Peck has also added an intrusion-detection system from Internet Security Systems to ensure compliance with HIPAA's data security requirements, which take full effect in two years.
"The HIPAA security regs are the stuff that we should be doing anyway," Peck says. "HIPAA just gives you the hammer to do it now."
The price tag for HIPAA upgrades is steep. Consultants we spoke with estimate that insurers and providers will spend between two and five times what they spent on Y2K remediation. For a large organization, that adds up to at least $4 million; some insurers will spend $10 million.
HIPAA accounts for the fact that not every health-care provider has the resources of a Children's or St. Vincent. Providers are directed to do what they can and then document what they did and why they did it. The key is making sure you have been diligent in the event of a lawsuit.
Even so, many providers, especially small medical practices that relied on their software vendors to provide HIPAA updates, won't be ready when the transaction and security deadlines hit, in October 2003 and April 2005, respectively. Many are expected to revert to paper forms--a nightmare for the insurers, whose work forces and IT systems are calibrated to process claims electronically.