05-18254. Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings-Extension of Expiration Date

AGENCY:

Office of the Secretary, HHS.

ACTION:

Final rule.

SUMMARY:

An interim final rule establishing procedures for the imposition, by the Secretary of Health and Human Services, of civil money penalties on entities that violate standards adopted by the Secretary under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was published on April 17, 2003. The interim final rule expires on September 16, 2005. This regulatory action extends the expiration date to March 16, 2006 to avoid the disruption of ongoing enforcement actions while HHS completes with rulemaking to develop a more comprehensive enforcement rule.

DATES:

Effective September 14, 2005, the expiration date of 45 CFR part 160, subpart E is extended from September 16, 2005, to March 16, 2006.

FOR FURTHER INFORMATION CONTACT:

Carol Conrad, [phone].

SUPPLEMENTARY INFORMATION:

I. Background

On April 17, 2003, the Secretary of Health and Human Services published an interim final rule with request for comments. 68 FR 18895. The interim final rule adopted rules of procedure for the imposition by the Department of Health and Human Services (HHS) of civil money penalties on entities that violate standards and requirements adopted by HHS under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191. These rules are codified at 45 CFR part 160, subpart E (subpart E).

As corrected at 68 FR 22453 (April 28, 2003), subpart E was scheduled to expire on September 16, 2004. On September 15, 2004, HHS published a final rule extending the expiration date for one year, to September 16, 2005. 69 FR 55515. The final rule extended the original expiration date to avoid disruption of ongoing enforcement actions while HHS undertook a rulemaking to propose complete procedural and substantive provisions for the enforcement of the HIPAA rules through the imposition of civil money penalties, which would supersede subpart E.

On April 18, 2005, HHS published a notice of proposed rulemaking proposing this complete set of enforcement provisions. 70 FR 20224. The public comment period on the proposed rules closed on June 17, 2005. HHS is currently considering the public comments received, but will not be able to issue the final rule by September 16, 2005. Thus, in order to preserve the status quo with respect to enforcement during the pendency of the rulemaking, HHS is extending the expiration date of subpart E for an additional six months, to March 16, 2006.

II. Procedural Requirements

A. Determination To Issue Final Rule Extending Expiration Date Without Notice and Comment, To Be Effective in Less Than 30 Days

As noted, HHS has proposed a rule to supersede subpart E. However, this rulemaking will not be completed by September 16, 2005, when the interim final rule that adopted subpart E is scheduled to expire. The resulting hiatus in the procedures for civil money penalty enforcement actions could create confusion for both the public and HHS with respect to enforcement during this period. Thus, HHS hereby extends the expiration date of subpart E to March 16, 2006. This action is being taken under HHS's authority at 42 U.S.C. 1302(a) and 1320d-6.

Notwithstanding this extension, HHS fully expects to issue the final rule that will result from the pending rulemaking as soon as possible. However, the six-month extension should provide HHS with a period sufficient to avoid another extension, should unexpected circumstances delay the regulatory development process.

The Administrative Procedure Act generally requires agencies to provide advance notice and an opportunity to comment on agency rulemakings. However, there are certain exceptions to this requirement. As the preamble to the April 17, 2003 interim final rule explained, subpart B sets out—

The procedures for provision by the agency of the statutorily required notice and hearing and procedures for issuing administrative subpoenas. Such provisions are exempted from the requirement for notice-and-comment rulemaking under the “rules of agency * * * procedure, or practice” exemption at 5 U.S.C. 553(b)(3)(A).

68 FR 18897. Since this regulatory action does no more than extend the effectiveness of a rule that itself was not required to be issued through notice-and-comment rulemaking, the extension of the rule likewise comes within the exemption of 5 U.S.C. 553(b)(3)(A). Accordingly, we do not request comment on the extension.

We have also determined that good cause exists to waive the requirement of publication 30 days in advance of the rule's effective date under 5 U.S.C. 553(d)(3). Since subpart E is already in effect, no useful purpose would be served in delaying the effective date of this action, as those entities who are subject to subpart E are already on notice of its terms. Making this extension effective on less than 30 days notice accordingly will not impose a burden upon anyone. In addition, to the extent that a delayed effective date occasioned a hiatus in the effectiveness of subpart E, it could cause the confusion that the extension seeks to avoid. Accordingly, we find good cause under 5 U.S.C. 553(d)(3) for not delaying the effective date of this action.

B. Review Under Procedural Statutes and Executive Orders

We have reviewed this final rule under the following statutes and executive orders governing rulemaking procedures: The Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1501 et seq.; the Regulatory Flexibility Act, 5 U.S.C. 601 et seq.; the Small Business Regulatory Enforcement Fairness Act of 1996, 5 U.S.C. 801 et seq.; the Paperwork Reduction Act, 44 U.S.C. 3501 et seq. Executive Order 12866 (Regulatory Planning and Review), as amended by Executive Order 13258; and Executive Order 13132 (Federalism). Since this rule merely extends the expiration date of subpart E, the information in the compliance statements that we published on April 17, 2003 with the existing rule continues to apply.

List of Subjects in 45 CFR Part 160

• Administrative practice and procedure
• Computer technology
• Electronic transactions
• Employer benefit plan
• Health
• Health care
• Health facilities
• Health insurance
• Health records
• Hospitals
• Investigations
• Medicaid
• Medical research
• Medicare
• Penalties
• Privacy
• Reporting and record keeping requirements
• Security

Dated: September 7, 2005.

Michael O. Leavitt,

Secretary.