7/29/2025
![]()
This section contains information for the public about the Health Insurance Portability and Accountability Act of 1996 as it relates to the pharmacy industry.
What Do I Need Now for HIPAA?
Implementation of the NCPDP Standards
Three NCPDP standards have been named by the Office of the Secretary, Department of Health and Human Services (HHS) in the “Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard." This
final rule adopts updated versions of the retail pharmacy standards for electronic transactions adopted under the Administrative Simplification subtitle of HIPAA.
These updated versions are modifications to the currently adopted standards for the following retail pharmacy transactions: healthcare claims or equivalent encounter information; eligibility for a health plan; referral certification and authorization; and coordination of benefits. This final rule also adopts a modification to the standard for the Medicaid pharmacy subrogation transaction. The final rule cites the following NCPDP standards and implementation timelines:
- NCPDP Telecommunication Standard Version F6 is required as of February 11, 2028.
- NCPDP Batch Standard Version 15 is required as of February 11, 2028.
- NCPDP Batch Standard Subrogation Implementation Guide Version 10 is required by February 11, 2028.
Delay of Effective and Compliance Dates
In accordance with the Presidential memorandum of January 20, 2025, titled “Regulatory Freeze Pending Review,” the effective date of the final rule titled “Administrative Simplification: Modifications of Health Insurance Portability and Accountability Act of 1996 (HIPAA) National Council for Prescription Drug Programs (NCPDP) Retail Pharmacy Standards; and Modification of the Medicaid Pharmacy Subrogation Standard” is delayed until April 14, 2025.
The compliance dates are extended to April 14, 2028.
HHS also stated “Moreover, we are cognizant that the final rule that appeared in the December 13, 2024,
Federal Register (89 FR 100763) requires publication in the
Federal Register of a correction document as a technical error was made in the calculation of the date of the 8-month transition period prior to full compliance with the retail pharmacy and Medicaid pharmacy subrogation standards. References in that final rule to August 11, 2027 should, instead, read June 11, 2027. The delay by virtue of this final rule will permit more time to publish those corrections, while also signaling the nature of those forthcoming corrections, thereby minimizing public confusion.” The final rule is available
here.
Webinars
NCPDP Telecommunication Standard Version F6 & Other Related HIPAA Webinars - Training webinars are available for NCPDP Standards recently named in HIPAA.
- NCPDP Telecommunication Standard Version F6
- Batch Standard Implementation Guide Version 15
- Subrogation Implementation Guide for Batch Standard Version 10
High-level Dispensing Model of Telecommunication Transactions
Telecommunication Version D.0
Quantity Prescribed (460-ET) Final Rule CMS-0055-F
The final rule CMS-0055-F published on January 24, 2020, adopts a modification of the requirements for the use of the Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007, National Council for Prescription Drug Programs, by requiring covered entities to use the Quantity Prescribed (460-ET) field for retail pharmacy transactions for Schedule II drugs. This change constitutes a modification to the use of the adopted standard, not a modification to the standard itself.
- Compliance Date: September 21, 2020
- Refer to the following important additional references
Version D Editorial – August 2025
This document provides a consolidated reference point for questions that have been posed based on the review and implementation of the NCPDP Telecommunication Standard Implementation Guide and Data Dictionary for Version D. This document also addresses editorial changes made to these documents. Since the HIPAA-named Standards documents are "frozen" from changes, this document provides helpful FAQs, typographical changes and corrections, and further guidelines for implementation. This document is very important to implementers of the Telecommunication and Batch Standards, and Medicaid Subrogation Implementation Guide, as appropriate. Please continue to review this link as the document is updated as needed.
Version D Editorial – August 2025.
NCPDP Payer Sheet Template for Telecommunication Version D.0
The NCPDP SNIP Committee developed guidance that is strongly recommended to be used in filling out and creating payer sheets based on Version D.0. Payer Sheets may be used in addition to provider manuals or included in provider manuals. Payers may take the request and response template sections within the guidance document, fill out the template per their usage, and send to their trading partners. The guidance also provides instructional sections to assist the payers in completing their payer sheets.
Click here for current version.
Medicaid Subrogation Version 3.0
Medicaid Subrogation Questions, Answers and Editorial Updates
This document provides a consolidated reference point for questions that have been posed based on the review and implementation of the NCPDP Medicaid Subrogation Standard Implementation Guide Version 3.0, and the Data Dictionary and External Code List only as they apply to Medicaid Subrogation. This document also addresses an editorial change made to the implementation guide in October 2010. Please continue to review this
link as the document is updated as needed.
NCPDP Payer Sheet Template for Medicaid Subrogation Version 3.0
The NCPDP SNIP Committee developed guidance is strongly recommended to be used in filling out and creating payer sheets based on Medication Subrogation Implementation Guide Version 3.0, Batch Standard Implementation Guide Version 1.2 and Telecommunication Standard Implementation Guide Version D.0. Payer Sheets may be used in addition to provider manuals or included in provider manuals. Payers may take the request and response template sections within the guidance document, fill out the template per their usage, and send to their trading partners. The guidance also provides instructional sections to assist the payers in completing their payer sheets.
Click here for Version 1.0.
ICD-10
CMS Resources
White Paper for HIPAA Implementation of the ICD-10 Code Sets
The NCPDP Strategic National Implementation Process (SNIP) created a white paper to assist the industry in preparing for the implementation of the ICD-10 code sets.
Click here for a copy.
Other HIPAA Information
HIPAA Privacy and Security Information
To protect people’s personal health information, HIPAA includes
privacy and
security rules.
The
HHS Office for Civil Rights (OCR) offers
privacy and security education resources.
Information on the HIPAA privacy rules is available
here. Information on the HIPAA security rules is available
here.
HIPAA National Provider ID (NPI)
HIPAA establishes and requires unique identifiers for providers. The
National Provider Identifier (NPI) is the adopted
standard mandated by HIPAA.
About NPIs
An NPI is a unique 10-digit number used to identify health care providers. All health care providers who are
HIPAA-covered entities, whether individuals or organizations, must obtain an NPI.
HIPAA Employer ID Information
HIPAA establishes and requires unique identifiers for employers. The
EIN, or Employer Identification Number, is issued by the
Internal Revenue Service and is used to identify employers in electronic transactions.
Operating Rules
Operating rules support a range of standards to make electronic data transactions more predictable and consistent, regardless of the technology. CAQH CORE is designated by the Secretary of the Department of Health and Human Services (HHS) as the National Operating Rule Authoring Entity for the administrative transactions covered by HIPAA.
Three sets of CAQH CORE Operating Rules are federally mandated under HIPAA. The federally mandated versions of the Eligibility & Benefits, Claim Status and Payment & Remittance Operating Rules are available here. CAQH CORE Operating Rule requirements are a floor, not a ceiling, with updated versions of the rules building on the existing requirements. Therefore, all federally mandated operating rule requirements are included in the current versions of the CAQH CORE Operating Rules.