Claims Attachments Finally Have a HIPAA Standard. What Medical Practices Need to Prepare for Before 2028

A payer asks for clinical notes before it will finish processing a claim. Your team may fax the records, upload them to a payer portal, mail documentation, or route the request through a clearinghouse. The clinical information may be the same, but the administrative path can vary from payer to payer.

That fragmentation is exactly what a new federal rule is designed to reduce.

In March 2026, the U.S. Department of Health and Human Services (HHS), through the Centers for Medicare & Medicaid Services (CMS), finalized CMS-0053-F, establishing the first HIPAA-adopted standards for electronic health care claims attachments and a standard for electronic signatures used with those transactions. The rule became effective May 26, 2026, and covered entities must comply with the applicable requirements by May 26, 2028.

For a physician owner or practice manager, this is not a reason to learn X12 or HL7 implementation guides. It is a reason to find out whether the systems and partners that move your documentation today are preparing for the same future workflow.

Leadership question: Do we know which system or partner will actually handle standardized claims attachments for our practice?

What is a claims attachment - and why does it matter?

A health care claims attachment is supporting information used with a health care claim or equivalent encounter transaction. In practice, it can include clinical notes, operative reports, diagnostic results, imaging, telemedicine documentation, and other records a health plan needs to adjudicate a claim.

Today, that supporting information often travels through workflows that are more manual than the claim itself. A practice may submit a claim electronically and then respond to a records request through a separate fax, portal, mail process, or vendor workflow.

CMS-0053-F adopts national standards for electronically requesting and transmitting that supporting information. It also adopts standardized clinical document formats and an electronic-signature standard for claims attachments when an electronic signature is used.

The management significance is straightforward: a part of the revenue cycle that has often lived outside the standardized claim transaction is moving toward a more consistent electronic framework.

The 2028 deadline does not mean this is a 2028 project

May 26, 2028, sounds distant enough to ignore. The problem is that a medical practice does not control this transition by itself.

Claims attachments can involve the practice-management system or EHR, the billing platform, a clearinghouse, a payer, and sometimes an outside RCM or technology partner. Operational readiness depends on the relevant systems and trading partners being able to exchange the adopted transactions and on staff understanding where requests, responses, and supporting documentation are supposed to go.

CMS's preparation guidance tells covered entities to review current processes for sending and receiving attachments, work with vendors, clearinghouses, and health IT partners, and plan testing and onboarding before the compliance date.

That is why the useful leadership question in 2026 is not, 'Are we compliant yet?' It is, 'Do we know who is responsible for making us ready, and do we know what their plan is?'

Do not confuse the rule with a blanket ban on medical faxing

CMS has described the rule as a move away from fax, mail, and fragmented portal workflows for claims attachments. The scope, however, matters.

The rule applies to HIPAA-covered entities conducting the relevant electronic transactions, and CMS's FAQ states that entities are required to comply only for transactions they conduct electronically. It is therefore inaccurate to describe CMS-0053-F as a universal ban on every fax used anywhere in a medical practice.

It is also not a general clinical-records rule. The rule specifically addresses attachments exchanged in support of health care claims transactions.

That distinction matters because a practice may use fax for referrals, records exchange, pharmacy communication, or other purposes outside the scope of this claims-attachment standard. Separate privacy, security, payer, contractual, and state requirements may still apply to those workflows.

Claims attachments are not prior authorization attachments

CMS's final FAQ states that CMS-0053-F applies to attachments exchanged in support of health care claims transactions. It does not establish attachment standards for prior authorization transactions.

The proposed rule had included standards for both claims and prior authorization attachments, but HHS did not finalize the prior authorization attachment standards in CMS-0053-F after concerns about alignment with existing prior authorization requirements and standards.

For a practice, that means two workflows that can feel similar - sending clinical documentation to support a prior authorization and sending clinical documentation to support a claim - should not be treated as though this rule standardized both.

You do not need to memorize the standards. Your vendors do need to support the applicable workflow.

The rule relies on national standards that include X12 transactions for requesting and transmitting attachment information, HL7 Consolidated Clinical Document Architecture (C-CDA) standards for clinical documents, and LOINC codes to identify the type of documentation being requested or sent.

Those details matter technically, but they are not the right level of work for most physician owners or practice managers.

Leadership should instead expect clear answers from the organizations that manage the transaction. If your EHR, practice-management system, clearinghouse, billing vendor, or RCM partner handles claims attachments, someone should be able to explain what component it supports, what still depends on another vendor or payer, when testing is expected, and what workflow changes the practice will actually see.

A vendor saying 'we are monitoring the rule' is not the same as a documented implementation path.

Four questions practice leadership should ask now

You do not need a full implementation project in 2026. You do need visibility. Four management-level questions can expose whether the practice has a plan or only an assumption:

1. Where do claims attachment requests arrive today? Identify whether staff receive them through payer portals, fax, clearinghouse work queues, EHR messaging, mail, or another channel.

2. Who sends the supporting documentation? The answer may be front office, billing, medical records, clinical staff, an outsourced RCM team, or different people depending on the payer. If ownership is unclear now, a new electronic standard will not automatically fix it.

3. Which vendor is expected to support the standardized transaction? Ask whether the EHR, PM system, clearinghouse, or billing platform will send and receive the adopted attachment transactions, and whether additional enrollment, configuration, testing, or fees are expected.

4. How will prior authorization attachments remain separate? Because CMS-0053-F does not standardize prior authorization attachments, the practice should not assume that one implementation plan covers both workflows.

These are leadership questions, not coding questions. They help determine whether the practice can see its dependencies before those dependencies become a deadline problem.

What the rule may improve - and what it cannot guarantee

CMS projects that the rule will save the health care industry approximately $781.98 million annually. That is an industrywide estimate, not a guaranteed savings figure for an individual medical practice.

For practices, the practical potential benefits are more consistent attachment workflows, fewer disconnected channels, clearer transaction tracking, and less reliance on paper and fax for applicable electronic claims-attachment transactions.

But standardization does not guarantee that a claim will be paid. A payer can still request documentation, apply coverage or medical-necessity rules, deny a claim, or adjudicate it differently than the practice expects. The rule standardizes how supporting information moves; it does not rewrite the underlying coverage and payment policies.

A faster pipe does not change what the payer is deciding. It can make the administrative exchange more consistent and traceable.

What a good 2026 readiness conversation sounds like

A useful discussion with your billing or technology team should end with a simple map: which claims-attachment workflows exist today, which systems touch them, who owns them, which trading partners must be ready, and when the practice expects testing to begin.

If the answer is still 'we fax whatever the payer asks for,' that is not necessarily a compliance failure today. It is a signal that the practice may not yet have translated the 2028 rule into an implementation plan.

The best time to discover a vendor limitation is while there is still time to solve it - not after a payer, clearinghouse, or platform changes its workflow and claims are waiting.

For practice leadership, that is the practical meaning of CMS-0053-F: not a technical standard to memorize, but an administrative dependency to make visible before the deadline makes it urgent.