Health Care Fraud and Abuse Data Collection Program: Reporting of Final Adverse Actions

SUMMARY: This final rule establishes a new CFR part to implement the

statutory requirements of section 1128E of the Social Security Act, as

added by section 221(a) of the Health Insurance Portability and

Accountability Act (HIPAA) of 1996. Section 221(a) of HIPAA

specifically directs the Secretary to establish a national health care

fraud and abuse data collection program for the reporting and

disclosing of certain final adverse actions taken against health care

providers, suppliers and practitioners, and to maintain a data base of

final adverse actions taken against health care providers, suppliers

and practitioners.

EFFECTIVE DATE: This rule is effective on October 26, 1999.

FOR FURTHER INFORMATION CONTACT: Thomas C. Croft, Director, Division of

Quality Assurance, Bureau of Health Professions, Health Resources and

Services Administration, (301) 443-2300.

SUPPLEMENTARY INFORMATION:

I. Background

The Healthcare Integrity and Protection Data Bank

On October 30, 1998, the Office of Inspector General (OIG)

published a proposed rule in the Federal Register (63 FR 58341)

designed to implement the statutory requirements of section 1128E of

the Social Security Act (the Act), as added by section 221(a) of the

Health Insurance Portability and Accountability Act (HIPAA) of 1996.

Section 221(a) of HIPAA specifically directs the Secretary to establish

a national health care fraud and abuse data collection program for the

reporting and disclosing of certain final adverse actions taken against

health care providers, suppliers and practitioners, and to maintain a

data base of final adverse actions taken against health care providers,

suppliers and practitioners. Final adverse actions include: (1) Civil

judgments against a health care provider, supplier, or practitioner in

Federal or State court related to the delivery of a health care item or

service; (2) Federal or State criminal convictions against a health

care provider, supplier or practitioner related to the delivery of a

health care item or service; (3) actions by Federal or State agencies

responsible for the licensing and certification of health care

providers, suppliers or practitioners; (4) exclusion of a health care

provider, supplier or practitioner from participation in Federal or

State health care programs; and (5) any other adjudicated actions or

decisions that the Secretary establishes by regulation. Settlements in

which no findings or admissions of liability have been made will be

excluded from reporting. Access to this new data bank is limited to

Federal and State Government agencies and health plans. Reporting is

limited to these same groups. Health care providers, suppliers and

practitioners may self query the data bank, but have no reporting

responsibilities. The Act also requires the Secretary to implement the

national health care fraud and abuse data collection program in such a

manner as to (1) assure that the privacy of individuals is maintained;

(2) establish reasonable fees for disclosure of information to recover

full operating costs; and (3) avoid duplication with the reporting

requirements established for the National Practitioner Data Bank

(NPDB). This new data bank is known as the Healthcare Integrity and

Protection Data Bank (HIPDB).

II. Summary of the Proposed Rule

The proposed regulations published on October 30, 1998 were

developed to establish a new 45 CFR part 61 to implement the

requirements for reporting of specific data elements to, and procedures

for obtaining information from, the HIPDB (and are applicable to

Federal and State Government agencies and health plans). Set forth

below is a description of the major provisions of the proposed rule,

including, among other things, proposed definitions for certain terms

associated with the HIPDB, a discussion of the specific reporting

requirements and when such information must be reported, the fees

applicable to requests for information, the issues of the

confidentiality of information, and how to dispute the accuracy of

information in the HIPDB.

Provisions of the Proposed Rule

1. Definitions

The proposed regulations expanded on previous regulatory

definitions and clarified aspects of a number of terms set forth in the

statute. The clarifications served to provide additional examples of

the scope of the statutory definitions, but did not go beyond

congressional intent. The proposed rule specifically set forth

definitions for the terms ``affiliated or associated;'' ``Government

agency;'' ``health care provider;'' ``health care supplier;'' ``health

plan;'' ``licensed health care practitioner, licensed practitioner and

practitioner;'' and ``other adjudicated actions or decisions.''

2. When Information Must Be Reported

The proposed regulations sought to establish the time frame for

submitting reports to the HIPDB. As proposed, information would be

submitted to the HIPDB (1) within 30 calendar days from the date the

final adverse action was taken or the date when the reporting entity

became aware of the final adverse action, or (2) by the close of the

entity's next monthly reporting cycle, whichever is later. The date the

final adverse action was taken, its effective date and duration of the

action would all be contained in the information reported to the HIPDB.

We also proposed a list of ``mandatory'' data elements, as well as

data elements that must be reported to the data bank ``if known.'' We

note that section 1128E(b)(2)(A) of the Act mandates that Federal and

State Government agencies and health care plans collect and report

Social Security Numbers and Federal Employer Identification Numbers for

the purposes of reporting to the HIPDB.

3. Reporting Errors, Omissions, Revisions and Actions on Appeal

In Sec. 61.6 of the proposed regulations, we indicated that if any

errors or omissions in the final adverse action are discovered after

the information has been reported, the person or entity that reported

such information must send an addition or correction to the HIPDB

within 60 calendar days of the discovery. We also proposed that any

revision to the action or to appeal status must similarly be reported

within 30 calendar days after the reporting entity learns of such

revision or appeal. In turn, we proposed that each subject of a report

will receive a copy when it is entered into the HIPDB and a copy of all

revisions and corrections to the report. This is an opportunity only

for the reporting entity to correct any errors or omissions in the

information, not for the subjects to request re-adjudication of their

cases.

[[Page 57741]]

4. Reporting Licensure Actions Taken by Federal or State Licensing and

Certification Agencies

In proposed Sec. 61.7, we addressed the reporting of licensure

actions taken by Federal and State licensing and certification

agencies. We proposed defining the phrase ``any other negative action

or finding'' by a Federal or State licensing and certification

authority to mean any action or finding that is publicly available and

rendered by a licensing or certification authority. These actions or

findings include, but are not limited to, imposition of civil money

penalties (CMPs) and administrative fines, limitations on the scope of

practice, injunctions and forfeitures. As indicated in the proposed

rule, this definition included final adverse actions occurring in

conjunction with settlements in which no findings or admissions of

liability have been made, and that would otherwise be reportable under

the statute.

The statute also requires the reporting of a health care provider,

supplier or practitioner who voluntarily surrenders a license or

certification. Based on extensive discussions with various State

agencies, we were advised that voluntary surrender and non-renewal of

licensure and provider participation agreements are not infrequently

used as means to exclude questionable health care providers, suppliers

and practitioners from participating in Federal and State health care

programs. These voluntary surrenders and non-renewal actions result in

allowing questionable health care providers, suppliers or practitioners

to move from State to State without the new State licensing agency

becoming aware of the true nature of the action in the prior licensing

State. Therefore, for reporting purposes, we proposed that the term

``voluntary surrender'' include a surrender made after a notification

of investigation or a formal official request by Federal or State

licensing or certification authorities for a health care provider,

supplier or practitioner to surrender the license or certification

(including certification agreements or contracts for participation in

Federal or State health care programs). This proposed definition also

included those instances where a health care provider, supplier or

practitioner voluntarily surrenders a license or certification

(including program participation agreements or contracts) in exchange

for a decision by the licensing or certification authority to cease an

investigation or similar proceeding, or in return for not conducting an

investigation or proceeding, or in lieu of a disciplinary action.

We recognized that many voluntary surrenders are not a result of

the types of adverse actions that are intended for inclusion in the

HIPDB. Therefore, we proposed that voluntary surrenders and licensure

non-renewals due to nonpayment of licensure fees, changes to inactive

status, and retirement be excluded from reporting to the HIPDB unless

they are taken in combination with one or more of the circumstances

listed above (in which case they would be reportable).

5. Reporting Federal or State Criminal Convictions Related to the

Delivery of a Health Care Item or Service

In proposed Sec. 61.8, we stated that Federal and State law

enforcement and investigative agencies would be required to report

criminal convictions against health care providers, suppliers or

practitioners. Consistent with section 1128E(g)(1)(A)(ii) of the Act,

we also proposed that criminal convictions unrelated to the delivery of

health care items or services would not be reported under this section.

6. Reporting of Civil Judgments in Federal or State Court Related to

the Delivery of a Health Care Item or Service

In proposed Sec. 61.9, we put forth that Federal and State law

enforcement and investigative agencies and health plans be required to

report civil judgments related to the delivery of a health care item or

service (except those resulting from medical malpractice) against

health care providers, suppliers or practitioners. The proposed rule

indicated that civil judgments must be entered or approved by a Federal

or State court. We also proposed that this reporting requirement would

not include Consent Judgments that have been agreed upon and entered to

provide security for civil settlements in which there was no finding or

admission of liability.

7. Reporting Exclusion From Participation in Federal or State Health

Care Programs

In proposed Sec. 61.10, we stated that the OIG would be required to

report health care providers, suppliers or practitioners excluded from

participating in Federal or State health care programs. We also

proposed that this section include exclusions made in a matter in which

there also was a settlement even though the settlement itself is not

reported because no findings or admissions of liability had been made.

8. Reporting Other Adjudicated Actions or Decisions

In proposed Sec. 61.11, we proposed that Federal and State agencies

and health plans be required to report other adjudicated actions or

decisions. Although not specifically required by the statute, we

proposed that ``any other adjudicated actions or decisions'' should

relate to the delivery of a health care item or service, as do criminal

convictions and civil judgments collected under the statute. We also

proposed in this section that a due process mechanism be available with

all adjudicated actions or decisions. In the proposed rule, we provided

examples of an adjudicated action or decision to include, but not be

limited to:

Orders by an administrative law judge;

CMPs and assessments;

Revocations, debarments or other restrictions from

participating in Federal or State government contracts or programs;

Liquidation, dissolution, cancellation or revocation of a

professional license; or

Limitations on either clinical privileges or staff

privileges by a health plan.

9. Fees Applicable to Requests for Information

Proposed Sec. 61.13 addressed fees applicable to all requests for

information from the HIPDB. In accordance with this proposed section,

fees to be charged would be based on the full costs of operating the

database, as authorized in section 1128E(d)(2) of the Act; criteria for

assessing fees would be based on the guidelines set forth in OMB

Circular A-25. These costs would encompass all direct and indirect

costs of providing such information, including but not limited to:

Direct and indirect personnel costs;

Physical overhead, consulting, and other indirect costs;

Agency management and supervisory costs; and

Costs of enforcement, collection, research, establishment,

regulations and guidance.

For maximum efficiency, we proposed that the HIPDB be an all-

electronic system, with all fees collected through the most cost-

effective methods (such as credit card and electronic funds transfer).

The Act exempts Federal agencies from these fees.

10. Confidentiality of HIPDB Information

In proposed Sec. 61.14, we stated that the confidentiality

requirements would

[[Page 57742]]

apply to all information obtained from the HIPDB. The confidentiality

requirements are clearly specified in sections 1128E(b)(3) and (d)(1)

and 1128C(a)(3)(B)(ii) of the Act. Specifically, section 1128E(b)(3) of

the Act requires the Secretary to protect the privacy of individuals

receiving health care services when determining what information is

required. Section 1128E(d)(1) of the Act requires that information in

the HIPDB will be available to Federal and State Government agencies

and health plans. Section 1128C(a)(3)(B)(ii) of the Act requires the

Secretary to assure that HIPDB information is provided and utilized in

a manner that appropriately protects the confidentiality of the

information. We proposed that information from this system be

confidential and disclosed only for the purpose for which it was

provided. We also proposed that appropriate uses of the information

would include the prevention of fraud and abuse activities and

improving the quality of patient care. This proposed provision did not

go beyond the requirements set forth in the Act. The proposed

requirements would not prevent an authorized user from sharing

information from the HIPDB within the entity that requested it, as long

as the information is used solely for the purpose for which it was

provided. However, in accordance with section 1128E(b)(3) of the Act,

we proposed that information obtained by a Government contractor, e.g.,

a Medicare carrier, an intermediary or auditor, may only be used in the

furtherance of its contractual responsibilities.

11. How To Obtain Access to, and Dispute the Accuracy of, HIPDB

Information

The proposed regulations outlined the procedures for obtaining

access to a report, submitting a statement, filing a dispute, and

revising disputed information in a previously submitted report. These

procedures are basically comparable to, or more generous than,

procedures established in the Department's Privacy Act regulations at

45 CFR part 5b. The Secretary has exempted the HIPDB from those Privacy

Act requirements in order to establish a more comprehensive and

generous notification, access and correction procedure. While these

procedures basically are comparable to similar provisions in the

Privacy Act, these procedures include significant rights in addition to

those set forth in the Privacy Act. For example, when a HIPDB report is

created or amended, we automatically provide subjects a copy of the all

report. Subjects may also file a statement of disagreement with a

report as soon as the report is filed , rather than at the end of an

appeal process, as under the Privacy Act.

In addition, we proposed that the subject of a report may dispute

only the factual accuracy of the information contained in the HIPDB

report concerning the individual or entity. As indicated in the

proposed rule, the dispute process would afford the subject an

opportunity to bring relevant factual information, including reversals

of criminal convictions by an appeals court, to the attention of the

reporter. The proposed dispute process would be consistent with that

for the NPDB.

12. Sanctions for Failure To Report

We incorporated the new CMP sanctions provision for failure to

report information to the data bank, as set forth in section 4331 of

Public Law 105-33, the Balanced Budget Act of 1997. In the proposed

rule, we indicated that any health plan that fails to report

information on a final adverse action that is required to be reported

would be subject to a CMP of not more than $25,000 for each such

adverse action not reported. Such penalties would be imposed and

collected in the same manner as other CMPs under section 1128A of the

Act.

III. Summary and Response to Public Comments

As we have noted, the statute upon which the proposed regulations

were drafted is quite broad and affords the Secretary numerous areas of

discretionary authority on which we sought the benefit of public

comment and input. The proposed rule set forth a 60-day public comment

period ending December 29, 1998. On December 30, 1998, we extended the

comment period for the proposed rule by an additional 2 weeks until

January 11, 1999 (63 FR 71819). As a result, we received a total of 117

timely-filed public comments from Federal and State law enforcement

agencies; health care practitioner and provider licensing boards,

health departments, private attorneys representing health care

providers, suppliers and practitioners; and various health plans,

health plan associations, hospitals, professional associations, health

care practitioners and other individuals and entities. Based on review

of the statute and the assessment of public comments received, we

believe the final regulations implementing this authority fully and

adequately balance the concerns of the Department with those expressed

by outside individuals and entities.

Set forth below is an overview of the various comments and

recommendations received and our responses to those concerns. Section

IV. of this preamble sets forth a summary of the specific revisions and

clarifications to be made to the final regulations as a result of those

comments.

A. Scope and Intent of the HIPDB

Comment: A principal concern raised in the majority of comments was

the interpretation of what constitutes the reporting threshold for all

final adverse actions under the term ``health care fraud and abuse.''

Many commenters believed that the OIG broadened the definitions and

criteria unnecessarily for reportable actions, well beyond a ``health

care fraud and abuse'' data collection system. Specifically, these

commenters only wanted actions involving health care related fraud and

abuse reported to the HIPDB.

Response: It is clear from reviewing the statutory language of the

implementing Act, and the legislative history (such as congressional

conference reports), that the HIPDB is not merely about establishing an

information collection system. Rather, it is directed at combating

fraud and abuse in a broader scope. Congress used the term health care

fraud and abuse only once in the provision's opening paragraph for

purposes of naming the data collection program. The term does not

appear elsewhere, especially with regard to limiting the scope of

reportable actions. Instead, Congress defined reportable ``final

adverse actions'' by specifying a finite list of actions. These actions

include civil judgments related to the delivery of a health care item

or service; Federal or State criminal convictions related to the

delivery of a health care item or service; actions taken by Federal or

State licensing or certification agencies; exclusions from

participation in Federal or State health care programs; and any other

adjudicated actions or decisions taken by a Federal or State Government

agency or health plan. To limit the adverse actions collected by the

data bank to only those that are based on health care fraud and abuse

would create a data bank that does not fully capture the types of

reports that Congress clearly intended to be collected in accordance

with the statute.

The term ``health care fraud and abuse,'' as used in the statute,

merely represents congressional intent that the HIPDB support efforts

to prevent such activities. To limit actions collected only to those

based on fraud and abuse would deny investigators, Government

contracting officers, health plans and

[[Page 57743]]

others the reports which are necessary to effectively research the

relevant backgrounds of potential providers, suppliers and

practitioners. As indicated by one State licensing board, narrowing the

scope of reportable actions may create an even greater burden on

reporters to screen out final adverse action based solely on health

care fraud and abuse. Accordingly, the definition related to final

adverse actions, as well as the definitions of health care provider,

supplier and practitioner, represent the statutorily-mandated reporting

criteria for the HIPDB--and is not limited to health care fraud and

abuse. It has been our goal to establish a complete and comprehensive

data bank that effectively deters health care fraud and abuse in the

health care industry, while promoting quality health care and

protecting the public. A further discussion of the term ``health care

fraud and abuse'' is contained in section III. B. 6. of this preamble.

B. Section-by-Section Analysis of Issues

Section 61.1 The Healthcare Integrity and Protection Data Bank

Comment: Several commenters viewed the regulations, in general, as

overly-broad and complex. Two commenters stated that information

reported to the HIPDB should be directly related to health care fraud

and abuse (see discussion regarding the definition of ``health care

fraud and abuse'' in the discussion of Sec. 61.3 later in this section

of this preamble). Another commenter expressed concern that the HIPDB

would contain data on individuals who have not committed fraud. This

commenter and others believed that the OIG will establish a vast system

not targeted to identify truly egregious individuals and entities.

Response: We disagree with these comments. As indicated in the

proposed rule and in the summary section above in this preamble, we

believe this rulemaking and the HIPDB clearly focus on specific final

adverse actions taken against individuals and entities, and that those

actions relate to these actions that could be defined as ``health care

fraud and abuse.'' We believe these implementing regulations and the

data bank are consistent with statutory intent and are properly

targeted at capturing specific types of information relevant to the

HIPDB's intended purpose.

Section 61.3 Definitions

1. Affiliated or Associated

Comment: With regard to the definition and application of the term

``affiliated or associated,'' several commenters stated that the

proposed definition overreached the intent of the statute.

Response: The OIG believes the definition supports congressional

intent to enable authorized users who conduct fraud and abuse

investigations to identify other business or commercial affiliations

through which the subject may have committed other acts of wrongdoing,

and to aid with subject identification, if the affiliation or

association is known by the reporter.

Comment: Several commenters requested the definition be refined to

exclude irrelevant affiliations and associations. The commenters

recommended that the definition be limited to (1) those entities in

which the subject has a business interest, and (2) those associations

having the power to revoke or suspend a license.

Response: We agree that the definition and implementation of the

term ``affiliated or associated'' set forth in the proposed rule may

have resulted in some confusion. As a result, we are limiting the

definition, in accordance with the first part of the commenters'

concerns, to those health care entities in which the subject has a

commercial interest.

Comment: A number of commenters believed that the collection of

this information set forth in the definition would be in violation of

the Privacy Act, as it implies guilt by association.

Response: The inclusion of an entity in this category by a reporter

will in no way imply that the entity was a party to the act(s) or

omission(s) that led to a reportable final adverse action. We believe

that the revised definition will eliminate naming of professional

affiliations or associations and the implied fear of invasion of

privacy. We also note only individuals, not entities (even if the

entity is an individual professional corporation), are protected by the

Privacy Act.

Comment: One commenter believed that ``affiliated or associated''

entities should be included only if such entities had an active role in

the underlying sanction. Another commenter stated the names of

``affiliated or associated'' entities should be expunged after an

investigation that determined there was no involvement by the

affiliation or association entity. A third commenter believed that

there would be increased liability for reporters as a result of the

definition set forth for this term.

Response: We believe limiting ``affiliations or associations'' to

those health care entities with an active role in the underlying

sanction, or removing the names after an investigation has determined

there was no involvement by the affiliated or associated entity, would

be contrary to the specific language of the statute. The statute

explicitly requires that the names of affiliated or associated health

care entities be reported. Involvement or non-involvement in the

underlying action is irrelevant to this reporting requirement. Further,

we do not agree that merely identifying an entity as being affiliated

with the subject of a report somehow imputes wrongdoing to the

affiliated entity, and a statement to this effect will be included in

the data base report. There will be no independent identification of

affiliated or associated entities in the HIPDB other than as part of a

subject's report, unless the entity also has been the subject of a

final adverse action. If it comes to the attention of a business entity

that it is incorrectly identified in a subject's report as having a

commercial business affiliation with the subject, then the business

entity may avail itself of the same correction procedures that are

available to the subject of a report. The affiliated entity first may

ask the reporting agency or health plan to correct the subject's

report. If the reporter declines to do so, the affiliated entity may

request a correction to the subject's report by the Secretary. With

respect to an increase in liability for reporters, the OIG is providing

an immunity provision in the final rule that will alleviate any

perceived increase in liability.

Comment: One commenter requested that the HIPDB provide written

notice to each entity listed as an ``affiliated or associated health

care entity'' within a final adverse action report, and that the HIPDB

offer an appeal process to these entities in the event that the

entities are incorrectly reported.

Response: The revised definition will require that a commercial

relationship exist between the subject and the affiliate or associate.

As we have previously noted, we believe that this data field in no way

implies wrongdoing on the part of the reported affiliate or associate,

and thus eliminates the need for these entities to be notified.

2. Any Other Negative Action or Finding

Comment: We received several comments regarding the manner in which

the term ``any other negative action or finding'' was defined. Most of

the commenters stated the proposed definition was too broad in nature

and would create a tremendous burden on the reporters, especially if

actions or findings pertaining to administrative fines and citations

were to be included in the HIPDB. Several commenters

[[Page 57744]]

expressed concern that there is a range of actions or findings taken

that may or may not be the same from State to State and do not relate

to health care per se (such as a practitioner fined for failure to

provide a new address). The commenters requested that the OIG clarify

and limit the definition of this term to actions that are directly

connected to health care violations.

Response: We agree with the commenters that there will be variation

from State to State regarding the types of final actions taken against

health care providers, suppliers and practitioners. However, the HIPDB

is being designed as a ``flagging system'' that will contain

information on actions taken in a particular State or program that are

considered by the State or program to warrant attention. We intend the

data to provide a summary of the actions taken against a health care

provider, supplier or practitioner. In addition, we acknowledge that

there are certain kinds of actions or findings that would not meet the

intent of the legislation and should not be reportable. For instance,

administrative actions, such as limited training permits, limited

licenses for telemedicine, fines or citations that do not restrict a

practitioner's practice, or personnel actions for tardiness, are not

within the range of actions intended by the statute. As a result of

these comments, we are modifying the final regulations to exclude

administrative fines or citations, corrective action plans and other

personnel actions unless they are (1) connected to the billing,

provision or delivery of health care services, and (2) taken in

conjunction with other licensure or certification actions such as

revocation, suspension, censure, reprimand, probation, or surrender.

For example, a nurse agreed to settle claims that he received Medicare

and Medicaid reimbursement to which he was not entitled. As a result of

this action, the State licensing board reprimanded the nurse and

imposed a $5,000 fine. This action would be reportable.

Comment: Several commenters expressed concern that the preamble

language that indicated that ``settlements in which no findings or

admissions of liability have been made will be excluded from

reporting'' conflicted with the next sentence in that discussion, which

read, ``However, any final adverse action that emanates from such

settlements and consent judgments, and that would otherwise be

reportable under the statute, is to be reported to the data bank.''

Response: We agree that the statutory language is clear that

settlement in which no findings of liability have been made will not be

reportable to the HIPDB. However, if another action is taken against

the provider, supplier or practitioner of a health care item or

service, as a result of or in conjunction with the settlement, the

second action is reportable. For example, a civil court settlement in

which no finding against or admission of liability by a practitioner is

made is not reportable. However, for example, if the State licensing

board suspends the practitioner's license as a result of a civil court

settlement, the licensing board must report the suspension of the

license. Similarly, if the OIG excludes a provider, supplier or

practitioner based on actions that were also the subject of a civil

settlement in which no finding or admission of liability was made, the

exclusion must be reported to the HIPDB.

Comment: One commenter questioned whether non-practitioners, such

as an executive director, should be reported to the HIPDB, while

another commenter requested clarification on the reporting of actions

pertaining to the handling of an impaired practitioner.

Response: The OIG reiterates the statutory intent that any final

action taken against a licensed or certified health care provider,

supplier or practitioner by a Federal or State licencing or

certification agency that is publicly available information is a

reportable action. If, for example in the case of an executive

director, he or she is licensed or certified as a health care provider,

supplier or practitioner, then that individual will be subject to the

HIPDB reporting requirements. If a Federal or State licensing agency

takes a final adverse action that is publicly available information

against an impaired practitioner, the final adverse action is

reportable.

3. Clinical Privileges

Comment: Several commenters expressed concern that Congress never

intended that clinical privilege actions would be reported to the

HIPDB, particularly since such actions are already reported to the

NPDB. Some commenters expressed a desire that clinical privileges

suspensions only be reported when they are in effect for a period

longer than 30 days, indicating that this limitation would parallel

existing NPDB requirements for reporting of clinical privilege actions.

Another commenter questioned why the proposed definition specifically

mentioned physicians and dentists, when they believed the definition

was to apply to all licensed health care practitioners.

Response: The OIG agrees with these concerns and, as a result, the

HIPDB will not collect data on clinical privileging actions. We note

that clinical privileging actions are already collected by the NPDB. We

believe that information on clinical privileging actions will not be of

significant value to HIPDB queriers, since queriers who have a need for

this information will already be accessing it through the NPDB.

Accordingly, we are adding language to the definition of the term

``other adjudicated actions or decisions'' to specify that the

reporting of clinical privileging actions is excluded.

4. Exclusion

Comment: One commenter raised a concern about the term

``exclusion'' and mistakenly applied the definition for this term to a

reportable licensure action.

Response: The OIG has clarified that the term ``exclusion'' applies

only to debarment of an individual or entity from participation in any

Federal or State health care related program; this term is only

applicable to reporting exclusion from participation in Federal or

State health care programs.

5. Government Agency

Comment: One commenter asserted that the definition of ``Government

agency'' was too broad and potentially open-ended. The commenter

requested clarification as to which agencies qualify as ``Federal and

State agencies responsible for the licensing and certification of

health care providers, suppliers and practitioners.'' A second

commenter suggested that the definition of ``Government agency'' be

amended to include all agencies authorized to investigate health care

fraud.

Response: We recognize the commenters' concerns and understand that

regulatory boards and licensing programs vary from State to State. For

this very reason, however, it is not possible for the OIG in this

rulemaking to provide a listing of all agencies responsible for the

licensing and certification of health care providers, suppliers and

practitioners. In response to the proposed rule, we received only two

comments from States that identified the agencies responsible for

licensing. We believe that the definition of ``Government agency''

includes all agencies authorized to investigate health care fraud and

abuse and, as a result, are making no changes to the final rule.

6. Health Care Fraud and Abuse

Comment: In general, comments reflected an assumption that the

terms ``health care fraud'' and ``health care

[[Page 57745]]

abuse'' defined the reporting criteria for all final adverse actions

mandated by the statute. Specifically, commenters found the term

``health care fraud,'' when used in conjunction with the proposed

preamble definition of ``health care abuse,'' to be too broad. Several

commenters requested that definitions for health care fraud and abuse

(and thus the nature of adverse actions collected) be limited to

activities relating to financial violations, or require the reportable

activities to meet a legal standard of fraud or abuse. One commenter

stated that health care abuse should be limited to those actions

against a health care system and not those relating to personal abuse.

Other commenters believed that the terms should be combined into one

definition. One State licensing agency requested specific guidance on

whether all final adverse actions must be based on health care fraud

and abuse to be reportable to HIPDB. The agency pointed out that only

one percent of its adverse licensing actions would meet such a fraud

and abuse reporting threshold. Three commenters did acknowledge and

agree that the term ``health care abuse'' was properly described within

the regulation and the statute as ``final adverse actions.''

Response: By attempting to define the terms ``health care fraud''

and ``health care abuse'' in the proposed rule, we gave the erroneous

impression to some readers that final adverse actions may not be

reported to the data bank unless they are categorized by the reporter

as being based upon ``health care fraud and abuse.'' That

interpretation is too limiting. Congress intended that this data bank

support efforts to prevent and combat health care fraud and abuse, and

not merely catalogue adverse actions that reporters may choose to

describe as arising from ``health care fraud and abuse.'' Restricting

reportable final adverse actions to those specifically relating to

health care fraud and abuse would eliminate the reporting of many

relevant actions that are included in the statutory definition of

``final adverse actions.'' Accordingly, and as a result of the comments

received, we are deleting the definition for the term ``health care

fraud'' from the final rule and are opting not to define ``health care

abuse.'' Instead, we defer to the statutory definition of ``final

adverse actions'' as encompassing the range of actions to be reported.

Comment: Several commenters requested changes to the ``health care

fraud and abuse'' definition to narrow the range of actions, indicating

that final adverse actions related to billing errors, benefits

administration, payment and reimbursement issues, and quality of

patient outcomes be excluded from the definition of ``health care fraud

and abuse.''

Response: There may be instances when billing errors, benefits

administration, payment and reimbursement issues, and quality of

patient outcomes meet the criteria and, therefore, will be reported.

However, it is also foreseeable that certain of the aforementioned

actions may not be final adverse actions and, therefore, not

reportable. The OIG takes the position that any action is reportable to

the data bank as long as the action meets the criteria of a ``final

adverse action,'' as specified in the final rule.

Comment: One commenter requested that ``health care fraud'' exclude

offenses by health plans or insurance companies and be limited to

offenses by health care providers, suppliers, or practitioners against

health plans or health plan sponsors. Another commenter stated that the

reporting of health care abuse should be optional and CMPs should not

be imposed for failure to report. One commenter questioned the value of

report data containing actions related to health care abuse since such

actions may suggest a standard of measurement less than a court

adjudication or administrative review panel finding.

Response: The OIG believes that excluding organizations, such as

health plans and insurance companies, would limit the effectiveness of

the data bank to serve its intended function as a fraud and abuse

prevention tool. We also believe that the intent of the statute is

clear that all final adverse actions taken against a health care

provider, supplier or practitioner must be reported to the HIPDB, and

that failure to report such actions may result in the imposition of a

CMP.

7. Health Care Provider

Comment: Several commenters indicated that the definition of

``health care provider'' was too broad and complex, and suggested as an

alternative that the OIG use the definition set forth in section

1861(u) of the Act. Two commenters objected to the inclusion of health

care entities, such as health maintenance organizations (HMOs) in this

definition. The commenters believed the definition for this term was

conflicting, since health care entities could be potential subjects of

the HIPDB as well as reporting entities. One commenter stated that most

States did not take compliance actions against these types of entities.

Response: Since Congress elected not to define ``health care

provider'' in the Act, we believe the congressional intent was for this

term to be defined broadly. There is no inherent conflict in health

care entities being potential subjects of the HIPDB, as well as

reporting entities. This is entirely consistent with the intent of the

Act.

8. Health Care Supplier

Comment: The majority of commenters responding to the definition of

``health care supplier'' stated that the definition went beyond

statutory authority and could allow inappropriate access to

information. For example, several commenters noted that the definition

included both direct and indirect providers of health care items and

services. Several commenters recommended the definition be limited to

suppliers as defined in section 1861(s) of the Act, and believed that

the definition should not include health insurance or benefits

providers, such as insurance agents, brokers, solicitors, consultants

and reinsurance intermediaries. Other commenters pointed out that to

broadly include health insurance or benefit providers in the definition

of supplier also could have the effect of including nearly all public

and private employers as the potential subjects of reports. These

commenters requested that suppliers be limited to those who directly

provide covered items or services to beneficiaries, or who directly

receive reimbursement from a health care program.

One commenter requested that reportable subjects not be limited to

practitioners, providers and suppliers, but rather encompass all

individuals and entities involved in health care fraud, including

beneficiaries, Government and private employees, managed care marketers

and any individual who is responsible for the actions of an entity. One

commenter requested clarification of the term ``subject.''

Response: We disagree with the contention of some commenters that

Congress intended to collect final adverse action information only on

direct providers of items or services covered by a health care program

or plan. Such a definition would exclude many entities that are the

subject of health care fraud and abuse investigations and actions. The

OIG believes that the intent of Congress was to have a broad

interpretation of the terms supplier, practitioner and provider. For

example, Congress did define the terms ``health care practitioner'' and

``health care provider''

[[Page 57746]]

elsewhere in the statute, yet it did not specifically apply these

definitions to the HIPDB. The term ``health care supplier'' is defined

in these regulations to capture all final adverse actions relating to

the delivery of a health care item or service. Accordingly, the OIG is

electing to keep both direct and indirect suppliers in the definition

of ``health care supplier.'' Including indirect suppliers in the

definition also is consistent with the definition of ``supplier'' used

in the regulations implementing OIG exclusion authorities resulting

from HIPAA (63 FR 46676; September 2, 1998).

However, we do not intend to include in the definition of

``supplier'' all public and private employers, unless they are self-

insured for health care coverage. The definition will still include

health plans, consultants, health insurance producers, agents, brokers

and reinsurance intermediaries. On the other hand, the definition will

not include businesses that merely provide their employees with health

insurance coverage through a contract with a health insurance producer

or a health plan. Therefore, in response to the concerns raised by the

various commenters, we have modified the definition of ``health care

supplier'' to clarify and limit its scope. Accordingly, we are

replacing the proposed language with the term ``health plan'' and are

inserting additional language excluding employers, unless they are

self-insured.

In response to the request that reporting be expanded beyond health

care providers, suppliers and practitioners, we note that individuals

or entities can only be subjects of HIPDB reports if final adverse

actions were taken against them. Beneficiaries are not included in that

category. For the purposes of this regulation, the term ``subject''

means a health care provider, supplier or practitioner upon whom a

reportable final adverse action was taken.

Comment: Two commenters indicated that States' burden of reporting

would be increased since States do not regulate or collect data about

many of the types of entities included in the supplier definition.

Response: The OIG reiterates that only final adverse actions, as

specified in the statute and these regulations, taken against health

care providers, suppliers and practitioners are reportable. Such

actions are to be reported by the organization taking the action. The

specific data required to be reported and responses to comments

regarding the reporting burden are addressed below in response to

comments on the regulatory impact statement.

9. Health Plan

Comment: With regard to the proposed definition of the term

``health plan,'' commenters stated the definition is too broad, and

suggested that the OIG use the definition as set forth in section 1128E

of the Act, which incorporates the definition set forth in section

1128C(c) of the Act.

Response: The OIG maintains that the statutory intent of the

definition was not meant to be exclusive or exhaustive. The OIG

interprets congressional use of the word ``includes'' in the statutory

definition as an indication that additional entities may be recognized

as ``health plans'' if they meet the basic definition of ``providing

health benefits.'' Therefore, we will continue to use a broad

definition. The statutory language indicates that Congress intended

that ``guarantors of payment'' for health care services and items,

including ``self insured employers'' who are often the subjects of

health care fraud, have access to HIPDB information. The OIG believes

that limiting the definition to the language of the statute would not

provide a workable basis for organizations and those who provide health

care services to appropriately determine their reporting

responsibilities under the statute. In response to one commenter's

recommendation to make the definition more inclusive, we are providing

further clarification and modifying the proposed definition.

Comment: One commenter requested an exclusion be provided within

the definition for direct reimbursements of an employee, stating there

is no relationship between the employer who provides the reimbursement

and the practitioner who provides the service.

Response: As revised, the definition of the term ``health plan''

reflects the variety of benefit plans with a wide range of

organizations, groups and individuals that currently offer such health

benefits that would include direct reimbursement. Given this change, we

believe any further revision is not necessary.

Comment: One commenter believed that State-sponsored workman's

compensation programs should be included as an example of a health

plan.

Response: It is our intention that State-sponsored workman's

compensation programs be covered under the regulations, and we believe

the definition, as written, includes such programs, although not stated

explicitly.

Comment: Two commenters stated the proposed definition would cause

confusion as to which entity is responsible for reporting the action,

i.e., the employer providing the health care policy or the insurance

corporation with whom the employer has contracted.

Response: We are aware of the multiple structures under which a

``health plan'' may operate within an integrated health system. The

final regulations state the entity taking the action is responsible for

reporting the action to the HIPDB. The activity of reporting can be

delegated to another entity, but the ultimate responsibility for the

report will still lie with the entity taking the action.

10. Licensed health care practitioner, licensed practitioner or

practitioner

Comment: Several commenters suggested that the definition for this

term should be more specific and include additional practitioner groups

not listed, such as occupational therapists and occupational

therapists' assistants. The commenters recommended that by providing a

comprehensive list of all practitioners and allied health personnel

eligible to be possible subjects of reports to the HIPDB, the OIG would

ensure that all States report consistently regardless of their

differences in professional licensing categories.

Response: We note that the meaning of the term ``licensed health

care practitioner, licensed practitioner or practitioner'' is

consistent with the definition in section 1128E(g)(2) of the Act. We

added the phrase ``but not limited to'' before our listing in order to

provide adequate leeway for the inclusion of other health care

practitioners as each individual State develops its own reporting

categories. While we recognize the benefits of conformity in reporting

practices, we have chosen not to sacrifice State flexibility and

authority in determining appropriate reporting categories. Even Federal

definitions may vary as to ``categorizing'' health care workers. In

section 1861(s) of the Act, for example, both physical and occupational

therapists are listed under the definition of supplier.

Comment: Other commenters requested clarification on how this

definition will be interpreted in States with ``title protection

statutes.'' Generally, title protection statutes only restrict the use

of a title of a health care practitioner and not the actual practice or

the delivery of the service itself. Under title protection statutes, an

individual may practice the profession without a license, but may not

use the title unless licensed by the regulatory board.

Response: The definition, as written, is consistent with the

statutory

[[Page 57747]]

language. We recognize that ``title protection statutes'' may vary with

each individual State. However, the statute only authorizes the

collection of final adverse action information on an individual who is

licensed or otherwise authorized by the State to provide health care

services (including any individual who, without authority, holds

himself or herself out to be so licensed or authorized by the State).

11. Organization Name and Type

Comment: We received several comments concerning the mandatory

element of ``organization name and type.'' Some commenters stated that

they did not collect this type of information, while others were

unclear as to the meaning of this term.

Response: As a result of these comments, we are clarifying this

term by specifically adding a new definition in Sec. 61.3 for the terms

``organization name'' and ``organization type.''

12. Other Adjudicated Actions or Decisions

Comment: Commenters raised numerous issues concerning different

aspects of the definition for the term ``other adjudicated actions or

decisions.'' Several commenters stated that the proposed definition was

too broad or burdensome, and extended beyond the scope of the statute.

A number of commenters suggested that all reportable ``adjudicated

actions or decisions'' should be related only to fraud.

Response: The OIG believes that the range of reportable ``other

adjudicated actions or decisions'' is not overly broad or beyond the

scope of the Social Security Act, since the statutory language states

that all final adverse actions must be reported. Furthermore, as

indicated above, the statute does not define fraud and abuse; it only

defines final adverse actions. To promote an effective system to aid in

deterring fraud and abuse, we believe it is necessary to define this

term more inclusively, as is contemplated by the statute.

Comment: The criteria set forth for the term ``other adjudicated

actions or decisions'' caused confusion for a majority of commenters.

Specifically, commenters indicated that they were unclear as to the

meaning of the phrase ``official action,'' and whether actions

involving (1) honest billing errors or differences in medical judgment,

(2) employment or personnel-related actions and (3) CMPs would be

reportable under this definition.

Response: In response to these concerns, we have restructured the

definition to clarify that in order for a formal or official action to

be reported under this provision it must meet the three criteria that

it (1) is taken against a health care provider, supplier or

practitioner by a Federal or State Governmental agency or a health

plan; (2) includes the availability of a due process mechanism; and (3)

is based on acts or omissions that affect or could affect the payment,

provision or delivery of a health care item or service. We also made

minor changes in the definition to provide further clarity about the

types of actions that are excluded from the definition.

Comment: Two commenters requested clarification regarding the

imposition of CMPs for failure to report. One commenter requested

voluntary reporting of other adjudicated actions, in the hopes of

eliminating such penalties. Another commenter asks that we include an

intent clause as a necessary element to apply CMPs.

Response: We disagree with the commenter's alternative approach

regarding voluntary reporting, which we believe to be inconsistent with

Congress' intent in creating a CMP for failure to report. In accordance

with the statutory language that requires such action, a health plan

failing to report any ``other adjudicated actions or decisions'' could

be assessed a CMP of not more than $25,000. The regulations

implementing this CMP provision are not a direct part of this HIPDB

implementing rule and are being addressed in specific detail through

separate OIG final rulemaking directed toward new or revised exclusion

and CMP authorities resulting from Public Law 105-33.

Comment: One commenter requested clarification on whether all

reportable adjudicated actions must be related to professional

competence or conduct.

Response: The term ``other adjudicated actions or decisions'' does

not need to relate to professional competence or conduct However, such

actions must relate to the delivery of health care items or services.

Comment: Several commenters stated the definition should be limited

to final adverse actions involving a court or Government agency, in

that reporting final adjudicated actions in which there was no finding

of liability will discourage settlements; and adverse actions will vary

from State to State, making it difficult to analyze or standardize the

reporting process.

Response: We believe that the statutory language is clear about

which entities are required to report. Certain health plan actions will

meet the criteria of ``other adjudicated actions or decisions,'' and,

therefore, will be reportable. The statute also is clear that final

actions resulting from settlements in which no findings of liability

have been made are not reportable. The OIG recognizes the variation

among States in the types of other adjudicated actions or decisions

taken. We stress that the HIPDB is intended as a ``flagging system''

and that the information in the HIPDB should serve only to alert

Federal and State agencies and health plans that there may be a problem

with a particular provider's, supplier's or practitioner's background.

The HIPDB information should be considered together with other relevant

data in evaluating a provider's, supplier's or practitioner's

background.

A hallmark of any valid adjudicated action or decision is the

availability of a due process mechanism. In general, if an

``adjudicated action or decision'' follows an agency's established

administrative procedures (that ensure that due process is available to

the subject of the final adverse action), it would qualify as a

reportable action under this definition. For example, a formal or

official final action taken by a Federal or State Government agency or

health plan may include, but is not limited to, a personnel-related

action such as suspension without pay, reduction in grade for cause,

termination or other comparable action in connection with the delivery

of a health care item or service. For health plans that are not

Government entities, an action taken following adequate notice and

opportunity for a hearing that meet the standards of due process set

forth in section 412(b) of the Health Care Quality and Improvement Act

(42 U.S.C. 11112(b)) also will qualify as a reportable action under

this definition. The fact that the subject elects not to use the due

process mechanism provided by the authority bringing the action is

immaterial, as long as such a process is available to the subject

before the adjudicated action or decision is made final.

The revised definition for the term ``other adjudicated actions or

decision'' specifically excludes clinical privileging actions taken by

Federal or State governmental agencies, as well as the similar

``paneling actions'' taken by health plans. We will not collect'removal

without cause'' actions taken by health plans, such as when the health

plan has to eliminate some of its specialists or when the health plan

concludes that a physician is not maintaining a desirable rate of

patient visits. On the other hand, health plans will report ``quality

actions'' that include the availability of a due process procedure,

such as the formal removal

[[Page 57748]]

of a physician for problems based on quality of care or competence

issues. Health plans also will report any health care related civil

judgments they obtain against a health care practitioner, provider or

supplier. The revised definition also clarifies that initial

overpayment determinations by HCFA contractors, and similar overpayment

decisions made by health plans, are not final, reportable actions.

13. Voluntary Surrender of License or Certification

Comment: We received several comments on the definition of

``voluntary surrender of license or certification'' from a variety of

State and local agencies, private sector organizations and others. The

majority of the commenters supported a broader definition of the term.

One commenter did not believe voluntary surrenders should be included

in the system because of added burden resulting from such action.

Several commenters requested that the OIG provide further clarification

of the term in the final regulations.

Response: In light of the strong support for the definition in the

proposed regulations, we are adopting this definition in the final rule

with certain clarifications. The OIG is aware that there are instances

in which a voluntary surrender is used to identify practitioners who

are deceased, retired, have not renewed their license or certification,

or have simply moved out of the State. We are clarifying the definition

to exclude non-disciplinary voluntary surrenders.

Section 61.4 How Information Must Be Reported

Comment: A number of commenters requested clarification on how

information must be reported to the HIPDB. These commenters generally

requested additional information on how electronic reporting would be

accomplished, how consolidated reporting would occur for both the HIPDB

and the NPDB, and whether all reporters would have the appropriate

software and hardware to perform this function. Some commenters

recommended, for example, that reporters be permitted to submit files

electronically using file transfer protocol or electronic mail, and two

commenters raised the issue of whether the HIPDB would accept paper

reports.

Response: In response to these concerns, we are indicating in this

final rule that reports may be submitted to the HIPDB either through a

secure interactive web-based reporting service (using state-of-the-art

encryption technology) or by mailing to the HIPDB properly formatted

report data on a diskette. Other types of electronic submissions will

not be accepted, nor will paper reports. Reporters who are required to

submit the same report to both the NPDB and the HIPDB will be able to

satisfy their reporting obligations by submitting their report only

once. Web-based reporting or querying will require a personal computer

with a modem and access to the Internet. We will provide technical

details regarding required data formats and access to the web site

through technical manuals, guidebooks and on-line user help. We believe

that most reporters possess these basic tools required to gain access

to the data bank. We also recognize that there may be a small number of

reporters who do not have these capabilities, but these entities should

be able to perform any required functions through the services of an

authorized agent, who would report to and query the data bank on the

entity's behalf.

Comment: One commenter requested that the NPDB and the HIPDB be

consolidated in order to allow more efficient querying and reporting.

The commenter also recommended allowing queriers to use search engines

to more efficiently locate information.

Response: The issue of integrating the NPDB and HIPDB is addressed

in greater detail in section III. C. of this preamble, ``General Issues

and Alternatives Suggestions.'' In response to the commenter's

recommendation regarding the use of search engines for querying,

queriers will be required to provide certain information about a

provider, supplier or practitioner in order to process their query.

Specific methods for querying will be addressed in subsequent guidance

and technical documentation.

Comment: To reduce the possibility that non-relevant reports will

be submitted to the HIPDB, one commenter recommended that the Secretary

establish a reporting threshold or specific criteria for each type of

report.

Response: Through development of a policy guidance guidebook, the

Department intends to provide specific examples and establish the

criteria for determining whether a final adverse action meets the

standards established in regulations. These criteria will be specific

to each type of action and will include examples of reportable and non-

reportable actions. It will be up to each reporter, however, to review,

understand and apply these criteria when reporting.

Section 61.5 When Information Must Be Reported

Comment: Commenters recommended extending the 30-day period for

reporting final adverse actions to the HIPDB to 60 days. The commenters

stated that the time frame set forth in the proposed rule was too

stringent and unrealistic to be met by State licensing boards. Several

associations representing State licensing boards suggested this time

frame would place significant burden on licensing boards. By extending

the time frame from 30 days to 60 days, commenters indicated that

licensing boards would have adequate time to provide the information to

their agent and, in turn, for the agent to submit the information to

the HIPDB.

Response: We are unable to make the changes suggested since the

statutory language requires reports to be submitted regularly, but not

less often than monthly.

Section 61.6 Reporting Errors, Omissions, Revisions or Whether an

Action Is on Appeal

Comment: One commenter stated that if a reportable adverse action

is on appeal, the action should not be reported until the appeal

process is final; if the appeal reverses the decision, then the entire

report should be removed from the HIPDB.

Response: We disagree with the first aspect of the comment since

the statutory language (section 1128E(b)(2)(C)) requires specifically

that a statement as to whether the action is on appeal must be included

in the report to the HIPDB. With respect to the second part of the

commenter's concern, we agree that reports which have been reversed on

appeal will require a revision to the report. The report may be voided

by the reporter at the time of the revision.

Comment: Some commenters stated that the reporting of revisions,

such as a reinstatement of a license, will cause confusion for

queriers, that the accuracy of the reports in the HIPDB will be

compromised, and that reporters will abuse the system by reporting

``indiscriminately'' to avoid a sanction for failing to report and

fulfilling the 30-day time frame. Commenters also expressed uncertainty

as to who is responsible for reporting the revision.

Response: We believe that there is a misconception on the part of

some of the commenters. Specifically, when a reinstatement of a license

occurs, the reporter must submit a revision to an action regarding the

reinstatement.

Comment: Two commenters raised concern over the fact that a subject

of a

[[Page 57749]]

report may file a written statement to the HIPDB. The commenters

believed this provision violates the due process rights of the entity

taking the action. In addition, these commenters were concerned that

the subject's statements could render an extremely inaccurate, biased

and unreliable report. One commenter requested that reports be deleted

after a 5-year period of time.

Response: We note that only final adjudicated actions are

reportable. The Act does not provide for the removal of reports from

the data bank except through the dispute process. A subject's statement

provides the subject with the opportunity to state his or her views on

the final adverse action report; the report and the addendum will be

sent to subsequent queriers. It is unclear what ``due process rights''

of the reporting entity could be violated by giving the subject of a

report the right to state his or her views about the report. Further,

we note that this approach parallels the long-standing practice used in

reporting to the NPDB.

Section 61.7 Reporting Licensure Actions Taken By Federal or State

Licensing and Certification Agencies

Comment: Several commenters were concerned about the possibility of

duplicative reporting when a practitioner is licensed in more than one

State. The question was raised as to who reports the adverse licensing

action. Several commenters questioned the process for reporting

reinstatement of a license.

Response: The statute requires that the State taking the action is

responsible for reporting that action to the HIPDB. Each respective

State licensure action requires a separate report to HIPDB. This

process of reporting parallels the approach taken under the NPDB. The

process for reporting reinstatement of a license is explained in the

preamble section discussing Sec. 61.6.

Comment: With respect to reporting actions on individuals, a number

of comments addressed the problem of collecting the mandatory and ``if

known'' data elements.

Response: We are addressing this issue below in section III. C. of

this preamble.

Comment: Several commenters believed that the description of

actions in this section were too vague, and that the OIG should limit

reportable actions to those that truly limit practice, such as

revocation, suspension and limitation on licensure. Another commenter

suggested the HIPDB should be collecting final adverse actions related

only to fraud and abuse in the delivery of a health care item or

service. Two commenters questioned whether censure letters and other de

minimis sanctions are reportable since these actions are not usually

subject to due process, and recommended that we include only actions

taken against physicians holding full licenses to practice medicine.

Response: Section 1128E(g)(1)(A)(iii) of the Act states that

Federal and State licensing and certification agencies must report to

the HIPDB all of the following final adverse actions that are taken

against a health care provider, supplier or practitioner:

Formal or official actions, such as revocation or

suspension of a license (and length of any such suspension ),

reprimand, censure or probation;

Any other loss of the license or the right to apply for,

or renew, a license of a provider, supplier or practitioner; and

Any other negative action or finding as defined by the

Federal or State agency.

Under section 1128E of the Act, the only limitation on a reportable

disciplinary action is that it must be a formal or official action.

Comment: One commenter believed that automatic suspension of a

license for failure to pay family support for a child or spouse, for

example, should not be included as a reportable event.

Response: While we are aware of other ways in which a license may

be suspended or revoked by other Federal laws not related to the HIPAA,

this licensing action is considered a disciplinary action and, in

accordance with the statute's definition of final adverse action, is

reportable to the HIPDB.

Comment: Concerning what information must be reported on

organizations, one commenter recommended that the actions reported by

Federal and State licensing and certification agencies be limited to

those who traditionally provide these services. The commenter believed

that the combination of the definitions of ``supplier'' and ``adverse

action'' could lead to a data bank for reporting complaints and

appeals, and not fraudulent activities.

Response: In accordance with these comments, we are modifying the

definitions of ``adverse actions'' and ``supplier'' in Sec. 61.3 in

order to collect meaningful data on subjects of reportable final

adverse actions.

Comment: Several State licensing boards stated that they already

report adverse action information to their individual professional

association, and several professional associations also stated that

they received reports from States on such actions. These commenters

believed that they should be exempt from reporting to the HIPDB.

Another commenter believed that HCFA should report all adverse actions

to the HIPDB taken against Medicare and Medicaid providers and

suppliers based on information that is already reported by State survey

and certification agencies, thus leaving States with the responsibility

to report only adverse actions taken against an entity based on State

law.

Response: The statute does not provide an exclusion from reporting

to the HIPDB for individual professions that may report to other data

banks. We encourage these organizations to designate their professional

associations to act as authorized agents with the HIPDB. The statute

requires that Federal and State Government agencies and health plans

report any adverse action taken against a health care provider,

supplier or practitioner. The OIG recognizes that State survey and

certification agencies already report their findings to HCFA and we

will continue to work with HCFA to find methods of streamlining and

coordinating the reporting process.

Section 61.8 Reporting Federal or State Criminal Convictions Related

to the Delivery of a Health Care Item or Service

Comment: One commenter indicated that States already report

convictions to the Federal Bureau of Investigation (FBI) and, as such,

reporting to the HIPDB would be duplicative and costly. Another

commenter requested clarification of the term ``delivery.''

Response: The scope of the HIPDB goes beyond the felony convictions

obtained at the State and local level that are currently reported to

the FBI. Information being reported to the data bank also will include

misdemeanor convictions, nolo contendere pleas, and pre-trial

diversions and similar actions, that are not reportable to the FBI. In

addition, the FBI does not classify convictions as being related to the

delivery of a health care item or service, nor does it classify those

convicted individuals and entities as being health care providers,

suppliers or practitioners. Consequently, the FBI's data bank does not

contain every action that would be reportable to the HIPDB, nor does it

provide a way in which all appropriate State and local convictions

could be identified for use in the HIPDB. The term ``delivery''

includes, but is not limited to, participation in any part of the

provision for or payment of a health care item or service.

[[Page 57750]]

Section 61.9 Reporting Civil Judgments Related to the Delivery of a

Health Care Item or Service

Comment: One commenter was not clear as to when a health plan would

be obligated to report a civil action, and recommended that health

plans only be required to report when no Government agency was a party

to the action. The commenter also suggested that health plans should be

able to assign responsibility for reporting to another entity, if the

other entity also were party to the suit. A second commenter believed

that civil actions are best reported by a prosecuting entity.

Response: The OIG does not require that each party to a civil

action report that action individually. However, to clarify who has the

responsibility for reporting multi-claimant civil judgments, we are

adding new language to Sec. 61.9 to address responsibilities for the

reporting of multi-claimant actions.

Section 61.10 Reporting Exclusion From Participation in Federal or

State Health Care Programs

Comment: One commenter stated that the OIG did not provide adequate

and clear information for providers to use to identify excluded

individuals or entities.

Response: Revised OIG exclusion authorities were published as

proposed rulemaking in the Federal Register on September 8, 1997 (62 FR

47182), and final regulations were published on September 2, 1998 (63

FR 46676). As indicated above in addressing the definition of the term

``health care supplier,'' in the OIG's final rulemaking on new

exclusions and revised authorities resulting from HIPAA, the OIG has

the authority to exclude any individual or entity who directly or

indirectly provides or supplies items or services. The scope of this

exclusion authority includes items or services manufactured,

distributed or otherwise provided by individuals or entities that do

not directly submit claims to Medicare, Medicaid or other Federal

health care programs, but that supply items or services to providers,

suppliers or practitioners who submit claims to these programs for such

items or services. Therefore, the OIG has already established through

that final rule the conditions for excluding an individual and entity

from a Federal or State health care program. As such, we believe no

further revisions or clarifications are necessary in this final rule.

Section 61.12 Requesting Information From the HIPDB.

Comment: Several commenters believed there should be public access

to the HIPDB, while other commenters stated that access to the HIPDB

should be open only to those who have the authority to take adverse

actions. Additionally, citing the need to obtain the information for

screening and credentialing potential employees, several commenters

requested that hospitals also be able to request information. Several

commenters also expressed concern regarding the data elements to be

included in the release of aggregate data for research purposes.

Response: While the OIG actively supports legislative proposals for

expanding access to the HIPDB, the existing statute clearly limits

access to the HIPDB to those entities that meet the definition of

Federal or State agency or a health plan. Under the current statutory

definition of entities having access, some hospitals will meet the

criteria and be in a position to request information from the HIPDB,

while other hospitals will not have access to the data bank. With

regard to what data elements would be included, the OIG is clarifying

the language in the final rule, as is discussed later in this preamble.

As set forth in Sec. 61.12, at the time subjects request

information as part of a ``self-query,'' the subjects will receive (1)

any report(s) in the HIPDB specific to them, and (2) a disclosure

history from the HIPDB of the name(s) of any entity (or entities) that

have previously received the report(s). This disclosure history will be

restricted in accordance with revisions being made to the Department's

Privacy Act regulations at 45 CFR part 5b which, when issued in final

form, will include an exemption for law enforcement access of the

HIPDB.

Section 61.13 Fees Applicable to Requests for Information

Comment: The majority of the comments received on this section were

from State agencies. The commenters requested free or discounted rates

for querying the HIPDB. The commenters suggested that those State

agencies that actually file reports with the HIPDB should, in exchange,

be able to query the data bank for free or at a discounted rate. One

commenter expressed a concern over having to pay a separate fee to

query both the HIPDB and the NPDB.

Response: The OIG is aware of the concerns of some State agencies.

The HIPDB and the NPDB were established under separate statutes, each

requiring a fee for querying. Each data bank, by statute, was designed

to recover its own cost through the imposition of query fees. We are

aware of the potential burden of dual querying and will make every

effort to keep these fees to a minimum. The OIG cannot comply with this

request to offer free or discounted queries to State agencies and

others. Since the statute specifically mandates that the Department

exempt only Federal agencies from query fees, in order to completely

cover costs from paying customers, the OIG must charge all non-Federal

customers the same rate.

The OIG intends to announce the actual amounts of the fees for the

data bank in periodic notices in the Federal Register.

Comment: One commenter recommended that all Federal agencies also

should be subjected to a fee when querying the HIPDB, while another

commenter stated that since Federal agencies are exempted from paying

fees, their access should be limited to ``bona fide'' purposes.

Response: With regard to the one commenter's suggestion as to

Federal agencies fees, section 1128E(d)(2) of the Act specifically

prevents the OIG from charging Federal agencies a fee to query the

HIPDB. The appropriate uses of HIPDB information for all users,

including Federal agencies, is being defined in Sec. 61.14 of these

regulations and the Privacy Act System of Records notice published in

the Federal Register on February 16, 1999 (64 FR 7653).

Comment: One commenter recommended that the OIG not establish a fee

for health care practitioners, providers or suppliers requesting

information about themselves (self-queries) from the HIPDB. This

commenter believed that State licensing boards will ``game the system''

by requiring licensees to submit self-query responses when requesting

initial licensure or re-licensure. This commenter noted this type of

activity already occurs with the NPDB.

Response: Since State licensing boards are not required by the

statute to query, the OIG can not expressly mandate that they query the

HIPDB directly in place of requiring practitioners to provide self-

query responses. However, we will make every effort to strongly

encourage State licensing boards to query the HIPDB directly to ensure

they receive accurate and complete information.

Comment: One commenter asked that the HIPDB provide an automatic

copy (without a request and free of charge) of every report to the

health care provider, supplier or practitioner who is the subject of

the report, and not just when the report is initially entered into the

HIPDB. This would include any report that is ``amended or deleted.'' A

second commenter recommended that the OIG add a sentence to the final

regulations

[[Page 57751]]

stating that the HIPDB also will provide a copy of every HIPDB report

automatically, without a request and free of charge, to the reporter

who submitted the report.

Response: We agree with these comments and will modify the final

regulations accordingly. The HIPDB will provide a copy of every HIPDB

report to the reporter, as well as to the health care provider,

supplier, or practitioner who is the subject of the report, when the

report is initially entered. In addition, further notification will be

made to these parties whenever the report is corrected or revised, and

whenever the report is voided. We also agree to automatically provide

the reporter with a copy of the revised report, without further

request.

Section 61.14 Confidentiality of the HIPDB Information

Comment: The majority of the commenters responding to this

provision questioned the confidentiality of the reported data bank

elements and resulting privacy of the information once a report is

submitted to the HIPDB. The confidentiality of individual elements, as

well as of the report as a whole, were questioned and several

commenters believed the final rule needed to be clarified further.

Citing possible violation of the Privacy Act, commenters expressed

concern about the ``purpose'' for which the data are provided and the

process of how queriers may distribute and use the information provided

in a report.

Response: Similar to the NPDB, the HIPDB requires specific data

elements to be reported in order to maximize the accuracy of matching

subjects of reports by the querier. The Privacy Act of 1974 established

the guidelines for Federal governmental systems of records that are

maintained by the names of individuals. The HIPDB was established as a

system of records subject to the Privacy Act by notice published in the

Federal Register on February 16, 1999 (64 FR 7653). Section 552(i)(3)

of the Privacy Act provides that obtaining information knowingly from

an agency system of records under false pretenses will be treated as a

misdemeanor and will incur a fine of not more than $5,000 per

occurrence. Section 552b(3) of the Privacy Act allows disclosure for

``routine use,'' compatible with the purpose for which it was

collected. Appropriate uses for the HIPDB information will include

credentialing and employment decisions, fraud and abuse investigations,

and use as a part of a querying entity's screening process which would

indicate more complete details are needed about the subject. This

``routine use'' does not allow disclosure to the general public. We are

clarifying this discussion in Sec. 61.14 of the final regulations.

We note that information which would identify Federal or State

agency health program beneficiaries, or other patients of providers or

practitioners, is not reportable to the HIPDB. Further, we will

disallow references to individual patients or beneficiaries in any

rebuttal documents submitted as part of a report dispute process, or

submitted as part of the written comments that a subject may submit to

be included with a report.

Comment: Several commenters stated that the wording of this section

was confusing, and did not fully explain the ways in which information

can be disseminated once it is released to an eligible entity.

Response: With respect to the confidentiality requirements of

information obtained from the HIPDB indirectly from another party, as

well as information obtained directly from the data bank, an individual

or entity that receives information from the HIPDB is permitted to

disclose such information further in the course of carrying out the

activity for which the information was sought. For example, during the

course of a health plan's credentialing process, the plan may request

information from the HIPDB on a practitioner's history of final adverse

actions. The health plan may share this information with other

individuals who are part of the credentialing review and decision

making process on the practitioner's application. Nevertheless, the

confidentiality limitations of the Act apply both to the health plan

staff who initially receive the information and to the specific

departmental staff who subsequently review this same information; they

may each only use and disclose the information with respect to the

credentialing decision.

Section 61.15 How To Dispute the Accuracy of the HIPDB Information

Comment: Several commenters were supportive of the mechanism set

forth in the proposed rule that would allow practitioners to attach a

2,000 word statement to their report for purposes of disputing the

accuracy of HIPDB information. Some commenters indicated that the

inclusion of a 2,000 word statement to a report was unnecessary and

recommended eliminating this provision for the final rule.

Response: We believe this mechanism will be useful, and are

retaining it in the final regulations.

Comment: While some commenters believed a dispute mechanism was

unnecessary or would greatly increase the burden on reporting entities,

other commenters supported the inclusion of an additional dispute

mechanism under which reporting entities could report disagreements

with a Secretarial decision to delete a report from the HIPDB.

Response: The statute specifically requires that the HIPDB have a

dispute mechanism in place. We are adopting the dispute mechanism that

currently is being used for reports to the NPDB, which has proven to be

effective. We are addressing regulatory burden issues later in this

preamble.

C. General Issues and Alternative Suggestions

1. Coordination and distinctions between the HIPDB and the NPDB

Comment: One commenter stated that an additional data bank was

unnecessary. The commenter believed that the NPDB is adequate, and that

the HIPDB will only serve to be duplicative in nature.

Response: While we agree that the NPDB is adequate for its intended

purpose of protecting the public from incompetent or unprofessional

health care practitioners, the HIPDB reflects separate and distinct

congressional intent, with unique data elements. The HIPDB data base is

intended to collect a wide range of final adverse actions. The HIPDB

serves a dual purpose of protecting the public, and assisting fraud and

abuse investigations of health care practitioners, suppliers and

providers. The HIPDB also contains information that is not reported to

the NPDB, for purposes of meeting its intended statutory objectives.

Comment: Some commenters expressed a desire that the HIPDB and the

NPDB be combined into one system, and commenters believed that for

reports required under both systems, the OIG should have reporters

report such actions only once.

Response: Although the HIPDB and the NPDB must be separate data

banks, and serve different purposes, the HIPDB and the NPDB will, for

certain reporting and querying purposes, form an integrated system,

whereby a report required under both systems will only need to be

reported once. The system will subsequently store the report in the

HIPDB, the NPDB, or both, as appropriate. Additionally, a querier

eligible to have access to both data banks can query both through a

single request.

Comment: One commenter expressed concern that under an integrated

reporting system for the NPDB and the

[[Page 57752]]

HIPDB a medical malpractice insurer would be forced to submit certain

fields required under the HIPDB, such as for an individual's Social

Security Number.

Response: This provision is only applicable to reports required

under both data banks. For example, medical malpractice payment reports

are only required to be reported to the NPDB; they are statutorily

exempt from HIPDB reporting. Therefore, the HIPDB data elements

required, such as an individual's Social Security Number, do not apply

to those reports.

Comment: One commenter expressed a desire that actions taken before

August 21, 1996, the effective date of the HIPAA statute, be required

to be reported to the HIPDB.

Response: Since the Department does not have the statutory

authority to retroactively require reports before the statute's date of

enactment, we cannot accept this recommendation, and we would be

unwilling to impose the burden of retroactive reporting on the

reporting entities even if we had the authority to do so.

2. Immunity Provisions Under the HIPDB

Comment: More than half of the comments received regarding immunity

provision under the HIPDB stated that any immunity provisions must be

included within the final regulations and not merely alluded to in the

preamble. The commenters specifically requested immunity with regard to

submitting reports to the HIPDB. Several commenters stated that any

immunity provisions included within the final regulations needed to

specifically provide immunity for agents.

Response: We agree with the comments, and are adding a new

Sec. 61.16 within the final regulations to address this concern.

Comment: Three commenters were supportive of the proposed

definition for the term ``knowledge of falsity'' to mean actual

knowledge of falsity by the submitting party. One commenter requested

the elimination of immunity for those who file information with the

HIPDB recklessly.

Response: The intention of the statute is to encourage final

adverse actions to be reported against subjects, without fear of the

subject retaliating with a lawsuit against those who report the action.

In accordance with the comments and the statute, we will continue to

interpret the term ``knowledge of falsity'' to mean actual acknowledge.

Consequently, we are including language in the final regulations

stating that the submitting reporter will not be immune from liability

if there is actual knowledge of falsity of a report.

Comment: One commenter stated the subject of a report should be

required to follow the dispute resolution procedures before filing suit

against a reporter for false knowledge in reporting to the HIPDB.

Response: We decline to accept this comment. The statute does not

provide the authority to require the subject of a report to follow the

dispute resolution procedures prior to filing suit against a reporter.

Further, we believe this would result in unnecessary delays in

reporting final adverse actions to the HIPDB.

3. Sanctions for Failure To Report

Comment: With regard to sanctions for failure to report to the

HIPDB, commenters stated that a potential CMP of $25,000 per occurrence

against health plans that fail to report was too severe. One commenter

recommended that, because of the perceived breadth and ambiguity of the

reporting requirements, the OIG should only assess CMPs against health

plans that ``knowingly and willfully fail to report.'' Another

commenter stated that the CMP was proportionately unfair to single

service health plans.

Response: Section 4331 of Public Law 105-33, the Balanced Budget

Act (BBA) of 1997, authorizes a CMP of up to $25,000 for each adverse

action not reported by a health plan. The statute does not require that

this full amount be imposed; a lesser penalty could be assessed at the

discretion of the OIG. The statute does not require a ``knowing and

willful'' standard as part of the CMP criteria. However, the OIG has

discretion in choosing whether to assess a CMP, and the OIG applies

various mitigating and aggravating factors, as set forth in the OIG/CMP

regulations, in determining the CMP amount up to the $25,000 limit.

Specific policies and factors regarding imposition of this CMP are

being set forth by the OIG in separate final rulemaking addressing new

and revised sanction authorities resulting from the BBA.

Comment: One commenter asked whether the OIG would impose CMPs

against health plans that cannot report because they do not collect all

of the reportable data elements.

Response: Every effort has been made to specify a set of data

elements that will not impose an undue burden on reporters and that

still ensure a high degree of confidence in matching names of health

care practitioners, providers and suppliers with existing reports in

the HIPDB. Reporters will be required to report mandatory data

elements, and may report all other fields if they are known. However,

reporters that fail to submit reports with the minimum mandatory data

required by statute and regulations may be subject to the sanctions

referenced above.

Comment: Some commenters expressed concern that the OIG would

impose CMPs for the non-reporting of adverse actions (or particular

data elements associated with an adverse action) that occurred during

the period between the effective date of HIPAA, August 21, 1996, and

the effective date of this rule, a time period when the exact reporting

requirements of the rule were not yet known to the entities now

responsible for reporting.

Response: The basic types of actions to be reported were specified

in the HIPAA and were, therefore, noticed to potential reporters as of

August 21, 1996. We do realize, however, that the specific definitions

of terms used, and the specification of exact data elements to be

reported, are set forth in this rule. While there is a duty to report

actions (and data elements) dating from the period between August 21,

1996 and the promulgation of this rule, the OIG will give due

consideration to the ability of a reporting agency or health plan to

comply with requirements to report such actions (and data elements) in

determining whether to impose a CMP for failure to report in accordance

with 42 CFR 1003.102(b)(5)(ii).

4. Implementation Schedule

Comment: Four comments were received regarding the implementation

schedule for the HIPDB. Commenters stated that collecting data elements

retroactively, as required by the Act, would be burdensome and

difficult to obtain. One commenter recommended a separate date for

``other adjudicated actions,'' stating that these actions are not final

until each case has exhausted all appeal rights. Several commenters

suggested the OIG should allow for two different dates: one for data

that are available at the time of the opening of the data bank, and

another date (for example, 60 days later) for additional and

retroactive data.

Response: The OIG has taken these points into consideration. This

concern is being addressed below in the section of this preamble

discussing the burden of data collection.

5. Paperwork Reduction Act Statement

a. Data elements to be reported to the HIPDB. The OIG solicited

comments on: (1) Whether the proposed collection of information is

necessary for the proper performance of the functions of the

Department, including whether the

[[Page 57753]]

information will have practical utility; (2) the accuracy of the

Department's estimate of the burden of the proposed collection of

information; (3) ways to enhance the quality, utility and clarity of

the information to be collected; and (4) ways to minimize the burden of

the collection of information on respondents, including through the use

of automated collection techniques or other forms of information

technology.

Comment: Over half of the comments received concerned the data

elements in general. Commenters stated that the proposed rule was

overreaching the scope of the statute and created unintended reporting

burdens with regard to the various data elements specified for

collection. Some commenters indicated that they did not collect one or

more of the required data elements, while others suggested that not all

of the requested data elements were necessary for the HIPDB, or that

only a minimal set of elements were needed to insure proper

identification of a subject. Some commenters stated that the required

data elements would force physicians to devote additional time and

expense to reporting these actions.

Response: The OIG disagrees with the commenters' assessments. The

OIG continues to believe the data elements selected for inclusion into

the HIPDB are essential for users in properly identifying individuals

and entities which are the subjects of reports in the data bank.

Further, as indicated earlier, with respect to the concerns indicated

by some physicians, there are no requirements for physicians to report

directly to the data bank and thus no additional non-medical time

required of them with respect to the array of data elements.

Comment: A number of State agencies cited their respective State

statutes that prohibit the collection or reporting of Social Security

Numbers and, in some instances, other personal data (such as sex and

date of birth). Ten commenters stated that their organizations did not

routinely collect Social Security Numbers or Taxpayer Identification

Numbers.

Response: The statute offers the OIG no discretion in this

collection element provision. The Federal statute authorizing this data

base takes precedence over and preempts State statutory requirements,

and specifically requires the reporting of Taxpayer Identification

Numbers, which includes Social Security Numbers and Federal Employer

Identification Numbers. As to the inclusion of other personal

identifiers, we have determined that these elements are required to

insure proper identification of subjects reported to the data bank and,

consequently, these requirements are being retained in the final

regulations. We believe that the various reporting entities can make

the proper adjustments to secure the required information without undue

hardship or burden.

Comment: Some commenters raised concern over the need to include

``Occupation'' as one of the mandatory element under the HIPDB.

Response: For identification purposes, we believe it is important

for a querier of the data bank to know a subject's occupation. Today's

health care providers are frequently involved in different ventures and

occupations. Reportable actions may arise in one area of a subject's

endeavors, but not in others. Therefore, we believe that queriers must

be made aware of all reportable actions against a subject, and an

integral element of this is learning the occupation in which these

actions were taken.

Comment: Three commenters requested that ``Other Names Used'' be a

mandatory field, particularly with regard to female subjects.

Response: We are satisfied that this element should be reported

``if known,'' and we assume the reporters will provide these names if

such information is available to them.

Comment: We received comments regarding the ``Physician Specialty''

data element. Commenters questioned why specialty data were only being

collected on physicians and not on other types of practitioners.

Response: We agree with the suggestion that ``specialty'' should be

reported for all practitioners, if applicable, and are modifying the

regulations accordingly.

Comment: Twenty-six commenters suggested that the ``Name of the

Affiliated or Associated Health Care Entity'' not be made a mandatory

field.

Response: The statute requires that this information be reported

``if known.'' We agree with the commenters' concerns, and will clarify

the language in the final regulations to emphasize that this

information be reported only if known.

Comment: Several comments stated that potential reporters do not

currently collect the mandatory element ``National Provider

Identifier'' (NPI).

Response: We are aware that NPIs have not been issued and,

therefore, cannot be reported. However, once HCFA issues these

identification numbers, the collection and reporting of NPIs to the

HIPDB will be mandatory. Reporters are advised to begin the necessary

steps to collect this identifier in the future, as it becomes

available. In this final rule, we are deleting the data field ``NPI for

Affiliated or Associated Health Care Entities.''

Comment: One commenter suggested that the HIPDB also add the method

used to detect the act that underlies the action being reported.

Response: We disagree. We believe this information will not be

useful, and would create an additional reporting burden.

Comment: Commenters stated that some reporters do not collect data

on the ``Name of Each Professional School Attended and Year of

Graduation.''

Response: These data are mandatory requirements of the NPDB and are

routinely provided by State agencies and organizations representing

physicians and dentists. These NPDB requirements will remain unchanged.

For reports made solely to the HIPDB, these data elements will be

mandatory for licensing and certification actions reported by Federal

and State agencies, which routinely collection this information, and

will be designated as ``if known'' for all other reporters.

Comment: Several commenters noted the unreliability of a ``Work

Address'' element for individual subjects, and other commenters stated

that only an ``Address of Record'' would be known by certain reporters.

Response: The OIG agrees with these comments and is revising the

final regulations accordingly. Only one address--either the subject's

``Home Address'' or the ``Address of Record''--will be mandatory for

each report. Other addresses, such as a primary work address, will be

reportable only ``if known.''

Comment: Twelve comments were received concerning the mandatory

``Description of the Acts or Omissions'' and the ``Description of the

Action'' fields. The commenters suggested use of numerical codes in

lieu of narrative descriptions.

Response: The statute is clear that the ``Description of the Acts

or Omissions'' field is a mandatory element. However, to assist users

of this information, we are adopting the suggestion of a code list that

corresponds to the most common underlying acts expected to be reported.

Use of this code will be mandatory, along with a narrative description

of the acts or omissions and injuries upon which the reported action

was based. With regard to the ``Description of the Action'' field, we

have changed the final rule to show that the mandatory requirements for

reporting an action are the date the action was taken, its effective

date and duration, the amount of any monetary penalty, and whether

[[Page 57754]]

the action is on appeal. We believe these elements are essential for a

user's understanding of the action being reported. The proposed rule

also called for a mandatory ``Classification of the action'' in

accordance with a reporting code adopted by the Secretary. While the

``Description of the action'' has been deleted, the ``Action code''

will remain as a mandatory element in the final regulations.

Comment: Five comments were received requesting additional

clarification regarding the reporting of ``Professional license,

certification or registration.''

Response: In response to these comments, we are clarifying the

final regulations to indicate that for licensure certification or

registration actions taken by Federal and State licensing and

certification agencies, the mandatory information to be reported will

be on the professional license, certification or registration on which

the action was taken. Information on other licenses, certifications or

registrations, including those issued in other States or by other

agencies, will be reportable to the data bank ``if known.''

b. Estimated burden of data collection requirements. Comment: A

number of commenters stated that the proposed rule did not accurately

address the burden as it applies to the cost of creating and

maintaining the data collection system, or the costs associated with

collecting the required data elements. Commenters stated that the

start-up cost, indicated at $5,000, was significantly underestimated.

One commenter strongly believed that the costs associated with the

HIPDB system would far outweigh its benefit, and several commenters

stated that they would need to hire new employees in order to meet the

HIPDB reporting requirements. One commenter indicated that, while their

State proportionally had a smaller number of health care providers than

some of the larger States, its State agency nevertheless took 712

actions last year that would need to be reported to the HIPDB,

resulting in what they believed would be a larger than estimated burden

nationwide.

Response: In developing our burden statement and estimate,

calculations for the regulatory impact statement in the proposed rule

were based on estimations derived from the regulatory impact prepared

for the proposed rule currently being developed for State licensing

boards addressing section 1921 of the Act. Section 1921 of the Act, as

amended by section 5(b) of the Medicare and Medicaid Patient and

Program Protection Act of 1987 and by the Omnibus Budget Reconciliation

Act of 1990, requires each State to adopt a system that reports to the

Secretary certain adverse licensure actions taken against health care

practitioners and health care entities that are licensed or otherwise

authorized by a State (or a political subdivision) to provide health

care services. Similar to the information required for the HIPDB,

section 1921 of the Act already requires, for reporting to the NPDB,

that each State (1) report any negative actions or findings that a

State licensing authority, peer review organization or private

accreditation entity takes against a health care practitioner or health

care entity; and (2) have an information reporting system in place as

of January 1, 1992, regardless of whether the Secretary promulgated

regulations to carry out these provisions. Therefore, since 1992, the

States already have been required to collect much of the information to

which they attribute their costs of collecting information for

reporting to the HIPDB. However, we recognize that the regulatory

impact will vary from State to State, and as a result, we have adjusted

our burden estimates in this final rule accordingly. Specifically,

after consideration of the concerns raised, we agree with the

commenters that their developing or restructuring of a data collection

system to incorporate the HIPDB requirements may have been

underestimated. Therefore, we have increased the start-up cost estimate

to $20,000 for each State licensing board. In terms of the reporting

burden for State licensing agencies, we were advised by national

organizations that represent State licensing boards that much of the

requested data are already being collected and maintained by their

organization. Therefore, we believe that the reporting burden for State

licensing boards, such as nursing, chiropractic, optometry, physical

therapist and social worker should be minimal.

Comment: Some commenters believed that complying with the HIPDB

would be labor intensive and costly. Commenters suggested that the

HIPDB data collection requirements would create an administrative

burden for State licensing boards.

Response: As indicated above, the OIG has addressed the reporting

requirements in detail in this preamble in response to public comments.

We agree with many of the commenters' concerns, and are streamlining

the HIPDB reporting requirements accordingly. The OIG believes that

this final rule now reflects the least burdensome reporting

requirements possible with respect to State agencies' compliance.

Comment: Several commenters proposed alternatives that they

believed might ease the burden on State licensing boards. Specifically,

commenters recommended that the OIG make use of various authorized

agents, such as the National Council of State Boards of Nursing,

Federation of Chiropractic Licensing Boards, National Association of

Boards of Pharmacy and the American Association of State Social Work

Boards to collect and report the required information, thus lessening

the burden on individual health plans and State agencies.

Response: In developing this rulemaking, the OIG sought the input

from States and representatives of various associations. Initially, the

OIG met with State regulatory boards and associations, including the

National Council of State Boards of Nursing, Federation of Chiropractic

Licensing Boards, National Association of Boards of Pharmacy and the

American Association of State Social Work Boards, to explain the

requirements of the HIPDB and to explore options that would ease the

regulatory burden on State agencies. As a result with respect to State

licensing boards, we suggested the following options: (1) organizing a

centralized or decentralized reporting mechanism within the State, or

(2) reporting to the data bank through an authorized agent. If an

authorized agent is utilized by the State, individual agreements must

be made between the State and the professional association, as well as

between the State and the HIPDB.

IV. Summary of Revisions in the Final Rule

Based on our review and response to the array of public comments,

and based on the discretionary authority given the Department under the

statute, we are making the following revisions to the proposed

regulations that we believe will allow the collection and dissemination

of information to and from the HIPDB to occur in a more effective and

efficient manner:

Section 61.3

We are revising the definition of the term ``Affiliated or

associated'' to read as follows: Affiliated or Associated means health

care entities with which a subject of a final adverse action has a

commercial business relationship, including but not limited to,

organizations, associations, corporations, or partnerships. It also

includes a professional corporation or other business entity composed

of a single individual.

[[Page 57755]]

In the definition of the term ``Any other negative action

or finding,'' we are adding the following sentence: ``This definition

excludes administrative fines or citations and corrective action plans,

unless they are: (1) Connected to the delivery of health care services,

and (2) taken in conjunction with other licensure or certification

actions such as revocation, suspension, censure, reprimand, probation,

or surrender.''

We are deleting the proposed definition for the term

``Clinical privileges.''

We are amending the fourth element in the definition of

the term ``Government agency'' to include both Federal and State law

enforcement agencies, and law enforcement investigators as well as

States Attorneys General.

In the first sentence under the definition for the term

``Health care supplier,'' we have inserted a comma and are adding the

phrase ``whether directly or indirectly,'' after the statement ``* * *

or any individual or entity, other than a provider, who furnishes'' and

we have replaced the example of ``manufacturers of health care related

items'' with the phrase ``manufacturers of health care items.'' We have

also revised the second sentence in the definition to read as follows:

``The term also includes any individual or entity under contract to

provide such supplies, items or ancillary services, health plans as

defined in this section (excluding employers that are not self-insured)

and health insurance producers (including, but not limited to, agents,

brokers, solicitors, consultants and reinsurance intermediaries).''

We are modifying the fourth element in the proposed

definition of the term ``Health plan'' to make the definition more

inclusive. As revised the fourth element will include, but not be

limited to, ``[A] plan, program, agreement or other mechanism

established, maintained or made available by a self insured employer or

group of self insured employers, a practitioner, provider or supplier

group, third party administrator, integrated health care delivery

system, employee welfare association, public service group or

organization or professional association * * *''

We are adding a definition for the term ``Organizational

name and type.'' The ``organization name'' data element, to be reported

for all types of actions described in Secs. 61.7, 61.8, 61.9, 61.10 and

61.11, means the subject's business or employer at the time the

underlying acts occurred. If more than one business or employer is

involved, the one most closely related to the underlying acts must be

reported in ``organization name,'' with the others being reported in

the ``affiliated or associated health care entities'' field. The

``organization type'' is a brief description of the nature of that

business or employer.

The definition for ``Other adjudicated actions or

decisions'' specifically excludes clinical privileging actions taken by

Federal or State governmental agencies, paneling decisions made by

health plans and overpayment determinations by Federal and State agency

contractors or by health plans.

We are also adding a new definition for the term

``Voluntary surrender'' to mean a surrender made after a notification

of investigation or a formal official request by Federal or State

licensing or certification authorities for a health care provider,

supplier, or practitioner to surrender the license or certification

(including certification agreements or contracts for participation in

Federal or State health care programs). The definition also includes

those instances where a health care provider, supplier or practitioner

voluntarily surrenders a license or certification (including program

participation agreements or contracts) in exchange for a decision by

the licensing or certification authority to cease an investigation or

similar proceeding, or in return for not conducting an investigation or

proceeding, or in lieu of a disciplinary action.

Section 61.9

With regard to reporting civil judgments related to the

delivery of a health care item or service, we are adding the following

language to Sec. 61.9(a): ``If a Government agency is party to a multi-

claimant civil judgment, it must assume the responsibility for

reporting the entire action, including all amounts awarded to all the

claimants, both public and private. If there is no Government agency as

a party, but there are multiple health plans as claimants, the health

plan which receives the largest award must be responsible for reporting

the total action for all parties.''

Section 61.12

With regard to requesting information from the HIPDB, we

are revising the first sentence in Sec. 61.12 (a)(4) to indicate that

information in the data bank will be available, upon request, to ``[A]

person or entity who requests statistical information, which does not

permit any personal identifiers for any individual or entity.''

Section 61.13

We are adding the following sentence to the end of

Sec. 61.13 (a) with regard to our policy on fees applicable to requests

for information: ``For the same purpose, the Department will provide a

copy of the report--automatically, without a request and free of

charge--to the reporter that submitted it.''

Data Elements To Be Reported to the HIPDB

In view of the comments and responses discussed above, and in an

effort to clarify reporting requirements, the data elements have been

reformatted. Sections 61.7, 61.8, 61.9, 61.10 and 61.11 are structured

as follows:

The actions which must be reported and who is responsible

for making those reports.

The mandatory personal identifiers and employment or

professional identifiers for individual subjects; the mandatory

identifiers for organization subjects; and the mandatory data elements

for all subjects relating to the acts or omissions, the action taken

and the reporting entity.

The ``if known'' personal identifiers and employment or

professional identifiers for individual subjects; the ``if known''

identifiers for organization subjects; and the ``if known'' data

elements for all subjects relating to the acts or omissions, and the

action taken.

Each section concludes with the sanctions for failure to

report.

Section 61.16

We are adding a new Sec. 61.16 Immunity, to indicate that

individuals, entities or their authorized agents and the HIPDB will not

be held liable in any civil action filed by the subject of a report

unless the individual, entity or their authorized agent submitting the

report has actual knowledge of falsity of the information contained in

the report.

V. Regulatory Impact Statement

Executive Order 12866, the Unfunded Mandates Reform Act and the

Regulatory Flexibility Act

The Office of Management and Budget (OMB) has reviewed this final

rule in accordance with the provisions of Executive Order 12866, the

Unfunded Mandates Reform Act and the Regulatory Flexibility Act (5

U.S.C. 601-612), and has determined that it does not meet the criteria

for a significant regulatory action.

Executive Order 12866 directs agencies to assess all costs and

benefits of available regulatory alternatives and,

[[Page 57756]]

when rulemaking is necessary, to select regulatory approaches that

maximize net benefits (including potential economic, environmental,

public health, safety, distributive and equity effects). The Unfunded

Mandates Reform Act, Public Law 104-4, requires that agencies prepare

an assessment of anticipated costs and benefits on any rulemaking that

may result in an annual expenditure by State, local or tribal

government, or by the private sector of $100 million or more. In

addition, under the Regulatory Flexibility Act, if a rule has a

significant economic effect on a substantial number of small entities,

the Secretary must specifically consider the economic effect of a rule

on small entities and analyze regulatory options that could lessen the

impact of the rule.

Executive Order 12866 requires that all regulations reflect

consideration of alternatives, costs, benefits, incentives, equity, and

available information. Regulations must meet certain standards, such as

avoiding unnecessary burden. Regulations that are ``significant''

because of cost, adverse effects on the economy, inconsistency with

other agency actions, effects on the budget, or novel legal or policy

issues, require special analysis. The resources required to implement

the requirements in this final rule are minimal. We have determined

that this final rule does not meet the criteria for a major rule, as

defined by Executive Order 12866. As indicated above, this final rule

is designed to establish procedures for reporting to and releasing from

the HIPDB information on health care providers, suppliers, or

practitioners against whom final adverse actions have been taken.

In accordance with the Unfunded Mandates Reform Act of 1995, we

have determined the only costs (which we believe will not be

significant) would include the ability to transmit the information

electronically (e.g., Internet service) and additional staff hours

needed to transmit the information. Based on the public comments, we

have increased the initial start-up cost from $5,000 to $20,000 per

State licensing and certification agency ($20,000 per State licensing

and certification agency x 216 State agencies = $4,320,000). The

Department determined that the initial start-up cost will be less than

$100 per health plan ($100 per health plan x 20,000 health plans =

$2,000,000). Section 221(a) of HIPAA intends that the Federal

Government will not incur any costs for the operation and maintenance

of the HIPDB; user fees are intended to cover the full costs of the

HIPDB. For the reasons stated above, the Department has determined that

this rule does not impose any mandates on State, local or tribal

governments, or the private sector that will result in an annual

expenditure of $100 million or more, and that a full analysis under the

Act is not necessary.

In addition, in accordance with the Regulatory Flexibility Act of

1980 (RFA), and the Small Business Regulatory Enforcement Act of 1996,

which amended the RFA, we are required to determine if this rule will

have a significant economic effect on a substantial number of small

entities and, if so, to identify regulatory options that could lessen

the impact. For purposes of this final rule, we have not categorized

health plans as small business entities in accordance with the RFA, nor

have we included individuals and States in this definition of small

entities. Rather, we have defined small entities as nonprofit

organizations and local government agencies. Although the statute does

not specify local government agencies as reporters, we also have given

States the option to decide the manner in which they will report, i.e.,

having one centralized point for reporting or having multiple agencies

such as municipalities and local government agencies (including

District and County attorneys) report independently to the HIPDB. If

States elect to have multiple agencies reporting independently to the

HIPDB, we have determined that both the burden and costs associated

with reporting to the HIPDB will be minimal. We also have determined

that this rule would affect less than 100 nonprofit and local

government agencies. Also with respect to health plans, we have

determined that the burden and cost to them will be minimal. In an

effort to reduce the reporting and impact burdens upon health plans, we

have, as indicated above, clarified the definition of the term ``other

adjudicated actions or decisions'' to emphasize that such an action

requires the availability of a due process mechanism. We have in the

rule specifically limited the types of actions that health plans will

be required o report to a more limited and narrower category of

actions. We are not preparing an analysis for the RFA, since we have

determined, and the Secretary certifies, that this rule will not have a

significant economic impact on a substantial number of small entities

and, in accordance with the threshold criteria of Executive Order 13132

(August 4, 1999), have determined that these regulations do not

significantly affect the rights, roles and responsibilities of States.

Paperwork Reduction Act

In compliance with section 3506(c)(2)(A) of the Paperwork Reduction

Act (PWA) of 1995, we are required to solicit public comments, and

receive final OMB approval, on any information collection requirements

set forth in final rulemaking. As indicated above, in order to properly

implement the HIPDB, the OIG requires the collection of certain

information as set forth in Secs. 61.6, 61.7, 61.8, 61.9, 61.11, 61.12

and 61.15 of this final rule. In accordance with the PWA, we are

submitting to OMB at this time the following requirements for seeking

emergency review of these provisions. We are requesting an emergency

review because the data collection and reporting of this information is

needed before the expiration of the normal time limits under OMB's

regulations at 5 CFR part 1320, to ensure the timely availability and

reporting of data as necessary in order to improve the quality of

patient care and to prevent health care fraud and abuse activities.

Delaying the reporting process would delay implementation of the

establishment of a complete data bank that effectively deters health

care fraud and abuse in the health care industry and protects the

public. We are requesting OMB review and approval of this collection

within 16 working days from the date of publication of this rulemaking,

with a 180-day approval period. Written comments and recommendations

will be accepted from the public if received by the individual

designated below within 15 working days from the dat of publication of

these regulations. During this 180-day approval period, we will publish

a separate Federal Register notice announcing the initiation of an

extensive 60-day agency review and public comment period on the

requirements set forth.

Collection of Information: The Healthcare Integrity and Protection

Data Bank for Final Adverse Information on Health Care Providers,

Suppliers and Practitioners.

Description: Information collected under Secs. 61.6, 61.7, 61.8,

61.9, 61.11, 61.12 and 61.15 of this final rule would be used by

authorized parties, specified in the proposed rule, to prevent health

care fraud and abuse activities and to improve the quality of patient

care.

Description of Respondents: Federal and State Government agencies

and health plans. The reports from Federal agencies are not subject to

the PRA.

Estimated Annual Reporting: The Department estimates that the

public reporting burden for this final rule is

[[Page 57757]]

185,099 hours. As a result of the public comments, we acknowledge that

the proposed rule significantly under estimated the number of licensure

and certification actions taken by State licensing authorities against

health care providers, suppliers and practitioners. Therefore, we have

increased the reporting burden from 132,733 to 185,099 hours.

The estimated annual reporting and querying burden is as follows:

----------------------------------------------------------------------------------------------------------------

Number of Responses per Total Hours per Total burden

Section No. respondents respondent responses response hours

----------------------------------------------------------------------------------------------------------------

61.6, Errors & Omissions........ \1\ 1,200 1 1,200 25 500

61.6, Revisions/Appeal Status... 1,000 1 1,000 75 1,250

61.7--Licensure Actions:

Disclosure by State \2\ 1,836 22 40,400 75 50,500

Licensing Boards...........

Reporting by State Licensing 216 187 40,400 15 10,100

Authorities................

61.8, Criminal Convictions...... \3\ 54 13 700 75 875

61.9, Civil Judgments........... \4\ 62 8 500 75 625

61.11, Other Adjudicated Action \5\ 66 12 800 75 1,000

or Decision....................

61.12:

Queries..................... \6\ 5,601 201 1,127,512 5 93,959

Self-queries................ 60,000 1 60,000 25 25,000

Entity verification \7\..... 5,000 1 5,000 10 833

Entity update............... 250 1 250 5 20

61.12, Authorized agent 100 1 100 10 16

designation \7\................

61.12, Authorized agent 5 1 5 5 0.42

designation update.............

61.15--Disputed Reports &

Secretarial Review:

Initial Request............. \8\ 750 1 750 10 125

Request for Secretarial 37 1 37 480 296

Review.....................

-------------------------------------------------------------------------------

Total....................... 76,177 .............. 1,278,654 185,099

----------------------------------------------------------------------------------------------------------------

Footnotes:

1. Section 61.6 requires each Government agency or health plan that reports information to the HIPDB to ensure

the accuracy of the information. If there are any errors or omissions to the reports previously submitted to

the HIPDB, the individual or entity that submitted the report to the HIPDB is also responsible for making the

necessary correction or revision to the original report. If there is any revision to the action or the action

is on appeal, the individual or entity that submitted the original report to the HIPDB is also responsible for

reporting revisions and whether the action is on appeal. Based on corrections and revisions made to

information contained in the NPDB, we have estimated that a total of 1,200 respondents will need to correct

their reports each year and that a total of 1,000 respondents will need to revise actions originally reported,

or to report whether an action is on appeal each year. Based on experience with the NPDB, a correction is

expected to take 25 minutes to complete and submit. A revision is expected to take somewhat longer (75

minutes) because it involves completing a new report form rather that just correcting the individual items

that are in error.

2. Section 61.7 requires Federal and State agencies responsible for the licensing and certification of health

care providers, suppliers and practitioners to report all disciplinary licensure actions to the HIPDB.

Therefore, we estimate that approximately 34 State licensing boards in each State will report to the State

licensing and certification authorities (54 States and territories x 34 licensing boards/per State = 1,836

State licensing and certification boards), and the State licensing and certification authorities (4 per State)

will be responsible for reporting information to the HIPDB (54 States and territories x 4 State licensing and

certification authorities/per State = 216 State licensing and certification authorities). We estimate that

40,400 reports will be submitted directly to the HIPDB each year, for an average of 187 reports per State

licensing and certification authority and 22 reports per State licensing board. Since disciplinary licensure

actions by State licensing authorities in the NPDB overlap with this statute, this estimate includes all

licensure actions that will be reported to both the NPDB and the HIPDB. The HIPDB will use similar forms and

procedures for reporting as the NPDB. As a result, we estimate that it will take a State licensing board 75

minutes to complete and submit an initial report. We also estimate that it will take a State licensing and

certification authority 15 minutes to verify the accuracy and completeness of the information contained in the

initial report before electronically submitting the information to the HIPDB.

3. Section 61.8 requires Federal and State prosecutors to report criminal convictions related to the delivery of

a health care item or service. Based on the number of health care providers, suppliers and practitioners

convicted by the Federal Government, we estimate that there will be an approximate total of 700 State criminal

convictions reported to the HIPDB each year, for an average of 13 convictions per State. Based on experience

with the NPDB, we estimate that it will take 75 minutes to complete and submit each report.

4. Section 61.9 requires Federal and State attorneys and health care plans to report civil judgments against

health care providers, suppliers and practitioners related to the delivery of a health care item or service.

We estimate that there will be an approximate total of 500 civil judgments each year that will be reported by

the 54 States Attorneys and an estimated 8 health plans, for a total of 62 reporters. Based on experience with

the NPDB, we estimate that it will take 75 minutes to complete and submit each report.

5. Section 61.11 requires Federal and State Governmental agencies and health plans to report any adjudicated

action or decision related to the delivery of a health care item or service against health care providers,

suppliers and practitioners. We estimate that there will be an approximate total of 800 other adjudicated

actions or decision reports submitted to the HIPDB each year by 54 State governmental agencies and an

estimated 12 health plans, for a total of 66 reporters. Based on experience with the NPDB, we estimate that it

will take 75 minutes to complete and submit each report.

6. Certain queriers have access to both the NPDB and the HIPDB. When these entities query one data bank, they

may elect to automatically receive reports from both. The Department estimates that there will be 1,127,512

queries submitted to the HIPDB per year on health care providers, suppliers and practitioners, including an

estimated 60,000 self-queries. These estimates include only queries submitted directly to the HIPDB; it does

not include those transferred from the NPDB. The estimates of burden per response are based on experience with

similar querying of the NPDB.

7. To access the HIPDB, entities are required to certify that they meet section 1128E reporting and querying

requirements by completing an Entity Registration form and submitting it to the HIPDB. The information

collected on this form provides the HIPDB with essential information concerning the entity, such as name,

address and entity type. Eligible entities, such as State licensing agencies or certain managed care

organizations, that have access to both the NPDB and the HIPDB have already registered for the NPDB and are

not required to register separately for the HIPDB. Entities eligible to access only the HIPDB must complete

and submit the Entity Registration form. We estimate that it will take an entity 10 minutes to complete and

submit the Entity Registration form to the HIPDB. If there are any changes in the entity's name, address,

telephone, entity type designation, or query and report point of contact, the entity representative must

update the information on the Entity Information Update form and submit it to the HIPDB. Of the 5,000 new

registrants, we estimate 250 entities (5 percent of all new registrants) will need to update their

organization's information each year.

[[Page 57758]]

An eligible entity may elect to have an outside organization query or report to the HIPDB on its behalf. This

organization is referred to as an authorized agent. Before an authorized agent acts on behalf of an entity,

the eligible entity must complete and submit an Agent Designation form to the HIPDB Help Line. The information

collected on this form provides the HIPDB with essential information concerning the agent, such as name,

address and telephone number. We estimate that 100 entities (2 percent of all new registrants) will elect an

authorized agent to query or report to the HIPDB on their behalf. We estimate that it will take an entity 10

minutes to complete and submit the Agent Designation form to the HIPDB. Any changes to the authorized agent

designation, such as routing of responses to queries or termination of an authorized agent, the eligible

entity must update the information on the Agent Designation Update form and submit it to the HIPDB. We

estimate that five of the 100 eligible entities will need to update their agent's information each year.

8. Section 61.15 describes the process to be followed by a health care provider, supplier or practitioner in

disputing the factual accuracy of information in a report and requesting Secretarial review of the disputed

report. Based on experience with the NPDB, we estimate that 750 (10 percent of all new reports) will be

entered into the ``disputed status.'' We estimate that it will take a health care provider, supplier or

practitioner 10 minutes to notify the HIPDB to enter the report into ``disputed status.'' Of the 750 disputed

reports, we estimate that only 37 reports (5 percent) will be forwarded to the Secretary for review. We

estimate that it will take a health care provider, supplier or practitioner 8 hours to describe in writing

which facts are in dispute and to gather supporting documentation related to the dispute.

Forms to be used in the day-to-day management of the HIPDB would

include the following:

--------------------------------------------------------------------------------------------------------------------------------------------------------

Hrs. per

Form name No. of Responses per Total response Total burden Wage rate Total cost

respondents respondent responses (minutes) hours

--------------------------------------------------------------------------------------------------------------------------------------------------------

Account Discrepancy..................... 2,000 1 2,000 5 166 $15 $2,490

Electronic Funds Transfer Authorization. 850 1 850 5 70 15 1,050

Entity Reactivation..................... 500 1 500 5 41 15 615

---------------------------------------------------------------------------------------------------------------

Total............................... 3,350 .............. 3,350 .............. 277 .............. 4,155

--------------------------------------------------------------------------------------------------------------------------------------------------------

Comments on this information collection activity should be sent to:

Allison Herron Eydt, OIG Desk Officer, Office of Management and Budget,

Room 10235, New Executive Office Building, 725 17th Street, N.W.,

Washington, D.C. 20053, FAX: (202) 395-6974.

VI. Waiver of Delayed Effective Date

In publishing final regulations, we usually indicate an effective

date of 30 days following their publication in the Federal Register.

However, this procedure may be waived when an agency finds good cause

that a delay in the effective date is impracticable, unnecessary or

contrary to the public interest.

Section 221(a) of HIPAA stated that the Secretary establish a

national health care fraud and abuse data collection program by January

1, 1997. After a series of meetings with more than 1,000 current users

of the NPDB and potential users of, and reporters to, the HIPDB

(including health plans, State licensing boards, law enforcement

officials, Federal and State Government agencies and professional

associations), on October 31, 1998, we published a notice of proposed

rulemaking in the Federal Register in which we requested public comment

on the implementation of the HIPDB. As indicated, we received 117

formal public comments in response to that proposed rulemaking.

Further, in developing the final rule, we have also taken into

consideration the concerns of numerous Federal agencies, including the

Department of Justice, the Department of Defense, the Department of

Veterans Affairs and the U.S. Postal Inspection Service. Through this

process, the Department has continued to work closely with the 17

national licensing boards organizations--including those for nurses,

chiropractors, optometrists and physical therapists--that represent

more than 4 million health care practitioners. In addition, the OIG

also has contacted each State Governor regarding the reporting

requirements of the HIPDB and continues to work with the States to help

implement the States' reporting.

To implement the requirements of the statute, we believe that it is

urgent that final regulations be promulgated without further delay in

order to (1) streamline the fact-gathering process by law enforcement

officials, regulatory agencies and health plans; (2) allow health care-

related final adverse actions taken against providers, practitioners

and suppliers to be reported to the HIPDB; and (3) establish a

centralized system that will make this information easily accessible to

authorized users.

In light of the fact that we have provided ample opportunity for

public input and comment, and have worked closely with Federal and

State Government agencies and various national organizations and their

members in developing the HIPDB, we find that imposing the normal 30-

day delay would be contrary to public interest. Therefore, consistent

with 5 U.S.C. 553(d), we find good cause to waive the delay in the

effective date of this rule and allow for the timely implementation of

final regulations and the start-up of the data bank.

List of Subjects in 45 CFR Part 61

Billing and transportation services, Durable medical equipment

suppliers and manufacturers, Health care insurers, Health maintenance

organizations, Health professions, Home health care agencies,

Hospitals, Penalties, Pharmaceutical suppliers and manufacturers,

Privacy, Reporting and recordkeeping requirements, Skilled nursing

facilities.

Accordingly, a new 45 CFR part 61 is added to read as follows:

PART 61--HEALTHCARE INTEGRITY AND PROTECTION DATA BANK FOR FINAL

ADVERSE INFORMATION ON HEALTH CARE PROVIDERS, SUPPLIERS AND

PRACTITIONERS

Subpart A--General Provisions

Sec.

61.1 The Healthcare Integrity and Protection Data Bank.

61.2 Applicability of these regulations.

61.3 Definitions.

Subpart B--Reporting of Information

61.4 How information must be reported.

61.5 When information must be reported.

61.6 Reporting errors, omissions, revisions, or whether an action

is on appeal.

61.7 Reporting licensure actions taken by Federal or State

licensing and certification agencies.

61.8 Reporting Federal or State criminal convictions related to the

delivery of a health care item or service.

61.9 Reporting civil judgments related to the delivery of a health

care item or service.

61.10 Reporting exclusions from participation in Federal or State

health care programs.

61.11 Reporting other adjudicated actions or decisions.

[[Page 57759]]

Subpart C--Disclosure of Information by the Healthcare Integrity and

Protection Data Bank

61.12 Requesting information from the Healthcare Integrity and

Protection Data Bank.

61.13 Fees applicable to requests for information.

61.14 Confidentiality of Healthcare Integrity and Protection Data

Bank information.

61.15 How to dispute the accuracy of Healthcare Integrity and

Protection Data Bank information.

61.16 Immunity.

Authority: 42 U.S.C. 1320a-7e.

Subpart A--General Provisions

Sec. 61.1 The Healthcare Integrity and Protection Data Bank.

(a) Section 1128E of the Social Security Act (the Act) authorizes

the Secretary of Health and Human Services (the Secretary) to implement

a national health care fraud and abuse data collection program for the

reporting and disclosing of certain final adverse actions taken against

health care providers, suppliers, or practitioners. Section 1128E of

the Act also directs the Secretary to maintain a database of final

adverse actions taken against health care providers, suppliers or

practitioners. This data bank will be known as the Healthcare Integrity

and Protection Data Bank (HIPDB). Settlements in which no findings or

admissions of liability have been made will be excluded from being

reported. However, if another action is taken against the provider,

supplier or practitioner of a health care item or service as a result

of or in conjunction with the settlement, that action is reportable to

the HIPDB.

(b) Section 1128E of the Act also requires the Secretary to

implement the HIPDB in such a manner as to avoid duplication with the

reporting requirements established for the National Practitioner Data

Bank (NPDB) (See 45 CFR part 60). In accordance with the statute, the

reporter responsible for reporting the final adverse actions to both

the HIPDB and the NPDB will be required to submit only one report,

provided that reporting is made through the Department's consolidated

reporting mechanism that will sort the appropriate actions into the

HIPDB, NPDB, or both.

(c) The regulations in this part set forth the reporting and

disclosure requirements for the HIPDB.

Sec. 61.2 Applicability of these regulations.

The regulations in this part establish reporting requirements

applicable to Federal and State Government agencies and to health

plans, as the terms are defined under Sec. 61.3.

Sec. 61.3 Definitions.

The following definitions apply to this part:

Act means the Social Security Act.

Affiliated or associated means health care entities with which a

subject of a final adverse action has a commercial relationship,

including but not limited to, organizations, associations,

corporations, or partnerships. It also includes a professional

corporation or other business entity composed of a single individual.

Any other negative action or finding by a Federal or State

licensing agency means any action or finding that under the State's law

is publicly available information, and rendered by a licensing or

certification authority, including but not limited to, limitations on

the scope of practice, liquidations, injunctions and forfeitures. This

definition also includes final adverse actions rendered by a Federal or

State licensing or certification authority, such as exclusions,

revocations or suspension of license or certification that occur in

conjunction with settlements in which no finding of liability has been

made (although such a settlement itself is not reportable under the

statute). This definition excludes citations, corrective action plans

and personnel actions.

Civil judgment means a court-ordered action rendered in a Federal

or State court proceeding, other than a criminal proceeding. This

reporting requirement does not include Consent Judgments that have been

agreed upon and entered to provide security for civil settlements in

which there was no finding or admission of liability.

Criminal conviction means a conviction as described in section

1128(i) of the Act.

Exclusion means a temporary or permanent debarment of an individual

or entity from participation in any Federal or State health-related

program, in accordance with which items or services furnished by such

person or entity will not be reimbursed under any Federal or State

health-related program.

Government agency includes, but is not limited to--

(1) The U.S. Department of Justice;

(2) The U.S Department of Health and Human Services;

(3) Any other Federal agency that either administers or provides

payment for the delivery of health care services, including, but not

limited to, the U.S. Department of Defense and the U.S. Department of

Veterans Affairs;

(4) Federal and State law enforcement agencies, including States

Attorneys General and law enforcement investigators;

(5) State Medicaid Fraud Control Units; and

(6) Federal or State agencies responsible for the licensing and

certification of health care providers, suppliers or licensed health

care practitioners. Examples of such State agencies include Departments

of Professional Regulation, Health, Social Services (including State

Survey and Certification and Medicaid Single State agencies), Commerce

and Insurance.

Health care provider means a provider of services as defined in

section 1861(u) of the Act; any health care entity (including a health

maintenance organization, preferred provider organization or group

medical practice) that provides health care services and follows a

formal peer review process for the purpose of furthering quality health

care, and any other health care entity that, directly or through

contracts, provides health care services.

Health care supplier means a provider of medical and other health

care services as described in section 1861(s) of the Act; or any

individual or entity, other than a provider, who furnishes, whether

directly or indirectly, or provides access to, health care services,

supplies, items, or ancillary services (including, but not limited to,

durable medical equipment suppliers, manufacturers of health care

items, pharmaceutical suppliers and manufacturers, health record

services such as medical, dental and patient records, health data

suppliers, and billing and transportation service suppliers). The term

also includes any individual or entity under contract to provide such

supplies, items or ancillary services; health plans as defined in this

section (including employers that are self-insured); and health

insurance producers (including but not limited to agents, brokers,

solicitors, consultants and reinsurance intermediaries).

Health plan means a plan, program or organization that provides

health benefits, whether directly, through insurance, reimbursement or

otherwise, and includes but is not limited to--

(1) A policy of health insurance;

(2) A contract of a service benefit organization;

(3) A membership agreement with a health maintenance organization

or other prepaid health plan;

(4) A plan, program, or agreement established, maintained or made

available by an employer or group of employers, a practitioner,

provider or supplier group, third party administrator, integrated

health care delivery system, employee welfare

[[Page 57760]]

association, public service group or organization or professional

association; and

(5) An insurance company, insurance service or insurance

organization that is licensed to engage in the business of selling

health care insurance in a State and which is subject to State law

which regulates health insurance.

Licensed health care practitioner, licensed practitioner, or

practitioner means, with respect to a State, an individual who is

licensed or otherwise authorized by the State to provide health care

services (or any individual who, without authority, holds himself or

herself out to be so licensed or authorized).

Organization name means the subject's business or employer at the

time the underlying acts occurred. If more than one business or

employer is involved, the one most closely related to the underlying

acts should be reported in the ``organization name,'' field with the

others being reported in the ``affiliated or associated health care

entities'' field.

Organization type means a brief description of the nature of that

business or employer.

Other adjudicated actions or decisions means formal or official

final actions taken against a health care provider, supplier or

practitioner by a Federal or State governmental agency or a health

plan; which include the availability of a due process mechanism, and;

are based on acts or omissions that affect or could affect the payment,

provision or delivery of a health care item or service. For example, a

formal or official final action taken by a Federal or State

governmental agency or a health plan may include, but is not limited

to, a personnel-related action such as suspensions without pay,

reductions in pay, reductions in grade for cause, terminations or other

comparable actions. A hallmark of any valid adjudicated action or

decision is the availability of a due process mechanism. The fact that

the subject elects not to use the due process mechanism provided by the

authority bringing the action is immaterial, as long as such a process

is available to the subject before the adjudicated action or decision

is made final. In general, if an ``adjudicated action or decision''

follows an agency's established administrative procedures (which ensure

that due process is available to the subject of the final adverse

action), it would qualify as a reportable action under this definition.

This definition specifically excludes clinical privileging actions

taken by Federal or State Government agencies and similar paneling

decisions made by health plans. This definition does not include

overpayment determinations made by Federal or State Government

programs, their contractors or health plans; and it does not include

denial of claims determinations made by Government agencies or health

plans. For health plans that are not Government entities, an action

taken following adequate notice and the opportunity for a hearing that

meets the standards of due process set out in section 412(b) of the

HCQIA (42 U.S.C. 11112(b)) also would qualify as a reportable action

under this definition.

Secretary means the Secretary of Health and Human Services and any

other officer or employee of the Department of Health and Human

Services to whom the authority involved has been delegated.

State means any of the fifty States, the District of Columbia, the

Commonwealth of Puerto Rico, the Virgin Islands and Guam.

Voluntary surrender means a surrender made after a notification of

investigation or a formal official request by a Federal or State

licensing or certification authority for a health care provider,

supplier or practitioner to surrender the license or certification

(including certification agreements or contracts for participation in

Federal or State health care programs). The definition also includes

those instances where a health care provider, supplier or practitioner

voluntarily surrenders a license or certification (including program

participation agreements or contracts) in exchange for a decision by

the licensing or certification authority to cease an investigation or

similar proceeding, or in return for not conducting an investigation or

proceeding, or in lieu of a disciplinary action.

Subpart B--Reporting of Information

Sec. 61.4 How information must be reported.

Information must be reported to the HIPDB as required under

Secs. 61.6, 61.7, 61.8, 61.9, 61.10, 61.11 and 61.15 in such form and

manner as the Secretary may prescribe.

Sec. 61.5 When information must be reported.

(a) Information required under Secs. 61.7, 61.8, 61.9, 61.10 and

61.11 must be submitted to the HIPDB--

(1) Within 30 calendar days from the date the final adverse action

was taken or the date when the reporting entity became aware of the

final adverse action; or

(2) By the close of the entity's next monthly reporting cycle,

whichever is later.

(b) The date the final adverse action was taken, its effective date

and duration of the action would be contained in the information

reported to the HIPDB under Secs. 61.7, 61.8, 61.9, 61.10 and 61.11.

Sec. 61.6 Reporting errors, omissions, revisions or whether an action

is on appeal.

(a) If errors or omissions are found after information has been

reported, the reporter must send an addition or correction to the

HIPDB. The HIPDB will not accept requests for readjudication of the

case.

(b) A reporter that reports information on licensure, criminal

convictions, civil or administrative judgments, exclusions, or

adjudicated actions or decisions under Secs. 61.7, 61.8, 61.9, 61.10 or

61.11 also must report any revision of the action originally reported.

Revisions include, but are not limited to, reversal of a criminal

conviction, reversal of a judgment or other adjudicated decisions or

whether the action is on appeal, and reinstatement of a license.

(c) The subject will receive a copy of all reports, including

revisions and corrections to the report.

(d) Upon receipt of a report, the subject--

(1) Can accept the report as written;

(2) May provide a statement to the HIPDB that will be permanently

appended to the report, either directly or through a designated

representative (The HIPDB will distribute the statement to queriers,

where identifiable, and to the reporting entity and the subject of the

report. The HIPDB will not edit the statement; only the subject can,

upon request, make changes to the statement); or

(3) May follow the dispute process in accordance with Sec. 61.15.

Sec. 61.7 Reporting licensure actions taken by Federal or State

licensing and certification agencies.

(a) What actions must be reported. Federal and State licensing and

certification agencies must report to the HIPDB the following final

adverse actions that are taken against a health care provider,

supplier, or practitioner (regardless of whether the final adverse

action is the subject of a pending appeal)--

(1) Formal or official actions, such as revocation or suspension of

a license or certification agreement or contract for participation in

Federal or State health care programs (and the length of any such

suspension), reprimand, censure or probation;

(2) Any other loss of the license or loss of the certification

agreement or contract for participation in Federal or

[[Page 57761]]

State health care programs, or the right to apply for, or renew, a

license or certification agreement or contract of the provider,

supplier, or practitioner, whether by operation of law, voluntary

surrender, non-renewal (excluding nonrenewals due to nonpayment of

fees, retirement, or change to inactive status), or otherwise; and

(3) Any other negative action or finding by such Federal or State

agency that is publicly available information.

(b) Entities described in paragraph (a) of this section must report

the following information:

(1) If the subject is an individual, personal identifiers,

including:

(i) Name;

(ii) Social Security Number;

(iii) Home address or address of record;

(iv) Sex; and

(v) Date of birth.

(2) If the subject is an individual, that individual's employment

or professional identifiers, including:

(i) Organization name and type;

(ii) Occupation and specialty, if applicable;

(iii) National Provider Identifier (NPI), when issued by the Health

Care Financing Administration (HCFA);

(iv) Name of each professional school attended and year of

graduation; and

(v) With respect to the State professional license (including

professional certification and registration) on which the reported

action was taken, the license number, the field of licensure, and the

name of the State or territory in which the license is held.

(3) If the subject is an organization, identifiers, including:

(i) Name;

(ii) Business address;

(iii) Federal Employer Identification Number (FEIN), or Social

Security Number when used by the subject as a Taxpayer Identification

Number (TIN);

(iv) The NPI, when issued by HCFA;

(v) Type of organization; and

(vi) With respect to the State license (including certification and

registration) on which the reported action was taken, the license and

the name of the State or territory in which the license is held.

(4) For all subjects:

(i) A narrative description of the acts or omissions and injuries

upon which the reported action was based;

(ii) Classification of the acts or omissions in accordance with a

reporting code adopted by the Secretary;

(iii) Classification of the action taken in accordance with a

reporting code adopted by the Secretary, and the amount of any monetary

penalty resulting from the reported action;

(iv) The date the action was taken, its effective date and

duration;

(v) If the action is on appeal;

(vi) Name of the agency taking the action;

(vii) Name and address of the reporting entity; and

(viii) The name, title and telephone number of the responsible

official submitting the report on behalf of the reporting entity.

(c) Entities described in paragraph (a) of this section should

report, if known, the following information:

(1) If the subject is an individual, personal identifiers,

including:

(i) Other name (s) used;

This text is long and has been trimmed here. Open the source document for the complete record.