HIPAA X12 transactions explained: a glossary for patient access teams

What are X12 transactions?

X12 is the standards organization that publishes the electronic data interchange (EDI) formats used across U.S. health care. Under HIPAA's Administrative Simplification rules, HHS adopts specific versions of those formats as the required standard for each type of administrative transaction. A covered entity that conducts one of these transactions electronically must use the adopted standard (45 CFR Part 162).

Covered entities are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction (45 CFR 160.103). In practice, that includes almost every practice that bills insurance electronically.

Each transaction has a number. Many come in pairs: one for the request and one for the response. A practice checking coverage sends a 270 and gets back a 271. A practice submitting a claim sends an 837 and is paid with an 835.

The HIPAA transactions at a glance

Three of these matter most for patient access before a visit: the 270/271 eligibility transaction, the 278 prior authorization transaction, and the codes those transactions return. The 837, 835, and 276/277 sit on the billing side, after care is delivered.

Version 5010 and what comes next

HHS adopted version 5010 of the X12 standards, along with NCPDP version D.0 for retail pharmacy, in a final rule published January 16, 2009, at 74 FR 3296. Compliance was required on January 1, 2012 (Federal Register). CMS then announced it would not take enforcement action through June 30, 2012, so enforcement began July 1, 2012 (CMS).

Version 5010 is still the required version for every X12 transaction above except the new claims attachments standard. The retail pharmacy standard is changing separately: NCPDP version F6 applies on and after April 14, 2028 (45 CFR 162.1102).

Newer X12 versions exist but are not required. In June 2023, the National Committee on Vital and Health Statistics (NCVHS) recommended that HHS not adopt version 008020 for claims and remittance transactions (NCVHS). In December 2025, X12 recommended that each mandated transaction move to version 008060 (X12). As of November 4, 2026, HHS had not proposed a rule adopting 008060, and the regulations still name version 5010.

Operating rules: the rules on top of the standards

An X12 standard defines the format of a transaction. Operating rules define how trading partners must use it: response times, which data must be returned, connectivity, and error reporting.

HHS has adopted CAQH CORE operating rules for three areas: eligibility and claim status (required from January 1, 2013) and electronic funds transfer and remittance advice (required from January 1, 2014) (45 CFR Part 162). No operating rule has been adopted for the X12 278, so CORE's prior authorization rules are voluntary (Federal Register).

In October 2026, X12 assumed ownership and administration of the CORE Operating Rules and Certification Program from DataSpring, the organization formerly known as CAQH (X12). The federally adopted rules themselves did not change.

Attachments: the X12 275

For decades, HIPAA had no standard for sending supporting documentation such as clinical notes with a claim or prior authorization, so most attachments moved by fax, mail, or portal upload. HHS proposed attachments standards for both claims and prior authorization in December 2022 (Federal Register).

The final rule, CMS-0053-F, was published March 24, 2026. It adopts the X12 277 (version 006020X313) for a health plan to request more information, the X12 275 (version 006020X314) for the provider's response, HL7 C-CDA and CDA attachment implementation guides for the clinical content, and an HL7 digital signature standard. It took effect May 26, 2026, and compliance is required by May 26, 2028 (Federal Register).

Acknowledgments: TA1, 999, and 277CA

When a practice or clearinghouse sends a batch of transactions, the receiver usually answers with an acknowledgment before any business response. A TA1 reports problems with the interchange envelope (the ISA and IEA segments). A 999 reports errors inside a functional group, such as a malformed segment. A 277CA acknowledges individual claims and reports claim-level rejections (HETS Companion Guide; Medicare Claims Processing Manual, Ch. 24).

These acknowledgments are widely used but are not HIPAA-mandated. HHS declined to adopt an acknowledgment standard in the 5010 rule, and Medicare's EDI manual marks the TA1, 999, and 277CA as not required under HIPAA (Federal Register; CMS).

Code sets inside the transactions

X12 transactions carry codes from two kinds of lists. HIPAA's medical code sets describe diagnoses and services: ICD-10-CM and ICD-10-PCS (required since October 1, 2015), HCPCS and CPT, CDT for dental services, and NDC for drugs (45 CFR 162.1002).

Non-medical code lists explain what happened to a transaction: service type codes and AAA rejection codes in eligibility, Claim Adjustment Reason Codes (CARCs) and Remittance Advice Remark Codes (RARCs) on payments, and decision codes on a 278. See the X12 codes guide for the ones patient access teams see most.

Where X12 meets FHIR

For eligibility, claims, and payments, X12 remains the required standard. Prior authorization is different. Under CMS-0057-F, Medicare Advantage, Medicaid, CHIP, and federal Marketplace plans must offer a FHIR-based Prior Authorization API by 2027 (Federal Register). Because HIPAA still names the X12 278, HHS announced in February 2024 that it will not enforce the 278 requirement against covered entities that use an all-FHIR prior authorization process (CMS).

In April 2026, HHS went further and proposed adopting FHIR standards as the HIPAA standard for prior authorization in place of the X12 278 (Federal Register). That proposal was not final as of November 4, 2026. See the 278 guide for what this means in practice and the Prior Authorization API guide for the FHIR side.

What this means for patient access teams

• Eligibility is the most automated step. Under federally adopted rules, a real-time 270 must be answered within 20 seconds, which makes it the fastest way to confirm coverage before a visit.
• Prior authorization is the least automated. Most requests still go through payer portals, phone, or fax rather than the X12 278.
• Attachments are moving. Claims attachments become a HIPAA standard in 2028; prior authorization attachments are still unsettled.
• Codes are the explanation. When a check fails or a claim is denied, the AAA code, CARC, or RARC tells you what to fix.

Saga's agents run real-time X12 270/271 eligibility checks and record benefits to the chart, and submit and track prior authorizations through payer portals, working inside the practice's EHR. See eligibility verification and prior authorization.