[Federal Register Volume 64, Number 161 (Friday, August 20, 1999)]
[Rules and Regulations]
[Pages 45786-45807]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 99-21662]
[[Page 45785]]
_______________________________________________________________________
Part VI
Department of Health and Human Services
_______________________________________________________________________
Health Care Financing Administration
_______________________________________________________________________
45 CFR Parts 144, 146, 148, and 150
Federal Enforcement in Group and Individual Health Insurance Markets;
Interim Rule
Federal Register / Vol. 64, No. 161 / Friday, August 20, 1999 / Rules
and Regulations
[[Page 45786]]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Health Care Financing Administration
45 CFR Parts 144, 146, 148, and 150
[HCFA-2019-IFC]
RIN 0938-AJ48
Federal Enforcement in Group and Individual Health Insurance
Markets
AGENCY: Health Care Financing Administration (HCFA), HHS.
ACTION: Interim final rule with comment period.
-----------------------------------------------------------------------
SUMMARY: This interim final rule with comment period details procedures
for enforcing title XXVII of the Public Health Service Act as added by
the Health Insurance Portability and Accountability Act of 1996, and as
amended by the Mental Health Parity Act of 1996, the Newborns' and
Mothers' Health Protection Act of 1996, and the Women's Health and
Cancer Rights Act of 1998, in States that do not enact the legislation
necessary to enforce or otherwise do not substantially enforce the
requirements of these acts. This regulation also delineates the process
for taking enforcement actions against non-Federal governmental plans
and, in those States in which HCFA is directly enforcing the
requirements of these acts, health insurance issuers that are not
complying with those requirements.
DATES: Effective date: September 20, 1999. Comments will be considered
if we receive them at the appropriate address, as provided below, no
later than 5 p.m. on October 19, 1999.
ADDRESSES: Mail written comments (1 original and 3 copies) to the
following address:
Health Care Financing Administration, Department of Health and Human
Services, Attention: HCFA-2019-IFC, P.O. Box 9016, Baltimore, MD 21244-
9016.
If you prefer, you may deliver your written comments (1 original
and 3 copies) to one of the following addresses:
Room 309-G, Hubert H. Humphrey Building, 200 Independence Avenue, SW.,
Washington, DC,
or
Room C5-16-03, 7500 Security Boulevard, Baltimore, MD
FOR FURTHER INFORMATION CONTACT: Rochelle Shevitz, (410) 786-1565.
SUPPLEMENTARY INFORMATION:
Comments, Procedures, and Availability of Copies
Because of staff and resource limitations, we cannot accept
comments by facsimile (FAX) transmission. In commenting, please refer
to file code HCFA-2019-IFC. Comments received timely will be available
for public inspection as they are received, generally beginning
approximately 3 weeks after publication of a document, in Room 443-G of
the Department's office at 200 Independence Avenue, SW., Washington,
DC, on Monday through Friday of each week from 8:30 to 5 p.m. (phone:
(202) 690-7890).
Copies: To order copies of the Federal Register containing this
document, send your request to: New Orders, Superintendent of
Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date
of the issue requested and enclose a check or money order payable to
the Superintendent of Documents, or enclose your Visa or Master Card
number and expiration date. Credit card orders can also be placed by
calling the order desk at (202) 512-1800 or by faxing to (202) 512-
2250. The cost for each copy is $8. As an alternative, you can view and
photocopy the Federal Register document at most libraries designated as
Federal Depository Libraries and at many other public and academic
libraries throughout the country that receive the Federal Register.
I. Background
Title I of the Health Insurance Portability and Accountability Act
of 1996 (HIPAA) created a new title XXVII of the Public Health Service
(PHS) Act (42 U.S.C. 300gg, et seq.) that requires group health plans
and health insurance issuers to provide certain guarantees for
availability and renewability of health coverage in the group and
individual health insurance markets. 1
---------------------------------------------------------------------------
\1\ HIPAA created a series of parallel provisions that were
placed in the Employee Retirement Security Act (ERISA), which is
within the jurisdiction of the Department of Labor; the Public
Health Service Act (PHS), which is within the jurisdiction of the
Department of Health and Human Services; and the Internal Revenue
Code, which is within the jurisdiction of the Department of the
Treasury. These ``shared provisions'' set forth Federal requirements
relating to portability, access, and renewability of group health
plans and group health insurance coverage provided by issuers.
Specifically, the shared provisions contain rules limiting the use
of preexisting condition exclusion periods, and prohibiting
discrimination against participants and beneficiaries based on
health status.
Section 104 of Title I of HIPAA requires that the three
departments ensure through an interagency memorandum of
understanding (MOU) that regulations, rulings and interpretations
issued by each of the departments relating to the same matter over
which two or more departments have jurisdiction, are administered so
as to have the same effect at all times. Section 104 also requires
the departments, through the MOU, to provide for coordination of
policies relating to enforcement of the same requirements in order
to have a coordinated enforcement strategy that avoids duplication
of enforcement efforts and assigns priorities in enforcement. The
three departments recently signed the MOU.
HIPAA also added certain provisions governing insurance in the
group and individual markets, and with respect to non-Federal
government plans which are contained only in the Public Health
Service Act and thus are not within the regulatory jurisdiction of
the Department of Labor or the Department of the Treasury. Section
101(b) of HIPAA provides that the Department of Labor is not
authorized to enforce any of the portability requirements of part 7
of ERISA (the ``shared'' provisions) against a health insurance
issuer offering health insurance coverage in connection with a group
health plan, although individuals covered under ERISA can bring
suit. Also, governmental plans, as defined in section 3(32) are
exempt from ERISA, under section 4(1) of ERISA. Thus the scope of
the MOU is limited, with respect to coordination of enforcement
activities, to enforcement of shared provisions. Enforcement of
these provisions constitutes only a relatively small portion of
HCFA's responsibilities.
---------------------------------------------------------------------------
The Newborns' and Mothers' Health Protection Act of 1996 amended
the PHS Act to provide protections for mothers and their newborn
children with regard to the length of hospital stay following
childbirth. The Mental Health Parity Act of 1996 further amended title
XXVII of the PHS Act to provide for parity in the application of
certain annual and lifetime dollar limits on mental health benefits
with annual and lifetime dollar limits on medical/surgical benefits.
The Women's Health and Cancer Rights Act of 1998 amended the PHS Act to
provide certain protections for patients who elect breast
reconstruction in connection with a mastectomy (As used hereafter in
this preamble, HIPAA refers to title XXVII of the PHS Act, as added by
the Health Insurance Portability and Accountability Act of 1996, and
later amended by the Mental Health Parity Act of 1996, the Newborns'
and Mothers' Health Protection Act, and the Women's Health and Cancer
Rights Act of 1998.)
HIPAA added two preemption provisions to the PHS Act. With respect
to HIPAA's preexisting condition exclusions rules and special
enrollment rights contained in section 2701 of the PHS Act, State law
cannot differ in any way from the Federal requirements, except to
expand the protections in one of several ways specifically permitted by
the statute (See section 2723(b). With respect to HIPAA's other
requirements, for example, HIPAA's non-discrimination provisions, State
laws are preempted only to the extent they prevent the application of
any requirement of HIPAA. (See section 2723(a)).
[[Page 45787]]
HIPAA affirms that the States are the primary regulators of health
insurance coverage in each State. However, in the event that a State
either does not enact legislation that meets or exceeds the Federal
health insurance requirements, if it or otherwise fails to
substantially enforce the HIPAA standards, the Health Care Financing
Administration (HCFA) enforces the HIPAA requirements that apply to
health insurance issuers offering coverage within that State.
HCFA is also responsible for enforcing the HIPAA requirements with
respect to non-Federal governmental plans. Non-Federal governmental
plans that are not provided through health insurance coverage may elect
exemption from one or more requirements of HIPAA, but must comply with
requirements regarding certification and disclosure of creditable
coverage.
II. Provisions of the Proposed Regulations
Subpart A--General Provisions
Section 150.101 Basis and Scope
On April 8, 1997, we published regulations to implement HIPAA by
adding 45 CFR parts 144, 146, and 148. The enforcement provisions of
that rule are contained in Secs. 146.184, 148.200, and 148.202. Now
that HCFA has had experience with direct Federal enforcement in some
States, we have determined that it is necessary to provide more detail
on the procedures that will be used to enforce HIPAA when a State does
not do so. We are adding a new part that will revise and expand the
provisions contained in Secs. 146.184, 148.200, and 148.202. Those
sections are deleted.
This new part, 45 CFR part 150, consists of four subparts. Subpart
A explains the scope and basis of this regulation and presents
definitions that supplement definitions located in 45 CFR 144.103 and
148.103. Subpart B describes how HCFA determines whether to assume
enforcement authority in a State and explains the process for
transferring such authority back to the State. Subpart C describes
procedures for assessing civil money penalties. Examples of specific
situations that may trigger the assessment are listed in Appendix A to
Subpart C. Subpart D describes the administrative appeals process.
Section 150.103 Definitions
In order to convey the requirements of 45 CFR part 150, we are
defining a number of terms that will be found at 45 CFR 150.103. Terms
found at 45 CFR part 150 have the same meaning given to them in 45 CFR
144.103 and 148.103, unless otherwise indicated. Section 150.103 will
include definitions of the following terms: amendment, endorsement or
rider; application; certificate of insurance; complaint; group health
insurance policy or group policy; individual health insurance policy or
individual policy; plan document; and State law.
Subpart B--HCFA Enforcement Processes for Determining Whether States
Are Failing To Substantially Enforce HIPAA Requirements
This subpart describes the steps we will take to determine whether
a State is failing to substantially enforce HIPAA requirements and the
notification procedures we will follow prior to beginning direct
enforcement.
Section 150.201 State Enforcement
HIPAA affirmed the States' role as the primary regulator of health
insurance in each State. Consistent with HIPAA, Sec. 150.201 will state
that, except as provided in subpart B, each State enforces HIPAA
requirements with respect to health insurance issuers that issue, sell,
renew, or offer health insurance coverage in the State.
Section 150.203 Circumstances Requiring HCFA Enforcement
Federal enforcement is triggered in two instances: (1) A State
notifies us that it has not enacted the necessary legislation to bring
its laws into compliance with HIPAA requirements or that it is
otherwise not substantially enforcing those requirements; or (2) a
State does not notify us of its failure to substantially enforce HIPAA
requirements, but we receive or obtain information that forms the basis
for HCFA's determination that such a failure is occurring. When we
receive such notification or make such a determination, we will discuss
with State officials the requirements that are not substantially
enforced and begin Federal enforcement of those requirements.
With regard to the group health insurance market, section
2722(a)(2) of the PHS Act requires Federal enforcement of any
``provision (or provisions)'' that a State fails to substantially
enforce. Therefore, it is possible that a State could enforce some
group market provisions while HCFA enforces others.
With regard to the individual market, section 2761(a)(2) of the PHS
Act calls for Federal enforcement of the ``requirements of this part''
whenever a State fails to substantially enforce them. However, HCFA
does not enforce those State laws that constitute an ``acceptable
alternative mechanism'' (as defined in Sec. 148.128) for enforcing
guaranteed availability regulations. In addition, HIPAA does not
preempt State laws that afford greater protections to HIPAA-eligible
individuals than HIPAA without preventing the application of a HIPAA
requirement. Thus, in the individual market, it is also possible that
HCFA will enforce some requirements while the State enforces others.
The complexity of the situation varies from one State to another and
requires careful consideration on a case-by-case basis.
Section 150.205 Sources of Information Triggering an Investigation of
State Enforcement
The interim final regulations provide more specific guidance on
situations in which there is no formal complaint, but other information
indicates that a State's failure to substantially enforce may exist.
Information regarding an alleged failure to enforce may come from a
variety of sources, including, but not limited to--
A complaint;
Informal contacts with State officials;
Communication with other individuals, such as brokers and
agents, or consumers themselves; and
Reports in the news media.
When we receive information indicating that a failure to
substantially enforce might exist in a particular State, we will write
to the governor and the commissioner of insurance or chief insurance
regulatory official of that State (and/or the official responsible for
regulating HMOs if the alleged failure involves HMOs) to inquire about
the status of HIPAA enforcement in the State. Further action on our
part will be dictated by the nature of the State's answer. If a State
informs us that it is enforcing all of the requirements of HIPAA and
provides a satisfactory explanation of why there is no failure, we will
take no further action unless there are further indications to
contradict the State's assertion.
Sections 150.207-150.219 Procedure for Determining That a State Fails
to Substantially Enforce HIPAA Requirements
If we receive a complaint indicating that a State is failing to
substantially enforce the law, we will first make a preliminary
assessment of whether the complainant who is adversely affected has
made a reasonable effort to resolve the issue through any remedies
available under State law (Sec. 150.209). We will contact the
complainant to
[[Page 45788]]
determine actions already taken, including whether State officials have
been notified and what action, if any, those officials have taken. We
may also contact State officials informally to discuss the situation.
If we receive information other than an individual complaint, we will
initiate similar contact with State officials.
In accordance with Sec. 150.211, we will send a written notice to
the State if we find that there is a reasonable question as to whether
the State is failing to substantially enforce HIPAA requirements. The
notice will be addressed to--
(1) The governor or chief executive officer of the State;
(2) The insurance commissioner or chief insurance regulatory
official; and
(3) If the alleged failure involves HMOs, the official responsible
for regulating HMOs if different from the individual identified in (2).
Under Sec. 150.213, the notice to the State will identify the
requirement or requirements of HIPAA for which there is evidence of a
potential failure to enforce and will describe the facts of any alleged
violation by an issuer or the ways in which the State law fails to
acceptably implement HIPAA. The letter will further explain that the
consequence of a State's failure to substantially enforce those
requirements is that HCFA will do so. The notice will give the State 30
days to respond unless an extension is granted.
In the interim final regulations published on April 8, 1997, a
response time of 45 days was allowed. This regulation shortens the
response time to 30 days to lessen any adverse impact on consumers.
This shorter response time appears to balance the States' prerogative
to enact and enforce their own insurance laws with the consumer rights
and protections that the Congress intended to guarantee when it enacted
HIPAA. We invite comment on this change.
We may extend the 30-day response period for good cause at a
State's request (see Sec. 150.215). The length of the extension period
granted may vary depending upon the specific circumstances of the
situation; thus, the regulation does not set forth a prescribed
extension period. Extensions will be granted based upon the
circumstances, and at our discretion.
Example: The State replies to our notice by stating that some State
regulators had been unclear on the scope of their new responsibilities.
Having recognized the problem, the State plans to train all affected
regulatory staff as quickly as possible. However, it is unlikely that
the State will be able to assure us within 30 days that full HIPAA
enforcement is taking place. Therefore, the State requests an extension
until staff training is completed.
If, at the end of 30 days (and any extension), the State does not
establish to our satisfaction that it is substantially enforcing the
requirements described in the notice, we may, after further
consultation with the appropriate State officials or their designees,
send the State a notice of preliminary determination (see
Sec. 150.217). The notice of preliminary determination will specify the
HIPAA requirements that the State has failed to substantially enforce.
The notice will afford the State a reasonable opportunity to present
evidence of substantial enforcement.
We will allow the State a reasonable opportunity--normally, 30
days--to correct its failure to substantially enforce the requirements
identified in the preliminary determination. However, in accordance
with Sec. 150.219, if we find that the State has not taken the
necessary corrective action, we will issue a final written
determination. The final determination will identify the HIPAA
requirements that HCFA is enforcing. The notice will also specify the
effective date of HCFA's enforcement. This date may be retroactive to
apply so that civil monetary penalties, that HCFA later assesses, may
take into account violations that occurred after the effective dates
specified in HIPAA or a date that HCFA identifies as the point at which
the State's failure to substantially enforce the specified requirements
commenced. HCFA does not enforce a State law that was enacted as an
alternative mechanism. However, in the case of a State that is found
not to be implementing its acceptable alternative mechanism, and also
is found not to be substantially enforcing the Federal fallback
regulations on guaranteed availability, HCFA will enforce the HIPAA
requirements as of the date that HCFA determines that the State has
failed to enforce. HCFA does not enforce a State law that was enacted
as an alternative mechanism.
In cases where HCFA assumes enforcement responsibility in a State,
the transition to Federal enforcement should be as smooth as possible
in order to protect consumers and create as little disruption as
possible for health insurance issuers.
Section 150.221 Transition to State Enforcement
When the State demonstrates that it is prepared to undertake
substantial enforcement and if and when we determine that
responsibility for enforcement should be returned to the State, we will
enter into discussions with State officials to ensure that a smooth
transition back to State enforcement is effected, especially with
respect to the handling of consumer inquiries and complaints. To the
extent practicable and legally permissible, we will make available to
the State our records documenting issuer compliance, as well as other
relevant areas of our enforcement operations, for incorporation into
the records of the regulatory authority assuming jurisdiction. We
invite comments on the transition procedures described in this
subsection.
Subpart C--HCFA Enforcement With Respect to Issuers and Non-Federal
Governmental Plans--Civil Money Penalties
This subpart describes the bases for imposing civil money penalties
against non-Federal governmental plans, and, in those States in which
we are enforcing the HIPAA requirements, against health insurance
issuers that are not complying with the requirements of HIPAA.
The basis for our enforcement actions are the requirements of 45
CFR parts 146 and 148 as set forth in the interim final rules published
on April 8, 1997 in the Federal Register, as well as the rules
published on December 22, 1997 (implementing the Mental Health Parity
Act of 1996) and October 27, 1998 (implementing the Newborns' and
Mothers' Health Protection Act of 1996), and the requirements in
sections 2706 and 2752 of the PHS Act (relating to the Women's Health
and Cancer Rights Act of 1998). Those rules explain practices to which
issuers and non-Federal governmental plans are required to adhere.
However, since publication of the April 8, 1997 rules, we have become
aware of actions taken by issuers and other responsible entities that
are inconsistent with several requirements of HIPAA but are not
specifically addressed in the rules. We addressed some of these actions
in Bulletin 98-01, discussed below. In an appendix to Subpart C we
provide a list of business practices or situations, including those
listed in the bulletin, that violate HIPAA and may trigger enforcement
action. This list is not all-inclusive. Rather, it highlights the
compliance problems that we have encountered most frequently.
This subpart establishes an enforcement process that ensures the
rights of individuals protected by HIPAA and provides for due
consideration toward health insurance issuers and non-Federal
governmental plans. This subpart explains the process
[[Page 45789]]
for investigating complaints to determine whether a violation has
occurred, and, when necessary, the process for assessing a civil money
penalty. In addition, this subpart provides suggestions to issuers and
other responsible entities of possible ways to avoid civil money
penalties through early identification of compliance problems.
Section 150.301 General Rule Regarding the Imposition of Civil Money
Penalties
Section 150.301 states that any health insurance issuer or non-
Federal governmental plan, or employer that sponsors a non-federal
government plan, subject to our enforcement authority that fails to
comply with HIPAA may be subject to a civil money penalty as described
in this subpart.
Section 150.303 Information Initiating Administrative Action or
Investigation
In accordance with Sec. 150.303, any individual or any entity
acting on his or her behalf may request that we investigate the
possible denial or abridgement of a HIPAA right. Complaints may be
directed to any of our regional offices where the complaint will be
either investigated or forwarded to the appropriate office for
investigation. Information about all complaints received will be
accessible to all HCFA staff involved in HIPAA enforcement in both the
central and regional offices.
Since many individuals protected by HIPAA will not initiate
complaints because they are unaware of their rights under the law and
therefore do not realize when their rights are being denied or
abridged, HCFA will consider other information when determining whether
a State is substantially enforcing HIPAA or when determining the
compliance of an issuer or other responsible entity as defined in
Sec. 150.305 (Determination of entity liable for civil money penalty).
Essentially, ``other information'' means any information HCFA receives
from any source that indicates that a potential violation of HIPAA has
been committed by a health insurance issuer or other responsible
entity. Other information includes any other indication that an issuer
or non-Federal governmental plan fails to meet any requirement of
HIPAA. Sources of information that we may rely upon include, but are
not limited to:
Reports and information collected from State insurance
departments, the National Association of Insurance Commissioners, and
other State, local, and Federal entities;
Information received through HCFA's enforcement activities
and from other sources that may include policy form review and market
conduct examinations.
Section 150.305 Determination of Entity Liable for Civil Money Penalty
Health insurance issuers that issue, sell, renew, or offer coverage
to either private employers that sponsor group health plans or to non-
Federal governmental plan sponsors are responsible for compliance with
HIPAA and applicable implementing regulations at 45 CFR part 146.
Under Sec. 150.305, we consider a health insurance issuer to be
subject to a civil money penalty if a group health insurance policy it
sells is written, serviced, or administered in a manner that fails to
comply with, or conflicts with, an applicable requirement of HIPAA. To
the extent that a group health plan is subject to HIPAA, a health
insurance issuer may be liable for the penalty even if a group health
plan sponsor had expressly requested that the issuer provide a policy
that does not comply with one or more requirements of HIPAA. In that
situation, the issuer should inform the plan sponsor that it would be
illegal to sell such a policy and refuse to structure the policy as
requested. With regard to health insurance sold in the individual
market, the issuer is the responsible entity and therefore liable for
any assessed civil money penalty. To the extent that policies sold in
the individual market are subject to the requirements of HIPAA, issuers
are responsible for ensuring that their policies comply and are
marketed and administered in accordance with those requirements and
applicable implementing regulations at 45 CFR Part 148. In addition,
when a policy does not comply with applicable HIPAA requirements, the
issuer may be subject to a civil money penalty irrespective of whether
the issuer sold the policy directly, or a broker or agent sold the
policy on the issuer's behalf.
Under section 2722(b)(1)(B) of the PHS Act, we have direct
enforcement authority with respect to group health plans that are non-
Federal governmental plans. A non-Federal governmental plan sponsored
by one or multiple non-Federal governmental entities is subject to
HIPAA to the same extent as any other group health plan, unless, in the
case of a non-Federal governmental plan that is not provided through
health insurance coverage, the plan sponsor(s) has (have) elected to
exempt the plan from one or more HIPAA provisions (as permitted under
45 CFR 146.180, and section 2721(b)(2) of the PHS Act).
When the sponsor of a non-Federal governmental plan does not elect
to have its plan exempted from one or more HIPAA requirements and the
plan fails to comply with one or more applicable provisions of HIPAA,
we enforce the law, and either the plan or the non-Federal governmental
employer sponsoring the plan is subject to a civil money penalty. In
accordance with section 2722(b)(2)(B) of the PHS Act, if the plan is
sponsored by a single non-Federal governmental employer, the non-
Federal governmental employer is subject to the penalty; if the plan is
sponsored by two or more non-Federal governmental employers, the plan
is subject to the penalty.
Separate civil money penalties may be assessed against an issuer
and a non-Federal governmental plan or employer, depending upon the
circumstances of the compliance failure(s). A civil money penalty, or
penalties, will be determined in accordance with sections 150.317
through 150.325.
Section 150.307 Notice to Responsible Entities
Under Sec. 150.307, when we receive a complaint or other
information indicating a possible violation of HIPAA, we will provide
written notice to the responsible entity(ies) that describes the
substance of the complaint or other information and any identifiable
actions that need to be taken to come into compliance. The notice will
also provide the responsible entities 30 days from the date of the
notice in which to respond. Furthermore, the notice will state that a
civil money penalty may be imposed if the entity fails to comply.
Section 150.309 Request for Extension
Section 150.309 will allow issuers and other responsible entities
to request an extension of time to respond to the notice. We will
consider granting the request provided:
(1) The request for the extension is made in writing;
(2) The issuer or other responsible entity can show good cause; and
(3) A complete response can be provided within the additional time
granted by HCFA.
This section, which allows for additional time, will benefit both
issuers and other responsible entities that are unable to respond to an
inquiry from us within 30 days regarding a potential HIPAA violation.
Failure to respond to a notice from HCFA within 30 days, or any
extended time frame, may result in the assessment of a civil money
penalty based upon the complaint or other information. This section
reflects HCFA's interest in ensuring complete responses. However, in
deciding
[[Page 45790]]
whether to grant the extension, HCFA will also consider the facts and
circumstances of the situation to assure thet individuals are not
adversely affected.
Section 150.311 Responses to Allegations of Noncompliance
Section 150.311 will state that in determining whether to assess a
civil money penalty and the amount of any such penalty, HCFA will
consider documentation provided by an issuer or other responsible
entity. If documentation substantiates that the violation was corrected
within 30 days of the first day that the responsible entity knew, or
exercising reasonable diligence, could have known of the violation,
then no civil money penalty may be imposed (see Sec. 150.341). However,
if the correction is made beyond the 30 days, we will review all
documentation supporting a responsible entity's efforts to comply with
HIPAA and, under appropriate circumstances, take such efforts into
account in our calculation of the amount of the penalty. In general, we
view more favorably responses where the rights and protections afforded
consumers are quickly and completely restored, and where the issuer or
other responsible entity can demonstrate that adequate changes have
been made to ensure future compliance.
Examples of documentation that may be included in a response
include:
Relevant policy forms, advertising material, and other
documents
Other evidence refuting the alleged noncompliance
Evidence showing the approximate cost to the affected
individual(s)
Evidence showing the number of individuals affected
Evidence that the entity did not know, or exercising due
diligence would not have known, of the violation
Documentation proving that issued policies and/or
certificates of coverage and plan documents were amended to comply with
HIPAA and showing the date of such amendment
Documentation of the issuance of forms that comply with
HIPAA (with respect to any forms that were submitted and reviewed by
us, such documentation may also include any final letter from us that
closed the review)
Evidence documenting the development and implementation of
internal policies and procedures to ensure HIPAA compliance (including
corporate compliance programs)
Other evidence showing the entity's prior record of HIPAA
compliance
Section 150.313 Market Conduct Examinations
In 1974 the National Association of Insurance Commissioners
recommended the establishment of a ``separate and distinct'' program of
surveillance to ensure fair treatment of insurance policyholders. Since
then, these surveillance programs, known as ``market conduct
examinations,'' have been an essential tool used by State insurance
departments to confirm the compliance of issuers with various State
insurance laws and regulations.
Market conduct examinations differ from traditional financial
audits performed on issuers by either regulators or the companies
themselves. While financial audits are primarily concerned with the
financial solvency of a company, market conduct examinations are
primarily concerned with the issuer's compliance with legal
requirements because the issuer's business practices impact consumers
directly. For example, while an issuer may be judged financially strong
through a financial audit, if this financial strength is obtained
through non-compliant claim denials, the issuer could ``pass'' a
financial audit, while ``failing'' a market conduct examination.
Pursuant to guidelines of the National Association of Insurance
Commissioners and State insurance laws, State insurance departments
charge the expenses of a market conduct examination directly to the
issuer. In contrast, HCFA will not require an issuer or other
responsible entity to bear the expense of a market conduct examination.
During a HCFA market conduct examination, HCFA will sample and, in some
cases, review in their entirety specific records, information, and
other documentation maintained by the issuer or other responsible
entity to determine compliance with the specific requirements of HIPAA.
HCFA market conduct examinations will differ from traditional State
insurance department examinations in that the scope of HCFA's reviews
will be much narrower, focusing on the provisions and requirements of
HIPAA.
For example, areas of HCFA examinations may include, but are not
limited to:
The issuer's, or non-Federal governmental plan's
certificate of creditable coverage issuance procedures and practices;
Claim denials based on pre-existing condition exclusion
provisions of the issuer's, or the non-Federal governmental plans;
The issuance of guaranteed available individual and small
employer group products; or
The guaranteed renewability of health insurance policies.
A market conduct examination may be performed at HCFA's initiation,
or upon request of a potential responsible entity. During the course of
a complaint investigation, HCFA may determine that a pattern of
noncompliance exists to warrant a market conduct examination. An
issuer, or a non-Federal governmental plan, may request a market
conduct examination to confirm compliance or to identify potential
violations and initiate corrective action that may enable it to
completely avoid imposition of a civil money penalty under Sec. 150.315
of this subpart. If we identify potential violations, we will provide
notice to the issuer or other responsible entity of such defects and
may present a proposed plan of correction.
A market conduct examination may be performed through either on-
site examinations, when appropriate; or ``in-house'' examinations or
``desk audits'' at a HCFA location. In general, on-site examinations
are appropriate when we have reason to believe that, in order to obtain
and have ready access to all of the information necessary to identify
existing failures to comply with HIPAA or confirm the compliance of an
issuer, or a non-Federal governmental plan, it is necessary for our
examiners to be at a responsible entity's site. On-site examinations
may also be appropriate when the market share of an issuer represents a
significant portion of the marketplace in a State or when an issuer's
entire program for HIPAA compliance is the subject of the examination.
In general, a ``desk audit'' is sufficient to confirm a responsible
entity's compliance with regard to a specific area(s) of compliance or
when circumstances make an on-site examination impracticable.
When HCFA identifies an issue that warrants investigation, HCFA
will appoint one or more examiners to perform the examination and
instruct them as to the scope of the examination. HCFA will observe the
guidelines adopted by the NAIC and may employ additional guidelines as
deemed appropriate. Upon completion of the market conduct examination,
HCFA will develop a report that will address the results of the
examination. Responsible entities will be advised of HCFA's position on
each issue contained in the report. The purpose of the report is to
identify areas of the business or operational affairs of the
responsible entity that may need to be corrected.
[[Page 45791]]
Sections 150.315 Through 150.323 Provisions Relating to the Amount of
Penalty
These sections of the regulation establish the process for
determining the amount of any penalty that is imposed on a responsible
entity for a violation of a provision or requirement of HIPAA. The
statute allows for a penalty that does not exceed $100 for each day for
each individual with respect to each violation. The statute further
requires at section 2722 that, in determining the amount of the
penalty, the responsible entity's previous record of compliance as well
as the gravity of the violation be taken into consideration. Therefore,
in determining the amount of the penalty, we intend to use a process
that takes into account both mitigating and aggravating circumstances.
We will take into account evidence of the entity's efforts to comply
with HIPAA in assessing the entity's previous record of compliance.
This will be determined largely through documentation submitted by the
responsible entity during the course of the investigation of the
complaint or other information. We will consider the gravity of the
violation by reviewing the frequency of the violation as well as the
level of the financial impact on any affected individuals.
Responsible entities that discover violations are encouraged to
take all necessary steps to correct the violations and identify the
individuals adversely affected and restore their rights. Under
Sec. 150.319, those actions taken by responsible entities to correct
the violations and restore individuals' rights will be considered
mitigating circumstances and will be taken into account to reduce the
penalty or assessment.
Conversely, under Sec. 150.321, we will consider as aggravating
circumstances instances in which violations that appear to be frequent
have resulted in an obvious or significant financial and other impacts
on affected individuals or cannot be adequately corrected. These
parameters will be considered in determining the gravity of the
violation. In determining the appropriate amount of the penalty and
assessment to be imposed, we will take into account all mitigating and
aggravating circumstances outlined by these sections.
Section 150.325 Settlement Authority
This section will state that nothing in Secs. 150.315 through
150.323 limits our authority to settle any issue or case or to reduce
any penalty or assessment.
Section 150.341 Limitations on Penalties
This section explains that HCFA will not impose any civil money
penalty on any failure if the failure was due to reasonable cause and
not due to willful neglect and the failure was corrected within 30 days
of the first day that any of the entities against whom the penalty
would be imposed knew, or exercising reasonable diligence would have
known, that the failure existed. The burden of establishing that the
responsible entity did not know, and exercising reasonable diligence,
could not have known that a failure existed, is on the responsible
entity.
Section 150.343 Notice of Proposed Penalty
This section of the regulation further describes the information to
be disclosed in the written notice of the proposed penalty to the
responsible entity, including instructions to the responsible entity
for responding and an explanation of the entity's right to a hearing if
the responsible entity is appealing the proposed penalty.
Section 150.345 Appeal of Proposed Penalty
We include this section to direct the reader to our appeal
procedures.
Section 150.347 Failure to Request a Hearing
This section of the regulation describes our responsibility to
notify the entity in writing of the assessed penalty and the means by
which to satisfy the judgment following the entity's failure to request
a hearing within the specified period of time.
Appendix A to Subpart C of Part 150--Examples of Violations
This Appendix A includes examples of practices which, if undertaken
by issuers, or non-federal governmental plans, may warrant the
imposition of a civil money penalty. For convenience, the Appendix is
divided into the group and individual markets and the types of
violations are listed in numerical order by regulatory citation number
in each of the two markets.
Subpart D--Administrative Hearings
This subpart describes the processes for administrative hearings
and appeals of civil money penalties.
Sections 150.401 Through 150.463
Sections 150.401 through 150.463 set forth the procedures for
appeal of HCFA's assessment of a civil money penalty. The PHS Act
provides that if a responsible entity appeals HCFA's assessment of a
civil money penalty, the administrative law judge hearing the appeal
makes the initial agency decision.
Although the administrative law judge makes the initial agency
decision, the considerations and factors set forth in this part are
binding on the administrative law judge's decision. The administrative
law judge may not add or disregard such considerations and factors in
deciding whether assessment of a civil money penalty is appropriate,
and the amount of such penalty.
Section 150.457 sets forth the process through which the HCFA
Administrator may vacate or modify the administrative law judge's
decision. Section 150.459 provides that any responsible entity against
whom a final assessment of a civil money penalty is made may appeal
that assessment to the appropriate United States District Court.
Section 150.465 Collection and Use of Penalty Funds
This section describes to whom (HCFA) penalty funds are paid and
how they may be used.
Sections 144.101, 144.102, and 144.103
We are adding provisions to include the new part 150. We are also
revising the definition of ``non-Federal governmental plan'' under
Sec. 144.103 because the existing definition reiterates the definition
in section 2791(d)(8)(C) of the PHS Act. This definition simply states
that the term ``non-Federal governmental plan'' means ``a governmental
plan that is not a Federal governmental plan.'' Section 2791(d)(8)(A)
defines the term ``governmental plan'' as that term is defined under
section 3(32) of ERISA. (Determining whether an entity is a
``governmental plan'' for purposes of section 3(32) of ERISA is within
the jurisdiction of the Department of Labor.) Subparagraphs (B) and (C)
of section 2791(d)(8), respectively, define ``Federal governmental
plan'' and ``non-Federal governmental plan''. ERISA does not separately
define these terms. Section 3(32) of ERISA, in pertinent part, defines
the term ``governmental plan'' as ``a plan established or maintained
for its employees by the Government of the United States, by the
government of any State or political subdivision thereof, or by any
agency or instrumentality of any of the foregoing.'' We have revised
the definition of the term ``non-Federal governmental plan'' by
adopting that portion of the ERISA definition of ``governmental plan''
that defines a non-Federal governmental plan.
[[Page 45792]]
Parts 146 and 148
We are deleting Secs. 146.184, 148.200, and 148.202, as these
provisions are now in part 150.
III. Collection of Information Requirements
Under the Paperwork Reduction Act of 1995, we are required to
provide a 60-day notice in the Federal Register and solicit public
comment before a collection of information is submitted to the Office
of Management and Budget (OMB) for review and approval. This document
does not impose any information collection and record keeping
requirements subject to the Paperwork Reduction Act (PRA).
Consequently, it does not need to be reviewed by the Office of
Management and Budget (OMB) under the authority of the PRA.
IV. Response to Comments
Because of the large number of items of correspondence we normally
receive on Federal Register documents published for comment, we are not
able to acknowledge or respond to them individually. We will consider
all comments we receive by the date and time specified in the DATES
section of this preamble, and, if we proceed with a subsequent
document, we will respond to the major comments in the preamble to that
document.
V. Waiver of Proposed Rulemaking
We ordinarily publish a notice of proposed rulemaking in the
Federal Register and invite public comment on the proposed rule. The
notice of proposed rulemaking includes a reference to the legal
authority under which the rule is proposed, and the terms and
substances of the proposed rule or a description of the subjects and
issues involved. This procedure can be waived, however, if an agency
finds good cause that a notice-and-comment procedure is impracticable,
unnecessary, or contrary to the public interest and incorporates a
statement of the finding and its reasons in the rule issued. We believe
that dispensing with proposed rulemaking is in the public interest.
Proposed rulemaking is also unnecessary. Accordingly, we are proceeding
here directly with an interim final rule.
The basic requirements of this interim final rule already exist in
45 CFR parts 146 and 148. Therefore, we are not adding anything that
will impose new requirements. We do include provisions that will assist
health insurance issuers, and non-Federal governmental plans/employers,
by letting them know what they can do if we impose a civil money
penalty; for example, refute our findings or request a hearing. This
rule will also help individuals whose health insurance coverage is
subject to part 146 or 148 in that we will be better able to enforce
our rules and provide protections to individuals.
Therefore, we find good cause to waive the notice of proposed
rulemaking and to issue this rule as an interim final rule with comment
period. We are, however, providing a 60-day comment period and will
respond to comments we receive in any subsequent Federal Register
document.
VI. Regulatory Impact Statement
A. Overall Impact
We have examined the impacts of this rule as required by Executive
Order 12866 and the Regulatory Flexibility Act (RFA) (Pub. L. 96-354).
Executive Order 12866 directs agencies to assess all costs and benefits
of available regulatory alternatives and, if regulation is necessary,
to select regulatory approaches that maximize net benefits (including
potential economic, environmental, public health and safety effects,
distributive impacts, and equity). A regulatory impact analysis (RIA)
must be prepared for major rules with economically significant effects
($100 million or more annually). A discussion regarding the expected
economic effects of this interim final rule is presented below.
The RFA requires agencies to analyze options for regulatory relief
of small businesses. For purposes of the RFA, small entities include
small businesses and nonprofit organizations. Entities are considered
small either because of nonprofit status or because of having revenues
of $5 million or less annually. For purposes of the RFA, we consider it
unlikely that many health insurance issuers will meet this definition
of small entity. This interim final rule will also affect non-Federal
governmental plans, but these plans do not meet the definition of a
small entity.
Section 202 of the Unfunded Mandates Reform Act of 1995 also
requires that agencies assess anticipated costs and benefits before
issuing any rule that may result in an annual expenditure by State,
local, or tribal governments, in the aggregate, or by the private
sector, of $100 million. Although this interim final rule will affect
State and local governments and health insurance issuers in the private
sector, such impact is expected to be minimal and less than $100
million in the aggregate. Set forth below is a discussion regarding the
expected impact of this interim final rule.
B. Anticipated Effects
The Congress intended that the protections provided in HIPAA be
afforded to all Americans, regardless of whether such protections are
guaranteed by States or the Federal government. These regulations are
intended to expand upon the basic process for Federal enforcement of
HIPAA. Federal enforcement presently exists in California, Missouri and
Rhode Island. We estimate that approximately 325 health insurance
issuers offer health insurance coverage in these States and would
therefore be affected by these regulations. While we recognize that
direct Federal enforcement may become necessary in additional States,
we are unable to predict the number of States or issuers affected in
the future. We expect these regulations to impose a minimal burden on
States, health insurance issuers, and non-Federal governmental plans/
employers but we invite comments from affected parties regarding the
potential or real impact of these regulations.
1. Effects on State and Local Governments
The primary impact of these regulations on States is to clarify the
process by which we determine that Federal enforcement is necessary. As
described in the regulations, which closely follow the statutory
language, we determine that Federal enforcement is necessary when
either a State notifies us of its failure to enact and/or enforce the
necessary legislation; or we receive information or otherwise discover
that a State is not substantially enforcing HIPAA. We are exercising
our regulatory discretion where necessary to ensure that consumers are
protected to the full extent of the law. The impact of our regulatory
discretion with respect to States is discussed below.
These regulations will also affect State and local governments to
the extent that these governments provide health plans to their
employees. These plans, designated as non-Federal governmental plans
under HIPAA, are subject to our direct enforcement, but those that are
self-funded are permitted to elect to be exempt from one or more HIPAA
provisions, with the exception of the requirement that the plan issue
certificates of creditable coverage. The impact of these regulations on
non-Federal governmental plans is discussed below under subsection 2.
These regulations, however, will not affect health plans provided by
tribal governments because such entities are not covered by the PHS Act
and are
[[Page 45793]]
therefore not subject to our direct enforcement.
The interim final regulations published on April 8, 1997 (42 CFR
Parts 144, 146, and 148) address the situation in which we learn of a
State's failure to substantially enforce the HIPAA provisions by a
``complaint or other means.'' These interim final regulations clarify
the scope of the term ``other means'' to include informal contact
between us and State officials, a report in the news media, periodic
communication by us with the States, periodic review of State health
care legislation, or any other information that indicates a substantial
failure to enforce. Since many individuals protected by HIPAA will not
initiate complaints because they are unaware of their rights under the
law and therefore do not realize when their rights are being denied or
abridged, we cannot limit the basis of our investigation solely to
complaints received from individuals. Therefore, we have clarified the
definition of ``other information'' to include other forms of
information so that we will learn about potential HIPAA violations and
if necessary, initiate enforcement action as soon as possible.
If we initiate an inquiry in a particular State, we may begin our
inquiry by informally contacting appropriate State officials. If a
State informs us that it is enforcing all of the HIPAA provisions and
requirements, we will take no further action unless there are further
indications to contradict the State's assertion. If we find that a
State has failed to substantially enforce HIPAA, we will allow the
State a reasonable opportunity to correct such a failure. It is only
when other efforts have failed that we will initiate the formal
determination process in a particular State. Thus, as permitted by
current regulations, while we may initiate an inquiry in a State on
information other than a complaint, these regulations that we are
publishing today will provide flexibility for the State to respond to
the inquiry and will allow the State a reasonable opportunity to
enforce HIPAA.
In the event that we determine that there is a reasonable basis for
finding a State's failure to substantially enforce HIPAA, we will
provide written notice to the chief executive officer of the State and
other appropriate State officials. In the interim final regulations
published on April 8, 1997 a response time of 45 days was allowed. This
regulation shortens the response time to 30 days in order to lessen any
adverse effect on individuals in that particular State. Individuals may
not incur a break in coverage of more than 63 days without losing their
right to HIPAA protections. Our primary concern is that individuals
receive rights to which they are entitled under HIPAA. This shorter
response time appears to strike a balance between the States'
prerogative to regulate health insurance issuers and the rights of
individuals that Congress intended to protect by enacting HIPAA. We
have invited comments on this change.
However, if a State is unable to respond to our inquiry within the
30-day response period, these regulations will allow us to extend the
30-day response period for good cause. We estimate that those States
responding to an inquiry will incur some costs in providing
information, whether orally or in writing, to demonstrate their
enforcement of HIPAA.
These regulations also provide a transition process from Federal
enforcement back to State enforcement if and when HCFA determines that
Federal enforcement is no longer necessary. The impact of these
transitional processes is difficult to estimate at this time. We invite
comments on this process and the possible impacts associated with it.
2. Effects of These Regulations on Non-Federal Governmental Plans
State and local governmental plans may offer health insurance
coverage to their members through an issuer or may self-insure their
members. For those non-Federal governmental plans that offer health
insurance coverage through an issuer, violations by the non-Federal
governmental plan are subject to our enforcement. Violations by the
issuer are subject to enforcement by the State unless HCFA is directly
enforcing HIPAA requirements in that State. Those plans that self-
insure their members (i.e., do not purchase insurance from an insurance
issuer) are subject to our enforcement but are also permitted to elect
exemptions from one or more HIPAA requirements. To date, approximately
615 self-insured non-Federal governmental plans have notified us of
their intent to opt out of one or more HIPAA provisions. Since self-
insured non-Federal governmental plans are permitted to elect exemption
from one or more HIPAA provisions, we expect to find relatively few of
these plans out of compliance with HIPAA. While the exact number of
non-Federal governmental plans is not known at this time, we do not
expect many more plans to exercise their right to opt out. In general,
the effects of the regulations on health insurance issues as discussed
below under subsection 3, also apply to non-Federal governmental
plans/employers that are subject to HIPAA requirements.
3. Effects of the Regulations on Health Insurance Issuers Offering
Individual or Group Health Insurance Coverage
In those instances in which HCFA enforces HIPAA, we are responsible
for enforcing HIPAA with respect to health insurance issuers. As stated
above, we estimate that 325 health insurance issuers issue policies in
those three States currently subject to Federal enforcement in the
individual market, group market, or both (California, Missouri, and
Rhode Island). These issuers will be primarily affected to the extent
that they fail to comply with the HIPAA provisions and requirements.
Issuers will be required to establish new relationships and communicate
directly with Federal officials. Thus, issuers may incur some costs as
they develop and maintain new processes for dealing with Federal
regulators. However, in those States in which we have begun directly
enforcing HIPAA, we have already held meetings with health insurance
issuers and provided information about appropriate Federal officials
and general enforcement processes. Thus, to some extent, new
relationships between health insurance issuers and Federal officials
have already been established in those States. Issuers in those States
will therefore incur only minimal costs in maintaining these
relationships.
As part of our direct enforcement responsibilities, we may request
additional information from issuers pursuant to a complaint or other
information. This may impose a burden on issuers to the extent that
they must submit additional information to us in response to a
complaint. These interim final regulations will provide a process for
doing so that is similar to the complaint resolution process currently
in practice in many States. If a complaint or other information we
receive indicates a potential violation, we will provide written notice
to the issuer and provide 30 days from the date of the notice for the
issuer to respond with additional information. This time frame may be
more lenient than similar State requirements, which provide as few as
15 working days or 20 calendar days for the issuer's response. If the
30-day period is not sufficient, the issuer may request an extension
for good cause. We will consider the potential impact of granting an
extension on those individuals who may incur a significant break in
coverage as a result of the extension.
During an investigation of any potential violation, we will review
and consider documentation provided that
[[Page 45794]]
demonstrates the issuers compliance with HIPAA. These interim final
regulations will not require, but will suggest, documentation that an
issuer may submit in response to the complaint allegation. If, in the
course of an investigation of a potential violation, we discover a
pattern of noncompliance or any other issue that warrants further
investigation, we may initiate a market conduct examination of the
issuer. If, during the course of our examination, we identify a
potential violation(s), we will provide notice to the issuer of the
violation and a proposed plan of correction. While the issuer that
undergoes a market conduct examination may incur some costs in
providing the documentation requested pursuant to that examination, the
issuer may avoid the imposition of a civil money penalty or may be
subject to a civil money penalty of a lesser amount.
Although those health insurance issuers given notice of a potential
violation may incur additional costs in responding to our inquiry,
these costs are expected to be minimal and incurred only by a small
number of issuers. Generally, consumers will first seek redress by the
health insurance issuer and second by the State insurance department.
Complaints are then forwarded to one of our regional offices and
possibly our central office after the first two steps have been taken.
Therefore, the number of complaints that will be brought to our
attention will be relatively small given the universe of health
insurance issuers.
In those instances in which documents (e.g, new policy forms or
marketing materials) must be modified to meet the HIPAA standards,
issuers may have to resubmit these documents to the appropriate State
officials to be reviewed for compliance with other applicable State
laws. Thus, issuers may spend more time bringing new materials and
products to the market. However, in the absence of Federal enforcement,
these documents would have had to have been reviewed by State officials
for compliance with applicable HIPAA standards, as well as those of
other State laws. Under Federal enforcement, issuers are therefore
required to submit to a separate regulatory body--the Federal
government--only information they are already required to submit to the
State, and are expected to incur minimal costs in doing so.
In the event that an issuer is found to be in violation of HIPAA,
the Secretary of the Department of Health and Human Services is
authorized to impose civil money penalties of no more than $100 for
each day for each violation for each affected individual. These
regulations will provide further details regarding possible
alternatives to the imposition of a civil money penalty, including
returning adversely affected individuals to the same position in which
they would have been had the violation not occurred.
However, in the event that an issuer refuses to respond to or
resolve a complaint or other inquiry in a satisfactory manner, we will
assess the penalty and provide notice of this penalty to the health
insurance issuer. In assessing the penalty, we will consider several
mitigating factors, also enumerated in the current interim final
regulations, which include the issuer's record of prior compliance and
the gravity of the violation. We will also consider aggravating
circumstances, including the frequency of the violation, the financial
and other impacts of the violation on the average affected individual,
or the issuer's inability to show that substantially all of the
violations were corrected. Issuers will be permitted to request a
hearing and may also request a settlement or alternative dispute
resolution.
4. Effects on the Medicare and Medicaid Programs
We do not expect that this rule will have any impact on Medicare
expenditures or the solvency of the trust fund or on Medicaid program
expenditures.
5. Federalism
Under Executive Order 12612, this regulation will not significantly
affect the States beyond what is required by HIPAA. It follows the
intent and letter of the law and does not usurp State authority beyond
what the HIPAA requires. This regulation describes only processes that
must be undertaken to fulfill our obligation to conduct enforcement as
required by the April 8, 1997 regulation. In addition, HIPAA follows a
narrow preemption of State laws and does not preempt State laws that
afford greater protections to HIPAA-eligible individuals.
We have included various provisions throughout this regulation that
demonstrate cooperation with the States. For example, States are
afforded the opportunity to enforce HIPAA requirements, which is the
preferred avenue of HIPPA implementation. If we receive information
that a State is not substantially enforcing, we first ask whether State
officials have been notified. We may also contact State officials
informally to discuss the requirements that are allegedly not being
enforced. If the State provides a satisfactory explanation that
indicates it is enforcing the HIPAA requirements, we will take no
further action unless we receive further information to validate the
assertion that the State is failing to enforce the requirements.
If there is a reasonable question regarding whether a State is
failing to substantially enforce HIPAA requirements, we will send our
preliminary determination to the chief executive officer of the State,
as well as to other appropriate regulatory officials of the State. This
preliminary determination will provide the State with a reasonable
opportunity to present evidence of substantial enforcement, to take
corrective action, and under certain specific circumstances, with an
opportunity to request an extension.
If we subsequently find that a State is not enforcing the HIPAA
requirements, we will issue a final written determination that will
identify the requirements that we will enforce and the effective date
of our enforcement. Under certain circumstances it is even possible
that States may enforce certain requirements while we enforce others.
After we have assumed enforcement responsibility in a State, should
the State demonstrate that it is prepared to begin its own enforcement
we may, at our discretion, enter into discussions with State officials
regarding the possibility of a transition back to State enforcement. In
this case, to the extent permissible, we will make our records
documenting compliance and enforcement available for incorporation into
State records.
C. Alternatives Considered
Throughout the process of developing these regulations, we
attempted to balance States' interest in regulating health insurance
issuers and the rights of those individuals that the Congress intended
to protect in enacting HIPAA. In those cases where we are exercising
regulatory discretion (described above), we are allowing States the
maximum amount of flexibility without jeopardizing the individual's
rights to the HIPAA protections. Likewise, we are attempting to
establish a process for investigating complaints and other information
regarding potential HIPAA violations that serves as an effective
deterrent to HIPAA violations. This process will provide ample notice
to the issuer and other responsible entities under investigation and
will provide guidance to issuers and other responsible entities that
wish to comply with the HIPAA provisions. We expect these regulations
to impose a minimal burden on States, health insurance issuers, and
non-Federal governmental plans/employers but we invite
[[Page 45795]]
comments from affected parties regarding the potential or real impact
of these regulations.
D. Conclusion
In accordance with the requirements of the RFA, we have performed
the above analysis, and we believe that there will be minimal impact on
small entities. We request comments on our findings. In accordance with
the provisions of Executive Order 12866, this regulation was reviewed
by the Office of Management and Budget.
List of Subjects Affected
45 CFR Parts 144 and 146
Health care, Health insurance, Reporting and recordkeeping
requirements.
45 CFR Part 148
Administrative practice and procedure, Health care, Health
insurance, Penalties, Reporting and recordkeeping requirements.
45 CFR Part 150
Administrative practice and procedure, Health care, Health
insurance, Penalties, Reporting and recordkeeping requirements.
For the reasons set forth in the preamble, 45 CFR subtitle A,
subchapter B, is amended as set forth below:
A. Part 144 is amended as follows:
PART 144--REQUIREMENTS RELATING TO HEALTH INSURANCE COVERAGE
1. The authority citation for part 144 continues to read as
follows:
Authority: Secs. 2701 through 2763, 2791, and 2792 of the Public
Health Service Act (42 U.S.C. 300gg through 300gg-63, 300gg-91, and
300gg-92).
2. Section 144.101 is revised to read as follows:
Sec. 144.101 Basis and purpose.
(a) Part 146 of this subchapter implements sections 2701 through
2723 of the Public Health Service Act (PHS Act, 42 U.S.C. 300gg, et
seq.). Its purpose is to improve access to group health insurance
coverage, guarantee the renewability of all coverage in the group
market, provide certain protections for mothers and newborns with
respect to coverage for hospital stays in connection with childbirth,
and provide parity between the application of annual and lifetime
dollar limits to mental health benefits and those limits for other
health benefits and to provide certain protections for patients who
elect breast reconstruction in connection with a mastectomy.
(b) Part 148 of this subchapter implements sections 2741 through
2763 of the PHS Act. Its purpose is to improve access to individual
health insurance coverage for certain individuals who previously had
group coverage, guarantee the renewability of all health insurance
coverage in the individual market, and provide certain protections for
mothers and newborns with respect to coverage for hospital stays in
connection with childbirth, and to provide certain protections for
patients who elect breast reconstruction in connection with a
mastectomy.
(c) Part 150 of this subchapter implements the enforcement
provisions of sections 2722 and 2761 of the PHS Act with respect to the
following:
(1) States that fail to substantially enforce one or more
provisions of part 146 concerning group health insurance or the
requirements of part 148 of this subchapter concerning individual
health insurance.
(2) Insurance issuers in States described in paragraph (c)(1) of
this section.
(3) Group health plans that are non-Federal governmental plans.
(d) Sections 2791 and 2792 of the PHS Act define terms used in the
regulations in this subchapter and provide the basis for issuing these
regulations.
3. In Sec. 144.102, paragraph (d) is added to read as follows:
Sec. 144.102 Scope and applicability.
* * * * *
(d) Provisions relating to HCFA enforcement of one or more
provisions of part 146 or the requirements of part 148, or both, are
contained in part 150 of this subchapter.
4. In Sec. 144.103, the title, the introductory text, and the
definition of non-Federal governmental plan are revised and a
definition of ``HCFA'' is added to read as follows:
Sec. 144.103 Definitions.
For purposes of parts 146 (group market), 148 (individual market),
and 150 (enforcement) of this subchapter, the following definitions
apply unless otherwise provided:
* * * * *
HCFA means the Health Care Financing Administration.
* * * * *
Non-Federal governmental plan means a governmental plan established
or maintained for its employees by the government of any State or
political subdivision thereof, or by any agency or instrumentality of
either.
* * * * *
PART 146--[AMENDED]
B. Part 146 is amended as follows:
1. The authority citation continues to read as follows:
Authority: Secs. 2701 through 2723, 2791, and 2792 of the PHS
Act, 42 U.S.C. 300gg through 300gg-63, 300gg-91, and 300gg-92.
Sec. 146.180 [Amended]
2. The cross-reference in Sec. 146.180(i)(2) to
``Sec. 146.184(d)(7)(iii)(B)'' is revised to read
``Sec. 150.341(a)(2).''
3. The cross-reference in Sec. 146.180(i)(3) to ``Sec. 146.184'' is
revised to read ``part 150 of this subchapter.''
Sec. 146.184 [Removed]
4. Section 146.184 is removed.
PART 148--[AMENDED]
C. Part 148 is amended as follows:
1. The authority citation continues to read as follows:
Authority: Secs. 2741 through 2763, 2791, and 2792 of the Public
Health Service Act (42 U.S.C. 300gg-41 through 300gg-63, 300gg-91,
and 300gg-92).
Sec. Sec. 148.200 and 148.202 [Removed]
2. Sections 148.200 and 148.202 are removed.
D. Part 150 is added to read as follows:
PART 150--HCFA ENFORCEMENT IN GROUP AND INDIVIDUAL INSURANCE
MARKETS
Subpart A--General Provisions
Sec.
150.101 Basis and scope.
150.103 Definitions.
Subpart B--HCFA Enforcement Processes For Determining Whether States
Are Failing to Substantially Enforce HIPAA Requirements
Sec.
150.201 State enforcement.
150.203 Circumstances requiring HCFA enforcement.
150.205 Sources of information triggering an investigation of State
enforcement.
150.207 Procedure for determining that a State fails to
substantially enforce HIPAA requirements.
150.209 Verification of exhaustion of remedies and contact with
State officials.
150.211 Notice to the State.
150.213 Form and content of notice.
150.215 Extension for good cause.
150.217 Preliminary determination.
150.219 Final determination.
150.221 Transition to State enforcement.
[[Page 45796]]
Subpart C--HCFA Enforcement With Respect to Issuers and Non-Federal
Governmental Plans--Civil Money Penalties
150.301 General rule regarding the imposition of civil money
penalties.
150.303 Basis for initiating an investigation of a potential
violation.
150.305 Determination of entity liable for civil money penalty.
150.307 Notice to responsible entities.
150.309 Request for extension.
150.311 Responses to allegations of noncompliance.
150.313 Market conduct examinations.
150.315 Amount of penalty--General.
150.317 Factors HCFA uses to determine the amount of penalty.
150.319 Determining the amount of the penalty--mitigating
circumstances.
150.321 Determining the amount of penalty--aggravating
circumstances.
150.323 Determining the amount of penalty--other matters as justice
may require.
150.325 Settlement authority.
150.341 Limitations on penalties.
150.343 Notice of proposed penalty.
150.345 Appeal of proposed penalty.
150.347 Failure to request a hearing.
Appendix A to Subpart C of Part 150--Examples of Violations
Subpart D--Administrative Hearings
150.401 Definitions.
150.403 Scope of ALJ's authority.
150.405 Filing of request for hearing.
150.407 Form and content of request for hearing.
150.409 Amendment of notice of assessment or request for hearing.
150.411 Dismissal of request for hearing.
150.413 Settlement.
150.415 Intervention.
150.417 Issues to be heard and decided by ALJ.
150.419 Forms of hearing.
150.421 Appearance of counsel.
150.423 Communications with the ALJ.
150.425 Motions.
150.427 Form and service of submissions.
150.429 Computation of time and extensions of time.
150.431 Acknowledgment of request for hearing.
150.435 Discovery.
150.437 Submission of briefs and proposed hearing exhibits.
150.439 Effect of submission of proposed hearing exhibits.
150.441 Prehearing conferences.
150.443 Standard of proof.
150.445 Evidence.
150.447 The record.
150.449 Cost of transcripts.
150.451 Posthearing briefs.
150.453 ALJ decision.
150.455 Sanctions.
150.457 Review by Administrator.
150.459 Judicial review.
150.461 Failure to pay assessment.
150.463 Final order not subject to review.
150.465 Collection and use of penalty funds.
Authority: Secs. 2701 through 2763, 2791, and 2792 of the PHS
Act (42 U.S.C. 300gg through 300gg-63, 300gg-91, and 300gg-92).
Subpart A--General Provisions
Sec. 150.101 Basis and scope.
(a) Basis. HCFA's enforcement authority under sections 2722 and
2761 of the PHS Act and its rulemaking authority under section 2792 of
the PHS Act provide the basis for issuing regulations under this part
150.
(b) Scope--(1) Enforcement with respect to group heath plans. The
provisions of title XXVII of the PHS Act that apply to group health
plans that are non-Federal governmental plans are enforced by HCFA
using the procedures described in Sec. 150.301 et seq.
(2) Enforcement with respect to health insurance issuers. The
States have primary enforcement authority with respect to the
requirements of title XXVII of the PHS Act that apply to health
insurance issuers offering coverage in the group or individual health
insurance market. If HCFA determines under subpart B of this part that
a State is not substantially enforcing title XXVII of the PHS Act,
including the implementing regulations in part 146 and part 148 of this
subchapter, HCFA enforces them under subpart C of this part.
Sec. 150.103 Definitions.
The definitions that appear in part 144 of this subchapter apply to
this part 150, unless stated otherwise. As used in this part:
Amendment, endorsement, or rider means a document that modifies or
changes the terms or benefits of an individual policy, group policy, or
certificate of insurance.
Application means a signed statement of facts by a potential
insured that an issuer uses as a basis for its decision whether, and on
what basis to insure an individual, or to issue a certificate of
insurance, or that a non-Federal governmental health plan uses as a
basis for a decision whether to enroll an individual under the plan.
Certificate of insurance means the document issued to a person or
entity covered under an insurance policy issued to a group health plan
or an association or trust that summarizes the benefits and principal
provisions of the policy.
Complaint means any expression, written or oral, indicating a
potential denial of any right or protection contained in HIPAA
requirements (whether ultimately justified or not) by an individual, a
personal representative or other entity acting on behalf of an
individual, or any entity that believes such a right is being or has
been denied an individual.
Group health insurance policy or group policy means the legal
document or contract issued by an issuer to a plan sponsor with respect
to a group health plan (including a plan that is a non-Federal
governmental plan) that contains the conditions and terms of the
insurance that covers the group.
HIPAA requirements means the requirements of title XXVII of the PHS
Act and its implementing regulations in parts 146 and 148 of this
subchapter.
Individual health insurance policy or individual policy means the
legal document or contract issued by the issuer to an individual that
contains the conditions and terms of the insurance. Any association or
trust arrangement that is not a group health plan as defined in
Sec. 144.103 of this subchapter or does not provide coverage in
connection with one or more group health plans is individual coverage
subject to the requirements of part 148 of this subchapter. The term
``individual health insurance policy'' includes a policy that is----
(1) Issued to an association that makes coverage available to
individuals other than in connection with one or more group health
plans; or
(2) Administered, or placed in a trust, and is not sold in
connection with a group health plan subject to the provisions of part
146 of this subchapter.
Plan document means the legal document that provides the terms of
the plan to individuals covered under a group health plan, such as a
non-Federal governmental health plan.
State law means all laws, decisions, rules, regulations, or other
State action having the effect of law, of any State as defined in
Sec. 144.103 of this subchapter. A law of the United States applicable
to the District of Columbia is treated as a State law rather than a law
of the United States.
Subpart B--HCFA Enforcement Processes for Determining Whether
States Are Failing to Substantially Enforce HIPAA Requirements
Sec. 150.201 State enforcement.
Except as provided in subpart C of this part, each State enforces
HIPAA requirements with respect to health insurance issuers that issue,
sell, renew, or offer health insurance coverage in the State.
Sec. 150.203 Circumstances requiring HCFA enforcement.
HCFA enforces HIPAA requirements to the extent warranted (as
determined by HCFA) in any of the following circumstances:
[[Page 45797]]
(a) Notification by State. A State notifies HCFA that it has not
enacted legislation to enforce or that it is not otherwise enforcing
HIPAA requirements.
(b) Determination by HCFA. If HCFA receives or obtains information
that a State may not be substantially enforcing HIPAA requirements, it
may initiate the process described in this subchapter to determine
whether the State is failing to substantially enforce these
requirements.
(c) Special rule for guaranteed availability in the individual
market. If a State has notified HCFA that it is implementing an
acceptable alternative mechanism in accordance with Sec. 148.128 of
this subchapter instead of complying with the guaranteed availability
requirements of Sec. 148.120, HCFA's determination focuses on the
following:
(1) Whether the State's mechanism meets the requirements for an
acceptable alternative mechanism.
(2) Whether the State is implementing the acceptable alternative
mechanism.
(d) Consequence of a State not implementing an alternative
mechanism. If a State is not implementing an acceptable alternative
mechanism, HCFA determines whether the State is substantially enforcing
the requirements of Secs. 148.101 through 148.126 and Sec. 148.170 of
this subchapter.
Sec. 150.205 Sources of information triggering an investigation of
State enforcement.
Information that may trigger an investigation of State enforcement
includes, but is not limited to, any of the following:
(a) A complaint received by HCFA.
(b) Information learned during informal contact between HCFA and
State officials.
(c) A report in the news media.
(d) Information from the governors and commissioners of insurance
of the various States regarding the status of their enforcement of
HIPAA requirements.
(e) Information obtained during periodic review of State health
care legislation. HCFA may review State health care and insurance
legislation and regulations to determine whether they are:
(1) Consistent with HIPAA requirements.
(2) Not pre-empted as provided in Sec. 146.143 (relating to group
market provisions) and Sec. 148.120 (relating to individual market
requirements) on the basis that they prevent the application of a HIPAA
requirement.
(f) Any other information that indicates a possible failure to
substantially enforce.
Sec. 150.207 Procedure for determining that a State fails to
substantially enforce HIPAA requirements.
Sections 150.209 through 150.219 describe the procedures HCFA
follows to determine whether a State is substantially enforcing HIPAA
requirements.
Sec. 150.209 Verification of exhaustion of remedies and contact with
State officials.
If HCFA receives a complaint or other information indicating that a
State is failing to enforce HIPAA requirements, HCFA assesses whether
the affected individual or entity has made reasonable efforts to
exhaust available State remedies. As part of its assessment, HCFA may
contact State officials regarding the questions raised.
Sec. 150.211 Notice to the State.
If HCFA is satisfied that there is a reasonable question whether
there has been a failure to substantially enforce HIPAA requirements,
HCFA sends, in writing, the notice described in Sec. 150.213 of this
part, to the following State officials:
(a) The governor or chief executive officer of the State.
(b) The insurance commissioner or chief insurance regulatory
official.
(c) If the alleged failure involves HMOs, the official responsible
for regulating HMOs if different from the official listed in paragraph
(b) of this section.
Sec. 150.213 Form and content of notice.
The notice provided to the State is in writing and does the
following:
(a) Identifies the HIPAA requirement or requirements that have
allegedly not been substantially enforced.
(b) Describes the factual basis for the allegation of a failure or
failures to enforce HIPAA requirements.
(c) Explains that the consequence of a State's failure to
substantially enforce HIPAA requirements is that HCFA enforces them.
(d) Advises the State that it has 30 days from the date of the
notice to respond, unless the time for response is extended as
described in Sec. 150.215 of this subpart. The State's response should
include any information that the State wishes HCFA to consider in
making the preliminary determination described in Sec. 150.217.
Sec. 150.215 Extension for good cause.
HCFA may extend, for good cause, the time the State has for
responding to the notice described in Sec. 150.213 of this subpart.
Examples of good cause include an agreement between HCFA and the State
that there should be a public hearing on the State's enforcement, or
evidence that the State is undertaking expedited enforcement
activities.
Sec. 150.217 Preliminary determination.
If, at the end of the 30-day period (and any extension), the State
has not established to HCFA's satisfaction that it is substantially
enforcing the HIPAA requirements described in the notice, HCFA takes
the following actions:
(a) Consults with the appropriate State officials identified in
Sec. 150.211 (or their designees).
(b) Notifies the State of HCFA's preliminary determination that the
State has failed to substantially enforce the requirements and that the
failure is continuing.
(c) Permits the State a reasonable opportunity to show evidence of
substantial enforcement.
Sec. 150.219 Final determination.
If, after providing notice and a reasonable opportunity for the
State to show that it has corrected any failure to substantially
enforce, HCFA finds that the failure to substantially enforce has not
been corrected, it will send the State a written notice of its final
determination. The notice includes the following:
(a) Identification of the HIPAA requirements that HCFA is
enforcing.
(b) The effective date of HCFA's enforcement.
Sec. 150.221 Transition to State enforcement.
(a) If HCFA determines that a State for which it has assumed
enforcement authority has enacted and implemented legislation to
enforce HIPAA requirements and also determines that it is appropriate
to return enforcement authority to the State, HCFA will enter into
discussions with State officials to ensure that a transition is
effected with respect to the following:
(1) Consumer complaints and inquiries.
(2) Instructions to issuers.
(3) Any other pertinent aspect of operations.
(b) HCFA may also negotiate a process to ensure that, to the extent
practicable, and as permitted by law, its records documenting issuer
compliance and other relevant areas of HCFA's enforcement operations
are made available for incorporation into the records of the State
regulatory authority that will assume enforcement responsibility.
[[Page 45798]]
Subpart C--HCFA Enforcement With Respect to Issuers and Non-Federal
Governmental Plans--Civil Money Penalties
Sec. 150.301 General rule regarding the imposition of civil money
penalties.
If any health insurance issuer that is subject to HCFA's
enforcement authority under Sec. 150.101(b)(2), or any non-Federal
governmental plan (or employer that sponsors a non-Federal governmental
plan) that is subject to HCFA's enforcement authority under
Sec. 150.101(b)(1), fails to comply with HIPAA requirements, it may be
subject to a civil money penalty as described in this subpart.
Sec. 150.303 Basis for initiating an investigation of a potential
violation.
(a) Information. Any information that indicates that any issuer may
be failing to meet the HIPAA requirements or that any non-Federal
governmental plan that is a group health plan as defined in section
2791(a)(1) of the PHS Act and 45 CFR Sec. 144.103 may be failing to
meet an applicable HIPAA requirement, may warrant an investigation.
HCFA may consider, but is not limited to, the following sources or
types of information:
(1) Complaints.
(2) Reports from State insurance departments, the National
Association of Insurance Commissioners, and other Federal and State
agencies.
(3) Any other information that indicates potential noncompliance
with HIPAA requirements.
(b) Who may file a complaint. Any entity or individual, or any
entity or personal representative acting on that individual's behalf,
may file a complaint with HCFA if he or she believes that a right to
which the aggrieved person is entitled under HIPAA requirements is
being, or has been, denied or abridged as a result of any action or
failure to act on the part of an issuer or other responsible entity as
defined in Sec. 150.305.
(c) Where a complaint should be directed. A complaint may be
directed to any HCFA regional office.
Sec. 150.305 Determination of entity liable for civil money penalty.
If a failure to comply is established under this Part, the
responsible entity, as determined under this section, is liable for any
civil money penalty imposed.
(a) Health insurance issuer is responsible entity--(1) Group health
insurance policy. To the extent a group health insurance policy issued,
sold, renewed, or offered to a private plan sponsor or a non-Federal
governmental plan sponsor is subject to applicable HIPAA requirements,
a health insurance issuer is subject to a civil money penalty,
irrespective of whether a civil money penalty is imposed under
paragraphs (b) or (c) of this section, if the policy itself or the
manner in which the policy is marketed or administered fails to comply
with an applicable HIPAA requirement.
(2) Individual health insurance policy. To the extent an individual
health insurance policy is subject to an applicable HIPAA requirement,
a health insurance issuer is subject to a civil money penalty if the
policy itself, or the manner in which the policy is marketed or
administered, violates any applicable HIPAA requirement.
(b) Non-Federal governmental plan is responsible entity. (1) Basic
rule. If a non-Federal governmental plan is sponsored by two or more
employers and fails to comply with an applicable HIPAA requirement, the
plan is subject to a civil money penalty, irrespective of whether a
civil money penalty is imposed under paragraph (a) of this section. The
plan is the responsible entity irrespective of whether the plan is
administered by a health insurance issuer, an employer sponsoring the
plan, or a third-party administrator.
(2) Exception. In the case of a non-Federal governmental plan that
is not provided through health insurance coverage, this paragraph (b)
does not apply to the extent that the non-Federal governmental
employers have elected under Sec. 146.180 to exempt the plan from
applicable HIPAA requirements.
(c) Employer is responsible entity. (1) Basic rule. If a non-
Federal governmental plan is sponsored by a single employer and fails
to comply with an applicable HIPAA requirement, the employer is subject
to a civil money penalty, irrespective of whether a civil money penalty
is imposed under paragraph (a) of this section. The employer is the
responsible entity irrespective of whether the plan is administered by
a health insurance issuer, the employer, or a third-party
administrator.
(2) Exception. In the case of a non-Federal governmental plan that
is not provided through health insurance coverage, this paragraph (c)
does not apply to the extent the non-Federal governmental employer has
elected under Sec. 146.180 to exempt the plan from applicable HIPAA
requirements.
(d) Actions or inactions of agent. A principal is liable for
penalties assessed for the actions or inactions of its agent.
Sec. 150.307 Notice to responsible entities.
If an investigation under Sec. 150.303 indicates a potential
violation, HCFA provides written notice to the responsible entity or
entities identified under Sec. 150.305. The notice does the following:
(a) Describes the substance of any complaint or other information.
(See Appendix A to this subpart for examples of violations.)
(b) Provides 30 days from the date of the notice for the
responsible entity or entities to respond with additional information,
including documentation of compliance as described in Sec. 150.311.
(c) States that a civil money penalty may be assessed.
Sec. 150.309 Request for extension.
In circumstances in which an entity cannot prepare a response to
HCFA within the 30 days provided in the notice, the entity may make a
written request for an extension from HCFA detailing the reason for the
extension request and showing good cause. If HCFA grants the extension,
the responsible entity must respond to the notice within the time frame
specified in HCFA's letter granting the extension of time. Failure to
respond within 30 days, or within the extended time frame, may result
in HCFA's imposition of a civil money penalty based upon the complaint
or other information alleging or indicating a violation of HIPAA
requirements.
Sec. 150.311 Responses to allegations of noncompliance.
In determining whether to impose a civil money penalty, HCFA
reviews and considers documentation provided in any complaint or other
information, as well as any additional information provided by the
responsible entity to demonstrate that it has complied with HIPAA
requirements. The following are examples of documentation that a
potential responsible entity may submit for HCFA's consideration in
determining whether a civil money penalty should be assessed and the
amount of any civil money penalty:
(a) Any individual policy, group policy, certificate of insurance,
application, rider, amendment, endorsement, certificate of creditable
coverage, advertising material, or any other documents if those
documents form the basis of a complaint or allegation of noncompliance,
or the basis for the responsible entity to refute the complaint or
allegation.
(b) Any other evidence that refutes an alleged noncompliance.
[[Page 45799]]
(c) Evidence that the entity did not know, and exercising due
diligence could not have known, of the violation.
(d) Documentation that the policies, certificates of insurance, or
non-Federal governmental plan documents have been amended to comply
with HIPAA requirements either by revision of the contracts or by the
development of riders, amendments, or endorsements.
(e) Documentation of the entity's issuance of conforming policies,
certificates of insurance, plan documents, or amendments to
policyholders or certificate holders before the issuance of the notice
of intent to assess a penalty described in Sec. 150.307.
(f) Evidence documenting the development and implementation of
internal policies and procedures by an issuer, or non-Federal
governmental health plan or employer, to ensure compliance with HIPAA
requirements. Those policies and procedures may include or consist of a
voluntary compliance program. Any such program should do the following:
(1) Effectively articulate and demonstrate the fundamental mission
of compliance and the issuer's, or non-Federal governmental health
plan's or employer's, commitment to the compliance process.
(2) Include the name of the individual in the organization
responsible for compliance.
(3) Include an effective monitoring system to identify practices
that do not comply with HIPAA requirements and to provide reasonable
assurance that fraud, abuse, and systemic errors are detected in a
timely manner.
(4) Address procedures to improve internal policies when
noncompliant practices are identified.
(g) Evidence documenting the entity's record of previous compliance
with HIPAA requirements.
Sec. 150.313 Market conduct examinations.
(a) Definition. A market conduct examination means the examination
of health insurance operations of an issuer, or the operation of a non-
Federal governmental plan, involving the review of one or more (or a
combination) of a responsible entity's business or operational affairs,
or both, to verify compliance with HIPAA requirements.
(b) General. If, based on the information described in
Sec. 150.303, HCFA finds evidence that a specific entity may be in
violation of a HIPAA requirement, HCFA may initiate a market conduct
examination to determine whether the entity is out of compliance. HCFA
may conduct the examinations either at the site of the issuer or other
responsible entity or a site HCFA selects. When HCFA selects a site, it
may direct the issuer or other responsible entity to forward any
documentation HCFA considers relevant for purposes of the examination
to that site.
(c) Appointment of examiners. When HCFA identifies an issue that
warrants investigation, HCFA will appoint one or more examiners to
perform the examination and instruct them as to the scope of the
examination.
(d) Appointment of professionals and specialists. When conducting
an examination under this part, HCFA may retain attorneys, independent
actuaries, independent market conduct examiners, or other professionals
and specialists as examiners.
(e) Report of market conduct examination. (1) HCFA review. When
HCFA receives a report, it will review the report, together with the
examination work papers and any other relevant information, and prepare
a final report. The final examination report will be provided to the
issuer or other responsible entity.
(2) Response from issuer or other responsible entity. With respect
to each examination issue identified in the report, the issuer or other
responsible entity may:
(i) Concur with HCFA's position(s) as outlined in the report,
explaining the plan of correction to be implemented.
(ii) Dispute HCFA's position(s), clearly outlining the basis for
its dispute and submitting illustrative examples where appropriate.
(3) HCFA's reply to a response from an issuer or other responsible
entity. Upon receipt of a response from the issuer or other responsible
entity, HCFA will provide a letter containing its reply to each
examination issue. HCFA's reply will consist of one of the following:
(i) Concurrence with the issuer's or non-Federal governmental
plan's position.
(ii) Approval of the issuer's or non-Federal governmental plan's
proposed plan of correction.
(iii) Conditional approval of the issuer's or non-Federal
governmental plan's proposed plan of correction, which will include any
modifications HCFA requires.
(iv) Notice to the issuer or non-Federal governmental plan that
there exists a potential violation of HIPAA requirements.
Sec. 150.315 Amount of penalty--General.
A civil money penalty for each violation of 42 U.S.C. 300gg et seq.
may not exceed $100 for each day, for each responsible entity, for each
individual affected by the violation. Penalties imposed under this part
are in addition to any other penalties prescribed or allowed by law.
Sec. 150.317 Factors HCFA uses to determine the amount of penalty.
In determining the amount of any penalty, HCFA takes into account
the following:
(a) The entity's previous record of compliance. This may include
any of the following:
(1) Any history of prior violations by the responsible entity,
including whether, at any time before determination of the current
violation or violations, HCFA or any State found the responsible entity
liable for civil or administrative sanctions in connection with a
violation of HIPAA requirements.
(2) Documentation that the responsible entity has submitted its
policy forms to HCFA for compliance review.
(3) Evidence that the responsible entity has never had a complaint
for noncompliance with HIPAA requirements filed with a State or HCFA.
(4) Such other factors as justice may require.
(b) The gravity of the violation. This may include any of the
following:
(1) The frequency of the violation, taking into consideration
whether any violation is an isolated occurrence, represents a pattern,
or is widespread.
(2) The level of financial and other impacts on affected
individuals.
(3) Other factors as justice may require.
Sec. 150. 319 Determining the amount of the penalty--mitigating
circumstances.
For every violation subject to a civil money penalty, if there are
substantial or several mitigating circumstances, the aggregate amount
of the penalty is set at an amount sufficiently below the maximum
permitted by Sec. 150.315 to reflect that fact. As guidelines for
taking into account the factors listed in Sec. 150.317, HCFA considers
the following:
(a) Record of prior compliance. It should be considered a
mitigating circumstance if the responsible entity has done any of the
following:
(1) Before receipt of the notice issued under Sec. 150.307,
implemented and followed a compliance plan as described in
Sec. 150.311(f).
(2) Had no previous complaints against it for noncompliance.
(b) Gravity of the violation(s). It should be considered a
mitigating circumstance if the responsible entity has done any of the
following:
[[Page 45800]]
(1) Made adjustments to its business practices to come into
compliance with HIPAA requirements so that the following occur:
(i) All employers, employees, individuals and non-Federal
governmental entities are identified that are or were issued any
policy, certificate of insurance or plan document, or any form used in
connection therewith that failed to comply.
(ii) All employers, employees, individuals, and non-Federal
governmental plans are identified that were denied coverage or were
denied a right provided under HIPAA requirements.
(iii) Each employer, employee, individual, or non-Federal
governmental plan adversely affected by the violation has been, for
example, offered coverage or provided a certificate of creditable
coverage in a manner that complies with HIPAA requirements that were
violated so that, to the extent practicable, that employer, employee,
individual, or non-Federal governmental entity is in the same position
that he, she, or it would have been in had the violation not occurred.
(iv) The adjustments are completed in a timely manner.
(2) Discovered areas of noncompliance without notice from HCFA and
voluntarily reported that noncompliance, provided that the responsible
entity submits the following:
(i) Documentation verifying that the rights and protections of all
individuals adversely affected by the noncompliance have been restored;
and
(ii) A plan of correction to prevent future similar violations.
(3) Demonstrated that the violation is an isolated occurrence.
(4) Demonstrated that the financial and other impacts on affected
individuals is negligible or nonexistent.
(5) Demonstrated that the noncompliance is correctable and that a
high percentage of the violations were corrected.
Sec. 150.321 Determining the amount of penalty--aggravating
circumstances.
For every violation subject to a civil money penalty, if there are
substantial or several aggravating circumstances, HCFA sets the
aggregate amount of the penalty at an amount sufficiently close to or
at the maximum permitted by Sec. 150.315 to reflect that fact. HCFA
considers the following circumstances to be aggravating circumstances:
(a) The frequency of violation indicates a pattern of widespread
occurrence.
(b) The violation(s) resulted in significant financial and other
impacts on the average affected individual.
(c) The entity does not provide documentation showing that
substantially all of the violations were corrected.
Sec. 150.323 Determining the amount of penalty--other matters as
justice may require.
HCFA may take into account other circumstances of an aggravating or
mitigating nature if, in the interests of justice, they require either
a reduction or an increase of the penalty in order to assure the
achievement of the purposes of this part, and if those circumstances
relate to the entity's previous record of compliance or the gravity of
the violation.
Sec. 150.325 Settlement authority.
Nothing in Secs. 150.315 through 150.323 limits the authority of
HCFA to settle any issue or case described in the notice furnished in
accordance with Sec. 150.307 or to compromise on any penalty provided
for in Secs. 150.315 through 150.323.
Sec. 150.341 Limitations on penalties.
(a) Circumstances under which a civil money penalty is not imposed.
HCFA does not impose any civil money penalty on any failure for the
period of time during which none of the responsible entities knew, or
exercising reasonable diligence would have known, of the failure. HCFA
also does not impose a civil money penalty for the period of time after
any of the responsible entities knew, or exercising reasonable
diligence would have known of the failure, if the failure was due to
reasonable cause and not due to willful neglect and the failure was
corrected within 30 days of the first day that any of the entities
against whom the penalty would be imposed knew, or exercising
reasonable diligence would have known, that the failure existed.
(b) Burden of establishing knowledge. The burden is on the
responsible entity or entities to establish to HCFA's satisfaction that
no responsible entity knew, or exercising reasonable diligence would
have known, that the failure existed.
Sec. 150.343 Notice of proposed penalty.
If HCFA proposes to assess a penalty in accordance with this part,
it delivers to the responsible entity, or sends to that entity by
certified mail, return receipt requested, written notice of its intent
to assess a penalty. The notice includes the following:
(a) A description of the HIPAA requirements that HCFA has
determined that the responsible entity violated.
(b) A description of any complaint or other information upon which
HCFA based its determination, including the basis for determining the
number of affected individuals and the number of days for which the
violations occurred.
(c) The amount of the proposed penalty as of the date of the
notice.
(d) Any circumstances described in Secs. 150.317 through 150.323
that were considered when determining the amount of the proposed
penalty.
(e) A specific statement of the responsible entity's right to a
hearing.
(f) A statement that failure to request a hearing within 30 days
permits the assessment of the proposed penalty without right of appeal
in accordance with Sec. 150.347.
Sec. 150.345 Appeal of proposed penalty.
Any entity against which HCFA has assessed a penalty may appeal
that penalty in accordance with Sec. 150.401 et seq.
Sec. 150.347 Failure to request a hearing.
If the responsible entity does not request a hearing within 30 days
of the issuance of the notice described in Sec. 150.343, HCFA may
assess the proposed civil money penalty, a less severe penalty, or a
more severe penalty. HCFA notifies the responsible entity in writing of
any penalty that has been assessed and of the means by which the
responsible entity may satisfy the judgment. The responsible entity has
no right to appeal a penalty with respect to which it has not requested
a hearing in accordance with Sec. 150.405 unless the responsible entity
can show good cause, as determined under Sec. 150.405(b), for failing
to timely exercise its right to a hearing.
Appendix A to Subpart C of Part 150--Examples of Violations
This appendix lists actions in the group and individual markets
for which HCFA may impose civil money penalties. This list is not
all-inclusive.
Note 1: All cross-references to sections of the Code of Federal
Regulations are cross-references to sections in parts 144, 146, or
148 of this subchapter.
Note 2: Except as otherwise expressly noted, all references to
non-Federal governmental plans refer to non-Federal governmental
plans that are not exempt from HIPAA requirements (as defined in
Sec. 150.103) under section 2721(b)(2) of the PHS Act and
Sec. 146.180.
I. Basis for Imposition of Civil Money Penalties--Actions in the
Group Market
a. Failure to comply with the limitations on pre-existing
condition exclusions (Sec. 146.111).
[[Page 45801]]
Violations of the limitations on preexisting condition
exclusions, set forth in Sec. 146.111, includes those circumstances
in which a non-Federal governmental plan or health insurance issuer
offering group health insurance coverage does the following:
(1) Imposes a preexisting condition exclusion period that
exceeds 12 months or, in the case of a late enrollee, 18 months,
from the enrollment date (the first day of coverage or the first day
of the waiting period, if any).
(2) Fails to reduce a pre-existing condition exclusion period by
creditable coverage as provided in Secs. 146.111(a)(1)(iii) and
146.113.
(3) Imposes a pre-existing condition exclusion period without
first giving the two written notices required in Secs. 146.111(c)
and 146.115(d). The first notice is a general notice to all plan
participants of the existence and terms of any pre-existing
condition exclusion under the plan, and the rights of individuals to
demonstrate creditable coverage. The notice should explain the right
of an individual to request a certificate from a previous plan or
issuer, if necessary, and include a statement that the current plan
or issuer will assist in obtaining a certificate from a previous
plan or issuer, if necessary. The second notice is required to be
sent to any individual who has presented evidence of creditable
coverage, and to whom a pre-existing condition exclusion period will
be applied. This second notice informs the individual of the plan's
determination of any pre-existing condition exclusion period, the
basis for such determination, a written explanation of any appeals
procedures established by the plan or issuer, and a reasonable
opportunity to submit additional evidence of creditable coverage.
(4) Treats pregnancy as a pre-existing condition, as prohibited
by Sec. 146.111(b)(4). For example, an issuer may not refuse to pay
for prenatal care and delivery effective with the date maternity
coverage began because the individual did not have maternity
coverage at the time the pregnancy began.
(5) Imposes a pre-existing condition exclusion with regard to a
child who enrolls in a group health plan within 30 days of birth,
adoption, or placement for adoption.
(6) Imposes a pre-existing condition exclusion with regard to a
child who was enrolled in another group health plan within 30 days
of birth, adoption, or placement for adoption and who does not
experience significant break in coverage.
(7) Uses a pre-existing condition look-back period that exceeds
the six-month period ending on the enrollment date in violation of
Sec. 146.111(a)(1) of this chapter.
(8) Determines whether a pre-existing condition exclusion
applies by using a standard other than whether medical advice,
diagnosis, care, or treatment was actually recommended or received
during the look-back period. A determination that a reasonably
prudent person would or should have sought medical care for the
condition is an unacceptable standard by which to determine whether
a pre-existing condition exclusion applies.
(9) Uses genetic information as part of the definition of pre-
existing condition in the absence of a diagnosis of the condition
related to the genetic information.
(10) Otherwise fails to comply with Sec. 146.111.
b. Failure to comply with the provisions relating to creditable
coverage (Sec. 146.113).
Failure to comply with the Sec. 146.113 rules relating to
creditable coverage includes those circumstances in which a non-
Federal governmental plan or issuer offering group health insurance
coverage does the following:
(1) Fails to treat all forms of coverage listed in
Sec. 146.113(a) as creditable coverage.
(2) Counts creditable coverage in a manner inconsistent with the
standard method described in Sec. 146.113(b) or the alternative
method described in Sec. 146.113(c), if it elects to use the
alternative method.
(3) Treats an individual with fewer than 63 consecutive days
without creditable coverage as having a significant break in
coverage in violation of Sec. 146.113(b)(2)(iii).
(4) Takes either a waiting period or an affiliation period into
account when calculating a significant break in coverage, as
prohibited by Sec. 146.113(b)(2)(iii).
(5) Otherwise fails to comply with Sec. 146.113.
c. Failure to comply with the provisions regarding certification
and disclosure of previous coverage (Sec. 146.115).
Except as provided in paragraph (c)(b), the plan sponsor of a
self-funded non-Federal governmental plan may not elect to exempt
its plan from the requirements of this paragraph.
Failure to comply with the requirements in Sec. 146.115
regarding certification and disclosure of previous coverage includes
those circumstances in which a non-Federal governmental plan or
issuer offering group health insurance coverage does the following:
(1) Fails to ensure that individuals who request certification
receive it.
(2) Fails to automatically provide certificates of creditable
coverage promptly, either--
(i) When the individual ceases to be covered under the plan
(whether or not COBRA continuation coverage is offered or elected);
or
(ii) When the COBRA continuation coverage is exhausted or is
terminated by the individual, if COBRA continuation coverage was
offered and was elected.
(3) Fails to provide certificates of creditable coverage
promptly upon request.
(4) Fails to provide the required information in certificates of
creditable coverage.
(5) Fails to provide certificates of creditable coverage to
dependents.
(6) Fails to accept other evidence of creditable coverage as
provided in Sec. 146.115(c). (The plan sponsor of a self-funded non-
Federal governmental plan may elect to exempt its plan from the
requirements of this paragraph (6)).
(7) Otherwise fails to comply with Sec. 146.115.
d. Failure to comply with the provisions regarding special
enrollment periods (Sec. 146.117).
Failure to comply with the Sec. 146.117 requirements regarding
special enrollment periods includes those circumstances in which an
issuer or a non-Federal governmental plan does the following:
(1) Fails to permit employees and dependents to enroll for
coverage if they satisfy the conditions of Sec. 146.117(a) or (b).
(2) Fails to provide coverage on a timely basis to individuals
protected by a special enrollment period as provided in
Sec. 146.117.
(3) Fails to provide the employee with a description of the
plan's or issuer's special enrollment rules on or before the time
the employee is offered the opportunity to enroll as provided in
Sec. 146.117(c).
(4) Otherwise fails to comply with Sec. 146.117.
e. Failure to comply with the HMO affiliation period provisions
(Sec. 146.119).
Failure to comply with the Sec. 146.119 affiliation period
requirements includes those circumstances in which an HMO that
offers group health insurance coverage does the following:
(1) Imposes a pre-existing condition exclusion period.
(2) Charges a premium for months in an affiliation period.
(3) Fails to impose an affiliation period uniformly without
regard to any health status-related factor.
(4) Imposes an affiliation period that is longer than 2 months
(or 3 months for late enrollees), or one that begins later than the
enrollment date or does not run concurrently with any waiting
period.
(5) Otherwise fails to comply with Sec. 146.119.
f. Failure to comply with the provisions regarding
nondiscrimination (Sec. 146.121).
Failure to comply with the Sec. 146.121 prohibitions regarding
nondiscrimination includes those circumstances in which an issuer or
a non-Federal governmental plan does the following:
(1) Applies rules of eligibility (including continued
eligibility) to enroll under the terms of the plan based any of the
health-status related factors described in Sec. 146.121(a).
(2) Requires an individual as a condition of enrollment or re-
enrollment to pay a higher premium than others similarly situated by
reason of a health-status related factor of the individual or the
individual's dependent.
(3) Otherwise fails to comply with Sec. 146.121.
g. Failure to comply with the provisions relating to benefits
for mothers and newborns (Sec. 146.130) in States where the
Sec. 146.130 standards are applicable.
Failure of an issuer or a non-Federal governmental plan to
comply with the standards in Sec. 146.130 relating to benefits for
mothers and newborns includes the following:
(1) Restricts benefits for a mother or her newborn to less than
48 hours following a vaginal delivery or less than 96 hours
following a delivery by cesarean section, unless the attending
provider decides, in consultation with the mother, to discharge the
mother or newborn earlier.
(2) Fails to calculate the length of stay from the time of
delivery when delivery occurs in a hospital, or from the time of
admission when delivery occurs outside the hospital.
(3) Penalizes an attending provider for complying with the law.
[[Page 45802]]
(4) Offers incentives to an attending provider to provide care
in a manner inconsistent with the provisions of Sec. 146.130.
(5) Denies the mother or newborn eligibility or continued
eligibility to enroll under the plan to avoid complying with
Sec. 146.130.
(6) Provides payments or rebates to mothers to encourage them to
accept less than the minimum stay required.
(7) Requires an attending provider to obtain authorization to
prescribe a hospital length of stay of up to 48 hours (or 96 hours)
after delivery.
(8) Imposes deductibles, coinsurance, or other cost-sharing
measures for any portion of a 48-hour (or 96-hour) hospital stay
that are less favorable than those imposed on any preceding portion
of the stay.
(9) In the case of a non-Federal governmental plan, fails to
provide participants and beneficiaries with a statement describing
the requirements of the Newborns' and Mothers' Health Protection Act
of 1996, using the language provided at Sec. 146.130(d)(2), not
later than 60 days after the first day of the first plan year
beginning on or after January 1, 1999.
(10) Otherwise fails to comply with Sec. 146.130.
h. Failure to comply with the provisions pertaining to parity in
the application of certain limits to mental health benefits in the
large group market (Sec. 146.136).
Failure of a non-Federal governmental plan offered by a large
employer or health insurance issuer offering health insurance
coverage to large employers to comply with the Sec. 146.136
provisions pertaining to parity in the application of certain limits
to mental health benefits (with respect to a plan that must comply
with such provisions) includes the following:
(1) Sale of a product by a health insurance issuer that fails to
comply with the mental health parity provisions of Sec. 146.136.
(2) Failure of a non-Federal governmental plan to comply with
the annual and lifetime dollar limits provisions concerning mental
health parity.
i. Failure to comply with the Women's Health and Cancer Rights
Act of 1998 (section 2706 of the PHS Act, 42 U.S.C. 300gg-06).
j. Failure to comply with the provisions regarding guaranteed
availability of coverage in the small group market (Sec. 146.150).
Failure to provide guaranteed availability in the small group
market as provided in Sec. 146.150 includes those circumstances in
which a health insurance issuer offering any health insurance
coverage to group health plans in the small group market does the
following:
(1) Fails to offer all products on a guaranteed availability
basis to all small employers.
(2) Fails to define a small employer using the definition at
Sec. 144.103, unless otherwise provided under State law; that is,
generally an employer with between 2 and 50 employees.
(3) Fails to count as employees all individual employees that an
employer wants to include in the group by applying a more
restrictive definition of ``employee'' than is permitted by
Sec. 144.103.
(4) Fails to accept all employee dependents who are qualified
under the terms of the employer's group health plan.
(5) Sets agent commissions for sales to small employers so low
as to discourage agents from marketing policies to, or enrolling,
these groups so that a failure to offer coverage results.
(6) Unreasonably delays the processing of applications submitted
by small employers, so that a break in coverage of more than 63 days
results.
(7) Fails to offer to any small employer on a guaranteed
availability basis any product that the issuer sells to small
employers through one or more associations that are not bona fide
associations, as defined in Sec. 144.103. The requirement to
guarantee availability of such products to all small employers
applies whether or not the small employer is a member of, or could
qualify for membership in, that association.
(8) Otherwise fails to comply with Sec. 146.150.
k. Failure to comply with the requirements regarding guaranteed
renewability in either the large or small group market
(Sec. 146.152).
Failure to provide guaranteed renewability of coverage as
provided in Sec. 146.152 includes those circumstances in which a
health insurance issuer offering health insurance coverage to a
group health plan in the small or large group market does the
following:
(1) Fails to renew or continue in force coverage at the option
of the plan sponsor unless one of the specific exceptions in
Sec. 146.152(b) is met.
(2) Fails to follow the requirements as described in
Sec. 146.152(c)-(e) relating to the discontinuance of a particular
product or withdrawal from the market of a particular product.
(3) Fails to renew coverage of an individual employer who has
been a member of an association when the individual employer ceases
to be a member of the association, unless it is a bona fide
association as defined in Sec. 144.103, and the issuer terminates
coverage for all former members on a uniform basis.
(4) Fails to act uniformly if the issuer cancels coverage.
(5) Otherwise fails to comply with Sec. 146.152.
l. Failure to comply with the requirements relating to
disclosure of information (Sec. 146.160).
Failure to make reasonable disclosure as provided in
Sec. 146.160 includes those circumstances in which an issuer
offering group health insurance coverage to a small employer, as
defined in Sec. 144.103, does the following:
(1) Fails to disclose all information concerning all products
available from the issuer in the small group market as defined in
Sec. 144.103.
(2) Otherwise fails to comply with Sec. 146.160.
II. Basis for Imposition of Civil Money Penalties--Actions in the
Individual Market
a. Failure to comply with the requirements regarding guaranteed
availability of coverage (Sec. 148.120).
In States that are not implementing an acceptable alternative
mechanism described in Sec. 148.128, failure to provide guaranteed
availability with no preexisting condition exclusion period as
provided in Sec. 148.120 includes those circumstances in which an
issuer does the following:
(1) Fails to provide to eligible individuals, on a guaranteed
availability basis, at least one of the following:
(i) Enrollment in all individual market policies it actually
markets.
(ii) The two most popular policies described in
Sec. 148.120(c)(2).
(iii) Two representative policy forms as described in
Sec. 148.120(c)(3).
(2) Imposes any preexisting condition exclusion or affiliation
period on eligible individuals under any policy that it sells on a
guaranteed availability basis.
(3) Sets agent commissions for sales to eligible individuals so
low as to discourage agents from marketing policies to, or
enrolling, these individuals so that a failure to offer coverage
results.
(4) Unreasonably delays the processing of applications submitted
by eligible individuals.
(5) Fails to offer to any eligible individual as defined in
Sec. 148.103 (on a guaranteed availability basis with no preexisting
condition exclusions) any product the issuer sells to individuals
through one or more associations that are not bona fide
associations, as defined in Sec. 144.103, unless the issuer has
designated at least two other products (as its two most popular or
its two representative policies) that it will sell to eligible
individuals.
(6) Denies an eligible individual a policy on the basis that the
individual has had a significant break in coverage even though a
substantially complete application was filed on or before the 63rd
day after the prior group coverage ended.
(7) Otherwise fails to comply with Sec. 148.120.
b. Failure to comply with the requirements regarding guaranteed
renewability of coverage (Sec. 148.122).
Failure to provide guaranteed renewability as provided in
Sec. 148.122 includes those circumstances in which an issuer does
the following:
(1) Fails to renew or continue in force coverage at the option
of the individual, unless one of the specific exceptions in
Sec. 148.122 is met.
(2) Fails to follow the requirements relating to the
discontinuance of a particular product or withdrawal from the market
of a particular product as described in Sec. 148.122(d).
(3) Fails to continue coverage at the option of the individual
after the individual becomes eligible for Medicare.
(4) Fails to renew coverage for an individual who has been a
member of an association when the individual ceases to be a member
of the association, unless the association is a bona fide
association as defined in Sec. 144.103 and the issuer uniformly
terminates coverage for all former members.
(5) Otherwise fails to comply with Sec. 148.122.
c. Failure to comply with the requirements regarding
certification and disclosure of coverage (Sec. 148.124).
Failure to comply with the requirements of Sec. 148.124
regarding certification and
[[Page 45803]]
disclosure of previous coverage includes those circumstances in
which an issuer does any of the following:
(1) Fails to provide automatic certificates of creditable
coverage promptly.
(2) Fails to disclose the required information in certificates
of creditable coverage as provided in Sec. 148.124(b).
(3) Fails to provide certificates of creditable coverage to
dependents who are insured in the individual market and whose
coverage ceases under an individual policy.
(4) Fails to credit coverage or establish eligibility as
provided in Sec. 148.124 solely because the individual is unable to
obtain a certificate. This includes failing to accept, acknowledge,
consider, or otherwise use other evidence of creditable coverage
described in Sec. 146.115(c) submitted by, or on behalf of, an
individual to establish that person is an eligible individual.
(5) Otherwise fails to comply with Sec. 148.124.
d. Failure to comply with the requirements regarding
determination of an eligible individual (Sec. 148.126).
Failure to determine, as provided in Sec. 148.126, that an
applicant for health insurance is an eligible individual includes
those circumstances in which an issuer does the following:
(1) Fails to identify eligible individuals, to provide
information regarding all coverage options, and to issue policies
promptly.
(2) Requires eligible individuals to specify their desire to
invoke the requirements of part 148 or to explicitly request their
rights under the law in order to obtain information about products
available to them.
(3) Otherwise fails to comply with Sec. 148.126.
e. Failure to comply with the standards relating to benefits for
mothers and newborns (Sec. 148.170).
In States where the Sec. 148.170 standards are applicable (see
Sec. 148.170(e)), failure to comply with the Sec. 148.170 standards
relating to benefits for mothers and newborns includes those
circumstances in which a health insurance issuer does the following:
(1) Restricts benefits for a mother or her newborn to fewer than
48 hours following a vaginal delivery or fewer than 96 hours
following a delivery by cesarean section, unless the attending
provider decides, in consultation with the mother, to discharge the
mother or newborn earlier.
(2) Fails to calculate the length of stay from the time of
delivery when delivery occurs in a hospital, or from the time of
admission when delivery occurs outside the hospital.
(3) Requires an attending provider to obtain authorization to
prescribe a hospital length of stay of up to 48 hours (or 96 hours,
if applicable) after delivery.
(4) Imposes deductibles, coinsurance, or other cost-sharing
measures for any portion of a 48-hour (or 96-hour, if applicable)
hospital stay that are less favorable than those imposed on any
preceding portion of the stay.
(6) Penalizes a provider for complying with the law.
(7) Offers incentives to a provider to provide care in a manner
inconsistent with the provisions of Sec. 148.170 to avoid complying
with Sec. 148.170.
(8) Denies the mother or newborn eligibility or continued
eligibility solely to avoid the requirements of Sec. 148.170.
(9) Provides incentives to mothers to encourage them to accept
less than the minimum stay requirement.
(10) Fails to provide participants and beneficiaries with a
statement describing the requirements of the Newborns' and Mothers'
Health Protection Act of 1996, using the language provided at
Sec. 148.170 (d)(2), not later than March 1, 1999.
(11) Otherwise fails to comply with Sec. 148.170.
f. Failure to comply with the Women's Health and Cancer Rights
Act of 1998 (section 2752 of the PHS Act, 42 U.S.C. 300gg-52) and
any additional implementing regulations.
Subpart D--Administrative Hearings
Sec. 150.401 Definitions.
In this subpart, unless the context indicates otherwise:
ALJ means administrative law judge of the Departmental Appeals
Board of the Department of Health and Human Services.
Filing date means the date postmarked by the U.S. Postal Service,
deposited with a carrier for commercial delivery, or hand delivered.
Hearing includes a hearing on a written record as well as an in-
person or telephone hearing.
Party means HCFA or the respondent.
Receipt date means five days after the date of a document, unless
there is a showing that it was in fact received later.
Respondent means an entity that received a notice of proposed
assessment of a civil money penalty issued pursuant to Sec. 150.343.
Sec. 150.403 Scope of ALJ's authority.
(a) The ALJ has the authority, including all of the authority
conferred by the Administrative Procedure Act, to adopt whatever
procedures may be necessary or proper to carry out in an efficient and
effective manner the ALJ's duty to provide a fair and impartial hearing
on the record and to issue an initial decision concerning the
imposition of a civil money penalty.
(b) The ALJ's authority includes the authority to modify,
consistent with the Administrative Procedure Act (5 U.S.C. 552a), any
hearing procedures set out in this subpart.
(c) The ALJ does not have the authority to find invalid or refuse
to follow Federal statutes or regulations.
Sec. 150.405 Filing of request for hearing.
(a) A respondent has a right to a hearing before an ALJ if it files
a request for hearing that complies with Sec. 150.407(a), within 30
days after the date of issuance of either HCFA's notice of proposed
assessment under Sec. 150.343 or notice that an alternative dispute
resolution process has terminated. The request for hearing should be
addressed as instructed in the notice of proposed determination. ``Date
of issuance'' is five (5) days after the filing date, unless there is a
showing that the document was received earlier.
(b) The ALJ may extend the time for filing a request for hearing
only if the ALJ finds that the respondent was prevented by events or
circumstances beyond its control from filing its request within the
time specified above. Any request for an extension of time must be made
promptly by written motion.
Sec. 150.407 Form and content of request for hearing.
(a) The request for hearing must do the following:
(1) Identify any factual or legal bases for the assessment with
which the respondent disagrees.
(2) Describe with reasonable specificity the basis for the
disagreement, including any affirmative facts or legal arguments on
which the respondent is relying.
(b) The request for hearing must identify the relevant notice of
assessment by date and attach a copy of the notice.
Sec. 150.409 Amendment of notice of assessment or request for hearing.
The ALJ may permit HCFA to amend its notice of assessment, or
permit the respondent to amend a request for hearing that complies with
Sec. 150.407(a), if the ALJ finds that no undue prejudice to either
party will result.
Sec. 150.411 Dismissal of request for hearing.
An ALJ will order a request for hearing dismissed if the ALJ
determines that:
(a) The request for hearing was not filed within 30 days as
specified by Sec. 150.405(a) or any extension of time granted by the
ALJ pursuant to Sec. 150.405(b).
(b) The request for hearing fails to meet the requirements of
Sec. 150.407.
(c) The entity that filed the request for hearing is not a
respondent under Sec. 150.401.
(d) The respondent has abandoned its request.
(e) The respondent withdraws its request for hearing.
Sec. 150.413 Settlement.
HCFA has exclusive authority to settle any issue or any case,
without the consent of the administrative law judge at any time before
or after the administrative law judge's decision.
[[Page 45804]]
Sec. 150.415 Intervention.
(a) The ALJ may grant the request of an entity, other than the
respondent, to intervene if all of the following occur:
(1) The entity has a significant interest relating to the subject
matter of the case.
(2) Disposition of the case will, as a practical matter, likely
impair or impede the entity's ability to protect that interest.
(3) The entity's interest is not adequately represented by the
existing parties.
(4) The intervention will not unduly delay or prejudice the
adjudication of the rights of the existing parties.
(b) A request for intervention must specify the grounds for
intervention and the manner in which the entity seeks to participate in
the proceedings. Any participation by an intervenor must be in the
manner and by any deadline set by the ALJ.
(c) The Department of Labor or the IRS may intervene without regard
to paragraphs (a)(1) through (a)(3) of this section.
Sec. 150.417 Issues to be heard and decided by ALJ.
(a) The ALJ has the authority to hear and decide the following
issues:
(1) Whether a basis exists to assess a civil money penalty against
the respondent.
(2) Whether the amount of the assessed civil money penalty is
reasonable.
(b) In deciding whether the amount of a civil money penalty is
reasonable, the ALJ--
(1) Applies the factors that are identified in Sec. 150.317.
(2) May consider evidence of record relating to any factor that
HCFA did not apply in making its initial determination, so long as that
factor is identified in this subpart.
(c) If the ALJ finds that a basis exists to assess a civil money
penalty, the ALJ may sustain, reduce, or increase the penalty that HCFA
assessed.
Sec. 150.419 Forms of hearing.
(a) All hearings before an ALJ are on the record. The ALJ may
receive argument or testimony in writing, in person, or by telephone.
The ALJ may receive testimony by telephone only if the ALJ determines
that doing so is in the interest of justice and economy and that no
party will be unduly prejudiced. The ALJ may require submission of a
witness' direct testimony in writing only if the witness is available
for cross-examination.
(b) The ALJ may decide a case based solely on the written record
where there is no disputed issue of material fact the resolution of
which requires the receipt of oral testimony.
Sec. 150.421 Appearance of counsel.
Any attorney who is to appear on behalf of a party must promptly
file, with the ALJ, a notice of appearance.
Sec. 150.423 Communications with the ALJ.
No party or person (except employees of the ALJ's office) may
communicate in any way with the ALJ on any matter at issue in a case,
unless on notice and opportunity for both parties to participate. This
provision does not prohibit a party or person from inquiring about the
status of a case or asking routine questions concerning administrative
functions or procedures.
Sec. 150.425 Motions.
(a) Any request to the ALJ for an order or ruling must be by
motion, stating the relief sought, the authority relied upon, and the
facts alleged. All motions must be in writing, with a copy served on
the opposing party, except in either of the following situations:
(1) The motion is presented during an oral proceeding before an ALJ
at which both parties have the opportunity to be present.
(2) An extension of time is being requested by agreement of the
parties or with waiver of objections by the opposing party.
(b) Unless otherwise specified in this subpart, any response or
opposition to a motion must be filed within 20 days of the party's
receipt of the motion. The ALJ does not rule on a motion before the
time for filing a response to the motion has expired except where the
response is filed at an earlier date, where the opposing party consents
to the motion being granted, or where the ALJ determines that the
motion should be denied.
Sec. 150.427 Form and service of submissions.
(a) Every submission filed with the ALJ must be filed in
triplicate, including one original of any signed documents, and
include:
(1) A caption on the first page, setting forth the title of the
case, the docket number (if known), and a description of the submission
(such as ``Motion for Discovery'').
(2) The signatory's name, address, and telephone number.
(3) A signed certificate of service, specifying each address to
which a copy of the submission is sent, the date on which it is sent,
and the method of service.
(b) A party filing a submission with the ALJ must, at the time of
filing, serve a copy of such submission on the opposing party. An
intervenor filing a submission with the ALJ must, at the time of
filing, serve a copy of the submission on all parties. Service must be
made by mailing or hand delivering a copy of the submission to the
opposing party. If a party is represented by an attorney, service must
be made on the attorney.
Sec. 150.429 Computation of time and extensions of time.
(a) For purposes of this subpart, in computing any period of time,
the time begins with the day following the act, event, or default and
includes the last day of the period unless it is a Saturday, Sunday, or
legal holiday observed by the Federal government, in which event it
includes the next business day. When the period of time allowed is less
than seven days, intermediate Saturdays, Sundays, and legal holidays
observed by the Federal government are excluded from the computation.
(b) The period of time for filing any responsive pleading or papers
is determined by the date of receipt (as defined in Sec. 150.401) of
the submission to which a response is being made.
(c) The ALJ may grant extensions of the filing deadlines specified
in these regulations or set by the ALJ for good cause shown (except
that requests for extensions of time to file a request for hearing may
be granted only on the grounds specified in section Sec. 150.405(b)).
Sec. 150.431 Acknowledgment of request for hearing.
After receipt of the request for hearing, the ALJ assigned to the
case or someone acting on behalf of the ALJ will send a letter to the
parties that acknowledges receipt of the request for hearing,
identifies the docket number assigned to the case, provides
instructions for filing submissions and other general information
concerning procedures, and sets out the next steps in the case.
Sec. 150.435 Discovery.
(a) The parties must identify any need for discovery from the
opposing party as soon as possible, but no later than the time for the
reply specified in Sec. 150.437(c). Upon request of a party, the ALJ
may stay proceedings for a reasonable period pending completion of
discovery if the ALJ determines that a party would not be able to make
the submissions required by Sec. 150.437 without discovery. The parties
should attempt to resolve any discovery issues informally before
seeking an order from the ALJ.
(b) Discovery devices may include requests for production of
documents,
[[Page 45805]]
requests for admission, interrogatories, depositions, and stipulations.
The ALJ orders interrogatories or depositions only if these are the
only means to develop the record adequately on an issue that the ALJ
must resolve to decide the case.
(c) Each discovery request must be responded to within 30 days of
receipt, unless that period of time is extended for good cause by the
ALJ.
(d) A party to whom a discovery request is directed may object in
writing for any of the following reasons:
(1) Compliance with the request is unduly burdensome or expensive.
(2) Compliance with the request will unduly delay the proceedings.
(3) The request seeks information that is wholly outside of any
matter in dispute.
(4) The request seeks privileged information. Any party asserting a
claim of privilege must sufficiently describe the information or
document being withheld to show that the privilege applies. If an
asserted privilege applies to only part of a document, a party
withholding the entire document must state why the nonprivileged part
is not segregable.
(e) Any motion to compel discovery must be filed within 10 days
after receipt of objections to the party's discovery request, within 10
days after the time for response to the discovery request has elapsed
if no response is received, or within 10 days after receipt of an
incomplete response to the discovery request. The motion must be
reasonably specific as to the information or document sought and must
state its relevance to the issues in the case.
Sec. 150.437 Submission of briefs and proposed hearing exhibits.
(a) Within 60 days of its receipt of the acknowledgment provided
for in Sec. 150.431, the respondent must file the following with the
ALJ:
(1) A statement of its arguments concerning HCFA's notice of
assessment (respondent's brief), including citations to the
respondent's hearing exhibits provided in accordance with paragraph
(a)(2) of this section. The brief may not address factual or legal
bases for the assessment that the respondent did not identify as
disputed in its request for hearing or in an amendment to that request
permitted by the ALJ.
(2) All documents (including any affidavits) supporting its
arguments, tabbed and organized chronologically and accompanied by an
indexed list identifying each document (respondent's proposed hearing
exhibits).
(3) A statement regarding whether there is a need for an in-person
hearing and, if so, a list of proposed witnesses and a summary of their
expected testimony that refers to any factual dispute to which the
testimony will relate.
(4) Any stipulations or admissions.
(b) Within 30 days of its receipt of the respondent's submission
required by paragraph (a) of this section, HCFA will file the following
with the ALJ:
(1) A statement responding to the respondent's brief, including the
respondent's proposed hearing exhibits, if appropriate. The statement
may include citations to HCFA's proposed hearing exhibits submitted in
accordance with paragraph (b)(2) of this section.
(2) Any documents supporting HCFA's response not already submitted
as part of the respondent's proposed hearing exhibits, organized and
indexed as indicated in paragraph (a)(2) of this section (HCFA's
proposed hearing exhibits).
(3) A statement regarding whether there is a need for an in-person
hearing and, if so, a list of proposed witnesses and a summary of their
expected testimony that refers to any factual dispute to which the
testimony will relate.
(4) Any admissions or stipulations.
(c) Within 15 days of its receipt of HCFA's submission required by
paragraph (b) of this section, the respondent may file with the ALJ a
reply to HCFA's submission.
Sec. 150.439 Effect of submission of proposed hearing exhibits.
(a) Any proposed hearing exhibit submitted by a party in accordance
with Sec. 150.437 is deemed part of the record unless the opposing
party raises an objection to that exhibit and the ALJ rules to exclude
it from the record. An objection must be raised either in writing prior
to the prehearing conference provided for in Sec. 150.441 or at the
prehearing conference. The ALJ may require a party to submit the
original hearing exhibit on his or her own motion or in response to a
challenge to the authenticity of a proposed hearing exhibit.
(b) A party may introduce a proposed hearing exhibit following the
times for submission specified in Sec. 150.437 only if the party
establishes to the satisfaction of the ALJ that it could not have
produced the exhibit earlier and that the opposing party will not be
prejudiced.
Sec. 150.441 Prehearing conferences.
An ALJ may schedule one or more prehearing conferences (generally
conducted by telephone) on the ALJ's own motion or at the request of
either party for the purpose of any of the following:
(a) Hearing argument on any outstanding discovery request.
(b) Establishing a schedule for any supplements to the submissions
required by Sec. 150.437 because of information obtained through
discovery.
(c) Hearing argument on a motion.
(d) Discussing whether the parties can agree to submission of the
case on a stipulated record.
(e) Establishing a schedule for an in-person hearing, including
setting deadlines for the submission of written direct testimony or for
the written reports of experts.
(f) Discussing whether the issues for a hearing can be simplified
or narrowed.
(g) Discussing potential settlement of the case.
(h) Discussing any other procedural or substantive issues.
Sec. 150.443 Standard of proof.
(a) In all cases before an ALJ--
(1) HCFA has the burden of coming forward with evidence sufficient
to establish a prima facie case;
(2) The respondent has the burden of coming forward with evidence
in response, once HCFA has established a prima facie case; and
(3) HCFA has the burden of persuasion regarding facts material to
the assessment; and
(4) The respondent has the burden of persuasion regarding facts
relating to an affirmative defense.
(b) The preponderance of the evidence standard applies to all cases
before the ALJ.
Sec. 150.445 Evidence.
(a) The ALJ will determine the admissibility of evidence.
(b) Except as provided in this part, the ALJ will not be bound by
the Federal Rules of Evidence. However, the ALJ may apply the Federal
Rules of Evidence where appropriate; for example, to exclude unreliable
evidence.
(c) The ALJ excludes irrelevant or immaterial evidence.
(d) Although relevant, evidence may be excluded if its probative
value is substantially outweighed by the danger of unfair prejudice,
confusion of the issues, or by considerations of undue delay or
needless presentation of cumulative evidence.
(e) Although relevant, evidence is excluded if it is privileged
under Federal law.
(f) Evidence concerning offers of compromise or settlement made in
this
[[Page 45806]]
action will be inadmissible to the extent provided in the Federal Rules
of Evidence.
(g) Evidence of acts other than those at issue in the instant case
is admissible in determining the amount of any civil money penalty if
those acts are used under Secs. 150.317 and 150.323 of this part to
consider the entity's prior record of compliance, or to show motive,
opportunity, intent, knowledge, preparation, identity, or lack of
mistake. This evidence is admissible regardless of whether the acts
occurred during the statute of limitations period applicable to the
acts that constitute the basis for liability in the case and regardless
of whether HCFA's notice sent in accordance with Secs. 150.307 and
150.343 referred to them.
(h) The ALJ will permit the parties to introduce rebuttal witnesses
and evidence.
(i) All documents and other evidence offered or taken for the
record will be open to examination by all parties, unless the ALJ
orders otherwise for good cause shown.
(j) The ALJ may not consider evidence regarding the willingness and
ability to enter into and successfully complete a corrective action
plan when that evidence pertains to matters occurring after HCFA's
notice under Sec. 150.307.
Sec. 150.447 The record.
(a) Any testimony that is taken in-person or by telephone is
recorded and transcribed. The ALJ may order that other proceedings in a
case, such as a prehearing conference or oral argument of a motion, be
recorded and transcribed.
(b) The transcript of any testimony, exhibits and other evidence
that is admitted, and all pleadings and other documents that are filed
in the case constitute the record for purposes of an ALJ decision.
(c) For good cause, the ALJ may order appropriate redactions made
to the record.
Sec. 150.449 Cost of transcripts.
Generally, each party is responsible for 50 percent of the
transcript cost. Where there is an intervenor, the ALJ determines what
percentage of the transcript cost is to be paid for by the intervenor.
Sec. 150.451 Posthearing briefs.
Each party is entitled to file proposed findings and conclusions,
and supporting reasons, in a posthearing brief. The ALJ will establish
the schedule by which such briefs must be filed. The ALJ may direct the
parties to brief specific questions in a case and may impose page
limits on posthearing briefs. Additionally, the ALJ may allow the
parties to file posthearing reply briefs.
Sec. 150.453 ALJ decision.
The ALJ will issue an initial agency decision based only on the
record and on applicable law; the decision will contain findings of
fact and conclusions of law. The ALJ's decision is final and appealable
after 30 days unless it is modified or vacated under Sec. 150.457.
Sec. 150.455 Sanctions.
(a) The ALJ may sanction a party or an attorney for failing to
comply with an order or other directive or with a requirement of a
regulation, for abandonment of a case, or for other actions that
interfere with the speedy, orderly or fair conduct of the hearing. Any
sanction that is imposed will relate reasonably to the severity and
nature of the failure or action.
(b) A sanction may include any of the following actions:
(1) In the case of failure or refusal to provide or permit
discovery, drawing negative fact inferences or treating such failure or
refusal as an admission by deeming the matter, or certain facts, to be
established.
(2) Prohibiting a party from introducing certain evidence or
otherwise advocating a particular claim or defense.
(3) Striking pleadings, in whole or in part.
(4) Staying the case.
(5) Dismissing the case.
(6) Entering a decision by default.
(7) Refusing to consider any motion or other document that is not
filed in a timely manner.
(8) Taking other appropriate action.
Sec. 150.457 Review by Administrator.
(a) The Administrator of HCFA (which for purposes of this
subsection may include his or her delegate), at his or her discretion,
may review in whole or in part any initial agency decision issued under
Sec. 150.453.
(b) The Administrator may decide to review an initial agency
decision if it appears from a preliminary review of the decision (or
from a preliminary review of the record on which the initial agency
decision was based, if available at the time) that:
(1) The ALJ made an erroneous interpretation of law or regulation.
(2) The initial agency decision is not supported by substantial
evidence.
(3) The ALJ has incorrectly assumed or denied jurisdiction or
extended his or her authority to a degree not provided for by statute
or regulation.
(4) The ALJ decision requires clarification, amplification, or an
alternative legal basis for the decision.
(5) The ALJ decision otherwise requires modification, reversal, or
remand.
(c) Within 30 days of the date of the initial agency decision, the
Administrator will mail a notice advising the respondent of any intent
to review the decision in whole or in part.
(d) Within 30 days of receipt of a notice that the Administrator
intends to review an initial agency decision, the respondent may
submit, in writing, to the Administrator any arguments in support of,
or exceptions to, the initial agency decision.
(e) This submission of the information indicated in paragraph (d)
of this section must be limited to issues the Administrator has
identified in his or her notice of intent to review, if the
Administrator has given notice of an intent to review the initial
agency decision only in part. A copy of this submission must be sent to
the other party.
(f) After receipt of any submissions made pursuant to paragraph (d)
of this section and any additional submissions for which the
Administrator may provide, the Administrator will affirm, reverse,
modify, or remand the initial agency decision. The Administrator will
mail a copy of his or her decision to the respondent.
(g) The Administrator's decision will be based on the record on
which the initial agency decision was based (as forwarded by the ALJ to
the Administrator) and any materials submitted pursuant to paragraphs
(b), (d), and (f) of this section.
(h) The Administrator's decision may rely on decisions of any
courts and other applicable law, whether or not cited in the initial
agency decision.
Sec. 150.459 Judicial review.
(a) Filing of an action for review. Any responsible entity against
whom a final order imposing a civil money penalty is entered may obtain
review in the United States District Court for any district in which
the entity is located or in the United States District Court for the
District of Columbia by doing the following:
(1) Filing a notice of appeal in that court within 30 days from the
date of a final order.
(2) Simultaneously sending a copy of the notice of appeal by
registered mail to HCFA.
(b) Certification of administrative record. HCFA promptly certifies
and files with the court the record upon which the penalty was
assessed.
[[Page 45807]]
(c) Standard of review. The findings of HCFA and the ALJ may not be
set aside unless they are found to be unsupported by substantial
evidence, as provided by 5 U.S.C. 706(2)(E).
Sec. 150.461 Failure to pay assessment.
If any entity fails to pay an assessment after it becomes a final
order, or after the court has entered final judgment in favor of HCFA,
HCFA refers the matter to the Attorney General, who brings an action
against the entity in the appropriate United States district court to
recover the amount assessed.
Sec. 150.463 Final order not subject to review.
In an action brought under Sec. 150.461, the validity and
appropriateness of the final order described in Sec. 150.459 is not
subject to review.
Sec. 150.465 Collection and use of penalty funds.
(a) Any funds collected under Sec. 150.461 are paid to HCFA.
(b) The funds are available without appropriation until expended.
(c) The funds may be used only for the purpose of enforcing the
HIPAA requirements for which the penalty was assessed.
Dated: April 16, 1999.
Nancy-Ann Min DeParle,
Administrator, Health Care Financing Administration.
Dated May 25, 1999.
Donna E. Shalala,
Secretary.
[FR Doc. 99-21662 Filed 8-19-99; 8:45 am]
BILLING CODE 4120-01-P
