URAC Board Approves HIPAA Privacy Accreditation Standards

Twenty Companies In-Process for Accreditation

Washington, D.C., (April 8, 2003) -- URAC announced today that its Board of Directors has approved the nation's first independent HIPAA Privacy accreditation program for Covered Entities and Business Associates, and that 20 companies are currently in the process of seeking accreditation for the program. URAC's HIPAA Privacy Accreditation program enables health care organizations to display a commitment to fair information practices, and demonstrate that they have taken the necessary steps to protect health information privacy in accordance with the HIPAA Privacy Rule.

When Congress created the groundbreaking HIPAA legislation in 1996, it included compliance with a specific set of requirements related to the privacy of protected health information (PHI), but charged the health care industry itself with determining the operational standards necessary to evaluate compliance. As one of the industry's leading accreditation bodies, URAC became a focal point for the creation of an operational framework through which health care organizations could implement and validate their HIPAA Privacy compliance programs.

"URAC Board approval of the HIPAA Privacy standards marks the final step in developing a much needed accreditation system verifying that an organization has put in place the necessary infrastructure and implemented the necessary processes to comply with the HIPAA Privacy Rule," said Garry Carneal, URAC president and CEO. "I would like to personally thank all of the applicants in our beta group for helping us reach this moment."

Members of a "beta" group supply feedback to URAC as they test accreditation standards and processes to ensure that they are appropriate and effective. The beta group of in-process applicants for HIPAA Privacy accreditation is composed of 20 companies operating in more than 60 different sites across the nation. They are:

• American Specialty Health, Inc., and its affiliates including:
  - American Specialty Health Plans of California
  - American Specialty Health Networks
  - American Specialty Health Insurance Company
  - Healthyroads
• BCE Emergis
• BlueCross BlueShield of Tennessee, Inc.
• Blue Cross and Blue Shield of Louisiana
  - HMO Louisiana (BCBSLA subsidiary)
• Health Ink & Vitality Communications
• Imogen Systems
• MedRisk, Inc.
• Fiserv Health and its family of Health Plan Managers:
  - Employee Benefits Services
  - Benesight
  - Harrington
  - Fiserv Health of Kansas
  - Fiserv Health of Tennessee
• National Imaging Associates, Inc.
• Wausau Benefits

"The breadth of the beta group of applicants for HIPAA Privacy Accreditation is quite impressive," said Lisa Gallagher, senior vice president of URAC's Information and Technology Accreditation Department. "We designed the program with the ability to serve organizations of virtually any size and with the flexibility to meet the exact and differing needs of both Covered Entities and Business Associates. Receiving feedback from such a large number of beta applicants has enabled URAC to successfully test and validate this program."

Running on a parallel course to the HIPAA Privacy standards, URAC has a