Last updated: November 2026
A HIPAA electronic transactions and operating rules compliance program is the inventory, role matrix, vendor terms and exception log that keep a health plan, clearinghouse or provider conducting standard transactions as 45 CFR Part 162 requires. It is for compliance, revenue cycle and IT leaders who need to know which standard each transaction uses and who owns it, and who must plan for the claims attachments compliance date of May 26, 2028. Integral Healthcare Solutions (IHS) has three practice lines (Accreditation Consulting, Compliance Services and Program Development), and this program is in Compliance Services. IHS drafts the documents for your leaders to adopt.
What does 45 CFR Part 162 require?
Part 162 requires covered entities to conduct covered transactions as standard transactions and places duties on plans, clearinghouses and business associates. IHS read 45 CFR Part 162, 45 CFR Part 160 and the final rule CMS-0053-F, 91 FR 14350 (March 24, 2026) on November 5, 2026.
Duties by role
- Definition: section 162.103 says "Standard transaction means a transaction that complies with an applicable standard and associated operating rules adopted under this part."
- Covered entities: under section 162.923(a), a covered entity that conducts a transaction using electronic media, with another covered entity that must comply with the adopted standard (or within the same covered entity), and for which the Secretary has adopted a standard, must conduct it as a standard transaction, except as otherwise provided in Part 162.
- Business associates: a covered entity that chooses to use one for all or part of a transaction must require it to comply with all applicable requirements of Part 162 and to bind any agent or subcontractor the same way (section 162.923(c)).
- Health plans: section 162.925(a)(2) says "A health plan may not delay or reject a transaction, or attempt to adversely affect the other entity or the transaction, because the transaction is a standard transaction." Paragraph (a)(3) says "A health plan may not reject a standard transaction on the basis that it contains data elements not needed or used by the health plan (for example, coordination of benefits information)."
- Clearinghouses: when acting as a business associate, a clearinghouse may translate between standard and nonstandard transactions for the covered entity (section 162.930).
- Trading partner agreements: a covered entity must not enter one that changes the definition, data condition or use of a data element or segment in a standard or operating rule, except where necessary to implement State or Federal law or to protect against fraud and abuse (section 162.915(a)).
Operating rules and named standards
Section 162.1203 adopts CAQH CORE Phase I and Phase II operating rules for eligibility, and section 162.1403 adopts Phase II rules for claim status, each on and after January 1, 2013 and each excluding the CORE rules that reference and pertain to acknowledgements and CORE certification. Section 162.1603 adopts the Phase III CORE EFT and ERA Operating Rule Set on and after January 1, 2014, except Requirement 4.2 of the 835 infrastructure rule.
Some standards change on a schedule. For retail pharmacy drug claims, section 162.1102(e) lists both the current and the newer NCPDP standards for August 14, 2027 through April 14, 2028, and paragraph (f) applies the newer ones on and after April 14, 2028.
The claims attachments rule
- CMS-0053-F adopts standards for health care claims attachments transactions and for electronic signatures used with them.
- Its dates read "Effective Date: This final rule is effective on May 26, 2026." and "Compliance Date: Compliance with these regulations is required by May 26, 2028."
- Section 162.2002 adopts the X12N 275 and 277 transactions and HL7 guides for the period on and after May 26, 2028.
- The rule says "we have elected not to finalize health care attachments standards supporting prior authorization transactions at this time."
Who needs this program and what triggers it
Health plans, clearinghouses and providers need a program that shows, for each transaction, the standard used and the owner, because Part 162 assigns duties by role. Four situations usually start the work:
- Preparing for the May 26, 2028 compliance date in CMS-0053-F.
- A trading partner rejects a transaction as nonstandard, or your plan rejects one for extra data elements.
- A new clearinghouse or billing vendor is added without the Part 162 duty in its business associate terms.
- The organization has no inventory of the standard and version it uses for each transaction.
What happens when a transaction is challenged?
CMS states that it "is charged on behalf of HHS with enforcing compliance with adopted Administrative Simplification requirements" (CMS enforcement page, opened November 5, 2026).
- A person may file a complaint with the Secretary within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless the Secretary waives the limit for good cause (section 160.306).
- On its Compliance Review Program page (opened November 5, 2026), CMS says "Corrective Action Plans are commonly used to address non-compliance" and "In cases of willful and egregious noncompliance, monetary penalties may be assessed and calculated on a case by case basis."
- Section 160.402(a) provides, subject to section 160.410, that the Secretary will impose a civil money penalty on a covered entity or business associate the Secretary determines has violated an administrative simplification provision. Under section 160.410(c), for violations occurring on or after February 18, 2009, the Secretary may not impose one if the entity establishes to the satisfaction of the Secretary that the violation was not due to willful neglect and was corrected during the 30-day period beginning on the first date the entity knew, or by exercising reasonable diligence would have known, of the violation, or during a longer period the Secretary determines appropriate based on the nature and extent of the failure to comply.
How IHS helps
IHS reads Part 162 as a division of work by role; that is IHS's reading, not the regulation's wording. A program can then be a role-by-transaction matrix backed by the documents below.
What IHS drafts
- A transaction-and-standard inventory template: one row per transaction with its standard, version, date window, owner and trading partners.
- A role matrix for plan, provider, clearinghouse and business associate duties.
- A vendor and business-associate flow-down checklist keyed to section 162.923(c).
- A change-calendar entry for Subpart T and the other dated standards.
- An exception log for rejected standard transactions, covering both sides of section 162.925(a).
- A mock internal audit of the evidence file.
What you supply
You supply the documents listed under "What to have ready." Counsel reads contracts and enforcement exposure.
The real limit
IHS does not build interfaces, certify systems or test with trading partners, and it does not contact HHS or CMS. Your organization acts for itself. IHS gives no legal advice on penalties.
What to have ready
- A list of every electronic transaction you conduct, with the standard and version in use (section 162.923(a)).
- Your clearinghouse and billing vendor contracts and the business associate terms in them (section 162.923(c)).
- Your trading partner agreements and companion guides (section 162.915).
- Rejection and denial reports showing transactions rejected for being standard or for extra data elements (section 162.925(a)(2) and (a)(3)).
- The functions each clearinghouse performs for you (section 162.930).
- The operating rule set you follow for eligibility, claim status and remittance transactions (sections 162.1203, 162.1403 and 162.1603).
- Your owner and plan for the claims attachments transaction (CMS-0053-F, May 26, 2028).
A free introductory call is the place to walk through this list and agree what IHS drafts first.
How it compares
This program covers Part 162 and its role duties.
| Route | Governing text | What IHS drafts |
|---|---|---|
| HIPAA transactions program (this page) | 45 CFR Part 162 and CMS-0053-F | Inventory, role matrix, flow-down checklist, exception log, Subpart T calendar entry |
| General compliance program | Laws and contracts that apply to your organization | Compliance plan, policies, monitoring |
| Interface build or system certification | Your vendor's and trading partners' technical requirements | None; IHS does not build interfaces or certify systems |
See compliance program development and Compliance Services.
What it costs
The text opened sets no authority fee for conducting standard transactions, so the costs are consulting and your own staff time.
- Authority fees: none stated in the text opened.
- Consulting fees: IHS scopes each engagement after a free introductory call. Transaction types, trading partners, vendors and the gaps the first inventory finds move the scope.
- Your internal time: your compliance, revenue cycle and IT owners and counsel build the inventory and review vendor terms.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm.
- It is not an interface build, system certification or trading-partner testing.
- It is not contact with HHS or CMS; IHS contacts neither.
Frequently asked questions
What is a HIPAA standard transaction and who must use it?
Section 162.103 defines it as a transaction that complies with an applicable standard and associated operating rules adopted under Part 162. Section 162.923(a) requires a covered entity to conduct such a transaction as a standard transaction, subject to that section's conditions.
Can a health plan reject a claim because it is a standard transaction?
No. Section 162.925(a)(2) bars a plan from delaying or rejecting a transaction, or attempting to adversely affect the other entity or the transaction, because it is a standard transaction.
What does a covered entity owe when it uses a clearinghouse?
If it chooses to use a business associate for all or part of a transaction, section 162.923(c) requires it to make the business associate comply with all applicable Part 162 requirements and bind any agent or subcontractor the same way.
What are CAQH CORE operating rules and which ones does Part 162 name?
Operating rules are the business rules for electronic exchange that a standard does not define (section 162.103). Part 162 adopts CAQH CORE rules for eligibility (section 162.1203), claim status (section 162.1403) and electronic funds transfers and remittance advice (section 162.1603), each with the exclusions stated in that section.
What is the claims attachments rule and when must we comply?
CMS-0053-F adopts standards for health care claims attachments transactions and for electronic signatures used with them. It took effect on May 26, 2026, and compliance is required by May 26, 2028. It does not finalize attachment standards for prior authorization at this time.
Do the NCPDP standard versions in Part 162 change on a schedule?
Yes. Part 162 sets the version in each subpart, and some change on a schedule. Section 162.1902 names Version 3.0 of the NCPDP Batch Standard Medicaid Subrogation Implementation Guide through August 14, 2027, adds Version 10 (September 2019) from August 14, 2027 through April 14, 2028, and for the period on and after April 14, 2028 points to the standard identified in paragraph (b).
How do we show that our trading partners are compliant?
Start with the agreements. Section 162.915 bars a trading partner agreement that changes the definition, data condition or use of a data element or segment in a standard or operating rule, except where necessary to implement State or Federal law or to protect against fraud and abuse. IHS drafts a record of each agreement, its date and its reviewer.
What happens if a trading partner files a complaint about us?
Under section 160.306 a person may file a complaint with the Secretary within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless the Secretary waives the limit for good cause. The Secretary investigates when a preliminary review indicates possible willful neglect and may investigate any other complaint. Your organization responds for itself.
What belongs in a transactions compliance calendar?
May 26, 2028, August 14, 2027 and April 14, 2028, each vendor contract review date, a periodic review of rejection and denial reports and the date each inventory row was last confirmed, each with an owner.