Response to Comments

APPENDIX A – Comments and Responses for Information Collection Related to Information Collection Request: Extension of a currently approved collection; Title of Information Collection: Administrative Simplification HIPAA Compliance Review

Comment: One commenter from New York expressed several concerns and suggestions about what they believe is NSG’s failure to satisfy the basic requirements under HIPAA for compliance reviews. A concern is that they believe the compliance review does not provide any benefit greater than the cost of compliance and it has failed to satisfy the legal requirements for the updated forms under 44 U.S.C. 3501–3520 because it does not minimize “paperwork burden” because the data collected serves no “overarching” policy goal and does not improve compliance in the industry, it fails to “ensure the greatest possible public benefit ” does not “maximize the utility of information created, collected, maintained, or used,” and fails to effectively use information for better decision making, and accountability. The commenter does not think that CMS can do random audits and doubts that a complete database of all health plans that are required to comply with HIPAA Administrative Simplification requirements exist. They believe that HHS failed to adopt and implement the HPID (Health Plan ID), a HIPAA mandated identifier, which prevented valid methodology to sample plans or vendors for compliance. They also believe that the operating rule response/attestation document does not address common non-compliance problems and there is no validation for “self-certified” compliance claims because they believe the text on the form is too vague. Therefore, they don’t believe that OMB should approve this request.

Response: CMS appreciates the commenters feedback, however we would like to assure them that HHS is compliant with the requirements set forth at (44 U.S.C. 3501–3520). For the purposes of this notice, we have documented the commenters concerns for consideration.