Carriers Find HIPAA Compliance Manageable

“We are complaint with all of those,” Laberge says of the HIPAA rules already in effect. Aetna has established a chief privacy officer and a project management office with dedicated staff to ensure that compliance, he adds.

“We got a good jump-start on this,” he says, noting that Aetna began working toward compliance in 2000 or early 2001, when it realized the rules were likely being crafted.

Aetna did a “company-wide risk assessment against the requirements,” he explains, and the results “determined that we were already compliant with a lot of it.” There are still some “technical things that need to be done,” Laberge adds.

Neither Pal nor Laberge says they expected any serious problems as the companies prepare for HIPAA compliance. They have seen few serious bumps in the road as they have worked toward compliance in other areas.

“You can never say that you have no problems,” Pal notes. However, he also says that problems that were found were not especially serious. “It was a lot of details, but similar to any organization-wide transfer.”

Pal says that as Anthem worked toward compliance, it took a stance on technology that he summed up as “buy vs. build.” Effectively, he says, when Anthem discovered an obstacle blocking it from being compliant, the companys first move was to see if there was an existing solution that could be brought in to resolve the issue.

Pal notes that Anthems philosophy toward HIPAA compliance also played a role in its decision. As the company was absorbing the various rules and regulations involved with HIPAA, it made sure to take the most conservative stance possible on the requirements. This directive came from the top executive of the company, Anthem CEO Larry Glasscock, says Pal.

For Aetna, Laberge says that while there may have been some problems getting into compliance, none of them was especially notable. One of the main reasons for the smooth process now, he notes, is that insurers have been through the process of achieving compliance already. “Because this is the fifth of the five, weve figured out what were doing and what to expect.”

Looking forward, neither Pal nor Laberge expects any serious problems on their paths toward compliance. Pal notes that there is still time for the rulemaking bodies to fine-tune the HIPAA requirements and that Anthem was watching for “what other surprises are around the corner.”

Laberge notes, however, that another more technical problem could arise as insurers such as Aetna deal with claims. Some small hospital chains or physicians practices may not have the resources to achieve compliance with HIPAA, such as a dedicated IT department or a solid computer network, and may have received an extension of the compliance deadline from the government.

Additionally, Laberge notes that while HIPAA is a federal mandate covering the entire country, several states have added on their own rules. “Were a heavily regulated industry,” he says, “and we want to make sure were fully compliant.”

Reproduced from National Underwriter Edition, October 14, 2004. Copyright 2004 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.