Determining what is HIPAAffordable: a professional costing approach to HIPAA implementation - HIPAA Watch - Health Insurance Portability and Accountability Act

Health Management Technology, Oct, 2002 by D'Arcy Guerin Gue, John Spearly, Tom Grove

Hotly debated predictions of industry-wide costs of HIPAA compliance are one thing. Well, actually, more than one. Depending on your politics, assessments of the costs to America's healthcare industry for HIPAA implementation range from reasonable (including ROI factors) to ruinous.

What individual organizations must spend on HIPAA is quite another thing--and to those "in the trenches" of HIPAA implementation planning, arguably the real thing. Considering the frequency of HIPAA administrative simplification cost discussions in the media, it is surprising, and undoubtedly frustrating, to many that hard data on costing of individual HIPAA initiatives is rarely addressed outside of conference rooms and internal memos.

What should you be spending? How should you cost out your organization's HIPAA implementation expenditures--and what will be cost effective, at the very least--and possibly even beneficial to your operations? Are there proven models you can work from that will help ensure that HIPAA will not end up simply a major brain- and dollar-drain for your organization?

Unlike healthcare organizations that have more things to worry about (such as healthcare delivery), expert HIPAA consultants have been able to justify drilling down into these issues for years. But you don't have to hire a consultant to take advantage of their costing methodologies. Consider the following proven costing model.

Assumptions--Internal Costs

Unless you have staff with no other work to do, start out by recognizing that internal work efforts have a real dollar cost. Simplify your staff costs for HIPAA work to a few levels (rather than in precise detail) to minimize calculation complexities.

Real client examples suggest that the time of physicians and senior executives should be calculated at $100 per hour, management staff at $35 per hour and other staff at $25. If these numbers seem high, recognize that they are "loaded" rates that include indirect (i.e. benefits) and overhead costs. If these numbers still seem high for your organization, create your own. The point is, don't exclude them because the staff is already in place.

Assumptions--External Costs

No surprises here. External costs for management and technical consulting support will likely be the single biggest line item cost outside of technical security purchases. On the other hand, with careful planning, they may represent the highest value dollars you spend depending on your staff's level of expertise and available time--and considering the learning curve they may have to get the job done.

Expect to pay $150 per hour to $300 per hour plus expenses for qualified management consultants, and between $125 per hour and $225 per hour for technical consultants. Where used, consultants should be part of an internal-external mix, rather than hired to "make us compliant."

Major Initiatives

Necessary implementation tasks (which should have been generated through your gap analysis) and associated costs include:

Project management. The primary cost driver is hours allocated for project manager and staff. For large hospitals, systems, payers and clearinghouses, a full-time effort is required to manage the HIPAA implementation project. For mid-size hospitals, at least 16 hours per week should be allocated, plus strong support. For small facilities, allocate at least 12 hours per week until the project is complete. Then, apply appropriate hourly. Tip: Actual hours required will depend heavily on support provided to the project manager by other staff.

Data flow analysis. This effort, required by the security NPRM, will be invaluable for understanding the effects of identifiers throughout your information systems and for developing effective privacy practices.

Primary cost driver is the number of peer-to-peer connection points within the organization. Focus should be on three major areas: internal electronic data flow, external electronic data flow, and both internal and external paper flow. Once you know the total number of connection points, multiply them by your estimate of the number of minutes or hours required to identify and document findings.

For example, a small hospital's internal paper data flow analysis might indicate 12 departments by four hours each, and 28 unique reports by two hours each--for a total of 100 hours. Large hospitals are likely to end up with a cost of $150,000 or more, mid-size hospitals $75,000, and small hospitals $25,000.

Risk management. Primary cost drivers: cost of staff to manage the process and cost of a new risk-tracking system. Program development efforts will create the need to front load this effort. Large entities are likely to spend the half-time effort of one person for six weeks--with four hours per week thereafter. These numbers will be halved for mid-size organizations, and could be closer to five hours per week for the first six weeks, with one hour per week thereafter for small facilities.

Vendor management. This effort will include vendors of software systems that include protected health information, payers and clearinghouses. Cost drivers include number of critical vendors, hours estimated per vendor to track their compliance efforts, and consulting assistance, if needed. Tips: Include time to collect data, make repeated contact attempts and analyze results. Large facilities may need to consider a document management tool. Cost out by multiplying the number of vendors of each type by the number of hours needed to address each vendor. Major software vendors and clearinghouses will require eight hours to 16 hours each, minor vendors about half this number.