Will HIPAA Cause Y2K-Like Resource Drain?

Hopes that the Bush administration would adopt a more industry-favorable posture on healthcare privacy regulation were dampened by an announcement last month by Health and Human Services (HHS) Secretary Tommy G. Thompson that the Department would immediately begin implementation of the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. Combine HIPAA with privacy provisions in Gramm-Leach-Bliley (GLB), and insurers may face a strain on technology resources.

The HIPAA privacy rule was published by HHS on Dec. 28, 2000, following an executive order from President Clinton. Promulgation was delayed in January when President George W. Bush ordered a 60-day suspension of some federal rules issued by President Clinton.

Thompson characterized the implementation of the rule as "a bold and definitive step to protect the rights of citizens to keep their medical records confidential."

The message for the insurance industry, according to Marty Abrams, executive director of law firm Hunton & Williams' Center for Information Policy Leadership (Atlanta), is that the Bush administration's "default position" will be to show greater concern for consumer privacy than to business process concerns than might have been expected of a Republican administration. "The administration sees it in a very simple consumer/business-type balancing position, which means that, at this point, there is not great sensitivity to the concerns of industry trying to reach full implementation of the HIPAA regulations," he says.

Insurers will face high costs to achieve compliance, says Lisa Sotto, a partner at Hunton & Williams, adding that the task is exacerbated by the need to adopt state rules and regulations to meet a July 1 deadline for compliance with the GLB's provisions for financial information privacy. "I think the insurance industry has the hardest time of anybody right now, because of the confluence of NAIC National Association of Insurance Commissioners' recommendations and HIPAA and state law."

Abrams comments, "Folks in banking found the implementation of GLB was more complicated than Y2K. If you have to implement GLB and HIPAA at the same time, you've got huge data-processing costs."

However, Julie Gackenbach, director of government relations, National Association of Independent Insurers (NAII, Washington, DC), says that while many in the insurance business will be disappointed by the HHS announcement, there may still be room for hope. "It may not be as much as everybody had hoped for, but I think we can still work on some changes with the Department," she says. If Thompson's guidelines are found unsatisfactory in the industry, Gackenbach adds, "I think everyone involved is going to see how far they can go and then may possibly look to Congress for some additional changes."

Anthony O'Donnell has covered technology in the insurance industry since 2000, when he joined the editorial staff of Insurance & Technology. As an editor and reporter for I&T and the InformationWeek Financial Services of TechWeb he has written on all areas of information ... View Full Bio