Three Standards for One Attachment

Claims attachments were on HIPAA's list of standard transactions in 1996. CMS proposed a standard for them in 2005 and again in 2022 and finally adopted it in March. The final rule (CMS-0053-F) came out on March 24, 2026 and compliance is due May 26, 2028.

It uses two X12 transactions on version 6020. The payer requests documentation with a 277 (006020X313) and the provider sends it back in a 275 (006020X314). The clinical content rides inside the 275 as an HL7 C-CDA document and the rule adopts the HL7 CDA Digital Signatures guide for signed documents.

Until now HIPAA had no adopted standard for claims attachments. Most are still faxed, mailed or uploaded to payer portals. Electronic use has dropped. The 2025 CAQH Index puts it at 24% of medical attachments and 28% of dental, down from 32% and 37% the year before.

The version is the first thing I would look at. Claims and remittance are still on 5010. The attachment mandate is on 6020 and in December 2025 X12 recommended 8060 for all twelve HIPAA guides including the attachment transactions. The Unified Agenda lists a proposed rule (CMS-0061) for a new claims and remittance version in December 2026. It covers only the 837 and 835 and does not say which version. That date has slipped before. If it follows X12's recommendation a team building the 6020 275 now could see the claim proposed on 8060 before its 2028 deadline while the attachment stays on 6020.

One claim can need both versions. The claim goes out on a 5010 837 and the attachment goes on a 6020 275. On a Medicare claim the provider sets PWK02 to EL to show the documentation will follow on the 275. If the payer asks for it instead, its 6020 277 carries the payer's claim control number so the 275 can be matched back to the claim. Either way, a provider or payer that exchanges attachments has to support 5010 for the claim and 6020 for the request and the 275.

The other thing is the part CMS did not finalize. CMS also proposed a 275 for prior authorization (006020X316) that would travel with the 278. Three weeks later, CMS published CMS-0062-P which proposes FHIR in place of the 278 and names HL7 Da Vinci CDex as the standard for prior auth attachments. In August ONC adopted CDex as a federal health IT standard in the FY 2027 IPPS final rule. The HIPAA prior auth proposals in CMS-0062 are not finalized so CDex is not yet a HIPAA standard for prior auth attachments.

WEDI raised this before either rule came out. At a CMS listening session on December 10, 2025 it warned about "two standards for attachments, one for PA and a different standard for claims."

If both rules stay in place, the same clinical note could be sent differently for a claim than for a prior authorization. A note sent with a claim goes as a C-CDA inside a 6020 X12 275. For prior authorization, the payer would get it through CDex as a FHIR exchange.