A difficult economic climate may make it harder for health care providers to comply with provisions of the Health Insurance Portability and Accountability Act (HIPAA) in time for deadlines next year, according to a report by the consulting company Frost & Sullivan.

The independent report, "Effects of HIPAA in the U.S. Healthcare Markets" studied three health care market sectors affected by HIPAA: hospitals, managed care organizations and physician practice groups.

The study found that, despite an April 2004 deadline for HIPAA compliance on patient privacy, IT spending remains a low priority for hospitals and health care providers struggling for survival because of the economy.

"This is something that we've seen fomenting over time," said Amith Viswanathan, senior industry analyst for health care information systems at Frost & Sullivan. "IT is a last priority item for hospitals. It's a question of 'do we buy a new car or do we eat?'"

The growing medical needs of the large population of aging "baby boomers," those born between 1946 and 1964, has combined with cuts in federal Medicare reimbursements and increased payroll and operations costs to constrain IT spending by health care companies, according to Viswanathan.

"Hospitals are dealing with all kinds of operational issues, and they're cutting spending for anything ancillary to patient care," Viswanathan said.

Enacted by the U.S. Congress in 1996, HIPAA establishes national standards meant to ensure privacy in electronic health care transactions. The legislation, which is enforced by the Department of Health and Human Services (DHHS), affects health care providers, health plans and private physicians.

Since it was enacted, HIPAA has pushed hospitals and other health care organizations to shift from older, mainframe technology and paper-based processes to more efficient and secure systems that improve patient confidentiality.

Providers were supposed to comply with HIPAA regulations regarding medical transactions and code-sets, which indicate what type of procedure was performed on a patient, by last Wednesday. Organizations that were not in compliance with HIPAA rules by the deadline were required to apply for an extension by mailing or e-mailing a form to the DHHS before midnight Tuesday.

The IDG News Service is a Network World affiliate.