans". The Security Rule complements the Privacy Rule. While the Privacy Rule pertains to all Protected Health Information (PHI) including paper and electronic, the Security Rule deals specifically with Electronic Protected Health Information (EPHI). It lays out three types of security safeguards required for compliance: administrative, physical, and technical. For each of these types, the Rule identifies various security standards, and for each standard, it names both required and addressable implementation specifications. Required specifications must be adopted and administered as dictated by the Rule. Addressable specifications are more flexible. Individual covered entities can evaluate their own situation and determine the best way to implement addressable specifications. Some privacy advocates have argued that this "flexibility" may provide too much latitude to covered entities.[37] The standards and specifications are as follows:

Administrative Safeguards – policies and procedures designed to clearly show how the entity will comply with the act
Covered entities (entities that must comply with HIPAA requirements) must adopt a written set of privacy procedures and designate a privacy officer to be responsible for developing and implementing all required policies and procedures.
The policies and procedures must reference management oversight and organizational buy-in to compliance with the documented security controls.
Procedures should clearly identify employees or classes of employees who will have access to electronic protected health information (EPHI). Access to EPHI must be restricted to only those employees who have a need for it to complete their job function.
The procedures must address access authorization, establishment, modification, and termination.
Entities must show that an appropriate ongoing training program regarding the handling of PHI is provided to employees performing health plan administrative functions.
Covered entities that out-source some of their business processes to a third party must ensure that their vendors also have a framework in place to comply with HIPAA requirements. Companies typically gain this assurance through clauses in the contracts stating that the vendor will meet the same data protection requirements that apply to the covered entity. Care must be taken to determine if the vendor further out-sources any data handling functions to other vendors and monitor whether appropriate contracts and controls are in place.
A contingency plan should be in place for responding to emergencies. Covered entities are responsible for backing up their data and having disaster recovery procedures in place. The plan should document data priority and failure analysis, testing activities, and change control procedures.
Internal audits play a key role in HIPAA compliance by reviewing operations with the goal of identifying potential security violations. Policies and procedures should specifically document the scope, frequency, and procedures of audits. Audits should be both routine and event-based.
Procedures should document instructions for addressing and responding to security breaches that are identified either during the audit or the normal course of operations.
Physical Safeguards – controlling physical access to protect against inappropriate access to protected data
Controls must govern the introduction and removal of hardware and software from the network. (When equipment is retired it must be disposed of properly to ensure that PHI is not compromised.)
Access to equipment containing health information should be carefully controlled and monitored.
Access to hardware and software must be limited to properly authorized individuals.
Required access controls consist of facility security plans, maintenance records, and visitor sign-in and escorts.
Policies are required to address proper workstation use. Workstations should be removed from high traffic areas and monitor screens should not be in direct view of the public.
If the covered entities utilize contractors or agents, they too must be fully trained on their physical access responsibilities.

Technical Safeguards – controlling access to computer systems and enabling covered entities to protect communications containing PHI transmitted electronically over open networks from being intercepted by anyone other than the intended recipient.
Information systems housing PHI must be protected from intrusion. When information flows over open networks, some form of encryption must be utilized. If closed systems/networks are utilized, existing access controls are considered sufficient and encryption is optional.
Each covered entity is responsible for ensuring that the data within its systems has not been changed or erased in an unauthorized manner.
Data corroboration, including the use of check sum, double-keying, message authentication, and digital signature may be used to ensure data integrity.
Covered entities must also authenticate entities with which they communicate. Authentication consists of corroborating that an entity is who it c