Electronic Claim Attachments: What the 2026 HIPAA Rule Requires

Updated October 2026

Medwave first published this page in December 2022, the same month HHS proposed a national standard for electronic claim attachments. That proposal sat for more than three years. The final rule appeared in the Federal Register on March 24, 2026, and every HIPAA covered entity now has until May 26, 2028 to comply.

Claims attachments were on the original 1996 HIPAA list of transactions, yet no standard was ever adopted for them. Operative notes, imaging reports, lab results, and therapy plans of care still move between practices and payers by fax, mail, and portal upload. HHS says so in the rule’s own preamble.

Key Takeaways

What HHS Finalized in March 2026

The rule adopts six standards that work together. Two are X12 transactions that carry the request and the response. The other four are HL7 implementation guides that define the clinical document inside the transaction and how it gets signed.

The May 2028 date applies to everyone. Earlier HIPAA standards usually gave small health plans an extra year, but the Affordable Care Act provision behind this rule makes no such allowance.

Two things changed between the 2022 proposal and the final version. HHS swapped the 2017 HL7 Attachments guide for the 2022 release, and it dropped prior authorization attachments entirely. The CMS fact sheet projects about $782 million a year in industry savings. The rule’s regulatory impact analysis puts annual costs at roughly $478 million, so the payoff depends on how much fax and portal work each organization retires.

How the 277 Request and 275 Response Work

Payers already ask for documentation in two ways, and the rule covers both.

In a solicited exchange, the plan sends a 277 tied to a specific claim. LOINC codes in the request identify which document the plan wants, such as a discharge summary or a progress note. The practice answers with a 275 that carries that document back.

In an unsolicited exchange, nobody asks. A payer policy or trading partner agreement says certain services always need supporting records, so the practice sends the 275 along with the claim. The PWK segment on the 837 tells the payer documentation is coming and how it is being sent. A transmission code of EL means electronic, FX means fax, and BM means mail. The PWK also carries an attachment control number the payer uses to match the 275 to the right claim.

That control number is where a lot of revenue gets stuck today. When the number on the documentation doesn’t match the number on the claim, the records sit unmatched in the payer’s system. The claim then comes back with CARC 252, which means an attachment or other documentation is required. Rebilling a claim like that without the paperwork tends to repeat the outcome, which is why it belongs in denial management rather than a simple resubmission queue. If your team mixes those up, the difference between a denial and a rejection explains which queue a claim belongs in.

The standard covers documentation used in pre-payment review, adjudication, and post-payment activity such as audits and recoupment reviews. It does not cover documentation sent with a formal appeal or dispute. HHS left appeals for future rulemaking.

What the Document Inside the 275 Looks Like

The 275 is the envelope, and an HL7 Consolidated Clinical Document Architecture (C-CDA) document goes inside it. C-CDA templates exist for the most common paper records, including history and physicals, consult notes, procedure notes, and discharge summaries. Many certified EHRs already produce C-CDA documents for transitions of care, so some practices are closer to ready than they think.

Records that don’t fit a template still qualify. The Attachments guide allows an unstructured document in PDF, TIFF, JPEG, PNG, GIF, Word, RTF, HTML, or plain text. A machine-readable CDA header wraps the file and carries the document type, patient and provider identifiers, and service dates. A scanned operative report can travel electronically as long as that header goes with it, and the payer’s system can route and index it without anyone opening the file.

HHS chose this document-based approach over FHIR after public comment. Commenters pushed for FHIR, but HHS stuck with X12 because covered entities already run X12 transactions for claims. FHIR still matters for prior authorization, which moves through the API requirements in the 2024 CMS Interoperability and Prior Authorization final rule. For background on how the two HL7 families differ, see HL7 vs FHIR.

Electronic Signatures Travel With the Attachment

Plenty of payers want proof that a clinician signed the record. For years that proof has been a faxed page with a pen signature on it.

The rule adopts the HL7 Digital Signatures and Delegation of Rights guide for signatures used with claims attachments. A signature built to that guide lets the plan confirm who signed a document and that it hasn’t been altered since. It also supports cases where a provider has delegated signing authority. Ask your EHR vendor now whether its signing workflow can produce signatures to this guide, because that answer decides how much of your signed documentation can move off the fax machine.

What the Rule Leaves Untouched

Prior authorization attachments are out. HHS cited misalignment with the existing X12N 278 and with the FHIR-based prior authorization API that CMS already requires of many government-program payers.

Appeals are out too, as noted above.

The rule also doesn’t limit how much documentation a plan can ask for. HHS stated plainly that HIPAA standards govern the format of the exchange, and a payer’s business rules about what it requests sit outside HIPAA.

Fax and mail are still allowed where a payer accepts them, because the standard governs electronic exchange. Once compliance kicks in, any claims attachment transaction conducted electronically between covered entities has to use these standards. HIPAA also bars a health plan from refusing to conduct a standard transaction, so a practice that can send a compliant 275 has leverage with a payer that still insists on its own portal.

Getting Ready Before May 2028

Most of the work sits with clearinghouses and software vendors, but the practice decides when that work starts. The X12 organization has pointed out that organizations already exchanging 275 and 277 transactions can expand to new trading partners without waiting.

If your clearinghouse can’t give a straight answer on 6020 support, put that in front of your next contract renewal. The questions in choosing a clearinghouse apply here, and attachment support now belongs on that list. Practices with custom EHR or PM connections may also need interface work, which is where HL7 integration comes in.

Electronic Claim Attachment FAQ

Medwave has supported more than 15,000 providers. If missing-documentation denials are piling up, our medical billing team can work the backlog and build the attachment workflow your practice will need before the 2028 deadline.

Alex J. Lau

Co-Founder and COO of Medwave, bringing more than 25 years of hands-on experience in healthcare revenue cycle management, payer contracting, and medical credentialing.