HIPAA 4010 to 5010 transition, HIPAA 5010, HIPAA rules Planning & organizational readiness Requirement audits & testing Vendor selection cautions What defines production ready? Opportunities

1. Managing the Conversion to HIPAA 5010 February 18, 2010 Mike Arrigo Managing Partner, CEO No World Borders, Inc. For more details, assessment info 5010@noworldborders.com (Please send from your payor or provider email domain address) http://www.noworldborders.com/HIPAA5010MigrationServices.html

2. 5010 Topics Planning & organizational readiness Requirement audits & testing Vendor selection cautions What defines production ready? Opportunities http://www.noworldborders.com/HIPAA5010MigrationServices.html

3. HIPAA 5010 Planning http://www.noworldborders.com/HIPAA5010MigrationServices.html

4. Planning:Identify Principles for Stakeholder Interaction Address 4010 to 5010 cutover issues Review current applications, IT projects Design approach Impacted systems Vendors Members Providers Requirements development & audit http://www.noworldborders.com/HIPAA5010MigrationServices.html

5. HIPAA 5010 Implementation Approach Business and IT Alignment – Business, technology, strategies, and resources must be aligned to achieve results. Business roadmap meets IT portfolio mgmt. Process Change and Innovation –Working with people and helping them see a better way to work. Manage Expectations, findquick wins Help the team Visualizethe process to improve buy-in Change Management & Communication – Communicate and distribute critical business knowledge, share the “wins” via social media Best-Practices Measurement – Best practice methods, and testing frameworks http://www.noworldborders.com/HIPAA5010MigrationServices.html

6. Planning – Do Not Underestimate Dec. 31, 2010, payers and providers complete first level testing Conduct internal testing throughout 2010 Once you realize that Level Two testing must be completed by the end 2011, final compliance dates are not so far away http://www.noworldborders.com/HIPAA5010MigrationServices.html

7. HIPAA 5010 Organizational Readiness http://www.noworldborders.com/HIPAA5010MigrationServices.html

8. Organizational Checklist (1 of 2) http://www.noworldborders.com/HIPAA5010MigrationServices.html Vendor Agnostic Approach Industry Standards Group Membership Experience With HIPAA, Multiple Health Plans X12 Transactions & Acks Experience Understand Association Specific Technologies Vendor Claims System SMEs Understand TR3 Impl. Guides

10. WEDI experience (an industry standards organization for EDI transactions)

11. Understand WEDI/NCHICA 5010 implementation timeline

12. CMS, ICD-9 and ICD-10 experience to understand global “end game” ramificationshttp://www.noworldborders.com/HIPAA5010MigrationServices.html For Bios & Detail Capabilities Contact Us

13. HIPAA 5010 Requirement Audits:Insurance Policy AgainstRework Downstream http://www.noworldborders.com/HIPAA5010MigrationServices.html

14. Audit Capabilities Check List:Regulatory Experience & Judgment Understand unique architecture and business organization Perform review of business requirements & artifacts Provide a detailed regulatory gap analysis between: HIPAA 5010 Final Rule and X12 Implementation Guides for HIPPA 5010 covered transactions and acknowledgements) System (i.e., receiving, archiving, validating, transforming, processing and responding) Facilitate defining the steps to complete 5010 Functional Specifications http://www.noworldborders.com/HIPAA5010MigrationServices.html

15. HIPAA 5010 Testing http://www.noworldborders.com/HIPAA5010MigrationServices.html

16. According to Gartner,A large portion of the work effort and cost for HIPAA 5010 will be in testing1 www.noworldborders.com/HIPAA5010MigrationServices.html 13 Majority of HIPAA 5010 testing isn’t about HIPAA compliance. It’s about your back end systems, end to end claims processing . . . etc. 1Version 5010 Regulatory Impact Analysis – Supplement September 2008 This document was prepared by Gartner, Inc., under a contract to the Centers for Medicare & Medicaid Services (CMS)

17. www.noworldborders.com/HIPAA5010MigrationServices.html 14 Ensure You Have HIPAA Testing Thought Leadership On Your Team Quality Assurance Methodology and Framework BRS, Functional requirements System / integration / UAT testing Design documentation End to end testing Test Automation Test Data Management Trading Partner Testing / On boarding Reusability of Artifacts for ICD-10

18. http://www.noworldborders.com/HIPAA5010MigrationServices.html Test Strategy Test Automation Test data & HIPAA Privacy Test Methodology External Testing Internal Testing

19. System Inventory, Test & Transition Plan(Sample Artifact) http://www.noworldborders.com/HIPAA5010MigrationServices.html

20. Detail Test Framework(Sample Artifact) http://www.noworldborders.com/HIPAA5010MigrationServices.html

21. Market Intelligence Laggards Lack of business & IT alignment CIO short term budget concerns Just getting started in understanding the landscape of vendors and approaches Leaders: Working to beat deadlines Investing heavily in process, people, systems Challenged by legacy issues Intent on outsourcing claims processes for laggards, at a profit http://www.noworldborders.com/HIPAA5010MigrationServices.html

22. HIPAA 5010 Vendor SelectionAuditing, Testing, Implementation (page 1 of 2) http://www.noworldborders.com/HIPAA5010MigrationServices.html

23. Issues to Consider HIPAA Transactions Experience: 820, 834, 835, 837 P, 837 I, 837 D, 270/271, 276/277 and 278 transactions and 999, Acknowledgements TA1 277CA Look for people who have lived through NPI, 4010… http://www.noworldborders.com/HIPAA5010MigrationServices.html

24. Impact of HIPAA Title II, Subtitle FWith Respect to 5010 EDI Standards Privacy & Security Transactions Code sets Identifiers Trading partner security & governance risk assessments http://www.noworldborders.com/HIPAA5010MigrationServices.html

25. HIPAA 5010 Vendor SelectionAuditing, Testing, Implementation (page 2 of 2) http://www.noworldborders.com/HIPAA5010MigrationServices.html

26. System Integration &Testing Approach, Ideas The interoperable cloud—tying heterogeneously tested data together with today's Web standards Packaged pathways—extending popular integration tools into the cloud New best practices—ensuring security and availability for dispersed resources Strategic opportunities—focusing on what you do best, using SOA to help with integration issues http://www.noworldborders.com/HIPAA5010MigrationServices.html

27. Prediction Based on Experience Most large IT projects fail on the first attempt Usually, the cause is lack of business & IT alignment Difficult to balance day to day with innovating new business value via IT Talent management plans are an after thought Suggestion for 5010 success: Make an early investment in outside professional guidance on these and other issues identified http://www.noworldborders.com/HIPAA5010MigrationServices.html

28. No World Borders 5010 Consulting Services Strategic Planning Project Management Subject Matter Experts Auditing & Testing of for 4010 to 5010 Team Experience with ~ 25 health plans and providers Private Equity backing with 10 years’ experience 25

29. Conclusion Planning & organizational readiness Requirement audits & testing planning reduces risk Augment with experts if needed Vendor selection cautions – ensure proper experience http://www.noworldborders.com/HIPAA5010MigrationServices.html

30. Mike Arrigo Managing Partner, CEO No World Borders, Inc. For more details, assessment info 5010@noworldborders.com (Please send from your payor or provider email domain address) noworldborders.com/HIPAA5010MigrationServices.html

31. Supporting Material http://www.noworldborders.com/HIPAA5010MigrationServices.html

32. www.noworldborders.com/HIPAA5010MigrationServices.html 29 Track Record Founded 2000 “Real life” experiences with NPI & HIPAA implementation Recent success story: Excellus BCBS Experience with several different Blues Seven claims systems implementations Backed by Private Equity Firm, Strong Financials Consultants in U.S., Latin America, E.U., Asia 29 No World Borders

34. WEDI experience

35. Blues Technology

36. ITS, Blue Exchange, Blue Squared

37. Software / tools vendor relationships, subject matter expertise

38. HIPAA 4010, 5010 regulatory, technical, and process expertise

39. ICD-10 regulatory, technical, and process expertise

40. Testing & validation tools & methods30

41. www.noworldborders.com/HIPAA5010MigrationServices.html 31 Audit Quality Assurance & Testing100 Years Collective Experience in Audits & Quality Assurance Healthcare, Financial and Pharmaceutical Verticals Pharmaceutical & Healthcare testing Configuration, Release Management Test Data & Automation Management Team participates in WEDI transaction & testing work groups Accomplishments Team created CCAP Testing Methodology Tested all Major EDI Translators and Validators for 4010A Original “Certifier of Certifiers” Process Author of HIPAA Reference Book Assisted Numerous Covered Entities and Vendors with Compliance

43. Regulatory

44. Process

45. System / Vendor Impacts

46. Testing & Integration

47. “Agnostic, end to end approach”32

48. 33 Process & Compliance Expertise Process improvement & claims implementation team consultants, former consultants to 21 Blues including: Alabama Blue Shield of CA CareFirst Excellus Georgia Louisiana Hawaii Indiana Premera Rhode Island Nebraska Michigan

49. 5010 & ICD-10 Testing Testing Phases Internal Testing Unit/System/Integration Product Testing (Vendor 5010/ICD-10 Software Quality) User Acceptance Testing Regression Testing Performance Testing Concurrent Testing (Deploying New 5010 Systems) Disaster Recovery/Non-Compliance Testing Post-Deadline External Testing HIPAA Compliance Edit Testing/Transaction Testing 3rd Party Certification End-to-End Testing/Trading Partner Testing Collaborative/Community Testing 1/17/2010 34 © 2010 HCCO, Inc.

50. Testing Frameworks Methodology Waterfall Agile (Test-Driven Software Development) Rational Unified Process (Iterative Development) Hybrid Models Test Data PHI Security and Privacy Concerns Absolutely Critical for Successful Testing Strategies Data Obfuscation/Data Masking/Scrambling Business Data Cohesion and Traceability to Functional Requirements 4010A Production Data for Regression Reusability Across 5010 and ICD-10 Projects 1/17/2010 35 © 2010 HCCO, Inc.

52. Automated Retrieval of Test Data

53. ROI from Reusability Across 5010 and ICD-10

54. Necessity for Reducing Timelines

56. Majority of IT Effort will be in Testing

57. Bring Testing Focus to Functional Requirements

58. Prepare for HIPAA Interpretation Differences

59. Use Analytics to Assist in Trading Partner Testing and Ramp-up

60. Testing for Both Verification and Validation

61. Verification – Have We Built the Software Right?

62. Validation – Have We Built the Right Software?1/17/2010 36 © 2010 HCCO, Inc.

64. Incorporate Better Test Data Generation Practices

65. Use Accurate Technical Test Data

66. Create Business Driven Testing Scenarios

67. Traceability to Functional Requirements

68. Have Separate Repositories to Prevent Data Corruption

69. Execute Cohesive/Coordinated Data Across all HIPAA Transactions

70. New 5010/ICD-10 Systems Bring More Testing Concerns

71. Vendor’s Software Defects

72. Internal Software Remediation Defects

73. Existing Legacy Defects

74. When Combined Equals Delays in Testing and Longer Timelines

75. Also Requires Legacy Data Migration and Heavy Regression Testing1/17/2010 37 © 2010 HCCO, Inc.

77. Automate Testing for Key Business Processes

78. Enables Faster Repetitive Regression Testing

79. Automates Test Data Conversion and Execution Processes

80. Documents Expected ICD-9 Results for ICD-10 Testing

81. Provides Reusability for ICD-10 Test Cases

82. Crucial for Performance Testing of Systems Integration

83. Use Vendor Products That Test Using HCCO CCAP Programs

84. HIPAA EDI Interpretations Tested and Aligned

85. Vendor Neutral Environment

86. Common Set of HIPAA EDI Test Data

87. Greatly Reduces Trading Partner Testing and Interpretation Ambiguities 1/17/2010 38 © 2010 HCCO, Inc.

88. Testing Will Be Critical . . . http://www.noworldborders.com/HIPAA5010MigrationServices.html