Cost Of Health Care Industry Compliance Could Exceed Y2K SBC Communications Inc. (NYSE: SBC) and its subsidiary Sterling Commerce today announced a comprehensive suite of assessment, design, implementation and management offerings designed to assist organizations in achieving compliance with new federal rules for health care data privacy enacted under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The announcement was made at the 2001 HIMSS Annual Conference and Exhibition.

HIPAA requires most organizations that regularly collect, transmit or store personally identifiable health care information – including providers, insurance companies and other payers, clearinghouses and employers – to conform over the next two to three years to universal standards for security and privacy, as well as for transfer of health care and insurance information via electronic data interchange (EDI). While the standards ultimately will streamline industry operations, businesses face a tremendous task in compliance as they consolidate the more than 400 standards used today to report and process health care information.

To help customers meet the challenge, SBC has combined the expertise of subsidiaries Sterling Commerce and SBC DataComm to provide a single source for HIPAA assessment, planning and consulting, backed by the ability to deploy, optimize and manage the EDI, privacy and security solutions needed for compliance with HIPAA standards.

A recent study by independent research firm GartnerGroup showed that most health care organizations are just beginning to develop HIPAA compliance strategies, with only 22 percent of respondents having completed a formal e-business strategy, and only 15 percent having completed initial budget estimates for HIPAA compliance projects. Various industry sources have estimated that the total cost of HIPAA compliance could exceed $40 billion, which would surpass the industry's expenditures on Y2K compliance.

"HIPAA compliance is a daunting task for the health care industry, and some aspects of the regulations affect any employer that provides health insurance to employees," said Rich Dietz, President-SBC Enterprises. "Addressing challenges like HIPAA is exactly the reason SBC has worked to assemble a full range of e-business skills and services, allowing us ultimately to combine and customize these offerings to meet the specific needs of our customers. Our unmatched range of capabilities enables us to help any organization determine HIPAA’s impact on its operations, then assist in the development and execution of a strategy to achieve compliance."

To meet business' most pressing HIPAA needs today – planning and assessment – SBC provides Business Impact Analysis services to help organizations develop customized strategies for compliance. This initial consulting work helps businesses pinpoint areas of non-compliance with HIPAA standards and identify activities necessary to achieve compliance. This process includes analysis of areas of business communications potentially affected by HIPAA, including process analysis; physical, network and computer security; contingency plans and security policies and procedures.

These initial consulting services are backed by Process Analysis, which includes documentation of administrative and software applications required by HIPAA. Finally, SBC helps businesses choose the combination of hardware, software and services necessary to address HIPAA issues.

Just as important as SBC's consulting capabilities is the company’s ability to implement and manage solutions needed to achieve HIPAA compliance. SBC’s capabilities cover the three areas of administrative simplification outlined in HIPAA: EDI, privacy and security.

EDI

Much of the HIPAA administrative simplification regulations center on the secure interchange of information through EDI. HIPAA compliance requires complete mastery of all EDI standards and protocols, including developments in standard setting, particularly the ASC X12N protocol, a fundamental component in all EDI transactions.

SBC's Sterling Commerce has been serving the healthcare industry for more than 25 years, providing e-business solutions to a large healthcare payer and provider customer base that includes insurance, managed care, retail pharmacies, hospital organizations and physician practice groups. Sterling Commerce also is a leading EDI provider to the pharmaceutical and medical/surgical markets, with customers including Cardinal Health, Allergan, Pfizer, and Roche Pharmaceuticals. Sterling’s unparalleled experience and expertise in EDI allows for one of the most comprehensive HIPAA solution packages available today.

Privacy

Privacy policies are a critical component of HIPAA compliance. Through its Business Impact and Process analysis consulting services, SBC is able to help health care providers identify procedures or processes that require attention to achieve HIPAA compliance. Consulting services also include contingency and business continuity planning to help businesses prepare for and address potential privacy issues in accordance with HIPAA regulations.

Security

Security measures provide the means to ensure and protect privacy. HIPAA regulations place the responsibility for security of patient information directly in the hands of the providers that handle the information.

Sterling Commerce provides SBC customers with the advantage of years of expertise in developing secure EDI networks, and SBC DataComm can deploy a range of networking security features, such as sophisticated hardware and software encryption, firewalls, proactive intrusion detection monitoring and management reporting.

SBC also provides HIPAA security training to assist employees in making the necessary changes in administrative and computer safety procedures to obtain maximum protection of sensitive information.

All solutions include critical ongoing support to help customers stay ahead of the curve on evolving HIPAA requirements. HIPAA guidelines on patient information privacy were recently published, and final compliance with these regulations is expected by Feb. 26, 2003. Standards for transaction code sets must be met by Oct. 16, 2002, and additional rulings and compliance deadlines are expected to be set this year for national provider and employer identifiers and security standards.

SBC Communications Inc. (www.sbc.com) is a global communications leader. Through its subsidiaries' trusted brands - Southwestern Bell, Ameritech, Pacific Bell, SBC Telecom, Nevada Bell, SNET and Sterling Commerce - and world-class network, SBC and its affiliated companies provide a full range of voice, data, networking and e-business services, including local and long-distance voice, high-speed Internet access and data transport, voice and data network integration, software and process integration, Web site and application hosting, e-marketplace development, paging and messaging, as well as cable and satellite television and directory advertising and publishing. In the United States, the company currently has 61.3 million access lines and is undertaking a national expansion program that will bring SBC service to the nation's top 50 markets. SBC has a 60 percent equity interest in Cingular Wireless, its joint venture with BellSouth, which serves 19.7 million wireless customers. Internationally, SBC has telecommunications investments in more than 20 countries and has annual revenues that rank it among the largest Fortune 500 companies.