Administrative Simplification; Adoption of Standards for Health Care Claims Attachments Transactions and Electronic Signatures

Federal RegisterMar 24, 2026

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 162

[CMS-0053-F]

RIN 0938-AT38

Administrative Simplification; Adoption of Standards for Health Care Claims Attachments Transactions and Electronic Signatures

AGENCY:

Office of the Secretary, Department of Health and Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

This final rule implements requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010, enacted on March 30, 2010—collectively, the Affordable Care Act. Specifically, this final rule adopts standards for health care claims attachments transactions, which will support health care claims transactions, and a standard for electronic signatures to be used in conjunction with health care claims attachments transactions.

DATES:

Effective Date:

This final rule is effective on May 26, 2026. The incorporation by reference of certain material listed in this rule is approved by the Director of the Federal Register as of May 26, 2026.

Compliance Date:

Compliance with these regulations is required by May 26, 2028.

FOR FURTHER INFORMATION CONTACT:

Geanelle G. Herring, (410) 786-4466.

Shaheen Halim, (410) 786-0641.

Shelley Harrow, (410) 786-6875—Regulatory Impact Analysis.

Christopher Wilson, (410) 786-3178.

SUPPLEMENTARY INFORMATION:

I. Executive Summary

A. Purpose/Need for the Regulatory Action

Despite the health care industry's widespread use of electronic health records (EHR) and broad implementation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) transaction standards, the exchange of health care claims attachments has remained largely manual, frequently relying on fax, mail, or portal uploads. This final rule adopts standards for the electronic exchange of clinical and administrative documentation to support claims-related processes. Standardizing health care claims attachment transactions is intended to reduce administrative burden and improve data exchange efficiency between health plans and health care providers.

B. Summary of the Provisions

This final rule implements requirements of the Administrative Simplification subtitle of HIPAA and the Affordable Care Act. Specifically, this final rule adopts definitions of “attachment information” and “electronic signature” in 45 CFR 162.103 and “health care claims attachments transaction” in § 162.2001. This rule also adopts standards for health care claims attachments transactions in § 162.2002(a) through (d) and standards for electronic signatures, to be used in conjunction with health care claims attachments transactions, in § 162.2002(e).

In this final rule, we are adopting the following X12N standards and Health Level 7 (HL7®) implementation guides (IG) for use by covered entities in health care claims attachments transactions:

• X12N 277—Health Care Claim Request for Additional Information [006020X313].

• X12N 275—Additional Information to Support a Health Care Claim or Encounter [006020X314].

•

HL7 IG for Clinical Document Architecture (CDA) Release 2:

Consolidated CDA (C-CDA) Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume One—Introductory Material, June 2019 with Errata (HL7 C-CDA IG Volume One).

•

HL7 IG for CDA Release 2:

C-CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume Two—Templates and Supporting Material, June 2019 with Errata (HL7 C-CDA IG Volume Two).

•

HL7 CDA Release 2 Attachment IG:

Exchange of C-CDA Based Documents, Release 2, March 2022 (HL7 Attachments IG).

The proposed rule that preceded this final rule named an earlier iteration of this HL7 Attachments IG (Release 1, March 2017). The iteration of the HL7 Attachments IG named in this final rule (Release 2, March 2022) contains cumulative technical updates that are defined as “maintenance.” Additional discussion regarding this can be found in section III.E. of this final rule.

•

HL7 IG for CDA Release 2:

Digital Signatures and Delegation of Rights, Release 1 (Digital Signatures Guide).

C. Summary of the Differences Between the Notice of Proposed Rulemaking and Final Rule

The proposed rule included proposals to support both health care claims and prior authorization transactions, as well as a standard for electronic signatures to be used in conjunction with these transactions. Commenters expressed broad support for the HHS proposal to adopt health care claims attachment standards. Conversely, commenters overwhelmingly expressed two concerns about the proposals for prior authorization attachments standards: (1) potential misalignment when paired with the currently mandated X12N 278 transaction standard for prior authorization; and (2) potential misalignment between HHS's proposed attachment standard for prior authorization transactions with the requirements in CMS's then-proposed, but now finalized, rule titled: “CMS Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program final rule” (hereinafter referred to as the CMS Interoperability and Prior Authorization final rule) (89 FR 8758). Upon considering these comments, along with further analysis and consultations with standard setting organizations (SSO), we have elected not to finalize health care attachments standards supporting prior authorization transactions at this time.

In the proposed rule, we proposed the adoption of the 2017 iteration of one of the IGs (the HL7 CDA Release 2 Attachment IG: Exchange of C-CDA Based Documents, Release 1, March 2017) (HL7 Attachments IG) (87 FR 78438). Based on the comments received, we examined the history of changes to the HL7 Attachments IG and determined that the cumulative changes in the March 2022 iteration constitute “maintenance updates” because they refine the IG's existing content rather than adding new content. Further consultation with the designated standards maintenance organization (DSMO) indicates that the maintenance updates reflected in the March 2022

iteration of the HL7 Attachments IG better facilitate the implementation of Version 6020 of the X12N 275 and X12N 277 standards for claims attachment, which the Secretary of Health and Human Services (the Secretary) is adopting in this final rule. Therefore, this final rule adopts the March 2022 iteration of the HL7 Attachments IG rather than the proposed March 2017 iteration.

D. Summary of Costs and Savings

Based on the estimates included in the Regulatory Impact Analysis (RIA), the primary net annualized cost, discounted at 7 percent, to the industries is approximately $303.75 million. This estimate includes the difference between the primary net annualized costs of $478.23 million, which includes the regulatory review costs of $14.13 million, and primary net annualized savings of $781.98 million.

II. Background

This background discussion presents a history of statutory provisions and regulations relevant to this final rule.

A. Legislative Authority for Administrative Simplification

1. Standards Adoption and Modification Under the HIPAA Administrative Simplification Provisions

Congress addressed the need for a consistent framework for electronic transactions and other administrative simplification issues in HIPAA (Pub. L. 104-191, enacted on August 21, 1996). Through subtitle F of title II of HIPAA, Congress added to title XI of the Social Security Act (the Act) a new Part C, titled: “Administrative Simplification,” which required the Secretary to adopt standards for certain transactions to enable health information to be exchanged more efficiently and to achieve greater uniformity in the transmission of health information. For purposes of this and later discussion in this final rule, we sometimes refer to this statute as the “original” HIPAA provisions.

Section 1172(a) of the Act provides that any standard adopted by the Secretary under the HIPAA Administrative Simplification provision shall apply, in whole or in part, to the following persons, referred to as “covered entities”: (1) a health plan; (2) a health care clearinghouse; and (3) a health care provider who transmits any health information in electronic form in connection with a HIPAA transaction. In general, section 1172 of the Act provides that any standard adopted under HIPAA is to be developed, adopted, or modified by an SSO. The statute requires consultation with four organizations named at section 1172(c)(3)(B) of the Act. In adopting a standard, section 1172(f) of the Act requires the Secretary to rely upon recommendations of the National Committee on Vital and Health Statistics (NCVHS) and consult with appropriate federal and state agencies and private organizations.

Section 1172(b) of the Act provides that a standard adopted under HIPAA must be consistent with the objective of reducing the administrative costs of providing and paying for health care. The transaction standards adopted under HIPAA enable financial and administrative electronic data interchange (EDI) using a common structure, as opposed to the many varied, often proprietary, transaction formats on which the industry had previously relied. This lack of uniformity across transaction formats engendered an administrative burden.

Section 1173(g)(1) of the Act, which was added by section 1104(b) of the Affordable Care Act, further addresses the goal of uniformity by requiring the Secretary to adopt a single set of operating rules for each transaction. These operating rules are required to be consensus-based and reflective of the necessary business rules and operations affecting both health plans and health care providers.

Section 1173(a) of the Act provides that the Secretary must adopt standards for financial and administrative transactions, and data elements for those transactions, to enable health information to be exchanged electronically. The original HIPAA provisions require the Secretary to adopt standards for the following transactions: (1) health claims or equivalent encounter information; (2) health claims attachments; (3) enrollment and disenrollment in a health plan; (4) eligibility for a health plan; (5) health care payment and remittance advice; (6) health plan premium payments; (7) first report of injury; (8) health claim status; and (9) referral certification and authorization (prior authorization). Section 1104(b)(2)(A) of the Affordable Care Act added the requirement for the Secretary to adopt a standard for electronic funds transfers. Additionally, section 1173(a)(1)(B) of the Act requires the Secretary to adopt standards for any other financial and administrative transactions the Secretary determines appropriate.

Sections 1173(c) through (f) of the Act provide that the Secretary must adopt standards that: (1) select or establish code sets for appropriate data elements for each listed health care transaction; (2) address and ensure security for health care information; (3) specify procedures for electronic signatures in coordination with the Secretary of Commerce, compliance with which will be deemed to satisfy both state and federal statutory requirements for written signatures for the listed transactions; and (4) address the transmission of appropriate standard data elements needed for the coordination of benefits, sequential processing of claims, and other data elements for individuals who have more than one health plan. Section 1174 of the Act requires the Secretary to review the adopted standards and adopt modifications to them, including additions to the standards as appropriate, but not more frequently than once every 12 months.

Section 1175 of the Act prohibits health plans from refusing to conduct a transaction as a standard transaction.

It also prohibits health plans from delaying a transaction or adversely affecting, or attempting to adversely affect, a person or the transaction itself on the grounds that the transaction is in a standard format. Additionally, it establishes a timetable for covered entities to comply with any standard, implementation specification, or modification as follows: (1) for an initial standard or implementation specification, no later than 24 months following its adoption; and (2) for modifications, as the Secretary determines appropriate, but no earlier than 180 days after the modification is adopted.

See 45 CFR 162.103 for the definition of standard transaction.

Sections 1176 and 1177 of the Act establish civil money penalties (CMP) and criminal penalties to which covered entities may be subject, for violations of HIPAA Administrative Simplification provisions. The Department of Health and Human Services (HHS) administers the CMPs under section 1176 of the Act, while the U.S. Department of Justice administers the criminal penalties under section 1177 of the Act. Section 1176(b) of the Act sets out limitations on the Secretary's authority and provides the Secretary certain discretion with respect to imposing CMPs. For example, section 1176(b)(1) provides that no CMPs may be imposed with respect to an act if a penalty has been imposed under section 1177 of the Act with respect to such an act. Section 1176(b)(2)(A) generally precludes the Secretary from imposing a CMP for a violation corrected during the 30-day

period beginning when an individual knew or, by exercising reasonable diligence, would have known that the failure to comply occurred. The original HIPAA provisions are discussed in greater detail in the August 17, 2000 Health Insurance Reform: Standards for Electronic Transactions final rule (65 FR 50312) (hereinafter referred to as the Transactions and Code Sets final rule), and the December 28, 2000 Standards for Privacy of Individually Identifiable Health Information final rule (65 FR 82462). We refer readers to those documents for further information.

2. Affordable Care Act Amendments to HIPAA Administrative Simplification

Section 1104(c)(3) of the Affordable Care Act reiterated the original HIPAA requirement to adopt a health claims attachment standard, and directed the Secretary to promulgate a final rule to establish a transaction standard and a single set of associated operating rules.

Section 1104(c)(3) of the Affordable Care Act requires that the adopted standard be “consistent with the X12 Version 5010 transaction standards,” provides that the Secretary must adopt the standard and operating rules by January 1, 2014, to be effective no later than January 1, 2016, and that the Secretary may adopt the standard and operating rules on an interim final basis. We interpret the 24 month “effective date” under section 1104(c)(3) of the Affordable Care Act to mean that the compliance date for covered entities should be 24 months after the effective date of this final rule. Unlike the original HIPAA provisions, the Affordable Care Act provision makes no allowance for an extended period for small health plans to achieve compliance.

As we noted in the Administrative Simplification: Adoption of Standards for Health Care Attachments Transactions and Electronic Signatures, and Modification to Referral Certification and Authorization Transaction Standard proposed, at that time CAQH CORE had developed operating rules for attachments but the NCVHS had yet to evaluate them and make a recommendation to the Secretary, thus they were not proposed for adoption (87 FR 78445).

B. Prior Rulemaking

In the Transactions and Code Sets final rule (65 FR 50312), we implemented some of the HIPAA Administrative Simplification requirements by adopting standards for electronic transactions developed by SSOs, and medical code sets to be used in those transactions. We adopted X12 Version 4010 standards for administrative transactions, and the National Council for Prescription Drug Programs (NCPDP) Telecommunication Version 5.1 standard for retail pharmacy transactions, which were specified at 45 CFR part 162, subparts K through R.

Since then, we have adopted several modifications to the HIPAA standards, including in the Health Insurance Reform: Modifications to the Health Insurance Portability and Accountability Act (HIPAA) Electronic Transaction Standards final rule (hereinafter referred to as the Modifications final rule) which appeared in the January 16, 2009

Federal Register

(74 FR 3296). That rule, among other things, adopted updated versions of the standards, X12 Version 5010, and the NCPDP Telecommunication Standard Version D.0 and equivalent Batch Standard, Version 1, Release 2. We also adopted the NCPDP Batch Standard Version 3.0 for the Medicaid pharmacy subrogation transaction. Covered entities were required to comply with Version 5010, Version D.0, and Version 3.0 standards on January 1, 2012, though with respect to the latter, small health plans were required to comply on January 1, 2013.

In the HIPAA Administrative Simplification: Standards for Electronic Health Care Claims Attachments proposed rule (hereinafter referred to as the Standards for Electronic Health Care Claims Attachments proposed rule), which appeared in the September 23, 2005

Federal Register

(70 FR 55990), we proposed to adopt certain health care claims attachments standards. As opposed to a standard with generalized applicability, that proposed rulemaking proposed to adopt health care claims attachment standards with respect to specific services, including ambulance services, clinical reports, emergency department, laboratory results, medications, and rehabilitation services. However, public comments we received on those proposals persuasively argued that the standards lacked technical maturity and that interested parties were not ready to implement the electronic exchange of clinical data, so we did not finalize adopting them.

HHS issued a proposed rule titled: Administrative Simplification: Adoption of Standards for Health Care Attachments Transactions and Electronic Signatures, and Modification to Referral Certification and Authorization Transaction Standard that appeared in the December 21, 2022

Federal Register

(87 FR 78438) (hereinafter referred to as the HIPAA Standards for Health Care Attachments proposed rule). In that proposed rule, we proposed new requirements for HIPAA covered entities that we believed would improve the electronic exchange of health information and a new electronic signature standard. We provided a 90-day public comment period.

We later issued a correcting document titled: Administrative Simplification: Adoption of Standards for Health Care Attachments Transactions and Electronic Signatures, and Modification to Referral Certification and Authorization Transaction Standard; Correction, which appeared in the March 17, 2023

Federal Register

(88 FR 16392) (hereinafter referred to as the HIPAA Standards for Health Care Attachments proposed rule correction notice). That notice corrected typographical and technical errors in the HIPAA Standards for Health Care Attachments proposed rule by conforming the proposed regulations text to the proposed policies discussed in the preamble.

Subsequently, we extended the public comment period for the proposed rule by another 30 days via a notice that appeared in the March 24, 2023

Federal Register

titled: “Adoption of Standards for Health Care Attachments Transactions and Electronic Signatures, and Modification to Referral Certification and Authorization Transaction Standard: Extension of Comment Period” (88 FR 17780). We believed it was important for the public to have the opportunity to review and comment on the corrected proposed rule because most of the corrections to the proposed rule were in the regulation text.

In the HIPAA Standards for Health Care Attachments proposed rule (87 FR 78445), we proposed to adopt attachments standards that would apply to health care claims or equivalent encounter transactions and to referral certification and authorization (prior authorization) transactions.

In this final rule, HHS adopts standards only for health care claims attachments transactions or equivalent encounter transactions, which will support health care claims transactions. HHS further adopts a standard for electronic signatures to be used in conjunction with health care claims attachments transactions. We thus refer to the attachment standards being adopted in this final rule as “health care claims attachment standards.” In section III.A.

of this final rule, we explain why we elected not to move forward with the proposals to adopt an attachments standard for prior authorization transactions.

We clarify that, in this final rule, we frequently use the shorthand “health care claims” to speak of health care claims or equivalent encounter information transactions under 45 CFR 161.1101. We note that attachments would most likely be requested for health care claims (§ 161.1101(a)) involving payment, rather than for “equivalent encounter information” transactions (§ 161.1101(b)) involving the “transmission of encounter information for the purpose of reporting health care.”

C. Standards and Code Sets Organizations

The HIPAA Standards for Health Care Attachments proposed rule presented information about the organizations responsible for developing and maintaining the transaction standards and code sets that we are adopting in this final rule. Information about each organization's balloting process—the process by which they vet and approve the products they develop and changes thereto—is available on their respective websites. We provide links to these websites in this section.

As we stated previously, the law requires any standard adopted under HIPAA to be developed, adopted, or modified by an SSO. Section 1171 of the Act provides that an SSO is an organization accredited by the American National Standards Institute (ANSI) that develops standards for information transactions, data elements, or any standard that is necessary to, or will facilitate the implementation of, administrative simplification. Pursuant to section 1172(c)(3) of the Act, a HIPAA SSO must develop, adopt, and modify standards in consultation with certain organizations: the National Uniform Billing Committee (NUBC), National Uniform Claim Committee (NUCC), Workgroup for Electronic Data Interchange (WEDI), and American Dental Association (ADA). The two SSOs associated with this final rule are the Accredited Standards Committees (ASC) X12 and HL7, both of which maintain websites where the required IGs may be obtained. One other organization, the Regenstrief Institute (Regenstrief), a health research institution and not an SSO, maintains a code set named Logical Observation Identifiers Names and Codes (LOINC), which is important to this rulemaking.

1. X12

X12. (n.d.). Retrieved from

https://X12.org/.

The first SSO associated with this final rule is X12, which develops and maintains standards for the electronic exchange of business-to-business transactions. An ANSI-accredited organization, X12 membership is open to all individuals and organizations. An X12 subcommittee known as Subcommittee N: Insurance (X12N) develops and maintains electronic standards specific to the insurance industry, including, but not limited to, health insurance. Comprised of volunteers, X12N develops standards for electronic health care transactions for common administrative activities including: (1) claims; (2) remittance advice; (3) claims status; (4) enrollment; (5) eligibility; (6) authorizations and referrals; and (7) electronic health care claims attachments. X12N is responsible for obtaining consensus on the standards from the entire organization and producing draft documents that it makes available for public review and comment, which it addresses as necessary before voting on any proposal. Proposals must then be reviewed and ratified by a majority of the X12N voting members and X12's executive committee.

2. HL7

Health Level Seven International. (n.d.). Retrieved from

https://www.HL7.org/.

The second SSO associated with this final rule is HL7, an ANSI-accredited SSO that develops and maintains standards for the exchange, integration, sharing, and retrieval of electronic health information that supports clinical practice and the management, delivery, and evaluation of health services. Its domain is principally clinical data, and its specific emphasis is the interoperability between health care information systems. HL7's membership is open to all individuals and organizations, and it focuses its interface requirements on the entire health care industry, not just a subset of it.

HL7 conducts a multi-step process called balloting to solicit feedback and comments on standards and specifications prior to publication.

A technical committee, such as a workgroup, develops the standard or specifications, which is then submitted for consideration under the balloting process. All HL7 members are eligible to vote and submit feedback on standards, regardless of whether they are members of the committee that developed the standard. Non-members may also vote on a given ballot for a standard, though to do so they must pay an administrative fee. After reviewing feedback received during voting, HL7 technical committees vote on “recommendations,” which require a two-thirds majority for approval. HL7 standards are available to the public on its website, and the website also describes in more detail HL7's balloting process.

HL7 standards are free and open source, and documentation is available to anyone to ensure that all implementers can equally access information.

Health Level Seven International. (n.d.). HL7 Balloting. Retrieved from

https://confluence.hl7.org/display/HL7/HL7+Balloting.

Health Level Seven International. (n.d.). Retrieved from

https://www.hl7.org/.

3. The Regenstrief Institute (Regenstrief)

Logical Observation Identifiers Names and Codes from Regenstrief. (n.d.). Retrieved from

https://loinc.org/.

Regenstrief is a health research institution that develops and maintains a code set, LOINC, which is the code system, terminology, and vocabulary for identifying individual clinical results and other clinical information. Regenstrief supports the development of a code system for attachments use cases and works closely with the HL7 Payer/Provider Information Exchange (PIE) Work Group (formerly known as the Attachments Work Group) to develop a set of LOINC codes to uniquely indicate the type and content of attachment information in electronic transmissions. Regenstrief maintains LOINC through its LOINC Committee, which is composed of volunteer representatives from academia, industry, and government who serve as subject matter experts in their domains of expertise. That committee establishes overall naming conventions and policies for the development process.

D. Industry Standards, Code Sets, and IGs

1. Electronic Data Interchange (EDI) and Transaction Standards

In the HIPAA Standards for Health Care Attachments proposed rule, we discussed how HIPAA transactions involve the electronic transmission of information between two parties to carry out health care-related financial or administrative activities (87 FR 78441). These activities include health insurance claims submissions and prior authorization requests, and HIPAA standards for those transactions require uniformity for EDI of those transmissions.

The benefit of HIPAA standards is that they use a common interchange structure, eliminating covered entities' need to have information technology (IT) systems that accommodate multiple proprietary, and potentially continually changing, data formats. The interchange structure uniformity enables covered entities to exchange medical, billing, and other information to process transactions more expeditiously and cost-effectively, reduces handling and processing time, and eliminates the risk of lost paper documents, thereby reducing administrative burdens,

lowering operating costs, and improving overall data quality.

HIPAA transaction standards specify: (1) data interchange structures (message transmission formats); and (2) data content (all of the data elements and code sets inherent to a transaction and not related to the format of the transaction). Implementation specifications detail the nature, location, and content format of each piece of information transmitted in a transaction. Standardization of transactions also involves: (1) specification of the data elements that are exchanged; (2) uniform definitions of those specific data elements in each type of electronic transaction; (3) identification of the specific codes or values that are valid for each data element; and (4) specification of the business actions each party must take to ensure the exchange of administrative transactions occurs smoothly and reliably, regardless of the technology employed.

a. IGs—X12

As discussed in section II.C.1. of this final rule, X12 develops and maintains standards for the electronic exchange of business-to-business transactions. X12N publishes transmission standards that apply to many lines of insurance business. For example, the X12N 820 message format for premium payment may be used for automobile and casualty insurance. X12 implementation specifications, referred to by the industry as IGs and written collaboratively by X12N workgroups, make these general standards functional for industry-specific uses. The specifications are based on X12 standards, but contain detailed instructions for using the standard to meet a specific business need. X12's implementation specifications for HIPAA transaction standards adopted by the Secretary are known as “Technical Reports Type 3” (TR3). Each X12N IG has a unique version identification number represented in a parenthetical, where the highest version number represents the most recent version. HHS adopted the then-updated Version 5010 of the X12 standards in the Modifications final rule (74 FR 3296), while this final rule adopts Version 6020 of the X12N 275 and X12N 277 standards, the rationale for which we discuss in section III. of this final rule.

b. IGs—HL7

HL7's PIE Workgroup develops standards for electronic health care attachments. The workgroup, which includes industry experts representing health care providers, health plans, and health technology vendors, is also responsible for creating and maintaining the IGs. The IGs are sets of instructions and associated code tables that describe, list, or itemize the content, format, and code to be sent, and specify how such information is to be conveyed in an electronic health care attachment.

The HL7 CDA is an XML-based (a computer programming language) markup standard that specifies the encoding, structure, and semantics of clinical documents for purposes of transmitting attachment information. XML-coded files have the same characteristics and information as hard copy documents, so regardless of how data are sent within a transaction, they can be read and processed by both people and machines. An important feature of the CDA standard is that it allows the entire body of an electronic document to be replaced by an image, for example, a scanned copy of a page or pages from a medical record. That permits the clinical content to be conveyed by an image or text document, but a header still supports automated document management. The CDA header contains standardized, machine-readable data elements, such as document type, patient and provider identifiers, and service dates that enable health information technology (health IT) systems to automatically route, index, associate, and manage attachment documents even when the document body consists of images or other non-structured content. This feature of the CDA standard is relevant because it accommodates health care attachments that may not be conducive to XML formatting, such as medical imaging, video, or audio files.

HL7 also produces the C-CDA standard that provides specifications for formatting document templates, depending on whether they are structured or unstructured, enabling the CDA to create numerous specific document types, known as templates. The HL7 C-CDA IG document templates are designed to be electronic versions of the most common types of paper document attachment information. Attachment information not included in a template may be created by using instructions included in the finalized unstructured document IG; supported unstructured formats include MSWORD, PDF, Plain Text, RTF Text, HTML Text, GIF Image, TIF Image, JPEG Image, and PNG Image.

2. Code Sets

Transaction data content standardization involves identifying the specific codes or values for each data element. Health care EDI requires many types of code sets, including large medical data code sets and classification systems for medical diagnoses, procedures, and drugs, and smaller code sets to identify categories, such as facility type, currency, units, or a state within the United States. Large data code sets include those developed and maintained by federal agencies, such as the Centers for Medicare & Medicaid Services' (CMS) Healthcare Common Procedure Coding System (HCPCS), and by private organizations, such as the American Medical Association's (AMA) Current Procedural Terminology (CPT®) and the ADA's Code on Dental Procedures and Nomenclature (CDT Code).

10 11

These code sets have been adopted through rulemaking under HIPAA in the Transactions and Code Sets final rule (65 FR 50312) and are mandated for use in federal and state health care programs, such as Medicare, Medicaid, and the Children's Health Insurance Program (CHIP). SSOs require or permit their use in their standards.

CPT® is a registered service mark of the American Medical Association.

The CDT code set is a proprietary code set.

3. IGs as HIPAA Standards

Section 1172(d) of the Act directs the Secretary to establish specifications for implementing each of the adopted standards. As we explained previously, SSOs have developed IGs by which to implement the same standards for different business purposes. In the HIPAA Standards for Health Care Attachments proposed rule, we proposed an approach we have taken with previous HIPAA Rules that adopted a specific IG as both the “standard” and the “implementation specifications” for each health care transaction (87 FR 78442).

In pursuing this approach, we were mindful that section 1104(c)(3) of the Affordable Care Act requires that the Secretary promulgate a final rule to establish a transaction standard and a single set of operating rules for health care attachments that is “consistent with the X12 Version 5010 transaction standards.” We interpreted this requirement to mean that the proposed health care attachment implementation specifications must be compatible with X12 standards generally, meaning any standard we adopt for attachment information can be electronically transmitted by an X12 transmission standard in the same transaction (87 FR 78442). The Affordable Care Act was enacted in 2010, at which time we had adopted Version 5010 of the X12 standards. A decade later, we

interpreted the Affordable Care Act's mandate as referencing the then-current standards—the X12 Version 5010—but not specifically requiring adherence in perpetuity to a static standard, which would contravene the HIPAA standards paradigm that is premised on standards evolution over time and be contrary to logic as X12 continues to publish newer versions of its standards. Therefore, in the HIPAA Standards for Health Care Attachments proposed rule, we proposed to adopt Version 6020 of certain X12 standards (87 FR 78447).

Additionally, we proposed to adopt transaction standards that can be used together in a single electronic transmission (87 FR 78447 through 78449). HL7 standards can work in conjunction with other standards like X12. The HIPAA covered entities who would use the health care claims attachment standard are currently using X12 transaction standards, so adoption of a health care claims attachment standard using X12 standards, which are being finalized in this final rule, should have minimal impact on covered entities.

Separately, we are also aware that SSOs are developing and piloting other types of standards. In the HIPAA Standards for Health Care Attachments proposed rule, we solicited public comment on this and any alternative implementation specifications that may be considered compatible with X12 Version 5010 (87 FR 78442). Commenters were supportive of our proposals pertaining to claims attachments, however, commenters expressed concerns about the proposals to include prior authorization within the attachment transaction. Commenters identified additional standards for consideration, specifically the HL7 Fast Healthcare Interoperability Resources (FHIR®) standard.

We summarize the alternatives that commenters recommended we consider, and provide our full response to these comments, in section III.D.2. of this final rule.

Health Level Seven International. (2023). Guide to Using HL7 Trademarks. Retrieved from

http://www.hl7.org/legal/trademarks.cfm?ref=nav.

HL7 requires the registered trademark with the first use of its name in a document, for which policies are available on its website at

www.HL7.org.

E. The NCVHS Recommendations to the Secretary

In the proposed rule, we stated that the NCVHS is a statutorily designated advisory committee that provides the Secretary with recommendations on health information policy and standards (87 FR 78447).

Among the ways it does so is by convening regular forums with industry groups on key issues related to population health, standards, privacy and confidentiality, and data access and use. Pursuant to HIPAA, the NCVHS advises the Secretary on the adoption of standards, implementation specifications, code sets, identifiers, and operating rules for HIPAA transactions. For readers' reference, we include here the process discussion also found in the HIPAA Standards for Health Care Attachments proposed rule.

At the time this final rule was being drafted, the NCVHS website was undergoing maintenance. National Committee on Vital and Health Statistics. (n.d.). Retrieved from

https://ncvhs.hhs.gov/.

Website references herein to NCVHS recommendation and artifacts reflect access made prior to the initiation of maintenance mode and also appeared in the proposed rule. Current inquiries seeking NCVHS recommendation letters and other artifacts referenced herein should be directed to:

FACMT@cdc.gov.

The NCVHS held a number of hearings and made several sets of recommendations to the Secretary on claims attachment standards, which are reflected in the administrative record and described in prior

Federal Register

notices. For example, the HIPAA Standards for Health Care Attachments proposed rule discusses the NCVHS subcommittee hearings, correspondence to the Secretary, and its March 30, 2022 recommendation urging prompt adoption of a claims attachments standard (87 FR 78443 and 78444).

The NCVHS Standards Subcommittee held a November 17, 2011 hearing on health claims attachments to gather information regarding new business needs, priorities, issues, and challenges. Participant testimony addressed the development status of standards and implementation specifications. Some organizations testified regarding their interest in serving as attachments operating rules authoring entities. In a letter to HHS dated March 2, 2012, the NCVHS Subcommittee on Standards advised HHS that it was premature to make formal recommendations regarding the adoption of any standard, implementation specification, or operating rule associated with health care attachments.

On May 5, 2012, the NCVHS recommended that the Council for Affordable Quality Healthcare (CAQH), a nonprofit entity whose stated mission is to improve the efficiency, accuracy, and effectiveness of industry-driven business transactions, be designated as the operating rules authoring entity.

National Committee on Vital and Health Statistics. (2012, March 2). Claim Attachments. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2014/05/120302lt1.pdf.

National Committee on Vital and Health Statistics. (2021, May 5). Recommendations to Designate an Authoring Entity and Ensure Industry Collaboration for the Development of Operating Rules for Health Care Administrative Transactions. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2014/05/120505lt.pdf.

The NCVHS Subcommittee held a second hearing on health claims attachments on February 27, 2013, where it identified a trend toward convergence of administrative and clinical information. In a June 21, 2013 letter, the NCVHS recommended that the Secretary adopt a number of initial attachments-related transaction standards by January 1, 2016 (the date by which the Affordable Care Act required claims attachment standards to be effective), but advised HHS to take a comprehensive and incremental approach to considering attachment standards to promote innovation and flexibility.

The NCVHS noted there was industry consensus that adoption of standards should not be limited to “claim attachments,” but, rather, should be more inclusive of any kind of attachment with administrative or clinical information. It recommended that attachments-related transaction standards should be applied to claims, eligibility, prior authorization, referrals, care management, post-payment audits, and any other administrative processes for which supplemental information is needed. Among other recommendations, the NCVHS advised HHS that attachment standards should support structured and unstructured data, and both solicited and unsolicited transmissions. It further advised that attachments standards should be defined for two types of transactions: (1) Query (the electronic solicitation of an attachment); and (2) Response (the electronic transmission of an attachment). The NCVHS held another hearing on health care attachments on February 15, 2016, and on July 5, 2016 sent the Secretary a letter titled: “Recommendations for the Electronic Health Care Attachment Standard.”

This letter consolidated its previous recommendations on attachments and advised that updated versions of the available standards were ready for industry use, and there was unanimous testimony that the health care industry was eager to see them adopted. The NCVHS recommended that HHS complete additional rulemaking to adopt the recommended standards

considering the length of time that had elapsed since the 2005 publication of the previous, and, ultimately, premature Standards for Electronic Health Care Claims Attachments proposed rule (70 FR 55990), and subsequent technology advancement and stakeholder readiness.

National Committee on Vital and Health Statistics. (2013, June 21). Attachments Standards for Health Care. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2014/05/130621lt2.pdf.

National Committee on Vital and Health Statistics. (2016, July 5). Recommendations for the Electronic Health Care Attachment Standard. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2018/03/2016-Ltr-Attachments-July-1-Final-Chair-CLEAN-for-Submission-Publication.pdf.

On March 30, 2022, the NCVHS sent the Secretary a letter titled: “Recommendations to Modernize Aspects of HIPAA and Other HIT [(Health Information Technology)] Standards to Improve Patient Care and Achieve Burden Reduction.”

This letter continued to stress previous recommendations urging the Secretary to adopt a standard for electronic attachments as soon as possible, and also stated—

National Committee on Vital and Health Statistics. (2022, March 30). Recommendations to Modernize Aspects of HIPAA and Other HIT Standards to Improve Patient Care and Achieve Burden Reduction. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2022/04/Recommendation-Letter-HIT-Standards-Modernization-to-Improve-Patient-Care-March-30-2022.pdf.

We recognize that there is ongoing debate and no definitive industry consensus about the role of attachments (

i.e.,

documents) as opposed to data (

i.e.,

a string of data elements not structured within a document). While the vision with APIs [(Application Programming Interfaces)] based on FHIR seem to be driving toward more of a data-driven transaction, we see more than sufficient industry demand for a document-based attachment standard, and we do not foresee any imminent demise of the utility of digital documents. We suggest short-term publication of an attachment rule, with consideration for emerging standards based on recent input from industry and other advisory group discussions. This could add immediate value for industry and could support future actions as HIPAA's procedural requirements may be updated to allow for non-document type digital attachment data.

https://ncvhs.hhs.gov/wp-content/uploads/2022/04/Recommendation-Letter-HIT-Standards-Modernization-to-Improve-Patient-Care-March-30-2022.pdf.

Based on the NCVHS's previous recommendations to the Secretary, and particularly in consideration of its most recent March 30, 2022 recommendation, we are finalizing adoption of a document-based attachments standard for healthcare claims or equivalent encounter transactions in this final rule.

F. Other Industry Recommendations

1. Consensus-Based Organization Support

Industry consensus-based organizations, which vet proposals before they are presented to the NCVHS, agree that the standards we proposed are sufficiently mature to support health care business needs. Both WEDI and the CAQH Committee on Operating Rules for Information Exchange (CORE) have described the benefits that adopting health care attachments standards would bring in automating and streamlining workflows that, today, are primarily manual processes and sources of significant administrative burden. We discussed their perspectives in the HIPAA Standards for Health Care Attachments proposed rule (87 FR 78443).

In May 2019, CAQH CORE issued a document titled: “Report on Attachments: A Bridge to a Fully Automated Future to Share Medical Documentation,” where it reported evidence from its 2018 environmental scan indicating a high degree of industry readiness and interest in the attachments standard.

The report noted that “the health care industry continues to wait for an electronic attachments standard that can simplify the exchange of necessary medical information and supplemental documentation.” Specifically, the report stated that “health plans, providers and vendors lack the direction needed to support broad use of automation in the attachment workflow, or for industry to coalesce around the use of even a small number of electronic solutions,” leading to largely manual, and often paper-based, processes, and ultimately underscoring the need to standardize electronic attachment exchange methods.

The Council for Affordable Quality Healthcare Committee on Operating Rules for Information Exchange. (2019). CAQH CORE Report on Attachments: A Bridge to a Fully Automated Future to Share Medical Documentation. Retrieved from

https://www.caqh.org/hubfs/43908627/drupal/core/core-attachments-environmental-scan-report.pdf.

2. Other Recent Public Comment Support

CMS published the Reducing Administrative Burden to Put Patients Over Paperwork request for information (RFI), which appeared in the

Federal Register

on June 11, 2019 (84 FR 27070). That RFI solicited public comment on ideas for regulatory, subregulatory, policy, practice, and procedural changes to reduce unnecessary administrative burdens for clinicians, providers, patients, and their families, with an aim to improve quality of care, lower costs, improve program integrity, and make the health care system more effective, simple, and accessible. To be clear, the RFI did not relate to, and was not for the purpose of, soliciting comments on HHS's efforts pertaining to HIPAA Administrative Simplification. Nevertheless, many commenters, including organizations representing physician provider groups, insurance payers, health technology vendors, health care financial managers, and health IT standard advisory bodies, called for the publication of a HIPAA electronic attachments proposed rule to be accelerated, as well as guidance on other standards, such as electronic signature protocols to achieve these goals. These commenters indicated that adoption of a HIPAA attachments standard could help reduce administrative burden in many clinical and administrative situations where documents need to be shared, and relieve providers of current burdensome, largely paper-based, processes.

In preparation for its August 25, 2020 Standards Committee Meeting, the NCVHS invited the public to provide feedback on the CAQH CORE operating rules for prior authorization transactions. In response, commenters expressed their support for the adoption of an attachment standard. Commenters also provided input on current standards development efforts underway to address prior authorization challenges, including recommendations for the Secretary to explore or allow the use of other standards or alternative approaches.

In that regard, we acknowledge there is a growing base of evidence that may support our adopting attachment standards that rely on emerging technologies, such as APIs. We refer readers to section III.D.2. of this final rule for a summary of public comments received on the proposed rule regarding emerging technologies, such as APIs, and our response to them.

National Committee on Vital and Health Statistics. (2020, August 25). NCVHS Standards Subcommittee on Standards Hearing on Request for NCVHS Review of CAQH CORE Operating Rules for Federal Adoption. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2020/09/Standards-Transcript-8-25-20Final-508.pdf.

III. Provisions of the Proposed Rule, Analysis of and Responses to the Public Comments Received, and Final Provisions

In response to the HIPAA Standards for Health Care Attachments proposed rule, which appeared in the December 21, 2022

Federal Register

(87 FR 78438), we received more than 120 timely pieces of correspondence commenting on health care claims and prior authorization attachments.

In general, commenters were supportive of HHS's efforts to adopt health care claims attachments standards that could potentially mitigate

longstanding issues pertaining to the manual transmission of health care claims attachments. Importantly, however, commenters recommended that HHS, at this time, adopt only standards for health care claims attachments transactions and

not

for prior authorization attachments transactions, as we had also proposed. We explain in this final rule that we are confining the scope of this rule's finalized policies to claims attachments transactions, and we explain our rationale for not finalizing our proposals to adopt the X12N 278 standard for prior authorization attachments transactions.

A. Decision Regarding the Adoption of X12N 278—Health Care Services Request for Review and Response (006020X315)

In the HIPAA Standards for Health Care Attachments proposed rule, we proposed to adopt Version 6020 of the X12N 278—Health Care Services Request for Review and Response (006020X315) as the standard a health plan must use to electronically request attachment information from a health care provider to support a prior authorization transaction (87 FR 78447). That standard, we noted, is unique in that it is also used for a health care provider's request for prior authorization, as reflected in § 162.1302(b)(2)(ii) (87 FR 78447). We also proposed to incorporate the same by reference in § 162.920. Version 6020 of the X12N 278 standard would have been a modification to the existing HIPAA transaction standard, as we previously adopted Version 5010 of the X12N 278 standard in the January 16, 2009 Modifications final rule (74 FR 3296).

The X12N 278 standard supports prior authorization transactions for health care that has yet to be rendered by the requesting provider, as well as responses from health plans for authorizations or for referrals to another provider, such as when a provider refers a patient to a specialist or for inpatient care.

Using the X12N 278 standard for prior authorization transactions, the health plan transmits a response to the health care provider. This response contains coded information that can then be utilized in a health care claim to indicate that the billed items or services were approved by the health plan before being rendered, or that a referral to another provider has been approved.

See

45 CFR 162.1301.

After reviewing public comments, we are not adopting an attachments standard for prior authorization at this time. Commenters cited limited industry experience implementing the X12N 278 standard for prior authorization attachments, variability in current prior authorization workflows, and potential conflict with other federal interoperability initiatives requiring FHIR-based prior authorization API capabilities. Instead, we are adopting standards only for health care claims attachments. This approach reflects current industry readiness and supports administrative simplification while allowing continued evaluation of evolving standards for prior authorization.

Comment:

Although several commenters expressed support for HHS's efforts to reduce the burden of prior authorizations by adopting electronic standards to create a streamlined prior authorization process that meets the needs of health plans and providers, more commenters opposed HHS's finalizing the proposed adoption of X12N 278 standard with respect to prior authorization attachments transactions. Commenters asserted that: (1) there is a lack of agreement on data element standardization within the industry; (2) entities have a wide range of prior authorization workflows and common definitions; (3) previous attempts to leverage the X12N 278 standard to support prior authorizations have failed; (4) the X12N 278 standard for prior authorization transactions was never fully implemented in the industry; (5) the X12N 278 standard for prior authorization transactions will not support the requests or responses of a FHIR-based questionnaire; and (6) HHS's goal of efficient, cost-effective, simplified interoperability may be impeded by health IT vendors constantly having to deal with exceptions due to conflicting requirements across various rulemaking efforts.

Commenters also expressed concern that HHS's proposed X12N 278 standard for prior authorization attachments transactions that appeared in the HIPAA Standards for Health Care Attachments proposed rule may conflict with provisions of a CMS proposed (and now finalized) rule that appeared nearly simultaneously in the

Federal Register

, on December 13, 2022 titled: “Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program” (hereinafter referred to as the CMS Interoperability and Prior Authorization proposed rule) (87 FR 76238).

Commenters also requested clarification or provided HHS with certain recommendations for consideration in the event HHS finalized the adoption of the X12N 278 standard for prior authorization attachments transactions. A commenter recommended that if HHS were to adopt the X12N 278 standard, HHS should continue the use of Version 5010 and not adopt Version 6020 of the X12N 278 standard, asserting that it offers no additional functionality, is untested, and may contain errors.

Response:

We appreciate the comments submitted in response to our proposal to adopt a standard for health care attachments transactions that would include the prior authorization transaction standard. Upon further consideration, and as we explain herein, we have elected not to finalize the prior authorization transaction standard proposal. Rather, we are adopting only the standards for health care claims attachments transactions. Our decision reflects substantive consideration of several interrelated concerns raised by commenters, many of which point to foundational issues that could have impeded effective implementation.

First, numerous commenters cited the lack of industry consensus regarding data element standardization. Prior authorization processes vary widely across health plans, and there is currently no agreed-upon, consistent set of data elements that supports a level of automation and interoperability consistent with HIPAA Administrative Simplification goals. While a standard like the X12N 278 is intended to create a unified structure, in practice the diversity of clinical and operational use cases would have made its application difficult to scale.

Second, commenters emphasized that prior authorization workflows differ significantly across organizations and are often not standardized even within the same type of entity. These workflows include clinical decision-making, review protocols, timing of documentation, and routing processes, all of which influence where and how attachment information is requested and supplied. While a technical standard could, in theory, be inserted into any

point in the workflow, the absence of shared operational expectations and integration strategies greatly increases the risk of fragmentation, workarounds, and vendor-specific implementations, which would undermine the goal of interoperability and could increase, rather than reduce, provider burden.

Third, many commenters pointed out that previous attempts to use the X12N 278 standard to support prior authorization have not been successful. There is limited industry adoption and very few operational use cases that demonstrate consistent, real-world functionality of the standard in the context of attachments. The lack of implementation and testing means that critical issues related to content sufficiency, response timing, and payload alignment remain unresolved. Interested parties also raised specific concerns that Version 6020 offers no additional functional value over Version 5010, and, in fact, could introduce unvetted changes that have not been adequately tested or validated.

In addition, we acknowledge commenters' concern that adopting a prior authorization attachment standard under HIPAA could conflict with requirements of the aforementioned, and now finalized, CMS Interoperability and Prior Authorization final rule that appeared in the January 17, 2024

Federal Register

in which CMS mandated the use of a FHIR Prior Authorization Support API by CMS-regulated health plans and payers (89 FR 8758).

We also acknowledge certain commenters' suggestions that the current low adoption rate for Version 5010 of the X12N 278 standard may itself be attributable to the absence of a mandated prior authorization attachments standard. Though that is a plausible contributing factor, it would not mitigate the practical concerns about industry readiness, data variability, and implementation barriers that commenters identified. Simply requiring the use of a standard in this context—without sufficient groundwork to ensure feasibility and alignment—would risk ineffective uptake and could impose new burdens rather than resolve existing ones.

In light of these reasonable concerns, we concluded it would be imprudent to now proceed to finalize adoption of a prior authorization attachments standard, so the finalized policies in this final rule are limited to attachments for the health care claims or equivalent encounter transactions and associated electronic signature standards. This permits us to focus our regulatory resources, and the industry to focus its resources, on a narrower set of transactions for which there is stronger implementation maturity, standards infrastructure, and stakeholder alignment.

We remain committed to improving the prior authorization process and recognize the importance of establishing electronic standards that reduce burden and promote interoperability. We will continue to monitor testing of alternative transaction standards, including FHIR-based solutions, and will continue to engage with industry-led SSOs to evaluate readiness for potential adoption of a prior authorization attachments standard.

B. Overview of Final Requirements

Nearly every health plan has various requirements for health care providers to submit additional information beyond that contained in a HIPAA transaction. A health care provider may transmit this additional information in a “solicited” or an “unsolicited” fashion. In solicited transmissions, a health care provider transmits additional information pursuant to a health plan's specific electronic request (87 FR 78444). Conversely, in unsolicited transmissions there are no specific electronic requests. Rather, they typically occur pursuant to pre-established health plan requirements for health care providers to transmit additional information—to support, for example, certain diagnoses, items, services, or medications—that are set forth in trading partner agreements or other guidance (87 FR 78444).

Although health care providers may transmit this additional information electronically via an attachment to a health care claims transaction, today and historically health care providers have frequently transmitted the information via burdensome manual processes that often involve paper mail, fax, and phone because there have been no previously adopted HIPAA standards for health care claims attachments.

We are adopting standards for health care claims attachment transactions in this final rule. In doing so, we first define the term “attachment information.”

C. Definitions of Attachment Information and Health Care Claims Attachments Transaction

In adopting an attachment transaction standard, we determined we needed to define “attachment information” and “health care claims attachments transaction.” We proposed to separately define the two terms to prevent the definition of health care claims attachments transaction from becoming too unwieldy and further clarify this in our responses to comments later in this section.

1. Definition of Attachment Information

We proposed to define attachment information in § 162.103 as documentation that enables the health plan to make a decision about health care that is not included in either of the following:

• A health care claims or equivalent encounter information transaction, as described in § 162.1101.

• A referral certification and authorization transaction, as described in § 162.1301(a) and the portion of § 162.1301(c) that pertains to authorization.

We used the term “attachment information” in our proposed definition of the health care claims attachments transaction in § 162.2001 to specify the information transmitted by a health care provider or requested by a health plan. The proposed rule discussed how the NCVHS recommended defining attachments as “any

supplemental documentation needed

about a patient(s) to support a specific health care-related event (such as a claim, prior authorization, or referral) using a standardized format” (87 FR 78444 and 78445, emphasis in original).

We incorporated key aspects of their recommendation into our proposed definition of “attachment information,” while attempting to ensure that the definition was broad and general enough to include all possible patient-related information that could be generated with respect to health care services. The full discussion of the proposed definition of “attachment information,” to which we refer readers, further details the NCVHS's recommendations for the definition to include reference to “documentation,” “supplemental,” and “needed” (87 FR 78445).

National Committee on Vital and Health Statistics. (2016, July 5). Recommendations for the Electronic Health Care Attachment Standard. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2018/03/2016-Ltr-Attachments-July-1-Final-Chair-CLEAN-for-Submission-Publication.pdf.

We solicited public comments on the proposed definition of “attachment information” and received feedback from interested parties, which we considered in developing this final rule.

Comment:

Multiple commenters expressed support for the proposed definition of attachment information. Some commenters indicated that the definition proposed for attachment information sufficiently captures what is necessary for solicited and

unsolicited exchange of supplementary medical information.

Response:

We appreciate commenters' support of our proposed definition of “attachment information.”

Comment:

A commenter agreed that the proposed definition of “attachment information” needs to be broad and general enough to include all possible patient-related information that could be generated with respect to health care services. The commenter acknowledged that HHS explicitly defined the documentation as supplemental, meaning it is documentation “that is not included” in a health care claims or prior authorization transaction, which the commenter believed means that the health care attachment standards are dependent upon and linked to the accuracy and completeness of these other HIPAA transaction standards. The commenter also noted that effective adoption of the health care attachments standards is impossible without effective adoption of the other standards, and requested that HHS actively support and verify the effective use of those HIPAA transaction standards, and these health care attachment standards once finalized, as HHS did during the health care industry's transition from International Classification of Diseases (ICD), Ninth Revision (ICD-9) to ICD, Tenth Revision (ICD-10).

Response:

We appreciate the commenter's observations supporting a broad and general definition of “attachment information,” and agree that the definition must be sufficiently inclusive to encompass the full range of patient-related documentation a health plan may require in support of a health care claim or equivalent encounter transaction.

We likewise agree with commenters that the finalized definition should appropriately exclude documentation already required or contained within other adopted HIPAA transaction standards and clarify that this exclusion is deliberate and consistent with the principles of administrative simplification and the goal of reducing duplicative documentation burdens.

As noted in the HIPAA Standards for Health Care Attachments proposed rule, we initially proposed a definition of “attachment information” that would have applied with respect to both claims and prior authorization transactions. For the reasons articulated in section III.A. of this final rule, we are not finalizing adoption of a prior authorization attachment transaction standard, so the finalized definition of “attachment information” applies only in the context of health care claims or equivalent encounter information transactions. This narrowed scope is reflected in the revised definition we are finalizing in § 162.103, which specifies that “attachment information” is documentation that enables a health plan to make a decision about health care that is not included in a health care claims or equivalent encounter information transaction, as described in § 162.1101.

Comment:

Several commenters suggested changes to the proposed definition of “attachment information” or associated requirements on health plans. A commenter recommended that the definition be revised to state that attachment information should “enable providers to make decisions about what healthcare content the payer requires in the healthcare attachment.” Another commenter suggested that HHS dictate that payers, after receipt of an initial attachment, not be able to serially add documentation requirements.

A different commenter was concerned that too broad a definition could allow payers to require supplemental documentation for routine care such as vaccines, well child visits, or routine prescriptions, which could potentially increase financial burden on small and independent pediatricians who provide safety net care to rural or low-income or both populations. That commenter recommended that HHS consider adopting the NCVHS's definition of “attachment information” as it only included supplemental information without which a claim could not be properly adjudicated.

Response:

We appreciate the commenters' concerns but do not believe it is appropriate or necessary to modify the definition of “attachment information” to account for such concerns as our proposal was intended to identify the type of documentation exchanged. Ultimately, payers' business and payment-decision rules fall outside the scope of HIPAA. In other words, though we appreciate that health care providers may experience added burden should health plans request additional documentation following an initial submission, HIPAA transaction standards govern the format and content of the electronic exchange, not payers' business practices or the quantum of documentation they may require. Therefore, we are finalizing a slightly modified definition of “attachment information,” revised only to account for the fact that we are not adopting prior authorization attachments standards.

We also continue to believe that it is crucial that the definition of “attachment information” in HHS's administrative simplification implementing regulations be broad and general enough to apply to all situations where a health plan requires attachment information to support a health care claims or equivalent encounter information transaction. In this final rule, we are adopting a definition of “attachment information” that incorporates key aspects of the NCVHS's definition. Though our definition of “attachment information” does not include the NCVHS-recommended term “supplemental,” it incorporates that concept as it specifies documentation “that is not included” in a health care claims or equivalent encounter information transaction, as described in § 162.1101, to express that the documentation would be supplemental.

In our finalized definition, we chose not to limit the definition strictly to documentation without which a claim “could not be adjudicated,” as suggested by the commenter, because such a narrow framing may not accommodate the diversity of documentation that different health plans may reasonably require based on their benefit structures, medical necessity criteria, or regulatory obligations. For example, certain documentation may not by itself determine a claim's payability but may still be necessary under specific plan policies or for administrative or compliance purposes.

The commenter was concerned that a broad definition of “attachment information,” such as the definition being finalized in this rule, could prompt health plans to require documentation for routine services, which could administratively or financially burden small health care providers, especially those serving rural or underserved populations. However, we note that nothing prohibits a health plan from requiring such documentation today under the manual processes currently in widespread use (which are more labor and resource intensive than an electronic transaction). Therefore, we do not agree that finalizing this definition of “attachment information” or the adoption of a standard for health care claims attachments in and of themselves would cause health plans to make broad requests for documentation. We also believe the definition we are finalizing appropriately balances flexibility with restraint by tying the use of attachment information directly to a standard claims or equivalent encounter transaction and explicitly excluding any information already required by the transaction standard itself, which would ensure that attachment information is supplemental in nature and transaction-

specific while also providing sufficient adaptability across diverse payer-provider contexts.

Comment:

Multiple commenters stated that there was a critical need to improve the clarity of the proposed definition of “attachment information” as they believed the scope of the proposed definition could be expansively interpreted as applying to all use cases, permitting a “kitchen sink” approach to the eligible activities to which the mandated standards would apply, rather than the definition of “attachment information” being tied to “a specific transaction” such as the claims transactions. The commenters further stated that the proposed definition potentially would include any information exchange between a health care provider and other information source (for example, a clinical laboratory or immunization registry) and a health plan.

Response:

We reiterate that we believe the definition of the term “attachment information” is adequately narrow. In the proposed, and finalized, definition of the health care claims attachments transaction in § 162.2001, “attachment information” refers to information transmitted by a health care provider or requested by a health plan that is necessary to make a decision about a health care claim and that is not included in the standard health care claims or equivalent encounter transaction, as described in § 162.1101. Though the definition must be sufficiently broad to encompass the various documentation that a health plan may require “to make a decision about health care,” it also must be clearly tied to the health care claim or equivalent encounter transaction. The finalized definition does not apply to all information exchanges between health care providers and other entities nor does it permit a “kitchen sink” approach to its application. It also would not authorize any action beyond those already permitted under health plan policies.

Therefore, we continue to believe the finalized definition of “attachment information” in § 162.103 appropriately balances clarity and flexibility, ensuring that it is broad enough to be functional in practice while remaining anchored to a defined transaction use case.

Comment:

A commenter stated that they interpreted the language in the proposed definition of “attachment information” as not being inclusive of information needed for fraud, waste, and abuse purposes. The commenter recommended that HHS include a reference to fraud, waste, and abuse in the definition of “needed” in the proposed definition of “attachment information.” The commenter also pointed to HHS's language in the Executive Summary, part A, that the purpose of [the proposed] rule is to “determine the necessity of a health care service as part of making a coverage decision” and stated that fraud, waste, and abuse must be considered when a service is deemed medically unnecessary in order to maintain CMS program integrity.

Response:

The definition of “attachment information” adopted in this final rule is intended to ensure that health plans have the documentation necessary to support proper claims processing and payment determinations. While this information may inform a payment determination, the determination itself may also depend on additional factors such as plan policies or clinical review requirements. Accordingly, certain documentation may be necessary for evaluating coverage without being solely determinative of claim adjudication. This approach would also allow health plans to use attachment information for administrative purposes, including fraud, waste, and abuse detection and prevention, without requiring a separate explicit reference to these activities in the definition.

2. Definition of the Health Care Claims Attachments Transaction

In the HIPAA Standards for Health Care Attachments proposed rule, we proposed to add a new Subpart T to 45 CFR part 162—Health Care Attachments (87 FR 78446). In Subpart T, in § 162.2001, we proposed to define the “health care attachments transaction” for health care claims transactions and prior authorization transactions. Specifically, we proposed that any of the following different types of transmissions would constitute a “health care attachments transaction”: (1) the transmission of attachment information from a health care provider to a health plan in support of a referral certification and authorization transaction or in support of a health care claims or equivalent encounter transaction; and (2) a request from a health plan to a health care provider for attachment information. For each type of transmission, we specified the entity type from which the transaction is being transmitted and to which it is being sent, the information being transmitted, and the purpose of the transmission. We noted that the overarching purpose for each type of transmission—to enable a health plan to make a decision about health care—is incorporated into the definition of “attachment information.” We further specified the purpose for the two transmission types in § 162.2001(a), as discussed later in this section.

Because we are adopting only an attachment standard for health care claims, as that term is used in this rule to include health care claims or equivalent encounter information transactions, and not a standard that includes the prior authorization transaction, in § 162.2001 we rename what we had called the “health care attachments transaction” to the “health care claims attachments transaction.”

The finalized definition has been revised from what we had proposed to remove language specific to prior authorization (that had read in part, “in support of a referral certification and authorization transaction”) and reformat the outline structure to account for that, so that it applies exclusively to claims attachments. Aside from that, the definition remains the same as we had proposed.

As we observe at n.4, while this also includes “equivalent encounter information” transactions (§ 161.1101(b)), attachments more likely would be requested for health care claims (§ 161.1101(a)) involving payment as opposed to the “transmission of encounter information for the purpose of reporting health care.”

In the HIPAA Standards for Health Care Attachments proposed rule, to align with the proposed rule's scope which addressed health care attachments for health care claims or equivalent encounter information

and

prior authorization transactions, we also proposed to make a conforming change to the definition of “transaction” in § 160.103. We proposed to replace “(10) Health claims attachments” with “(10) Health care attachments” (87 FR 78446). Because we are not adopting the prior authorization attachments standards, we are not finalizing this proposed change. But, to align with the focus on health care attachments for health care claims or other equivalent encounter information transactions, we retain the word “care” from our proposal and are finalizing the definition of “transaction” with modification, so it reads “Health care claims attachments.”

Comment:

The majority of commenters who provided feedback on our proposed definition of the health care attachments transactions opposed the proposal. A commenter stated that because the proposed definition refers to attachments for both claims and prior authorization transactions and not just claims, it arbitrarily collapsed the two use cases into one definition, to which the commenter objected. The commenter indicated that using attachments for prior authorization transactions diverges from the statutory

construct, which could result in confusion and difficulty unraveling them down the road.

Another commenter recommended that the proposed health care attachments transaction definition include only attachment information created and maintained by a health care provider and explained that the proposed definition was too broad and could lead to the capture of all possible patient-related health services information. The commenter stated that such a broad definition might inadvertently cause disruption to claim adjudication processes and place a greater burden on health care providers, believing that it would not limit attachment information to only what was needed for a plan to make decisions about care. Instead, a health plan might demand all possible patient-related information that could be generated with respect to health care services before deciding whether or not to cover an item or service or when conducting a post-payment audit. The commenter also stated that health care entities, such as laboratories, do not create or routinely maintain all possible patient-related information that could be generated with respect to health care services; do not routinely receive electronic attachment information from clinicians; and cannot transmit this information to health plans when requested to support claims processing. The proposed definition, the commenter claimed, could cause laboratories to receive innumerable requests from health plans for electronic attachment information that they did not create and do not maintain.

Response:

As discussed in section III.A. of this final rule, numerous commenters opposed our proposal to adopt a health care attachment standard to include prior authorization as a use case and opposed the adoption of a standard for prior authorization attachments transactions, and, after further consideration, we are not finalizing adoption of a standard for prior authorization attachments transactions. We further note that the health care claims attachment definitions and standards we are adopting in this rule do not include references, or otherwise extend, to prior authorization attachment transactions.

Our proposed definition of the “health care attachments transactions” was intended to encompass the different types of transmissions such a transaction would encompass. For each type of transmission, we specified the entity type from which the transaction would be transmitted and to which it would be sent, the type of information being transmitted, and the purpose for the transaction. We also noted in the HIPAA Standards for Health Care Attachments proposed rule that the overarching purpose for the two types of transmissions was to enable a health plan to make a decision about health care in support of the health care transaction and that specification of the information transmitted by a health care provider or requested by a health plan in support of the transaction was incorporated into the definition of attachment information (87 FR 78446).

We emphasize that HIPAA transaction standards govern the format and conduct of electronic transactions; determinations about the amount or type of documentation that a health plan may request in support of adjudication remain subject to health plan business rules and other governing law. The term “attachment information,” as defined in our finalized definition at § 162.103, is limited to documentation not included in a standard claims transaction that enables a health plan to make a decision about health care. These limitations ensure that the standard does not encompass all conceivable patient-related information.

We also clarify that this rule does not create new requirements for entities that do not originate or maintain the documentation at issue. The standard applies only to the exchange of documentation that a health care provider or other covered entity already maintains and transmits as part of a claims adjudication process.

Final Action:

After considering the public comments, and for the reasons discussed previously, in § 162.103, we are finalizing, with modification, the definition of “attachment information” as: documentation that enables the health plan to make a decision about health care that is not included in a health care claims or equivalent encounter information transaction, as described in § 162.1101.

We are also finalizing the addition of a new Subpart T to 45 CFR part 162—Health Care Claims Attachments. In Subpart T, in § 162.2001, we are finalizing the definition of the “health care claims attachments transaction” as the transmission of either of the following:

• Attachment information from a health care provider to a health plan in support of a health care claim or equivalent encounter information transaction, as described in § 162.1101.

• A request from a health plan to a health care provider for attachment information.

Last, because we are not adopting an attachments standard for prior authorization transactions in this final rule, as discussed in section III.A. of this final rule, we are finalizing, with modification, the proposed definition of “transaction” in § 160.103 by amending paragraph (10) to add the word “care,” (Health care claims attachments).”

D. Attachments Transaction Standards

In the HIPAA Standards for Health Care Attachments proposed rule (87 FR 78445 through 78451), we proposed to adopt certain industry consensus standards that, when used together, provide the functionality necessary for the transmission of electronic health care attachment information.

The standards being adopted in this final rule are for requesting and transmitting attachment information. In this section, we describe the new requirements for covered entities to use: (1) certain X12N standards for requesting and transmitting attachment information and HL7 standards for clinical information content; and (2) electronic signatures standards. We also describe how the HL7 Attachments IG utilizes the LOINC code set to identify attachment information in a consistent manner.

For additional information about the business and operational processes involved in the exchange of these standards, we refer readers to the aforementioned November 2017 WEDI whitepaper and the HL7 CDA® R2 Attachment Implementation Guide: Exchange of C-CDA Based Documents, Release 1 (Universal Realm) for more technical information. Both are available at:

https://build.fhir.org/ig/HL7/CDA-ccda-2.1-sd/.

1. Electronic Health Care Claims (or Equivalent Encounter Information) Attachments Transactions

Health plans often require health care providers to submit additional information in association with the claims payment process. Additional information is frequently in a format, such as medical imaging or free text, not supported by the discretely defined health care claims transaction standard data fields. Claims payment is a multi-step process that may include pre-payment review, payment adjudication, and post-payment activities such as audits or recoupment reviews. The claims attachment transaction standards adopted in this final rule apply to the transmission of solicited and unsolicited attachments used in support of these stages of the claims payment process, including post-payment review activities related to claim adjudication. These standards do not apply to attachments exchanged as part of a separate claims appeal or dispute resolution process. Appeals and related

transactions are outside the scope of this rule and would require separate standards to be adopted through future rulemaking.

In the HIPAA Standards for Health Care Attachments proposed rule, we proposed to adopt standards for requesting and transmitting attachment information, and to define attachment information in § 162.103, as documentation that enables the health plan to make a decision about health care that is not included in a health care claim or equivalent encounter information transaction, as described in § 162.1101. We also proposed to adopt X12N standards with respect to the transmission of attachment information and HL7 standards with respect to the clinical content of attachments. Specifically, as detailed in the sections that follow, we proposed to adopt three X12N TR3 implementation specifications for health care claims attachments (87 FR 78445) and three HL7 IGs for the clinical information embedded in those transactions (87 FR 78445).

a. Scope of Health Care Claims Attachments Transactions

Section 1173(a) of the Act requires the Secretary to adopt standards for “health claims attachments,” and section 1104(c)(3) of the Affordable Care Act reiterated that requirement, directing the Secretary to promulgate a final rule to adopt a transaction standard and a single set of associated operating rules. In the proposed rule, we stated that the proposed attachments standards would satisfy the requirement to adopt a standard to support health care claims but would also support prior authorization transactions (87 FR 78445). Because, as we have already explained, in this final rule we are finalizing only a definition for “health care claims attachments,” we use that term to refer to attachments for health care claims or equivalent encounter information transactions rather than the proposed rule's broader “health care attachments” phrase that was intended to include both the claims and prior authorization transaction standards.

We did not propose to adopt attachments standards for all health care transaction business needs. Rather, we stated that not only would it be challenging to identify standard specifications and appropriate codes for the full array of different health care attachment types used today, but also that it was important that covered entities gain experience with a limited number of standard electronic attachment types so that technical and business issues could be identified to inform potential future rulemaking for other electronic attachments standards (87 FR 78446).

We requested comments on alternative standards and approaches that could address the challenges described in section I.A. We summarize and respond to public comments submitted in response to this request in the next section.

2. Adoption of Electronic Health Care Claims Attachments Transaction Standards

In the proposed rule, we highlighted the NCVHS's July 5, 2016 recommendations to the Secretary on attachments standards, which are the same standards we proposed to adopt (87 FR 78446 and 78447). We title this section to only refer to the health care claims attachments standards that we are adopting in this final rule and emphasize that prior authorization attachments standards are not adopted in this final rule. But, because our proposal had been broader by including prior authorization attachments standards and thus generated comment on the broader proposal, our comment summaries and responses do include some discussion of the full scope of what had been proposed.

As mentioned in the proposed rule, and discussed again in section II.D.3. of this final rule, section 1104(c)(3) of the Affordable Care Act requires that the adopted attachments standard be “consistent with the X12N Version 5010 transaction standards” (87 FR 78440), which we interpret as requiring that the health care claims attachment implementation specifications we adopt should generally be compatible with X12N standards. Thus, any standard we adopt for health care claims attachments should be electronically transmitted by an X12N transaction standard in the same transaction.

While the NCVHS did not recommend specific versions of the X12N attachments standards, we proposed to adopt X12N Version 6020 for both the X12N 277—Health Care Claim Request for Additional Information (006020X313) and the X12N 278—Health Care Services Request for Review and Response Version (006020X315) as the standards a health plan must use to electronically request attachment information from a health care provider to support a prior authorization transaction. We proposed to adopt Version 6020 of the standards because they better harmonize with the X12N 275—Additional Information to Support a Health Care Claim or Encounter (006020X314) and the X12N 275—Additional Information to Support a Health Care Services Review (006020X316) (87 FR 78447), and we refer readers to the proposed rule for the full discussion of the use of these standards and their compatibility (87 FR 78446).

Comment:

Multiple commenters supported the proposed attachment standards, noting the approach would enable continuous advancements in standards-based attachment content. Commenters underscored the importance that uniform standard requirements would have on furthering industry adoption of automated claims processes, which would help reduce the current manually intensive administrative burden, and, therefore, reduce costs. Similarly, one commenter stated that adopting unified standards would eliminate the need for proprietary data programs, reduce handling and processing time, eliminate the risk of lost paper documents, and, thereby, reduce administrative burden and lower costs.

Another commenter supported HHS's proposals to apply attachment standards for health care claims and prior authorization transactions. The commenter noted that while some in the industry are concerned with the lack of alignment in prior authorization standards (X12 versus FHIR), they agreed with HHS's proposed approach since the absence of an electronic attachments standard had contributed to low industry adoption rates for electronic prior authorization (ePA) transactions.

A commenter noted that, currently, health plans have requirements for submitting supporting documentation that health care providers must follow and that health plans may request further information from a health care provider to make an authorization decision. The commenter noted that health care providers must submit this information via burdensome manual processes through mail, fax, or a portal, with each health plan having different requirements. The commenter further noted that every player has a different portal to submit attachments, and managing the many access usernames and passwords is also burdensome. Therefore, the commenter stated that a standard attachment process, via a standardized electronic format, would greatly improve the process.

Another commenter noted that payers and providers would benefit from having a unified submission method for documents needed for prior authorization, claims, quality, audit, and other use cases. Another commenter stated that adopting the X12 standards

and C-CDA standards would improve patient outcomes.

Response:

We thank commenters for the feedback on and support of our proposals. After careful consideration, we are adopting standards for health care claims attachments transactions to help combat the burdensome manual processes health care providers face today when transmitting supporting documentation required by health plans in association with the claims payment process. We agree with commenters that adopting standards for health care claims attachments will yield numerous benefits, including reducing administrative burden and costs, removing the need for proprietary data programs, cutting lengthy processing times, and eliminating the risk of lost paper documents. However, for the reasons extensively discussed in section III.A. of this final rule and as noted repeatedly elsewhere, we are limiting the scope of this rulemaking solely to the adoption of standards for health care claims attachments transactions.

Comment:

Multiple commenters noted that the technology and regulatory spaces have significantly evolved over the years, with some expressing concern that HHS's proposals demonstrated “2016-based thinking” by proposing the use of X12N standards, which they stated would make the evolution of requesting and responding to supplemental data needs harder and more burdensome. One of these commenters noted that, while they support a national attachments standard for claims and prior authorizations, more flexible technologies are available that would reduce complexity. A commenter requested that HHS consider updating the required attachment standards as new methods are introduced and real-world tested. Another commenter stated that HHS proposed outdated standards, and that HHS should not require adherence to standards that would move the industry backward. Further, a commenter expressed concern about how the proposed standard requirements would fit into the business process for most health care provider organizations and expressed that even though discussion included in the proposed rule was about physically capturing data elements and the transport mechanisms, a more holistic approach would be required to bring the technical capabilities into a product suite to work for the end user. Another commenter expressed that by focusing on a document-based, as opposed to a data-driven, approach, HHS was proceeding down a standards pathway that would make the attachment standards incongruent with the standards mandated in other proposed and final rules, such as the CMS Interoperability and Prior Authorization proposed rule (87 FR 76238). Multiple commenters expressed concern regarding the proposal to adopt standards for prior authorization attachments transactions and recommended that HHS bifurcate the claims attachments and prior authorization attachments standards proposals to finalize

only

the proposed claims attachments standard. A commenter noted that section 1173(a)(1)(A) of the Act specifically calls for the establishment of a claims attachment standard, but contains no provision requiring prior authorization attachments.

Response:

We thank commenters for their feedback on the proposed attachment standards and their observations about broader health IT and standards development trends. We acknowledge that industry technologies and regulatory requirements have evolved significantly since 2016 and agree that any adopted standard must balance progress with stability. Newer technologies may offer long-term potential to reduce complexity and improve flexibility in transmitting supplemental clinical information, and we will continue to consider their technical viability and operational maturity across a broad segment of the industry. The X12N standards for health care claims attachments that we finalize here have been used for many years in related HIPAA transactions, are supported by widely adopted infrastructure, and offer a known path for implementation and compliance. Standardizing attachments through X12N Version 6020 allows for the exchange of clinical content in a format that aligns with other existing administrative transactions, increases health care provider and health plan efficiency and reduces the need for burdensome manual submission processes.

While the 2016 NCVHS recommendation mentioned earlier noted the value of a broader attachments strategy that could extend beyond claims to include prior authorization, referrals, and other use cases, and although we had originally proposed a broader strategy to include other use cases, this final rule focuses specifically on claims attachments. This narrower scope is consistent with section 1173(a)(1)(A) of the Act, which requires the Secretary to adopt a health claims attachments transactions standard.

With respect to interoperability, we have taken the CMS Interoperability and Prior Authorization final rule (89 FR 8758) into consideration, and note that adopting a consistent, national claims attachment standard supports broader goals of administrative simplification and compatibility across systems.

Comment:

A commenter stated that the proposed rule's reference to the limited uptake of the current referral certification and authorization transaction standard being due to not having established standards for attachments (87 FR 78446) may be a result of an onerous process for certification and authorization. The commenter stated that if limited uptake of the referral certification and authorization transactions is a standards issue, it is imperative that the new attachments standard be simple and practical in order to improve compliance rates.

Response:

We thank the commenter for this input. We acknowledge that the limited uptake of the current referral certification and authorization transaction standard (X12N 278 Version 5010), which supports prior authorization, has been documented in multiple reports, but that is separate from the adoption of standards for health care claims attachments, which we are finalizing in this rule. We agree that any future attachment standards, particularly for prior authorization, must be practical and simple to implement in order to improve adoption rates. Past experiences with low utilization of the referral certification and authorization transaction, as mentioned in the 2016 NCVHS Hearing on attachments, demonstrate that overly complex standards or processes can pose barriers to adoption, even when standards are available. For this reason, simplicity in aligning with existing industry workflows, and coordination with SSOs and interested parties, are central considerations in our policy development as we continue to evaluate prior authorization attachments options.

Comment:

Multiple commenters, citing numerous rationales, encouraged HHS to consider implementing the FHIR standard, including the HL7® FHIR® Da Vinci Clinical Data Exchange (CDex) IG, for prior authorization attachments transactions. At the larger policy level, commenters described FHIR as an alternative standard aligned with federal and industry interoperability objectives, consistent with administrative simplification principles, and synergistic with certified EHR capabilities. At the practical level, commenters cited FHIR's flexibility and the efficiency of FHIR questionnaires, its ability to support end-to-end prior authorization and provide automated and real time solutions, and its being a

more modern technology. Multiple commenters expressed concern regarding HL7 C-CDA unstructured document media types not supporting FHIR bundles (for example, application/json+fhir). Commenters also noted that use of the FHIR standard would allow systems to adopt FHIR specifications to enable greater advancements within the health care industry.

Multiple commenters expressed concern over HHS proposing two rules that included proposals on prior authorization: (1) the HHS HIPAA Standards for Health Care Attachments proposed rule (87 FR 78438); and (2) the CMS Interoperability and Prior Authorization proposed rule (87 FR 76238). Commenters noted that across these two rules, HHS and CMS proposed the use of two different standards, X12N and FHIR, for prior authorization transactions, which would require implementation of both standards and be confusing and cumbersome. A commenter expressed that doing so would be counterproductive to the goals of administrative simplification. Another commenter noted that adopting both X12N and FHIR standards would create confusion for providers, insurers, and vendors that could lead to delays in prior authorization processing and approvals, increased costs, and would likely result in providers using solely the X12N standard despite incentives to use the FHIR standard. Multiple commenters expressed support for the use of FHIR, citing a desire for alignment with the CMS Interoperability and Prior Authorization proposed rule. A commenter requested that HHS review the standards proposed in the CMS Interoperability and Prior Authorization proposed rule and allow providers to utilize both FHIR and X12 standards to meet the requirements in both rules, while another suggested we be thoughtful in considering how HHS's proposal aligns with CMS's proposal so as to avoid providers' duplication of efforts.

A commenter also recommended that HHS allow data-element driven data sharing via FHIR APIs, which would enable flexibility for targeted requests. Despite a stated preference for health care providers to adopt the FHIR standard and connect to APIs once finalized, a commenter recognized there would be providers that lack the means to finance their vendors' FHIR updates. They therefore proposed the adoption of a safe harbor for providers that would allow for the use of Version 5010 of the X12N 278 standard for prior authorization transactions and the X12N 275 standard for claims transactions.

Response:

We appreciate these comments and thank commenters for sharing these important considerations. In its most recent letter to the Secretary (March 30, 2022), the NCVHS recommended that HHS move forward with publishing a claims attachments rule to address longstanding industry needs, while also continuing to monitor and consider emerging standards.

As discussed extensively in section III.A. of this final rule and as reiterated elsewhere, we are not in this final rule adopting attachment standards for prior authorization transactions. We note that the NCVHS's March 30, 2022, letter also recommended that CMS publish the CMS Interoperability and Prior Authorization proposed rule, which included proposals for FHIR-based APIs to support prior authorization workflows. This underscores both the ongoing demand for a claims attachments standard today and the importance of continuing to evaluate newer technologies for prior authorization and other use cases. We therefore finalize a claims attachments standard in this rule while leaving open the opportunity to adopt alternative standards applicable to prior authorization in other rulemaking.

National Committee on Vital and Health Statistics. (2022 March 30). Recommendations to Modernize Aspects of HIPAA and Other HIT Standards to Improve Patient Care and Achieve Burden Reduction. Retrieved from

https://ncvhs.hhs.gov/wp-content/uploads/2022/04/Recommendation-Letter-HIT-Standards-Modernization-to-Improve-Patient-Care-March-30-2022.pdf.

Comment:

A commenter noted that while they expect claims transactions to remain X12-based, the industry and technology have evolved significantly and are moving toward FHIR standards. Another commenter underscored the need for claims attachments standardization but noted industry concern with the specific technology proposed for the prior authorization attachments standard. The commenter stated that HIPAA regulations view the claims and prior authorization attachment standards separately, and that the claims process occurs after care has been delivered, as opposed to the prior authorization process which occurs in advance of care. Given the different workflows and points at which these two processes occur, the commenter stated the need for the processes to mirror one another or be adopted in tandem is diminished. A commenter stated that the proposed standards are an interim step to move health care providers and payers to electronic data submission. However, the commenter noted that to further advance ePA processes and reduce administrative burden, it is critical to align prior authorization attachments standards across all components of the ePA process, which includes the transmission of clinical information via health care attachments.

Response:

We thank commenters for their perspectives on the need for attachment standards in both the health care claims and prior authorization contexts and agree that claims and prior authorization serve distinct business functions and operate under different workflows, with prior authorization typically occurring before items or services have been rendered and claims typically occurring afterwards.

In this final rule, as repeatedly noted, we have elected to adopt standards only for health care claims attachments. That focused approach accommodates the requirement at section 1173(a)(2)(B) of the Act that the Secretary adopt standards for the health claims attachment transaction and public feedback recommending that we not simultaneously finalize claims and prior authorization attachments standards in the same final rule. Finalizing only claims attachments standards now allows the industry to begin realizing the benefits of increased automation that reduces administrative burden, while providing additional time to align on prior authorization attachment standards in future rulemaking. We acknowledge the growing interest in APIs, such as FHIR based approaches, particularly for prior authorization transactions, and that FHIR for API-driven data exchange has already been adopted in other regulatory contexts, such as the CMS Interoperability and Prior Authorization final rule (89 FR 8758).

Finally, we emphasize that the decision not to adopt a standard for prior authorization attachments in this final rule should not be interpreted as abandoning the goal of reducing burden in that area. To the contrary, we recognize that prior authorization remains a major challenge across the health care system, and our action here is intended to allow targeted progress on claims attachments while maintaining flexibility to support emerging standards for prior authorization attachments through separate HHS-led policymaking efforts coordinated with interested parties, including health plans, health care providers, and industry. We encourage the participants in the standards development community to continue to explore how emerging paradigms for information exchange can be extended to address HIPAA transactions, and we welcome

further dialogue with interested parties about promising approaches.

Comment:

A commenter highlighted the significant burden on health plans to ensure their systems can support the standards for health care claims and prior authorization attachments transactions for structured and unstructured documents. The commenter stated that by adopting an approach in the final rule whereby a health plan would be compliant by implementing the use of either, but not necessarily both, structured or unstructured claims and prior authorization documents by the compliance date, HHS could ease health plans' burden as they work to ensure their systems can accommodate structured and unstructured documents for claims and prior authorization attachments transactions. The commenter also noted that HHS could, under such an approach, require that health plans implement the other document type (whether structured or unstructured) within 1 year of the compliance date.

Response:

Consistent with section 1104(c)(3) of the Affordable Care Act, we are finalizing a compliance date of 24 months after the effective date of this final rule by which all covered entities must comply. We believe that the fact that we are not finalizing adoption of a prior authorization attachments transaction standard ought to diminish the commenter's burden concerns. HIPAA covered entities will have to support structured and unstructured document types, but we understand the health care industry is moving in that direction and should be able to fully accommodate the requirement within this final rule's compliance timeframe. We encourage all HIPAA covered entities to begin testing their systems early to ensure smooth implementation.

Comment:

A commenter noted that current HIPAA regulations do not require health plans to send X12N 277 (Health Care Claim Acknowledgment or Claim Status Response) transactions as a response to an X12N 837 (health care claim) or X12N 278 (standard for prior authorization) transaction. The commenter requested that HHS confirm whether any requirements finalized by this rulemaking would result in a health plan being required to respond to a X12N 837 or X12N 278 transaction with the X12N 275 (Additional Information to Support a Health Care Claim or Encounter) standard to inform the provider of whether the attachment information is needed. The commenter also requested clarification as to whether a health plan that may require an attachment for a claim or prior authorization may then deny the corresponding claim or item or service authorization should a provider fail to provide the attachment, which would have the effect of requiring the provider to resubmit the claim or prior authorization request with the appropriate attachment information.

Response:

We appreciate the commenter's feedback and the opportunity to clarify the requirements for how health plans may request attachment information, while also reiterating that HIPAA specifies transaction standards requirements but does not directly address health plans' business rules. HIPAA regulations do not now (and this final rule does not alter this) require health plans to use the X12N 275 transaction to respond to an X12N 837 health care claim or an X12N 278 prior authorization transaction when requesting additional documentation. In other words, the X12N 275 standard may be used to support claim attachments, but HIPAA does not require its use as a mandatory response transaction.

Similarly, currently, the X12N 277 transaction may be used to notify a provider that claim attachment information is needed. HIPAA does not require its use, but health plans may elect to use it to communicate with health care providers about missing documentation. Health plans' business rules typically would specify when they may or may not deny a claim for failure to comply with health plan policies. While we do not currently require the use of the X12N 275 and X12N 277 transactions in these scenarios, we encourage health plans to adopt clear and consistent communication practices, including using these transactions where appropriate, to minimize administrative burden and avoid unnecessary claim denials.

Comment:

Multiple commenters supported the proposed adoption of Version 6020 for the X12N 275, X12N 278, and X12N 277 standards. A commenter stated that adopting Version 6020 for these standards would be critical to attachment transactions functionality because Version 6020 includes two key fields: (1) the health plan assigned claim control number to aid with claim reassociation; and (2) the field to capture LOINC for required data elements to identify the specific attachment information. A commenter expressed their appreciation for Version 6020 being tested and implemented in real-world settings.

Response:

We thank commenters for their feedback and support of Version 6020 of the standards as a business case in adopting a health care claims attachments transaction standard.

Comment:

Multiple commenters expressed concern about HHS's proposal to adopt Version 6020 and, instead, recommended that we adopt a newer version of the X12N attachments standards, such as Version 8020, which a commenter noted has been published. A commenter supported the adoption of Version 6020 of the X12N 275 and X12N 277 standards but recommended that the attachments standards be updated to Version 8020 when possible, while another commenter expressed concern that we would adopt Version 6020 when X12 may recommend Version 8020 be implemented prior to, or shortly after, HHS's action. That commenter encouraged us to ensure that the proposed technical standards are supported, compliant, and not mandated for replacement for no less than 5 years after the implementation date.

Multiple commenters recommended that HHS consult with standards development organizations (SDO) to ensure that the appropriate versions of the standards are finalized and that versioning is aligned. A commenter noted that using the versions proposed in the proposed rule could lead to operational and implementation costs and requested that HHS collaborate with early adopters of the proposed attachments standards. A commenter stated that the proposed Version 6020 of the X12N attachments standards will be problematic for attachment standard transactions because health care providers currently use Version 5010 of the X12N standard, and Version 8020 is being utilized by X12. The commenter expressed the belief that HHS's proposal would create a scenario where the transaction standard floor is lower than the one X12 will potentially recommend, and that is currently used for claims transaction processing. A commenter noted concern over the alignment between the proposed standards in the proposed rule and future HIPAA standards. The commenter encouraged HHS to ensure that future adoption of X12N standards is compatible with the proposed health care attachments standards outlined in the proposed rule. Multiple commenters recommended that HHS wait to adopt attachments transaction standards until the NCVHS makes a determination about recommending the next version of X12N standards. A commenter also stated that the NCVHS is currently evaluating requests from X12 on the adoption of Version 8020 for the X12N 837 and X12N 835 payment/remittance advice standards.

Response:

We appreciate the commenters' recommendations and concerns regarding the adoption of specific versions of the X12N 275 and X12N 277 standards for health care claims attachments. Specifically, we understand commenters' concerns regarding the potential for Version 6020 to become outdated, especially since X12 has published Version 8020 and the NCVHS may be considering it. However, the NCVHS has not recommended that any newer version of these standards be adopted under HIPAA, and under the HIPAA regulatory framework, HHS is limited to adopting standards that have completed the formal SDO process and have undergone appropriate evaluation and recommendation, including through the NCVHS. Therefore, we are finalizing the adoption of Version 6020 of the X12N 275 and X12N 277 standards, as they are currently the most recent versions that provide the necessary functionality to support the exchange of attachments in conjunction with claims and are currently the viable and legally supportable standards for the claims attachment transactions.

We agree with commenters that it is important that the attachment standards and the broader suite of adopted HIPAA standards, such as the X12N 837 and 835, be aligned. We are committed to ongoing coordination with SDOs, such as X12, and with the NCVHS to ensure that any future updates to HIPAA standards, including consideration of Version 8020 or later, are harmonized across transaction types to reduce implementation burden and maintain interoperability. We also recognize the importance of maintaining stability in the adoption of new standards. The HIPAA statute allows for the periodic update of standards—indeed, as we discuss in section II.D.3., the HIPAA standards paradigm is premised on standards evolution over time—but we will strive to maintain reasonable implementation timelines and take commenters' feedback into account as we consider future rulemaking and versioning policies.

Finally, as we extensively discuss in section III.A. of this final rule and reiterate elsewhere, we are not finalizing the proposed adoption of standards for prior authorization attachments at this time and, therefore, in this rule, are not adopting an updated version of the X12N 278 transaction standard.

a. Adoption of X12N Standards for Health Care Claims Attachments Transactions

(1) Adoption of Standards for Request From a Health Plan to a Health Care Provider for Attachment Information

(a) X12N 277—Health Care Claim Request for Additional Information (006020X313)

In the proposed rule, we proposed to adopt the X12N 277—Health Care Claim Request for Additional Information (006020X313) as the standard a health plan must use to electronically request attachment information from a health care provider to support a health care claim in § 162.2002(e)(1), and also proposed to incorporate the same by reference in § 162.920 (87 FR 78447). We explained that the X12N 277 standard for claims transactions contains two noteworthy fields: (1) the health plan assigned claim control number that is assigned by the health plan to link the attachment request with the original claim, enabling reassociation when the provider responds via the X12N 275 transaction; and (2) the LOINC code set for HIPAA that is used to identify the specific type of attachment requested (87 FR 78447).

Comment:

Multiple commenters strongly supported HHS's proposed adoption of the X12N 277 standard for claims attachments, and a commenter recommended that we finalize this standard as proposed. Commenters noted that the current claims attachment process is complex and cumbersome and that adopting consistent electronic claims attachment standards would reduce administrative burden and associated costs. A commenter urged HHS to strongly enforce this new standard, if finalized. Multiple commenters discussed how health plans have implemented an electronic claims attachment standard outside the HIPAA context and achieved significant efficiencies in denials, appeals, and time to payment using clinical documents rather than granular data elements for claims processing. A commenter noted that this example of successful real-world implementation and return on investment strengthens the argument for immediate claims attachments standards adoption.

Response:

We thank these commenters for their support for our proposals to adopt a health care claims attachment standard.

HHS administers HIPAA Administrative Simplification requirements related to the format and content of electronic administrative health care transactions for which we have adopted standards. Consistent with our approach of responding to complaints of non-compliance and conducting proactive compliance reviews, should we identify a HIPAA covered entity that fails to conduct, or fails to properly conduct, an adopted transaction standard, it may be subject to enforcement action.

As discussed in the final action section, we are finalizing adoption of the X12N 277 transaction standard in § 162.2002(d). The regulatory text has been reordered to group related transaction standards together for clarity and ease of reference; this reordering does not change the requirements for the use of the standard.

(2) Adoption of Standards for Transmission of Attachment Information From a Health Care Provider to a Health Plan: X12N 275—Additional Information To Support a Health Care Claim or Encounter (006020X314) and X12N 275—Additional Information To Support a Health Care Services Review (006020X316)

We proposed to adopt, in § 162.2002(d), the X12N 275—Additional Information to Support a Health Care Claim or Encounter (006020X314) as the standard a health care provider must use to electronically transmit attachment information to a health plan to support a health care claims or equivalent encounter information transaction. We also proposed to incorporate the same by reference in § 162.920.

As discussed in the HIPAA Standards for Health Care Attachments proposed rule, the X12N 275 standard for claims transactions may be used with respect to both solicited and unsolicited attachment information (87 FR 78448). We noted in the proposed rule that the X12N 275 standard for claims transactions does not itself contain claims attachment information (87 FR 78448). Rather, the standard serves as the electronic envelope for health care claims attachment information such that the attachment information (which is embedded in an HL7 standard) is transported by the X12N 275. We describe in detail the specific HL7 standards for embedding attachment information in this section of the final rule.

Additionally, we proposed to adopt, in § 162.2002(c), the X12N 275—Additional Information to Support a Health Care Services Review (006020X316) as the standard a health care provider must use to electronically transmit attachment information for electronic prior authorization

transactions. We also proposed to incorporate the same by reference in § 162.920. We are not adopting that standard in this final rule as it only pertains to electronic prior authorization transactions. We clarify that in this final rule, we are only adopting the X12N 275—Additional Information to Support a Health Care Claim or Encounter (006020X314) standard for health care claims attachments.

The X12N 277 transaction set is used for claim status inquiries and responses. When a health care provider submits a claim and the payer needs additional information to continue the review or processing of that claim, it may send the provider a request through a X12N 277—Health Care Claim Request for Additional Information transaction, and the health care provider may use the X12N 275—Additional Information to Support a Health Care Claim or Encounter to transmit the requested information back to the payer. For example, with a surgery for which there is no HCPCS code, for solicited attachment information, the health plan would request attachment information using the X12N 277 standard for claims transactions, and the health care provider would use the X12N 275 standard for claims transactions to respond with the operative note. In a scenario with unsolicited attachment information, the health care provider would transmit the X12N 275 standard for claims transactions to enable the health plan to make a decision about the claim without additional requests for information.

Comment:

Multiple commenters supported the adoption of the X12N 275 standard for health care claims transactions. Commenters stated that the present lack of attachments standards under HIPAA burdens the health care industry and noted that evidence from voluntary X12N 275 standard implementations has demonstrated the technical success of the transactions and cost savings. A commenter stated that, due to the X12N standards being foundational and widely implemented across health care providers, health plans, and health IT vendors, they believe it is appropriate to adopt the X12N 275 standard as the basis for exchange to support adoption at scale. A commenter recommended that HHS mandate a version of the X12N 275 standard that is consistent with HIPAA requirements at publication of the final rule. Another commenter expressed support for solicited and unsolicited claims attachment standards and noted that using the X12N 275 standard concurrently with a claims transaction will promote efficiency and decrease costs for providers and health plans. A commenter pointed out that Version 6020 of the X12N 275 standard includes the Binary Data Segment (BDS), which was not part of Version 5010, and is necessary for transmitting properly encoded clinical data.

Response:

We thank the commenters for their feedback and support. We agree that the absence of adopted HIPAA attachment standards has contributed to variability and inefficiencies in documentation exchange processes across the health care industry. We appreciate commenters highlighting the value of using the X12N 275 standard for health care claims and encounters, including its technical success in voluntary implementations, alignment with widely adopted foundational X12N standards, and capacity to support health care provider, health plan, and vendor interoperability. We also agree that adopting a consistent standard for solicited and unsolicited claims attachments can reduce administrative burden and promote operational efficiency.

We acknowledge the specific support for Version 6020 of the X12N 275 standard and its enhancements over prior versions, including the BDS that supports the secure and structured transmission of clinical data in attachment transactions. Accordingly, in this final rule, we are adopting Version 6020 of the X12N 275 standard for use in the health care claims attachments transaction, as well as Version 6020 of the X12N 277 standard. We believe this establishes a clear, standards-based foundation for exchanging attachments that will enable greater automation, improve data integrity, and reduce costs across the health care system.

We appreciate commenters' recognition of the need for consistency and predictability in the standards adopted under HIPAA and will continue to engage with parties in the health care industry and SDOs to ensure that future standards development and updates are responsive to industry needs and remain aligned with the HIPAA regulatory framework.

Comment:

A commenter stated the X12N 275 standard for health care claims and encounters will not work with unstructured documentation. Another commenter recommended that HHS permit trading partners to agree upon other documentation, not covered by the HL7 C-CDA, that would be allowed to be transported via the X12N 275 standard.

Response:

We further evaluated the commenter's assertion that the X12N 275 standard for claims transactions would not work with unstructured documentation and determined the assertion is incorrect, having confirmed that the X12N 275 standard for claims transactions does support the submission of unstructured documentation. The versions that we are adopting in this final rule include the BDS, which, in the HL7 standard, is used to carry attachments, such as documents or images. Moreover, the C-CDA Release 2.1 supports structured and unstructured templates. Therefore, we believe that the standards we are adopting in this final rule are sufficient for broad industry-wide use.

Regarding the comment recommending that we permit trading partners to agree that documentation not covered by the HL7 C-CDA be allowed to be transported via the X12N 275 standard for claims transactions, the types of documentation supported by the HL7 C-CDA broadly cover those that may be requested for the claims payment process. However, we encourage covered entities to negotiate the types of documentation required for implementing the transaction standard during the development of their trading partner agreements.

Comment:

A commenter noted that health IT vendors will have to engage in new development work should the proposed X12N 275 standard for claims attachment transactions be finalized as proposed, since such entities have not previously developed those transaction standards.

Response:

As discussed previously, we acknowledge that covered entities, or their vendors, will incur a number of one-time costs to implement the new HIPAA transactions. However, over time, we believe the resultant automation will ultimately benefit the industry by reducing burden and costs. We account for this implementation burden in our impact analysis in section VI. of this final rule.

Comment:

Multiple commenters expressed that a definition for baseline structured data is needed to achieve administrative burden relief. They also emphasized that it is important that the X12N 837 claim and encounter standard be supported by the X12N 275 standard for claims transactions for additional information at the time of a prior authorization request, initial claim submission, and for claims in paid or denied status.

Response:

We do not believe that a definition for baseline structured data is needed because the HL7 C-CDA Release 2.1 broadly covers structured and unstructured document types that may be transmitted under the X12N 275 standard for claims attachment

transactions. We encourage interested parties to engage with SDOs and industry collaboratives to identify and refine the consensus around structured data elements. We also encourage covered entities to negotiate the types of documentation required for implementing the transaction standard during the development of their trading partner agreements.

Final Action:

After consideration of the public comments we received, and after consultation with the SSOs, we are finalizing, with modification, our proposal regarding the adoption of certain X12N standards for requesting and transmitting attachment information.

In § 162.2002(c), we are adopting the X12N 275—Additional Information to Support a Health Care Claim or Encounter (006020X314) as the standard a health care provider must use to electronically transmit attachment information to a health plan to support a health care claim or equivalent encounter information transaction. We are also incorporating this standard by reference in § 162.920.

In § 162.2002(d), we are adopting the X12N 277—Health Care Claim Request for Additional Information (006020X313) as the standard a health plan must use to electronically request attachment information from a health care provider to support a health care claim. We are also incorporating this standard by reference in § 162.920.

E. Adoption of HL7 IGs for Health Care Claims Attachment Information

The HL7 CDA standard is the only currently available SSO-created, NCVHS-recommended implementation specification in the United States designed to support the HIPAA transactions. Other standards for the exchange of clinical information are being developed and piloted. However, due in part to its readiness, we stated in the proposed rule that we believe the HL7 CDA IG set is the most appropriate standard for adoption at this time (87 FR 78448).

We proposed to adopt the following three HL7 IGs as HIPAA standards for the attachment information included in health care attachments transactions:

•

HL7 IG for CDA Release 2:

C-CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume One—Introductory Material, June 2019 with Errata (HL7 C-CDA IG Volume One).

•

HL7 IG for CDA Release 2:

C-CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume Two—Templates and Supporting Material, June 2019 with Errata (HL7 C-CDA IG Volume Two).

•

HL7 CDA Release 2 Attachment IG:

Exchange of C-CDA Based Documents, Release 1, March 2017 (HL7 Attachments IG).

We refer readers to the detailed discussion in the proposed rule on the purpose and functionality of each IG and how they interact with each other (87 FR 78448).

These IGs provide specifications for creating and transmitting both structured and unstructured health care attachment documents. Structured documents are machine-readable with standardized sections and codes, while unstructured documents (for example, scanned images, video, patient logs, etc.) have metadata (that is, information that describes, explains, or gives context to other data) but no internal tagging. The HL7 Attachments IG also defines criteria for creating new templates when none exist.

In the HIPAA Standards for Health Care Attachments proposed rule, we proposed to adopt the March 2017 iteration of the HL7 Attachments IG. The SDO engaged in its regular maintenance process with respect to that IG, and, in March 2022, published the Release 2 iteration of it. Commenters on the proposed rule encouraged us to adopt the March 2022 iteration, as opposed to the March 2017 iteration that we had proposed to adopt.

We carefully examined the history of changes to the HL7 Attachments IG between March 2017 and March 2022 and determined that the cumulative changes reflected in the March 2022 iteration of the IG constitute “maintenance updates” because, rather than adding new content, the updates address

errata

in the existing IG content. Maintenance refers to “activities necessary to support the use of a standard adopted by the Secretary, including technical corrections to an implementation specification, and enhancements or expansion of a code set.”

Maintenance updates to standards are non-substantive in nature, unlike modifications to standards which require rulemaking to be adopted by the Secretary.

See

42 CFR 162.103.

We also consulted the DSMOs, which apprised us that the maintenance updates reflected in the March 2022 iteration of the HL7 Attachments IG better facilitate implementation of Version 6020 of the X12N 275 and X12N 277 standards for claims attachments adopted by the Secretary in this final rule. Our own in-depth evaluation along with our consultations with the DSMOs persuade us that we can confidently conclude that adopting the newer March 2022 iteration of the HL7 Attachments IG would be functionally equivalent to adopting the March 2017 iteration of the HL7 Attachments IG with errata.

Having established that the March 2022 iteration is functionally equivalent to the proposed March 2017 HL7 Attachments IG with maintenance updates, and to avoid industry confusion with respect to which IG iteration should be used, in this final rule we are adopting the March 2022 iteration of the HL7 Attachments IG which is Release 2.

Comment:

Multiple commenters expressed support for the adoption of the proposed HL7 IGs for the exchange of claims attachments information. A commenter stated that the HL7 C-CDA is widely implemented and has demonstrated its value through the flexibility it provides in delivering solicited and unsolicited information in various formats. Another commenter stated that if HHS proceeds with the implementation of the claims attachments standards for payment purposes, they support proceeding with the HL7 C-CDA standard for now.

Response:

We thank commenters for their feedback and support of our proposal.

Comment:

Multiple commenters expressed concern regarding HL7's indication that it will no longer make updates to the HL7 CDA and C-CDA standard, in favor of moving towards FHIR solutions, and recommended that HHS work with HL7 to continue maintaining the HL7 C-CDA standard or develop a plan for a FHIR-based solution. A commenter urged HHS to ensure that HL7 will continue to support and develop guides based on the HL7 CDA standard as needed.

Response:

HL7 is required, as an SSO, to continue to maintain any IGs that are adopted by the Secretary as HIPAA standards. Like all SSOs, HL7 holds weekly workgroup meetings and quarterly membership meetings to ensure that adopted standards meet the needs of HIPAA covered entities and, should a modification be needed to a standard, the workgroup would undertake its process to update it. SSOs, SDOs, or DSMOs maintain their standards in accordance with ANSI requirements and their own ANSI-approved policies; maintenance is an ANSI requirement and is embedded in each SSO's processes, so it is not governed by expectations or assumptions.

We did include a request for comment in the HIPAA Standards for Health Care Attachments proposed rule (87 FR

78444) on other standards to consider for prior authorization transactions, to which we received numerous comments advocating for the FHIR standard. We will consider these comments in our future planning with respect to the health care transaction standards adopted under HIPAA Administrative Simplification.

Comment:

A commenter expressed support for an approach that enables advancing standards-based attachment content. Additionally, since it was not referenced in the proposed rule, multiple commenters sought clarification as to whether the HL7 CDA® R2 IG: C-CDA Templates for Clinical Notes STU Companion Guide Release 3 (US Realm) Standard for Trial Use, May 2022 (HL7 C-CDA Companion Guide) may be used under the proposed health care attachments template recognition approach.

Multiple commenters recommended that HHS consider adopting the HL7 C-CDA Companion Guide. The commenters noted the HL7 C-CDA Companion Guide provides additional templates and best practices useful for attachments transactions and guidance to document creators to ensure higher levels of consistency and quality.

A commenter noted that the HL7 C-CDA Companion Guide is the primary guide to specify templates for use in the Office of the National Coordinator for Health Information Technology's (ONC)

Certification Program (ONC Health IT Certification Program) and sought confirmation of its belief that it represents templates applicable to attachments without a separate template needing to be defined. The commenter stated additional rulemaking would be needed following the publication of the next version of the HL7 C-CDA Companion Guide if HHS decided to reference this IG in the final rule. The commenter expressed concern that this would hinder industry's ability to use the HL7 C-CDA Companion Guide. Commenters also encouraged HHS to make the HL7 C-CDA Companion Guide eligible for use without specifically being referenced under the proposed health care attachments template recognition approach so that future updates to templates used within the IG could be used immediately upon publication through the accepted process.

On July 25, 2024, HHS announced a reorganization to streamline and bolster technology, cybersecurity, data, and AI strategy and policy functions which had historically been distributed across HHS. As part of the reorganization, ONC has been renamed the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology (ASTP/ONC) and has assumed oversight over technology. For more information on this reorganization refer to the press release available at:

https://www.hhs.gov/about/news/2024/07/25/hhs-reorganizes-technology-cybersecurity-data-artificial-intelligence-strategy-policy-functions.html.

Response:

We are adopting the C-CDA implementation specifications because they are already implemented and widely used in EHR systems. The HL7 C-CDA Companion Guide, which is a collection of IGs that provides standardized templates for structuring C-CDA documents, is a set of IGs defined by HL7 as a “library of C-CDA templates,” and their functionality allows that any templates created with them are compliant with the HL7 C-CDA standard. These templates essentially serve as blueprints for how specific medical information should be organized and presented when exchanging patient data between systems using the C-CDA standard.

If compatible with the HL7 C-CDA release adopted, these templates are acceptable for use once an associated LOINC code is available.

Health Level Seven International. (HL7). Understanding C-CDA and the C-CDA Companion Guide. Retrieved from

https://build.fhir.org/ig/HL7/CDA-ccda-2.1-sd/understanding_c-cda_and_the_c-cda_companion_guide.html.

Comment:

A commenter expressed support for a consistent format that would eliminate manual processes to send and receive data and allow for information to be automatically recorded into a patient's record, stating that this change would eliminate manual processes. The commenter also noted that health IT vendors are currently only required to support three HL7 C-CDA templates and stated that requiring health IT vendors to support all template types would require significant development effort while, concurrently, numerous other regulatory requirements go into effect. The commenter noted that integrating EHRs and revenue cycle products to support CDA generation would require significant development.

Response:

We understand that covered entities, or their vendors, will incur a number of one-time costs to implement the new and modified HIPAA transactions, for which we account in the RIA (section VI. of this final rule). Health IT vendors are not covered entities and therefore are not directly required to comply with the requirements. While HIPAA covered entities must comply with the requirements of this final rule, they are not required to possess technology that implements every template in the C-CDA; rather the attachments they transmit must be in accordance with the standard. We are adopting both the HL7 CDA and X12N standards for health care claims attachments transactions. Our goal is to automate health care transactions as much as possible, which will ultimately decrease costs.

Comment:

A commenter questioned the use of HL7 C-CDA templates to support prior authorization requests and stated that no health plans have mapped their clinical criteria to HL7 C-CDA templates to ensure all the data needed to make the prior authorization decisions are in those templates. The commenter stated that this lack of successful results from real-world testing is a critical issue and that payers use a data-element approach for prior authorizations rather than clinical documents. A commenter stated that the C-CDA unstructured document does not fully support the ability to carry a FHIR bundle, and that use of the C-CDA unstructured document would interfere with the IGs referenced in the CMS Interoperability and Prior Authorization proposed rule that was proposed at the time these comments were submitted. Specifically, the commenter referenced the HL7® FHIR® Da Vinci Coverage Requirements Discovery (CRD) and Document Templates and Rules (DTR) IGs, which support the use of questionnaire and responses, as part of data collection in the prior authorization process. The commenter noted it is important that real-time responses should be considered as part of the prior authorization workflow and recommended that HHS ensure that any requirements for the adoption of ePA APIs by CMS-denominated “impacted payers” be harmonized with current HIPAA prior authorization transaction standards and CMS's Interoperability and Prior Authorization rule, which has since been finalized.

Response:

We appreciate the comments submitted in response to our proposal to adopt a prior authorization health care attachments transaction standard. As articulated in section III.A. of this final rule, and noted repeatedly elsewhere, we are not finalizing our proposal to adopt prior authorization with the health care claims attachments transaction standard.

Comment:

A commenter recommended that C-CDA structured information be allowed and encouraged where appropriate, but not required. The commenter also stated that unstructured documents can, but should not be required to, utilize the Unstructured Document CDA template.

Response:

Covered entities may use any adopted documentation format that is supported by, and compatible with, the standards adopted in this rule. The IGs we are adopting also support

unstructured data documents where the HL7 C-CDA structured documents are unable to support the document or do not exist. We note that health plans must specify the types of attachment information that will be necessary to support a claim and encourage health plans conducting electronic transactions with health care providers to accept electronically both structured and unstructured C-CDA documents.

Comment:

Multiple commenters expressed that the proposed version of the HL7 Attachments IG is no longer current, noting that an updated version of the HL7 Attachments IG was published in March 2022.

A commenter recommended that HHS adopt the “most recent version” of all the proposed HL7 IGs in the final rule.

Health Level Seven International (HL7). (2022, March 8). HL7 CDA R2 Attachment Implementation Guide: Exchange of C-CDA Based Documents, Release 2—U.S. Realm. Retrieved from

https://www.hl7.org/implement/standards/product_brief.cfm?product_id=464.

Response:

We appreciate these comments and thank commenters for sharing these important considerations, which we interpret to mean that HHS should adopt the most recent iteration of the HL7 Attachments IG that was proposed, including its maintenance updates. As we explain earlier, based on the commenters' suggestions, we reviewed the March 2022 iteration of the proposed HL7 Attachments IG and consulted with standards maintenance organizations and found the March 2022 iteration of the HL7 Attachments IG is functionally equivalent to adopting the March 2017 iteration of the HL7 Attachments IG with errata. Therefore, in this final rule, we are adopting Release 2 of the HL7 Attachments IG, published in March 2022.

Comment:

A commenter recommended that HHS work with the NCVHS to develop alternative approaches to meeting the HIPAA EDI requirements that represent a more contemporary basis of interoperability. Multiple commenters stated that the proposal would leave limited ability to improve on the current state of automated support to produce the relevant data to populate the requested document type with the minimum necessary information without substantive user involvement. A commenter further explained that the proposed rule would require the use of C-CDA-based attachments in accordance with the HL7 CDA® R2 Attachment IG: Exchange of C-CDA Based Documents, Release 1—US Realm (STU) and would cover approximately 106 recognized document types. Multiple commenters pointed out that thirteen document types in C-CDA R2.1, of which three are recognized in the ONC Health IT Certification Program and one is recognized in CMS's programs, have defined C-CDA templates, but no clear implementation guidance is provided for all the other 90+ document types that are referenced. Commenters pointed out that this means some would not have a clear C-CDA document to consider, for example, a physician letter or a patient consent for treatment in an unstructured C-CDA document, while others could be structured in C-CDA format, but no agreed upon document templates exist.

Response:

We appreciate these comments and thank commenters for sharing these implementation considerations. The C-CDA standard is being adopted because it provides a widely recognized, structured format that supports interoperability and can accommodate a variety of clinical documents. The LOINC code system allows discrete identification of attachment types, including both structured and unstructured documents, and provides modifiers for templates and time windows where applicable. We believe that the C-CDA standard we are adopting broadly covers the types of documents that would be requested for health care claims. Though the standard we are adopting might not address all document types, it balances the need for standardization and efficiency with practical flexibility for health care providers while allowing the system to evolve as new document templates and business needs arise.

The document types in the HL7 Attachments IG have discrete data elements that allow HIPAA covered entities to exchange clinical information as both an unstructured and structured document. Should covered entities have future business needs that give rise to additional document types, these could be exchanged as unstructured documents by obtaining a LOINC code to identify the attachment type.

Comment:

Multiple commenters recommended that HHS reconsider adopting the standard for claims attachments transactions, given the substantial guidance still needed to enable supporting a substantially less burdensome documents-based approach. One commenter stated that in order to support a consistent exchange through FHIR-based or X12-based transactions, attachment approaches between the CDex guide and the HL7 Attachments IG need to be aligned.

Response:

We appreciate this information and encourage the industry to submit specific requests for changes and enhancements to the transaction standards to the SDO responsible for maintaining the standard.

Comment:

Multiple commenters expressed support for the use of the HL7 CDA standard, HL7 C-CDA standard, and HL7 IGs for health care attachment transactions.

Response:

We thank the commenters for their feedback and support of our proposal.

Comment:

A commenter recommended that HHS name a specific version of the HL7 IGs as a “floor” and create a sub-regulatory advancement process. The commenter stated that without a requirement to use specific IGs, the industry will not achieve the level of interoperability necessary to support data exchange. The commenter recommended that HHS establish a process, such as the ONC Standards Version Advancement Process (SVAP), to allow technology to evolve through industry testing while also allowing the industry to provide public comment.

Response:

We thank the commenters for their feedback. We note that section 1174(b)(2)(B)(i) of the Act provides authority permitting the routine maintenance, testing, enhancement, and expansion of code sets outside of the rulemaking process. We will further explore regulatory flexibilities with respect to modifications to adopted IGs. With respect to requiring that organizations adopt new and updated code sets, we note that such changes are generally considered maintenance updates, and the Secretary previously adopted LOINC as a code set for use with HIPAA health care transaction standards. Organizations can incorporate maintenance updates to a given IG, including its LOINC codes, without the need for the Secretary to engage in additional rulemaking.

Comment:

A commenter recommended that HHS modify the rule to state that the HL7 C-CDA standard be used for all documents covered by the HL7 C-CDA, but not limit health insurance providers, hospitals, and clinicians to solely use HL7 C-CDA permitted documents.

Response:

We reiterate that covered entities may use any adopted documentation format that is supported by, and compatible with, the standards adopted in this rule. Additionally, we note that the IGs we are adopting also support unstructured data documents where the HL7 C-CDA structured documents are unable to support the document or do not exist.

Comment:

A commenter offered that mandating the HL7 IG standards for HIPAA transactions is an important step forward, but expressed concern that these standards have not yet been tested

for suitability to the dental industry. The commenter provided specific examples relating to dental claims, noting that only one dental health IT module is certified under the ONC Health IT Certification Program, meaning that the majority of dental EHR systems cannot produce HL7 C-CDA. The commenter noted that dental claims require images as supporting documentation in a variety of formats (for example, BMP, JPG/JPEG, TIFF/TIF, PNG, PDF, TXT, DOC/DOCX, DICOM, GIF), and recommended that HHS allow the use of these file formats instead of mandating the sole use of HL7 C-CDA to account for specialties that may rely on unstructured data exchanges, specifically noting concerns in cases where unstructured data such as MRIs and X-rays are needed. A commenter noted that the dental industry has worked with HL7 to develop two CDA R2 attachment standards and IGs tailored to the needs of the dental industry. These two IGs, which the commenter suggested should be considered for adoption, are: (1) the HL7 CDA® R2 IG: Orthodontic Attachment, Release 1—US Realm which aims to provide a CDA-based set of templates that can be used by a dental provider to a payer for claims; and (2) the HL7 CDA® R2 IG: Exchange of C-CDA Based Documents; Periodontal Attachment, Release 1—US Realm which is used to exchange dental clinical data.

Response:

We agree that it is important that HIPAA-adopted standards support the needs of all health care types, including the needs of the dental industry. HL7 has developed two dental C-CDA standards, but, because the NCVHS has not yet recommended them for adoption and because we did not propose them in the HIPAA Standards for Health Care Attachments proposed rule, we cannot adopt them in this final rule. Should the NCVHS make such a recommendation to the Secretary, we may consider adopting these dental standards in future rulemaking. Upon publication of this final rule, we will consider outreach strategies and industry-wide policies and implementation issues, along with sector-specific approaches that may, for example, involve collaborating with multiple interested parties to conduct dental-specific outreach and education.

Final Action:

After consideration of the public comments we received, we are finalizing our proposals to adopt the following HL7 IGs as HIPAA standards for the attachment information included in health care claims attachments transactions in § 162.2002(a) and (b):

•

HL7 CDA Release 2 Attachment IG:

Exchange of C-CDA Based Documents, Release 2, March 2022 (HL7 Attachments IG).

•

HL7 Implementation Guide for CDA Release 2:

Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume One—Introductory Material, June 2019 with Errata (HL7 C-CDA IG Volume One).

•

HL7 Implementation Guide for CDA Release 2:

Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume Two—Templates and Supporting Material, June 2019 with Errata (HL7 C-CDA IG Volume Two).

F. LOINC for HIPAA Attachments

We stated in the HIPAA Standards for Health Care Attachments proposed rule (87 FR 78445) that health plans and health care providers must have a clear and unambiguous way to specify attachment information (for example, a discharge summary, surgical operation note, or cardiovascular disease consult note) to be transmitted or requested in a health care attachments transaction.

As we stated, the LOINC code set was developed for the following three principal purposes:

• To identify the specific kind of information that a health plan electronically requests of a health care provider and a health care provider electronically transmits to a health plan (for example, a discharge summary or a diagnostic imaging report).

• To specify certain optional modifier variables for attachment information (for example, a time period for which the attachment information is requested).

• For structured attachment information, to identify specific HL7 IG: LOINC Document Ontology document templates.

With respect to these three purposes, we discussed that the HL7 Attachments IG contains specific instructions for how to utilize the LOINC code set for HIPAA Attachments (87 FR 78445).

In the proposed rule, we included an overview on tools available from Regenstrief to support utilization of the LOINC for HIPAA Attachments (87 FR 78445).

Comment:

Multiple commenters supported the use of the LOINC for HIPAA Attachments, with some stating that LOINC enables health plans to request documents, which will reduce processing delays caused by current inefficient document request processes. A commenter stated that the use of LOINC for HIPAA Attachments is logical, as Regenstrief has online tools for easier searches, including a LOINC database that effectively creates an

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.