04-20842. Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings-Extension of Expiration Date

AGENCY:

Office of the Secretary, HHS.

ACTION:

Final rule.

SUMMARY:

An interim final rule establishing procedures for the imposition, by the Secretary of Health and Human Services, of civil money penalties on entities that violate standards adopted by the Secretary under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was published on April 17, 2003. The interim final rule expires on September 16, 2004. This regulatory action extends the expiration date one year to avoid the disruption of ongoing enforcement actions while HHS proceeds with rulemaking to develop a more comprehensive enforcement rule.

DATES:

Effective September 15, 2004, the expiration date of 45 CFR part 160, subpart E is extended from September 16, 2004, to September 16, 2005.

FOR FURTHER INFORMATION CONTACT:

Karen Shaw, [phone].

SUPPLEMENTARY INFORMATION:

I. Background

On April 17, 2003, the Secretary of Health and Human Services published an interim final rule with request for comments. 68 FR 18895. The interim final rule adopted rules of procedure for the imposition by the Department of Health and Human Services (HHS) of civil money penalties on entities that violate standards and requirements adopted by HHS under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191. These rules are codified at 45 CFR part 160, subpart E (subpart E).

As corrected at 68 FR 22453 (April 28, 2003), subpart E expires on September 16, 2004. HHS intends to propose in the near future a rule to establish complete procedural and substantive provisions for the enforcement of the HIPAA rules through the imposition of civil money penalties. The final rule that will result from this forthcoming rulemaking will supersede subpart E. However, as additional time is needed to complete the rulemaking, HHS has decided to extend the expiration date of subpart E from September 16, 2004 to September 16, 2005.

II. Comments on Subpart E

The April 17, 2003 interim final rule requested comment, and HHS received 19 public comments during the public comment period. We will describe and respond to those comments in the preamble to the forthcoming proposed rule.

III. Procedural Requirements

A. Determination To Issue Final Rule Extending Expiration Date Without Notice and Comment, To Be Effective in Less Than 30 Days

As noted, HHS expects to propose a rule to amend subpart E in the near future. However, this forthcoming rulemaking will not be completed by September 16, 2004, when the interim final rule that adopted subpart E is scheduled to expire. The resulting hiatus in the procedures for civil money penalty enforcement actions could create confusion for both the public and HHS with respect to enforcement during this period. Thus, HHS hereby extends the expiration date of subpart E by one year. This action is being taken under HHS's authority at 42 U.S.C. 1302(a) and 1320d-6.

Notwithstanding this extension, HHS fully expects to issue the final rule that will result from the forthcoming rulemaking as soon as possible rather than at or near the new September 16, 2005 expiration date. However, a one-year extension should provide HHS with a period sufficient to avoid another extension, should unexpected circumstances delay the regulatory development process.

The Administrative Procedure Act generally requires agencies to provide advance notice and an opportunity to comment on agency rulemakings. However, there are certain exceptions to this requirement. As the preamble to the April 17, 2003 interim final rule explained, subpart E sets out—

the procedures for provision by the agency of the statutorily required notice and hearing and procedures for issuing administrative subpoenas. Such provisions are exempted from the requirement for notice-and-comment rulemaking under the “rules of agency * * * procedure, or practice” exemption at 5 U.S.C. 553(b)(3)(A).

68 FR 18897. Since this regulatory action does no more than extend the effectiveness of a rule that itself was not required to be issued through notice-and-comment rulemaking, the extension of the rule likewise comes within the exemption of 5 U.S.C. 553(b)(3)(A). Accordingly, we do not request comment on the extension.

We have also determined that good cause exists to waive the requirement of publication 30 days in advance of the rule's effective date under 5 U.S.C. 553(d)(3). Since subpart E is already in effect, no useful purpose would be served in delaying the effective date of this action, as those entities who are subject to subpart E are already on notice of its terms. Making this extension effective on less than 30 days notice accordingly will not impose a burden upon anyone. In addition, to the extent that a delayed effective date occasioned a hiatus in the effectiveness of subpart E, it could cause the confusion that the extension seeks to avoid. Accordingly, we find good cause under 5 U.S.C. 553(d)(3) for not delaying the effective date of this action.

B. Review Under Procedural Statutes and Executive Orders

We have reviewed this final rule under the following statutes and executive orders governing rulemaking procedures: the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1501 et seq.; the Regulatory Flexibility Act, 5 U.S.C. 601 et seq.; the Small Business Regulatory Enforcement Fairness Act of 1996, 5 U.S.C. 801 et seq.; the Paperwork Reduction Act, 44 U.S.C. 3501 et seq.; Executive Order 12866 (Regulatory Planning and Review), as amended by Executive Order 13258; and Executive Order 13132 (Federalism). Since this rule merely extends the expiration date of subpart E, the information in the compliance statements that we published on April 17, 2003 with the existing rule continues to apply.

List of Subjects in 45 CFR Part 160

• Administrative practice and procedure
• Computer technology
• Electronic transactions
• Employer benefit plan
• Health
• Health care
• Health facilities
• Health insurance
• Health records
• Hospitals
• Investigations
• Medicaid
• Medical research
• Medicare
• Penalties
• Privacy
• Reporting and record keeping requirements
• Security

Dated: August 6, 2004.

Tommy G. Thompson,

Secretary.