HIPPA Glossary | HIPPA Legislation | HIPPA Business Directory

1. Except as provided in paragraph (2) of this definition, business associate means, with respect to a covered entity, a person who:
   
   
   1. On behalf of such covered entity or of an organized health care arrangement (as defined in § 164.501 of this subchapter) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, performs, or assists in the performance of:
      
      
      1. A function or activity involving the use or disclosure of individually identifiable health information, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, billing, benefit management, practice management, and repricing; or
         
         
      2. Any other function or activity regulated by this subchapter;
         
         
      or
      
      
   2. Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of individually identifiable health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.
   
   
   
2. A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement, does not, simply through the performance of such function or activity or the provision of such service, become a business associate of other covered entities participating in such organized health care arrangement
   
   
3. A covered entity may be a business associate of another covered entity.

1. A health plan.
   
2. A health care clearinghouse.
   
3. A health care provider who transmits any health information in electronic form in connection with a transaction covered by subchapter 45 CFR 160.103.

• Accountability. Certification provides tangible proof that a computer system is secure. In the event of a computer system compromise, the certification can become a document of accountability to prove that you made efforts to avoid a breach of security.
• An outline. The certification requirements will provide you with an outline of policies, guidelines, and standards that you can use to protect a computer system.
• A point of reference. In the case of an audit, the certification also can provide a point-by-point description as to what was secured, how it was secured, and why it was secured.
• Without proper certification, your practice has no way to provide evidence that its computer systems are operating at a proper standard of security. However, be sure to research the validity of any certification before placing faith in it. While third-party audits and certifications generally are the most valuable, no standard exists by which to judge the certification itself.

• Outpatient services, including specialized outpatient services for children, the elderly, individuals who are chronically ill, and residents of the CMHC's mental health services area who have been discharge from inpatient treatment at a mental health facility,
  
  
• 24 hour a day emergency care services,
  
  
• Day treatment, other than partial hospitalization services, or psychosocial rehabilitation services,
  
  
• Screening for patients considered for admission to State mental health facilities to determine the appropriateness of such admission, and
  
  
• Consultation and education services.

• With the consent of the individual for treatment, payment, or health care operations;
  
  
• With the authorization of the individual for all other uses or disclosures;
  
  
• As permitted under this rule for certain public policy purposes.

1. A health plan.
   
   
2. A health care clearinghouse.
   
   
3. A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. [45 CFR 160.103]

1. A group of records maintained by or for a covered entity that is:
   
   
   1. The medical records and billing records about individuals maintained by or for a covered health care provider;
      
      
   2. The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or
      
      
   3. Used, in whole or in part, by or for the covered entity to make decisions about individuals.
   
   
   
2. For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.

1. Has 50 or more participants (as defined in section 3(7) of ERISA, 29 U.S.C. 1002(7)); or
   
   
2. Is administered by an entity other than the employer that established and maintains the plan.

1. Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body;
   
   
2. Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
   
   
3. Procurement or banking of blood, sperm, organs, or any other tissue for administration to individuals. [45 CFR 160.103]

1. Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.
   
   
2. Receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity. [45 CFR 160.103]

1. Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;
   
   
2. Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities;
   
   
3. Underwriting, premium rating, and other activities relating to the creation, renewal or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of § 164.514(g) are met, if applicable;
   
   
4. Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;
   
   
5. Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and
   
   
6. Business management and general administrative activities of the entity, including, but not limited to:
   
   
   1. Management activities relating to implementation of and compliance with the requirements of this subchapter;
      
      
   2. Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer.
      
      
   3. Resolution of internal grievances;
      
      
   4. Due diligence in connection with the sale or transfer of assets to a potential successor in interest, if the potential successor in interest is a covered entity or, following completion of the sale or transfer, will become a covered entity; and
      
      
   5. Consistent with the applicable requirements of § 164.514, creating de- identified health information, fundraising for the benefit of the covered entity, and marketing for which an individual authorization is not required as described in § 164.514(e)(2).

1. Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
   
   
2. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. [45 CFR 160.103]

1. A group health plan, as defined in this section.
   
   
2. A health insurance issuer, as defined in this section.
   
   
3. An HMO, as defined in this section.
   
   
4. Part A or Part B of the Medicare program under title XVIII of the Act.
   
   
5. The Medicaid program under title XIX of the Act, 42 U.S.C. 1396, et seq.
   
   
6. An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1)).
7. An issuer of a long-term care policy, excluding a nursing home fixed- indemnity policy.
   
   
8. An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers.
   
   
9. The health care program for active military personnel under title 10 of the United States Code.
   
   
10. The veterans health care program under 38 U.S.C. chapter 17.
    
    
11. The Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)(as defined in 10 U.S.C. 1072(4)).
    
    
12. The Indian Health Service program under the Indian Health Care Improvement Act, 25 U.S.C. 1601, et seq.
    
    
13. The Federal Employees Health Benefits Program under 5 U.S.C. 8902, et seq.
    
    
14. An approved State child health plan under title XXI of the Act, providing benefits for child health assistance that meet the requirements of section 2103 of the Act, 42 U.S.C. 1397, et seq.
    
    
15. The Medicare + Choice program under Part C of title XVIII of the Act, 42 U.S.C. 1395w-21 through 1395w-28.
    
    
16. A high risk pool that is a mechanism established under State law to provide health insurance coverage or comparable coverage to eligible individuals.
    
    
17. Any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).

1. Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1); and
   
   
2. A government-funded program (other than one listed in paragraph (1)(i)- (xvi)of this definition):
   
   
   1. Whose principal purpose is other than providing, or paying the cost of, health care; or
      
      
   2. Whose principal activity is:
      
      
      1. The direct provision of health care to persons; or
         
         
      2. The making of grants to fund the direct provision of health care to persons.

1. The health care provider delivers health care to the individual based on the orders of another health care provider; and
   
   
2. The health care provider typically provides services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products or reports to the individual.

1. Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
   
   
2. Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
   
   
   1. That identifies the individual; or
      
      
   2. With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

1. Investigate or conduct an official inquiry into a potential violation of law; or
   
   
2. Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

1. A communication from a hospital informing former patients about a cardiac facility, that is not part of the hospital, that can provide a baseline EKG for $39, when the communication is not for the purpose of providing treatment advice.
2. A communication from a health insurer promoting a home and casualty insurance product offered by the same company.

1. communications made by a covered entity for the purpose of describing the participating providers and health plans in a network, or describing the services offered by a provider or the benefits covered by a health plan; and
   
   
2. communications made by a health care provider as part of the treatment of a patient and for the purpose of furthering that treatment, or made by a provider or health plan in the course of managing an individual's treatment or recommending an alternative treatment.

• Notice Distribution A covered health care provider with a direct treatment relationship with individuals must deliver a privacy practices notice to patients starting April 14, 2003 as follows:
  
  
  • Not later than the first service encounter by personal delivery (for patient visits), by automatic and contemporaneous electronic response (for electronic service delivery), and by prompt mailing (for telephonic service delivery);
  • By posting the notice at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice; and
  • In emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates. Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request. A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information.
    
    
  The covered entities in an organized health care arrangement may use a joint privacy practices notice, as long as each agrees to abide by the notice content with respect to the protected health information created or received in connection with participation in the arrangement. Distribution of a joint notice by any covered entity participating in the organized health care arrangement at the first point that an OHCA member has an obligation to provide notice satisfies the distribution obligation of the other participants in the organized health care arrangement.
  
  A health plan must distribute its privacy practices notice to each of its enrollees by its Privacy Rule compliance date. Thereafter, the health plan must give its notice to each new enrollee at enrollment, and send a reminder to every enrollee at least once every three years that the notice is available upon request. A health plan satisfies its distribution obligation by furnishing the notice to the “named insured,” that is, the subscriber for coverage that also applies to spouses and dependents.
  
  
• Acknowledgement of Notice Receipt A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice. The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient’s written acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation.

1. A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;
   
   
2. An organized system of health care in which more than one covered entity participates, and in which the participating covered entities:
   
   
   1. Hold themselves out to the public as participating in a joint arrangement; and
      
      
   2. Participate in joint activities that include at least one of the following:
      
      
      1. Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;
         
         
      2. Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or
         
         
      3. Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.
   
   
   
3. A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;
   
   
4. A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or
   
   
5. The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

1. The activities undertaken by:
   
   
   1. A health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan; or
      
      
   2. A covered health care provider or health plan to obtain or provide reimbursement for the provision of health care; and
   
   
   
2. The activities in paragraph (1) of this definition relate to the individual to whom health care is provided and include, but are not limited to:
   
   
   1. Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;
      
      
   2. Risk adjusting amounts due based on enrollee health status and demographic characteristics;
      
      
   3. Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing;
      
      
   4. Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;
      
      
   5. Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and
      
      
   6. Disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement:
      
      
      1. Name and address;
         
         
      2. Date of birth;
         
         
      3. Social security number;
         
         
      4. Payment history;
         
         
      5. Account number; and
         
         
      6. Name and address of the health care provider and/or health plan.

1. Up to $50,000 fine and/or up to one year in prison for obtaining or disclosing protected heatlh information
2. Up to a $100,000 fine and/or up to five years in prison for obtaining protected health information under false pretenses.
3. Up to $250,000 fine and/or up to ten years in prison for obtaining or disclosing protected health information with the intent to sell, transfer or use it for commercial advantage, personal gain or malicious harm.

1. Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultation between providers regarding a patient and referral of a patient by one provider to another.
2. Payment encompasses activities of a health plan to obtain premiums, determine or fulfill responsibilities for coverage and provision of benefits, and furnish or obtain reimbursement for health care delivered to an individual and activities of a health care provider to obtain payment or be reimbursed for the provision of health care to an individual.
3. Health care operations are any of the following activities: (a) quality assessment and improvement activities, including case management and care coordination; (b) competency assurance activities, including provider or health plan performance evaluation, credentialing, and accreditation; (c) conducting or arranging for medical reviews, audits, or legal services, including fraud and abuse detection and compliance programs; (d) specified insurance functions, such as underwriting, risk rating, and reinsuring risk; (e) business planning, development, management, and administration; and (f) business management and general administrative activities of the entity, including but not limited to: de-identifying protected health information, creating a limited data set, and certain fundraising for the benefit of the covered entity.

1. Facility Directories It is a common practice in many health care facilities, such as hospitals, to maintain a directory of patient contact information. A covered health care provider may rely on an individual’s informal permission to list in its facility directory the individual’s name, general condition, religious affiliation, and location in the provider’s facility. The provider may then disclose the individual’s condition and location in the facility to anyone asking for the individual by name, and also may disclose religious affiliation to clergy. Members of the clergy are not required to ask for the individual by name when inquiring about patient religious affiliation.
   
   
2. For Notification and Other Purposes A covered entity also may rely on an individual’s informal permission to disclose to the individual’s family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person’s involvement in the individual’s care or payment for care. This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual’s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual’s care of the individual’s location, general condition, or death. In addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts.

1. Required by Law Covered entities may use and disclose protected health information without individual authorization as required by law (including by statute, regulation, or court orders).
   
   
2. Public Health Activities Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. See OCR “Public Health” Guidance; CDC Public Health and HIPAA Guidance.
   
   
3. Victims of Abuse, Neglect or Domestic Violence In certain circumstances, covered entities may disclose protected health information to appropriate government authorities regarding victims of abuse, neglect, or domestic violence.
   
   
4. Health Oversight Activities Covered entities may disclose protected health information to health oversight agencies (as defined in the Rule) for purposes of legally authorized health oversight activities, such as audits and investigations necessary for oversight of the health care system and government benefit programs.
   
   
5. Judicial and Administrative Proceedings Covered entities may disclose protected health information in a judicial or administrative proceeding if the request for the information is through an order from a court or administrative tribunal. Such information may also be disclosed in response to a subpoena or other lawful process if certain assurances regarding notice to the individual or a protective order are provided.
   
   
6. Law Enforcement Purposes Covered entities may disclose protected health information to law enforcement officials for law enforcement purposes under the following six circumstances, and subject to specified conditions: (1) as required by law (including court orders, court-ordered warrants, subpoenas) and administrative requests; (2) to identify or locate a suspect, fugitive, material witness, or missing person; (3) in response to a law enforcement official’s request for information about a victim or suspected victim of a crime; (4) to alert law enforcement of a person’s death, if the covered entity suspects that criminal activity caused the death; (5) when a covered entity believes that protected health information is evidence of a crime that occurred on its premises; and (6) by a covered health care provider in a medical emergency not occurring on its premises, when necessary to inform law enforcement about the commission and nature of a crime, the location of the crime or crime victims, and the perpetrator of the crime.
   
   Decedents Covered entities may disclose protected health information to funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
   
   
7. Cadaveric Organ, Eye, or Tissue Donation Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue.
   
   
8. Research “Research” is any systematic investigation designed to develop or contribute to generalizable knowledge. The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual’s authorization, provided the covered entity obtains either: (1) documentation that an alteration or waiver of individuals’ authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought. A covered entity also may use or disclose, without an individuals’ authorization, a limited data set of protected health information for research purposes (see discussion below). See OCR “Research” Guidance; NIH Protecting PHI in Research.
   
   
9. Serious Threat to Health or Safety Covered entities may disclose protected health information that they believe is necessary to prevent or lessen a serious and imminent threat to a person or the public, when such disclosure is made to someone they believe can prevent or lessen the threat (including the target of the threat). Covered entities may also disclose to law enforcement if the information is needed to identify or apprehend an escapee or violent criminal.
   
   
10. Essential Government Functions An authorization is not required to use or disclose protected health information for certain essential government functions. Such functions include: assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, making medical suitability determinations for U.S. State Department employees, protecting the health and safety of inmates or employees in a correctional institution, and determining eligibility for or conducting enrollment in certain government benefit programs.
    
    
11. Workers’ Compensation Covered entities may disclose protected health information as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses. See OCR “Workers’ Compensation” Guidance.

1. Except as provided in paragraph (2) of this definition, that is:
   
   
   1. Transmitted by electronic media;
      
      
   2. Maintained in any medium described in the definition of electronic media at § 162.103 of this subchapter; or
      
      
   3. Transmitted or maintained in any other form or medium.
   
   
   
2. Protected health information excludes individually identifiable health information in:
   
   
   1. Education records covered by the Family Educational Right and Privacy Act, as amended, 20 U.S.C. 1232g; and
      
      
   2. Records described at 20 U.S.C. 1232g(a)(4)(B)(iv).

1. Name
2. Address
3. Phone Numbers
4. Fax Number
5. Dates (birth, death, admission, discharge, etc.)
6. Social Security Number
7. E-mail Address
8. Medical Record Numbers
9. Health Plan Beneficiary Numbers
10. Account Numbers
11. Certificate or License Numbers
12. Vehicle Identifiers and Serial Numbers, including license plate numbers
13. Device Identifiers and Serial Numbers
14. Web Universal Resource Locators (URLs)
15. Internet Protocol (IP) Address Numbers
16. Biometric Identifiers, including finger and voice prints
17. Full Face Photographic Images and any comparable images
18. Any other unique identifying number, characteristic, or code
19. Patient's Medical History

1. Documented Institutional Review Board (IRB) or Privacy Board Approval
   
2. Preparatory to Research
   
3. Research on Protected Health Information of Decedents
   
4. Limited Data Sets with a Data Use Agreement
   
5. Research Use/Disclosure With Individual Authorization
   
6. Accounting for Research Disclosures
   
7. Transition Provisions
   
   

   ---

   
   

1. Classification of components.
   
   
2. Specification of Materials, performance, or operations.
   
   
3. Delineation of procedures. [45 CFR 160.103]

1. For a health plan established or regulated by Federal law, State has the meaning set forth in the applicable section of the United States Code for such health plan.
   
   
2. For all other purposes, State means any of the several States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, and Guam. [45 CFR 160.103]

1. Health care claims or equivalent encounter information.
   This transaction may be used to submit health care claim billing information, encounter information, or both, from health care providers to payers, either directly or via intermediary billers and claims clearinghouses.
   
   
2. Health care payment and remittance advice.
   This transaction may be used by a health plan to make a payment to a financial institution for a health care provider (sending payment only), to send an explanation of benefits remittance advice directly to a health care provider (sending data only), or to make payment and send an explanation of benefits remittance advice to a health care provider via a financial institution (sending both payment and data).
   
   
3. Coordination of benefits.
   This transaction set can be used to transmit health care claims and billing payment information between payers with different payment responsibilities where coordination of benefits is required or between payers and regulatory agencies to monitor the furnishing, billing, and/or payment of health care services within a specific health care/insurance industry segment.
   
   In addition to the nine electronic transactions specified in section 1173(a)(2) of the Act, section 1173(f) directs the Secretary to adopt standards for transferring standard data elements among health plans for coordination of benefits. This particular provision does not state that these should be standards for electronic transfer of standard data elements among health plans. However, we believe that the Congress, when writing this provision, intended for these standards to be an electronic form of transactions for coordination of benefits and sequential processing of claims. The Congress expressed its intent on these matters generally in section 1173(a)(1)(B)of the Act, where the Secretary is directed to adopt "other financial and administrative transactions ... consistent with the goals of improving the operation of the health care system and reducing administrative costs."
   
   
4. Health care claim status.
   This transaction may be used by health care providers and recipients of health care products or services (or their authorized agents) to request the status of a health care claim or encounter from a health plan.
   
   
5. Enrollment and disenrollment in a health plan.
   This transaction may be used to establish communication between the sponsor of a health benefit and the payer. It provides enrollment data, such as subscriber and dependents, employer information, and primary care health care provider information. A sponsor is the backer of the coverage, benefit, or product. A sponsor can be an employer, union, government agency, association, or insurance company. The health plan refers to an entity that pays claims, administers the insurance product or benefit, or both.
   
   
6. Eligibility for a health plan.
   This transaction may be used to inquire about the eligibility, coverage, or benefits associated with a benefit plan, employer, plan sponsor, subscriber, or a dependent under the subscriber’s policy. It also can be used to communicate information about or changes to eligibility, coverage, or benefits from information sources (such as insurers, sponsors, and payers) to information receivers (such as physicians, hospitals, third party administrators, and government agencies).
   
   
7. Health plan premium payments.
   This transaction may be used by, for example, employers, employees, unions, and associations to make and keep track of payments of health plan premiums to their health insurers. This transaction may also be used by a health care provider, acting as liaison for the beneficiary, to make payment to a health insurer for coinsurance, copayments, and deductibles.
   
   
8. Referral certification and authorization.
   This transaction may be used to transmit health care service referral information between health care providers, health care providers furnishing services, and payers. It can also be used to obtain authorization for certain health care services from a health plan.
   
   
9. First report of injury.
   This transaction may be used to report information pertaining to an injury, illness, or incident to entities interested in the information for statistical, legal, claims, and risk management processing requirements.
   
   
10. Health claims attachments.
    This transaction may be used to transmit health care service information, such as subscriber, patient, demographic, diagnosis, or treatment data for the purpose of a request for review, certification, notification, or reporting the outcome of a health care services review.
    
    
11. Other transactions that the Secretary may prescribe by regulation.
    Under section 1173(a)(1)(B) of the Act, the Secretary may adopt standards, and data elements for those standards, and for other financial and administrative transactions deemed appropriate by the Secretary. These transactions would be consistent with the goals of improving the operation of the health care system and reducing administrative costs.