Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings

AGENCY:

Office of the Secretary, HHS.

ACTION:

Interim final rule; request for comments.

SUMMARY:

This interim final rule establishes rules of procedure for the imposition, by the Secretary of Health and Human Services, of civil money penalties on entities that violate standards adopted by the Secretary under the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). We intend that this be the first installment of a rule that we term the “Enforcement Rule.” The Enforcement Rule, when issued in complete form, will set forth procedural and substantive requirements for imposition of civil money penalties. In the interim, we are issuing these rules of procedure to inform regulated entities of our approach to enforcement and to advise regulated entities of certain procedures that will be followed as we enforce the Administrative Simplification provisions of HIPAA.

DATES:

Effective Date: This interim final rule is effective May 19, 2003.

Comment Date: Comments on the interim final rule must be received by June 16, 2003.

Expiration Date: This interim final rule will cease to be in effect on September 16, 2003.

ADDRESSES:

In commenting, please refer to file code CMS-0010-IFC. Because of staff and resource limitations, we cannot accept comments by facsimile (“FAX”) transmission. Mail written comments (one original and three copies) to the following address only: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-0010-IFC, P.O. Box 8010, Baltimore, MD 21244-8010.

Please allow sufficient time for mailed comments to be timely received in the event of delivery delays.

If you prefer, you may deliver (by hand or courier) your written comments (one original and three copies) to one of the following addresses: Room 445-G, Hubert H. Humphrey (“HHH”) Building, 200 Independence Avenue, SW., Washington, DC 20201, or Room C5-14-03, 7500 Security Boulevard, Baltimore, MD 21244-1850.

(Because access to the interior of the HHH Building is not readily available to persons without Federal Government identification, commenters are encouraged to leave their comments in the CMS drop slots located in the main lobby of the building. A stamp-in clock is available for commenters wishing to retain a proof of filing by stamping in and retaining an extra copy of the comments being filed.)

Comments mailed to the addresses indicated as appropriate for hand or courier delivery may be delayed and could be considered late.

Comments may also be submitted electronically to the following e-mail address: CMS0010.Comments@hhs.gov. For e-mail procedures, see the beginning of the SUPPLEMENTARY INFORMATION section.

For further information on viewing public comments, see the beginning of the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT:

Karen Shaw, (202) 690-7711.

SUPPLEMENTARY INFORMATION:

Inspection of Public Comments

Comments received timely will be available for public inspection as they are received, generally beginning approximately 3 weeks after publication of this document, at the headquarters of the Centers for Medicare & Medicaid Services, 7500 Security Boulevard, Baltimore, Maryland 21244, Monday through Friday of each week from 8:30 a.m. to 4 p.m. To schedule an appointment to view public comments, call Sharon Jones at (410) 786-9994.

Electronic Comments

We will consider all electronic comments that include the full name, postal address, and affiliation (if applicable) of the sender and are submitted to the electronic address identified in the ADDRESSES section of this preamble. All comments must be incorporated in the e-mail message because we may not be able to access attachments. Copies of electronically submitted comments will be available for public inspection as soon as practicable at the address provided, and subject to the same process described, in the preceding paragraph.

Copies

To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at (202) 512-1800 (or toll-free at 1-866-512-1800) or by faxing to (202) 512-2250. The cost for each copy is $10. As an alternative, you may view and photocopy the Federal Register document at most libraries designated as Federal Depository Libraries and at many other public and academic libraries throughout the country that receive the Federal Register.

This Federal Register document is also available from the Federal Register online database through GPO Access, a service of the U.S. Government Printing Office. The web site address is: http://www.access.gpo.gov/nara/index.html.

Electronic Access

This document is available electronically at the following web sites of the Department of Health and Human Services (“HHS” or the “Department”): http://www.hhs.gov/ocr/hipaa/ and http://www.cms.gov/hipaa/hipaa2. It is also available at the web site of the Government Printing Office at http://www.access.gpo.gov/nara/index.html.

I. Background

This interim final rule establishes rules of procedure for the imposition, by the Secretary of Health and Human Services, of civil money penalties on entities that violate the Administrative Simplification regulations (“HIPAA rules”) adopted by the Secretary under subtitle F of Title II of HIPAA (“HIPAA provisions”). We intend this interim final rule to be the first installment of a rule termed the “Enforcement Rule.” The Enforcement Rule, when issued in complete form, will set forth procedural and substantive requirements for imposition of civil money penalties. In the interim, we are issuing these rules of procedure to inform regulated entities of our approach to enforcement and to advise regulated entities of certain procedures that will be followed with regard to enforcement. We intend to revise the procedural rule by the expiration date provided above.

We set out below the statutory and regulatory background of the rule, describe our approach to enforcement of the HIPAA provisions and rules in general and this rule in particular, and then discuss each section of the interim final rule. We also set out our analyses of impact and other issues under applicable law.

Statutory Background

HIPAA became law in 1996 (Public Law 104-191). Subtitle F of Title II of HIPAA, entitled “Administrative Simplification,” requires the Secretary of HHS to adopt national standards for certain information-related activities of the health care industry. The purpose of subtitle F is to improve the Medicare program under title XVIII of the Social Security Act (“Act”), the Medicaid program under title XIX of the Act, and the efficiency and effectiveness of the health care system, by mandating the development of standards and requirements to enable the electronic exchange of certain health information. Section 262 of subtitle F added a new Part C to Title XI of the Act. Part C (42 U.S.C. 1320d-1320d-8) requires the Secretary to adopt national standards for certain financial and administrative transactions and various data elements to be used in those transactions, such as code sets and certain unique health identifiers. Recognizing that the industry trend toward computerizing health information, which HIPAA encourages, may increase the access to that information, the statute also requires national standards to protect the security and privacy of the information.

The HIPAA provisions, by statute, apply only to the following persons:

(1) A health plan.

(2) A health care clearinghouse.

(3) A health care provider who transmits any health information in electronic form in connection with a transaction referred to in section 1320d-2(a)(1) of this title.

42 U.S.C. 1320d-1(a)

Collectively, these entities are known as “covered entities.” The statute requires certain consultations with industry as a predicate to the issuance of standards and gives most covered entities 2 years (small health plans have 3 years) to come into compliance with the standards, once adopted. 42 U.S.C. 1320d-1(c), 42 U.S.C. 1320d-4(b). The statute establishes civil money penalties and criminal penalties for violations. 42 U.S.C. 1320d-5, 42 U.S.C. 1320d-6. HHS will enforce the civil money penalties, while the U.S. Department of Justice will enforce the criminal penalties.

HIPAA's civil money penalty (“CMP”) provision authorizes the Secretary to impose CMPs, as follows:

(1) In general. Except as provided in subsection (b), the Secretary shall impose on any person who violates a provision of this part [42 U.S.C. 1320d et seq.] a penalty of not more than $100 for each such violation, except that the total amount imposed on the person for all violations of an identical requirement or prohibition during a calendar year may not exceed $25,000.

(2) Procedures. The provisions of section 1128A [42 U.S.C. 1320a-7a] (other than subsections (a) and (b) and the second sentence of subsection (f)) shall apply to the imposition of a civil money penalty under this subsection in the same manner as such provisions apply to the imposition of a penalty under such section 1128A.

42 U.S.C. 1320d-5(a)

Subsection (b) of section 1320d-5 sets out a number of substantive limitations on the Secretary's authority to impose CMPs. First, a CMP may not be imposed with respect to an act that “constitutes an offense punishable” under the criminal penalty provision. 42 U.S.C. 1320d-5(b)(1). Second, a CMP may not be imposed “if it is established to the satisfaction of the Secretary that the person liable for the penalty did not know, and by exercising reasonable diligence would not have known, that such person violated the provision.” 42 U.S.C. 1320d-5(b)(2). Third, a CMP may not be imposed if the failure to comply was due “to reasonable cause and not to willful neglect” and is corrected within a certain time. 42 U.S.C. 1320d-5(b)(3). Finally, a CMP may be reduced, if not waived entirely, “to the extent that the payment of such penalty would be excessive relative to the compliance failure involved.” 42 U.S.C. 1320d-5(b)(4).

As noted above, HIPAA incorporates by reference certain provisions of section 1128A of the Act (42 U.S.C. 1320a-7a). Those provisions, as relevant here, provide a number of procedural requirements with respect to the imposition of CMPs. The Secretary may not initiate a CMP action “later than six years after the date” of the occurrence that forms the basis for the CMP. The Secretary may initiate a CMP action by serving notice “in any manner authorized by Rule 4 of the Federal Rules of Civil Procedure.” 42 U.S.C. 1320a-7a(c)(1). A person upon whom the Secretary seeks to impose a CMP must be given written notice and an opportunity for a determination to be made “on the record after a hearing at which the person is entitled to be represented by counsel, to present witnesses, and to cross-examine witnesses against the person.” 42 U.S.C. 1320a-7a(c)(2). There are provisions authorizing the sanctions the hearing officer may impose for misconduct in connection with the CMP proceeding, judicial review of the Secretary's determination in the United States Court of Appeals for the circuit in which the person resides, and the issuance of subpoenas by the Secretary and the enforcement of those subpoenas. 42 U.S.C. 1320a-7a(c)(4), (e), (j). These provisions are discussed more fully below.

Regulatory Background

As noted above, HIPAA requires the Secretary of HHS to adopt a number of national standards to facilitate the exchange of certain health information. The Secretary has already issued a number of these HIPAA standards by regulation. We summarize these HIPAA Administrative Simplification rules below.

• Regulations implementing the statutory requirement for the adoption of standards for transactions and code sets (“Transactions Rule”) were published on August 17, 2000 (65 FR 50312), and were recently modified (68 FR 8381, February 20, 2003). The Transactions Rule became effective on October 16, 2000, with an initial compliance date of October 16, 2002 for covered entities other than small health plans. The passage of the Administrative Simplification Compliance Act, Pub. L. 107-105, in 2001 enabled covered entities to obtain an extension of the compliance date to October 16, 2003 by filing a compliance plan by October 15, 2002. If a covered entity (other than a small health plan) did not file such a plan, it was required to comply with the Transactions Rule by October 16, 2002. All covered entities must be in compliance with the Transactions Rule, as modified, by October 16, 2003.
• Regulations implementing the statutory requirement for the adoption of privacy standards were published on December 28, 2000 (65 FR 82462) (“Privacy Rule”). The Privacy Rule became effective on April 14, 2001, with an initial compliance date of April 14, 2003 for covered entities other than small health plans. Modifications to the Privacy Rule were published on August 14, 2002 (67 FR 53182), and compliance with the modified privacy standards is required by the initial compliance date, April 14, 2003, for those covered entities that must comply by that date.
• Regulations implementing the statutory requirement for the adoption of an employer identifier standard were published on May 31, 2002 (67 FR 38009) and became effective on July 30, 2002. The initial compliance date is July 30, 2004 for most covered entities; small health plans have until July 30, 2005 to come into compliance.
• Regulations implementing the statutory requirement for the adoption of security standards were published on February 20, 2003 (68 FR 8334). They are effective on April 21, 2003, and the initial compliance date for covered entities other than small health plans is April 20, 2005; small health plans have until April 20, 2006 to comply.

The authority for administering and enforcing compliance with the Privacy Rule has been delegated to the Office for Civil Rights (“OCR”) of HHS. Responsibility for administering and enforcing the remaining HIPAA rules has been assigned to the Centers for Medicare & Medicaid Services (“CMS”).

II. General Approach

As the discussion above makes clear, the duty to comply with certain of the HIPAA rules is now a reality for many, if not most, covered entities. The immediacy of the compliance obligation brings with it the issue of how these rules will be enforced. Accordingly, we lay out below our general approach to enforcement. We then discuss how the rules below will fit in with the projected Enforcement Rule in its entirety and the basic approach of the interim final rule.

HHS's General Approach to Enforcement

The Department intends to seek and promote voluntary compliance with the rules promulgated to carry out the HIPAA provisions. With respect to the Privacy Rule, OCR has developed and is continuing to produce guidance and a wide array of other technical assistance materials to help covered entities effectively implement the Privacy Rule. These materials are available on the OCR Privacy web site at http://www.hhs.gov/ocr/hipaa. These efforts will continue after the April 14, 2003 compliance date, as OCR learns from its compliance activities and from those who are implementing the Privacy Rule where additional guidance and assistance are needed. Other components of the Department are also developing guidance and technical assistance on the Privacy Rule for their partners.

This approach reflects the requirements in 45 CFR part 160, subpart C, that, to the extent practicable, OCR will seek the cooperation of covered entities in obtaining compliance with the Privacy Rule, and may provide technical assistance to help covered entities voluntarily comply with the Rule. See 45 CFR 160.304. As further provided in 45 CFR 160.312(a)(2), OCR will seek to resolve matters by informal means before issuing findings of non-compliance, under its authority to investigate and resolve complaints, and to engage in compliance reviews.

With respect to enforcement of the remainder of the HIPAA rules, the enforcement approach of CMS is similar. “Enforcement activities will focus on obtaining voluntary compliance through technical assistance. The process will be primarily complaint driven and will consist of progressive steps that will provide opportunities to demonstrate compliance or submit a corrective action plan.” HHS press release of October 15, 2002, announcing assignment of enforcement responsibility to CMS. CMS provides a wide variety of technical assistance and informational materials on its Web site, at http://www.cms.gov/hipaa/hipaa2.

HHS's Approach to the Enforcement Rule

As noted above, HHS intends to issue an Enforcement Rule in furtherance of its implementation of 42 U.S.C. 1320d-5. The Enforcement Rule, in its entirety, will address a number of substantive issues relating to the imposition of CMPs under section 1320d-5, such as the Department's policies for determining violations and calculating CMPs. In addition, the Enforcement Rule will establish various procedures for the imposition of CMPs, including the procedures for providing notice and a hearing on the Secretary's determination to impose a CMP. This interim final rule implements this latter aspect of the Enforcement Rule.

Administrative Procedure Act

We recognize that under the Administrative Procedure Act (“APA”) most of the above-described provisions of the Enforcement Rule must be promulgated through notice-and-comment rulemaking. We intend to do so. However, to allow covered entities and the public to be informed as soon as possible of procedural requirements that will apply as compliance proceeds, we are expediting the publication of these procedural rules in final form. These rules set out the procedures for provision by the agency of the statutorily required notice and hearing and procedures for issuing administrative subpoenas. Such provisions are exempted from the requirement for notice-and-comment rulemaking under the “rules of agency * * * procedure, or practice” exemption at 5 U.S.C. 553(b)(3)(A). Even though notice-and-comment rulemaking is, therefore, not required with respect to the procedural rules adopted below, HHS is interested in input from the public, and thus is requesting public comment on them. We expect to augment these procedural rules with provisions that, while related to procedure, are substantive in nature. We anticipate including those provisions in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule. In any event, we plan to revise the procedural rule by the expiration date.

Approach of the Interim Final Rule

As noted above, the provisions of 42 U.S.C. 1320a-7a apply to the imposition of a CMP under 42 U.S.C. 1320d-5 “in the same manner as” they apply to the imposition of CMPs under section 1320a-7a itself. Within HHS, section 1320a-7a is implemented by the Office of Inspector General (“OIG”) and, as pertinent here, through the OIG regulations that are codified at 42 CFR parts 1003, 1005, and 1006. We have used the OIG regulations as the platform for the rules below for two reasons. First, we read the “in the same manner as” language of the statute as indicating that the procedures for the imposition of CMPs under 42 U.S.C. 1320d-5 should be, in general, similar to those used by the OIG under 42 U.S.C. 1320a-7a. Second, HHS and much of the health care industry have operated under the OIG regulations implementing section 1320a-7a for more than a decade. There is, thus, a significant body of experience with, and understanding of, the OIG procedural rules, both within HHS and in a large part of the regulated universe. Based on this experience, we believe that the rules below will be workable and promote the efficient resolution of cases where the Secretary's proposed imposition of a CMP is challenged.

Accordingly, the rules below are based upon, and are in many respects the same as, the OIG regulations at 42 CFR parts 1003, 1005, and 1006. We have adapted, re-ordered, or combined the OIG language in a number of places for clarity of presentation or to reflect concepts peculiar to the HIPAA provisions or rules. To avoid confusion, we have also employed certain language usages in order to make the usage in the rules below consistent with that in the other HIPAA rules (for example, for mandatory duties, “must” instead of “will” or “shall”; for discretionary duties, “may” instead of “has the authority to”). We do not discuss those nonsubstantive changes below. Where we have materially changed the language of the OIG regulations, however, we discuss our reasons for doing so.

We also note that the rules below, as well as the Enforcement Rule as a whole, are not HIPAA standards, and thus the requirement for industry consultations in 42 U.S.C. 1320d-1(c) does not apply. Therefore, we have not engaged in such consultations with respect to the interim final rule below. For the same reason, HIPAA's timeframes for compliance (42 U.S.C. 1320d-4) do not apply to the interim final rule below.

III. Provisions of the Interim Final Rule

We discuss the interim final rule on a provision-by-provision basis below. As a general matter, we note that the provisions adopted are in many cases the same as or similar to analogous provisions of the OIG regulations. Where we have closely followed the OIG regulations, we have done so because we believe that these procedures work and satisfactorily address issues of concern addressed in prior rulemakings by the OIG. We do not reiterate those concerns, or their resolutions, here, but they have informed our decisionmaking on these rules.

Applicability

Section 160.500 states that the procedures established by this subpart are applicable to investigations, imposition of penalties, and hearings conducted as a result of a proposed imposition of civil money penalties. We use “applicability” instead of the basis and purpose statement of the OIG regulations, because we have followed a different format in the remainder of the HIPAA rules and wish to be consistent with that approach. Furthermore, this preamble constitutes the requisite basis and purpose statement.

Definitions

Definitions for the terms used in this new subpart that are not set forth elsewhere in part 160 are included in § 160.502.

• ALJ means an administrative law judge, the natural person who presides at and conducts a hearing requested by a respondent pursuant to this subpart.
• Entity means a legal person that is not a natural person. The term is intended to include all manner of organizations, such as corporations, associations, partnerships, and other entities that have a legal existence, other than a natural person. The term “entity” is necessary for this subpart to distinguish such legal persons from natural persons, because certain procedures in this rule, such as those involving subpoenas, are different for entities than they are for natural persons.

The term “entity” should not be confused with the regulatory term “covered entity.” The latter term, which is defined at § 160.103, denotes those entities to which the HIPAA rules apply. The term “entity,” as used in this interim final rule, describes a broader class of persons. For example, subpoenas could be directed to entities that are not covered entities under § 160.504 below.

• Penalty is defined to mean the amount calculated under 42 U.S.C. 1320d-5. This section of HIPAA sets a penalty of not more than $100 for each violation, subject to a calendar-year cap of $25,000 for all violations of an identical requirement or prohibition. The term includes the plural form of the word.
• Person is defined to mean a natural person or a legal person (such as an entity described above). The term includes, but is not limited to, covered entities. The term is broader than “covered entities,” because some sections of the provisions below by their nature apply to persons other than covered entities in certain circumstances. For example, the provisions for subpoenas relate to natural persons who will be called to testify, and many, if not most, of these persons will not be covered entities. While the term “person” is used generically throughout the HIPAA rules, we have provided a definition of the term “person” for use in this subpart to provide a clear and efficient way of permitting these distinctions to be drawn. This definition is not intended to define “person” as that term is used in HIPAA.
• Respondent means a person (as defined herein) upon whom a penalty has been imposed, whether proposed or final, by the Secretary. Respondents will necessarily be covered entities. See the discussion below of § 160.506.

Investigational Subpoenas and Inquiries

Section 160.504 provides procedures for the issuance of subpoenas to both named persons and unnamed persons associated with subpoenaed entities. A subpoenaed entity is required to name a natural person or persons knowledgeable about the subjects on which information is sought. This procedure is similar to that provided for in Rule 30(b)(6) of the Federal Rules of Civil Procedure. Subpoenas issued under this section may require either testimony or the production of evidence.

The procedures adopted in this section are similar to those in 42 CFR part 1006. Like § 1006.4, § 160.504 provides that investigational inquiries are non-public proceedings conducted by the Secretary. A witness is entitled to be represented by an attorney during an investigational inquiry. However, while this section provides for the taking of witness testimony, it does not include all of the provisions of § 1006.4 regarding claims of privilege or objections, clarification of answers by the witness, corrections to the transcript, or the use by the Secretary of testimony or evidence obtained in an investigational inquiry. We anticipate addressing these issues in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule.

Basis for Penalty

Under § 160.506, CMPs are imposed for violations of 42 U.S.C. 1320d-1320d-8, section 264 of Pub. L. 104-191, or the implementing regulations at parts 160, 162 or 164 of this subchapter. CMPs may be imposed only on covered entities. As we have stated in prior rulemakings, it is the view of HHS that only covered entities are subject to the HIPAA provisions and rules. Thus, only covered entities can be liable for a CMP under 42 U.S.C. 1320d-5. See, for example, 67 FR 53252. Regulatory definition of what constitutes a violation requiring imposition of a CMP will be addressed in the subsequent notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule. This section, thus, functions to clarify and establish the linkage of the procedural rules to the criteria and processes for the substantive determinations that are to be developed through notice-and-comment rulemaking.

Amount of Penalty

Under § 160.508, the amount of the penalty is determined in accordance with 42 U.S.C. 1320d-5 and the provisions of this part. We anticipate addressing how penalties will be determined in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule. This section thus functions to clarify and establish the linkage of the procedural rules to the criteria and processes for the substantive determinations that are still to be developed.

Authority To Settle

Section 160.510 enunciates the authority of the Secretary to settle any issue or case or to compromise any penalty during the process addressed in this subpart. This authority is the same as that set forth in § 1003.106(f)(3) of the OIG regulations and implements statutory authority provided by the first sentence of 42 U.S.C. 1320a-7a(f). It provides for flexible resolution of cases and issues between the Secretary and a respondent. We anticipate that factors to be taken into account in determinations regarding the amount of penalties, like those set forth in § 1003.106(a) through § 1003.106(e) of the OIG regulations, will be addressed in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule. This section, like the preceding sections, thus serves to link substantive provisions yet to be developed into the procedural process put in place by the rules below.

Notice of Proposed Determination

Section 160.514 sets forth the requirements for the notice to a respondent sent when the Secretary proposes a penalty under this part. These requirements are substantially the same as those in § 1003.109 of the OIG regulations. Statistical sampling provisions, however, are not included in this section at this time. We anticipate addressing statistical sampling in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule.

Failure To Request a Hearing

Under § 160.516, when a respondent does not timely request a hearing on a proposed penalty, the Secretary will impose the proposed penalty or any less severe penalty permitted by 42 U.S.C. 1320d-5. The penalty is then final, and the respondent has no right to appeal a penalty imposed under these circumstances. This section is similar to § 1003.110 of the OIG regulations. This section simply states the necessary consequence of a respondent's failure to exercise the right to a hearing.

Collection of Penalty

Section 160.518 provides that once a determination to impose a penalty has become final, the penalty must be collected by the Secretary. The penalty may be recovered in a civil action in United States District Court, or by deduction from any sum owed to the respondent by the United States or a State agency. If the Secretary seeks to recover the penalty in a civil action, the respondent is prohibited from raising in that proceeding any matter that was raised or could have been raised in a hearing or appeal under this subpart. These provisions restate statutory provisions at 42 U.S.C. 1320a-7a(f) and (g).

Limitations

Section 160.522 sets forth the 6-year limitations period provided for by 42 U.S.C. 1320a-7a(c)(1). The section includes only the part of the statutory language that is relevant to the imposition of penalties in the context of the HIPAA rules. The statutory language concerning the “claim was presented” and “request for payment” are not included, because these phrases pertain to violations described in the parts of 42 U.S.C. 1320a-7a that are not incorporated by reference into 42 U.S.C. 1320d-5. Section 160.522 accordingly differs in this respect from § 1003.132 of the OIG regulations.

Hearing Before an ALJ

The requirements for a hearing request are contained in § 160.526. The parties to a hearing are the party against whom the Secretary has proposed a penalty (the respondent) and the Secretary. We recognize that the HHS party will be OCR and/or CMS. We have not described the party more specifically here, however, for several reasons. First, it is not feasible to parse out which component will actually appear for the Secretary, because the appropriate component (if both are not) will depend on the facts of the case. Second, the designation of the proper party component can be handled through the normal delegation process. Third, similar issues arise in other sections of this interim final rule (see, for example, § 160.514), and they are handled this way in those sections as well. A consistent approach is less confusing and more manageable.

The respondent may request a hearing following receipt of a notice of a proposed determination. The request for a hearing must be in writing. If the respondent fails to timely request a hearing, or thereafter withdraws or abandons the request for a hearing, or if the hearing request fails to raise any issue that may properly be addressed in a hearing, the administrative law judge (ALJ) is required to dismiss the hearing request. In such a case, the penalty becomes final, with no further appeal permitted.

Paragraph (c) of § 160.526 differs slightly from the corresponding paragraph in § 1005.2. Our provision requires specific admissions, denials or explanations in a respondent's hearing request. The degree of specificity required generally parallels the requirements applicable to the notice of proposed determination at § 160.514. Based on experience in prior administrative hearings, we believe that such additional specificity will assist the parties and the ALJ in ascertaining the findings of fact and conclusions of law that are actually in dispute in a case. This certainty will promote procedural regularity and permit more timely and efficient resolution of the case between the parties or adjudication of the case by the ALJ.

Rights of Parties; Authority of the ALJ

The provisions in § 160.528 and § 160.530 list the rights of the parties and the authorities of the ALJ not specifically provided elsewhere in this part. These sections are based upon § 1005.3 and § 1005.4 of the OIG regulations, but do not address attorneys' fees under 42 U.S.C. 406 or any limitation on the ALJ's authority to review the Secretary's exercise of discretion to impose a penalty. We anticipate addressing such issues in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule. We have clarified in § 160.530 that a summary judgment decision constitutes a hearing on the record.

Ex-parte Contacts

The provisions of § 160.532 are designed to ensure the fairness of the hearing by prohibiting ex-parte contacts with the ALJ on matters in issue. Routine questions about administrative procedures or the status of the case are permitted. These requirements are generally applicable to administrative hearings under 5 U.S.C. 554(d)(1) and are the same as those in § 1005.5 of the OIG regulations.

Prehearing Conferences

The provisions of § 160.534 closely track the provisions of the analogous OIG regulation at § 1005.6. The ALJ is required to schedule at least one prehearing conference, in order to narrow the issues to be addressed at the hearing and thus expedite the formal hearing process. Matters that may be discussed at a prehearing conference are identified and include the protection of the privacy of individually identifiable health information submitted into evidence, if appropriate.

Settlement

The Secretary has exclusive authority to settle any issue or case at any time and need not obtain the consent of the ALJ. This provision in § 160.536 tracks § 1003.126 of the OIG regulations.

Discovery

Consistent with the approach of § 1005.7 of the OIG regulations, § 160.538 provides for limited discovery in the form of the production for inspection and copying of documents that are relevant and material to the issues before the ALJ. Like the OIG, we are specifically not authorizing other forms of discovery, such as depositions and interrogatories. Prehearing discovery is not provided for under the APA and is rarely available in administrative hearings. Full-scale discovery is inappropriate in administrative hearings, as it would unduly delay the streamlined administrative process. These regulations do, however, provide for exchange of relevant and material documents, as well as the exchange of witness lists, prior witness statements, and exhibits before the hearing, as provided in § 160.540 of the rule.

Exchange of Witness Lists, Statements, and Exhibits

Section 160.540 provides for the prehearing exchange of certain documents, including witness lists, copies of prior statements of witnesses, and copies of hearing exhibits.

Paragraph (a) of this section differs slightly from the corresponding paragraph in § 1005.8 of the OIG regulations, in that it provides for the exchange of witness lists, witness statements and exhibits at least 15 days before the hearing, but also allows the ALJ to order an earlier exchange if he or she deems it necessary.

Paragraph (b) provides that the ALJ must exclude witnesses and documents offered by a party that did not provide those materials before the hearing, except where there is good cause for the failure, or where there is not substantial prejudice to the objecting party. As with the OIG regulations, this provision is mandatory and serves to prevent the parties from litigating by surprise and to promote the procedural regularity of the hearing. Paragraph (b)(3) provides that where the witnesses or exhibits are not excluded, the ALJ must recess the hearing for a reasonable time to allow the objecting party the opportunity to prepare and respond to them, unless the objecting party agrees to proceed. This paragraph differs from § 1005.8(b)(3) of the OIG regulations, under which the decision to postpone the hearing is within the ALJ's discretion. This modification is equally beneficial to both parties to a hearing and will reduce the potential for unfair surprise during a hearing. It is preferable to the OIG provision that grants the ALJ discretion, because it provides clear notice to the parties and clear direction to the ALJ in the event witnesses or exhibits are not excluded.

Finally, any documents exchanged before the hearing would be deemed authentic for purposes of admissibility at the hearing unless a party objected to a particular document before the hearing.

Subpoenas for Attendance at the Hearing

Section 160.542 outlines procedures for the ALJ to issue, and for parties and prospective witnesses to contest, subpoenas to appear at the hearing. Subpoenas are authorized by 42 U.S.C. 1320a-7a(j) and may be issued by an ALJ pursuant to 5 U.S.C. 556(c). Either party may request that the ALJ issue a subpoena, if the appearance of a witness and the testimony are reasonably necessary for the party's case. The subpoena procedures here are the same as those at § 1005.9 of the OIG regulations.

Fees

Section 160.544 provides for the payment of witness fees by the party requesting a subpoena. This section tracks § 1005.10 of the OIG regulations.

Form, Filing, and Service of Papers; Computation of Time

Section 160.546 sets forth requirements for documents filed with the ALJ. Section 160.548 outlines the method for computing time periods under this part. These provisions track, respectively, § 1005.11 and § 1005.12 of the OIG regulations.

Motions

The provisions of § 160.550 set forth requirements for the content of motions and the time allowed for responses. This section tracks § 1005.13 of the OIG regulations.

Sanctions

Section 160.552 outlines the sanctions an ALJ may impose on parties and their representatives for failing to comply with an order or procedure, failing to defend an action, or other misconduct. These sanctions are specifically provided for by the statutory provision at 42 U.S.C. 1320a-7a(c)(4). This section tracks § 1005.14 of the OIG regulations.

The Hearing

Section 160.554 provides for a public hearing on the record. It allows for the admission of rebuttal evidence not exchanged before the hearing.

This section is based upon § 1005.15 of the OIG regulations, which also addresses the burden of proof at the hearing, and provides that the hearing is not limited to the items and information set forth in the notice of proposed determination. We anticipate addressing those issues in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule.

Witnesses

Under § 160.556, the ALJ may allow testimony to be admitted in the form of a written statement or deposition so long as the opposing party has a sufficient opportunity to subpoena the person whose statement is being offered. This section also allows an HHS investigator or other expert to be a witness, in addition to assisting counsel for the Secretary at counsel table during the hearing. These provisions closely track § 1005.16 of the OIG regulations.

Evidence

With certain limited exceptions, the Federal Rules of Evidence are not binding on the ALJ. However, the ALJ may apply the Federal Rules of Evidence to exclude unreliable evidence. Section 160.558 is substantially similar to § 1005.17 of the OIG regulations, but does not contain a paragraph corresponding to § 1005.17(j) regarding evidence as to the respondent's willingness and/or ability to enter into a corrective action plan. We anticipate addressing this issue in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule.

The Record

Section 160.560 provides for recording and transcription of the hearing, and for the record to be available for inspection and copying by any person. For good cause, the ALJ may order appropriate redactions made to the record. These provisions track § 1005.18 of the OIG regulations.

Post-Hearing Briefs

Section 160.562 provides that the ALJ has discretion to order post-hearing briefs, although the parties may file post-hearing briefs in any event if they desire. This section tracks § 1005.19 of the OIG regulations.

ALJ Decision

Section 160.564 provides that not later than 60 days after the filing of post-hearing briefs, the ALJ shall serve on the parties a decision making specific findings of fact and conclusions of law. The ALJ's decision is the final decision of the Secretary.

Section 1005.20 of the OIG regulations, upon which this section is based, provides for the ALJ to issue an “initial decision,” which is then reviewable by the Departmental Appeals Board if properly appealed. We have not provided for a second level of administrative review in this rule, and thus this section refers to the “ALJ decision” rather than to an “initial decision.” Neither section 1320a-7a nor the APA requires a second level of administrative review, although this is generally available in Department hearings. We anticipate addressing the issue of further administrative review in the notice-and-comment rulemaking that we plan for the remainder of the Enforcement Rule.

Judicial Review; Stay of ALJ Decision

Section 160.568 provides for judicial review of penalties imposed under this part, as authorized by 42 U.S.C. 1320a-7a(e). Section 160.570 provides that a respondent may request a stay of the effective date of a penalty pending judicial review. This section tracks § 1005.22(b) of the OIG regulations.

IV. Impact Statement and Other Required Analyses

Paperwork Reduction Act

We reviewed this interim final rule to determine whether it invokes issues that would subject it to the Paperwork Reduction Act (PRA). While the PRA applies to agencies and collections of information conducted or sponsored by those agencies, 5 CFR 1320.4(a) exempts collections of information that occur “during the conduct of . . . an administrative action, investigation, or audit involving an agency against specific individuals or entities,” except for investigations or audits “undertaken with reference to a category of individual or entities such as a class of licensees or an entire industry.” The rules adopted below come squarely within this exemption, as they deal entirely with administrative investigations and actions against specific individuals or entities. Therefore, we have determined that the PRA does not apply to this rule.

Executive Order 12866; Unfunded Mandates Reform Act of 1995; Regulatory Flexibility Act; Small Business Regulatory Enforcement Fairness Act of 1996; Executive Order 13132

We have examined the impacts of this rule as required by E.O. 12866 (September 1993, Regulatory Planning and Review), the Regulatory Flexibility Act (RFA) (September 16, 1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), and E.O. 13132.

E.O. 12866 (as amended by E.O. 13258, which merely reassigns responsibility of duties) directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). HHS has concluded that this rule should be treated as a “significant regulatory action” within the meaning of section 3(f)(4) of E.O. 12866 because the HIPAA provisions to be enforced have extremely broad implications for the nation's health care system, and because of the novel issues presented by, and the uncertainties surrounding, compliance among covered entities. However, E.O. 12866 requires a full economic impact analysis only for “economically significant” rules, which are defined in section 3(f)(1) of the order as rules that may “have an annual effect on the economy of $100 million or more, or adversely affect in a material way the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities.” Because this rule is procedural in nature, it has no intrinsic significant economic impact; therefore, no economic impact analysis has been prepared.

The RFA requires agencies to analyze options for regulatory relief of small businesses. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and government agencies. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of $6 million in any 1 year. This interim final rule is purely procedural in nature and, as such, HHS has determined that this regulation will not have a significant economic impact on a substantial number of small entities. The regulation simply implements procedures necessitated by enactment of HIPAA, in order to allow the Secretary to enforce subtitle F of Title II of HIPAA.

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 603 (proposed documents)/604 (final documents) of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area and has fewer than 100 beds. This rule will not have a significant impact on small rural hospitals. The rule implements procedures necessary for the Secretary to enforce subtitle F of Title II of HIPAA.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule that may result in expenditure in any 1 year by State, local, or tribal governments, in the aggregate, or by the private sector, of $100 million. Because this rule is procedural in nature, it will not impose a burden large enough to require a section 202 statement under the Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1531 et seq.).

E.O. 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. This interim final rule does not have “Federalism implications.” The rule does not have “substantial direct effects on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government” and therefore is not subject to E.O. 13132 (Federalism).

The Small Business Regulatory Enforcement Fairness Act of 1996 (5 U.S.C. 801 et seq.) requires that rules that will have an impact on the economy of $100 million or more per annum be submitted for Congressional review. Because this rule is procedural in nature, it will not impose a burden large enough to require Congressional review under the statute.

List of Subjects in 45 CFR Part 160

• Administrative practice and procedure
• Computer technology
• Healthcare
• Health facilities
• Health insurance
• Health records
• Hospitals
• Investigations
• Medicaid
• Medicare
• Penalties
• Reporting and recordkeeping requirements

For the reasons set forth in the preamble, the Department of Health and Human Services amends 45 CFR subtitle A, subchapter C, part 160 as set forth below.

PART 160—GENERAL ADMINISTRATIVE REQUIREMENTS

1. The authority citation for part 160 is revised to read as follows:

Authority: 42 U.S.C. 1302(a), 42 U.S.C. 1320d—1320d-8, and sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note)).

2. Add a new subpart E to part 160 to read as follows:

Subpart E—Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings

Subpart E—Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings