For a system in a hospital or clinic to be HIPAA-compliant, it needs to comply with three basic HIPAA principles - creating an audit trial, ensuring patient privacy and restricted access.

Legacy systems have no audit trails, no access logs to keep track of who accessed patient records, and were not made to share information, which make them non HIPAA-compliant. Hospitals, in particular, need to break away from the legacy EMR systems, shed their techno phobia and make the necessary investment for their CPR systems to comply with HIPAA as it will be beneficial to them in the future.

Rather than spending millions of dollars to convert their legacy systems to comply with HIPAA, some Healthcare Organizations would rather outsource the patient record maintenance to Application Service Providers (ASPs). Both payer and provider organizations have essentially three options when confronting HIPAA compliance issues for their EDI transactions

High replacement Ensuring that data has not been changed or altered en route or in storage.

Re-engineering of their current system at substantial cost and an uncertain time frame for testing and completion.

Middle-ware solution that meets HIPAA requirements at minimal cost that can be rapidly deployed.