Federal Enforcement in Group and Individual Health Insurance Markets

SUMMARY: This interim final rule with comment period details procedures

for enforcing title XXVII of the Public Health Service Act as added by

the Health Insurance Portability and Accountability Act of 1996, and as

amended by the Mental Health Parity Act of 1996, the Newborns' and

Mothers' Health Protection Act of 1996, and the Women's Health and

Cancer Rights Act of 1998, in States that do not enact the legislation

necessary to enforce or otherwise do not substantially enforce the

requirements of these acts. This regulation also delineates the process

for taking enforcement actions against non-Federal governmental plans

and, in those States in which HCFA is directly enforcing the

requirements of these acts, health insurance issuers that are not

complying with those requirements.

DATES: Effective date: September 20, 1999. Comments will be considered

if we receive them at the appropriate address, as provided below, no

later than 5 p.m. on October 19, 1999.

ADDRESSES: Mail written comments (1 original and 3 copies) to the

following address:

Health Care Financing Administration, Department of Health and Human

Services, Attention: HCFA-2019-IFC, P.O. Box 9016, Baltimore, MD 21244-

9016.

If you prefer, you may deliver your written comments (1 original

and 3 copies) to one of the following addresses:

Room 309-G, Hubert H. Humphrey Building, 200 Independence Avenue, SW.,

Washington, DC,

or

Room C5-16-03, 7500 Security Boulevard, Baltimore, MD

FOR FURTHER INFORMATION CONTACT: Rochelle Shevitz, (410) 786-1565.

SUPPLEMENTARY INFORMATION:

Comments, Procedures, and Availability of Copies

Because of staff and resource limitations, we cannot accept

comments by facsimile (FAX) transmission. In commenting, please refer

to file code HCFA-2019-IFC. Comments received timely will be available

for public inspection as they are received, generally beginning

approximately 3 weeks after publication of a document, in Room 443-G of

the Department's office at 200 Independence Avenue, SW., Washington,

DC, on Monday through Friday of each week from 8:30 to 5 p.m. (phone:

(202) 690-7890).

Copies: To order copies of the Federal Register containing this

document, send your request to: New Orders, Superintendent of

Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date

of the issue requested and enclose a check or money order payable to

the Superintendent of Documents, or enclose your Visa or Master Card

number and expiration date. Credit card orders can also be placed by

calling the order desk at (202) 512-1800 or by faxing to (202) 512-

2250. The cost for each copy is $8. As an alternative, you can view and

photocopy the Federal Register document at most libraries designated as

Federal Depository Libraries and at many other public and academic

libraries throughout the country that receive the Federal Register.

I. Background

Title I of the Health Insurance Portability and Accountability Act

of 1996 (HIPAA) created a new title XXVII of the Public Health Service

(PHS) Act (42 U.S.C. 300gg, et seq.) that requires group health plans

and health insurance issuers to provide certain guarantees for

availability and renewability of health coverage in the group and

individual health insurance markets. 1

---------------------------------------------------------------------------

\1\ HIPAA created a series of parallel provisions that were

placed in the Employee Retirement Security Act (ERISA), which is

within the jurisdiction of the Department of Labor; the Public

Health Service Act (PHS), which is within the jurisdiction of the

Department of Health and Human Services; and the Internal Revenue

Code, which is within the jurisdiction of the Department of the

Treasury. These ``shared provisions'' set forth Federal requirements

relating to portability, access, and renewability of group health

plans and group health insurance coverage provided by issuers.

Specifically, the shared provisions contain rules limiting the use

of preexisting condition exclusion periods, and prohibiting

discrimination against participants and beneficiaries based on

health status.

Section 104 of Title I of HIPAA requires that the three

departments ensure through an interagency memorandum of

understanding (MOU) that regulations, rulings and interpretations

issued by each of the departments relating to the same matter over

which two or more departments have jurisdiction, are administered so

as to have the same effect at all times. Section 104 also requires

the departments, through the MOU, to provide for coordination of

policies relating to enforcement of the same requirements in order

to have a coordinated enforcement strategy that avoids duplication

of enforcement efforts and assigns priorities in enforcement. The

three departments recently signed the MOU.

HIPAA also added certain provisions governing insurance in the

group and individual markets, and with respect to non-Federal

government plans which are contained only in the Public Health

Service Act and thus are not within the regulatory jurisdiction of

the Department of Labor or the Department of the Treasury. Section

101(b) of HIPAA provides that the Department of Labor is not

authorized to enforce any of the portability requirements of part 7

of ERISA (the ``shared'' provisions) against a health insurance

issuer offering health insurance coverage in connection with a group

health plan, although individuals covered under ERISA can bring

suit. Also, governmental plans, as defined in section 3(32) are

exempt from ERISA, under section 4(1) of ERISA. Thus the scope of

the MOU is limited, with respect to coordination of enforcement

activities, to enforcement of shared provisions. Enforcement of

these provisions constitutes only a relatively small portion of

HCFA's responsibilities.

---------------------------------------------------------------------------

The Newborns' and Mothers' Health Protection Act of 1996 amended

the PHS Act to provide protections for mothers and their newborn

children with regard to the length of hospital stay following

childbirth. The Mental Health Parity Act of 1996 further amended title

XXVII of the PHS Act to provide for parity in the application of

certain annual and lifetime dollar limits on mental health benefits

with annual and lifetime dollar limits on medical/surgical benefits.

The Women's Health and Cancer Rights Act of 1998 amended the PHS Act to

provide certain protections for patients who elect breast

reconstruction in connection with a mastectomy (As used hereafter in

this preamble, HIPAA refers to title XXVII of the PHS Act, as added by

the Health Insurance Portability and Accountability Act of 1996, and

later amended by the Mental Health Parity Act of 1996, the Newborns'

and Mothers' Health Protection Act, and the Women's Health and Cancer

Rights Act of 1998.)

HIPAA added two preemption provisions to the PHS Act. With respect

to HIPAA's preexisting condition exclusions rules and special

enrollment rights contained in section 2701 of the PHS Act, State law

cannot differ in any way from the Federal requirements, except to

expand the protections in one of several ways specifically permitted by

the statute (See section 2723(b). With respect to HIPAA's other

requirements, for example, HIPAA's non-discrimination provisions, State

laws are preempted only to the extent they prevent the application of

any requirement of HIPAA. (See section 2723(a)).

[[Page 45787]]

HIPAA affirms that the States are the primary regulators of health

insurance coverage in each State. However, in the event that a State

either does not enact legislation that meets or exceeds the Federal

health insurance requirements, if it or otherwise fails to

substantially enforce the HIPAA standards, the Health Care Financing

Administration (HCFA) enforces the HIPAA requirements that apply to

health insurance issuers offering coverage within that State.

HCFA is also responsible for enforcing the HIPAA requirements with

respect to non-Federal governmental plans. Non-Federal governmental

plans that are not provided through health insurance coverage may elect

exemption from one or more requirements of HIPAA, but must comply with

requirements regarding certification and disclosure of creditable

coverage.

II. Provisions of the Proposed Regulations

Subpart A--General Provisions

Section 150.101 Basis and Scope

On April 8, 1997, we published regulations to implement HIPAA by

adding 45 CFR parts 144, 146, and 148. The enforcement provisions of

that rule are contained in Secs. 146.184, 148.200, and 148.202. Now

that HCFA has had experience with direct Federal enforcement in some

States, we have determined that it is necessary to provide more detail

on the procedures that will be used to enforce HIPAA when a State does

not do so. We are adding a new part that will revise and expand the

provisions contained in Secs. 146.184, 148.200, and 148.202. Those

sections are deleted.

This new part, 45 CFR part 150, consists of four subparts. Subpart

A explains the scope and basis of this regulation and presents

definitions that supplement definitions located in 45 CFR 144.103 and

148.103. Subpart B describes how HCFA determines whether to assume

enforcement authority in a State and explains the process for

transferring such authority back to the State. Subpart C describes

procedures for assessing civil money penalties. Examples of specific

situations that may trigger the assessment are listed in Appendix A to

Subpart C. Subpart D describes the administrative appeals process.

Section 150.103 Definitions

In order to convey the requirements of 45 CFR part 150, we are

defining a number of terms that will be found at 45 CFR 150.103. Terms

found at 45 CFR part 150 have the same meaning given to them in 45 CFR

144.103 and 148.103, unless otherwise indicated. Section 150.103 will

include definitions of the following terms: amendment, endorsement or

rider; application; certificate of insurance; complaint; group health

insurance policy or group policy; individual health insurance policy or

individual policy; plan document; and State law.

Subpart B--HCFA Enforcement Processes for Determining Whether States

Are Failing To Substantially Enforce HIPAA Requirements

This subpart describes the steps we will take to determine whether

a State is failing to substantially enforce HIPAA requirements and the

notification procedures we will follow prior to beginning direct

enforcement.

Section 150.201 State Enforcement

HIPAA affirmed the States' role as the primary regulator of health

insurance in each State. Consistent with HIPAA, Sec. 150.201 will state

that, except as provided in subpart B, each State enforces HIPAA

requirements with respect to health insurance issuers that issue, sell,

renew, or offer health insurance coverage in the State.

Section 150.203 Circumstances Requiring HCFA Enforcement

Federal enforcement is triggered in two instances: (1) A State

notifies us that it has not enacted the necessary legislation to bring

its laws into compliance with HIPAA requirements or that it is

otherwise not substantially enforcing those requirements; or (2) a

State does not notify us of its failure to substantially enforce HIPAA

requirements, but we receive or obtain information that forms the basis

for HCFA's determination that such a failure is occurring. When we

receive such notification or make such a determination, we will discuss

with State officials the requirements that are not substantially

enforced and begin Federal enforcement of those requirements.

With regard to the group health insurance market, section

2722(a)(2) of the PHS Act requires Federal enforcement of any

``provision (or provisions)'' that a State fails to substantially

enforce. Therefore, it is possible that a State could enforce some

group market provisions while HCFA enforces others.

With regard to the individual market, section 2761(a)(2) of the PHS

Act calls for Federal enforcement of the ``requirements of this part''

whenever a State fails to substantially enforce them. However, HCFA

does not enforce those State laws that constitute an ``acceptable

alternative mechanism'' (as defined in Sec. 148.128) for enforcing

guaranteed availability regulations. In addition, HIPAA does not

preempt State laws that afford greater protections to HIPAA-eligible

individuals than HIPAA without preventing the application of a HIPAA

requirement. Thus, in the individual market, it is also possible that

HCFA will enforce some requirements while the State enforces others.

The complexity of the situation varies from one State to another and

requires careful consideration on a case-by-case basis.

Section 150.205 Sources of Information Triggering an Investigation of

State Enforcement

The interim final regulations provide more specific guidance on

situations in which there is no formal complaint, but other information

indicates that a State's failure to substantially enforce may exist.

Information regarding an alleged failure to enforce may come from a

variety of sources, including, but not limited to--

A complaint;

Informal contacts with State officials;

Communication with other individuals, such as brokers and

agents, or consumers themselves; and

Reports in the news media.

When we receive information indicating that a failure to

substantially enforce might exist in a particular State, we will write

to the governor and the commissioner of insurance or chief insurance

regulatory official of that State (and/or the official responsible for

regulating HMOs if the alleged failure involves HMOs) to inquire about

the status of HIPAA enforcement in the State. Further action on our

part will be dictated by the nature of the State's answer. If a State

informs us that it is enforcing all of the requirements of HIPAA and

provides a satisfactory explanation of why there is no failure, we will

take no further action unless there are further indications to

contradict the State's assertion.

Sections 150.207-150.219 Procedure for Determining That a State Fails

to Substantially Enforce HIPAA Requirements

If we receive a complaint indicating that a State is failing to

substantially enforce the law, we will first make a preliminary

assessment of whether the complainant who is adversely affected has

made a reasonable effort to resolve the issue through any remedies

available under State law (Sec. 150.209). We will contact the

complainant to

[[Page 45788]]

determine actions already taken, including whether State officials have

been notified and what action, if any, those officials have taken. We

may also contact State officials informally to discuss the situation.

If we receive information other than an individual complaint, we will

initiate similar contact with State officials.

In accordance with Sec. 150.211, we will send a written notice to

the State if we find that there is a reasonable question as to whether

the State is failing to substantially enforce HIPAA requirements. The

notice will be addressed to--

(1) The governor or chief executive officer of the State;

(2) The insurance commissioner or chief insurance regulatory

official; and

(3) If the alleged failure involves HMOs, the official responsible

for regulating HMOs if different from the individual identified in (2).

Under Sec. 150.213, the notice to the State will identify the

requirement or requirements of HIPAA for which there is evidence of a

potential failure to enforce and will describe the facts of any alleged

violation by an issuer or the ways in which the State law fails to

acceptably implement HIPAA. The letter will further explain that the

consequence of a State's failure to substantially enforce those

requirements is that HCFA will do so. The notice will give the State 30

days to respond unless an extension is granted.

In the interim final regulations published on April 8, 1997, a

response time of 45 days was allowed. This regulation shortens the

response time to 30 days to lessen any adverse impact on consumers.

This shorter response time appears to balance the States' prerogative

to enact and enforce their own insurance laws with the consumer rights

and protections that the Congress intended to guarantee when it enacted

HIPAA. We invite comment on this change.

We may extend the 30-day response period for good cause at a

State's request (see Sec. 150.215). The length of the extension period

granted may vary depending upon the specific circumstances of the

situation; thus, the regulation does not set forth a prescribed

extension period. Extensions will be granted based upon the

circumstances, and at our discretion.

Example: The State replies to our notice by stating that some State

regulators had been unclear on the scope of their new responsibilities.

Having recognized the problem, the State plans to train all affected

regulatory staff as quickly as possible. However, it is unlikely that

the State will be able to assure us within 30 days that full HIPAA

enforcement is taking place. Therefore, the State requests an extension

until staff training is completed.

If, at the end of 30 days (and any extension), the State does not

establish to our satisfaction that it is substantially enforcing the

requirements described in the notice, we may, after further

consultation with the appropriate State officials or their designees,

send the State a notice of preliminary determination (see

Sec. 150.217). The notice of preliminary determination will specify the

HIPAA requirements that the State has failed to substantially enforce.

The notice will afford the State a reasonable opportunity to present

evidence of substantial enforcement.

We will allow the State a reasonable opportunity--normally, 30

days--to correct its failure to substantially enforce the requirements

identified in the preliminary determination. However, in accordance

with Sec. 150.219, if we find that the State has not taken the

necessary corrective action, we will issue a final written

determination. The final determination will identify the HIPAA

requirements that HCFA is enforcing. The notice will also specify the

effective date of HCFA's enforcement. This date may be retroactive to

apply so that civil monetary penalties, that HCFA later assesses, may

take into account violations that occurred after the effective dates

specified in HIPAA or a date that HCFA identifies as the point at which

the State's failure to substantially enforce the specified requirements

commenced. HCFA does not enforce a State law that was enacted as an

alternative mechanism. However, in the case of a State that is found

not to be implementing its acceptable alternative mechanism, and also

is found not to be substantially enforcing the Federal fallback

regulations on guaranteed availability, HCFA will enforce the HIPAA

requirements as of the date that HCFA determines that the State has

failed to enforce. HCFA does not enforce a State law that was enacted

as an alternative mechanism.

In cases where HCFA assumes enforcement responsibility in a State,

the transition to Federal enforcement should be as smooth as possible

in order to protect consumers and create as little disruption as

possible for health insurance issuers.

Section 150.221 Transition to State Enforcement

When the State demonstrates that it is prepared to undertake

substantial enforcement and if and when we determine that

responsibility for enforcement should be returned to the State, we will

enter into discussions with State officials to ensure that a smooth

transition back to State enforcement is effected, especially with

respect to the handling of consumer inquiries and complaints. To the

extent practicable and legally permissible, we will make available to

the State our records documenting issuer compliance, as well as other

relevant areas of our enforcement operations, for incorporation into

the records of the regulatory authority assuming jurisdiction. We

invite comments on the transition procedures described in this

subsection.

Subpart C--HCFA Enforcement With Respect to Issuers and Non-Federal

Governmental Plans--Civil Money Penalties

This subpart describes the bases for imposing civil money penalties

against non-Federal governmental plans, and, in those States in which

we are enforcing the HIPAA requirements, against health insurance

issuers that are not complying with the requirements of HIPAA.

The basis for our enforcement actions are the requirements of 45

CFR parts 146 and 148 as set forth in the interim final rules published

on April 8, 1997 in the Federal Register, as well as the rules

published on December 22, 1997 (implementing the Mental Health Parity

Act of 1996) and October 27, 1998 (implementing the Newborns' and

Mothers' Health Protection Act of 1996), and the requirements in

sections 2706 and 2752 of the PHS Act (relating to the Women's Health

and Cancer Rights Act of 1998). Those rules explain practices to which

issuers and non-Federal governmental plans are required to adhere.

However, since publication of the April 8, 1997 rules, we have become

aware of actions taken by issuers and other responsible entities that

are inconsistent with several requirements of HIPAA but are not

specifically addressed in the rules. We addressed some of these actions

in Bulletin 98-01, discussed below. In an appendix to Subpart C we

provide a list of business practices or situations, including those

listed in the bulletin, that violate HIPAA and may trigger enforcement

action. This list is not all-inclusive. Rather, it highlights the

compliance problems that we have encountered most frequently.

This subpart establishes an enforcement process that ensures the

rights of individuals protected by HIPAA and provides for due

consideration toward health insurance issuers and non-Federal

governmental plans. This subpart explains the process

[[Page 45789]]

for investigating complaints to determine whether a violation has

occurred, and, when necessary, the process for assessing a civil money

penalty. In addition, this subpart provides suggestions to issuers and

other responsible entities of possible ways to avoid civil money

penalties through early identification of compliance problems.

Section 150.301 General Rule Regarding the Imposition of Civil Money

Penalties

Section 150.301 states that any health insurance issuer or non-

Federal governmental plan, or employer that sponsors a non-federal

government plan, subject to our enforcement authority that fails to

comply with HIPAA may be subject to a civil money penalty as described

in this subpart.

Section 150.303 Information Initiating Administrative Action or

Investigation

In accordance with Sec. 150.303, any individual or any entity

acting on his or her behalf may request that we investigate the

possible denial or abridgement of a HIPAA right. Complaints may be

directed to any of our regional offices where the complaint will be

either investigated or forwarded to the appropriate office for

investigation. Information about all complaints received will be

accessible to all HCFA staff involved in HIPAA enforcement in both the

central and regional offices.

Since many individuals protected by HIPAA will not initiate

complaints because they are unaware of their rights under the law and

therefore do not realize when their rights are being denied or

abridged, HCFA will consider other information when determining whether

a State is substantially enforcing HIPAA or when determining the

compliance of an issuer or other responsible entity as defined in

Sec. 150.305 (Determination of entity liable for civil money penalty).

Essentially, ``other information'' means any information HCFA receives

from any source that indicates that a potential violation of HIPAA has

been committed by a health insurance issuer or other responsible

entity. Other information includes any other indication that an issuer

or non-Federal governmental plan fails to meet any requirement of

HIPAA. Sources of information that we may rely upon include, but are

not limited to:

Reports and information collected from State insurance

departments, the National Association of Insurance Commissioners, and

other State, local, and Federal entities;

Information received through HCFA's enforcement activities

and from other sources that may include policy form review and market

conduct examinations.

Section 150.305 Determination of Entity Liable for Civil Money Penalty

Health insurance issuers that issue, sell, renew, or offer coverage

to either private employers that sponsor group health plans or to non-

Federal governmental plan sponsors are responsible for compliance with

HIPAA and applicable implementing regulations at 45 CFR part 146.

Under Sec. 150.305, we consider a health insurance issuer to be

subject to a civil money penalty if a group health insurance policy it

sells is written, serviced, or administered in a manner that fails to

comply with, or conflicts with, an applicable requirement of HIPAA. To

the extent that a group health plan is subject to HIPAA, a health

insurance issuer may be liable for the penalty even if a group health

plan sponsor had expressly requested that the issuer provide a policy

that does not comply with one or more requirements of HIPAA. In that

situation, the issuer should inform the plan sponsor that it would be

illegal to sell such a policy and refuse to structure the policy as

requested. With regard to health insurance sold in the individual

market, the issuer is the responsible entity and therefore liable for

any assessed civil money penalty. To the extent that policies sold in

the individual market are subject to the requirements of HIPAA, issuers

are responsible for ensuring that their policies comply and are

marketed and administered in accordance with those requirements and

applicable implementing regulations at 45 CFR Part 148. In addition,

when a policy does not comply with applicable HIPAA requirements, the

issuer may be subject to a civil money penalty irrespective of whether

the issuer sold the policy directly, or a broker or agent sold the

policy on the issuer's behalf.

Under section 2722(b)(1)(B) of the PHS Act, we have direct

enforcement authority with respect to group health plans that are non-

Federal governmental plans. A non-Federal governmental plan sponsored

by one or multiple non-Federal governmental entities is subject to

HIPAA to the same extent as any other group health plan, unless, in the

case of a non-Federal governmental plan that is not provided through

health insurance coverage, the plan sponsor(s) has (have) elected to

exempt the plan from one or more HIPAA provisions (as permitted under

45 CFR 146.180, and section 2721(b)(2) of the PHS Act).

When the sponsor of a non-Federal governmental plan does not elect

to have its plan exempted from one or more HIPAA requirements and the

plan fails to comply with one or more applicable provisions of HIPAA,

we enforce the law, and either the plan or the non-Federal governmental

employer sponsoring the plan is subject to a civil money penalty. In

accordance with section 2722(b)(2)(B) of the PHS Act, if the plan is

sponsored by a single non-Federal governmental employer, the non-

Federal governmental employer is subject to the penalty; if the plan is

sponsored by two or more non-Federal governmental employers, the plan

is subject to the penalty.

Separate civil money penalties may be assessed against an issuer

and a non-Federal governmental plan or employer, depending upon the

circumstances of the compliance failure(s). A civil money penalty, or

penalties, will be determined in accordance with sections 150.317

through 150.325.

Section 150.307 Notice to Responsible Entities

Under Sec. 150.307, when we receive a complaint or other

information indicating a possible violation of HIPAA, we will provide

written notice to the responsible entity(ies) that describes the

substance of the complaint or other information and any identifiable

actions that need to be taken to come into compliance. The notice will

also provide the responsible entities 30 days from the date of the

notice in which to respond. Furthermore, the notice will state that a

civil money penalty may be imposed if the entity fails to comply.

Section 150.309 Request for Extension

Section 150.309 will allow issuers and other responsible entities

to request an extension of time to respond to the notice. We will

consider granting the request provided:

(1) The request for the extension is made in writing;

(2) The issuer or other responsible entity can show good cause; and

(3) A complete response can be provided within the additional time

granted by HCFA.

This section, which allows for additional time, will benefit both

issuers and other responsible entities that are unable to respond to an

inquiry from us within 30 days regarding a potential HIPAA violation.

Failure to respond to a notice from HCFA within 30 days, or any

extended time frame, may result in the assessment of a civil money

penalty based upon the complaint or other information. This section

reflects HCFA's interest in ensuring complete responses. However, in

deciding

[[Page 45790]]

whether to grant the extension, HCFA will also consider the facts and

circumstances of the situation to assure thet individuals are not

adversely affected.

Section 150.311 Responses to Allegations of Noncompliance

Section 150.311 will state that in determining whether to assess a

civil money penalty and the amount of any such penalty, HCFA will

consider documentation provided by an issuer or other responsible

entity. If documentation substantiates that the violation was corrected

within 30 days of the first day that the responsible entity knew, or

exercising reasonable diligence, could have known of the violation,

then no civil money penalty may be imposed (see Sec. 150.341). However,

if the correction is made beyond the 30 days, we will review all

documentation supporting a responsible entity's efforts to comply with

HIPAA and, under appropriate circumstances, take such efforts into

account in our calculation of the amount of the penalty. In general, we

view more favorably responses where the rights and protections afforded

consumers are quickly and completely restored, and where the issuer or

other responsible entity can demonstrate that adequate changes have

been made to ensure future compliance.

Examples of documentation that may be included in a response

include:

Relevant policy forms, advertising material, and other

documents

Other evidence refuting the alleged noncompliance

Evidence showing the approximate cost to the affected

individual(s)

Evidence showing the number of individuals affected

Evidence that the entity did not know, or exercising due

diligence would not have known, of the violation

Documentation proving that issued policies and/or

certificates of coverage and plan documents were amended to comply with

HIPAA and showing the date of such amendment

Documentation of the issuance of forms that comply with

HIPAA (with respect to any forms that were submitted and reviewed by

us, such documentation may also include any final letter from us that

closed the review)

Evidence documenting the development and implementation of

internal policies and procedures to ensure HIPAA compliance (including

corporate compliance programs)

Other evidence showing the entity's prior record of HIPAA

compliance

Section 150.313 Market Conduct Examinations

In 1974 the National Association of Insurance Commissioners

recommended the establishment of a ``separate and distinct'' program of

surveillance to ensure fair treatment of insurance policyholders. Since

then, these surveillance programs, known as ``market conduct

examinations,'' have been an essential tool used by State insurance

departments to confirm the compliance of issuers with various State

insurance laws and regulations.

Market conduct examinations differ from traditional financial

audits performed on issuers by either regulators or the companies

themselves. While financial audits are primarily concerned with the

financial solvency of a company, market conduct examinations are

primarily concerned with the issuer's compliance with legal

requirements because the issuer's business practices impact consumers

directly. For example, while an issuer may be judged financially strong

through a financial audit, if this financial strength is obtained

through non-compliant claim denials, the issuer could ``pass'' a

financial audit, while ``failing'' a market conduct examination.

Pursuant to guidelines of the National Association of Insurance

Commissioners and State insurance laws, State insurance departments

charge the expenses of a market conduct examination directly to the

issuer. In contrast, HCFA will not require an issuer or other

responsible entity to bear the expense of a market conduct examination.

During a HCFA market conduct examination, HCFA will sample and, in some

cases, review in their entirety specific records, information, and

other documentation maintained by the issuer or other responsible

entity to determine compliance with the specific requirements of HIPAA.

HCFA market conduct examinations will differ from traditional State

insurance department examinations in that the scope of HCFA's reviews

will be much narrower, focusing on the provisions and requirements of

HIPAA.

For example, areas of HCFA examinations may include, but are not

limited to:

The issuer's, or non-Federal governmental plan's

certificate of creditable coverage issuance procedures and practices;

Claim denials based on pre-existing condition exclusion

provisions of the issuer's, or the non-Federal governmental plans;

The issuance of guaranteed available individual and small

employer group products; or

The guaranteed renewability of health insurance policies.

A market conduct examination may be performed at HCFA's initiation,

or upon request of a potential responsible entity. During the course of

a complaint investigation, HCFA may determine that a pattern of

noncompliance exists to warrant a market conduct examination. An

issuer, or a non-Federal governmental plan, may request a market

conduct examination to confirm compliance or to identify potential

violations and initiate corrective action that may enable it to

completely avoid imposition of a civil money penalty under Sec. 150.315

of this subpart. If we identify potential violations, we will provide

notice to the issuer or other responsible entity of such defects and

may present a proposed plan of correction.

A market conduct examination may be performed through either on-

site examinations, when appropriate; or ``in-house'' examinations or

``desk audits'' at a HCFA location. In general, on-site examinations

are appropriate when we have reason to believe that, in order to obtain

and have ready access to all of the information necessary to identify

existing failures to comply with HIPAA or confirm the compliance of an

issuer, or a non-Federal governmental plan, it is necessary for our

examiners to be at a responsible entity's site. On-site examinations

may also be appropriate when the market share of an issuer represents a

significant portion of the marketplace in a State or when an issuer's

entire program for HIPAA compliance is the subject of the examination.

In general, a ``desk audit'' is sufficient to confirm a responsible

entity's compliance with regard to a specific area(s) of compliance or

when circumstances make an on-site examination impracticable.

When HCFA identifies an issue that warrants investigation, HCFA

will appoint one or more examiners to perform the examination and

instruct them as to the scope of the examination. HCFA will observe the

guidelines adopted by the NAIC and may employ additional guidelines as

deemed appropriate. Upon completion of the market conduct examination,

HCFA will develop a report that will address the results of the

examination. Responsible entities will be advised of HCFA's position on

each issue contained in the report. The purpose of the report is to

identify areas of the business or operational affairs of the

responsible entity that may need to be corrected.

[[Page 45791]]

Sections 150.315 Through 150.323 Provisions Relating to the Amount of

Penalty

These sections of the regulation establish the process for

determining the amount of any penalty that is imposed on a responsible

entity for a violation of a provision or requirement of HIPAA. The

statute allows for a penalty that does not exceed $100 for each day for

each individual with respect to each violation. The statute further

requires at section 2722 that, in determining the amount of the

penalty, the responsible entity's previous record of compliance as well

as the gravity of the violation be taken into consideration. Therefore,

in determining the amount of the penalty, we intend to use a process

that takes into account both mitigating and aggravating circumstances.

We will take into account evidence of the entity's efforts to comply

with HIPAA in assessing the entity's previous record of compliance.

This will be determined largely through documentation submitted by the

responsible entity during the course of the investigation of the

complaint or other information. We will consider the gravity of the

violation by reviewing the frequency of the violation as well as the

level of the financial impact on any affected individuals.

Responsible entities that discover violations are encouraged to

take all necessary steps to correct the violations and identify the

individuals adversely affected and restore their rights. Under

Sec. 150.319, those actions taken by responsible entities to correct

the violations and restore individuals' rights will be considered

mitigating circumstances and will be taken into account to reduce the

penalty or assessment.

Conversely, under Sec. 150.321, we will consider as aggravating

circumstances instances in which violations that appear to be frequent

have resulted in an obvious or significant financial and other impacts

on affected individuals or cannot be adequately corrected. These

parameters will be considered in determining the gravity of the

violation. In determining the appropriate amount of the penalty and

assessment to be imposed, we will take into account all mitigating and

aggravating circumstances outlined by these sections.

Section 150.325 Settlement Authority

This section will state that nothing in Secs. 150.315 through

150.323 limits our authority to settle any issue or case or to reduce

any penalty or assessment.

Section 150.341 Limitations on Penalties

This section explains that HCFA will not impose any civil money

penalty on any failure if the failure was due to reasonable cause and

not due to willful neglect and the failure was corrected within 30 days

of the first day that any of the entities against whom the penalty

would be imposed knew, or exercising reasonable diligence would have

known, that the failure existed. The burden of establishing that the

responsible entity did not know, and exercising reasonable diligence,

could not have known that a failure existed, is on the responsible

entity.

Section 150.343 Notice of Proposed Penalty

This section of the regulation further describes the information to

be disclosed in the written notice of the proposed penalty to the

responsible entity, including instructions to the responsible entity

for responding and an explanation of the entity's right to a hearing if

the responsible entity is appealing the proposed penalty.

Section 150.345 Appeal of Proposed Penalty

We include this section to direct the reader to our appeal

procedures.

Section 150.347 Failure to Request a Hearing

This section of the regulation describes our responsibility to

notify the entity in writing of the assessed penalty and the means by

which to satisfy the judgment following the entity's failure to request

a hearing within the specified period of time.

Appendix A to Subpart C of Part 150--Examples of Violations

This Appendix A includes examples of practices which, if undertaken

by issuers, or non-federal governmental plans, may warrant the

imposition of a civil money penalty. For convenience, the Appendix is

divided into the group and individual markets and the types of

violations are listed in numerical order by regulatory citation number

in each of the two markets.

Subpart D--Administrative Hearings

This subpart describes the processes for administrative hearings

and appeals of civil money penalties.

Sections 150.401 Through 150.463

Sections 150.401 through 150.463 set forth the procedures for

appeal of HCFA's assessment of a civil money penalty. The PHS Act

provides that if a responsible entity appeals HCFA's assessment of a

civil money penalty, the administrative law judge hearing the appeal

makes the initial agency decision.

Although the administrative law judge makes the initial agency

decision, the considerations and factors set forth in this part are

binding on the administrative law judge's decision. The administrative

law judge may not add or disregard such considerations and factors in

deciding whether assessment of a civil money penalty is appropriate,

and the amount of such penalty.

Section 150.457 sets forth the process through which the HCFA

Administrator may vacate or modify the administrative law judge's

decision. Section 150.459 provides that any responsible entity against

whom a final assessment of a civil money penalty is made may appeal

that assessment to the appropriate United States District Court.

Section 150.465 Collection and Use of Penalty Funds

This section describes to whom (HCFA) penalty funds are paid and

how they may be used.

Sections 144.101, 144.102, and 144.103

We are adding provisions to include the new part 150. We are also

revising the definition of ``non-Federal governmental plan'' under

Sec. 144.103 because the existing definition reiterates the definition

in section 2791(d)(8)(C) of the PHS Act. This definition simply states

that the term ``non-Federal governmental plan'' means ``a governmental

plan that is not a Federal governmental plan.'' Section 2791(d)(8)(A)

defines the term ``governmental plan'' as that term is defined under

section 3(32) of ERISA. (Determining whether an entity is a

``governmental plan'' for purposes of section 3(32) of ERISA is within

the jurisdiction of the Department of Labor.) Subparagraphs (B) and (C)

of section 2791(d)(8), respectively, define ``Federal governmental

plan'' and ``non-Federal governmental plan''. ERISA does not separately

define these terms. Section 3(32) of ERISA, in pertinent part, defines

the term ``governmental plan'' as ``a plan established or maintained

for its employees by the Government of the United States, by the

government of any State or political subdivision thereof, or by any

agency or instrumentality of any of the foregoing.'' We have revised

the definition of the term ``non-Federal governmental plan'' by

adopting that portion of the ERISA definition of ``governmental plan''

that defines a non-Federal governmental plan.

[[Page 45792]]

Parts 146 and 148

We are deleting Secs. 146.184, 148.200, and 148.202, as these

provisions are now in part 150.

III. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995, we are required to

provide a 60-day notice in the Federal Register and solicit public

comment before a collection of information is submitted to the Office

of Management and Budget (OMB) for review and approval. This document

does not impose any information collection and record keeping

requirements subject to the Paperwork Reduction Act (PRA).

Consequently, it does not need to be reviewed by the Office of

Management and Budget (OMB) under the authority of the PRA.

IV. Response to Comments

Because of the large number of items of correspondence we normally

receive on Federal Register documents published for comment, we are not

able to acknowledge or respond to them individually. We will consider

all comments we receive by the date and time specified in the DATES

section of this preamble, and, if we proceed with a subsequent

document, we will respond to the major comments in the preamble to that

document.

V. Waiver of Proposed Rulemaking

We ordinarily publish a notice of proposed rulemaking in the

Federal Register and invite public comment on the proposed rule. The

notice of proposed rulemaking includes a reference to the legal

authority under which the rule is proposed, and the terms and

substances of the proposed rule or a description of the subjects and

issues involved. This procedure can be waived, however, if an agency

finds good cause that a notice-and-comment procedure is impracticable,

unnecessary, or contrary to the public interest and incorporates a

statement of the finding and its reasons in the rule issued. We believe

that dispensing with proposed rulemaking is in the public interest.

Proposed rulemaking is also unnecessary. Accordingly, we are proceeding

here directly with an interim final rule.

The basic requirements of this interim final rule already exist in

45 CFR parts 146 and 148. Therefore, we are not adding anything that

will impose new requirements. We do include provisions that will assist

health insurance issuers, and non-Federal governmental plans/employers,

by letting them know what they can do if we impose a civil money

penalty; for example, refute our findings or request a hearing. This

rule will also help individuals whose health insurance coverage is

subject to part 146 or 148 in that we will be better able to enforce

our rules and provide protections to individuals.

Therefore, we find good cause to waive the notice of proposed

rulemaking and to issue this rule as an interim final rule with comment

period. We are, however, providing a 60-day comment period and will

respond to comments we receive in any subsequent Federal Register

document.

VI. Regulatory Impact Statement

A. Overall Impact

We have examined the impacts of this rule as required by Executive

Order 12866 and the Regulatory Flexibility Act (RFA) (Pub. L. 96-354).

Executive Order 12866 directs agencies to assess all costs and benefits

of available regulatory alternatives and, if regulation is necessary,

to select regulatory approaches that maximize net benefits (including

potential economic, environmental, public health and safety effects,

distributive impacts, and equity). A regulatory impact analysis (RIA)

must be prepared for major rules with economically significant effects

($100 million or more annually). A discussion regarding the expected

economic effects of this interim final rule is presented below.

The RFA requires agencies to analyze options for regulatory relief

of small businesses. For purposes of the RFA, small entities include

small businesses and nonprofit organizations. Entities are considered

small either because of nonprofit status or because of having revenues

of $5 million or less annually. For purposes of the RFA, we consider it

unlikely that many health insurance issuers will meet this definition

of small entity. This interim final rule will also affect non-Federal

governmental plans, but these plans do not meet the definition of a

small entity.

Section 202 of the Unfunded Mandates Reform Act of 1995 also

requires that agencies assess anticipated costs and benefits before

issuing any rule that may result in an annual expenditure by State,

local, or tribal governments, in the aggregate, or by the private

sector, of $100 million. Although this interim final rule will affect

State and local governments and health insurance issuers in the private

sector, such impact is expected to be minimal and less than $100

million in the aggregate. Set forth below is a discussion regarding the

expected impact of this interim final rule.

B. Anticipated Effects

The Congress intended that the protections provided in HIPAA be

afforded to all Americans, regardless of whether such protections are

guaranteed by States or the Federal government. These regulations are

intended to expand upon the basic process for Federal enforcement of

HIPAA. Federal enforcement presently exists in California, Missouri and

Rhode Island. We estimate that approximately 325 health insurance

issuers offer health insurance coverage in these States and would

therefore be affected by these regulations. While we recognize that

direct Federal enforcement may become necessary in additional States,

we are unable to predict the number of States or issuers affected in

the future. We expect these regulations to impose a minimal burden on

States, health insurance issuers, and non-Federal governmental plans/

employers but we invite comments from affected parties regarding the

potential or real impact of these regulations.

1. Effects on State and Local Governments

The primary impact of these regulations on States is to clarify the

process by which we determine that Federal enforcement is necessary. As

described in the regulations, which closely follow the statutory

language, we determine that Federal enforcement is necessary when

either a State notifies us of its failure to enact and/or enforce the

necessary legislation; or we receive information or otherwise discover

that a State is not substantially enforcing HIPAA. We are exercising

our regulatory discretion where necessary to ensure that consumers are

protected to the full extent of the law. The impact of our regulatory

discretion with respect to States is discussed below.

These regulations will also affect State and local governments to

the extent that these governments provide health plans to their

employees. These plans, designated as non-Federal governmental plans

under HIPAA, are subject to our direct enforcement, but those that are

self-funded are permitted to elect to be exempt from one or more HIPAA

provisions, with the exception of the requirement that the plan issue

certificates of creditable coverage. The impact of these regulations on

non-Federal governmental plans is discussed below under subsection 2.

These regulations, however, will not affect health plans provided by

tribal governments because such entities are not covered by the PHS Act

and are

[[Page 45793]]

therefore not subject to our direct enforcement.

The interim final regulations published on April 8, 1997 (42 CFR

Parts 144, 146, and 148) address the situation in which we learn of a

State's failure to substantially enforce the HIPAA provisions by a

``complaint or other means.'' These interim final regulations clarify

the scope of the term ``other means'' to include informal contact

between us and State officials, a report in the news media, periodic

communication by us with the States, periodic review of State health

care legislation, or any other information that indicates a substantial

failure to enforce. Since many individuals protected by HIPAA will not

initiate complaints because they are unaware of their rights under the

law and therefore do not realize when their rights are being denied or

abridged, we cannot limit the basis of our investigation solely to

complaints received from individuals. Therefore, we have clarified the

definition of ``other information'' to include other forms of

information so that we will learn about potential HIPAA violations and

if necessary, initiate enforcement action as soon as possible.

If we initiate an inquiry in a particular State, we may begin our

inquiry by informally contacting appropriate State officials. If a

State informs us that it is enforcing all of the HIPAA provisions and

requirements, we will take no further action unless there are further

indications to contradict the State's assertion. If we find that a

State has failed to substantially enforce HIPAA, we will allow the

State a reasonable opportunity to correct such a failure. It is only

when other efforts have failed that we will initiate the formal

determination process in a particular State. Thus, as permitted by

current regulations, while we may initiate an inquiry in a State on

information other than a complaint, these regulations that we are

publishing today will provide flexibility for the State to respond to

the inquiry and will allow the State a reasonable opportunity to

enforce HIPAA.

In the event that we determine that there is a reasonable basis for

finding a State's failure to substantially enforce HIPAA, we will

provide written notice to the chief executive officer of the State and

other appropriate State officials. In the interim final regulations

published on April 8, 1997 a response time of 45 days was allowed. This

regulation shortens the response time to 30 days in order to lessen any

adverse effect on individuals in that particular State. Individuals may

not incur a break in coverage of more than 63 days without losing their

right to HIPAA protections. Our primary concern is that individuals

receive rights to which they are entitled under HIPAA. This shorter

response time appears to strike a balance between the States'

prerogative to regulate health insurance issuers and the rights of

individuals that Congress intended to protect by enacting HIPAA. We

have invited comments on this change.

However, if a State is unable to respond to our inquiry within the

30-day response period, these regulations will allow us to extend the

30-day response period for good cause. We estimate that those States

responding to an inquiry will incur some costs in providing

information, whether orally or in writing, to demonstrate their

enforcement of HIPAA.

These regulations also provide a transition process from Federal

enforcement back to State enforcement if and when HCFA determines that

Federal enforcement is no longer necessary. The impact of these

transitional processes is difficult to estimate at this time. We invite

comments on this process and the possible impacts associated with it.

2. Effects of These Regulations on Non-Federal Governmental Plans

State and local governmental plans may offer health insurance

coverage to their members through an issuer or may self-insure their

members. For those non-Federal governmental plans that offer health

insurance coverage through an issuer, violations by the non-Federal

governmental plan are subject to our enforcement. Violations by the

issuer are subject to enforcement by the State unless HCFA is directly

enforcing HIPAA requirements in that State. Those plans that self-

insure their members (i.e., do not purchase insurance from an insurance

issuer) are subject to our enforcement but are also permitted to elect

exemptions from one or more HIPAA requirements. To date, approximately

615 self-insured non-Federal governmental plans have notified us of

their intent to opt out of one or more HIPAA provisions. Since self-

insured non-Federal governmental plans are permitted to elect exemption

from one or more HIPAA provisions, we expect to find relatively few of

these plans out of compliance with HIPAA. While the exact number of

non-Federal governmental plans is not known at this time, we do not

expect many more plans to exercise their right to opt out. In general,

the effects of the regulations on health insurance issues as discussed

below under subsection 3, also apply to non-Federal governmental

plans/employers that are subject to HIPAA requirements.

3. Effects of the Regulations on Health Insurance Issuers Offering

Individual or Group Health Insurance Coverage

In those instances in which HCFA enforces HIPAA, we are responsible

for enforcing HIPAA with respect to health insurance issuers. As stated

above, we estimate that 325 health insurance issuers issue policies in

those three States currently subject to Federal enforcement in the

individual market, group market, or both (California, Missouri, and

Rhode Island). These issuers will be primarily affected to the extent

that they fail to comply with the HIPAA provisions and requirements.

Issuers will be required to establish new relationships and communicate

directly with Federal officials. Thus, issuers may incur some costs as

they develop and maintain new processes for dealing with Federal

regulators. However, in those States in which we have begun directly

enforcing HIPAA, we have already held meetings with health insurance

issuers and provided information about appropriate Federal officials

and general enforcement processes. Thus, to some extent, new

relationships between health insurance issuers and Federal officials

have already been established in those States. Issuers in those States

will therefore incur only minimal costs in maintaining these

relationships.

As part of our direct enforcement responsibilities, we may request

additional information from issuers pursuant to a complaint or other

information. This may impose a burden on issuers to the extent that

they must submit additional information to us in response to a

complaint. These interim final regulations will provide a process for

doing so that is similar to the complaint resolution process currently

in practice in many States. If a complaint or other information we

receive indicates a potential violation, we will provide written notice

to the issuer and provide 30 days from the date of the notice for the

issuer to respond with additional information. This time frame may be

more lenient than similar State requirements, which provide as few as

15 working days or 20 calendar days for the issuer's response. If the

30-day period is not sufficient, the issuer may request an extension

for good cause. We will consider the potential impact of granting an

extension on those individuals who may incur a significant break in

coverage as a result of the extension.

During an investigation of any potential violation, we will review

and consider documentation provided that

[[Page 45794]]

demonstrates the issuers compliance with HIPAA. These interim final

regulations will not require, but will suggest, documentation that an

issuer may submit in response to the complaint allegation. If, in the

course of an investigation of a potential violation, we discover a

pattern of noncompliance or any other issue that warrants further

investigation, we may initiate a market conduct examination of the

issuer. If, during the course of our examination, we identify a

potential violation(s), we will provide notice to the issuer of the

violation and a proposed plan of correction. While the issuer that

undergoes a market conduct examination may incur some costs in

providing the documentation requested pursuant to that examination, the

issuer may avoid the imposition of a civil money penalty or may be

subject to a civil money penalty of a lesser amount.

Although those health insurance issuers given notice of a potential

violation may incur additional costs in responding to our inquiry,

these costs are expected to be minimal and incurred only by a small

number of issuers. Generally, consumers will first seek redress by the

health insurance issuer and second by the State insurance department.

Complaints are then forwarded to one of our regional offices and

possibly our central office after the first two steps have been taken.

Therefore, the number of complaints that will be brought to our

attention will be relatively small given the universe of health

insurance issuers.

In those instances in which documents (e.g, new policy forms or

marketing materials) must be modified to meet the HIPAA standards,

issuers may have to resubmit these documents to the appropriate State

officials to be reviewed for compliance with other applicable State

laws. Thus, issuers may spend more time bringing new materials and

products to the market. However, in the absence of Federal enforcement,

these documents would have had to have been reviewed by State officials

for compliance with applicable HIPAA standards, as well as those of

other State laws. Under Federal enforcement, issuers are therefore

required to submit to a separate regulatory body--the Federal

government--only information they are already required to submit to the

State, and are expected to incur minimal costs in doing so.

In the event that an issuer is found to be in violation of HIPAA,

the Secretary of the Department of Health and Human Services is

authorized to impose civil money penalties of no more than $100 for

each day for each violation for each affected individual. These

regulations will provide further details regarding possible

alternatives to the imposition of a civil money penalty, including

returning adversely affected individuals to the same position in which

they would have been had the violation not occurred.

However, in the event that an issuer refuses to respond to or

resolve a complaint or other inquiry in a satisfactory manner, we will

assess the penalty and provide notice of this penalty to the health

insurance issuer. In assessing the penalty, we will consider several

mitigating factors, also enumerated in the current interim final

regulations, which include the issuer's record of prior compliance and

the gravity of the violation. We will also consider aggravating

circumstances, including the frequency of the violation, the financial

and other impacts of the violation on the average affected individual,

or the issuer's inability to show that substantially all of the

violations were corrected. Issuers will be permitted to request a

hearing and may also request a settlement or alternative dispute

resolution.

4. Effects on the Medicare and Medicaid Programs

We do not expect that this rule will have any impact on Medicare

expenditures or the solvency of the trust fund or on Medicaid program

expenditures.

5. Federalism

Under Executive Order 12612, this regulation will not significantly

affect the States beyond what is required by HIPAA. It follows the

intent and letter of the law and does not usurp State authority beyond

what the HIPAA requires. This regulation describes only processes that

must be undertaken to fulfill our obligation to conduct enforcement as

required by the April 8, 1997 regulation. In addition, HIPAA follows a

narrow preemption of State laws and does not preempt State laws that

afford greater protections to HIPAA-eligible individuals.

We have included various provisions throughout this regulation that

demonstrate cooperation with the States. For example, States are

afforded the opportunity to enforce HIPAA requirements, which is the

preferred avenue of HIPPA implementation. If we receive information

that a State is not substantially enforcing, we first ask whether State

officials have been notified. We may also contact State officials

informally to discuss the requirements that are allegedly not being

enforced. If the State provides a satisfactory explanation that

indicates it is enforcing the HIPAA requirements, we will take no

further action unless we receive further information to validate the

assertion that the State is failing to enforce the requirements.

If there is a reasonable question regarding whether a State is

failing to substantially enforce HIPAA requirements, we will send our

preliminary determination to the chief executive officer of the State,

as well as to other appropriate regulatory officials of the State. This

preliminary determination will provide the State with a reasonable

opportunity to present evidence of substantial enforcement, to take

corrective action, and under certain specific circumstances, with an

opportunity to request an extension.

If we subsequently find that a State is not enforcing the HIPAA

requirements, we will issue a final written determination that will

identify the requirements that we will enforce and the effective date

of our enforcement. Under certain circumstances it is even possible

that States may enforce certain requirements while we enforce others.

After we have assumed enforcement responsibility in a State, should

the State demonstrate that it is prepared to begin its own enforcement

we may, at our discretion, enter into discussions with State officials

regarding the possibility of a transition back to State enforcement. In

this case, to the extent permissible, we will make our records

documenting compliance and enforcement available for incorporation into

State records.

C. Alternatives Considered

Throughout the process of developing these regulations, we

attempted to balance States' interest in regulating health insurance

issuers and the rights of those individuals that the Congress intended

to protect in enacting HIPAA. In those cases where we are exercising

regulatory discretion (described above), we are allowing States the

maximum amount of flexibility without jeopardizing the individual's

rights to the HIPAA protections. Likewise, we are attempting to

establish a process for investigating complaints and other information

regarding potential HIPAA violations that serves as an effective

deterrent to HIPAA violations. This process will provide ample notice

to the issuer and other responsible entities under investigation and

will provide guidance to issuers and other responsible entities that

wish to comply with the HIPAA provisions. We expect these regulations

to impose a minimal burden on States, health insurance issuers, and

non-Federal governmental plans/employers but we invite

[[Page 45795]]

comments from affected parties regarding the potential or real impact

of these regulations.

D. Conclusion

In accordance with the requirements of the RFA, we have performed

the above analysis, and we believe that there will be minimal impact on

small entities. We request comments on our findings. In accordance with

the provisions of Executive Order 12866, this regulation was reviewed

by the Office of Management and Budget.

List of Subjects Affected

45 CFR Parts 144 and 146

Health care, Health insurance, Reporting and recordkeeping

requirements.

45 CFR Part 148

Administrative practice and procedure, Health care, Health

insurance, Penalties, Reporting and recordkeeping requirements.

45 CFR Part 150

Administrative practice and procedure, Health care, Health

insurance, Penalties, Reporting and recordkeeping requirements.

For the reasons set forth in the preamble, 45 CFR subtitle A,

subchapter B, is amended as set forth below:

A. Part 144 is amended as follows:

PART 144--REQUIREMENTS RELATING TO HEALTH INSURANCE COVERAGE

1. The authority citation for part 144 continues to read as

follows:

Authority: Secs. 2701 through 2763, 2791, and 2792 of the Public

Health Service Act (42 U.S.C. 300gg through 300gg-63, 300gg-91, and

300gg-92).

2. Section 144.101 is revised to read as follows:

Sec. 144.101 Basis and purpose.

(a) Part 146 of this subchapter implements sections 2701 through

2723 of the Public Health Service Act (PHS Act, 42 U.S.C. 300gg, et

seq.). Its purpose is to improve access to group health insurance

coverage, guarantee the renewability of all coverage in the group

market, provide certain protections for mothers and newborns with

respect to coverage for hospital stays in connection with childbirth,

and provide parity between the application of annual and lifetime

dollar limits to mental health benefits and those limits for other

health benefits and to provide certain protections for patients who

elect breast reconstruction in connection with a mastectomy.

(b) Part 148 of this subchapter implements sections 2741 through

2763 of the PHS Act. Its purpose is to improve access to individual

health insurance coverage for certain individuals who previously had

group coverage, guarantee the renewability of all health insurance

coverage in the individual market, and provide certain protections for

mothers and newborns with respect to coverage for hospital stays in

connection with childbirth, and to provide certain protections for

patients who elect breast reconstruction in connection with a

mastectomy.

(c) Part 150 of this subchapter implements the enforcement

provisions of sections 2722 and 2761 of the PHS Act with respect to the

following:

(1) States that fail to substantially enforce one or more

provisions of part 146 concerning group health insurance or the

requirements of part 148 of this subchapter concerning individual

health insurance.

(2) Insurance issuers in States described in paragraph (c)(1) of

this section.

(3) Group health plans that are non-Federal governmental plans.

(d) Sections 2791 and 2792 of the PHS Act define terms used in the

regulations in this subchapter and provide the basis for issuing these

regulations.

3. In Sec. 144.102, paragraph (d) is added to read as follows:

Sec. 144.102 Scope and applicability.

* * * * *

(d) Provisions relating to HCFA enforcement of one or more

provisions of part 146 or the requirements of part 148, or both, are

contained in part 150 of this subchapter.

4. In Sec. 144.103, the title, the introductory text, and the

definition of non-Federal governmental plan are revised and a

definition of ``HCFA'' is added to read as follows:

Sec. 144.103 Definitions.

For purposes of parts 146 (group market), 148 (individual market),

and 150 (enforcement) of this subchapter, the following definitions

apply unless otherwise provided:

* * * * *

HCFA means the Health Care Financing Administration.

* * * * *

Non-Federal governmental plan means a governmental plan established

or maintained for its employees by the government of any State or

political subdivision thereof, or by any agency or instrumentality of

either.

* * * * *

PART 146--[AMENDED]

B. Part 146 is amended as follows:

1. The authority citation continues to read as follows:

Authority: Secs. 2701 through 2723, 2791, and 2792 of the PHS

Act, 42 U.S.C. 300gg through 300gg-63, 300gg-91, and 300gg-92.

Sec. 146.180 [Amended]

2. The cross-reference in Sec. 146.180(i)(2) to

``Sec. 146.184(d)(7)(iii)(B)'' is revised to read

``Sec. 150.341(a)(2).''

3. The cross-reference in Sec. 146.180(i)(3) to ``Sec. 146.184'' is

revised to read ``part 150 of this subchapter.''

Sec. 146.184 [Removed]

4. Section 146.184 is removed.

PART 148--[AMENDED]

C. Part 148 is amended as follows:

1. The authority citation continues to read as follows:

Authority: Secs. 2741 through 2763, 2791, and 2792 of the Public

Health Service Act (42 U.S.C. 300gg-41 through 300gg-63, 300gg-91,

and 300gg-92).

Sec. Sec. 148.200 and 148.202 [Removed]

2. Sections 148.200 and 148.202 are removed.

D. Part 150 is added to read as follows:

PART 150--HCFA ENFORCEMENT IN GROUP AND INDIVIDUAL INSURANCE

MARKETS

Subpart A--General Provisions

Sec.

150.101 Basis and scope.

150.103 Definitions.

Subpart B--HCFA Enforcement Processes For Determining Whether States

Are Failing to Substantially Enforce HIPAA Requirements

Sec.

150.201 State enforcement.

150.203 Circumstances requiring HCFA enforcement.

150.205 Sources of information triggering an investigation of State

enforcement.

150.207 Procedure for determining that a State fails to

substantially enforce HIPAA requirements.

150.209 Verification of exhaustion of remedies and contact with

State officials.

150.211 Notice to the State.

150.213 Form and content of notice.

150.215 Extension for good cause.

150.217 Preliminary determination.

150.219 Final determination.

150.221 Transition to State enforcement.

[[Page 45796]]

Subpart C--HCFA Enforcement With Respect to Issuers and Non-Federal

Governmental Plans--Civil Money Penalties

150.301 General rule regarding the imposition of civil money

penalties.

150.303 Basis for initiating an investigation of a potential

violation.

150.305 Determination of entity liable for civil money penalty.

150.307 Notice to responsible entities.

150.309 Request for extension.

150.311 Responses to allegations of noncompliance.

150.313 Market conduct examinations.

150.315 Amount of penalty--General.

150.317 Factors HCFA uses to determine the amount of penalty.

150.319 Determining the amount of the penalty--mitigating

circumstances.

150.321 Determining the amount of penalty--aggravating

circumstances.

150.323 Determining the amount of penalty--other matters as justice

may require.

150.325 Settlement authority.

150.341 Limitations on penalties.

150.343 Notice of proposed penalty.

150.345 Appeal of proposed penalty.

150.347 Failure to request a hearing.

Appendix A to Subpart C of Part 150--Examples of Violations

Subpart D--Administrative Hearings

150.401 Definitions.

150.403 Scope of ALJ's authority.

150.405 Filing of request for hearing.

150.407 Form and content of request for hearing.

150.409 Amendment of notice of assessment or request for hearing.

150.411 Dismissal of request for hearing.

150.413 Settlement.

150.415 Intervention.

150.417 Issues to be heard and decided by ALJ.

150.419 Forms of hearing.

150.421 Appearance of counsel.

150.423 Communications with the ALJ.

150.425 Motions.

150.427 Form and service of submissions.

150.429 Computation of time and extensions of time.

150.431 Acknowledgment of request for hearing.

150.435 Discovery.

150.437 Submission of briefs and proposed hearing exhibits.

150.439 Effect of submission of proposed hearing exhibits.

150.441 Prehearing conferences.

150.443 Standard of proof.

150.445 Evidence.

150.447 The record.

150.449 Cost of transcripts.

150.451 Posthearing briefs.

150.453 ALJ decision.

150.455 Sanctions.

150.457 Review by Administrator.

150.459 Judicial review.

150.461 Failure to pay assessment.

150.463 Final order not subject to review.

150.465 Collection and use of penalty funds.

Authority: Secs. 2701 through 2763, 2791, and 2792 of the PHS

Act (42 U.S.C. 300gg through 300gg-63, 300gg-91, and 300gg-92).

Subpart A--General Provisions

Sec. 150.101 Basis and scope.

(a) Basis. HCFA's enforcement authority under sections 2722 and

2761 of the PHS Act and its rulemaking authority under section 2792 of

the PHS Act provide the basis for issuing regulations under this part

150.

(b) Scope--(1) Enforcement with respect to group heath plans. The

provisions of title XXVII of the PHS Act that apply to group health

plans that are non-Federal governmental plans are enforced by HCFA

using the procedures described in Sec. 150.301 et seq.

(2) Enforcement with respect to health insurance issuers. The

States have primary enforcement authority with respect to the

requirements of title XXVII of the PHS Act that apply to health

insurance issuers offering coverage in the group or individual health

insurance market. If HCFA determines under subpart B of this part that

a State is not substantially enforcing title XXVII of the PHS Act,

including the implementing regulations in part 146 and part 148 of this

subchapter, HCFA enforces them under subpart C of this part.

Sec. 150.103 Definitions.

The definitions that appear in part 144 of this subchapter apply to

this part 150, unless stated otherwise. As used in this part:

Amendment, endorsement, or rider means a document that modifies or

changes the terms or benefits of an individual policy, group policy, or

certificate of insurance.

Application means a signed statement of facts by a potential

insured that an issuer uses as a basis for its decision whether, and on

what basis to insure an individual, or to issue a certificate of

insurance, or that a non-Federal governmental health plan uses as a

basis for a decision whether to enroll an individual under the plan.

Certificate of insurance means the document issued to a person or

entity covered under an insurance policy issued to a group health plan

or an association or trust that summarizes the benefits and principal

provisions of the policy.

Complaint means any expression, written or oral, indicating a

potential denial of any right or protection contained in HIPAA

requirements (whether ultimately justified or not) by an individual, a

personal representative or other entity acting on behalf of an

individual, or any entity that believes such a right is being or has

been denied an individual.

Group health insurance policy or group policy means the legal

document or contract issued by an issuer to a plan sponsor with respect

to a group health plan (including a plan that is a non-Federal

governmental plan) that contains the conditions and terms of the

insurance that covers the group.

HIPAA requirements means the requirements of title XXVII of the PHS

Act and its implementing regulations in parts 146 and 148 of this

subchapter.

Individual health insurance policy or individual policy means the

legal document or contract issued by the issuer to an individual that

contains the conditions and terms of the insurance. Any association or

trust arrangement that is not a group health plan as defined in

Sec. 144.103 of this subchapter or does not provide coverage in

connection with one or more group health plans is individual coverage

subject to the requirements of part 148 of this subchapter. The term

``individual health insurance policy'' includes a policy that is----

(1) Issued to an association that makes coverage available to

individuals other than in connection with one or more group health

plans; or

(2) Administered, or placed in a trust, and is not sold in

connection with a group health plan subject to the provisions of part

146 of this subchapter.

Plan document means the legal document that provides the terms of

the plan to individuals covered under a group health plan, such as a

non-Federal governmental health plan.

State law means all laws, decisions, rules, regulations, or other

State action having the effect of law, of any State as defined in

Sec. 144.103 of this subchapter. A law of the United States applicable

to the District of Columbia is treated as a State law rather than a law

of the United States.

Subpart B--HCFA Enforcement Processes for Determining Whether

States Are Failing to Substantially Enforce HIPAA Requirements

Sec. 150.201 State enforcement.

Except as provided in subpart C of this part, each State enforces

HIPAA requirements with respect to health insurance issuers that issue,

sell, renew, or offer health insurance coverage in the State.

Sec. 150.203 Circumstances requiring HCFA enforcement.

HCFA enforces HIPAA requirements to the extent warranted (as

determined by HCFA) in any of the following circumstances:

[[Page 45797]]

(a) Notification by State. A State notifies HCFA that it has not

enacted legislation to enforce or that it is not otherwise enforcing

HIPAA requirements.

(b) Determination by HCFA. If HCFA receives or obtains information

that a State may not be substantially enforcing HIPAA requirements, it

may initiate the process described in this subchapter to determine

whether the State is failing to substantially enforce these

requirements.

(c) Special rule for guaranteed availability in the individual

market. If a State has notified HCFA that it is implementing an

acceptable alternative mechanism in accordance with Sec. 148.128 of

this subchapter instead of complying with the guaranteed availability

requirements of Sec. 148.120, HCFA's determination focuses on the

following:

(1) Whether the State's mechanism meets the requirements for an

acceptable alternative mechanism.

(2) Whether the State is implementing the acceptable alternative

mechanism.

(d) Consequence of a State not implementing an alternative

mechanism. If a State is not implementing an acceptable alternative

mechanism, HCFA determines whether the State is substantially enforcing

the requirements of Secs. 148.101 through 148.126 and Sec. 148.170 of

this subchapter.

Sec. 150.205 Sources of information triggering an investigation of

State enforcement.

Information that may trigger an investigation of State enforcement

includes, but is not limited to, any of the following:

(a) A complaint received by HCFA.

(b) Information learned during informal contact between HCFA and

State officials.

(c) A report in the news media.

(d) Information from the governors and commissioners of insurance

of the various States regarding the status of their enforcement of

HIPAA requirements.

(e) Information obtained during periodic review of State health

care legislation. HCFA may review State health care and insurance

legislation and regulations to determine whether they are:

(1) Consistent with HIPAA requirements.

(2) Not pre-empted as provided in Sec. 146.143 (relating to group

market provisions) and Sec. 148.120 (relating to individual market

requirements) on the basis that they prevent the application of a HIPAA

requirement.

(f) Any other information that indicates a possible failure to

substantially enforce.

Sec. 150.207 Procedure for determining that a State fails to

substantially enforce HIPAA requirements.

Sections 150.209 through 150.219 describe the procedures HCFA

follows to determine whether a State is substantially enforcing HIPAA

requirements.

Sec. 150.209 Verification of exhaustion of remedies and contact with

State officials.

If HCFA receives a complaint or other information indicating that a

State is failing to enforce HIPAA requirements, HCFA assesses whether

the affected individual or entity has made reasonable efforts to

exhaust available State remedies. As part of its assessment, HCFA may

contact State officials regarding the questions raised.

Sec. 150.211 Notice to the State.

If HCFA is satisfied that there is a reasonable question whether

there has been a failure to substantially enforce HIPAA requirements,

HCFA sends, in writing, the notice described in Sec. 150.213 of this

part, to the following State officials:

(a) The governor or chief executive officer of the State.

(b) The insurance commissioner or chief insurance regulatory

official.

(c) If the alleged failure involves HMOs, the official responsible

for regulating HMOs if different from the official listed in paragraph

(b) of this section.

Sec. 150.213 Form and content of notice.

The notice provided to the State is in writing and does the

following:

(a) Identifies the HIPAA requirement or requirements that have

allegedly not been substantially enforced.

(b) Describes the factual basis for the allegation of a failure or

failures to enforce HIPAA requirements.

(c) Explains that the consequence of a State's failure to

substantially enforce HIPAA requirements is that HCFA enforces them.

(d) Advises the State that it has 30 days from the date of the

notice to respond, unless the time for response is extended as

described in Sec. 150.215 of this subpart. The State's response should

include any information that the State wishes HCFA to consider in

making the preliminary determination described in Sec. 150.217.

Sec. 150.215 Extension for good cause.

HCFA may extend, for good cause, the time the State has for

responding to the notice described in Sec. 150.213 of this subpart.

Examples of good cause include an agreement between HCFA and the State

that there should be a public hearing on the State's enforcement, or

evidence that the State is undertaking expedited enforcement

activities.

Sec. 150.217 Preliminary determination.

If, at the end of the 30-day period (and any extension), the State

has not established to HCFA's satisfaction that it is substantially

enforcing the HIPAA requirements described in the notice, HCFA takes

the following actions:

(a) Consults with the appropriate State officials identified in

Sec. 150.211 (or their designees).

(b) Notifies the State of HCFA's preliminary determination that the

State has failed to substantially enforce the requirements and that the

failure is continuing.

(c) Permits the State a reasonable opportunity to show evidence of

substantial enforcement.

Sec. 150.219 Final determination.

If, after providing notice and a reasonable opportunity for the

State to show that it has corrected any failure to substantially

enforce, HCFA finds that the failure to substantially enforce has not

been corrected, it will send the State a written notice of its final

determination. The notice includes the following:

(a) Identification of the HIPAA requirements that HCFA is

enforcing.

(b) The effective date of HCFA's enforcement.

Sec. 150.221 Transition to State enforcement.

(a) If HCFA determines that a State for which it has assumed

enforcement authority has enacted and implemented legislation to

enforce HIPAA requirements and also determines that it is appropriate

to return enforcement authority to the State, HCFA will enter into

discussions with State officials to ensure that a transition is

effected with respect to the following:

(1) Consumer complaints and inquiries.

(2) Instructions to issuers.

(3) Any other pertinent aspect of operations.

(b) HCFA may also negotiate a process to ensure that, to the extent

practicable, and as permitted by law, its records documenting issuer

compliance and other relevant areas of HCFA's enforcement operations

are made available for incorporation into the records of the State

regulatory authority that will assume enforcement responsibility.

[[Page 45798]]

Subpart C--HCFA Enforcement With Respect to Issuers and Non-Federal

Governmental Plans--Civil Money Penalties

Sec. 150.301 General rule regarding the imposition of civil money

penalties.

If any health insurance issuer that is subject to HCFA's

enforcement authority under Sec. 150.101(b)(2), or any non-Federal

governmental plan (or employer that sponsors a non-Federal governmental

plan) that is subject to HCFA's enforcement authority under

Sec. 150.101(b)(1), fails to comply with HIPAA requirements, it may be

subject to a civil money penalty as described in this subpart.

Sec. 150.303 Basis for initiating an investigation of a potential

violation.

(a) Information. Any information that indicates that any issuer may

be failing to meet the HIPAA requirements or that any non-Federal

governmental plan that is a group health plan as defined in section

2791(a)(1) of the PHS Act and 45 CFR Sec. 144.103 may be failing to

meet an applicable HIPAA requirement, may warrant an investigation.

HCFA may consider, but is not limited to, the following sources or

types of information:

(1) Complaints.

(2) Reports from State insurance departments, the National

Association of Insurance Commissioners, and other Federal and State

agencies.

(3) Any other information that indicates potential noncompliance

with HIPAA requirements.

(b) Who may file a complaint. Any entity or individual, or any

entity or personal representative acting on that individual's behalf,

may file a complaint with HCFA if he or she believes that a right to

which the aggrieved person is entitled under HIPAA requirements is

being, or has been, denied or abridged as a result of any action or

failure to act on the part of an issuer or other responsible entity as

defined in Sec. 150.305.

(c) Where a complaint should be directed. A complaint may be

directed to any HCFA regional office.

Sec. 150.305 Determination of entity liable for civil money penalty.

If a failure to comply is established under this Part, the

responsible entity, as determined under this section, is liable for any

civil money penalty imposed.

(a) Health insurance issuer is responsible entity--(1) Group health

insurance policy. To the extent a group health insurance policy issued,

sold, renewed, or offered to a private plan sponsor or a non-Federal

governmental plan sponsor is subject to applicable HIPAA requirements,

a health insurance issuer is subject to a civil money penalty,

irrespective of whether a civil money penalty is imposed under

paragraphs (b) or (c) of this section, if the policy itself or the

manner in which the policy is marketed or administered fails to comply

with an applicable HIPAA requirement.

(2) Individual health insurance policy. To the extent an individual

health insurance policy is subject to an applicable HIPAA requirement,

a health insurance issuer is subject to a civil money penalty if the

policy itself, or the manner in which the policy is marketed or

administered, violates any applicable HIPAA requirement.

(b) Non-Federal governmental plan is responsible entity. (1) Basic

rule. If a non-Federal governmental plan is sponsored by two or more

employers and fails to comply with an applicable HIPAA requirement, the

plan is subject to a civil money penalty, irrespective of whether a

civil money penalty is imposed under paragraph (a) of this section. The

plan is the responsible entity irrespective of whether the plan is

administered by a health insurance issuer, an employer sponsoring the

plan, or a third-party administrator.

(2) Exception. In the case of a non-Federal governmental plan that

is not provided through health insurance coverage, this paragraph (b)

does not apply to the extent that the non-Federal governmental

employers have elected under Sec. 146.180 to exempt the plan from

applicable HIPAA requirements.

(c) Employer is responsible entity. (1) Basic rule. If a non-

Federal governmental plan is sponsored by a single employer and fails

to comply with an applicable HIPAA requirement, the employer is subject

to a civil money penalty, irrespective of whether a civil money penalty

is imposed under paragraph (a) of this section. The employer is the

responsible entity irrespective of whether the plan is administered by

a health insurance issuer, the employer, or a third-party

administrator.

(2) Exception. In the case of a non-Federal governmental plan that

is not provided through health insurance coverage, this paragraph (c)

does not apply to the extent the non-Federal governmental employer has

elected under Sec. 146.180 to exempt the plan from applicable HIPAA

requirements.

(d) Actions or inactions of agent. A principal is liable for

penalties assessed for the actions or inactions of its agent.

Sec. 150.307 Notice to responsible entities.

If an investigation under Sec. 150.303 indicates a potential

violation, HCFA provides written notice to the responsible entity or

entities identified under Sec. 150.305. The notice does the following:

(a) Describes the substance of any complaint or other information.

(See Appendix A to this subpart for examples of violations.)

(b) Provides 30 days from the date of the notice for the

responsible entity or entities to respond with additional information,

including documentation of compliance as described in Sec. 150.311.

(c) States that a civil money penalty may be assessed.

Sec. 150.309 Request for extension.

In circumstances in which an entity cannot prepare a response to

HCFA within the 30 days provided in the notice, the entity may make a

written request for an extension from HCFA detailing the reason for the

extension request and showing good cause. If HCFA grants the extension,

the responsible entity must respond to the notice within the time frame

specified in HCFA's letter granting the extension of time. Failure to

respond within 30 days, or within the extended time frame, may result

in HCFA's imposition of a civil money penalty based upon the complaint

or other information alleging or indicating a violation of HIPAA

requirements.

Sec. 150.311 Responses to allegations of noncompliance.

In determining whether to impose a civil money penalty, HCFA

reviews and considers documentation provided in any complaint or other

information, as well as any additional information provided by the

responsible entity to demonstrate that it has complied with HIPAA

requirements. The following are examples of documentation that a

potential responsible entity may submit for HCFA's consideration in

determining whether a civil money penalty should be assessed and the

amount of any civil money penalty:

(a) Any individual policy, group policy, certificate of insurance,

application, rider, amendment, endorsement, certificate of creditable

coverage, advertising material, or any other documents if those

documents form the basis of a complaint or allegation of noncompliance,

or the basis for the responsible entity to refute the complaint or

allegation.

(b) Any other evidence that refutes an alleged noncompliance.

[[Page 45799]]

(c) Evidence that the entity did not know, and exercising due

diligence could not have known, of the violation.

(d) Documentation that the policies, certificates of insurance, or

non-Federal governmental plan documents have been amended to comply

with HIPAA requirements either by revision of the contracts or by the

development of riders, amendments, or endorsements.

(e) Documentation of the entity's issuance of conforming policies,

certificates of insurance, plan documents, or amendments to

policyholders or certificate holders before the issuance of the notice

of intent to assess a penalty described in Sec. 150.307.

(f) Evidence documenting the development and implementation of

internal policies and procedures by an issuer, or non-Federal

governmental health plan or employer, to ensure compliance with HIPAA

requirements. Those policies and procedures may include or consist of a

voluntary compliance program. Any such program should do the following:

(1) Effectively articulate and demonstrate the fundamental mission

of compliance and the issuer's, or non-Federal governmental health

plan's or employer's, commitment to the compliance process.

(2) Include the name of the individual in the organization

responsible for compliance.

(3) Include an effective monitoring system to identify practices

that do not comply with HIPAA requirements and to provide reasonable

assurance that fraud, abuse, and systemic errors are detected in a

timely manner.

(4) Address procedures to improve internal policies when

noncompliant practices are identified.

(g) Evidence documenting the entity's record of previous compliance

with HIPAA requirements.

Sec. 150.313 Market conduct examinations.

(a) Definition. A market conduct examination means the examination

of health insurance operations of an issuer, or the operation of a non-

Federal governmental plan, involving the review of one or more (or a

combination) of a responsible entity's business or operational affairs,

or both, to verify compliance with HIPAA requirements.

(b) General. If, based on the information described in

Sec. 150.303, HCFA finds evidence that a specific entity may be in

violation of a HIPAA requirement, HCFA may initiate a market conduct

examination to determine whether the entity is out of compliance. HCFA

may conduct the examinations either at the site of the issuer or other

responsible entity or a site HCFA selects. When HCFA selects a site, it

may direct the issuer or other responsible entity to forward any

documentation HCFA considers relevant for purposes of the examination

to that site.

(c) Appointment of examiners. When HCFA identifies an issue that

warrants investigation, HCFA will appoint one or more examiners to

perform the examination and instruct them as to the scope of the

examination.

(d) Appointment of professionals and specialists. When conducting

an examination under this part, HCFA may retain attorneys, independent

actuaries, independent market conduct examiners, or other professionals

and specialists as examiners.

(e) Report of market conduct examination. (1) HCFA review. When

HCFA receives a report, it will review the report, together with the

examination work papers and any other relevant information, and prepare

a final report. The final examination report will be provided to the

issuer or other responsible entity.

(2) Response from issuer or other responsible entity. With respect

to each examination issue identified in the report, the issuer or other

responsible entity may:

(i) Concur with HCFA's position(s) as outlined in the report,

explaining the plan of correction to be implemented.

(ii) Dispute HCFA's position(s), clearly outlining the basis for

its dispute and submitting illustrative examples where appropriate.

(3) HCFA's reply to a response from an issuer or other responsible

entity. Upon receipt of a response from the issuer or other responsible

entity, HCFA will provide a letter containing its reply to each

examination issue. HCFA's reply will consist of one of the following:

(i) Concurrence with the issuer's or non-Federal governmental

plan's position.

(ii) Approval of the issuer's or non-Federal governmental plan's

proposed plan of correction.

(iii) Conditional approval of the issuer's or non-Federal

governmental plan's proposed plan of correction, which will include any

modifications HCFA requires.

(iv) Notice to the issuer or non-Federal governmental plan that

there exists a potential violation of HIPAA requirements.

Sec. 150.315 Amount of penalty--General.

A civil money penalty for each violation of 42 U.S.C. 300gg et seq.

may not exceed $100 for each day, for each responsible entity, for each

individual affected by the violation. Penalties imposed under this part

are in addition to any other penalties prescribed or allowed by law.

Sec. 150.317 Factors HCFA uses to determine the amount of penalty.

In determining the amount of any penalty, HCFA takes into account

the following:

(a) The entity's previous record of compliance. This may include

any of the following:

(1) Any history of prior violations by the responsible entity,

including whether, at any time before determination of the current

violation or violations, HCFA or any State found the responsible entity

liable for civil or administrative sanctions in connection with a

violation of HIPAA requirements.

(2) Documentation that the responsible entity has submitted its

policy forms to HCFA for compliance review.

(3) Evidence that the responsible entity has never had a complaint

for noncompliance with HIPAA requirements filed with a State or HCFA.

(4) Such other factors as justice may require.

(b) The gravity of the violation. This may include any of the

following:

(1) The frequency of the violation, taking into consideration

whether any violation is an isolated occurrence, represents a pattern,

or is widespread.

(2) The level of financial and other impacts on affected

individuals.

(3) Other factors as justice may require.

Sec. 150. 319 Determining the amount of the penalty--mitigating

circumstances.

For every violation subject to a civil money penalty, if there are

substantial or several mitigating circumstances, the aggregate amount

of the penalty is set at an amount sufficiently below the maximum

permitted by Sec. 150.315 to reflect that fact. As guidelines for

taking into account the factors listed in Sec. 150.317, HCFA considers

the following:

(a) Record of prior compliance. It should be considered a

mitigating circumstance if the responsible entity has done any of the

following:

(1) Before receipt of the notice issued under Sec. 150.307,

implemented and followed a compliance plan as described in

Sec. 150.311(f).

(2) Had no previous complaints against it for noncompliance.

(b) Gravity of the violation(s). It should be considered a

mitigating circumstance if the responsible entity has done any of the

following:

[[Page 45800]]

(1) Made adjustments to its business practices to come into

compliance with HIPAA requirements so that the following occur:

(i) All employers, employees, individuals and non-Federal

governmental entities are identified that are or were issued any

policy, certificate of insurance or plan document, or any form used in

connection therewith that failed to comply.

(ii) All employers, employees, individuals, and non-Federal

governmental plans are identified that were denied coverage or were

denied a right provided under HIPAA requirements.

(iii) Each employer, employee, individual, or non-Federal

governmental plan adversely affected by the violation has been, for

example, offered coverage or provided a certificate of creditable

coverage in a manner that complies with HIPAA requirements that were

violated so that, to the extent practicable, that employer, employee,

individual, or non-Federal governmental entity is in the same position

that he, she, or it would have been in had the violation not occurred.

(iv) The adjustments are completed in a timely manner.

(2) Discovered areas of noncompliance without notice from HCFA and

voluntarily reported that noncompliance, provided that the responsible

entity submits the following:

(i) Documentation verifying that the rights and protections of all

individuals adversely affected by the noncompliance have been restored;

and

(ii) A plan of correction to prevent future similar violations.

(3) Demonstrated that the violation is an isolated occurrence.

(4) Demonstrated that the financial and other impacts on affected

individuals is negligible or nonexistent.

(5) Demonstrated that the noncompliance is correctable and that a

high percentage of the violations were corrected.

Sec. 150.321 Determining the amount of penalty--aggravating

circumstances.

For every violation subject to a civil money penalty, if there are

substantial or several aggravating circumstances, HCFA sets the

aggregate amount of the penalty at an amount sufficiently close to or

at the maximum permitted by Sec. 150.315 to reflect that fact. HCFA

considers the following circumstances to be aggravating circumstances:

(a) The frequency of violation indicates a pattern of widespread

occurrence.

(b) The violation(s) resulted in significant financial and other

impacts on the average affected individual.

(c) The entity does not provide documentation showing that

substantially all of the violations were corrected.

Sec. 150.323 Determining the amount of penalty--other matters as

justice may require.

HCFA may take into account other circumstances of an aggravating or

mitigating nature if, in the interests of justice, they require either

a reduction or an increase of the penalty in order to assure the

achievement of the purposes of this part, and if those circumstances

relate to the entity's previous record of compliance or the gravity of

the violation.

Sec. 150.325 Settlement authority.

Nothing in Secs. 150.315 through 150.323 limits the authority of

HCFA to settle any issue or case described in the notice furnished in

accordance with Sec. 150.307 or to compromise on any penalty provided

for in Secs. 150.315 through 150.323.

Sec. 150.341 Limitations on penalties.

(a) Circumstances under which a civil money penalty is not imposed.

HCFA does not impose any civil money penalty on any failure for the

period of time during which none of the responsible entities knew, or

exercising reasonable diligence would have known, of the failure. HCFA

also does not impose a civil money penalty for the period of time after

any of the responsible entities knew, or exercising reasonable

diligence would have known of the failure, if the failure was due to

reasonable cause and not due to willful neglect and the failure was

corrected within 30 days of the first day that any of the entities

against whom the penalty would be imposed knew, or exercising

reasonable diligence would have known, that the failure existed.

(b) Burden of establishing knowledge. The burden is on the

responsible entity or entities to establish to HCFA's satisfaction that

no responsible entity knew, or exercising reasonable diligence would

have known, that the failure existed.

Sec. 150.343 Notice of proposed penalty.

If HCFA proposes to assess a penalty in accordance with this part,

it delivers to the responsible entity, or sends to that entity by

certified mail, return receipt requested, written notice of its intent

to assess a penalty. The notice includes the following:

(a) A description of the HIPAA requirements that HCFA has

determined that the responsible entity violated.

(b) A description of any complaint or other information upon which

HCFA based its determination, including the basis for determining the

number of affected individuals and the number of days for which the

violations occurred.

(c) The amount of the proposed penalty as of the date of the

notice.

(d) Any circumstances described in Secs. 150.317 through 150.323

that were considered when determining the amount of the proposed

penalty.

(e) A specific statement of the responsible entity's right to a

hearing.

(f) A statement that failure to request a hearing within 30 days

permits the assessment of the proposed penalty without right of appeal

in accordance with Sec. 150.347.

Sec. 150.345 Appeal of proposed penalty.

Any entity against which HCFA has assessed a penalty may appeal

that penalty in accordance with Sec. 150.401 et seq.

Sec. 150.347 Failure to request a hearing.

If the responsible entity does not request a hearing within 30 days

of the issuance of the notice described in Sec. 150.343, HCFA may

assess the proposed civil money penalty, a less severe penalty, or a

more severe penalty. HCFA notifies the responsible entity in writing of

any penalty that has been assessed and of the means by which the

responsible entity may satisfy the judgment. The responsible entity has

no right to appeal a penalty with respect to which it has not requested

a hearing in accordance with Sec. 150.405 unless the responsible entity

can show good cause, as determined under Sec. 150.405(b), for failing

to timely exercise its right to a hearing.

Appendix A to Subpart C of Part 150--Examples of Violations

This appendix lists actions in the group and individual markets

for which HCFA may impose civil money penalties. This list is not

all-inclusive.

Note 1: All cross-references to sections of the Code of Federal

Regulations are cross-references to sections in parts 144, 146, or

148 of this subchapter.

Note 2: Except as otherwise expressly noted, all references to

non-Federal governmental plans refer to non-Federal governmental

plans that are not exempt from HIPAA requirements (as defined in

Sec. 150.103) under section 2721(b)(2) of the PHS Act and

Sec. 146.180.

I. Basis for Imposition of Civil Money Penalties--Actions in the

Group Market

a. Failure to comply with the limitations on pre-existing

condition exclusions (Sec. 146.111).

[[Page 45801]]

Violations of the limitations on preexisting condition

exclusions, set forth in Sec. 146.111, includes those circumstances

in which a non-Federal governmental plan or health insurance issuer

offering group health insurance coverage does the following:

(1) Imposes a preexisting condition exclusion period that

exceeds 12 months or, in the case of a late enrollee, 18 months,

from the enrollment date (the first day of coverage or the first day

of the waiting period, if any).

(2) Fails to reduce a pre-existing condition exclusion period by

creditable coverage as provided in Secs. 146.111(a)(1)(iii) and

146.113.

(3) Imposes a pre-existing condition exclusion period without

first giving the two written notices required in Secs. 146.111(c)

and 146.115(d). The first notice is a general notice to all plan

participants of the existence and terms of any pre-existing

condition exclusion under the plan, and the rights of individuals to

demonstrate creditable coverage. The notice should explain the right

of an individual to request a certificate from a previous plan or

issuer, if necessary, and include a statement that the current plan

or issuer will assist in obtaining a certificate from a previous

plan or issuer, if necessary. The second notice is required to be

sent to any individual who has presented evidence of creditable

coverage, and to whom a pre-existing condition exclusion period will

be applied. This second notice informs the individual of the plan's

determination of any pre-existing condition exclusion period, the

basis for such determination, a written explanation of any appeals

procedures established by the plan or issuer, and a reasonable

opportunity to submit additional evidence of creditable coverage.

(4) Treats pregnancy as a pre-existing condition, as prohibited

by Sec. 146.111(b)(4). For example, an issuer may not refuse to pay

for prenatal care and delivery effective with the date maternity

coverage began because the individual did not have maternity

coverage at the time the pregnancy began.

(5) Imposes a pre-existing condition exclusion with regard to a

child who enrolls in a group health plan within 30 days of birth,

adoption, or placement for adoption.

(6) Imposes a pre-existing condition exclusion with regard to a

child who was enrolled in another group health plan within 30 days

of birth, adoption, or placement for adoption and who does not

experience significant break in coverage.

(7) Uses a pre-existing condition look-back period that exceeds

the six-month period ending on the enrollment date in violation of

Sec. 146.111(a)(1) of this chapter.

(8) Determines whether a pre-existing condition exclusion

applies by using a standard other than whether medical advice,

diagnosis, care, or treatment was actually recommended or received

during the look-back period. A determination that a reasonably

prudent person would or should have sought medical care for the

condition is an unacceptable standard by which to determine whether

a pre-existing condition exclusion applies.

(9) Uses genetic information as part of the definition of pre-

existing condition in the absence of a diagnosis of the condition

related to the genetic information.

(10) Otherwise fails to comply with Sec. 146.111.

b. Failure to comply with the provisions relating to creditable

coverage (Sec. 146.113).

Failure to comply with the Sec. 146.113 rules relating to

creditable coverage includes those circumstances in which a non-

Federal governmental plan or issuer offering group health insurance

coverage does the following:

(1) Fails to treat all forms of coverage listed in

Sec. 146.113(a) as creditable coverage.

(2) Counts creditable coverage in a manner inconsistent with the

standard method described in Sec. 146.113(b) or the alternative

method described in Sec. 146.113(c), if it elects to use the

alternative method.

(3) Treats an individual with fewer than 63 consecutive days

without creditable coverage as having a significant break in

coverage in violation of Sec. 146.113(b)(2)(iii).

(4) Takes either a waiting period or an affiliation period into

account when calculating a significant break in coverage, as

prohibited by Sec. 146.113(b)(2)(iii).

(5) Otherwise fails to comply with Sec. 146.113.

c. Failure to comply with the provisions regarding certification

and disclosure of previous coverage (Sec. 146.115).

Except as provided in paragraph (c)(b), the plan sponsor of a

self-funded non-Federal governmental plan may not elect to exempt

its plan from the requirements of this paragraph.

Failure to comply with the requirements in Sec. 146.115

regarding certification and disclosure of previous coverage includes

those circumstances in which a non-Federal governmental plan or

issuer offering group health insurance coverage does the following:

(1) Fails to ensure that individuals who request certification

receive it.

(2) Fails to automatically provide certificates of creditable

coverage promptly, either--

(i) When the individual ceases to be covered under the plan

(whether or not COBRA continuation coverage is offered or elected);

or

(ii) When the COBRA continuation coverage is exhausted or is

terminated by the individual, if COBRA continuation coverage was

offered and was elected.

(3) Fails to provide certificates of creditable coverage

promptly upon request.

(4) Fails to provide the required information in certificates of

creditable coverage.

(5) Fails to provide certificates of creditable coverage to

dependents.

(6) Fails to accept other evidence of creditable coverage as

provided in Sec. 146.115(c). (The plan sponsor of a self-funded non-

Federal governmental plan may elect to exempt its plan from the

requirements of this paragraph (6)).

(7) Otherwise fails to comply with Sec. 146.115.

d. Failure to comply with the provisions regarding special

enrollment periods (Sec. 146.117).

Failure to comply with the Sec. 146.117 requirements regarding

special enrollment periods includes those circumstances in which an

issuer or a non-Federal governmental plan does the following:

(1) Fails to permit employees and dependents to enroll for

coverage if they satisfy the conditions of Sec. 146.117(a) or (b).

(2) Fails to provide coverage on a timely basis to individuals

protected by a special enrollment period as provided in

Sec. 146.117.

(3) Fails to provide the employee with a description of the

plan's or issuer's special enrollment rules on or before the time

the employee is offered the opportunity to enroll as provided in

Sec. 146.117(c).

(4) Otherwise fails to comply with Sec. 146.117.

e. Failure to comply with the HMO affiliation period provisions

(Sec. 146.119).

Failure to comply with the Sec. 146.119 affiliation period

requirements includes those circumstances in which an HMO that

offers group health insurance coverage does the following:

(1) Imposes a pre-existing condition exclusion period.

(2) Charges a premium for months in an affiliation period.

(3) Fails to impose an affiliation period uniformly without

regard to any health status-related factor.

(4) Imposes an affiliation period that is longer than 2 months

(or 3 months for late enrollees), or one that begins later than the

enrollment date or does not run concurrently with any waiting

period.

(5) Otherwise fails to comply with Sec. 146.119.

f. Failure to comply with the provisions regarding

nondiscrimination (Sec. 146.121).

Failure to comply with the Sec. 146.121 prohibitions regarding

nondiscrimination includes those circumstances in which an issuer or

a non-Federal governmental plan does the following:

(1) Applies rules of eligibility (including continued

eligibility) to enroll under the terms of the plan based any of the

health-status related factors described in Sec. 146.121(a).

(2) Requires an individual as a condition of enrollment or re-

enrollment to pay a higher premium than others similarly situated by

reason of a health-status related factor of the individual or the

individual's dependent.

(3) Otherwise fails to comply with Sec. 146.121.

g. Failure to comply with the provisions relating to benefits

for mothers and newborns (Sec. 146.130) in States where the

Sec. 146.130 standards are applicable.

Failure of an issuer or a non-Federal governmental plan to

comply with the standards in Sec. 146.130 relating to benefits for

mothers and newborns includes the following:

(1) Restricts benefits for a mother or her newborn to less than

48 hours following a vaginal delivery or less than 96 hours

following a delivery by cesarean section, unless the attending

provider decides, in consultation with the mother, to discharge the

mother or newborn earlier.

(2) Fails to calculate the length of stay from the time of

delivery when delivery occurs in a hospital, or from the time of

admission when delivery occurs outside the hospital.

(3) Penalizes an attending provider for complying with the law.

[[Page 45802]]

(4) Offers incentives to an attending provider to provide care

in a manner inconsistent with the provisions of Sec. 146.130.

(5) Denies the mother or newborn eligibility or continued

eligibility to enroll under the plan to avoid complying with

Sec. 146.130.

(6) Provides payments or rebates to mothers to encourage them to

accept less than the minimum stay required.

(7) Requires an attending provider to obtain authorization to

prescribe a hospital length of stay of up to 48 hours (or 96 hours)

after delivery.

(8) Imposes deductibles, coinsurance, or other cost-sharing

measures for any portion of a 48-hour (or 96-hour) hospital stay

that are less favorable than those imposed on any preceding portion

of the stay.

(9) In the case of a non-Federal governmental plan, fails to

provide participants and beneficiaries with a statement describing

the requirements of the Newborns' and Mothers' Health Protection Act

of 1996, using the language provided at Sec. 146.130(d)(2), not

later than 60 days after the first day of the first plan year

beginning on or after January 1, 1999.

(10) Otherwise fails to comply with Sec. 146.130.

h. Failure to comply with the provisions pertaining to parity in

the application of certain limits to mental health benefits in the

large group market (Sec. 146.136).

Failure of a non-Federal governmental plan offered by a large

employer or health insurance issuer offering health insurance

coverage to large employers to comply with the Sec. 146.136

provisions pertaining to parity in the application of certain limits

to mental health benefits (with respect to a plan that must comply

with such provisions) includes the following:

(1) Sale of a product by a health insurance issuer that fails to

comply with the mental health parity provisions of Sec. 146.136.

(2) Failure of a non-Federal governmental plan to comply with

the annual and lifetime dollar limits provisions concerning mental

health parity.

i. Failure to comply with the Women's Health and Cancer Rights

Act of 1998 (section 2706 of the PHS Act, 42 U.S.C. 300gg-06).

j. Failure to comply with the provisions regarding guaranteed

availability of coverage in the small group market (Sec. 146.150).

Failure to provide guaranteed availability in the small group

market as provided in Sec. 146.150 includes those circumstances in

which a health insurance issuer offering any health insurance

coverage to group health plans in the small group market does the

following:

(1) Fails to offer all products on a guaranteed availability

basis to all small employers.

(2) Fails to define a small employer using the definition at

Sec. 144.103, unless otherwise provided under State law; that is,

generally an employer with between 2 and 50 employees.

(3) Fails to count as employees all individual employees that an

employer wants to include in the group by applying a more

restrictive definition of ``employee'' than is permitted by

Sec. 144.103.

(4) Fails to accept all employee dependents who are qualified

under the terms of the employer's group health plan.

(5) Sets agent commissions for sales to small employers so low

as to discourage agents from marketing policies to, or enrolling,

these groups so that a failure to offer coverage results.

(6) Unreasonably delays the processing of applications submitted

by small employers, so that a break in coverage of more than 63 days

results.

(7) Fails to offer to any small employer on a guaranteed

availability basis any product that the issuer sells to small

employers through one or more associations that are not bona fide

associations, as defined in Sec. 144.103. The requirement to

guarantee availability of such products to all small employers

applies whether or not the small employer is a member of, or could

qualify for membership in, that association.

(8) Otherwise fails to comply with Sec. 146.150.

k. Failure to comply with the requirements regarding guaranteed

renewability in either the large or small group market

(Sec. 146.152).

Failure to provide guaranteed renewability of coverage as

provided in Sec. 146.152 includes those circumstances in which a

health insurance issuer offering health insurance coverage to a

group health plan in the small or large group market does the

following:

(1) Fails to renew or continue in force coverage at the option

of the plan sponsor unless one of the specific exceptions in

Sec. 146.152(b) is met.

(2) Fails to follow the requirements as described in

Sec. 146.152(c)-(e) relating to the discontinuance of a particular

product or withdrawal from the market of a particular product.

(3) Fails to renew coverage of an individual employer who has

been a member of an association when the individual employer ceases

to be a member of the association, unless it is a bona fide

association as defined in Sec. 144.103, and the issuer terminates

coverage for all former members on a uniform basis.

(4) Fails to act uniformly if the issuer cancels coverage.

(5) Otherwise fails to comply with Sec. 146.152.

l. Failure to comply with the requirements relating to

disclosure of information (Sec. 146.160).

Failure to make reasonable disclosure as provided in

Sec. 146.160 includes those circumstances in which an issuer

offering group health insurance coverage to a small employer, as

defined in Sec. 144.103, does the following:

(1) Fails to disclose all information concerning all products

available from the issuer in the small group market as defined in

Sec. 144.103.

(2) Otherwise fails to comply with Sec. 146.160.

II. Basis for Imposition of Civil Money Penalties--Actions in the

Individual Market

a. Failure to comply with the requirements regarding guaranteed

availability of coverage (Sec. 148.120).

In States that are not implementing an acceptable alternative

mechanism described in Sec. 148.128, failure to provide guaranteed

availability with no preexisting condition exclusion period as

provided in Sec. 148.120 includes those circumstances in which an

issuer does the following:

(1) Fails to provide to eligible individuals, on a guaranteed

availability basis, at least one of the following:

(i) Enrollment in all individual market policies it actually

markets.

(ii) The two most popular policies described in

Sec. 148.120(c)(2).

(iii) Two representative policy forms as described in

Sec. 148.120(c)(3).

(2) Imposes any preexisting condition exclusion or affiliation

period on eligible individuals under any policy that it sells on a

guaranteed availability basis.

(3) Sets agent commissions for sales to eligible individuals so

low as to discourage agents from marketing policies to, or

enrolling, these individuals so that a failure to offer coverage

results.

(4) Unreasonably delays the processing of applications submitted

by eligible individuals.

(5) Fails to offer to any eligible individual as defined in

Sec. 148.103 (on a guaranteed availability basis with no preexisting

condition exclusions) any product the issuer sells to individuals

through one or more associations that are not bona fide

associations, as defined in Sec. 144.103, unless the issuer has

designated at least two other products (as its two most popular or

its two representative policies) that it will sell to eligible

individuals.

(6) Denies an eligible individual a policy on the basis that the

individual has had a significant break in coverage even though a

substantially complete application was filed on or before the 63rd

day after the prior group coverage ended.

(7) Otherwise fails to comply with Sec. 148.120.

b. Failure to comply with the requirements regarding guaranteed

renewability of coverage (Sec. 148.122).

Failure to provide guaranteed renewability as provided in

Sec. 148.122 includes those circumstances in which an issuer does

the following:

(1) Fails to renew or continue in force coverage at the option

of the individual, unless one of the specific exceptions in

Sec. 148.122 is met.

(2) Fails to follow the requirements relating to the

discontinuance of a particular product or withdrawal from the market

of a particular product as described in Sec. 148.122(d).

(3) Fails to continue coverage at the option of the individual

after the individual becomes eligible for Medicare.

(4) Fails to renew coverage for an individual who has been a

member of an association when the individual ceases to be a member

of the association, unless the association is a bona fide

association as defined in Sec. 144.103 and the issuer uniformly

terminates coverage for all former members.

(5) Otherwise fails to comply with Sec. 148.122.

c. Failure to comply with the requirements regarding

certification and disclosure of coverage (Sec. 148.124).

Failure to comply with the requirements of Sec. 148.124

regarding certification and

[[Page 45803]]

disclosure of previous coverage includes those circumstances in

which an issuer does any of the following:

(1) Fails to provide automatic certificates of creditable

coverage promptly.

(2) Fails to disclose the required information in certificates

of creditable coverage as provided in Sec. 148.124(b).

(3) Fails to provide certificates of creditable coverage to

dependents who are insured in the individual market and whose

coverage ceases under an individual policy.

(4) Fails to credit coverage or establish eligibility as

provided in Sec. 148.124 solely because the individual is unable to

obtain a certificate. This includes failing to accept, acknowledge,

consider, or otherwise use other evidence of creditable coverage

described in Sec. 146.115(c) submitted by, or on behalf of, an

individual to establish that person is an eligible individual.

(5) Otherwise fails to comply with Sec. 148.124.

d. Failure to comply with the requirements regarding

determination of an eligible individual (Sec. 148.126).

Failure to determine, as provided in Sec. 148.126, that an

applicant for health insurance is an eligible individual includes

those circumstances in which an issuer does the following:

(1) Fails to identify eligible individuals, to provide

information regarding all coverage options, and to issue policies

promptly.

(2) Requires eligible individuals to specify their desire to

invoke the requirements of part 148 or to explicitly request their

rights under the law in order to obtain information about products

available to them.

(3) Otherwise fails to comply with Sec. 148.126.

e. Failure to comply with the standards relating to benefits for

mothers and newborns (Sec. 148.170).

In States where the Sec. 148.170 standards are applicable (see

Sec. 148.170(e)), failure to comply with the Sec. 148.170 standards

relating to benefits for mothers and newborns includes those

circumstances in which a health insurance issuer does the following:

(1) Restricts benefits for a mother or her newborn to fewer than

48 hours following a vaginal delivery or fewer than 96 hours

following a delivery by cesarean section, unless the attending

provider decides, in consultation with the mother, to discharge the

mother or newborn earlier.

(2) Fails to calculate the length of stay from the time of

delivery when delivery occurs in a hospital, or from the time of

admission when delivery occurs outside the hospital.

(3) Requires an attending provider to obtain authorization to

prescribe a hospital length of stay of up to 48 hours (or 96 hours,

if applicable) after delivery.

(4) Imposes deductibles, coinsurance, or other cost-sharing

measures for any portion of a 48-hour (or 96-hour, if applicable)

hospital stay that are less favorable than those imposed on any

preceding portion of the stay.

(6) Penalizes a provider for complying with the law.

(7) Offers incentives to a provider to provide care in a manner

inconsistent with the provisions of Sec. 148.170 to avoid complying

with Sec. 148.170.

(8) Denies the mother or newborn eligibility or continued

eligibility solely to avoid the requirements of Sec. 148.170.

(9) Provides incentives to mothers to encourage them to accept

less than the minimum stay requirement.

(10) Fails to provide participants and beneficiaries with a

statement describing the requirements of the Newborns' and Mothers'

Health Protection Act of 1996, using the language provided at

Sec. 148.170 (d)(2), not later than March 1, 1999.

(11) Otherwise fails to comply with Sec. 148.170.

f. Failure to comply with the Women's Health and Cancer Rights

Act of 1998 (section 2752 of the PHS Act, 42 U.S.C. 300gg-52) and

any additional implementing regulations.

Subpart D--Administrative Hearings

Sec. 150.401 Definitions.

In this subpart, unless the context indicates otherwise:

ALJ means administrative law judge of the Departmental Appeals

Board of the Department of Health and Human Services.

Filing date means the date postmarked by the U.S. Postal Service,

deposited with a carrier for commercial delivery, or hand delivered.

Hearing includes a hearing on a written record as well as an in-

person or telephone hearing.

Party means HCFA or the respondent.

Receipt date means five days after the date of a document, unless

there is a showing that it was in fact received later.

Respondent means an entity that received a notice of proposed

assessment of a civil money penalty issued pursuant to Sec. 150.343.

Sec. 150.403 Scope of ALJ's authority.

(a) The ALJ has the authority, including all of the authority

conferred by the Administrative Procedure Act, to adopt whatever

procedures may be necessary or proper to carry out in an efficient and

effective manner the ALJ's duty to provide a fair and impartial hearing

on the record and to issue an initial decision concerning the

imposition of a civil money penalty.

(b) The ALJ's authority includes the authority to modify,

consistent with the Administrative Procedure Act (5 U.S.C. 552a), any

hearing procedures set out in this subpart.

(c) The ALJ does not have the authority to find invalid or refuse

to follow Federal statutes or regulations.

Sec. 150.405 Filing of request for hearing.

(a) A respondent has a right to a hearing before an ALJ if it files

a request for hearing that complies with Sec. 150.407(a), within 30

days after the date of issuance of either HCFA's notice of proposed

assessment under Sec. 150.343 or notice that an alternative dispute

resolution process has terminated. The request for hearing should be

addressed as instructed in the notice of proposed determination. ``Date

of issuance'' is five (5) days after the filing date, unless there is a

showing that the document was received earlier.

(b) The ALJ may extend the time for filing a request for hearing

only if the ALJ finds that the respondent was prevented by events or

circumstances beyond its control from filing its request within the

time specified above. Any request for an extension of time must be made

promptly by written motion.

Sec. 150.407 Form and content of request for hearing.

(a) The request for hearing must do the following:

(1) Identify any factual or legal bases for the assessment with

which the respondent disagrees.

(2) Describe with reasonable specificity the basis for the

disagreement, including any affirmative facts or legal arguments on

which the respondent is relying.

(b) The request for hearing must identify the relevant notice of

assessment by date and attach a copy of the notice.

Sec. 150.409 Amendment of notice of assessment or request for hearing.

The ALJ may permit HCFA to amend its notice of assessment, or

permit the respondent to amend a request for hearing that complies with

Sec. 150.407(a), if the ALJ finds that no undue prejudice to either

party will result.

Sec. 150.411 Dismissal of request for hearing.

An ALJ will order a request for hearing dismissed if the ALJ

determines that:

(a) The request for hearing was not filed within 30 days as

specified by Sec. 150.405(a) or any extension of time granted by the

ALJ pursuant to Sec. 150.405(b).

(b) The request for hearing fails to meet the requirements of

Sec. 150.407.

(c) The entity that filed the request for hearing is not a

respondent under Sec. 150.401.

(d) The respondent has abandoned its request.

(e) The respondent withdraws its request for hearing.

Sec. 150.413 Settlement.

HCFA has exclusive authority to settle any issue or any case,

without the consent of the administrative law judge at any time before

or after the administrative law judge's decision.

[[Page 45804]]

Sec. 150.415 Intervention.

(a) The ALJ may grant the request of an entity, other than the

respondent, to intervene if all of the following occur:

(1) The entity has a significant interest relating to the subject

matter of the case.

(2) Disposition of the case will, as a practical matter, likely

impair or impede the entity's ability to protect that interest.

(3) The entity's interest is not adequately represented by the

existing parties.

(4) The intervention will not unduly delay or prejudice the

adjudication of the rights of the existing parties.

(b) A request for intervention must specify the grounds for

intervention and the manner in which the entity seeks to participate in

the proceedings. Any participation by an intervenor must be in the

manner and by any deadline set by the ALJ.

(c) The Department of Labor or the IRS may intervene without regard

to paragraphs (a)(1) through (a)(3) of this section.

Sec. 150.417 Issues to be heard and decided by ALJ.

(a) The ALJ has the authority to hear and decide the following

issues:

(1) Whether a basis exists to assess a civil money penalty against

the respondent.

(2) Whether the amount of the assessed civil money penalty is

reasonable.

(b) In deciding whether the amount of a civil money penalty is

reasonable, the ALJ--

(1) Applies the factors that are identified in Sec. 150.317.

(2) May consider evidence of record relating to any factor that

HCFA did not apply in making its initial determination, so long as that

factor is identified in this subpart.

(c) If the ALJ finds that a basis exists to assess a civil money

penalty, the ALJ may sustain, reduce, or increase the penalty that HCFA

assessed.

Sec. 150.419 Forms of hearing.

(a) All hearings before an ALJ are on the record. The ALJ may

receive argument or testimony in writing, in person, or by telephone.

The ALJ may receive testimony by telephone only if the ALJ determines

that doing so is in the interest of justice and economy and that no

party will be unduly prejudiced. The ALJ may require submission of a

witness' direct testimony in writing only if the witness is available

for cross-examination.

(b) The ALJ may decide a case based solely on the written record

where there is no disputed issue of material fact the resolution of

which requires the receipt of oral testimony.

Sec. 150.421 Appearance of counsel.

Any attorney who is to appear on behalf of a party must promptly

file, with the ALJ, a notice of appearance.

Sec. 150.423 Communications with the ALJ.

No party or person (except employees of the ALJ's office) may

communicate in any way with the ALJ on any matter at issue in a case,

unless on notice and opportunity for both parties to participate. This

provision does not prohibit a party or person from inquiring about the

status of a case or asking routine questions concerning administrative

functions or procedures.

Sec. 150.425 Motions.

(a) Any request to the ALJ for an order or ruling must be by

motion, stating the relief sought, the authority relied upon, and the

facts alleged. All motions must be in writing, with a copy served on

the opposing party, except in either of the following situations:

(1) The motion is presented during an oral proceeding before an ALJ

at which both parties have the opportunity to be present.

(2) An extension of time is being requested by agreement of the

parties or with waiver of objections by the opposing party.

(b) Unless otherwise specified in this subpart, any response or

opposition to a motion must be filed within 20 days of the party's

receipt of the motion. The ALJ does not rule on a motion before the

time for filing a response to the motion has expired except where the

response is filed at an earlier date, where the opposing party consents

to the motion being granted, or where the ALJ determines that the

motion should be denied.

Sec. 150.427 Form and service of submissions.

(a) Every submission filed with the ALJ must be filed in

triplicate, including one original of any signed documents, and

include:

(1) A caption on the first page, setting forth the title of the

case, the docket number (if known), and a description of the submission

(such as ``Motion for Discovery'').

(2) The signatory's name, address, and telephone number.

(3) A signed certificate of service, specifying each address to

which a copy of the submission is sent, the date on which it is sent,

and the method of service.

(b) A party filing a submission with the ALJ must, at the time of

filing, serve a copy of such submission on the opposing party. An

intervenor filing a submission with the ALJ must, at the time of

filing, serve a copy of the submission on all parties. Service must be

made by mailing or hand delivering a copy of the submission to the

opposing party. If a party is represented by an attorney, service must

be made on the attorney.

Sec. 150.429 Computation of time and extensions of time.

(a) For purposes of this subpart, in computing any period of time,

the time begins with the day following the act, event, or default and

includes the last day of the period unless it is a Saturday, Sunday, or

legal holiday observed by the Federal government, in which event it

includes the next business day. When the period of time allowed is less

than seven days, intermediate Saturdays, Sundays, and legal holidays

observed by the Federal government are excluded from the computation.

(b) The period of time for filing any responsive pleading or papers

is determined by the date of receipt (as defined in Sec. 150.401) of

the submission to which a response is being made.

(c) The ALJ may grant extensions of the filing deadlines specified

in these regulations or set by the ALJ for good cause shown (except

that requests for extensions of time to file a request for hearing may

be granted only on the grounds specified in section Sec. 150.405(b)).

Sec. 150.431 Acknowledgment of request for hearing.

After receipt of the request for hearing, the ALJ assigned to the

case or someone acting on behalf of the ALJ will send a letter to the

parties that acknowledges receipt of the request for hearing,

identifies the docket number assigned to the case, provides

instructions for filing submissions and other general information

concerning procedures, and sets out the next steps in the case.

Sec. 150.435 Discovery.

(a) The parties must identify any need for discovery from the

opposing party as soon as possible, but no later than the time for the

reply specified in Sec. 150.437(c). Upon request of a party, the ALJ

may stay proceedings for a reasonable period pending completion of

discovery if the ALJ determines that a party would not be able to make

the submissions required by Sec. 150.437 without discovery. The parties

should attempt to resolve any discovery issues informally before

seeking an order from the ALJ.

(b) Discovery devices may include requests for production of

documents,

[[Page 45805]]

requests for admission, interrogatories, depositions, and stipulations.

The ALJ orders interrogatories or depositions only if these are the

only means to develop the record adequately on an issue that the ALJ

must resolve to decide the case.

(c) Each discovery request must be responded to within 30 days of

receipt, unless that period of time is extended for good cause by the

ALJ.

(d) A party to whom a discovery request is directed may object in

writing for any of the following reasons:

(1) Compliance with the request is unduly burdensome or expensive.

(2) Compliance with the request will unduly delay the proceedings.

(3) The request seeks information that is wholly outside of any

matter in dispute.

(4) The request seeks privileged information. Any party asserting a

claim of privilege must sufficiently describe the information or

document being withheld to show that the privilege applies. If an

asserted privilege applies to only part of a document, a party

withholding the entire document must state why the nonprivileged part

is not segregable.

(e) Any motion to compel discovery must be filed within 10 days

after receipt of objections to the party's discovery request, within 10

days after the time for response to the discovery request has elapsed

if no response is received, or within 10 days after receipt of an

incomplete response to the discovery request. The motion must be

reasonably specific as to the information or document sought and must

state its relevance to the issues in the case.

Sec. 150.437 Submission of briefs and proposed hearing exhibits.

(a) Within 60 days of its receipt of the acknowledgment provided

for in Sec. 150.431, the respondent must file the following with the

ALJ:

(1) A statement of its arguments concerning HCFA's notice of

assessment (respondent's brief), including citations to the

respondent's hearing exhibits provided in accordance with paragraph

(a)(2) of this section. The brief may not address factual or legal

bases for the assessment that the respondent did not identify as

disputed in its request for hearing or in an amendment to that request

permitted by the ALJ.

(2) All documents (including any affidavits) supporting its

arguments, tabbed and organized chronologically and accompanied by an

indexed list identifying each document (respondent's proposed hearing

exhibits).

(3) A statement regarding whether there is a need for an in-person

hearing and, if so, a list of proposed witnesses and a summary of their

expected testimony that refers to any factual dispute to which the

testimony will relate.

(4) Any stipulations or admissions.

(b) Within 30 days of its receipt of the respondent's submission

required by paragraph (a) of this section, HCFA will file the following

with the ALJ:

(1) A statement responding to the respondent's brief, including the

respondent's proposed hearing exhibits, if appropriate. The statement

may include citations to HCFA's proposed hearing exhibits submitted in

accordance with paragraph (b)(2) of this section.

(2) Any documents supporting HCFA's response not already submitted

as part of the respondent's proposed hearing exhibits, organized and

indexed as indicated in paragraph (a)(2) of this section (HCFA's

proposed hearing exhibits).

(3) A statement regarding whether there is a need for an in-person

hearing and, if so, a list of proposed witnesses and a summary of their

expected testimony that refers to any factual dispute to which the

testimony will relate.

(4) Any admissions or stipulations.

(c) Within 15 days of its receipt of HCFA's submission required by

paragraph (b) of this section, the respondent may file with the ALJ a

reply to HCFA's submission.

Sec. 150.439 Effect of submission of proposed hearing exhibits.

(a) Any proposed hearing exhibit submitted by a party in accordance

with Sec. 150.437 is deemed part of the record unless the opposing

party raises an objection to that exhibit and the ALJ rules to exclude

it from the record. An objection must be raised either in writing prior

to the prehearing conference provided for in Sec. 150.441 or at the

prehearing conference. The ALJ may require a party to submit the

original hearing exhibit on his or her own motion or in response to a

challenge to the authenticity of a proposed hearing exhibit.

(b) A party may introduce a proposed hearing exhibit following the

times for submission specified in Sec. 150.437 only if the party

establishes to the satisfaction of the ALJ that it could not have

produced the exhibit earlier and that the opposing party will not be

prejudiced.

Sec. 150.441 Prehearing conferences.

An ALJ may schedule one or more prehearing conferences (generally

conducted by telephone) on the ALJ's own motion or at the request of

either party for the purpose of any of the following:

(a) Hearing argument on any outstanding discovery request.

(b) Establishing a schedule for any supplements to the submissions

required by Sec. 150.437 because of information obtained through

discovery.

(c) Hearing argument on a motion.

(d) Discussing whether the parties can agree to submission of the

case on a stipulated record.

(e) Establishing a schedule for an in-person hearing, including

setting deadlines for the submission of written direct testimony or for

the written reports of experts.

(f) Discussing whether the issues for a hearing can be simplified

or narrowed.

(g) Discussing potential settlement of the case.

(h) Discussing any other procedural or substantive issues.

Sec. 150.443 Standard of proof.

(a) In all cases before an ALJ--

(1) HCFA has the burden of coming forward with evidence sufficient

to establish a prima facie case;

(2) The respondent has the burden of coming forward with evidence

in response, once HCFA has established a prima facie case; and

(3) HCFA has the burden of persuasion regarding facts material to

the assessment; and

(4) The respondent has the burden of persuasion regarding facts

relating to an affirmative defense.

(b) The preponderance of the evidence standard applies to all cases

before the ALJ.

Sec. 150.445 Evidence.

(a) The ALJ will determine the admissibility of evidence.

(b) Except as provided in this part, the ALJ will not be bound by

the Federal Rules of Evidence. However, the ALJ may apply the Federal

Rules of Evidence where appropriate; for example, to exclude unreliable

evidence.

(c) The ALJ excludes irrelevant or immaterial evidence.

(d) Although relevant, evidence may be excluded if its probative

value is substantially outweighed by the danger of unfair prejudice,

confusion of the issues, or by considerations of undue delay or

needless presentation of cumulative evidence.

(e) Although relevant, evidence is excluded if it is privileged

under Federal law.

(f) Evidence concerning offers of compromise or settlement made in

this

[[Page 45806]]

action will be inadmissible to the extent provided in the Federal Rules

of Evidence.

(g) Evidence of acts other than those at issue in the instant case

is admissible in determining the amount of any civil money penalty if

those acts are used under Secs. 150.317 and 150.323 of this part to

consider the entity's prior record of compliance, or to show motive,

opportunity, intent, knowledge, preparation, identity, or lack of

mistake. This evidence is admissible regardless of whether the acts

occurred during the statute of limitations period applicable to the

acts that constitute the basis for liability in the case and regardless

of whether HCFA's notice sent in accordance with Secs. 150.307 and

150.343 referred to them.

(h) The ALJ will permit the parties to introduce rebuttal witnesses

and evidence.

(i) All documents and other evidence offered or taken for the

record will be open to examination by all parties, unless the ALJ

orders otherwise for good cause shown.

(j) The ALJ may not consider evidence regarding the willingness and

ability to enter into and successfully complete a corrective action

plan when that evidence pertains to matters occurring after HCFA's

notice under Sec. 150.307.

Sec. 150.447 The record.

(a) Any testimony that is taken in-person or by telephone is

recorded and transcribed. The ALJ may order that other proceedings in a

case, such as a prehearing conference or oral argument of a motion, be

recorded and transcribed.

(b) The transcript of any testimony, exhibits and other evidence

that is admitted, and all pleadings and other documents that are filed

in the case constitute the record for purposes of an ALJ decision.

(c) For good cause, the ALJ may order appropriate redactions made

to the record.

Sec. 150.449 Cost of transcripts.

Generally, each party is responsible for 50 percent of the

transcript cost. Where there is an intervenor, the ALJ determines what

percentage of the transcript cost is to be paid for by the intervenor.

Sec. 150.451 Posthearing briefs.

Each party is entitled to file proposed findings and conclusions,

and supporting reasons, in a posthearing brief. The ALJ will establish

the schedule by which such briefs must be filed. The ALJ may direct the

parties to brief specific questions in a case and may impose page

limits on posthearing briefs. Additionally, the ALJ may allow the

parties to file posthearing reply briefs.

Sec. 150.453 ALJ decision.

The ALJ will issue an initial agency decision based only on the

record and on applicable law; the decision will contain findings of

fact and conclusions of law. The ALJ's decision is final and appealable

after 30 days unless it is modified or vacated under Sec. 150.457.

Sec. 150.455 Sanctions.

(a) The ALJ may sanction a party or an attorney for failing to

comply with an order or other directive or with a requirement of a

regulation, for abandonment of a case, or for other actions that

interfere with the speedy, orderly or fair conduct of the hearing. Any

sanction that is imposed will relate reasonably to the severity and

nature of the failure or action.

(b) A sanction may include any of the following actions:

(1) In the case of failure or refusal to provide or permit

discovery, drawing negative fact inferences or treating such failure or

refusal as an admission by deeming the matter, or certain facts, to be

established.

(2) Prohibiting a party from introducing certain evidence or

otherwise advocating a particular claim or defense.

(3) Striking pleadings, in whole or in part.

(4) Staying the case.

(5) Dismissing the case.

(6) Entering a decision by default.

(7) Refusing to consider any motion or other document that is not

filed in a timely manner.

(8) Taking other appropriate action.

Sec. 150.457 Review by Administrator.

(a) The Administrator of HCFA (which for purposes of this

subsection may include his or her delegate), at his or her discretion,

may review in whole or in part any initial agency decision issued under

Sec. 150.453.

(b) The Administrator may decide to review an initial agency

decision if it appears from a preliminary review of the decision (or

from a preliminary review of the record on which the initial agency

decision was based, if available at the time) that:

(1) The ALJ made an erroneous interpretation of law or regulation.

(2) The initial agency decision is not supported by substantial

evidence.

(3) The ALJ has incorrectly assumed or denied jurisdiction or

extended his or her authority to a degree not provided for by statute

or regulation.

(4) The ALJ decision requires clarification, amplification, or an

alternative legal basis for the decision.

(5) The ALJ decision otherwise requires modification, reversal, or

remand.

(c) Within 30 days of the date of the initial agency decision, the

Administrator will mail a notice advising the respondent of any intent

to review the decision in whole or in part.

(d) Within 30 days of receipt of a notice that the Administrator

intends to review an initial agency decision, the respondent may

submit, in writing, to the Administrator any arguments in support of,

or exceptions to, the initial agency decision.

(e) This submission of the information indicated in paragraph (d)

of this section must be limited to issues the Administrator has

identified in his or her notice of intent to review, if the

Administrator has given notice of an intent to review the initial

agency decision only in part. A copy of this submission must be sent to

the other party.

(f) After receipt of any submissions made pursuant to paragraph (d)

of this section and any additional submissions for which the

Administrator may provide, the Administrator will affirm, reverse,

modify, or remand the initial agency decision. The Administrator will

mail a copy of his or her decision to the respondent.

(g) The Administrator's decision will be based on the record on

which the initial agency decision was based (as forwarded by the ALJ to

the Administrator) and any materials submitted pursuant to paragraphs

(b), (d), and (f) of this section.

(h) The Administrator's decision may rely on decisions of any

courts and other applicable law, whether or not cited in the initial

agency decision.

Sec. 150.459 Judicial review.

(a) Filing of an action for review. Any responsible entity against

whom a final order imposing a civil money penalty is entered may obtain

review in the United States District Court for any district in which

the entity is located or in the United States District Court for the

District of Columbia by doing the following:

(1) Filing a notice of appeal in that court within 30 days from the

date of a final order.

(2) Simultaneously sending a copy of the notice of appeal by

registered mail to HCFA.

(b) Certification of administrative record. HCFA promptly certifies

and files with the court the record upon which the penalty was

assessed.

[[Page 45807]]

(c) Standard of review. The findings of HCFA and the ALJ may not be

set aside unless they are found to be unsupported by substantial

evidence, as provided by 5 U.S.C. 706(2)(E).

Sec. 150.461 Failure to pay assessment.

If any entity fails to pay an assessment after it becomes a final

order, or after the court has entered final judgment in favor of HCFA,

HCFA refers the matter to the Attorney General, who brings an action

against the entity in the appropriate United States district court to

recover the amount assessed.

Sec. 150.463 Final order not subject to review.

In an action brought under Sec. 150.461, the validity and

appropriateness of the final order described in Sec. 150.459 is not

subject to review.

Sec. 150.465 Collection and use of penalty funds.

(a) Any funds collected under Sec. 150.461 are paid to HCFA.

(b) The funds are available without appropriation until expended.

(c) The funds may be used only for the purpose of enforcing the

HIPAA requirements for which the penalty was assessed.

Dated: April 16, 1999.

Nancy-Ann Min DeParle,

Administrator, Health Care Financing Administration.

Dated May 25, 1999.

Donna E. Shalala,

Secretary.

[FR Doc. 99-21662 Filed 8-19-99; 8:45 am]

BILLING CODE 4120-01-P