Contingency Planning: Addressing Critical Business Processes That Support Implementation of HIPAA Transactions

Marie Margiottiello, CMS

Henry Chao, CMS

February 12, 2003

New Orleans

Overview

Definitions
Risk Analysis
Analyzing Risk Relative to HIPAA Impact

Identification of Critical Business Processes

Identification of Potential Failures Business Impact Analysis

Minimum Acceptable Levels Identification of Alternatives/Contingency

Develop The COOP
Testing
Training & Updating the Plan
Examples

Definitions

DISASTER

RECOVERY PLAN:
The document that defines the resources,
actions, tasks and data required to manage the business recovery process in the event of a business interruption. The plan is designed to assist in restoring the
business process within the stated
disaster recovery goals.

Source: Disaster Recovery Journal

Definitions

CONTINGENCY

PLAN:
A plan used by an organization or
business unit to respond to a specific systems failure or disruption of operations. A contingency plan may use any number of resources including
workaround procedures, an alternate
work area, a reciprocal agreement, or
replacement resources.

Source: Disaster Recovery Journal

Definitions

DISASTER

RECOVERY PLANNING:
The technological aspect of business continuity
planning. The advance planning and
preparations that are necessary to minimize loss and ensure continuity of the critical business functions of an organization in the event of disaster.
SIMILAR TERMS: Contingency Planning;
Business Resumption Planning; Corporate
Contingency Planning; Business Interruption
Planning; Disaster Preparedness.

Source: Disaster Recovery Journal

Definitions

PLANNING:
Process of developing advance arrangements and procedures that enable an organization to respond to an event that could occur by chance or unforeseen
circumstances.

CONTINGENCY

Source: Disaster Recovery Journal

Definitions

CONTINUITY OF OPERATIONS PLAN (COOP): A COOP provides guidance on the system restoration for emergencies, disasters,
mobilization, and for maintaining a state of
readiness to provide the necessary level of information processing support commensurate with the mission requirements/priorities identified by the respective functional proponent. This term traditionally is used by the Federal Government and its supporting agencies to describe activities
otherwise known as Disaster Recovery, Business
Continuity, Business Resumption, or Contingency
Planning. Source: Disaster Recovery Journal

Definitions

For consistency, use Continuity Of Operations Plan (COOP) COOP can be inclusive of all activities associated with previous terms Organizational readiness begins with clear recognition, understanding, and commitment to the scope of your COOP
You get what you pay for

Risk Analysis

How

likely is it to occur ?
~ and ~

What impact would it have ?

Risk Analysis

Specify

probability and criticality

Product of: (probability) x (criticality)

Probability: chance that the future event will occur

(if present, its a problem, not a risk)

Criticality: the impact of a future event

(no impact = no risk)

Risk Analysis

Degrees

of probability

High nearly certain (80 99%)

Moderate probable, possible (20 80%) Low improbable (< 20%) More ranges may be appropriate

Risk Analysis

Degrees

of Criticality

High total failure or serious degrading of

business function
Moderate impaired performance Low little impact, but more than none
More ranges may be appropriate

Analyze Risk Relative to HIPAA

Use

accurate stats for your operations

Number of beneficiaries
Number of providers Volume of transactions (by provider type, if possible) $ value of transactions MCOs Helpline/Hotline call volume Payment cycles Waiver programs Contractors roles
Are

there state-level coordination issues?

Identification of Critical
Business Processes

Identify

events with potential to degrade

ability to do business

Eligibility - Inquiry & Response Beneficiary Enrollment / Disenrollment Authorization Request & Response Claim / Encounter
Remittance / Payment
Claims Status - Inquiry & Response

Identification of Potential Failures

Describe expected outcome of each event:

Eligibility
Inquiry not possible (receipt, validation, processing) Response not possible (generation, translation, transmission)

Enrollment / Disenrollment
Enrollment not possible (generation, translation, transmission) Disenrollment not possible ( generation, translation, transmission)

Authorization

Request not possible (receipt, validation, processing)

Response not possible (generation, translation, transmission)

Identification of Potential Failures

Claim

Claim receipt not possible (receipt, translation)

Claim processing not possible (validation, adjudication)

Remittance / Payment

RA not possible (generation, translation, transmission)

Claim Status
Status inquiry not possible ( receipt, validation, processing ) Status response not possible ( generation, translation, transmission)

Identification of Potential Failures

Identify users and areas likely and seriously

affected

System areas modified but not tested thoroughly

System areas tested only internally (not tested via actual B-2-B) Areas of end-user unfamiliarity (new processes, new outputs, new interfaces)
Trading partner issues (process, product)
Multiple degradations/failures, source of problem not
easily determined
Trickle down effect, identify other business associates
affected

Business Impact Analysis

Identify

business process affected

Determine tolerance level if function(s) are degraded, disrupted, or completely unavailable

Business Impact Analysis

Analyze

process and ask how BAD is it

(really), if:

Providers cant determine if patients are eligible,

or what theyre eligible for ? Recipients cant get enrolled into a health plan ? Medical services cant be authorized ? Claims arent received electronically ?
Claims cant be processed ?
(validated, adjudicated, rejected, archived, etc.)
Providers cant be paid ?
Providers cant tell what the status of a claim is ?

What Is The Tolerance?

Determine risk actions to be taken based on varying

levels of tolerances for critical processes

Accept risk (do nothing) Watch it (monitor) Mitigate (reduce criticality and/or probability) Plan for contingencies

Business Impact Analysis

Document

risk analysis (description and

rationale) Prioritized listing of critical business processes Business processes should be identified,
evaluated, and then ranked in order of
importance

Business Impact Analysis

Dependency Dep #1 Dep #2 Dep #3

Probability

Business Process: Duration

Criticality Impact

Total Risk Score

Business processes BP #1 BP #2 BP #3 And so on # of beneficiaries impacted # of providers impacted % costs of this business process compared with total enterprise % of monthly transactions Political sensitivity Whats the adverse impact on beneficiaries Whats the adverse impact on providers Total score

Business Impact Analysis

Minimum Acceptable Levels

Eligibility

inquiries & responses

Enrollments & Disenrollments Authorization requests & responses Claims receipt & adjudication of EDI and paper
Remittance
Claims Status inquiries & responses

Identification of Alternatives
Selection of Contingency

For

each critical business process, identify

all the possible alternatives (workarounds) ONE alternative for each business process / scenario

Select

Develop The COOP

Each

contingency needs to specify:

(baseline parameters for planning)

(indication of failure) (who to tell) ERT (who does what) (the work-around)
(for how long)
(see how it goes)

Assumptions Triggers Notification Resource Assignments Procedures Duration Monitoring

Develop The COOP

Analyze

and document required resources

to support the plan Establish command, communication, and control procedures for executing the plan; Includes:
Timely recognition of trigger of disruption Designated plan invoker
Organized, responsive, and accessible

emergency response team (ERT)

Develop The COOP

Does your Incident Reporting mechanism work like

this:
or slightly faster

Require tested and operational Incident Reporting

mechanism to support all communication channels

Develop The COOP

Minimum Acceptable Level of Service: This is

some predetermined level of service. It may be a
percent of volume or length of time, etc.
Triggers: These are the specific failure points that cause a COOP to be invoked. Events may be separated from triggers by a period of time before the contingency is invoked
Concept of Operations: The concept of operations
is a short summary paragraph providing a macro
level view of how the workaround will unfold

Develop The COOP

Emergency

Response Teams

ERTs are tailored for each business process

The information should include positions,

names of who is assigned, function, and telephone numbers [work, home, cell, pager], etc. Contact procedures for ERT members: This section should indicate what method will be used to contact the ERT members: e.g. phone
trees with home/cell/work numbers, code announcements for state employees, email, other alternate means

Develop The COOP

Escalation of Problems and Reporting Procedures:

This is the information that is conveyed in the execution of the COOPsverbal, written, frequency Training Plan: This section explains the why training is conducted, when it will be done, who conducts and receives training, and how. (Prep for doing the CPs, periodic, and just-in-time.)
Validation Plan: This section describes a process for testing and validating the COOP.

Develop The COOP

Outreach Plan: This section explains how and when the Medicaid enterprise will communicate to beneficiaries and providers that contingency operations have started and ended Plan Maintenance Procedures: This section describes how the COOP will be reviewed, changed, updated and whois responsible
Day One Strategy: Procedures for the initial transition to the COOP Distribution: This section lists who and
where copies of the COOP are located

Develop The COOP

Disaster Recovery Plan: This section may be where a copy of the DRP (May be your F/A) is located for reference (IT and infrastructure) Alternative Strategies: This section provides for the identification of all possible workarounds from which one is selected (with justification)
Example: Provider Claims

hold all claims until system is recovered pay percentage of historical (previous month, quarter, year) pay prioritized list of providers most significantly impacted if not paid first in first out

Develop The COOP

Business partners affected: This section should identify all the business partners / other agencies affected by the implementation of the COOP --
who Resources and cost estimates to implement the COOP: This is a list of those things necessary to execute the COOP -- what
Restore to normal ops: This section contains procedures for transitioning back to normal operations after a contingency is no longer required

COOP Organization

Governor

Public Relations Crisis Coordination Enterprise Management Team (XMT) Emergency Management Team (EMT) Emergency Response Team (ERT)

CMS

Media

Beneficiaries

Providers

Contractors

Other State Agencies

Financial Institutions

Other Federal Agencies

Other Stakeholders

COOP Testing

Exercise

COOP to ensure:

Adequacy of assumptions
Staff comprehension of COOP procedures Under duress, staff can accomplish in expected

timeframes, produce expected outcomes (for example, MALS)

Assigned COOP resources (alternate site,
equipment, lines, ERT, etc.) are functional,
available

Training

Raise Awareness
Periodic presentations to team members, management, new

employees Offer external COOP training, conference opportunities, create library of publications

Conduct Validation Exercises

Desktop walk-thru or more realistic simulation fire drill Pre-exercise brief, audit the process, document progress, allow

participant feedback, and debrief

Establish change control procedures

Establish uniform distribution of plan; version control

Updating the COOP

As

personnel change
As situations change
Cycle of continuous improvement
Training
Revising

Testing

Table of Contents From Actual State BCCP/COOP Plan

I. II. III.

Introduction Current Business Process Overview

Assumptions
Concept of Contingency Operations a. Responsibilities Rapid Response Organization: i. Executive Team ii. Operating Team iii. Business Contingency Plan Managers b. Incident Management Guide c. Phone Trees IV. Eligibility Verification V. Claims Processing/Reimbursement Services VI. Systems Management VII. General Administration VIII. Managed Care IX. Chronic Care X. Acute Care XI. Legal and Regulatory
XII. [Fiscal Agent] Disaster Recovery Plan

CMS Central Office Response Process for State-Level Disaster/Disruption-Page 1

Notification may come from a variety of sources including, but not limited to: CMS Senior Staff CMS Regional Office(s) Press Office Public Media Disaster Event Affecting StateLevel Medicaid Operations ERT Leader should be made aully aware of the situation 018D indicates the use of a "Plan Invoker"--This is either a senior-level manager or a RMS designated contact

Start Event Log Entries Disruption to State Payment and Eligibility Function Decide if disruption affects RO's ability to operate normally Is the RO Affected?

No

Yes Page 4 lists the steps required to address disruption to the RO from the perspective of the CO. Each RO may invoke individual procedures, i.e., shift operations to another RO

Verify with Respective RO Staff (Preferably the RA or ARA) Yes RO Request copy of BCCP Forward to 018D ERT Leader SMA Invoked Contingency Plan?

Go to Page 4

No

Notify ERT Alternate and/or Co-Leader

RO Contact SMA Staff to Asess Intention to Invoke BCCP

It is possible that the SMA invoked a systems disaster recovery plan rather than a business continuity plan- which is much more comprehensive. Determine the kind of plan invoked and compare the appropriateness of the response versus the disruption.

Begin Assessment of Impact to State Functions

Communicate SMA Intention to ERT Leader

ERT Leader or Designee

No response required

Decide Initial Response Procedure

Only need subset of ERT

Exit point will be determined by the ERT Leader. Although no formal emergency response is required, ERT leader may designate a monitoring function prior to a complete exit.

Estimate impact requires significant resources

Notify Select Members of ERT

Notify all ERT Members Go to Page 2

Go to Page 2

Gap Analysis For each phase from Gap Analysis through COOP, fill in the corresponding cells for each HIPAA transaction. Italicized, indented business processes are listed as prompters to ensure these have been addressed in each phase of HIPAA implementation. The list serves as a guideline and is not an exhaustive list of processes that is necessary to be addressed for HIPAA implementation.

Renovation HIPAA Transaction with Associated Supporting Business and System Functions Tested Endto-End

Testing

Implementation and Transition

Continuity of Operations

HIPAA Transaction and supporting business process assessed for HIPAA impact

HIPAA Transaction and supporting system functions renovated

Start Date of End-ToEnd Testing for HIPAA Transaction Date or Expected Date

HIPAA Transaction with Associated Supporting Business and System Functions Implemented

Completed as of

Completed as of

Completed as of

Completed as of

Completed as of Date or Expected Date

Start Date of Implementa tion of HIPAA Transaction Date or Expected Date

COOP Updated for HIPAA Transaction

Unable to Meet 10/16/2003 Deadline for HIPAA Transaction, Prioritze for COOP Indicate Priority

Y/N Professional Claim/ Encounter [837P] Inpatient Claim/ Encounter [837I] Dental Claim/ Encounter [837D] Pharmacy Claim/ Encounter [NCPDP] Claim Receipt and Translation Claim Adjudication/Pricing/Calculation Capitation Payment Managed Care Administration Fee Payment Institutional LTC Payment Premium Payment [820] Medicare Buy-in Premium Payment Private Health Insurance Premium Payment Non-Standard Claim Payment Mass Claim Adjustment Transaction Claim, Encounter, and Payment Communications Remittance Advice [835] Claims Payment Check/Warrant Processing

Date or Expected Date

Y/N

Date or Expected Date

Y/N

Date or Expected Date

Y/N

Date or Expected Date

Y/N

Claim Status Request, Voice/Fax/Electronic Claim Status Response [277] Claim Status Response, Voice/Fax/Electronic Eligibility Verification Request [270] Processing Request, Voice/Fax/Electronic Eligibility Verification Response [271] Processing Response, Voice/Fax/Electronic Eligibility and Enrollment Notices and ID Documents Recipient Maintenance, Communication/TPL/Appeals/Lock-in Eligibility Data Exchange Enrollment Transaction [834] Enrollment Rosters to MCO Request for Auth. of Service [278] Response for Auth. of Service [278] Prior Authorization Receipt, Voice/Fax/Paper/Electronic Messages, Receipt/Acknowledge/Accept/Reject

The following business processes are from Medicaid Administration and Utilization Management areas, which are impacted in varying degrees by some or all of the HIPAA transactions and would have to be addressed in all phases of HIPAA implementation from Gap Analysis through Continuity of Operations Planning.
Utilization Review Review, Medical/Peer/Administrative Generate and Distribute EOMBs Catastrophic Case Management SURS Establish System Parameters SUR Case Referrals for Investigation Provider Prepayment Review Retro DUR Fraud Detection Processing, Data Mining Quality Assurance, Medicaid/MCO/Enrollment Broker Rate Setting Rate Setting, Fee For Service/Managed Care/Co-Payment/Capitation Rates/Waiver Rates Rate Calculation, Institutional/Outpatient/Pharmacy/Clinic/Encounter/Non-Institutional Practitioner DME and Supplies Rates and Clinical Lab Fee Schedule Fees, Case Management/Administration Management Reporting Reporting, EPSDT/MSIS/HEDIS Decision Support Claims History Inquiry 1099 Production Public Health and Vital Statistics Reporting Financial Management Accounts Receivable/Payable/TPL Collection/Drug Rebate/Recoveries/Bank Reconcilliation Drug Rebate Drug Rebate Claim Selection Drug Rebate Invoicing Drug Manufacturer Response Processing Auditing Pharmacy Fill Fee Audit Cost Settlement Audits Quality Control Medicaid Eligibility Quality Control Claims Processing Quality Audits Translator Administration Translator Contract Management Mapping to Adjudication System Translator Maintenance Trading Partner Administration Data Exchange Information Acquisition Data Exchange Information Maintenance