03-26629. Statement of Organization, Functions, and Delegations of Authority

Part F, of the Statement of Organization, Functions, and Delegations of Authority of the Department of Health and Human Services, Centers for Medicare & Medicaid Services (CMS), 49 FR 35247, dated September 6, 1984, is amended to include the following delegations of authority from the Secretary to the Administrator, CMS, with the authority to redelegate, to carry out the following administrative and enforcement activities vested in the Secretary of the Department of Health and Human Services under part C, of title XI of the Social Security Act, as amended.

• Section F.30., Delegations of Authority, is amended to include the following delegations of authority for certain provisions under part C, of title XI of the Social Security Act.

WW. 1. The authority under section 262 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, as amended, to administer and to make decisions regarding the interpretation, implementation and enforcement of the regulations adopting standards and general administrative requirements under 45 CFR, parts 160, 162 and 164 (except to the extent that these actions pertain to the “Standards for Privacy of Individually Identifiable Health Information”).

2. The authority under section 262 of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, except to the extent that these actions pertain to the Standards for Privacy of Individually Identifiable Health Information, to:

A. Impose civil monetary penalties, under section 1176 of the Social Security Act, including any settlement thereof, for a covered entity's failure to comply with certain requirements and standards.

B. Make exception determinations, under section 1178(a)(2)(A) of the Social Security Act, concerning when provisions of State laws that are contrary to the Federal standards are not preempted by the Federal provisions.

Exclusion to This Authority

All actions under Part C, of Title XI that pertain to Standards for Privacy of Individually Identifiable Health Information, were delegated by the Secretary to the Director, Office for Civil Rights, and are excluded from this delegation. This delegation to the Administrator also excludes the authority to issue regulations and to hold hearings and issue final determinations if the respondent has requested a hearing on the imposition of civil monetary penalties. This delegation should be exercised under the Department's existing delegation of authority and policy on issuance of regulations. In addition, I hereby affirm and ratify any actions taken by the Administrator, CMS, or any subordinates, that involved the exercise of the authority delegated hereunder prior to the effective date of this delegation.

This delegation of authority is effective immediately (October 7, 2003).

Dated: October 7, 2003.

Tommy G. Thompson,

Secretary.