Okay. Cool. Okay. Awesome. We'll have the time here. Okay. Cool. Okay. So I think we can start. So, welcome, everyone. So my name is Ricardo, I'm a software engineer at CERN. Hello, and I'm Robert Vasek, I'm a student of Informatics at the University of Slovakia. In my first year of the master's degree, but for the past eight months I had the amazing opportunity of having my internship at CERN with Ricardo as my supervisor. I was working on CSI surface and manual integration into Kubernetes. Okay. Cool. So today we'll talk about the work we've been doing. It's been, so these are the topics we'll cover. Quick introduction to CERN. I'm sure you've seen other presentations already during this summit or other summits. So CERN is located in Geneva, close to Geneva, across the Swiss French border. It was founded in 1954, it has 22 member states, and it has as main mission fundamental science. And we try to answer like big questions like what is 96% of the universe made of what's dark matter, what's dark energy? What was the state of matter just after the big bang? And why isn't there any antimatter in the universe or why don't we see it as it supposed to be in the same amount as matter? To try to answer these questions we build very large machines. The big one we have right now is the Large Hadron Collider. So this is a picture of the accelerator. It's a tunnel of 27 kilometers in circumference and it's 100 meters underground. So here we accelerate protons in different directions, close to the speed of light. We increase their energy and then we make them collide in specific points where we built this massive particle physics experiment. This is a picture of the CMS detector. You can see the people there to have an idea of the size. The cover is I believe 40 by 40 meters and it's totally full with this detector. It's also 100 meters underground. So the result of all of this is that from these collisions we generate a lot of data. We generate tens of petabytes per year that we need to store and analyze. For this we have a large private cloud based on OpenStack. We can see on the top that we currently have just over 300,000 cores. We have 36,000 VMs, around 10,000 hypervisors, and then you can see the magnum clusters. So these are mostly Kubernetes clusters. These are container clusters. We also support swarm and RISOs, but they are mostly Kubernetes. And every time we do a screenshot this keeps increasing, which is a sign that containers are getting more and more popular at CERN. Right now we have more than 400 clusters. So I would like to open this presentation by having a look at the title. So let's see. The dynamic storage provisioning of manila slash surface shares on Kubernetes. So that's quite a mouthful. But what's really important here is for my part of the presentation it sounds like I should know what I'm talking about, right? So anyway, it does serve a purpose. It basically says that the users of Kubernetes should be now able to create and use manila shares of their open-stack cloud from within Kubernetes. So while this title covers all the technical aspects of this presentation, this one really says how the development actually went down. Because to be frank with you, when I was finished with the implementation of CISFS and the manila provisioner, and we conducted our first benchmarks, those parameters that we got from those were nowhere near our expectations, as in pretty bad. So we managed to eventually do a pretty good job with this. So let's talk about the container storage interface. This interface I was using during the development of CISFS. And now let's see why and what it actually is. So let's imagine this scenario where we've created this storage system. We would like to get it to as many of customers as possible. And in order to do that, we need to integrate the storage system into existing infrastructures of our users so that people can actually use it. So let's say our customers are interested in container technologies. So we'll focus on those and we want to target the container orchestrators one, two and three. So that means we'll probably have to have three separate teams developing storage drivers for those three orchestrators so that our storage can talk to those orchestrators. Let's say that after some time we are done, our customers are happy, and now we are left with three separate storage drivers, which essentially do the same thing. They map the storage system to the container orchestrator. Now that's really not what we are looking for because we have a few problems. This lack of standardization between orchestrators is pushing our development and maintenance costs up. Another problem is usually those drivers are part of the orchestrator's code base, which means that adding features and fixing bugs is particularly hard simply because those drivers are now tightly coupled with the release cycles of those orchestrators. Due to this tight coupling, bugs in those drivers can propagate through other components of the orchestrators and crash different parts. So it would be nice if we had a common interface between all of those orchestrators. That way we would only write a single driver and use it everywhere else. So of course I'm talking about the container storage interface, CSI, which is the industry standard for cluster-wide storage plugins. It's being developed as a collaboration of communities, including Kubernetes, Mesos, Docker, and Cloud Foundry. It basically defines an interface between the orchestrator and the plugin. From this you can see it's not just a simple interface, it's a whole protocol defining the behavior for both the orchestrator and the plugin. So the end goal here is to have only a single storage plugin and use it everywhere else. In any CSI enabled container orchestrator. So the first alpha version of CSI was released in December 2017 with already working implementation in Kubernetes 1.9. Of course things have changed significantly since then. And for people like me who are already using this interface and writing drivers, it was sometimes a bit difficult to follow, but things are considerably more stable now. And actually just today was released the first, the second release candidate of the stable version 1.0. And the latest stable version is scheduled by the end of this month. So now let's have a look at the actual structure of CSI. So the specification defines three services that deal with storage in container orchestrators. The first one being the identity service which allows the orchestrator to query for plugins capabilities, hold probes and other metadata. Then we have the sort of control plane of the plugin, the controller service, which creates, deletes, lists, volumes and their snapshots. Lastly we have the node service which stages and publishes volumes on a node making them available to workloads on that particular node. So all of those services then form a CSI plugin. Now this CSI plugin can be compiled and you have a single executable file or you can actually split it into two separate plugins which can be deployed at their places in the cluster. So regardless of the structure orchestrators talk to CSI plugin using the GRPC framework over a simple UNIX domain socket with the orchestrator being the client issuing RPCs on the CSI plugin and the plugin comes up with some sort of response for those. So really quick look at the RPCs themselves. So for controller service we have created the lead volume as I mentioned earlier. For controller publish volume, this one attaches a volume to a certain node. This is required for storage systems that require to know in advance which node is going to consume that particular volume. For node service we have node stage volume which prepares the volume before it's consumed by workload and then we have node publish volume which actually exposes this volume to the workload and is ready to use. And lastly the identity service which provides information about the plugin. You can see some of those items being grayed out. It's because they are optional and that's simply because not all storage systems require for example volume attachments. That's why controller publish is optional. The same goes for node stage volume and actually the whole controller service is marked as optional because we need to accommodate node service plugins only. Okay so the way this is implemented in Kubernetes there is quite a long and really good documentation on Kubernetes websites but the gist of it is that there are four main components that deal with CSI in Kubernetes. The first one being Kubla itself which implements the entry volume plugin for CSI and acts as a client for the node service. Then it basically just calls the node stage and node publish volume when necessary. Then we have sidecar containers. Those accommodate the rest of the RPC. So if we take a look at the right side of the slide let that be our Kubernetes cluster and let those little logos be our nodes. Now let's say we want to deploy the plugin in such a way that every node will have access to our storage. What do we do? We simply deploy it as a demon set and be done with it but that's not really enough because even though each node is now running an instance of the plugin Kubernetes has no knowledge that those are actually CSI plugins and that those can be used. For that we need the driver registrar which uses the Kublet plugin discovery in order to register the plugin with Kublet. Then we have external provisioner and attacher. Those function in a very similar manner of hooking up into Kubernetes event system and responding to events. We have in the provisioner this one is interested in persistent volume claims and the response to those events. So when the user is either creating or deleting PVCs the appropriate RPCs could go. The same goes for the attacher where the control publish or unpublish is called when volume is about to be attached to a node. Okay so finally into something I've been working on I just don't talk about other people's work. Okay so the CSI plugin for the safe file system provides an interface between a CSI enabled container orchestrator and the safe cluster. Using this plugin users can provision and use surface volumes from container orchestrator. So for mounting it supports both the kernel surface client as well as the fuse driver and users can pick between those two options on a per volume basis. This is useful because those two options don't provide the same features or performance so one might be more useful in some cases than the other. So comparing this CSI plugin to the Kubernetes interface volume plugin which it currently contains so the general idea behind current implementations of in-tree volume plugins in Kubernetes is that eventually those or at least majority of those should be migrated to CSI plugin so this is one of them since this CSI plugin needs completely decoupled from Kubernetes we have the ability to choose between mounting tools and of course there is some still some functionality left to do like volume expansion and taking snapshots so now moving on to the manual and Kubernetes so manual provisioner brings open stack manual and Kubernetes sort of closer together in a sense where users can now create manual shares from within Kubernetes cluster. What it essentially does it just maps manual shares to Kubernetes persistent volume objects and those can be then used just like any other volume type inputs currently only CFS is supported just because that's what we've been interested in during development but it can be easily extended for other types as well for authentication it supports both user credentials as well as trustees and there is a really cool use case for this Magnum. Okay so I can pick it up so in as I mentioned at CERN we have a lot of container clusters and they're all deployed with Magnum it opens that Magnum so the fact that the plugin supports both user credentials and trustees makes it possible for us to because the clusters are already deployed with a trustee user inside it means that a user doesn't have to provide any additional credentials whatever the credentials the cluster was deployed with will be you can use them to create shares to talk to Keystone to all sorts of open stack operations so that means that it simplifies a lot the setup so for us like the fact that there are CSIs there it makes it really useful so that we minimize the development therefore now this was an overview of the different components so we'll quickly jump to benchmarks so we started benchmarks with a couple of goals so we have many different use cases to use containers at CERN we just have to make sure that they actually work and then we needed also to make sure that when you define a persistent volume claim in Kubernetes and if you're doing it in GKE that it works the same in open stack so that's the manual provisioner comes in and then one of the goals we wanted is to see that the CSI driver side not really test CFFS but see that the CSI driver behaves well even when things go wrong so that's why we tested with a smaller cluster and we put a lot of load so that we would create some some problems underneath and see how the plugin reacts so the client is using Kubernetes 112 the version of CSI CFFS was 031 and we use two set clusters one is called white and it has three only three nodes with sprint drives and it's running luminous the other one is slightly bigger so it's the cluster we use for HPC and it's 300 node cluster or 300 OSDs all with SSDs also with luminous and it's hyperconverged meaning we are sharing compute and storage and then maybe want to explain a bit the methodology so what we did for the benchmarks to the actual process we had Kubernetes cluster of 100 nodes and for each of those each of the tests that we ran is that we provisioned a certain number of CFFS shares using the manual provisioner then we created deployment with certain number of replicas and those were sized as to so that each part of those replicas would be scheduled onto a separate node because that's why we that's how we tested the exact number of connections to the CFFS cluster then each of those spots would then mount all of those shares that we provisioned earlier and then we would take our own measurements so as for the actual tests we have the first batch of the test were idle where we basically did nothing with the shares and we just wanted to see how well this set up scales and as for the busy tests we made each pot unpack a large archive so in our case this was the Linux kernel source code and this was a way of doing a sort of stress test on a safe metadata servers and we stressed them pretty good as for parameters for idle tests we provisioned 100 shares per 100 replicas making up for 10,000 idle clients and for busy tests we had 10 shares per 100 replicas making up for 1000 clients simultaneously unpacking the Linux kernel. The first go at it was to start low so we didn't go straight to 10,000 idle clients we started with 10 shares and 100 replicas which would mean 1000 idle clients and the outcome was not immediately very good so we saw a bunch of errors so that Robert was happy to debug off now. So this one basically says it's a complaint for wait for attach from the CSI volume plug-in in the Kublet and it basically says that the node authenticator is not able to is not giving access to certain nodes for volume attachment objects. So what we learned from this is that we provisioning of the shares worked just fine I mean it was just 10 shares in this case some pods were up and running with those shares mounted but others that report this error they wouldn't recover. As in no amount of waiting would make them run. So here. So the next attempt was to cheat so instead of immediately fixing the problem we tried to hide it by doing a loop where we would kill the pods that would get into this trouble and try to get a bit higher in the number of clients. We knew this wouldn't be a real solution but we wanted some proper numbers so we got to this which doesn't look that nice but eventually we managed to get to 650 clients concurrent clients somehow.  So for our third attempt by that time Kubernetes 1.12 was out along with driver registrar 0.4 and those brought some pretty interesting features like Kublet plugin registration where driver registrar can tell Kublet to use or not use certain features. One of those was the CSI skip attach feature. So what it actually does so the way this work prior to Kubernetes 1.12 was we had basically when Kublet sees that a pod is requesting a CSI volume it will create volume attachment object for that particular volume and wait for the volume to be marked as attached. Meanwhile Kublet node number 2 is waiting the external attacher has called this volume attachment object node number 1 and it will do something with it and eventually it will mark the volume as attached so that Kublet on node number 2 can continue. This was done for all CSI volume simply because the volume attachments are in the domain of controller plugin but as you can see on node number 2 we have only node plugin so Kublet cannot make any assumptions on this so it will leave the decision whether to actually attach or not attach the volume for external attacher. Now with the CSI skip attach feature driver registrar can tell Kublet that this plugin really doesn't need volume attachments so it can skip the whole attachment process which solved the issue. Right so once we finally thought we had fixed it and actually it ended up we did we went to the maximum number of clients we had from the start the idea to deploy we did so this means that we had 100 Manila shares being created and all those shares were mounted on every single node in the cluster so 100 times 100 we had 10,000 fuse mounts which corresponds to 10,000 clients on the CFFS side. We did this gradually so we didn't want to go in one go to 10,000 but to do it in a control way so we are deploying here each 5 replicas it's 5 times 100 so we are doing 500 clients adding 500 clients at a time in half an hour we had 10,000 and this is how it looks so these are the sessions on the CFMDS the metadata server and you can see it gradually going up and it everything looks good in addition we had the cluster has three active MDSs and you can see that they are balanced really well which is kind of perfect from this plot we had a lot of other plots we have a lot of information if you are interested we have plenty of information from the CF side here we say see the namespace rates it's a bit weird that the idle clients are creating so much load on the namespace server this is something we want to investigate further same for the pull IO it's not completely clear why idle clients would do this much IO on the metadata and here we see also the amount of requests that is quite high so also the CPU load on the MDS servers was quite high the cluster was clearly under provision for this kind of test but this was the goal from the start so this is interesting for us further things to investigate we did see a couple of interesting logs so here we see that some clients from time to time are evicted from the cluster we don't know exactly why it might just be a question of the tuning of the of the timeouts for the few clients but it does mean that the CSI driver was properly reconnecting and we wouldn't see the issue but on the set side we do see this reported another thing we saw is that some could let some nodes in the cluster would flip to not ready meaning that you couldn't schedule new workloads on them this is something that it's not really understood by us right now so we'll keep investigating but they will come back to ready in a matter of seconds but this should happen now for the busy benchmark so this this was really like just clients doing a sleep and just keeping the connection open for the busy benchmark we were extracting Linux kernel and the goal was really to break something yeah this is the main goal of this exercise and we did so here is a plot again of the MDS servers the step side the MDS demons and there's something really interesting because this cluster has three different types of MDS demons and there's something really interesting because this cluster has three active MDSs but it actually has a standby MDS and you can see that one of the MDSs went into trouble and the standby picked it up immediately so from our side we actually didn't see any issue but set managed to recover as it often does but we did crash something at some point which is an achievement always especially when we have our main set expert the many of you might know that sends us messages like this and this makes our day usually this was a clearly next achievement now a bonus benchmark that we did is deleting 10,000 clients so we had started 10,000 clients here we are deleting them everything went smooth from the Kubernetes side we couldn't see any issue all the shares disappeared all the persistent volumes disappear from Kubernetes but in the Manila side we did see some of the shares being stuck in deleting and we went there and we triggered a forced delete and still in some cases this wasn't enough so we kicked the Manila share demon and this fixed issue but it's something that we will try to reproduce again to try to fix here it's the plot again of the sessions disappearing quite quickly so here we are not nice we just killed them all in one go so as a conclusion okay so yeah what can take from this is first of all there is this standard storage interface for container orchestrators which makes really a powerful tool to have storage drivers for any number of container orchestrators as long as they support the protocol but this definitely made my life easier while developing the CSSFS it works very nicely in Kubernetes although there are some issues as we saw earlier those are being investigated but that's completely understandable since this is really new piece of software other orchestrators are will fall with their implementations very soon because as I mentioned the stable 1.0 is coming up very shortly messes has already some implementation of this as for the benchmarks what we saw is that both Manila provisioner and CSSFS can handle large concurrency pretty well we saw some hiccups but those will be investigated as well and we will see how it's basically in a state where it's really usable and it's actually deployed and users can use it on a daily basis so as for the next step where to go from here there is a plan to add the volume expansion and snapshots for CSSFS and for Manila provisioner to transfer Manila provisioner into a CSI plugin because Manila provisioner is a Kubernetes specific piece of software making it CSI plugin will enable users to access Manila shares from any orchestrator that supports CSI so yeah that's yeah I think that's it so we have some time for questions so feel free to come Did you with the tests with creating the shares did you try to ramp up the velocity to create more frequently or did you stop at the benchmark which you presented here right so we you mean like the rate of creation of new clients so we started doing that to create more quickly but we didn't want to do it in this test cluster because it's really undersized for the load we were putting so we will do it in this other cluster that we have we don't have the numbers here but we will publish them soon yeah as soon as we have okay thank you and just another quick question what was the resolution of the of the graphs because I think it was 20 minutes right or didn't I get it this one is five minutes right so we ramped up the the clients over like 30 minutes 30 minutes so something like that yeah to be honest we we we don't expect the the promise is that the MDS is at the set side will scale horizontally so if we add more clients we can add more MDS or at least this is what our set admins promise so we'll be testing this okay thank you cool there's no more questions so you can reproduce the issue where you do the deletes and make Manila share hang say again sir can you reproduce the issue where you make Manila share service hang up by doing the deletes yeah so give us the logs definitely definitely so we actually managed to reproduce the issue on both clusters so we we have collected everything to send it upstream yeah okay thank you very much thank you very much


The evaluation report of the US intelligence officials shows that Iran will not directly attack Israel in response to the killing of the Islamic Revolutionary Guard Corps commander in Damascus. CNN reported this with reference to two US intelligence sources, IT was reported that Tehran demanded the proxy forces in the region to organize large-scale attacks against Israel by using anti-aircraft missiles and rockets. Preliminary preparations for the attack have been given to Iranian proxy groups and they are waiting for the right time. If Tehran takes direct action against Israel, it does not want to give the USA and its allies an excuse to attack its territory because it is afraid of the escalation of the conflict in the region, the report said. It should be noted that the possible time for these forces to attack Israel was mentioned as the current weak many regional countries would like to see Iran directly involved in a war with Israel, because it will inflict great damage on the country, two commentators told the media in Tehran. Uncontrolled media in Tehran has been abuzz with bellicose statements by some officials and at the same time warnings of remaining cool-headed by many pundits, following Israel's April 1 air strike. That killed seven Islamic Revolutionary Guard Corps officers in the Iranian embassy in Damascus, the leadership of the Islamic Republic, and particularly Supreme Leader Ali Khamenei face a challenging political dilemma, launch a forceful retaliatory attack and risk a wider war, possibly involving the United States, or exercise restraint and look for less dramatic alternatives. However, Tehran's proxies around the region, its domestic supporters, and even ordinary Iranians opposed to the government, might see any hesitation as a sign of weakness. Iran has pledged retaliation for Israel's deadly attack on its diplomatic mission in Syria's Damascus city. A senior Iranian official, Yahya Rahim Safavi, an advisor to Iran's Supreme Leader has said that none of Israel's embassies were safe anymore, Iran's Tasneem news agency reported on Sunday, Yahya Rahim Safavi made the remarks following a suspected Israeli strike on the Iranian consulate in Damascus on April 1 that killed at least seven officials including Mohamed Reza Zahidi, a top commander in Iran's elite Revolutionary Guards, IRGC, and senior commander Mohamed Hadi Haji Rahimi. Mohamed Bigheri, chief of staff of Iran's armed forces in a speech on Saturday threatened the harshest possible response to Israel in retaliation for the attack on its diplomatic mission in Syria. We have learned from Qasem Soleimani that we determined the time and type of operation, he said, adding that Israel will regret attacking Iranian diplomatic building. In response to these threats, Israel's defense minister Yovgalin said on Sunday that his country was ready to handle any scenario that may arise with Iran. Meanwhile, Jada Iran reported on Sunday, citing an anonymous diplomatic source that Iran has informed the US it would refrain from responding to the Israeli attack if a ceasefire in Gaza is reached. The source added that if America succeeds in containing the situation, it will be a great success for the Biden administration and we can build on that. Iran's supreme leader Kamine had earlier pledged retaliation after the attack in Damascus, vowing that Israel would be punished by the hands of our courageous men. Ukraine's military intelligence has claimed that it set fire to the Russian missile ship Serpukov and Russia's Kaliningrad region on April 8. An unnamed source within the Ukraine's military intelligence told local media that its operatives were behind the fire in Serpukov. It was the first such attack on Russian naval assets in the Baltic Sea. The ship has sustained heavy damage as a result of the attack. The source said information about victims was being clarified, but the ship itself was not well. Repairs will take a long time, the source said. Serpukov is a Project 21631 bayonet small missile ship, the fifth ship in the series. Serpukov was burning at the Baltic Naval base in Russia's western region of Kaliningrad. It should be noted that earlier, Ukrainian Magura V-5 naval drones hit and heavily damaged the Russian Project 22160 patrol ship Sergei Kotov near the Kerch Strait on the night of March 5. Since launching its full-scale invasion of Ukraine, Russia has lost many ships, including those of the Black Sea Fleet. Recently, the Ukrainian military attacked large landing ships in Crimea, Yomal, and Azov.


So up till now we've looked at ChatGPT+, which means you need a subscription. So are there any free tools out there? And indeed they are. So the one that we're going to look at in this tutorial is called clod.ai, clod.caud.ai. So it looks very much like ChatGPT. We can upload a file, a CSV file directly from our internal drive. And let's see if we can perform some exploratory data analysis. Now I'll stick around to the end because as per usual, I'm not only going to do exploratory data analysis, but I'm also going to do one statistical test just to see if clod.ai can deal with it. So before we start, here's the website of the Milken Institute School of Public Health. Visit the website if you are interested in any of the courses of programs that we have on offer in this fantastic School of Public Health. And here we are at clod.ai. Now I've already signed up. So the first time you open this page, you're going to be asked to sign up for a free account. Do so. It's quite easy to do. And when you open this page again, this is what you're going to see. Meet clod. Now this is a very nice interface, I think. Looks slightly better than ChatGPT in my opinion, but everyone would have a different opinion on that. What we do see immediately though is that there's a button there that we can link a file to. So if you have your CSV, your comma separated values file, which is a spreadsheet file, or we save your spreadsheets as CSV files, we can upload it directly from our computer, which is what I'll do right now. So I've selected the file on my internal drive. It's called hotlm.csv. There'll be a link in the description down below for you to get the same very simplified file. And of course, it is available on GitHub. So as always, as I've mentioned in all of my other tutorials using ChatGPT, is that I like to give some metadata information about the data. Now it's not strictly necessary, but I think it's always good just to provide some information. Now you can run it as is, and you should actually try that. And you'll see that Claude's actually going to generate quite a bit of information about the data. It's going to guess at what the independent variables are, what the dependent variable is specifically, and it's going to give you some information. But for our purposes here, as I say, I always like to generate this metadata and tell the large language model what the data is all about. And I'll be very verbose when I do do this. And so this, you know, I typically write a lot more than this, but what I've done here briefly, it's the same prompt as I used in the ChatGPT tutorials. It's sort of a simplified version of me giving some information about each of the variables. So we've got our file uploaded there, and we're going to give some information to Claude. Now what I've noticed before is sometimes Claude will not read the whole dataset. And there we go. Claude.ai is starting to respond. It says here are a few insights on the heart disease data. By the way, look right at the top. This is what it's going to call the chat. It says heart disease prediction model says v file analysis, and that is going to be added. It's going to be saved. So when you open Claude.ai again, you'll see a list of your previous chats. And so Sydney, this chat will be there now. So there appears to be an imbalance dataset with more instances of no heart disease, zero value than instances for heart disease. That's the one encoded with a one. The imbalance should be considered when training machine learning models. The day contains a mix of categorical and continuous variables. And so it does a very good job of giving you some insight. And you can read through Sydney read through all of this. And I think it's that's that's quite a promising start. So now I've tapped in how many rows and columns are there in this dataset. Let's just make sure and and see if Claude.ai indeed read the whole file. And it certainly seems so. It looks like there are 918 rows or observations and the seven columns. And it gives us the names of all the columns, the names of the variables. And remember up here, it gave us some idea of what it thought was the categorical variables in which were the continuous numerical variables. So, so far, so good. As I said, I've tried this file before and it only read about the first 303 observations. But now just adding that single line just telling it in my short little description. And as I said, this is one of the added benefits of giving it information about your data set that I said that they're 918 observations. So, so far, so good. Let's carry on. Now I've asked calculate summary statistics of the cholesterol column. Let's still see if it includes all of the observations. I've asked for count mean, median, variance standard deviation, minimum, maximum range, quartiles and the interquartile range. And yes, it seems as if it's found all 918 values. We can see the mean, the median, the variance standard deviation, minimum, maximum range. And we can see immediately that there's some issues. There's some values that are zero. And of course, we will have to go in there and eventually try and fix that. For now, though, let's see if we can create a histogram. So I've typed in create a histogram of the cholesterol column and look what Claude.ai has done. It's generated instead of the actual histogram. It's generated some Python code for us by default. And there we go. Now you have to know a little bit about Python to know whether this is going to work or not. Certainly it's imported. As far as I can see, some of the libraries or packages quite correctly, we are going to use mathplotlib, which is one of the many, many, many plotting packages in Python. They've also imported pandas, which is a package in Python that deals with the import, wrangling, and use of data sets such as spreadsheet files. And one of the packages, I suppose, mathplotlib and pandas, some of the packages that are the reason for the success of Python in data science. Now it uses one of the functions here, read underscore CSV, and it just references the file directly. So you will have to know where you save this Python file. And as it stands at the moment that this CSV file is in the same folder or directory as your Python file. So as it stands, it's probably not going to work. So what I'm going to do now, I'll just create a folder and I'll save a Python file in that folder. And I'll also put this hard LLM CSV file in that same folder. And we're going to see if this code actually executes and gives us a histogram. So this is my favorite IDE integrated development environment where I would write my Python code, my Julia code, my R code. And this video is not about this. I just want to see if the code executes to show you. So I've created this little folder on my internal drive LLMs for data science. And you can see I've got a Python file there. And there's my hot LLM. So my Python file and my CSV file are in the same folder. Here's my Python file. Now I'm just going to use a hashtag and 2% symbol so that I can create these cells such that these cells can just be executed one at a time. Now over on claw.ai, let's just make sure that we've copied that code and let's paste that code right here.  Don't worry about any of this. We can make separate tutorials if you want about setting up an IDE like this. If you want to, I just want to see if the code executes that claw.ai has given us. So let's run this code. And lo and behold, we have our histogram and then we can clearly see the problems that we have with the data that there were lots of values here near zero. And so there were certainly values that were encoded with a zero if that data was not available and that's certainly something that we will have to remove from the data. We might impute those missing values or we might just ignore those observations completely. But lo and behold, let's go back to claw.ai. This code that claw.ai generated actually works. Now that's one difference between claw.ai and say for instance chatGPT. ChatGPT was actually going to give you the histogram here but what claw.ai does generate some Python code for you. Now it does give us some information at the bottom. It says the histogram shows the distribution is right skewed with most values less than 300 milligrams per deciliter but a long tail extending to higher values. The peak frequency occurs between 20 to 150 milligrams per deciliter and et cetera, et cetera. So it gives you some information but at least the code the code is there for us to generate this if you are so inclined to use Python. So what if you don't want to use Python? Maybe you are a use of R. So I've typed in here generate R code to create a histogram of the cholesterol values. And once again, it's given us some information about the results that we asked for and it's generated some code. So I'm going to copy this code and here we are back in Visual Studio Code. I've got a QMD file, a quarter document and we can type in some R code here. So I've got to tell it that I'm writing R code so this is how you would go about that. And let's just paste this code in. So it's going to load the data it seems and then it's going to create a histogram using the hist function and it's going to add some vertical lines for us. That looks interesting but as always let's just see if this code actually executes. So I'm going to click on run cell and lo and behold, let's create some space here. There we go, there's our histogram and it's actually added some vertical lines for us and it looks like in blue we have the mean and in orange we have the median. So that was quite good. Now there's obviously a few problems here the text is way too small both for the access values and the access labels the overall plot label is not big enough but if you know R code this would be very easy to fix. So what we've seen here is instead of giving us the histogram claw.ai can generate some Python code or that will be the default or if we ask for some specific code in another language and I don't know the languages that it can work with but certainly Python and R as working data science those would be your go-to languages especially Python I suppose that's why it defaults to Python but there you go, it can also generate the R code for us. So since this is a tutorial we want to make sure that this claw.ai actually works I'm just going to stress test it a little bit I'm going to ask for a specific package so I'm going to say use the seaborne package to create code for a histogram with a kernel density estimate of the age column add a title, add a horizontal axis title and a vertical axis so here I've used the word title here I've used the word label so just mixing it up a bit let's see what it comes up with and here we see the results I think that looks absolutely beautiful that's even going to tell us here at the bottom you know what the code is supposed to do so you can Sydney Pausen have a look at that I'm going to copy the code and I'm going to take it across to my Python file here I'm going to paste it and let's execute the cell and see what happens and there we go it's actually done the histogram it has generated the axis labels, axis titles it's generated the overall title I can see the grid that I asked for we can see the histogram and we can see the kernel density estimate so that works absolutely that's spot on that's a very nice plot and it's done what I've asked it to do so really if you want to do your summary statistics I think you've just got to be careful as to how to go about it so be very verbose and specific tell it something about your data set just to make sure that everything is imported and of course go back to your actual spreadsheet file and see that it is imported which vaster to import it seems to work as far as the summary statistics is concerned so please give that a go try and be more specific ask it to filter out specific observations and then calculate the summary statistics for a variable play around with it and see if that works for you just as an added bonus I thought what we could do is just to try and do a statistical test so let's type in a message and I've typed in created contingency table of observed values using the heart disease and the resting ECG columns so if you're interested in biostatistics or you can remember some of your biostatistics courses remember that we do use a contingency table such as this because we are trying to look for an association between two categorical variables so what it's done here it's got heart disease those without heart disease and with heart disease there's the two rows in this contingency column and resting ECG it's got three classes a normal ECG echocardiogram ST segment changes that's the ST and LVH is left ventricular hypertrophy and now it counts these joint frequencies so there were 327 observations out of our total of 918 that had no heart disease and a normal ECG so that's our contingency table and what it's done it's also generated the Python code for us and you can certainly copy and paste that and see if it runs so I've asked it for contingency table of expected values and it's generated the Python code for us but it's also shown us here the contingency table and now this is expected values under a null hypothesis and the null hypothesis would say that heart disease and resting ECG are independent of each other they're not associated with each other and for instance in our postgraduate biostatistics course that I teach in lecture two we deal with probability theory and I show you how do we know if two variables if they are independent and certainly that is what we use to generate this table so if you're interested consider taking a postgraduate course in biostatistics and you'll learn all about these things one thing that we have to check for here if we want to use a Pearson-Sky-Square test is that all these values or at least 80% of them should be 5 or more and we see definitely the lowest value expected value we have here is 10.49 so that's what we would expect given the number of observations if these two variables are independent of each other so that's one of the assumptions you must look for now let's see if it can actually conduct Pearson-Sky-Square test so I've asked it to perform a Sky-Square test for independence to determine if the heart disease variable is independent of the resting ECG variable use a 5% level of significance and I've just added a little bit here saying comment on the result and there we go we see a p-value very small definitely less than the alpha value that we specified and then it also gives us a critical value there now you see the Python code there so certainly copy and paste that and see if that works but it seems as if it's if it's done the proper thing and as far as a critical value for two degrees of freedom again if you take the class I'll teach you all about degrees of freedom and how it relates to this Pearson-Sky-Square test but it used the degrees of freedom there which it got back from there this function actually turns a tuple and so we get the critical value of 5.99 and of course the x-square statistic that was calculated from the Pearson-Sky-Square test would be well above that giving us the small p-value and we can reject the null hypothesis that these two categorical variables are independent of each other and let's see this suggests that the resting ECG measurement may be useful in predicting heart disease status in particular the ST and LVH readings have a different distribution for those with heart disease so it's actually you know given us some good information here let's read this first part though since the p-value is less than the critical value of 0.05 we can reject the null hypothesis and conclude that there is a statistically significant association between heart disease and resting ECG which is exactly what we asked to do as far as the Pearson-Sky-Square test or the Sky-Square test for independence or the Sky-Square test for association once again statisticians many names same thing and but it certainly seems to have done the job properly here so Claude AI this is what you would do I've added a little extra at the end which is not so many statistics and data visualization but I thought let's just give it a go and see if Claude AI can do that it seems to me that it does a good job once again as with all of these I think it's very important that that you have some experience in biostatistics that you have experience with Python or R to make sure that you know what is returned here is actually correct so there you go it's going to work now you need a little bit of knowledge of either Python or R as we could see it could generate that code for you so it's not always going to give you all the results that Chatchapiti gave you for instance creating those actual plots you'll have to run some code as well but I think there's nothing wrong with it so Claude AI seems to be a good tool why didn't you give it a go?


As I want to welcome everybody back to the independent investor channel, we're going to jump in and do a review of the self-directed Roth IRA account number two. This is one of six major accounts that I have in the total comprehensive portfolio. The whole idea here is to tax protect dollars and wealth preserve them going forward. Those two aspects are really the root and the backbone of the independent investor channel. If we're not doing those two things, we're missing out over time. It's just that simple. So if you're really here in the niche of my message, it's to understand the power of a liberated dollar into the future, free of fees, and liberated to grow to potential of your dollars. Super, super important to understand that point and takeaway from my message. Without further ado, we'll jump in and we'll conduct the review. I'd like to welcome everybody into the Roth IRA number two. This is going to be the chronicle, the holdings in my account. This is the one that I've had. Oh, just going on about 15 or 16 years now anyway. And it's evolved over time. A lot of trading action in here, a lot of investing action. A lot of the everything of the above in this. It's really evolved over time. There's no doubt a few cornerstones in here that I insist upon owning just straight through Johnson and Johnson sticks out on the list here. But we're owning a big position here and Apple computers on the top end to take up some technology space. Next on the list is Abvy in the healthcare space. Alibaba out of discretionary here a 15 share position. I've already swung trade that couple times this year. I've been profitable every single time and thought it was a nice reentry here in Alibaba city group. I've owned for a long, long time. It's obviously increased in value. We had it in some real deep water here in the low 40s. Fought all the way back and it's nice to see that the company is up just to dab seven percent and with just over 51 shares. Salesforce, we just took an up in Salesforce of 10 shares. So we added again to that position. Glad to do so. I think over the next five years, this salesforce.com position is really going to become very valuable in the portfolio. Right below that, a space that gives me some exposure and online security is CrowdStrike, which I think is the best in breed, the best in what they do in the online security space, a 15 share position, relatively small, comparatively speaking, maybe a point and a half a percentage to the total overall portfolio value. But in the large, large growth space technology, it's a good holding technology is a very tricky, tricky sector for me to fill and CrowdStrike and Salesforce help fill out some of those areas, both in the cloud and in cloud cybersecurity, actually, so somewhat related there, but kind of the emergence of where things are going with technology. Right below that in the telecom space, we've got Google three shares, nice big position in the online search giant, really difficult to own discretionary without owning this fine name. Then right below it, we've got highly on holdings as well in the industrial space, just about 2200 shares there that we're working with IBM right below that in old tech has really kind of caught some fire, came off a nice quarter and has run up into a little bit more of a respectable territory. IBM has just been kind of a dog over the last five years, but I like it for the dividend and I like what they're doing here with their smart cloud technology and just acquiring red hat a couple years ago, it's a good acquisition for them with their legacy businesses and now their smart cloud technology or the hybrid cloud technology very good stuff. I'm glad to own IBM here, just shy of 4,026 shares, social capital, we need to get that through SPAC merger, we'll convert those warrants over and we'll hold 400 shares here in this portfolio and own them in both Roth's obviously those are the two spec positions, obviously bullish on both, getting punished in the short term but hopefully medium to the long term is really going to pay off long as I look at those as having some real long term growth prospects into the future and really look to embolden the portfolio with those two holdings with some nice capital growth prospects. J&J is the cornerstone, probably my absolute favorite, I mean it really is one of my absolute favorite stocks to own, almost a $10,000 bill, we've upped that position 20 more shares, easy justification to take up the lion's share of the healthcare sector, it is my largest of the healthcare holdings J&J, couldn't ask for a better performance, a company dividend pair at 3%, fantastic, we'll continue to own this and it's one that I look at, I monitor but I don't I don't mess with it, if I was going to do anything with Johnson & Johnson I would just continue to add to it going forward. Kimberly Clark came off a tough one, it's been up and down but nonetheless very very happy to own Kimberly Clark, we monitor for many many years insisted upon owning Procter & Gamble exclusively but we've split those two since then and to get myself some staples exposure, Kimberly Clark and right below it Coca-Cola right, so they complement each other, Pepsi and Coke, Kimberly Clark and Procter & Gamble I own all four, I don't discriminate between them, they're all great companies and their own right and might as well just own them all. McDonald's and the discretionary space has just done well, it came off a really just non-fire quarter just shy of 5,000, just over 20 shares, rather large positions, second largest holding a discretionary for me right behind Amazon, so this is a big one, up 17%, we're good with McDonald's, we'll just continue to own it, it's one of those top 10 companies, Dow Component that I think you can just buy and own forever, we're good to go, Merck another Dow Component here, Health Care's come off, this is one of the names that I've been rather disappointed on from a value proposition, it's undervalued, however just out of favor right now and that happens, we'll continue to sit on the dividend and we'll live to fight another day and look to the horizon for Merck, big oil here on the bottom of Royal Dutch Shell and ExxonMobil respectively, just oil can't get out of its own way, it's just absolutely terrible, the ExxonMobil position I will say we were down 50% in that, so to be down 15% right now and to have that ExxonMobil position looking at a $6500 bill just speaks on how persistent I've been, how patient I've been and how bullish I am on the big oil companies especially Chevron, Royal Dutch and Exxon, I have the biggest positions in these, I do round out the portfolio using M1 Finance and the Energy Space with Valero, Marathon Petroleum, Enbridge, some other names like that, Total Energy I'm very bullish on that I own in the other, Conoco Phillips, Phillip 66, so one of my favorite sectors it always has been, I don't know why, it punishes me to invest in it, however it does pay a nice dividend on all of them and you know you've got to fill out the energy sector, I'm kind of right on the money, I'm a little overweight in energy right now, basically because of that ExxonMobil, kind of running away from me a touch, which is totally fine, we'll continue to monitor that position and you know it's kind of fighting back some really good value there in big oil and then finally Raytheon Technology, they're the RTX position in industrials, relatively small, $2,500, 30 share position, love Raytheon, Raytheon's just won a huge contract with Lockheed Martin, Defense I really enjoy, I own Northrop Grumman in General Dynamics and the other portfolio industrial sector, I own Raytheon in the other portfolio too, one of the very rare opportunities that I take to double up on a position, I'm that bullish on it, Raytheon's one of my favorites, the only one that I don't own is L3 Harris that I cover but I don't currently own and Huntington Ingalls really being the five that I kind of cover in the defense space, I always keep my eye on it but I do have my faves and I'm invested in those respectively, okay, so with that that kind of concludes the review of the Roth IRA number two, hope you guys enjoyed the review, I don't roll these out very often but when I do this is an opportunity for you to jump into a real portfolio, this thing is alive and well, summer up summer down but this is investing 406 right here, this is in the trenches investing and glad to share it with you guys and the subscriber base and with that we'll kick you back and we'll conclude the video. All right guys so we've come out of the Roth IRA account number two, this is an account that kind of started it all for me, this was the account that was started with $1,500 just seems like yesterday, it's just amazing how wealth grows, it's amazing how if you mentally put yourself on a plan how you can get there, you really can, a lot of this is mental and you know it just takes that little bit of motivation to start and hopefully we can provide that little spark for you and sometimes that's what people need is just a little bit of inspiration to say you know what if this guy can do it I can do it too and you absolutely can, so if you appreciate the motivational angle to my message and to make sure and subscribe to the channel and leave your comments at the bottom, share the message with anybody out there that's looking for some introductory information on the stock market, what it means to be a self-directed investor what it means to be an empowered investor bring them on the channel we'd be glad to have them we're building a community of self-directed investors and all is welcome it's great the initiative is very very positive and your success is is really indicative of the channel's success so appreciate you guys tuning in to the message good luck in your investment future


Hello and welcome to the Centers for Medicare and Medicaid Services program on the basics of HIPAA administrative simplification. I'm Valerie Hart and I'm joined by John Young and we'll be your guides as we review the information you need to know about HIPAA and complying with its administrative simplification provisions, specifically the electronic healthcare transaction and code set standards. This program is designed to help you understand the history of HIPAA and its benefits for you. Unsure whether you're a covered entity, we'll show you how to find out. Then we'll cover the standards that have been adopted for electronic transactions and code sets. You'll find out why the designated standards maintenance organizations may be important to you. You will also learn about some of the steps you need to take to become compliant with the administrative simplification provisions of HIPAA. We'll also touch on how HIPAA's rules and deadlines will be enforced. We'll also share the answers to some of the HIPAA questions that we have received and show you how to get more information about HIPAA. Congress passed the Health Insurance Portability and Accountability Act in 1996. In addition to creating consumer protection for healthcare benefits, the portability part of HIPAA, HIPAA will, Standardized Financial and Administrative Health Transactions for the public and private sectors, increase speed and efficiency, cut the cost of delivering healthcare services, and set minimum standards of protection for the storage, use and transfer of protected health information. In short, HIPAA puts the force of law behind the adoption of standards. The HIPAA statute has five titles. The second title contains the administrative simplification provisions and is the one we will focus on today. There are four main areas that comprise administrative simplification. The first is electronic transactions and code sets. HIPAA adopts and requires the use of uniformed national standards and requirements for conducting electronic healthcare transactions. The second area is the unique identifier. HIPAA requires establishing and assigning a standard identifier that providers, health plans and employers will use for every electronic healthcare transaction. The third is privacy. Under HIPAA, covered entities must implement standards to protect and guard against the misuse of individually identifiable health information. The final area is security. HIPAA addresses how electronic health information is stored, transmitted and accessed. The administrative simplification standards adopted by the Secretary of the Department of Health and Human Services under HIPAA applies to all healthcare clearinghouses, all health plans, those healthcare providers that conduct certain transactions in electronic form or use a billing service to conduct transactions on their behalf. If you meet one or more of these criteria, you are a covered entity and must comply with the administrative simplification requirements of HIPAA. We have mentioned transactions a lot. Exactly what is a transaction? A transaction is the electronic transmission of information between two parties to carry out financial or administrative activities related to healthcare. Electronic transaction standards have been developed for the following exchanges of information. Healthcare claims or equivalent encounter information, healthcare payment and remittance device, healthcare claim status, eligibility inquiry, referral certification and authorization, enrollment and disenrollment in the health plan, health plan premium payments, coordination of benefits, claims attachment, standards forthcoming, and first report of injury, standards forthcoming. What do we mean by electronic? The term electronic is used to describe moving healthcare data via the internet and extranet leased lines, dial up lines such as direct data entry or DDE, private networks, point of service, and health data that is physically moved from one location to another using magnetic tape, disk or CD media. Fax is sent using a dedicated fax machine as opposed to faxing from a computer and voice response units on phones are not subject to the transaction standards but may have to meet privacy and security standards. Now let's catch up with another special term and define direct data entry or DDE in some more detail. With DDE a remote user keys data directly into a health plan's computer using dumb terminals or computer browser screens. Health plans can give providers the option to use DDE but are not obligated to do so. In this segment we get back to more of the details of administrative simplification. Although HIPAA was enacted in 1996, each of the provisions of administrative simplification are set in motion through the issuing of proposed and final regulations. Thus, each part of administrative simplification has different effective dates and different compliance deadlines. We'll review them in the next section. The final rule for electronic transactions and code set standards was issued in August 2000. Compliance with this rule was required by October 16, 2002 for large health plans, health care providers and health care clearing houses. However, Congress realized that many covered entities would not be ready to comply with that date. So in December of 2001, it passed legislation that became Public Law 107-105, also known as the Administrative Simplification Compliance Act or ASCA for short, which amended HIPAA and granted a one-year compliance extension to October 16, 2003 under certain conditions. That extension was available to covered entities scheduled to become compliant in 2002, provided the covered entity submitted a compliance extension plan to CMS by October 15, 2002. Small health plans with receipts of less than $5 million have always had until October 16, 2003 to comply, and the compliance date was not affected by the extension. Covered entities that filed for an extension are required to begin their internal testing by April 16, 2003. Does HIPAA require that I submit my health care claims electronically? HIPAA does not require that you submit health care claims electronically. What it does require is that if you conduct certain transactions electronically, you must use the HIPAA standards. And there's another important element of ASCA. It requires that most Medicare claims submitted after October 16, 2003 be submitted electronically. There will be exceptions to this requirement. For example, you will be able to continue to submit paper claims if there is no method available for submitting them electronically. Also, regardless of whether an electronic claim format is available, small providers of services or supplies can continue to use paper. Small providers are defined by ASCA as a physician, practitioner, facility or supplier other than provider of services with fewer than 10 full-time equivalent employees, or a provider of services with fewer than 25 full-time equivalent employees. There may be additional exceptions. Regulations clarifying the exceptions to the Medicare electronic billing requirements will be issued. If you are a provider and believe you qualify for an exception, you should continue to build Medicare via paper. There is currently no mechanism in place to request a waiver of these requirements, so please be patient and wait for the regulations to be issued. It's time to hear one of the HIPAA questions that we received. I'm a small healthcare provider. I've heard that I'm excluded from HIPAA. Is that true? No. Small providers are not excluded from HIPAA. The size of the healthcare provider's office does not exempt them from HIPAA. If a healthcare provider transmits any of the designated transactions electronically, they are considered a covered entity and are subject to the administrative simplification provisions of HIPAA. Thanks. Now, let's move on to the compliance dates for the other key components of administrative simplification. The final rule for HIPAA privacy was published in December of 2000 with final modifications published August 14, 2002. Set the compliance date of April 14, 2003 for all covered entities except small health plans. Remember, even if you got the one-year extension for meeting the electronic transactions and code sets requirements, you still must meet all deadlines for compliance with the deadlines for the privacy provisions or any of the other HIPAA administrative simplification provisions. April 14, 2004 is the privacy compliance date for small health plans. The standard unique identifiers mandated by HIPAA include the following, the National Employer Identifier, the National Provider Identifier, and the National Health Plan Identifier. The final regulations that specify the National Employer Identifier were published in May 2002. The rules adopt the Employer Identification Number, or EIN, an existing identifier already issued by the Internal Revenue Service as the National Employer Identifier for use in health care transactions. The use of this identifier will improve the Medicare and Medicaid programs and the effectiveness and efficiency of the health care industry in general by simplifying the administration of the system and enabling the efficient electronic transmission of certain health information. All covered entities except small health plans must comply with the National Employer Identifier Standards by July 30, 2004. Small health plans must comply by August 1, 2005. As of December 2002, the final regulations for the National Provider Identifier are still pending and the rule for the National Health Plan Identifier has not been released. On February 20, 2003, the Department of Health and Human Services published the final rule for security standards for electronic protected health care information. This rule specifies a series of administrative, technical, and physical security procedures for covered entities to use to assure the confidentiality of electronic protected health information. The security compliance dates are April 21, 2005 and April 21, 2006 for small health plans. Please visit the CMS website for current information about security. That site is www.cms.hhs.gov slash HIPAA slash HIPAA 2. We'll provide a list with this address and other helpful web addresses at the end of the program. Before we move on, let's review each of the three covered entity categories in more detail to help you determine if you are a covered entity. Let's start with providers. How do you know if you or your business is a covered health care provider? All health care providers that conduct any electronic transactions for which the Secretary of the Department of Health and Human Services has adopted standards are covered entities. This includes providers who use a billing service or a clearinghouse. This includes hospitals, clinics, nursing homes, positions, suppliers, and others that furnish, bill, or receive payments for health care services in the normal course of business. If you use another entity such as a clearinghouse to conduct covered transactions in electronic form on your behalf, you are considered to be conducting the transaction in electronic form and thus you are a covered entity. Now how do you determine if your business is a covered health care clearinghouse? If your business processes or facilitates the processing of health information from non-standard formats to standard formats and vice-versa, you are considered a clearinghouse and thus a covered entity. Clearinghouse services may be provided by many types of organizations, including billing services, repricing companies, or in some cases, banks. Finally, how do you determine if your private benefit plan or government funded program is a health plan? A health plan is broadly defined as an individual or group plan that provides or pays the cost of medical care. For private benefit plans in general, it is considered a health plan if the plan is a health insurance issuer, a group health plan, an insurer of a Medicare supplemental policy, an HMO, or a multi-employer welfare benefit plan. Long-term care policies in addition to other policies are covered. However, nursing home fixed indemnity policies are not. There is an important exception to that definition. If the plan is a group health plan that has fewer than 50 participants and is self-administered, then it is not considered a health plan. Remember, HIPAA gave small health plans an additional year to comply with the HIPAA transaction and code sets standards. So what exactly is a small plan? A small health plan is defined as having annual receipts of $5 million or less. Annual receipts means total income or gross income plus cost of goods sold as these terms are defined or reported on IRS federal tax return forms. Health plans that do not report receipts to the IRS, such as ERISA group health plans exempt from filing income tax returns, should use proxy measures to determine their annual receipts. Fully insured health plans should use the amount of total premiums which they paid for health insurance benefits during the plan's last full fiscal year. Self-insured plans, both funded and unfunded, should use the total amount paid for healthcare claims by the employer, plan sponsor or benefit fund, as applicable to their circumstances on behalf of the plan during the plan's last fiscal year. These plans that provide health benefits through a mix of purchased insurance and self-insurance should combine the proxy measures to determine their total annual receipts. Finally, most government-funded programs are considered health plans. This includes Medicare, Medicare Plus Choice, Medicaid, State Children's Health Insurance Program, TRICARE, Indian Health Service, Veterans Health Care Program and the Federal Employees Health Benefit Program. However, government-funded programs other than those listed above are not health plans if their primary purpose is other than paying for or providing care, or if their principal activity is the direct provision of health care or making grants to fund health care. Remember, if you are a covered entity, you are responsible for complying with the rules and regulations of administrative simplification, including meeting all compliance deadlines of each of the provisions. If you still have questions about how to determine if you are a covered entity, you can visit the CMS website at the address on the screen and follow the covered entity flowchart decision tool.  In segment two, we briefly touched on the HIPAA transactions. Now let us clarify the transactions and code set standards that covered entities must use. Let's listen to another HIPAA question. I'm a health care provider. Am I allowed to submit claims both electronically and by paper? Under HIPAA, a provider has the option for any transaction to conduct it electronically or on paper. HIPAA does not require that you choose one method. However, if you choose to conduct electronic transactions, you must use the HIPAA transactions and code sets. Also, once a provider uses an electronic transaction, you become a covered entity and subject to the privacy rules also. Keep in mind that after October 16, 2003, Medicare will only accept paper claims under limited circumstances. HIPAA mandates the use of national standards for the electronic transfer of certain health care data between health care providers, health plans, and health care clearinghouses. It replaces many non-standard formats with a single set of electronic standards to be used throughout the U.S. health care industry. Standards have been developed for eight of the 10 transactions. We'll review these in a moment. Not every covered entity will conduct all of these transactions. For instance, health care providers would not engage in enrollment or disenrollment in a health plan. For each of the transaction standards, there is also an associated implementation guide. Implementation guides can be thought of as big recipe books, which provide detailed technical specifications that explain how to build a standard transaction. This includes format specifications, content specifications, and certain code sets. These guides define the data elements that are required for electronic transactions. Implementation guides provide important information for an information technology group or vendor that handles electronic claims submission. While many covered entities may never need to look at an implementation guide, it is important to know that they exist. Software vendors may rely on these to update your billing software. These guides may be downloaded for free from the website on your screen. Providers should also contact their payers and inquire whether they have companion guides available to accompany the implementation guides. If available, companion guides can provide additional information that is helpful in interpreting the implementation guides. Now let's return to the specific standards that have been adopted for each of the eight transactions. Please note that health care providers should mainly concern themselves with the first five transactions, as the other ones may not apply to them. The regulation adopted what is commonly referred to as the ASC X12N837 format for health care claims and coordination of benefits for professional, institutional, and dental claims. This format and many of the other adopted standards have been developed and maintained by X12 Standards Development Organization, who has been accredited by the American National Standards Institute as the standards organization for many electronic transactions. For retail pharmacy drug claims, the regulation adopted the NCPDP telecommunication version 5.1 and batch standard 1.1. For health care payment and remittance advice, the regulation adopted ASC X12N835. Currently, many providers spend precious time reconciling submitted claims with the paper remittance advice. Under HIPAA, providers can get electronic remittance advices from health plans and their practice management systems can auto-post them. In essence, you'll be able to conduct claims accounting without wasting staff time. For health claims status, the regulation adopted ASC X12N276 and 277. Office staff who have been spending time on hold calling a health plan to check on the status of the claim will now be able to electronically request claim status information and get the answer without using the phone. For eligibility for a health plan, HIPAA adopted ASC X12N270 and 271 for health care eligibility, benefit inquiry, and response. Under HIPAA, providers should have fewer worries about getting correct eligibility information quickly. For referral certification and authorization, the transaction standard adopted is ASC X12N278 for health care services review or request for review and response. This transaction is to allow providers to electronically ask for permission from the health plan to refer their patients to other providers or to perform additional procedures. For enrollment and disenrollment in a health plan, HIPAA adopted ASC X12N834 for benefit enrollment and maintenance. For health plan premium payments, the transaction standard is ASC X12N820 for payment order remittance advice. Now that you know what the HIPAA standards are, you might be wondering where they came from. HIPAA requires the Secretary of the Department of Health and Human Services to adopt standards that were developed by private sector standard development organizations. The ASC X12 organization maintains the standards. And the National Council for Prescription Drug Programs, or NCPDP, maintains the telecommunication and batch standards, and they can be found at www.ncpdp.org. In addition to standard transactions, the HIPAA regulation also requires the use of standard code sets. Here are the code sets adopted in the final rule. For diagnosis and procedure codes, HIPAA adopted ICD-9-CM. That stands for International Classification of Diseases, Ninth Revision Clinical Modification. Versions one and two are maintained by the Centers for Disease Control in DHHS, while version three is maintained by CMS. For services provided by physicians and other professionals, CPT-4 was adopted. CPT stands for Current Procedure Terminology and is maintained and copyrighted by the American Medical Association. HIPAA stands for Healthcare Common Procedure Coding System and is maintained by CMS. These codes are for products, supplies, and services not included in the CPT-4 codes. The code stands for Code on Dental Procedures and Nomenclature and is maintained and copyrighted by the American Dental Association. Finally, NDC stands for National Drug Code, which is used by retail pharmacies and is maintained by the Food and Drug Administration in DHHS. The transactions and code set regulation adopted these first sets of HIPAA standards. It also created a process to allow anyone to request a change in the standards. Six organizations known as Designated Standards Maintenance Organizations, or DISMOS, were designated by the Secretary of DHHS and have agreed to work together to collect requests for changes to HIPAA standards, evaluate the requests, and suggest changes to the standards for the Secretary's consideration. The six DISMOS are the Accredited Standards Committee X-12, Health Level 7, Inc., the National Council for Prescription Drug Programs, the National Uniform Billing Committee, the National Uniform Claim Committee, and the American Dental Association. The Secretary may modify a standard or its implementation guides, but no more frequently than once every 12 months. You can find out more by going to the DISMO website at www.HIPAA-DISMO.org. As always, any time you want to find out more information about this or any other HIPAA topic, you can visit the CMS HIPAA website. In the next section, we'll review some steps you can take to help reach HIPAA compliance. It's time for another question. Let's listen. I'm overwhelmed by HIPAA. Where do I start? Watching this program is a great start. Visit the CMS website. It contains many helpful items. The HIPAA provider readiness checklist can help you get the ball rolling. Also, review the frequently asked questions on the website. We also put HIPAA updates on our website, so try to get in the habit of checking it monthly. Many of you might be wondering just where to start with HIPAA. In this section, we'll outline some key steps and questions that covered entities should be addressing to help reach compliance with the electronic transactions and code set standards. While not all are encompassing, knowing where you're standing in relation to these steps and questions should help you to better focus your efforts in reaching compliance. The first step is HIPAA project planning. Assign someone in your office as a HIPAA point person if you haven't already done so. This person should be responsible for all aspects of HIPAA and should have access to the HIPAA decision makers such as the CEO, the CFO, and the CIO. Covered entities have many ways to communicate transactions and requests for information. You need to identify which modes you use that are covered under HIPAA, such as discats, direct data entry, or DDE, web-based, or any other form of EDI or electronic data interchange. Paper, telephone, and faxing with a dedicated fax machine as opposed to faxing from a computer are not considered electronic transactions under HIPAA. Have you identified all modes of communication for all HIPAA-covered transactions? Have you identified who your trading partners are? What methods do you use to conduct HIPAA-covered transactions electronically? Your HIPAA budget, resources, and contracts should be reviewed. The next step is evaluating the impact on business processes and systems. Some general points to consider include, have you assessed the business processes for HIPAA impact? Have the processes been prioritized for contingency planning? Adopting the HIPAA standard code sets means the loss of local codes. Has the impact of the loss of local codes and adoption of standard codes on your systems been assessed? Do you have a plan for changing policies, processes, and procedures, as well as staff training to accommodate the switch to standard codes? A system assessment in the form of a gap analysis needs to be completed. Simply put, this means identifying where you aren't ready or gaps between what you do now and what you'll need to do under HIPAA. For providers, the practice management software vendor may be responsible for all or part of gap analysis. Points to consider as part of a gap analysis include, has a gap analysis been performed on your systems or your vendor's systems? Have mandated standard transactions been mapped? Has the system assessment been completed? In addition to performing gap analyses, health plans and clearinghouses need to review and likely revise many of their internal systems to ensure that HIPAA codes, fields, and field sizes are fully supported. The next step is validation and testing. All covered entities must perform testing. For providers, focusing on key transactions, such as the claim, remittance advice, and eligibility transactions is important. Also, if you're testing with one payer, you should not assume that you are okay. You need to test with all of your payers. Remember, technical glitches can occur, so be sure to build in enough time. The World Group on Electronic Data Interchange in the Strategic National Implementation Process, or WEDI SNP, has a suggested seven-step testing process that you can follow as HIPAA does not specify how testing should be conducted. You can visit WEDI's website at the address on your screen for more information. And remember, testing must begin no later than April 16th, 2003. Try to test early and often as testing may take many months. The next step is coordinating with your trading partners. Trading partners include health plans, billing services, and clearing houses with which you may conduct HIPAA transactions. Here are some points to consider. Have you contacted your trading partners to determine their HIPAA readiness? Are contracts in place with vendors, billing services, or clearing houses for HIPAA-compliant transaction services? When will your vendor be updating and sending you HIPAA-compliant software? Do you or your system vendor have a schedule for design development and implementation? Do you have a way to track system modification status in progress? Have you or your system vendor decided on an overall approach to achieving compliance? Is everyone aware of the April 16th, 2003 testing deadline? While trading partner agreements, or TPAs, are not required by HIPAA, these agreements specify the communication methods and specific processing and code requirements not determined by the HIPAA transaction implementation guides. While the HIPAA standard to address data format and content, they do not address other issues, such as the method by which trading partners can accept and send transactions. And many data elements are considered situational, which means they are required as a given situation is met. However, these sorts of issues are not addressed in the standards and should be outlined in a TPA. Some additional questions to be asked and include, have transmission methods been agreed upon? Have situational data elements been identified? Do you have the appropriate implementation guides and companion guides? Have you accepted the processing and code requirements not determined by HIPAA? CMS has been designated by the Secretary of DHHS to enforce all of the HIPAA administrative simplification provisions with the exception of the privacy standards. This includes transactions and codes at standards and security and identifier standards after they are in effect. The Office for Civil Rights, or OCR, at DHHS, is responsible for enforcement of the privacy provisions. The enforcement process for both will be primarily complaint-driven. Thus, the process leading to any penalties will be initiated primarily in response to an external complaint filed against the covered entity. CMS will provide opportunities for a covered entity to demonstrate compliance or submit a corrective action plan with the focus on obtaining voluntary compliance through technical assistance. CMS will notify you by letter only if a complaint is filed against you. At that time, you will have the opportunity to show compliance or to submit a corrective action plan. Only if you do none of these things would consideration be given to invoking penalties. And what are the penalties? Civil monetary penalties of not more than $100 per violation capped at $25,000 for each requirement or prohibition that is violated. Criminal penalties of up to $50,000 in one year imprisonment for knowingly obtaining or disclosing individually identifiable health information in violation of the HIPAA rules. Up to $100,000 in five years imprisonment if the violation is committed under false pretenses. And up to $250,000 in 10 years imprisonment if the violation is committed with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm. All criminal penalties are under the jurisdiction of the Department of Justice. The enforcement aspect of administrative simplification is still in the early stages. Again, CMS's emphasis is on ensuring everyone becomes compliant with the HIPAA provisions. While it's true that penalties can be imposed, the first course of action will focus on providing technical assistance aimed at helping an entity reach compliance. For the most recent information with regard to enforcement and other general areas of HIPAA administrative simplification, visit the CMS website at www.cms.hhs.gov slash HIPAA slash HIPAA2. To learn more about HIPAA and privacy or privacy enforcement issues, visit OCR's website at www.hhs.gov slash OCR slash HIPAA. Now that we have provided you with an introduction to HIPAA, you may still be wondering how the administrative simplification provisions of HIPAA will benefit you. Let's meet Dr. Barbara Paul, CMS official, practicing physician, and covered entity. Dr. Paul is the Director of Quality Measurement and Health Assessment Group at CMS. Thanks, John. Hello, I'm Barbara Paul, one of the many practicing physicians who work at CMS. As I listened to this program, I realized that I had many of the same questions you heard today. As I navigate my way through HIPAA, I try to be patient with the stresses and strains of transitioning from the 400 different formats for submitting claims currently in use today. What keeps me going, and I hope will keep you going as well, is the prospect of simpler, more streamlined administrative environment for physicians and the healthcare industry overall. John and Valerie have already mentioned many of the advantages of a HIPAA-compliant practice. Speedy determination of your patient's eligibility, giving you fewer worries about what's covered and who to bill. The promise of prior authorization and referral requests for your patients in any health plan, and much quicker turnaround for these requests without ever picking up the phone. You'll also be able to send in bills and batches or online and get a speedy response from your payer if they cannot be processed. Thus, physicians will be paid faster and have fewer administrative hassles. That should translate into more time for patient care. Another benefit is that administrative simplification mandates that healthcare entities implement a set of standards that will be used by all sectors of the healthcare industry, thus eliminating the use of local codes. This means that under HIPAA, your office will use the same set of codes for the same procedure with all health plans that you bill. Before HIPAA, you had to know which local code to bill, which health plan for the same service. Thanks, Dr. Paul. In general, HIPAA intends to reduce the cost of administrative operations to simplify the electronic exchange of information and to prevent unauthorized access to patient health information. Your patients should see faster responses to their concerns such as unpaid bills or access to patient records. And this should serve to improve your patient's satisfaction with you. It is time for another HIPAA question. My vendor says they're handling everything so I don't need to worry about HIPAA, right? Good question, but you do need to worry about HIPAA.  So it's important that you understand the deadlines and details about HIPAA and its impact on your business and communicate often with your payers, software vendors, billing service or clearing houses to find out where they are with HIPAA implementation. In our final segment, we'll review important facts from our program and tell you about additional resources you can access to find out more information on HIPAA. By now, you should have a better understanding of the many aspects of complying with HIPAA's administrative simplification provisions. Remember that the next compliance date is April 14th, 2003. This is a deadline for meeting the privacy requirements with the exception of small health plans who have another year. Then, just two days later, is the testing deadline for all covered entities who submitted a compliance extension form. Compliance with the electronic transactions and code set standards for all covered entities, including small health plans, is required by October 16th, 2003. The compliance deadline for privacy is April 14th, 2004 for small health plans. The compliance date for national employer identifiers is July 30th, 2004 for all covered entities except small health plans. Small health plans have until August 1st, 2005 to comply. The compliance date for security is April 21st, 2005 for all covered entities except small health plans. Small health plans have until April 21st, 2006 to comply. To find out more information about HIPAA administrative simplification, there are a number of resources available. The HIPAA hotline number is available to answer your questions. That number is 1-866-282-0659. This hotline can help you with your questions about electronic transactions and code sets, unique identifiers, and security. Please direct your privacy questions to the HIPAA Privacy Hotline. That number is 1-866-627-7748. The CMS HIPAA website is another good resource of information. It's updated frequently and provides access to free tools and information, such as the covered entity decision tool, a provider readiness checklist, information on upcoming conference calls, and enforcement information, plus access to frequently asked questions about HIPAA. The address is www.cms.hhs.gov-hippa-hippa2. For more information on the HIPAA privacy provisions, visit www.hhs.gov-hippa-hippa. This website includes privacy guidance documents and sample business associate contract provisions. Here are some additional web resources that you might find useful. You have found the information in this program helpful in your efforts to comply with the administrative simplification provisions of HIPAA. Thank you for watching, and remember to check our website for the latest HIPAA information.