HR 3323, “Administrative Simplification Compliance Act,” was signed into law by President Bush on December 27, 2001, creating an extension of the October 16, 2002 HIPAA compliance deadline for the Transactions and Code Sets Final Rule to October 16, 2003. Organizations that wish to obtain an extension of the deadline must submit a detailed plan for meeting compliance regulations to Health and Human Services (HHS).

Compliance plans must show why the organization is not in compliance and the extent to which the organization is in noncompliance. The plan must include budgets, schedules, work plans and a timeframe for testing that begins no later than April 16, 2003. HHS is creating a model form that may be used to draft a compliance plan. The model form will be published in the Federal Register on March 31, 2002 and will be available on several Web sites. The Department of Health Care Services (DHS) will be submitting an extension request and a plan for meeting the protracted compliance deadline.

Once HHS receives compliance plans from all of the organizations requesting a one-year extension, HHS will submit the plans to the National Committee on Vital Health Statistics (NCVHS) for analysis. NCVHS will identify implementation barriers and consult with Designated Standard Maintenance Organizations (DSMO) and the Workgroup for Electronic Data Interchange (WEDI) to discuss effective solutions. These solutions will be published for public review.

An organization that is compliant by the original deadline is allowed to accept a transaction from a trading partner who is in noncompliance if the trading partner has submitted an extension plan. An organization that is not in compliance with the Transactions and Code Sets final rule by October 16, 2002, and does not request an extension, will be subject to the penalties identified in the original legislation.

The implementation deadline for small health plans will not change with HR 3323 and remains October 16, 2003. The deadline to comply with the Privacy Final Rule will also not change. The deadline for small health plans to comply with the privacy standards is April 14, 2004. For all other organizations, the deadline is April 14, 2003.