[Federal Register Volume 71, Number 32 (Thursday, February 16, 2006)]
[Rules and Regulations]
[Pages 8390-8433]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 06-1376]
[[Page 8389]]
-----------------------------------------------------------------------
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
Office of the Secretary
-----------------------------------------------------------------------
45 CFR Parts 160 and 164
HIPAA Administrative Simplification: Enforcement; Final Rule
Federal Register / Vol. 71, No. 32 / Thursday, February 16, 2006 /
Rules and Regulations
[[Page 8390]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office of the Secretary
45 CFR Parts 160 and 164
RIN 0991-AB29
HIPAA Administrative Simplification: Enforcement
AGENCY: Office of the Secretary, HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The Secretary of Health and Human Services is adopting rules
for the imposition of civil money penalties on entities that violate
rules adopted by the Secretary to implement the Administrative
Simplification provisions of the Health Insurance Portability and
Accountability Act of 1996, Public Law 104-191 (HIPAA). The final rule
amends the existing rules relating to the investigation of
noncompliance to make them apply to all of the HIPAA Administrative
Simplification rules, rather than exclusively to the privacy standards.
It also amends the existing rules relating to the process for
imposition of civil money penalties. Among other matters, the final
rule clarifies and elaborates upon the investigation process, bases for
liability, determination of the penalty amount, grounds for waiver,
conduct of the hearing, and the appeal process.
DATES: This final rule is effective on March 16, 2006.
FOR FURTHER INFORMATION CONTACT: Carol C. Conrad, (202) 690-1840.
SUPPLEMENTARY INFORMATION: On April 18, 2005, the Department of Health
and Human Services (HHS) published a Notice of Proposed Rulemaking
(proposed rule) proposing to revise the existing rules relating to
compliance with, and enforcement of, the Administrative Simplification
regulations (HIPAA rules) adopted by the Secretary of Health and Human
Services (Secretary) under subtitle F of Title II of HIPAA (HIPAA
provisions). 70 FR 20224. The proposed rule also proposed the adoption
of new provisions relating to the imposition of civil money penalties
on covered entities that violate a HIPAA provision or HIPAA rule. The
comment period on the proposed rule closed on June 17, 2005. Forty-nine
comments, principally from health care organizations, were received
during the comment period.
In this final rule, HHS revises existing rules that relate to
compliance with, and enforcement of, the HIPAA rules. These rules are
codified at 45 CFR part 160, subparts C and E. In addition, this final
rule adds a new subpart D to part 160. The new subpart D contains
additional rules relating to the imposition by the Secretary of civil
money penalties on covered entities that violate the HIPAA rules. The
full set of rules to be codified at subparts C, D, and E of 45 CFR part
160 is collectively referred to in this final rule as the ``Enforcement
Rule.'' Finally, HHS makes minor and conforming changes to subpart A of
part 160 and subpart E of part 164.
The statutory and regulatory background of the final rule is set
out below. A description of the provisions of the proposed rule, the
public comments, and HHS's responses to the comments follows. The
preamble concludes with HHS's analyses of impact and other issues under
applicable law.
I. Background
A. Statutory Background
Subtitle F of Title II of HIPAA, entitled ``Administrative
Simplification,'' requires the Secretary to adopt national standards
for certain information-related activities of the health care industry.
Under section 1173 of the Social Security Act (Act), 42 U.S.C. 1320d-2,
the Secretary is required to adopt national standards for certain
financial and administrative transactions, code sets, the security of
health information, and certain unique health identifiers. In addition,
section 264 of HIPAA, 42 U.S.C. 1320d-2 note, requires the Secretary to
promulgate standards to protect the privacy of certain health
information. Under section 1172(a) of the Act, 42 U.S.C. 1320d-1(a),
the provisions of Subtitle F apply only to--
The following persons:
(1) A health plan.
(2) A health care clearinghouse.
(3) A health care provider who transmits any health information
in electronic form in connection with a transaction referred to in
section 1173(a)(1).
These entities are collectively known as ``covered entities.'' \1\
---------------------------------------------------------------------------
\1\ An additional category of covered entities was added by the
Medicare Prescription Drug, Improvement, and Modernization Act of
2003 (Pub. L. 108-173) (MMA). As added by MMA, section 1860D-
31(h)(6)(A) of the Act, 42 U.S.C. 1395w-141(h)(6)(A), provides that
a prescription drug card sponsor is a covered entity for purposes of
applying part C of title XI and all regulatory provisions
promulgated thereunder, including regulations (relating to privacy)
adopted pursuant to the authority of the Secretary under section
264(c) of the Health Insurance Portability and Accountability Act of
1996 (42 U.S.C. 1320d-2 note).
---------------------------------------------------------------------------
HIPAA requires certain consultations with industry as a predicate
to the issuance of the HIPAA standards and provides that most covered
entities have up to 2 years (small health plans have up to 3 years) to
come into compliance with the standards, once adopted. Act, sections
1172(c) (42 U.S.C. 1320d-1(c)), 1175(b) (42 U.S.C. 1320d-4(b)). The
statute establishes civil money penalties and criminal penalties for
violations. Act, sections 1176 (42 U.S.C. 1320d-5), 1177 (42 U.S.C.
1320d-6). HHS enforces the civil money penalties, while the U.S.
Department of Justice enforces the criminal penalties.
HIPAA's civil money penalty provision, section 1176(a) of the Act,
42 U.S.C. 1320d-5(a), authorizes the Secretary to impose a civil money
penalty, as follows:
(1) IN GENERAL. Except as provided in subsection (b), the
Secretary shall impose on any person who violates a provision of
this part [42 U.S.C. 1320d, et seq.] a penalty of not more than $100
for each such violation, except that the total amount imposed on the
person for all violations of an identical requirement or prohibition
during a calendar year may not exceed $25,000.
(2) PROCEDURES. The provisions of section 1128A [42 U.S.C.
1320a-7a] (other than subsections (a) and (b) and the second
sentence of subsection (f)) shall apply to the imposition of a civil
money penalty under this subsection in the same manner as such
provisions apply to the imposition of a penalty under such section
1128A.
For simplicity, we refer throughout this preamble to this provision,
the related provisions at section 1128A of the Act, and other related
provisions of the Act, by their Social Security Act citations, rather
than by their U.S. Code citations.
Subsection (b) of section 1176 sets out limitations on the
Secretary's authority to impose civil money penalties and also provides
authority for waiving such penalties. Under section 1176(b)(1), a civil
money penalty may not be imposed with respect to an act that
``constitutes an offense punishable'' under the related criminal
penalty provision, section 1177 of the Act. Under section 1176(b)(2), a
civil money penalty may not be imposed ``if it is established to the
satisfaction of the Secretary that the person liable for the penalty
did not know, and by exercising reasonable diligence would not have
known, that such person violated the provision.'' Under section
1176(b)(3), a civil money penalty may not be imposed if the failure to
comply was due ``to reasonable cause and not to willful neglect'' and
is corrected within a certain time. Finally, under section 1176(b)(4),
a civil money penalty may be reduced or entirely waived ``to the extent
that the payment of such penalty would be excessive relative to the
compliance failure involved.''
As noted above, section 1176(a) incorporates by reference certain
[[Page 8391]]
provisions of section 1128A of the Act. Those provisions, as relevant
here, establish a number of requirements with respect to the imposition
of civil money penalties. Under section 1128A(c)(1), the Secretary may
not initiate a civil money penalty action ``later than six years after
the date'' of the occurrence that forms the basis for the civil money
penalty. Under section 1128A(c)(2), a person upon whom the Secretary
seeks to impose a civil money penalty must be given written notice and
an opportunity for a determination to be made ``on the record after a
hearing at which the person is entitled to be represented by counsel,
to present witnesses, and to cross-examine witnesses against the
person.'' Section 1128A also provides, at subsections (c), (e), and
(j), respectively, requirements for: Service of the notice and
authority for sanctions which the hearing officer may impose for
misconduct in connection with the civil money penalty proceeding;
judicial review of the Secretary's determination in the United States
Court of Appeals for the circuit in which the person resides or
maintains his/its principal place of business; and the issuance and
enforcement of subpoenas by the Secretary. In addition, section 1128A
of the Act contains provisions relating to liability for civil money
penalties and what measures must be taken once they are imposed. For
example, section 1128A(d) provides that the Secretary must take into
account certain factors ``in determining the amount * * * of any
penalty''; section 1128A(h) requires certain notifications once a civil
money penalty is imposed; and section 1128A(l) makes a principal liable
for penalties ``for the actions of the principal's agent acting within
the scope of the agency.'' These provisions are discussed more fully
below.
B. Regulatory Background
As noted above, section 1173 of the Act and section 264 of HIPAA
require the Secretary to adopt a number of national standards to
facilitate the exchange, and protect the privacy and security, of
certain health information. The Secretary has already adopted many of
these HIPAA standards by regulation. These regulations consist of the
following: Health Insurance Reform: Standards for Electronic
Transactions (Transactions Rule); Standards for Privacy of Individually
Identifiable Health Information (Privacy Rule); Health Insurance
Reform: Standard Unique Employer Identifier (EIN Rule); Health
Insurance Reform: Security Standards (Security Rule); and HIPAA
Administrative Simplification: Standard Unique Health Identifier for
Health Care Providers (NPI Rule). Proposed standards for certain claims
attachments were published on September 23, 2005 (70 FR 55990) and
proposed standards for health plan identifiers are under development.
The history of these and related rules is described in a proposed rule
published on April 18, 2005 at 70 FR 20225-20226.
An interim final rule promulgating procedural requirements for
imposition of civil money penalties, Civil Money Penalties: Procedures
for Investigations, Imposition of Penalties, and Hearings (April 17,
2003 interim final rule), was published on April 17, 2003 (68 FR
18895), and was effective on May 19, 2003, with a sunset date of
September 16, 2004 (as corrected at 68 FR 22453, April 28, 2003). The
April 17, 2003 interim final rule adopted a new subpart E of part 160.
The sunset date of the April 17, 2003 interim final rule was extended
to September 16, 2005 on September 15, 2004 (69 FR 55515) and was
further extended to March 16, 2006 on September 14, 2005 (70 FR 54293).
The authority for administering and enforcing compliance with the
Privacy Rule has been delegated to the HHS Office for Civil Rights
(OCR). 65 FR 82381 (December 28, 2000). The authority for administering
and enforcing compliance with the non-privacy HIPAA rules has been
delegated to the HHS Centers for Medicare & Medicaid Services (CMS). 68
FR 60694 (October 23, 2003).
II. Overview of the Proposed and Final Rules
A. The Proposed Rule
In the proposed rule, we proposed to bring together and adopt rules
governing the implementation of the civil money penalty authority of
section 1176 of the Act for all of the HIPAA rules. As previously
noted, parts of the Enforcement Rule are already in place: subpart C of
part 160 establishes certain investigative procedures for the Privacy
Rule, and subpart E establishes interim procedures for investigations
and for the imposition, and challenges to the imposition, of civil
money penalties for all of the HIPAA rules. The proposed rule would
complete the Enforcement Rule by (1) making subpart C applicable to all
of the HIPAA rules; (2) adopting on a permanent basis most of the
provisions of subpart E; and (3) addressing, among other issues, our
policies for determining violations and calculating civil money
penalties, how we will address the statutory limitations on the
imposition of civil money penalties, and various procedural issues,
such as provisions for appellate review within HHS of a hearing
decision, burden of proof, and notification of other agencies of the
imposition of a civil money penalty.
Several fundamental considerations shaped the proposed rule. First,
there is one statutory provision for imposing civil money penalties on
covered entities that violate the HIPAA rules; thus, the proposed rule
sought to establish a uniform enforcement and compliance policy for all
of the HIPAA rules to minimize the potential for confusion and burden
and maximize the potential for fairness and consistency in enforcement.
Second, the proposed rule sought to facilitate the movement from
noncompliance to compliance by covered entities by extending to all of
the HIPAA rules the regulatory commitment to promoting and encouraging
voluntary compliance with the HIPAA rules that currently applies to the
Privacy Rule, subpart C of part 160. Third, the proposed rule sought to
minimize confusion with the procedures for investigations and hearings
by building upon pre-existing Departmental procedures for
investigations and hearings under section 1128A of the Act--the civil
money penalty regulations of the Office of the Inspector General, which
are codified at 42 CFR parts 1003, 1005, and 1006 (OIG regulations).
Fourth, the proposed rule was intended to be clear and easy to
understand. Finally, the proposed rule sought to provide the Secretary
with reasonable discretion, particularly in areas where the exercise of
judgment is called for by the statute or rules, and to avoid being
overly prescriptive in areas where it would be helpful to gain
experience with the practical impact of the HIPAA rules, to avoid
unintended adverse effects.
We proposed to amend subpart A of part 160, which contains general
provisions, to include a definition of ``person.'' With respect to
subpart C of part 160, we proposed to incorporate several provisions
currently found in subpart E and to make subpart C applicable to the
non-privacy HIPAA rules. We also proposed to add to part 160 a new
subpart D, which would establish rules relating to the imposition of
civil money penalties, including those which apply whether or not there
is a hearing. We also proposed to incorporate into subpart D several
provisions currently found in subpart E. Proposed subpart E addressed
the pre-hearing and hearing phases of the enforcement process. Many of
the provisions of proposed subpart E were adopted by the April 17, 2003
interim final rule; we did not propose to change them substantively,
although we
[[Page 8392]]
proposed to renumber them. Finally, a conforming change to the privacy
standards in subpart E of part 164 was proposed.
B. The Final Rule
While the final rule adopts most of the provisions of the proposed
rule without change, several significant changes to certain provisions
of the proposed rule have been made in response to comments. We do not
list variables in the final rule, as was proposed, to count the number
of violations of an identical requirement or prohibition; rather, the
final rule clarifies that the method for determining the number of such
violations is grounded in the substantive requirement or prohibition
violated. In addition, the ALJ will be able to review the number of
violations determined as part of his or her review of the proposed
civil money penalty. The provision for joint and several liability of
the members of an affiliated covered entity is retained, unless it is
established that another member of the affiliated covered entity was
responsible for the violation. While we continue to treat section
1176(b)(1) as an affirmative defense, we provide that it may be raised
at any time. We retain the provision for statistical sampling, but we
provide that, where statistical sampling is used, HHS must provide a
copy of the study on which its statistical findings are based with the
notice of proposed determination. As a corollary, we provide that a
respondent who intends to introduce evidence of its statistical expert
at the hearing must provide the study prepared by its expert to HHS at
least 30 days prior to the scheduled hearing. We also provide that a
respondent will have 90, rather than 60, days in which to file its
request for hearing. Other changes made by the final rule are described
below.
The Enforcement Rule does not adopt standards, as that term is
defined and interpreted under Subtitle F of Title II of HIPAA. Thus,
the requirement for industry consultations in section 1172(c) of the
Act does not apply. For the same reason, the statute's time frames for
compliance, set forth in section 1175 of the Act, do not apply to the
Enforcement Rule. Accordingly, the Enforcement Rule is effective on
March 16, 2006.
III. Section-by-Section Description of the Final Rule and Response to
Comments
We received 49 comments on the proposed rule. Many of these
comments were from associations or interest groups involved in the
health care industry. We also received comments from covered entities,
a state agency, a law school class, and a number of individuals.
While the comments addressed most of the provisions of the proposed
rule, the following 14 sections of the proposed rule received no
comment: proposed Sec. Sec. 160.400, 160.418, 160.500, 160.502,
160.506, 160.510, 160.514, 160.524, 160.526, 160.528, 160.530, 160.532,
160.544, and 160.550. We have, accordingly, not changed these sections
in the final rule from what was proposed, and we do not discuss them
below. The basis and purpose of sections that are unchanged from the
proposed rule and are not discussed below are set out in the proposed
rule published on April 18, 2005 at 70 FR 20240-20247 and, in certain
cases, in the interim final rule published on April 17, 2003 at 68 FR
18895-18901.
A number of comments also expressed support for particular
provisions. In most cases, we do not discuss these comments, with which
we generally agree, below. Finally, certain comments raised issues
concerning other HIPAA rules, such as allegations that a particular
entity had violated the Privacy Rule or that particular provisions of a
HIPAA rule create a hardship. Such issues are outside the scope of this
rulemaking and, accordingly, are not addressed here.
A. Subpart A
Subpart A of the final rule adopts a new definition of the term
``person.'' This definition is placed in Sec. 160.103, which contains
definitions that apply to all of the HIPAA rules. Thus, the new
definition of ``person'' applies to all of the HIPAA rules.
Proposed rule: We proposed to amend Sec. 160.103 to add a
definition of the term ``person'' to replace the definition of that
term adopted by the April 17, 2003 interim final rule. We proposed to
define the term ``person'' as ``a natural person, trust or estate,
partnership, corporation, professional association or corporation, or
other entity, public or private.'' As more fully explained at 70 FR
20227-20228, the proposed definition clarified, consistent with the
HIPAA provisions, that the term includes States and other public
entities.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: We received one comment on this section, endorsing its
application to all of the HIPAA rules.
Response: The definition of ``person'' in the final rule remains
the same as proposed.
B. Subpart C--Compliance and Investigations
We amend subpart C to make the compliance and investigation
provisions of the subpart--which at present apply only to the Privacy
Rule--apply to all of the HIPAA rules. In addition, we include in
subpart C the definitions that apply to subparts C, D, and E. We move
to subpart C from subpart E the provisions relating to investigational
subpoenas and inquiries. We also add to subpart C provisions
prohibiting intimidation or retaliation that are currently found in the
Privacy Rule but not in the other HIPAA rules. We change the title of
this subpart to reflect the focus of this subpart within the larger
Enforcement Rule. Aside from a change to Sec. 160.306 and certain
minor and conforming changes to Sec. Sec. 160.300, 160.312, 160.314,
and 160.316, we do not change the substance of the existing provisions
of subpart C.
1. Section 160.300--Applicability
Proposed rule: We proposed to amend Sec. 160.300 (along with Sec.
160.304--Principles for achieving compliance; Sec. 160.306--Complaints
to the Secretary; Sec. 160.308--Compliance reviews; and Sec.
160.310--Responsibilities of covered entities) to make the provisions
of subpart C applicable to all of the HIPAA rules, instead of
applicable only to the Privacy Rule. The proposed rule would accomplish
this by changing the present references in these sections from
``subpart E of part 164'' to the more inclusive, defined term,
``administrative simplification provision'' or ``administrative
simplification provisions,'' as appropriate. As explained at 70 FR
20228, the purpose of this proposed change was to simplify and make
uniform the compliance and enforcement process for the HIPAA rules.
Final rule: The final rule streamlines the provisions of the
proposed rule by substituting the term ``provisions'' for the
references to standards, requirements, and implementation
specifications in Sec. 160.300.
Comment: A number of comments endorsed the approach of having
uniform compliance and enforcement provisions for the HIPAA rules, and
no comments disagreed with this approach.
Response: The final rule retains the policy of the proposed rule,
consistent with the expression of support for this approach in the
public comment, but streamlines the language of the section.
Comment: A couple of comments asked whether ``affiliated entities''
were the same as ``hybrid entities,'' in terms of applying the rule.
[[Page 8393]]
Response: As described at Sec. 164.105(b)(2)(i)(A), an affiliated
covered entity consists of ``[l]egally separate covered entities [that]
designate themselves (including any health care component of such
covered entity) as a single affiliated covered entity * * * [where] all
of the covered entities designated are under common ownership or
control.'' Thus, an affiliated covered entity is comprised of more than
one covered entity. By contrast, a hybrid entity is defined at Sec.
164.103 as ``a single legal entity: (1) That is a covered entity; (2)
Whose business activities include both covered and non-covered
functions; and (3) That designates health care components in accordance
with [the regulation].'' The Privacy and Security Rules apply to any
covered entity in either arrangement. The issue of liability for a
particular violation with respect to covered entities in an affiliated
covered entity is discussed in connection with Sec. 160.402(b) below.
2. Section 160.302--Definitions
Proposed rule: We proposed to move to Sec. 160.302 three
definitions that were adopted in the April 17, 2003 interim final rule
at Sec. 160.502: ``ALJ'' (Administrative Law Judge), ``civil money
penalty or penalty'', and ``respondent.'' We also proposed to add to
Sec. 160.302 two terms which are used throughout subparts C, D, and E:
``administrative simplification provision'' and ``violation'' or ``to
violate.'' We proposed to define the term ``administrative
simplification provision'' in Sec. 160.302 to mean any requirement or
prohibition established by the HIPAA provisions or HIPAA rules: ``* * *
any requirement or prohibition established by: (1) 42 U.S.C. 1320d-
1320d-4, 1320d-7, and 1320d-8; (2) Section 264 of Public Law 104-191;
or (3) This subchapter.'' We proposed to define a ``violation'' (or
``to violate'') to mean a ``failure to comply with an administrative
simplification provision.'' As more fully explained at 70 FR 20228-
20229, both definitions derive directly from the statutory language,
and both definitions function consistently and fairly across the
various HIPAA rules.
Final rule: The final rule adopts the provisions of the proposed
rule.
a. ``Administrative Simplification Provision''
Comment: One comment expressed general support for the definitions.
Another comment stated that the definition of ``administrative
simplification provision'' should be revised to include only standards.
The comment argued that this approach would be more consistent with the
statute, which provides that covered entities must comply with
standards, not requirements, prohibitions, or other restrictions set
forth in the HIPAA rules.
Response: No change is made to the definition of ``administrative
simplification provision.'' With respect to the second comment above,
we do not agree that the definition of this term should be limited to
standards. As discussed at 70 FR 20229, limiting the elements of the
HIPAA rules that could be violated to those designated as standards
would have the effect of, among other things, insulating from
enforcement explicit statutory requirements and prohibitions (e.g., the
prohibitions at section 1175(a) of the Act, which the statute terms
``requirements'' and which the Transactions Rule treats as requirements
but not standards). We do not agree that Congress intended such an
effect. We note, moreover, that the statute explicitly provides for the
adoption of implementation specifications. See section 1172(d) of the
Act. Furthermore, we disagree with the contention that the statute does
not contemplate that violations may be tied to requirements and
prohibitions: section 1176(a)(1) speaks of ``violations of an identical
requirement or prohibition.''
Comment: Several comments argued that this definition could lead to
multiple violations from a single act and lead to more liability than
covered entities could reasonably expect. It also was argued that this
definition would render almost meaningless the statutory $25,000 cap on
liability for violations of an identical provision in a calendar year.
Response: No examples were supplied to illustrate the concern as to
how this definition would increase the anticipated liability of covered
entities, so we can only respond generally. The prohibition in Sec.
160.404(b)(2) on counting overlapping requirements twice should
minimize any such effect. As for violations that might be implicated in
a single act and not be insulated by Sec. 160.404(b)(2), we see no
reason why they should not be considered as separate violations, since
covered entities must comply with all applicable requirements and
prohibitions of the HIPAA provisions and rules. Also, the definition
does not render the statutory cap meaningless; rather, the
``requirement or prohibition'' language of the definition is taken
directly from the part of section 1176(a) that establishes the $25,000
statutory cap (``the total amount imposed on the person for all
violations of an identical requirement or prohibition for a calendar
year may not exceed $25,000''). Furthermore, for the reasons explained
in the preamble to the proposed rule, none of the other possible
formulations of what constitutes a ``provision of this part'' works
uniformly and fairly across the HIPAA rules. Thus, we retain the
definition of ``administrative simplification provision'' as proposed.
b. ``Violation'' or ``Violate''
Comment: One comment asked how the definition of ``violation''
would work with the addressable components of the Security Rule.
Response: With respect to the issue of how this term would apply to
the addressable implementation specifications of the Security Rule, we
provide the following guidance. Under Sec. 164.306(d)(3)(ii), a
covered entity must implement an addressable implementation
specification if doing so is ``reasonable and appropriate.'' Where that
condition is met, the addressable implementation specification is a
requirement, and failure to implement the addressable implementation
specification would, accordingly, constitute a violation. Where that
condition is not met, the covered entity must document why it would not
be reasonable and appropriate to implement the implementation
specification and implement ``an equivalent alternative measure if
reasonable and appropriate.'' In this latter situation, creating the
documentation referred to is a requirement, and implementing an
alternative measure is also a requirement, if doing so is reasonable
and appropriate in the covered entity's circumstances; failure to take
either required action would, accordingly, constitute a violation.
3. Section 160.304--Principles for Achieving Compliance
Proposed rule: We proposed to amend Sec. 160.304 to make it
applicable to all of the HIPAA rules; otherwise, we proposed to leave
the rule substantively unchanged. Section 160.304 provides that the
Secretary will, to the extent practicable, seek the cooperation of
covered entities in obtaining compliance. Section 160.304 also provides
that the Secretary may provide technical assistance to help covered
entities voluntarily comply with the HIPAA rules.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: Many comments supported HHS's approach to voluntary
compliance and the use of a complaint-based process to identify and
correct
[[Page 8394]]
noncompliance, on the grounds that it is the most efficient and
effective way of obtaining compliance and realizing the benefits of the
HIPAA rules. In addition, some contended that, given the confusion of
many covered entities with many of the rules' requirements, it is an
appropriate approach. However, one comment criticized HHS's reliance on
voluntary compliance and informal resolution of complaints on the
ground that the statute contemplates that violations of the HIPAA rules
should be pursued in the same manner as fraud and abuse cases, that is,
through the formal, adversarial process provided for by section
1128A(c). Another comment stated that HHS's reliance on voluntary
compliance has led to lax enforcement and that reliance on a complaint-
based system is a fundamentally flawed approach, particularly with
respect to enforcement of the Privacy Rule, because HHS has provided
insufficient education to consumers, and it is impossible for consumers
to complain about a law about which they know very little. Several
comments urged that OCR and CMS continue to provide educational
materials and guidance to help covered entities comply with the HIPAA
rules and to educate consumers about their rights under the Privacy
Rule.
Response: We agree that encouraging voluntary compliance is the
most effective and quickest way of obtaining compliance in most cases.
We do not agree that encouraging voluntary compliance and seeking
informal resolution of complaints in individual cases constitutes lax
enforcement or that such an approach is inconsistent with our statutory
obligations. Our experience to date with privacy complaints illustrates
the effectiveness of our enforcement approach. As of October 31, 2005,
OCR had received and initiated reviews of over 16,000 privacy
complaints from health care consumers and others across the country.
These complaints are widespread and diverse, not only geographically,
but also with respect to the type of entity complained against, as well
as the Privacy Rule issues raised by the complaints. Complaints are
filed against all sizes and types of covered entities, from solo
practitioners to hospitals and pharmacy chains, and from health
insurance issuers to group health plans, for example. In addition, the
complaints implicate a full range of Privacy Rule issues, from uses and
disclosures of protected health information to individual rights to
administrative requirements. The variation and expansiveness of the
complaints provide HHS with a much broader approach to compliance than
would a compliance review system, which likely would need to be
targeted to larger institutions and/or a smaller set of concerns.
Further, our experience with these cases--68 percent have been resolved
or otherwise closed to date--indicates that generally we are receiving
good cooperation from covered entities in quickly addressing compliance
problems. Such resolutions bring the benefits of the HIPAA rules to
consumers far more quickly than would a formalized, adversarial
process, which would also be time-consuming and costly for both sides.
We also do not agree that the statute contemplates only a
formalized, adversarial process; rather, it only requires such a
process where a proposed civil money penalty is contested. It is
important to note, moreover, that section 1176 contemplates that we
would work with covered entities to help them achieve compliance, even
when there is an allegation that the covered entity is in violation of
the rules. Section 1176 provides that a civil money penalty may not be
imposed if the failure to comply was due to reasonable cause and not
willful neglect and is corrected within a certain period of time after
the covered entity knew or should have known of the compliance failure,
and that the Secretary may, in some circumstances, provide technical
assistance to the covered entity during that period. Further, an
approach that is primarily complaint-based does not limit our ability
to perform compliance reviews when appropriate, and this has, in fact,
occurred. We will continue to review the effectiveness of our
enforcement approach and revise it, if needed. Notwithstanding our
above approach, however, we will resort to civil money penalties, as
needed, for matters that cannot be resolved by informal means.
Further, we disagree that persons affected by the Privacy Rule and
the other HIPAA rules are unaware of their rights, as evidenced by the
large number of complaints that HHS has received from consumers and
covered and other entities. HHS has an ongoing program of providing
information to the public and guidance to covered entities through the
Internet, public speaking and educational events, and toll-free call-in
lines. The millions of hits to our Web sites--http://www.hhs.gov/ocr/hipaa for the Privacy Rule and http://www.cms.gov/hipaa/hipaa2 for the
other HIPAA rules--suggest that covered entities and the public are
increasingly aware of the application of the HIPAA rules to their
business activities and lives, respectively, and are able to access the
information we have made available. In addition, the American Health
Information Management Association issued the results of their latest
compliance survey in a report entitled ``The State of HIPAA Privacy and
Security Compliance, April 2005,'' which indicated, with respect to the
Privacy Rule, that over two-thirds of all hospital and health system
patients had some or a complete understanding of their rights and the
facility's responsibilities. Nonetheless, while such evidence is
encouraging, we recognize that HHS must remain active in providing
outreach and public education. We are committed to doing so, and thus,
continue to develop educational material for consumers and industry
guidance for covered entities.
Comment: One comment suggested that the Secretary commit to
providing technical assistance to covered entities.
Response: We do not agree that the provision of technical
assistance should be mandated. The statute (at section
1176(b)(3)(B)(ii)) makes the provision of technical assistance
discretionary if the Secretary determines that the compliance failure
was due to the covered entity's inability to comply. While OCR and CMS
provide technical assistance in many cases, it is not necessary in all
instances to provide such assistance in order to obtain compliance.
Thus, it is inappropriate to mandate the provision of technical
assistance.
Comment: One comment suggested amending Sec. 160.304(b) to require
ongoing reporting of complaints and resolutions to the healthcare
industry. The goal in requiring reporting would be to educate covered
entities regarding complaints that are found to be actual violations
and encourage them to review their compliance. The comment stated that
the current reports made by OCR to the National Committee on Vital and
Health Statistics are not helpful since they only report the volume of
complaints, not the nature of the complaints or whether a violation
occurred.
Response: We do not believe mandatory reporting of complaints and
resolutions is necessary. Both CMS and OCR currently have the ability
to report to the public, including the healthcare industry, about
complaints and their resolutions, and do so in summary form. We
continue to present summaries of actions on complaints in various fora,
including in public presentations, testimony, and in written documents.
Our enforcement experience also informs our development of FAQs and
guidance documents to explain certain
[[Page 8395]]
provisions and how to comply with them. In any event, covered entities
should use their own internal complaint processes and experience to
assess and improve their compliance and ability to serve the needs of
their customers.
Comment: One comment suggested that the informal resolution process
should allow HHS to render opinions on a covered entity's
interpretation of the HIPAA rules. The comment expressed concern that a
covered entity would not be able to resolve a compliance issue during
the informal resolution process if it made a good faith, but incorrect,
interpretation of a HIPAA rule. The comment suggested allowing HHS to
render an opinion on the entity's interpretation to facilitate the
informal resolution of compliance problems.
Response: As a general matter, we do not issue advisory opinions,
but the informal resolution process will provide covered entities with
information about HHS's interpretation of the HIPAA rules. Covered
entities may also find guidance as to the proper interpretation of a
HIPAA rule in the FAQs posted on the HHS website and technical
assistance offered to the covered entities by HHS. Covered entities may
also submit questions to HHS for consideration with respect to future
FAQs and guidance.
4. Section 160.306--Complaints to the Secretary
Proposed rule: Section 160.306 provides for investigations of
covered entities by the Secretary. It also outlines the procedure and
requirements for filing a complaint against a covered entity. For
example, it provides that a complaint must name the person that is the
subject of the complaint and describe the acts or omissions believed to
be violations. It also requires that complaints be filed within 180
days of when the complainant knew or should have known that the act or
omission occurred, unless this time limit is waived for good cause. The
proposed rule would have amended this section to apply it to all of the
HIPAA rules, rather than exclusively to the Privacy Rule, but otherwise
proposed no substantive changes to the section.
Final rule: The final rule adopts the provisions of the proposed
rule, except that proposed Sec. 160.306(c) is revised to require the
Secretary to describe the basis of the complaint in the first written
communication with the covered entity about the complaint.
Comment: One comment asked for clarification on when a complaint
will be considered to have been timely filed in situations when a
complainant should have known of the violation, thus triggering the
180-day time period for filing a complaint.
Response: Deciding whether or not a complaint was properly filed
within the 180-day period will need to be determined in each case. For
example, an individual who is informed through an accounting of
disclosures that his or her health information was impermissibly
disclosed would be considered to know of the violation at the time the
individual receives the accounting. In any event, however, the 180-day
period can be waived for good cause shown.
Comment: Two comments suggested that HHS be required to inform a
covered entity of the specific basis for an investigation or compliance
review. These comments suggested the best way to accomplish this goal
would be to send a copy of the complaint to the covered entity. The
comments stated that, without specific information as to the basis of
the complaint, a covered entity will not be able to properly respond to
the agency's request for information.
Response: Both CMS and OCR currently provide the basis for an
investigation in the first written communication with a covered entity
about a complaint. This policy will continue to be followed, and the
final rule is revised to require it. It should be noted that provision
of a description of the basis for the complaint does not circumscribe
the investigation, if the investigation subsequently uncovers other
compliance issues with respect to the covered entity.
We disagree that sending a copy of the complaint is necessary for a
covered entity to adequately respond to the Secretary's inquiries. As
noted above, covered entities receive a description of the basis for
the complaint. Other information contained in the complaint, such as
the complainant's identity, is not always relevant to the
investigation. In some cases, in fact, it may be necessary to withhold
such information to, for example, protect the complainant's privacy. In
instances where it is necessary to provide the complainant's identity
in order for the covered entity to properly respond to the
investigation, the complainant is so informed before this information
is released to the covered entity.
Comment: One comment suggested that the rule be revised to require
that a complaint include the name of the covered entity that is the
subject of the complaint.
Response: The rule, both as proposed and as adopted below, already
requires that a complaint ``name the person that is the subject of the
complaint.'' See Sec. 160.306(b)(2).
Comment: In one comment, a covered entity complained that it had
expended a great deal of time and money defending itself against what
turned out to be a false allegation and asked that HHS put more effort
into gathering detailed information from complainants and helping
covered entities respond to complaints. Another comment criticized the
rule for providing no way of sanctioning a person bringing a negligent
or malicious complaint.
Response: We understand that it may take time and effort to
establish that an allegation is unfounded. When complaints are
received, we make every effort to determine if the complaint is
legitimate, so as not to place undue burdens on covered entities.
Further, covered entities are encouraged promptly to contact the OCR or
CMS investigators handling their complaints to discuss the allegations
once notice of an investigation is received by the covered entity.
Doing so should help a covered entity avoid the expenditure of
unnecessary time and funds on defending itself against baseless
complaints. The statute provides no basis for our penalizing a person
for bringing a negligent or malicious complaint, although remedies may
exist at common law. However, as discussed below in connection with
Sec. 160.316, lack of good faith would typically be a matter that is
looked at in the course of investigating a complaint.
Comment: One comment suggested that only individuals or personal
representatives should have standing to file a complaint. The comment
takes the position that one covered entity should not be able to bring
a complaint against another.
Response: We disagree. The purpose of the complaint process is to
bring violations to the attention of HHS, so that any noncompliance
with the HIPAA rules may be corrected. Particularly with respect to the
Transactions Rule, the persons or entities that are likely to be
disadvantaged by the noncompliance of a covered entity are other
covered entities. It would, accordingly, be inconsistent with the
purpose of the complaint process to exclude such entities from it.
Comment: Two comments suggested that HHS be required to notify
covered entities of a complaint within a specified time-frame.
Response: OCR and CMS make every effort to notify covered entities
of complaints on a timely basis. However, we do not include a specific
deadline for notifying covered entities of
[[Page 8396]]
complaints in the rule. The time needed to determine whether a
complaint states issues that should be investigated can vary greatly,
while fluctuations in the volume of complaints and other workload
demands may also make meeting a specific deadline problematic.
Comment: One comment suggested that Sec. 160.306(a)(2) should be
amended to require that ``uses or disclosures'' be described in the
complaint rather than ``acts or omissions.''
Response: The suggested change would not be appropriate. The
provisions of this rule apply to all of the HIPAA rules, not just the
Privacy Rule; the other HIPAA rules regulate actions other than uses
and disclosures of protected health information. Moreover, even under
the Privacy Rule, a violation may occur where no impermissible use or
disclosure of protected health information has occurred. Failure to
comply with a notice requirement under Sec. 164.520 is an example of a
violation that does not involve a use or disclosure of protected health
information.
Comment: One comment suggested that the Secretary should be
required to investigate all complaints and that failure to do so is
inconsistent with section 1176(a) of the Act, which compels the
Secretary to impose penalties for violations unless a statutory
limitation applies. Imposing a deadline for beginning investigations
was also suggested.
Response: The decision to investigate a complaint is based on the
facts presented. Not all complaints need to be investigated. For
example, in our experience, a substantial percentage of privacy
complaints allege facts that fall outside of OCR's jurisdiction under
HIPAA--e.g., an action prior to the compliance date of the Privacy Rule
or an action by an entity not covered by the Rule. Revising the rule to
require the Secretary to investigate all complaints would be
counterproductive and lead to an inefficient allocation of enforcement
resources. Similarly, imposing a deadline for beginning an
investigation is unrealistic: Some investigations may turn out to be
more time-consuming than anticipated, delaying the start of other
investigations. It is necessary to provide OCR and CMS with the
flexibility to deal with variations in circumstances and resource
constraints.
5. Section 160.308--Compliance Reviews
Proposed rule: The proposed rule provided that the Secretary may
conduct compliance reviews to determine whether covered entities are
complying with the applicable administrative simplification provisions.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: Several comments asked HHS to outline the circumstances
under which a compliance review would be undertaken or asked that the
compliance review provision be eliminated from the rule. One comment
suggested that compliance reviews be limited to evidence-based reviews.
These comments expressed concern that the rule does not specifically
define when a compliance review will be undertaken.
Response: Compliance reviews are conducted at the discretion of the
Secretary. Outlining specific instances in which a compliance review
will be conducted could have the counterproductive effect of skewing
compliance efforts toward those aspects of compliance that had been
identified as likely to result in a compliance review. It also does not
seem advisable to limit, by rule, the circumstances under which such
reviews may be conducted at this early stage of the enforcement
program, when our knowledge of the types of violations that may arise
is necessarily limited. We also do not agree that the provision for
compliance reviews should be eliminated. There are situations where
instances of potential noncompliance come to HHS's attention outside of
the complaint process (e.g., where media reports suggest that a
violation has occurred), and HHS must have clear authority to
investigate such situations.
Comment: A number of comments suggested that HHS detail the
compliance review process and rules for notification of covered
entities when they are being reviewed.
Response: The rule already contains procedures to be followed, and
requirements to be met, that apply to compliance reviews. See
Sec. Sec. 160.304, 160.310, 160.312, 160.314, and 160.316. It is
unnecessary to establish procedures comparable to the complaint filing
procedures of Sec. 160.306 for compliance reviews, since they are
initiated by HHS. The concerns expressed by most of the comments on
this topic--that HHS would undertake a compliance review without notice
to the covered entity and without specifying the basis for, or the
focus of, the review--are misplaced. Section 160.312 requires HHS to
attempt to resolve violations found in a compliance review by informal
means and to inform the covered entity in writing if a compliance
review is or is not resolved by informal means. Failing to notify the
covered entity of a compliance review or the basis for such a review is
not consistent with our practice generally and would be unlikely to
yield much information of use, resulting in an ineffective use of the
covered entity's and the agency's resources.
Comment: One comment suggests that compliance reviews should be
mandatory and should be initiated within a specified time period.
Response: The rule, as proposed and adopted, does not preclude
establishing a compliance review program or schedule, but it does not
require it either. One purpose of compliance reviews is to permit
investigation when allegations or situations warranting investigation
come to our attention outside of the complaint process. The necessity
for a compliance review in a particular case or a program of scheduled
compliance reviews is inherently unpredictable, and it is important to
retain the administrative flexibility to address such situations.
Mandating compliance reviews on a fixed basis or schedule would be an
inefficient allocation of limited enforcement resources and would
hamper the agency's ability to target resources at actual noncompliance
problems as they arise.
Comment: One comment suggested that the rule contain provisions
outlining the coordination and cooperation between CMS and OCR when a
compliance review under more than one rule occurs.
Response: As with complaint-based investigations, CMS and OCR will
coordinate and allocate responsibility for compliance reviews based
upon the HIPAA provisions involved and the facts of the case. We do not
consider it advisable to specify detailed rules in this regard, as the
allocation of function and responsibility will depend on the facts of
each case and the resources available at the time.
6. Section 160.310--Responsibilities of Covered Entities
Proposed rule: Section 160.310 addresses the responsibilities of a
covered entity, such as providing records and compliance reports to the
Secretary and cooperating during a compliance review or complaint
investigation. Section 160.310(c) provides that a covered entity must
permit HHS to have access during normal business hours to its
facilities, books, records, and other information necessary to
determine compliance, but provides that if the Secretary determines
that ``exigent circumstances exist, such as when documents may be
hidden or destroyed,'' the covered entity must permit access at any
time without
[[Page 8397]]
notice. Section 160.310 also requires that the Secretary may not
disclose protected health information obtained by the Secretary in the
course of an investigation or compliance review except when necessary
to ascertaining or enforcing compliance or as otherwise required by
law. The proposed rule would amend this section to apply it to all of
the HIPAA rules, rather than exclusively to the Privacy Rule, but
otherwise proposed no substantive changes to the section.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: A couple of comments asked HHS either to further define
``exigent circumstances,'' such as by limiting it to situations
involving national security or by inserting specific examples of
exigent circumstances in Sec. 160.310(c)(1). One comment suggested
that the rule be revised to require that the Secretary's determination
that ``exigent circumstances'' exist be a ``reasonable'' one.
Response: The determination of what constitutes ``exigent
circumstances'' will inevitably be fact-dependent. Specific language
defining ``exigent circumstances'' is unnecessary, as the rule already
provides a clarifying example and the principle underlying the
provision is reasonably universal. We note that limiting the provision
to situations where matters of national security are involved would
most likely not cover the types of situations the provision is intended
to cover--situations in which it is likely that the covered entity will
seek to conceal or destroy evidence of noncompliance that HHS needs to
carry out its statutory obligation to enforce the HIPAA rules.
Comment: Two comments asked for further guidance and notice of
record retention requirements and another comment expressed concerns
with the record retention requirements of the Privacy Rule.
Response: Record retention requirements applicable to the Privacy
and Security Rules are spelled out in those rules; see, Sec.
164.530(j) and Sec. 164.316(b), respectively. We do not address these
record retention requirements here, as this topic lies outside the
scope of this rule.
The other HIPAA rules do not contain explicit record retention
requirements, as such. However, it is likely that the documentation
that would be relevant to showing compliance with those rules--such as
health plan instructions to providers, software documentation,
contracts, and systems processes--is kept as part of normal business
practices. Covered entities should consider any other applicable laws,
such as state law, in making such decisions.
7. Section 160.312--Secretarial Action Regarding Complaints and
Compliance Reviews
Proposed rule: We proposed to revise Sec. 160.312(a) to require
that, where noncompliance is indicated, the Secretary would seek to
reach by informal means a resolution of the matter that is satisfactory
to the Secretary. Informal means could include demonstrated compliance,
or a completed corrective action plan or other agreement. We proposed
to revise Sec. 160.312(a)(2) to require, where noncompliance is
indicated and the matter is resolved by informal means, that HHS notify
the covered entity in writing and, if the matter arose from a
complaint, the complainant. Where noncompliance is indicated and the
matter is not resolved by informal means, proposed Sec.
160.312(a)(3)(i) would require the Secretary to so inform the covered
entity and provide the covered entity an opportunity to submit, within
30 days of receipt of such notification, written evidence of any
mitigating factors or affirmative defenses. To avoid confusion with the
notice of proposed determination process provided for at proposed Sec.
160.420, proposed Sec. 160.312(a)(3)(ii) provided that, where the
matter is not resolved by informal means and the Secretary finds that
imposition of a civil money penalty is warranted, the formal finding
would be contained in the notice of proposed determination issued under
proposed Sec. 160.420. We proposed to leave Sec. 160.312(b)
substantively unchanged.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment suggested that covered entities should be able
to appeal the Secretary's findings during the informal resolution
process and that the Secretary's decision to resolve a matter
informally should not preclude the respondent from questioning the
Secretary's interpretation or application of the rule in question.
Response: The purpose of the informal resolution process described
in Sec. 160.312 is to bring closure at an early stage to a matter
where compliance is in issue and, thus, to obviate the need to issue a
notice of proposed determination. Section 160.312 recognizes, however,
that informal resolutions will not always be achieved. Where the agency
and the covered entity are not able to resolve the matter informally,
HHS (through OCR and/or CMS) will make a finding of noncompliance
pursuant to Sec. 160.420, which the covered entity may then challenge
through the applicable procedures of subparts D and E. Nothing in the
rule compels the covered entity to challenge the finding of
noncompliance under Sec. 160.420, but if the covered entity wishes to
challenge such a finding, including the agency's interpretation or
application of a rule, it must do so through the procedural avenue
provided by subparts D and E. These procedures implement the
requirement of section 1128A(c) of the Act that the Secretary may not
make an adverse determination against a person until the person has
been given written notice and an opportunity for a hearing on the
record on the adverse determination.
Comment: One comment asked how informal resolution is possible,
given HHS's position that, where a violation is found, a CMP must be
imposed. Another comment expressed concern that the informal resolution
process would allow covered entities to skirt penalties and the
consequences of noncompliance with the HIPAA rules and suggested that
the Secretary should not be compelled to reach a resolution through
informal processes.
Response: These comments misunderstand our position as to the
mandatory nature of the statute. The Secretary must impose a civil
money penalty where a formal determination of a violation is made.
However, many opportunities exist prior to this determination that
allow the Secretary to exercise his discretion to not impose a penalty.
This issue is discussed more fully in connection with Sec. 160.402
below.
The second comment above also misconstrues Sec. 160.312. Nothing
in that section compels OCR or CMS to resolve matters informally.
Indeed, Sec. 160.312(a)(3) describes the actions to be taken ``[i]f
the matter is not resolved by informal means * * *''.
Comment: One comment suggested that HHS and the covered entity
should be required to put the informal resolution in writing.
Response: Both Sec. 160.312(a)(2) and Sec. 160.312(b) require
that the resolutions contemplated in those sections be ``in writing.''
CMS and OCR currently document informal resolutions.
Comment: One comment suggested that the 30-day time period for a
covered entity to submit to the Secretary evidence of mitigating
factors or affirmative defenses should be extended.
Response: Thirty days should be sufficient for a covered entity to
submit such evidence. The opportunity to provide additional evidence
comes at
[[Page 8398]]
the end of investigation, and the covered entity should be gathering
any evidence of mitigating factors or affirmative defenses during the
investigation. In addition, the covered entity will have the
opportunity to present such evidence to the ALJ if it chooses to appeal
the Secretary's findings. Accordingly, we do not change this provision.
Comment: One comment suggested that a deadline should be imposed
for HHS to notify the covered entity of its findings after an
investigation.
Response: The time needed to finalize the agency's findings will
depend on the complexity of the case, its outcome, and workload
considerations. As these factors are inherently variable and
unpredictable, we do not believe it would be advisable to impose fixed
deadlines for taking the actions described in Sec. 160.312.
Comment: One comment requested clarification of proposed Sec.
160.312(a)(3)(ii), with respect to what action is referred to and the
associated time frame.
Response: The action referred to is HHS's notification of the
covered entity of its finding of noncompliance when it determines that
the matter cannot be resolved informally. Section 160.312(a)(3)(ii)
provides that, if HHS decides to impose a civil money penalty, it will
send a notice of proposed determination to the covered entity pursuant
to Sec. 160.420. Thus, the intent of this provision is to clarify
that, once OCR and/or CMS, as applicable, has determined that a
violation has occurred, the matter cannot be resolved informally in a
manner that is satisfactory to OCR and/or CMS, and a civil money
penalty should be imposed, the agency's next step is to provide the
formal notice required by section 1128A(c)(1), which in this rule is
the notice of proposed determination under Sec. 160.420. The rule
imposes no specific deadline on the agency for sending this notice.
However, it should be noted that if the notice is not sent within six
years of the violation, pursuit of the civil money penalty would be
precluded by section 1128A(c)(1), which is implemented in this rule by
Sec. 160.414.
Comment: One comment requested that Sec. 160.312(a)(3) be revised
to afford complainants the opportunity to express, in writing, the
impact of the violation.
Response: The suggested change is unnecessary, since nothing in the
rule precludes a complainant from providing such information to the
agency at any point in the process. Complainants frequently describe,
in their complaints or in the course of OCR's or CMS's initial contacts
with the complainants, the impact of the alleged violation. HHS also
may request such information from the complainant where, for example,
it bears on the amount of the penalty to be imposed.
8. Section 160.314--Investigational Subpoenas and Inquiries
Proposed rule: The text of proposed Sec. 160.314 was adopted by
the April 17, 2003 interim final rule as Sec. 160.504. We proposed to
move this section to subpart C, consistent with our overall approach of
organizing subparts C, D, and E to reflect the stages of the
enforcement process. We proposed to include in the introductory
language of proposed Sec. 160.314(a) a sentence which states that, for
the purposes of paragraph (a), a person other than a natural person is
termed an ``entity.'' We proposed not to modify Sec. 160.314(b)(1),
(2) and (8) from the provisions of the April 17, 2003 interim final
rule at paragraphs (b)(1)-(3) of Sec. 160.504. However, we proposed to
add new paragraphs (3) through (7) and (9) to Sec. 160.314(b) and also
to add a new paragraph (c). The proposed new paragraphs at Sec. Sec.
160.314(b)(3)-(b)(7) would permit representatives of HHS to attend and
ask questions at the inquiry, give a witness the opportunity to clarify
his answers on the record after being questioned by HHS, require any
objections or claims of privilege to be asserted on the record, and
permit HHS to seek enforcement of the subpoena through the federal
district court if a witness refuses to answer non-privileged questions
or produce requested documents or items. Further, proposed Sec.
160.314(c) provided that, consistent with Sec. 160.310, testimony and
other evidence obtained in an investigational inquiry may be used by
HHS in any of its activities and may be used or offered into evidence
in any administrative or judicial proceeding. Together, these additions
would clarify the manner in which investigational inquiries will be
conducted, and how testimony given, and evidence obtained, during such
an investigation may be used.
Final rule: The final rule adopts the provisions of the proposed
rule, except that paragraph (a) is revised to clarify that
investigational subpoenas may issue when a compliance review is
conducted.
Comment: A few comments requested that this section provide for the
protection of privileged documents when subpoenaed by the Secretary.
Comments also suggested that covered entities should have the ability
to challenge a subpoena issued by the Secretary.
Response: The rule, as proposed and adopted, provides a process for
a subpoenaed witness to challenge the subpoena and/or assert privilege.
Under section 205(e) of the Act, made applicable by section 1128A(j)(1)
of the Act, the federal district court in which a person charged with
contumacy or refusal to obey a subpoena resides or transacts business
has jurisdiction upon application of HHS. As provided in Sec.
160.314(a)(5), HHS may seek to enforce the subpoena in such cases
through action in the relevant federal district court, which would
presumably hear the basis for the witness's refusal to obey or claim of
privilege in connection with a motion to quash under Fed. R. Civ. P.
45(c)(3). (28 U.S.C. Appendix).
Comment: Several comments requested that the scope of the subpoenas
issued by the Secretary be limited to the investigation and that the
Secretary not be allowed to pursue open-ended inquiries.
Response: Section 205(d) of the Act, which is made applicable by
section 1128A(j)(1), provides that a subpoena may issue for ``the
production of any evidence that relates to any matter under
investigation or in question before [the Secretary].'' Moreover, the
federal courts subject the exercise of an agency's administrative
subpoena authority to a reasonableness analysis. In U.S. v. Powell, 397
U.S. 481 (1964), the holding of which was extended to all
administrative subpoena authorities in Securities and Exchange
Commission v. Jerry T. O'Brien, Inc., 467 U.S. 735, 741-42 (1984), the
U.S. Supreme Court articulated a standard for the judicial review of
administrative subpoenas that requires that the investigation be
conducted pursuant to a legitimate purpose and that the information
requested under the subpoena is relevant to that purpose. HHS is
required to comply with this standard in the exercise of the subpoena
authority under this section.
Comment: One comment asked that covered entities be given notice of
investigational inquiries directed at them.
Response: In general, we would expect that an investigational
subpoena would be used where a covered entity has failed to respond to
HHS's requests for information in the course of an investigation
conducted under Sec. 160.306. In such a case, the covered entity will
have been previously notified of the investigation pursuant to Sec.
160.306(c). Similarly, a subpoena would typically be issued in
connection with a compliance review under Sec. 160.308 where the
covered entity had
[[Page 8399]]
failed to respond to HHS's prior requests for information. Thus, we do
not expect the element of surprise to be present, which appears to be
the concern underlying these comments. We clarify in Sec. 160.314(a)
that this section also applies to compliance reviews.
Comment: One comment suggested that Sec. 160.314(a) be revised to
state that the admissibility of written statements obtained by HHS
during an investigational inquiry is subject to 45 CFR 160.518 and
160.538.
Response: We do not consider the suggested language necessary.
Sections 160.518 and 160.538 apply to the exchange and admission of
written statements. Should OCR or CMS seek to have written statements
obtained during an investigation admitted into evidence, those
statements would be subject to the requirements of Sec. Sec. 160.518
and 160.538.
Comment: One comment asked for clarification as to who may amend a
transcript and whether the Secretary has the discretion to limit a
witness's amendment of his or her testimony transcript.
Response: Under Sec. 160.314(b)(9), both sides may propose
corrections to the transcript, and any proposed corrections are
attached to the transcript; the transcript itself is not altered.
Section 160.314(b)(9)(i) provides that, if a witness is provided with a
copy of the transcript, the witness may submit written proposed
corrections to the transcript, or, if the witness is afforded only the
opportunity to inspect the transcript, the witness may propose
corrections to the transcript at the time of inspection. In either
case, the witness's proposed corrections are attached to the
transcript. Similarly, under Sec. 160.314(b)(9)(ii), the Secretary's
proposed corrections are attached to the transcript. The purpose of the
proposed corrections is to make the transcript ``true and accurate.''
See Sec. 160.314(b)(9)(i). Under this process, then, HHS would not be
changing the witness's proposed corrections; HHS would, at most, be
proposing different corrections.
Comment: One comment suggested that Sec. 160.314 be revised to
require HHS to provide for the same protection of protected health
information that is required of covered entities when HHS receives
protected health information during an investigation.
Response: Section 160.310(c)(3) explicitly protects the
confidentiality of protected health information received by HHS ``in
connection with an investigation or compliance review under this
subpart.'' Although these protections are not the same as those
required of covered entities with respect to protected health
information, in some respects they are more stringent, given the
limited circumstances for which the information may be disclosed under
this provision. Because Sec. 160.314 is now part of the subpart, the
restriction of Sec. 160.310(c)(3) applies to protected health
information received during an investigational inquiry. See Sec.
160.314(c), which provides that testimony and other evidence obtained
in an investigational inquiry may only be used ``[c]onsistent with
Sec. 160.310(c)(3) * * *''.
Comment: One comment asked for clarification of the ``good cause''
limitation on a witness's ability to inspect the official transcript of
their testimony.
Response: This provision derives from the Administrative Procedure
Act, which requires, at 5 U.S.C. 555(c), that ``[a] person compelled to
submit data or evidence is entitled to retain or, on payment of
lawfully prescribed costs, procure a copy or transcript thereof, except
that in a nonpublic investigatory proceeding the witness may for good
cause be limited to inspection of the official transcript of his
testimony.'' The ``good cause'' language of this provision has been
explained as follows:
The * * * grant[] to agencies of the right to inhibit access to
testimony in nonpublic investigatory proceedings were in recognition
that such investigations, ``like those of a grand jury, might be
thwarted in certain cases if not kept secret, and that if witnesses
were given a copy of their transcript, suspected violators would be
in a better position to tailor their own testimony to that of the
previous testimony, and to threaten witness about to testify with
economic or other reprisals.''
LaMorte v. Mansfield, 438 F.2d 448, 451 (2d Cir. 1971) (quoting
Commercial Capital Corp. v. S.E.C., 360 F.2d 856, 858 (7th Cir. 1966)).
Comment: Several comments suggested that evidence obtained during
an investigation by HHS should be used only within the scope of that
investigation, not for other matters, as provided for by Sec.
160.314(c).
Response: Section 160.314(c) mirrors the OIG rule. The concept that
HHS may use evidence obtained in an investigation for matters outside
the scope of the investigation is not novel. While we would expect to
be careful in using such information for other purposes, we are legally
obligated to take appropriate action if we obtain clear evidence of
wrongdoing.
9. Section 160.316--Refraining From Intimidation or Retaliation
Proposed rule: Proposed Sec. 160.316, which was taken from Sec.
164.530(g)(2) of the Privacy Rule, would prohibit covered entities from
threatening, intimidating, coercing, discriminating against, or taking
any other retaliatory action against individuals or other persons
(including other covered entities) who complain to HHS or otherwise
assist or cooperate in the enforcement processes created by this rule.
The intent of this addition to subpart C was to make these non-
retaliation provisions applicable to all of the HIPAA rules, not just
the Privacy Rule. A conforming change to Sec. 164.530(g) of the
Privacy Rule was proposed, to cross-reference proposed Sec. 160.316.
Final rule: The final rule adopts the provisions of the proposed
rule, except that the verb ``harass'' is inserted in the introductory
language of this section. The related revision to Sec. 164.530(g) is
adopted without change.
Comment: Two comments asked HHS to strengthen the prohibition on
retaliation and intimidation. The comments express concern that the
current provision is not a sufficient deterrence to covered entities,
particularly payers. One comment suggested that the language be revised
to read in pertinent part as follows: ``A covered entity may not
threaten * * * including not threaten to reduce or eliminate payment,
intimidate, coerce, harass, discriminate against, or take any other
retaliatory action against any individual or other person * * *
including suspending or terminating participation in a Medicaid program
and/or in any other program or network or reducing or eliminating
payment for * * *''. Another comment suggested that persons who engage
in prohibited retaliation or intimidation should be considered to have
``knowingly'' violated the statute and be subject to criminal penalties
under section 1177 of the Act.
Response: We agree with the comment that the actions covered in the
suggested language would constitute intimidation or retaliation under
the appropriate facts, but we think that such claims may be made under
the existing language. However, while harassment is encompassed by the
phrase ``other retaliatory action'' in this section, since harassment
is a form of pressure that is sufficiently different from, and as
objectionable as, the other intimidating or retaliatory acts that are
specifically mentioned, we clarify the section by including it in the
text of the regulation;
[[Page 8400]]
the text of the final rule is revised accordingly.
The statute does not make retaliation or intimidation the subject
of a criminal penalty under section 1177, and we cannot expand the
scope of the criminal provision by regulation. Accordingly, we do not
adopt this suggestion.
Comment: One comment suggested amending the section to require that
a complaint be filed in good faith under Sec. 160.306 and that the
same change be made to the remaining language in proposed Sec.
164.530(g). The comment stated that covered entities should not be
prohibited from firing employees who file false complaints and that
covered health care providers should not be prohibited from terminating
the provider-patient relationship where the patient files a false
complaint.
Response: The good faith of a complainant is currently evaluated by
OCR to the extent it bears upon determining whether a compliance
failure appears to have occurred and the extent to which the complaint
should be investigated. We do not read the rule as prohibiting the
firing of an employee or the termination of a provider-patient
relationship where other legitimate grounds for such action exist;
whether such grounds exist would be a matter to be ascertained in the
course of the investigation.
Comment: Two comments asked HHS to provide examples of retaliation
and/or outline procedures or criteria for how the occurrence of
retaliation will be investigated and determined. One comment asked that
the rule stipulate that an act be considered to be one of retaliation
or intimidation only if it occurred after the filing of a complaint.
Response: Complaints regarding retaliation or intimidation will be
handled in the same manner as investigations regarding other possible
violations of the HIPAA rule, as Sec. 160.316 is considered an
administrative simplification provision for the purposes of imposing a
civil money penalty. Because such situations are likely to be quite
varied and factually complex, we are reluctant to preclude
consideration of events prior to the filing of a complaint that may be
relevant to a claim of retaliation or intimidation. We, thus, retain
the language as proposed.
C. Subpart D--Imposition of Civil Money Penalties
Subpart D of the final rule addresses the issuance of a notice of
proposed determination to impose a civil money penalty and other
actions that are relevant thereafter, whether or not a hearing is
requested following the issuance of the notice of proposed
determination. It also contains provisions on identifying violations,
calculating civil money penalties for such violations, and establishing
affirmative defenses to the imposition of civil money penalties. It,
thus, implements the provisions of section 1176, as well as related
provisions of section 1128A. As noted above, many provisions of subpart
D are based in large part upon the OIG regulations, but we adapt the
language of the OIG regulations to reflect issues presented by, or the
authority underlying, the HIPAA rules.
1. Section 160.402--Basis for a Civil Money Penalty
Section 160.402 sets forth the rules concerning the basis for
liability for a civil money penalty. It includes the rules for
determining liability if more than one covered entity is responsible
for a violation and where an agent of a covered entity is responsible
for a violation.
a. Section 160.402(a)--General Rule
Proposed rule: Proposed Sec. 160.402(a) would require the
Secretary to impose a civil money penalty on any covered entity which
the Secretary determines has violated an administrative simplification
provision, unless the covered entity establishes that an affirmative
defense, as provided for by Sec. 160.410, exists. This provision is
based on the language in section 1176(a) that ''* * * the Secretary
shall impose on any person who violates a provision of this part a
penalty * * * ''. A ``provision of this part'' is considered to be a
requirement or prohibition of the HIPAA statute or rules. See the
discussion of ``administrative simplification provision'' under Sec.
160.302 above.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: A number of comments suggested that the words ``the
Secretary will impose a civil money penalty * * * '' are too strict.
Some comments expressed concern that this language could jeopardize
HHS's ability to resolve a matter informally; other comments questioned
how this language was consistent with the provisions for voluntary
compliance (Sec. 160.304), informal resolution (Sec. 160.312), and
settlement (Sec. 160.416). Most of these comments suggested that the
rule give the Secretary discretion to impose a civil money penalty
instead of making it mandatory.
Response: Section 160.402(a) states the general rule of section
1176(a): If the Secretary determines that a covered entity has violated
an administrative simplification provision, he will impose a civil
money penalty unless a basis for not imposing a penalty under section
1176(b) exists. The use of the words ``shall impose'' in section
1176(a) is more than the mere conveyance of authority to the Secretary
to exercise his discretion where he has made a formal determination
that a covered entity has violated an administrative simplification
provision. Under the procedures set forth in this final rule, the
formal determination is proposed in a notice of proposed determination
under Sec. 160.420. A covered entity may request administrative review
by an administrative law judge of this determination. If the covered
entity does not so request, the proposed determination becomes final.
Many opportunities will precede a determination of a violation,
however, that will permit the Secretary to exercise his discretion to
not impose a penalty. As set forth in Sec. 160.304, the principle for
achieving compliance is to seek voluntary compliance by covered
entities. To implement this principle in complaints and compliance
reviews, Sec. 160.312 provides that the Secretary will attempt to
reach resolution by informal means prior to proposing a determination
under Sec. 160.420 that a covered entity has violated an
administrative simplification provision. If resolution satisfactory to
the Secretary is reached by informal means, the Secretary may exercise
his discretion to close the matter without formally proposing a
determination under Sec. 160.420. The Secretary is also authorized by
section 1128A(f) of the Act, which is incorporated by reference in
section 1176, to exercise discretion to settle any matter. Thus, under
Sec. Sec. 160.416 and 160.514, settlements of civil money penalties
which have been proposed or are being challenged through the
administrative hearing process are possible. The Secretary also has
discretion to waive civil money penalties, in whole or in part, in
certain cases under Sec. 160.412.
The general rule stated in Sec. 160.402(a) that the Secretary will
impose a civil money penalty upon a covered entity if the Secretary
determines that the covered entity has violated an administrative
simplification provision is not at odds with the Secretary's authority
to exercise his discretion pursuant to Sec. Sec. 160.304, 160.312,
160.412, 160.416, and 160.514. However, these exercises of Secretarial
discretion require actions by covered entities. When a covered entity
acts, or fails to act, in ways that do not allow the exercise of
Secretarial discretion not to
[[Page 8401]]
impose a penalty, the Secretary will impose a civil money penalty upon
the covered entity if the Secretary determines that the covered entity
has violated an administrative simplification provision.
Comment: One comment complained that Sec. 160.402(a) does not
allow for early termination of frivolous complaints. The comment stated
that covered entities are locked into paying a civil money penalty or
initiating an expensive and elaborate defense to the complaint.
Response: It is our expectation that complaints that are frivolous
will be resolved at an early stage of the informal resolution process
under Sec. 160.312. A covered entity can facilitate this process by
cooperating with the OCR or CMS investigators on a timely basis.
Comment: One comment suggested that Sec. 160.402(a) be revised to
require HHS to issue a finding that informal resolution is not
sufficient and that a civil money penalty is necessary.
Response: The provision suggested would be redundant. The notice of
proposed determination under Sec. 160.420 essentially fulfills this
function, in that it must state the grounds upon which the Secretary
has decided to impose the penalty.
b. Section 160.402(b)--Violations by More Than One Covered Entity
Proposed rule: Proposed Sec. 160.402(b) provided that, except with
respect to covered entities that are members of an affiliated covered
entity, if the Secretary determines that more than one covered entity
was responsible for violating an administrative simplification
provision, the Secretary will impose a civil money penalty against each
such covered entity. Based on the statutory language in section
1176(a), which states that the Secretary ``* * * shall impose a penalty
* * *'' when there is a determination that an entity has violated a
HIPAA provision, this provision would apply to any two or more covered
entities (other than members of an affiliated covered entity, discussed
below), including, but not limited to, those that are part of a joint
arrangement, such as an organized health care arrangement. The preamble
to the proposed rule noted that the determination of whether or not an
entity is responsible for the violation would be based on the facts and
that, while simply being part of a joint arrangement would not, in and
of itself, make a covered entity responsible for a violation by another
entity in the joint arrangement, it could be a factor considered in the
analysis. See 70 FR 20231.
Proposed Sec. 160.402(b)(2) provided that each covered entity that
is a member of an affiliated covered entity would be jointly and
severally liable for a civil money penalty for a violation by the
affiliated covered entity. An affiliated covered entity is a group of
covered entities under common ownership or control, which have elected
to be treated as if they were one covered entity for purposes of
compliance with the Security and Privacy Rules. See Sec. 164.105(b).
Final rule: The final rule provides that a member of an affiliated
covered entity is jointly and severally liable for a violation by the
affiliated covered entity, unless it is established that another member
of the affiliated covered entity was responsible for the violation.
Comment: Proposed Sec. 160.402(b) was opposed by many on the
ground that it was unfair to make one covered entity liable for a
violation committed by another covered entity. A number of comments
stated that this provision was particularly unfair, when coupled with
the requirement of proposed Sec. 160.426 that the public be notified
of civil money penalties imposed, in that a covered entity that was not
responsible for the violation in question could bear the reputational
injury associated with such notification, due to the operation of
proposed Sec. 160.402(b). One comment pointed out that violations may
not be system-wide, but may be limited to one member of the affiliated
covered entity; in such a situation, it would not be fair to penalize
the other members of the affiliated covered entity.
Response: We agree with these comments to a certain extent and have
changed the final rule accordingly. We agree that, if responsibility
for a violation can be shown to lie with one member of an affiliated
covered entity, that member should be held liable for the violation.
Thus, we have provided that a covered entity member of an affiliated
covered entity may avoid liability if it is established that another
member was responsible for the violation. We suspect that in most
cases, which member was responsible for the violation will be clear--
for example, if four of five members of a covered entity distributed
privacy notices but the fifth member did not, the violations of the
notice distribution requirement of Sec. 164.520 would be attributed to
the fifth member. In such cases, the objections to publication
described above are beside the point, because liability follows
responsibility.
However, we do not agree that the inability to assign specific
responsibility for a violation to one or more members of an affiliated
covered entity should shield all of its members from liability. We
doubt that such situations will arise often, but they may arise where
the affiliated covered entity has failed to take a required act--for
example, where the affiliated covered entity has failed to appoint a
privacy officer. In such a case, all of the members of the affiliated
covered entity bear a share of the responsibility for the failure to
act, since any of them could have presumably taken action to bring the
group, as a whole, into compliance. It is, thus, not unreasonable that
all members of the affiliated covered entity should be jointly and
severally liable for the consequent penalty. Moreover, absent joint and
several liability, each member of the affiliated covered entity would
be separately liable for the penalty for the violation, e.g., the
failure to appoint a privacy officer. Thus, the removal of joint and
several liability may result in greater liability for the members of an
affiliated covered entity in some cases.
Comment: Several comments argued that there is no statutory
authority for holding the members of an affiliated covered entity
jointly and severally liable, in that the statute requires that the
penalty ``shall be imposed on any person who violates a provision * *
*'' and, thus, does not authorize imposition of a penalty on a person
who has not violated a provision of the statute or rules. One comment
argued that proposed Sec. 160.402(b) would violate the due process
clause by imposing liability on entities not responsible for a
violation.
Response: These objections are misplaced. Where, as will usually be
the case, responsibility for the violation is evident and the
responsible party is charged with the violation, they are obviously not
relevant. In the case of other violations, where the responsibility for
the violation is shared by the members of the affiliated covered
entity, as in where the affiliated covered entity fails to take
required actions, they are likewise not relevant. Since each covered
entity member of the affiliated covered entity is responsible for
complying with the rule in question, responsibility for the failure to
act may be properly imputed to each member. Moreover, since an
affiliated covered entity is a type of joint undertaking, it is
reasonable to impute responsibility to the members of the affiliated
covered entity, as is typically done with joint ventures.
Comment: Several comments argued that proposed Sec. 160.402(b)
uses a legal fiction of the Privacy and Security Rules to create
liability where liability would not otherwise exist and substitutes
this fiction for the corporate form and structure that establish the
basis for enterprise liability under U.S. law.
[[Page 8402]]
Another comment stated that this section is inconsistent with the
provision of the HIPAA rules (Sec. 160.105(b)) that defines an
affiliated covered entity as an entity comprised of ``legally
separate'' entities.
Response: We disagree. The affiliated covered entity concept is
more than a legal fiction. It is an operational approach to discharging
certain compliance responsibilities. When covered entities create an
affiliated covered entity, they mutually agree to conduct their
business in a certain manner and hold themselves out to the world as a
joint undertaking. While the Privacy and Security Rules do not
prescribe detailed requirements for how an affiliated covered entity
must be organized, the level of cooperation such an undertaking
necessitates, the requirement for designation, and the requirement of
common ownership or control mean that the participating members will
have entered into an agreement of some sort, whether formal or
informal. We, thus, think that it is properly viewed as a joint
venture.
The fact that an affiliated covered entity is composed of ``legally
separate'' entities is beside the point. Joint and several liability,
as a concept, is imposed on legally separate entities. See, e.g.,
Black's Law Dictionary (8th ed. 2004), liability.
Comment: A number of comments argued that the provision for joint
and several liability would discourage covered entities from setting up
affiliated covered entities. One comment stated that proposed Sec.
160.402(b) represents a change in position by HHS, in that the preamble
to the Privacy Rule, on which many covered entities relied, stated that
covered entities that formed an affiliated covered entity are
``separately subject to liability under this rule.''
Response: Section 160.402(b), as adopted, should allay the concerns
expressed by these comments with respect to the potential exposure to
liability for the members of affiliated covered entities. We think
that, in most cases, which member of an affiliated covered entity is
responsible for a violation will be obvious; where this is the case,
HHS would seek to impose the civil money penalties on that member. Even
if it is not obvious from the violation itself who the responsible
party is, a covered entity may adduce evidence to establish that
responsibility for the violation lies elsewhere, and, if this is shown,
avoid liability. In any event, the establishment of an affiliated
covered entity is not mandated by either the Privacy Rule or the
Security Rule. Rather, establishing an affiliated covered entity is a
business decision to be made by the covered entities involved. The
affiliated covered entity arrangement carries with it certain benefits
for the member entities; any increased exposure to potential liability
under this rule, assuming there is one, should be part of the business
calculus.
In addition, we do not agree that Sec. 160.402(b) is inconsistent
with the position taken in the preamble to the Privacy Rule. Our prior
statement was intended to provide notice that liability for violations
by an affiliated covered entity would devolve onto the member covered
entities of an affiliated covered entity, rather than being attributed
to the affiliated covered entity itself, so that member covered
entities could not avoid liability by arguing that the affiliated
covered entity had committed the violation in question. It was not
intended to indicate the bases upon which that liability would be
determined, which is the purpose of Sec. 160.402(b).
Comment: A couple of comments supported the policy of holding the
members of an affiliated covered entity jointly and severally liable.
One comment supported holding all covered entities in an affiliated
covered entity liable for the violations of one as an efficient
mechanism for highlighting the seriousness of violations of the HIPAA
rules.
Response: For the reasons set forth above, we have not adopted this
policy in the final rule, insofar as responsibility for a violation can
be determined.
Comment: Two comments requested clarification of the maximum amount
of the penalty that will be assessed against an affiliated covered
entity when one of its members has been found noncompliant.
Response: Where responsibility for a violation is allocated to
individual covered entities, each covered entity determined to be
responsible for the violation would be liable for violations of an
identical requirement or prohibition in a calendar year up to the
statutory maximum of $25,000. If responsibility for particular
violations cannot be determined, so that the members of the affiliated
covered entity are jointly and severally liable for the violation, the
maximum that would be imposed for violations of an identical
requirement or prohibition in a calendar year would be $25,000.
Comment: Several comments requested clarification of the statement
in the preamble to the proposed rule that membership in an organized
health care arrangement ``could be a factor considered in the
analysis'' in determining the liability of a member of such arrangement
for a violation. Of particular concern was the potential liability of a
hospital for the actions of physicians with privileges; one comment
noted that the hospital exercises little control over medical staff in
such situations. One comment requested that the final rule clarify that
membership in an organized health care arrangement would not increase a
covered entity's exposure to liability.
Response: As we noted in the preamble to the proposed rule, the
members of an organized health care arrangement would be individually--
not jointly and severally--liable for any violation of the HIPAA rules.
What our preamble statement intended to indicate was that HHS might
have to look carefully at how the organized health care arrangement
operated in determining which member(s) of the organized health care
arrangement was responsible for a particular violation, if that was not
clear at the outset.
c. Section 160.402(c)--Violations Attributed to a Covered Entity
Proposed rule: Proposed Sec. 160.402(c) provided that a covered
entity can be held liable for a civil money penalty based on the
actions of any agent, including a workforce member, acting within the
scope of the agency. This provision derives from section 1128A(l) of
the Act, which is made applicable to HIPAA by section 1176(a)(2) of the
Act. Section 1128A(l) states that ``a principal is liable for penalties
* * * under this section for the actions of the principal's agents
acting within the scope of the agency.'' Under the proposed rule, a
covered entity could be liable for a civil money penalty for a
violation by any agent acting within the scope of the agency, including
a workforce member. (``Workforce'' is defined at Sec. 160.103 as
``employees, volunteers, trainees, or other persons whose conduct in
the performance of work for a covered entity is under the direct
control of such entity, whether or not they are paid by the covered
entity.'') The proposed rule excepted covered entities from liability
for actions of a business associate agent that violate the HIPAA rules,
if the covered entity was in compliance with the HIPAA rules governing
business associates at Sec. Sec. 164.308(b) and 164.502(e). Proposed
Sec. 160.402(c) also provided that the Federal common law of agency
would apply to determine agency issues under this provision.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: A number of comments supported the provision of proposed
Sec. 160.402(c) relating to business
[[Page 8403]]
associates and requested that it be retained in the final rule.
Response: We agree and have done so.
Comment: One comment requested clarification of the liability of a
covered entity for a violation committed by a non-covered entity who is
not a business associate or workforce member, such as researchers,
medical device vendors, and non-covered providers who have treatment
privileges and access to protected health information at a covered
entity's facility. The comment argued that, depending on the
circumstances, such persons may or may not be considered agents.
Response: In general, a ``violation'' cannot occur, if the act in
question is not done by a covered entity or its agent, because only
covered entities are subject to the HIPAA rules. For example, if a
permitted or required disclosure of protected health information is
made by a covered entity to a person or entity that is not a workforce
member or business associate, the covered entity would not generally be
responsible for that person's or entity's subsequent use or disclosure
of the information. Thus, if a hospital that is a covered entity
discloses protected health information to a non-covered health care
provider with privileges for treatment of a patient, the hospital would
not be liable for a subsequent use or disclosure by that provider, as
long as the hospital is not also involved in that use or disclosure. If
the provider is an agent of the hospital, however, the hospital's
liability will be determined in accordance with Sec. 160.402(c).
Comment: We requested comment in the proposed rule on whether there
are categories of workforce members whom it would be inappropriate to
treat as agents under Sec. 160.402(c). A number of comments suggested
that independent contractors, volunteers, and students under the
supervision of an academic institution be excluded from the definition
of an agent for whose acts the covered entity could be liable, provided
that the covered entity has given the requisite training to such
persons. The comments indicated that generally covered entities have
less control over such persons than they have over employees.
Response: Whether a person is sufficiently under the control of a
covered entity and acting within the scope of the agency has to be
determined on the facts of each situation, but Sec. 160.402(c) creates
a presumption that a workforce member is an agent of the covered entity
for the member's conduct under the HIPAA rules, such as using and
disclosing protected health information. With regard to whether an
independent contractor is a member of the covered entity's workforce,
the question would be whether the covered entity had direct control
over the independent contractor in the performance of its work for the
covered entity. See Sec. 160.103 (definition of ``workforce''). If the
covered entity does not have direct control over such persons, they do
not fall within the definition of ``workforce.'' Where persons, such as
independent contractors, who are not under the direct control of the
covered entity perform a function or activity that involves the use or
disclosure of individually identifiable health information or a
function or activity regulated by this subchapter on behalf of a
covered entity, such persons would fall within the definition of
``business associate,'' and the covered entity would be required to
comply with the business associate provisions of the Privacy and
Security Rules with regard to such persons. Because of the direct
control requirement in the definition of workforce, we think it is
appropriate for a covered entity to be liable for a violative act of an
independent contractor who is a member of the workforce, that is, who
is under the direct control of the covered entity.
With respect to volunteers and trainees, we note that, while
covered entities may have less control over these persons, they do
control their performance of activities that are governed by the HIPAA
rules, such as access to protected health information. In regard to
privacy, a covered entity is required to train these categories of
workforce members as necessary and appropriate for these volunteers and
trainees to carry out their functions within the covered entity. 45 CFR
164.530(b). This requirement allows a covered entity to adapt its
training to a volunteer's or trainee's scope of duties. For example, a
volunteer who files laboratory results in a medical record will require
training that is different and more extensive than the training given
to a volunteer in the lobby gift shop of a hospital. Section 160.402(c)
is consistent with these distinctions. The acts of volunteers and
trainees will be examined on a case-by-case basis to determine if they
are acting as agents within the scope of their agency. Thus, we think
that it is appropriate to treat volunteers and trainees as persons for
whose acts a covered entity may be liable, if they act as agents for
the covered entity and violate the HIPAA rules within the scope of
their agency.
Comment: One comment recommended that the rule be revised to make
covered entities liable for violations committed by business
associates. The comment suggested that, if a covered entity is not
liable for the actions of its business associates, covered entities
will outsource the handling of protected health information to avoid
liability.
Response: We included the business associate exception in proposed
Sec. 160.402(c)(1)-(3) to make this rule consistent with the business
associate provisions in the Privacy and Security Rules. Changing the
business associate provisions in the Privacy and Security Rules is
outside the scope of this rulemaking. (See the extensive discussion
about business associates in the Privacy Rule and Security Rule
preambles at 65 FR 82503-82507 and 82640-82645, 67 FR 53251-53253, and
68 FR 8358-8361). The satisfactory assurances that are required in
written contracts or arrangements between covered entities and their
business associates are intended to protect the confidentiality of
protected health information handled by business associates. If a
covered entity fails to comply with the business associate provisions
in the Privacy and Security Rules, such as by not entering into the
requisite contracts or arrangements, or by not taking reasonable steps
to cure a breach or end a violation that is known to the covered
entity, the covered entity may be liable for the actions of a business
associate agent. We, therefore, decline to follow the recommendation.
Comment: Two comments suggested that HHS limit its use of the
Federal common law of agency because its application may make a covered
entity liable for the actions of a person, such as an independent
contractor, for whom the covered entity is not liable under state law.
Response: As we stated above, covered entities must comply with the
business associate provisions of the Privacy and Security Rules for
independent contractors who are not under the direct control of the
covered entity and who perform a function or activity that involves the
use or disclosure of individually identifiable health information or a
function or activity regulated by ``this subchapter'' (i.e., the HIPAA
rules) on behalf of a covered entity. If a covered entity complies with
the business associate provisions, the exception from liability in
Sec. 160.402(c) will be applicable. The purpose of establishing the
Federal common law of agency to determine when a covered entity is
vicariously liable for the acts of its agents is to achieve nationwide
uniformity in the implementation of the HIPAA rules by covered entities
and nationwide
[[Page 8404]]
consistency in the enforcement of these rules by HHS. The comments
reinforced our conclusion that reliance on state law could introduce
inconsistency in the implementation of the HIPAA rules by covered
entities in different states. Thus, we retain the Federal common law of
agency as the standard by which agency questions in specific cases will
be determined.
Comment: Two comments requested clarification of how this section
will apply to insurance agents, brokers, and consultants.
Response: Insurance agents, brokers, and consultants who are not
members of the covered entity's workforce but with whom the covered
entity shares protected health information will generally fall within
the definition of ``business associate'' at Sec. 160.103. A covered
entity that complies with the business associate provisions of the
Privacy and Security Rules would not be liable for a violation of those
rules by the business associate pursuant to the liability exception in
Sec. 160.402(c). It is also possible that the insurance agent, broker,
or consultant may be the covered entity's agent in some, but not all,
of his or her activities. An agent or broker may be working on behalf
of an employer to arrange insurance coverage for its employees and not
on behalf of the health insurance issuer that is a covered entity. In
cases where the liability exception for business associates is not
available or not met, the determination of whether an insurance agent,
broker, or consultant is an agent of a covered entity and was acting
within the scope of the agency will be made based on the facts of each
situation.
Comment: One comment argued that covered entities should not be
liable for acts of employees outside the scope of their employment.
Another comment suggested that covered entities should not be liable
for the actions of agents who have been informed of the covered
entity's HIPAA compliance policies, yet act contrary to them. Another
suggested that a covered entity should not be liable for the acts of
agents who, although authorized to disclose protected health
information, disclose it for purposes of sale or with intent to do
harm.
Response: Section 160.402(c), as proposed and adopted, provides
that a covered entity is liable for the acts of an agent acting
``within the scope of the agency.'' This provision necessarily implies
that a covered entity is not liable for its agent's acts outside the
scope of the agency (as determined under the federal common law of
agency). With regard to the comments that suggest that unauthorized
conduct by an agent is outside the scope of the agency, the Federal
common law of agency will be applied to the facts of each case to
determine whether the covered entity is liable for the conduct, even
though it was unauthorized.
Comment: Two comments expressed concern with the role of a Privacy
Officer and his or her liability under this part and the covered
entity's liability for the actions of a Privacy Officer who is a
business associate. One comment suggested that the Privacy Officer
should not incur any additional liability merely by being designated
the Privacy Officer. The other comment requested clarification as to a
covered entity's liability when the covered entity directly controls a
Privacy Officer, if the Privacy Officer is a business associate.
Response: As stated above, the facts of each case will determine
the liability of covered entities for wrongful conduct of its agents
under the HIPAA rules. As a general matter, we think that a Privacy
Officer is an officer of a covered entity for the purposes of the
Privacy Rule and, thus, will likely be the covered entity's agent. As
stated in Sec. 160.402, a covered entity is liable for the acts of its
agent acting within the scope of its agency and, thus, is liable for
any penalties that result from those acts. However, if a Privacy
Officer is a business associate of the covered entity, the liability
exception in Sec. 160.402(c) may apply. A covered entity that is in
compliance with the business associate provisions of the Privacy and
Security Rules will not be liable for a violation of those rules by the
business associate.
2. Section 160.404--Amount of a Civil Money Penalty
Proposed rule: Under proposed Sec. 160.404(a), the penalty amount
would be determined through the method provided for in proposed Sec.
160.406, using the factors set forth in proposed Sec. 160.408, and
subject to the statutory caps reflected in proposed Sec. 160.404(b)
and any reduction under proposed Sec. 160.412. The proposed regulation
would not establish minimum penalties. Proposed Sec. 160.404 would
follow the language of the statute and establish the maximum penalties
for a violation and for violations of an identical requirement or
prohibition during a calendar year, as set forth in the statute--up to
$100 per violation and up to $25,000 for violations of an identical
requirement or prohibition in a calendar year. Proposed Sec.
160.404(b) provided that the term ``calendar year'' means the period
from January 1 through the following December 31.
Under proposed Sec. 160.404(b)(2), a violation of a more specific
requirement or prohibition, such as one contained within an
implementation specification, could not also be counted, for purposes
of determining civil money penalties, as an automatic violation of a
broader requirement or prohibition that entirely encompasses the more
specific one. That is, the Secretary could impose a civil money penalty
for violation of either the general or the specific requirement, but
not both. Proposed Sec. 160.404(b)(2) would not apply where a covered
entity's action results in violations of multiple, differing
requirements or prohibitions within the same HIPAA rule or in
violations of more than one HIPAA rule. Proposed Sec. 160.404(b)(2)
also would not preclude assessing civil money penalties for multiple
violations of an identical requirement or prohibition, up to the
statutory cap.
Final rule: The final rule adopts the provisions of the proposed
rule. Changes to the provisions referenced in this section are
discussed in connection with those provisions.
Comment: While most comments that addressed proposed Sec.
160.404(b)(2) supported it, several comments suggested that a single
set of facts or single activity should not result in the finding of
more than one violation, even of different subparts. According to the
comments, covered entities should not be assessed penalties for
violating more than one provision if all violations arise out of the
same facts or incident. One comment suggested that penalties should not
be doubly assessed for overlapping provisions in other subparts unless
gross misconduct or willful negligence was involved.
Response: We do not count an act that violates overlapping
provisions of a subpart as more than one violation because provisions
that are duplicative in a subpart were written that way as a drafting
convenience and were not intended to establish separate legal
obligations. This rationale, however, does not apply where the legal
obligations are found in different subparts. Further, the different
subparts implement different statutory standards and, thus, impose
separate legal obligations. For example, where a covered entity re-
sells its used computers without scrubbing the hard drives that contain
protected health information, this act may violate several separate
legal obligations under the Security and Privacy Rules: (1) The media
re-use requirement of Sec. 164.310(d)(2)(ii); (2) the safeguards
requirement of Sec. 164.530(c); and (3) to the extent that the
protected health
[[Page 8405]]
information on the drives is accessible by persons to whom it could not
permissibly be disclosed, Sec. Sec. 164.308(a)(4)(i) and 164.502(a).
In such a situation, the act has violated requirements or prohibitions
of different rules promulgated pursuant to different provisions of the
statute, and it is appropriate that such violations be treated
separately. Thus, we decline to extend Sec. 160.404(b)(2) as
suggested.
Further, the same facts may evidence noncompliance with more than
one non-overlapping provision of a subpart and, thus, may result in
multiple violations for which a penalty may be assessed. For example, a
covered entity that makes an impermissible use of protected health
information may also, by virtue of the impermissible use, have violated
the Privacy Rule's minimum necessary and/or reasonable safeguard
provisions.
We also note that, in some cases, a violation of one requirement or
prohibition may produce consequential violations, and such cases would
not come within Sec. 160.404(b)(2). For example, Sec. 164.308(a)
requires covered entities to conduct security risk analyses. The
security risk analysis is the foundation of the covered entity's
security risk management plan and is one of the bases which it must
take into account in deciding not to implement addressable
implementation specifications under the Security Rule. If a covered
entity does not do a security risk analysis, it has no basis for not
implementing the addressable implementation specifications under the
Security Rule, and any failure to implement such specifications could,
thus, be considered a violation. Thus, while the failure to conduct the
security risk analysis would be a violation, albeit a continuing one,
of just one provision, it would necessarily result in other violations,
to the extent the covered entity failed to implement the addressable
implementation specifications of the Security Rule.
Comment: One comment suggested that the costs incurred by the
covered entity as a result of the violation should be considered in
calculating the amount of the penalty.
Response: We do not adopt this suggestion for several reasons.
First, we are not certain what costs the comment is suggesting be
considered--the costs associated with committing the violation, the
costs associated with correcting the violation, or both. Second, the
factors to be considered in determining the amount of the penalty for a
violation are set out at section 1128A(d) and are implemented in this
rule by Sec. 160.408. ``Costs incurred by the covered entity as a
result of the violation'' is not a concept that fits squarely within
any of the statutory factors. Third, to the extent consideration of
such costs is reasonable, it would seem to be relevant only to the
criterion for waiver under Sec. 160.412 (``the extent that payment of
the penalty would be excessive relative to the violation''); insofar as
that criterion weighs the seriousness of the effect of the violation,
costs associated with correcting the violation might in certain
circumstances be a relevant factor to be considered.
3. Section 160.406--Number of Violations
Proposed rule: Proposed Sec. 160.406 would establish the general
rule that the Secretary will determine the number of violations of an
identical requirement or prohibition by a covered entity by applying
any of the variables of action, person, or time, as follows: (1) The
number of times the covered entity failed to engage in required conduct
or engaged in a prohibited act; (2) the number of persons involved in,
or affected by, the violation; or (3) the duration of the violation,
counted in days. Paragraph (a) of this section would require the
Secretary to determine the appropriate variable or variables for
counting the number of violations based on the specific facts and
circumstances related to the violation, and take into consideration the
underlying purpose of the particular HIPAA rule that is violated. More
than one variable could be used to determine the number of violations
(for example, the number of people affected multiplied by the time
(number of days) over which the violation occurred). The Secretary
would have discretion in determining which variable or variables were
appropriate for determining the number of violations. The preamble to
the proposed rule noted that, under this proposal, the policy for
determining which variable(s) to use for which type of violation would
be developed in the context of specific cases rather than established
by regulation and that subsequent cases would be decided consistently
with prior similar cases.
Final rule: The final rule eliminates the provision for variables
and provides that the number of violations of an identical requirement
or prohibition (termed ``identical violations'') will be determined
based on the nature of the covered entity's obligation to act or not
act under the provision violated, such as its obligation to act in a
certain manner, or within a certain time, or with respect to certain
persons. With respect to continuing violations, a separate violation
will be deemed to occur on each day such a violation continues.
Comment: While two comments supported the proposal, many comments
challenged the variable approach of proposed Sec. 160.406 to
determining the number of violations. In particular, several comments
expressed concern over the broad discretion provided to the Secretary
to determine the number of violations, particularly in light of the
fact that the proposed rule would have prohibited the ALJ from
reviewing the Secretary's choice of variable(s). Further, some comments
were concerned that the Secretary could use multiple variables to
determine the number of violations. It was argued that the proposed
approach was unfair in that it (1) did not allow covered entities to
predict the amount of a civil money penalty that would result from a
violation, and (2) could maximize the penalty to the statutory cap in
virtually any case, which could result in very harsh penalties for
relatively minor offenses. Other comments argued that the variable
approach was inconsistent with the policy of proposed Sec.
160.404(b)(2), prohibiting the double counting of overlapping
regulatory requirements, or was inconsistent with HHS's general
approach to voluntary compliance. It was suggested, for example, that
HHS instead could establish one particular calculation method for each
HIPAA rule or specify the types of violations for which HHS would use a
particular method.
Comments also criticized the variable approach as inconsistent with
the definition of ``violation,'' arguing that the person and time
variables have no logical relationship to a failure to comply, and
thus, would not be appropriate for counting violations. Specifically,
it was argued that since a ``violation'' is defined as a failure to
comply with a requirement or prohibition, by definition a violation is
a failure to take a required action or a failure to refrain from doing
a prohibited act, and, thus, is not defined by the period of time
during which such action or inaction occurs or by the number of people
who may be affected by it. Further, several comments argued that the
action/inaction variable was the only one that was consistent with the
statute, so that penalizing covered entities by using other variables
would be penalizing them for violations that, by definition, do not
exist, which would be inconsistent with Congressional intent, as
expressed in section 1176(a), and inappropriate as a matter of public
policy. It was also argued that the time and person variables look at
qualitative issues and attempt to measure the
[[Page 8406]]
importance of an act or omission; they do not measure where an act is
quantitatively extensive--i.e., repeated or prolonged. It was argued
that qualitative considerations are treated, under the statute, as
aggravating or mitigating factors, not as questions of the quantity of
violations, as is done under the variable approach.
Response: It was not our intent to suggest that the variables we
proposed would be employed in a manner unrelated to the nature of the
underlying violation, as assumed by many of the comments. However,
since we agree that the manner in which the number of identical
violations should be determined will depend on the nature of the
provision violated, and the provision for variables was confusing and
susceptible to misinterpretation, we have eliminated the explicit
requirement to use the person, time, and action variables. The final
rule instead makes clear that the Secretary will determine the number
of identical violations based on the nature of the obligation of the
covered entity to act (or not act) under the provision violated. While
we agree, in principle, that the definition of ``violation'' looks to
an action or a failure to act as the essence of a violation, defining
what particular act or failure to act constitutes the specific
violation in question will necessarily require looking at the
substantive provision involved and determining what the covered entity
was legally obligated to do. We do not agree, in this regard, that the
elements of ``people'' and ``time'' are always irrelevant to a failure
to comply or that consideration of these elements would result in
double counting of violations. Rather, the precise nature of the
covered entity's obligation will, as discussed below, in many cases be
a function of to whom the obligation is owed or the manner in which it
must be performed or other elements. Thus, we include in the regulation
examples of elements that should be considered, as appropriate, in
construing a provision to determine a covered entity's obligation
thereunder. We believe that this approach, under which the number of
violations is grounded in the language of the provision violated, is
wholly consistent with the statutory scheme.
In many cases, applying this principle should not be difficult. For
example, the Privacy Rule requires that covered entities have contracts
or other arrangements in place with its business associates to assure
the privacy of protected health information, and specifies what must
(and may not) be included in the contract or other arrangement to do
so. See Sec. 164.504(e). Two such provisions are that the contract may
not authorize the business associate to use or further disclose the
information in a manner that would violate the Privacy Rule, if done by
the covered entity, and that the contract must provide that the
business associate will use appropriate safeguards to prevent use or
disclosure of the information other than as provided for by the
contract. See Sec. 164.504(e)(2)(i) and 164.504(e)(2)(ii)(B). If a
covered entity enters into five contracts with business associates that
authorize the business associates to use protected health information
in a manner not permitted by the Privacy Rule and that do not require
the business associates to use appropriate safeguards to protect the
information, the covered entity will have committed five violations of
each of the two separate requirements. Similarly, the Transactions Rule
prohibits covered entities from entering into trading partner
agreements that would change the use of a data element in a standard or
add data elements not contained in the standard. See Sec. 162.915(a),
(b). If a health plan were, by trading partner agreement, to require
200 providers to use a data element in a given transaction in a manner
that was inconsistent with the standard, and also required the use of
another data element that was not part of the standard, we would view
each inconsistent requirement in the trading partner agreement as a
separate violation. The regulation prohibits the adoption of certain
terms in trading partner agreements, so each noncompliant term in each
agreement would constitute a separate violation, resulting in 200
violations of each of these requirements.
With respect to the transactions standards themselves, however, we
anticipate defining the requirement violated to be the requirement to
conduct a standard transaction. While one could view each required data
element in a transaction as a separate requirement, because the
Implementation Guide for each transaction is incorporated by reference
into the regulation, one could also view the underlying Implementation
Guides as functioning simply to describe what constitutes compliance in
a particular case, rather than establishing separate compliance
requirements. While we believe that either interpretation of the
Transactions Rule is permissible, we expect to take the latter view of
the Rule, to facilitate the predictability of determining violations
under that Rule. Thus, we would count each noncompliant transaction as
a single violation, regardless of the number of missing data elements.
For example, if a health plan is found to have conducted 200
eligibility transactions which are missing several required data
elements, the health plan would have committed 200 violations of one
identical requirement (i.e., the requirement at Sec. 162.923(a) to
conduct a covered transaction as a standard (i.e., compliant)
transaction).
In some cases, determining how many times a provision has been
violated will be a function of the number of individuals or other
entities affected, because the covered entity's obligation is to act in
a certain manner with respect to certain persons. We include the term
``persons'' in the list of examples in Sec. 160.406 to make clear that
such consideration may be appropriate. It may include not only
individuals, but also other covered entities, their workforce members,
or trading partners, where the obligation in question relates to such
types of persons. For example, assume that a covered entity
impermissibly allows a workforce member to access the protected health
information of 20 patients whose information is stored on a computer
file. The question is whether this set of facts constitutes one
violation or 20 violations of Sec. 164.502(a), which prohibits
impermissible uses or disclosures of protected health information.
Since the covered entity has an obligation with respect to each patient
to protect his or her protected health information, the sharing of the
20 patients' protected health information with the employee constitutes
a separate impermissible use, or violation, of Sec. 164.502(a) with
respect to each patient.
Some provisions embody a requirement or prohibition that is of an
ongoing nature or for which timeliness is an element of compliance. We
characterize violations of such a requirement or prohibition as
continuing violations. In such cases, the covered entity's obligation
to act continues over time, and, if it fails to take the required
action, that failure to comply also continues over time. Thus, there
needs to be a way of determining how such compliance failures are
measured. We have decided to count such failures in days, as each day
represents a new opportunity to correct the compliance failure.
Accordingly, we have included, in the second sentence of Sec. 160.406,
language that establishes that continuing violations will be counted by
days for purposes of determining how many violations of an identical
requirement or prohibition occurred.
[[Page 8407]]
For example, the Security Rule requires covered entities to
implement many types of policies and procedures. Under Sec.
164.308(a)(4)(i), for example, a covered entity is required to
implement policies and procedures for authorizing access to electronic
protected health information that are consistent with the applicable
requirements of the Privacy Rule. The implementation of such policies
and procedures is an ongoing obligation and, thus, any failure to adopt
them is a continuing violation. As another example, a covered entity
generally is required by Sec. 164.524 to act on a request by an
individual for access to his or her protected health information no
later than 30 days after the request is received. Thus, each day beyond
the 30-day period a covered entity fails to provide such access would
be a separate violation.
In contrast, situations in which the violation is a discrete act
would not be continuing violations. The transaction example above
illustrates violations that are discrete acts. Similarly, where a
health plan violates Sec. 162.925(a)(2) by rejecting transactions
because they are standard transactions, each rejection would constitute
a discrete act. The example above of the workforce member who
impermissibly accesses protected health information likewise is an
example of violations that are discrete acts.
As explained above, determining the number of violations in a
particular case will depend, necessarily, on the precise provision
violated and a covered entity's obligations thereunder. The examples
above should assist covered entities in understanding their potential
liability. These examples also illustrate that determining the number
of violations may implicate a number of elements depending on the
underlying provision violated, such as whether a covered entity had an
obligation with respect to each person, or the amount of time that had
elapsed with respect to a continuing violation, or a combination of
these or other elements. While the final rule does not adopt the
variable approach of the proposed rule, it does not preclude
consideration of multiple elements in determining what constitutes the
violation and, thus, the number of violations.
Comment: Several comments challenged the preamble statement that
future cases would be decided consistently with prior similar cases.
One comment suggested that giving HHS discretion to determine the
variables used in counting violations, yet saying that future cases
will be consistent with past use of variable in similar violations,
creates conflict. Other comments asked whether and how a covered entity
would be able to challenge the selection of variable(s) based on the
variables used in similar cases, if the facts of prior cases were not
publicized, so that covered entities could determine how prior
violations had been counted. Thus, comments requested that tracking of
decided cases and the use of variables for each provision be assigned
to a central entity within HHS, or that this information be made
available to covered entities via the HHS Web sites.
Response: With respect to the comments regarding the preamble
statement in the proposed rule that future cases would be decided
consistently with prior similar cases, we clarify that the number of
violations of a particular provision will be determined in a similar
manner each time a case presents a violation of that particular
provision, with due regard to the individual facts and circumstances of
the case. In addition, as discussed below, the final rule eliminates
the prohibition on ALJ review of the Secretary's choice of variable.
Thus, under the final rule, the ALJ may review the Secretary's method
of determining the number of violations for consistency or other
purposes. With respect to a covered entity's ability to challenge the
Secretary's method of determining the number of violations, HHS will
make available for public inspection and copying final decisions
imposing civil money penalties and may publish such decisions on its
HIPAA Web sites. (This is discussed below in connection with Sec.
160.426.) Thus, covered entities will be able to ascertain the
application of the penalty provisions where penalties are imposed.
Comment: One comment suggested that there be a limit on the number
of violations determined based upon the monetary impact the fine will
have on the covered entity.
Response: A change is not necessary, as the statute and regulation
already provide two points at which the financial impact of a civil
money penalty on a covered entity may be considered--in connection with
(1) the statutory factors (section 1128A(d), implemented in this rule
by Sec. 160.408) and (2) waiver (section 1176(b)(4), implemented in
this rule by Sec. 160.412).
Comment: Two comments suggested that the Secretary should consider
whether or not the covered entity has enacted and completed a
corrective action plan when determining the number of violations.
Response: Completion of a corrective action plan does not relate to
determining the number of occurrences of a violation, so we do not
include it as part of Sec. 160.406. However, HHS would consider any
such action prior to imposition of a civil money penalty for purposes
of determining whether there is a basis for informal resolution of the
complaint. In addition, this fact is taken into account in determining
whether the penalty should be imposed at all, insofar as it pertains to
the ``reasonable cause'' defense under section 1176(b)(3) and Sec.
160.410(b)(3), since an element of that defense is whether the
``failure to comply'' has been corrected.
4. Section 160.408--Factors Considered in Determining the Amount of a
Civil Money Penalty
Proposed rule: Section 1176(a)(2) states that, with some
exceptions, the provisions of section 1128A of the Act shall apply to
the imposition of a civil money penalty under section 1176 ``in the
same manner as'' such provisions apply to the imposition of a civil
money penalty under section 1128A. Section 1128A(d) requires that--
In determining the amount of * * * any penalty, * * * the
Secretary shall take into account--
(1) The nature of the claims and the circumstances under which
they were presented,
(2) The degree of culpability, history of prior offenses and
financial condition of the person presenting the claims, and
(3) Such other matters as justice may require.
While the factors listed in section 1128A(d) were drafted to apply
to violations involving claims for payment under federally funded
health programs, HIPAA violations usually will not concern claims.
Thus, we proposed to tailor the section 1128A(d) factors to the HIPAA
rules and break them into their component elements for ease of
understanding and application, as follows: (1) The nature of the
violation; (2) the circumstances under which the violation occurred;
(3) degree of culpability; (4) history of prior offenses; (5) financial
condition of the covered entity; and (6) such other matters as justice
may require. Proposed Sec. 160.408 provided detailed factors, within
the categories stated above, to consider in determining the amount of a
civil money penalty. However, the proposed rule would not label any of
these factors as aggravating or mitigating. Rather, proposed Sec.
160.408 listed factors that could be considered either as aggravating
or mitigating in determining the amount of the civil money penalty. The
proposed approach would allow the Secretary to choose whether to
consider a particular factor and how to consider each factor as
appropriate in each
[[Page 8408]]
situation to avoid unfair or inappropriate results. It also would leave
to the Secretary's discretion the decision regarding when aggravating
and mitigating factors will be taken into account in determining the
amount of the civil money penalty.
Final rule: The final rule adopts the provisions of the proposed
rule, with a minor clarification. Section 160.408(d) is revised to
clarify that the prior history to be considered relates to prior
compliance with, and violations of, the administrative simplification
provisions.
Comment: A number of comments supported the provision for
mitigating factors and urged that it be retained in the final rule.
Response: We agree and have done so. See Sec. 160.408 below.
Comment: A number of comments raised concerns or recommendations
related to a covered entity's history of compliance. For example,
several urged that HHS consider as a factor whether the covered entity
has initiated correction action, and whether such action was performed
independently and prior to contact from HHS. Some comments also
requested that HHS consider any evidence of a covered entity's good
faith attempts to comply with the administrative simplification
requirements or that HHS take into consideration a history of prior
controls. One comment stated that the phrase ``history of prior
offenses'' in proposed Sec. 160.408(d) was vague and requested that
HHS revise the provision to clarify that it refers only to prior
violations by a covered entity of the HIPAA rules, and not to prior
offenses unrelated to the HIPAA rules. Another comment expressed
concern with the provision at proposed Sec. 160.408(d)(4), which would
allow HHS to consider as a factor in determining the amount of a civil
money penalty how the covered entity has responded to prior complaints,
as well as the preamble statement that such factor could include
complaints raised by individuals directly to the covered entity. The
comment argued that the manner in which a covered entity responded to
previous complaints about matters unrelated to the violation at issue,
or to complaints raised by individuals, may be irrelevant and unfairly
prejudicial.
Response: With respect to corrective action by a covered entity,
HHS would consider any such action prior to imposition of a civil money
penalty for purposes of determining whether there is a basis for
informal resolution of a complaint. In addition, corrective actions of
the covered entity are taken into account in determining whether the
covered entity has established an affirmative defense to the violation
as provided for under Sec. 160.410(b)(3). Nonetheless, where the
corrective action is taken in response to a complaint from an
individual, the final rule at Sec. 160.408(d)(4) provides the
Secretary with authority to consider such corrective action as a factor
in determining a civil money penalty.
With respect to a covered entity's good faith attempt to comply
with the HIPAA provisions and rules, we agree that such actions could
be mitigating factors depending on the circumstances and, thus, have
revised the rule to clarify that a covered entity's history of prior
compliance generally may be considered, which could include, as
appropriate, prior violations, as well as prior compliance efforts. In
addition, we agree that Sec. 160.408(d) should apply only to
violations of the HIPAA rules, and not to offenses of other provisions
of law. Accordingly, we have revised the language of Sec. 160.408(d)
to substitute the term ``violations''--which is defined at Sec.
160.302 as a failure to comply with an administrative simplification
provision--for the term ``offenses'' in the proposed rule.
Finally, we disagree that only those prior violations that are
relevant to the issue at hand should be considered. While greater
attention may be given to those violations that are similar in nature
to the violation at issue, a covered entity's history of HIPAA
compliance generally is relevant to determining whether the amount of a
civil money penalty should be increased or decreased.
Comment: One comment urged that the size of the covered entity not
be used as a factor in determining the amount of a civil money penalty,
arguing that larger covered entities should not be subject to greater
penalties for violations identical to those of smaller entities. The
comment stated that, depending on the way the number of violations is
calculated, larger covered entities are already subject to greater risk
since more patients potentially could be affected by one act or
omission. Another comment asked what financial information would be
required of a respondent to make a showing of its financial condition
and whether, given that section 1128A provides that the Secretary shall
take into account financial condition, the burden is on HHS to do so
even if the respondent does not. Another comment asked how the
financial condition of a covered entity is to be assessed.
Response: With respect to the first comment, no change is made in
the final rule. The size of the covered entity is relevant in
considering, under Sec. 160.408(e)(1), whether a covered entity
experienced financial difficulties affecting its ability to comply, and
under Sec. 160.408(e)(2), whether the imposition of a civil money
penalty would jeopardize a covered entity's ability to provide or pay
for health care. In response to the second comment, the showing that a
covered entity must make of its financial condition will vary depending
on the circumstances. However, a respondent may provide whatever
information it believes relevant to such a determination should it
desire that HHS consider the entity's financial condition as a
mitigating factor. Should a respondent fail to raise financial
condition as a mitigating factor (or any other mitigating factor),
however, HHS is under no obligation to raise the issue. See Sec.
160.534(b)(1)(ii).
With respect to how financial condition is assessed, the
Departmental Appeals Board (Board) has considered this issue in other
cases litigated under section 1128A. The Board has said that an inquiry
into a provider's financial condition should be focused on whether the
provider can pay the civil money penalty without being put out of
business. See Milpitas Care Center, DAB No. 1864 (2003). In Capitol
Hill Community Rehabilitation and Specialty Care Center, DAB CR 469
(1997), aff'd, DAB No. 1629 (1997), the Board construed a regulation
(42 CFR 488.438(f)(2)) that lists a facility's ``financial condition''
as one of the factors that must be considered in deciding the amounts
of civil money penalties. The Board stated that, while the term
``financial condition'' is not defined in the regulations, the plain
meaning of the term is that a facility's ``financial condition'' is its
overall financial health. Thus, the relevant question to be considered
in deciding whether a facility's financial condition would permit it to
pay civil money penalties is whether the penalty amounts would
jeopardize the facility's ability to survive as a business entity.
Comment: One comment argued that proposed Sec. 160.408 should
establish that HHS can only consider mitigating factors to determine
the amount of the civil money penalty and not as a basis for waiving
the penalty altogether. The comment stated that proposed Sec. 160.410
already establishes circumstances under which HHS may not impose a
fine, and it would be unreasonable to extend those circumstances.
Response: The final rule does not expand the circumstances under
which the Secretary is prohibited from imposing, or may waive, a civil
money penalty under Sec. Sec. 160.410 and 160.412,
[[Page 8409]]
respectively. The factors in Sec. 160.408 may be applied to determine,
as appropriate, whether to increase or decrease the amount of a civil
money penalty.
Comment: One comment expressed concern that the overlap of certain
variables in proposed Sec. 160.406 with factors in proposed Sec.
160.408 (e.g., the variable for the duration of the violation counted
in days versus the factor for the time period during which the
violation occurred) could result in compounding the penalty.
Response: We disagree that providing for both counting continuing
violations in days and taking time into account under Sec. 160.408 is
inappropriate. The provision for counting continuing violations in days
relates to determining how many times violation of an identical
provision occurred; the provision for considering the time period of
the violation is one element, among others, that may constitute a
mitigating or aggravating factor in determining the amount of a civil
money penalty. While it is true that length of time will tend to
operate in the same direction (i.e., to reduce or enlarge the penalty)
with respect to each of these elements of the penalty calculation,
these two elements are different in nature, and time is relevant to
both.
Comment: One comment that supported the list of factors in proposed
Sec. 160.408 nonetheless recommended that we better describe the
factors in the preamble. Another comment requested examples of what may
be included in the factor of ``[s]uch other matters as justice may
require'' proposed at Sec. 160.408(f).
Response: With respect to the first comment, the factors themselves
are particularized and, thus, are fairly self-explanatory. However,
where questions about the factors were raised in the public comments,
we have provided further guidance in our responses in this preamble.
With respect to the ``such matters as justice may require'' factor,
many different circumstances have been cited for consideration in prior
cases in other areas in which this factor applies. For example, ALJs
have been asked to consider the following types of circumstances under
this factor: the respondent's trustworthiness, the respondent's lack of
veracity and remorse, measurable damages to the government, indirect or
intangible damages to the government, the effect of the penalty on
respondent's rehabilitation, and unprompted diligence in correcting
violations.
5. Section 160.410--Affirmative Defenses to the Imposition of a Civil
Money Penalty
Section 160.410 implements sections 1176(b)(1)-(3) of the Act.
These sections specify certain limitations on when civil money
penalties may be imposed. Paragraphs (1), (2), and (3) of section
1176(b) each state that, if the conditions described in those
paragraphs are met, a penalty may not be imposed under subsection (a)
of section 1176. Under section 1176(b)(1), a civil money penalty may
not be imposed with respect to an act if the act constitutes a criminal
offense punishable under section 1177 of the Act. Under section
1176(b)(2), a civil money penalty may not be imposed if it is
established to the satisfaction of the Secretary that the person who
would be liable for the penalty did not know, and by exercising
reasonable diligence would not have known, that such person violated
the provision. Under section 1176(b)(3), a civil money penalty may not
be imposed if the failure to comply was due to reasonable cause and not
to willful neglect and is corrected within a certain period. The period
of time to correct a failure to comply may be extended as determined
appropriate by the Secretary based on the nature and extent of the
failure to comply.
Proposed rule: Proposed Sec. 160.410 would characterize the
limitations under section 1176(b)(1), (2), and (3) as ``affirmative
defenses,'' to make clear that they must be raised in the first
instance by the respondent. In order not to preclude the raising of
affirmative defenses that could legitimately be raised, the
introductory text of proposed Sec. 160.410 would permit a respondent
to offer affirmative defenses other than those provided in section
1176(b).
Under proposed Sec. 160.410(a), several terms relevant to the
affirmative defenses would be defined: ``Reasonable cause,''
``reasonable diligence,'' and ``willful neglect.'' ``Reasonable cause''
would be defined as ``circumstances that make it unreasonable for the
covered entity, despite the exercise of ordinary business care and
prudence, to comply with the administrative simplification provision
violated.'' ``Reasonable diligence'' would be defined as ``the business
care and prudence expected from a person seeking to satisfy a legal
requirement under similar circumstances.'' ``Willful neglect'' would be
defined as ``conscious, intentional failure or reckless indifference to
the obligation to comply with the administrative simplification
provision violated.''
Proposed Sec. 160.410(b)(1) simply referred to section 1177.\2\
Proposed Sec. 160.410(b)(2) generally tracked the statutory language,
but also provided that whether or not a covered entity possesses the
requisite knowledge to make this affirmative defense inapplicable would
be ``determined by the federal common law of agency.'' The text of
proposed Sec. 160.410(b)(3) used the defined term ``reasonable
diligence'' and, thus, would build on the analysis conducted under
proposed Sec. 160.410(b)(2). Proposed Sec. 160.410(b)(3)(ii)(B) would
follow the statutory language and would permit the Secretary to use the
full discretion provided by the statute in extending the statutory cure
period.
---------------------------------------------------------------------------
\2\ Section 1177(a) provides that a person who knowingly and in
violation of this part uses or causes to be used a unique health
identifier, obtains individually identifiable health information
relating to an individual, or discloses individually identifiable
health information relating to another person shall be punished as
provided in subsection (b). Section 1177(b) sets out three levels of
penalties that vary depending on the circumstances under which the
offense was committed.
---------------------------------------------------------------------------
Final rule: The final rule adopts the provisions of the proposed
rule. A related change is made to Sec. 160.504(c), as discussed below.
a. Section 160.410(b)--General Rule
Comment: One comment asked whether a covered entity could challenge
in a hearing the reasonableness of the Secretary's finding that an
affirmative defense has not been sufficiently established.
Response: A respondent may challenge in a hearing the finding in a
notice of proposed determination that an affirmative defense has not
been established. See Sec. 160.534(b)(1)(i), which provides that the
respondent bears the burden of proof with respect to affirmative
defenses.
Comment: Two comments noted that the preamble to the proposed rule
(70 FR 20237) would allow a covered entity to raise affirmative
defenses in addition to those listed under Sec. 160.410(b), but that
the text of the proposed rule would not allow for additional defenses.
They asked that the final rule be revised to allow a covered entity to
present affirmative defenses not expressly listed in Sec. 160.410(b).
One comment contended, however, that Sec. 160.410 would allow covered
entities too many opportunities to avoid a penalty.
Response: The introductory text of Sec. 160.410(b) permits other
affirmative defenses to be raised by using the phrase ``including the
following.'' While we do not delineate what additional affirmative
defenses might be raised, the ``[e]xcept as provided in subsection
(b)''
[[Page 8410]]
language of section 1176(a)(1) suggests that they are limited.
Nonetheless, the statute clearly contemplates at least one defense
other than the limitations set out at section 1176(b)--the statute of
limitations provision at section 1128A(h). Statutes of limitations
defenses are typically treated as affirmative defenses, see Fed. R.
Civ. P. 8(c). (28 U.S.C. Appendix). Thus, we believe that provision for
other affirmative defenses that may be fairly implied from the HIPAA
provisions or section 1128A must be made and, accordingly, have done
so.
We do not eliminate the affirmative defenses that may be raised and
that are provided for by Sec. 160.410, as suggested by the final
comment above. We have no authority to eliminate a limitation that the
statute imposes on our authority to impose civil money penalties,
whether or not it has the effect complained of.
Comment: One comment suggested that Sec. 160.410(b) should be
revised to state that the Secretary ``shall not'' impose a civil money
penalty. The comment stated that if a covered entity establishes an
affirmative defense, the Secretary should not have discretion to impose
a penalty as indicated by the current wording ``may not impose.''
Response: We do not make the suggested change, because the present
wording accomplishes what the comment urges. The phrase ``may not
impose'' means, in this context, ``is not permitted to impose.'' We do
not change the language here, as it is consistent with the usage in the
HIPAA rules generally, and we do not wish to suggest an inconsistency
or a different meaning for similar prohibitions in other HIPAA rules.
b. Section 160.410(b)(1)--``Criminal Offense'' Affirmative Defense
Comment: Several comments expressed concern that covered entities
are being forced to incriminate themselves if they raise the
affirmative defense under Sec. 160.410(b)(1) in the request for
hearing under Sec. 160.504. These comments stated that covered
entities should be able to raise this defense after a case has been
referred to the Department of Justice, on the theory that section
1176(b)(1) operates as a jurisdictional bar to the imposition of a
civil money penalty. One comment cited the Memorandum for Alex M. Azar
II and Timothy J. Coleman from Stephen G. Bradbury, Re: Scope of
Criminal Enforcement Under 42 U.S.C. 1320d-6 (June 1, 2005) (Justice
Memorandum). The Justice Memorandum is available at http://www.usdoj.gov/olc/hipaa_final.htm. The comment cited the Justice
Memorandum for the proposition that this section of the statute
operates as an absolute bar to imposition of a civil money penalty,
rather than as an affirmative defense. Several comments argued that the
burden of establishing that the limitation of section 1176(b)(1)
applied should be on HHS, not on the respondent, as a matter of
fairness.
Response: We continue to be of the view that the statute is
structured to make the limitation of section 1176(b)(1) a defense that
must be raised by the respondent. The fact that meeting the condition
described in this subsection operates to bar the imposition of a civil
money penalty does not distinguish it from the limitations provided for
by sections 1176(b)(2) and 1176(b)(3), and those sections of the
statute clearly are defenses which the respondent should raise.
Moreover, the burden of establishing that section 1176(b)(1) applied
could never be on HHS, as that would require HHS to carry the burden of
proving a fact that would defeat its claim; it is the respondent, not
HHS, who, in the context of the hearing, will be the proponent of the
claim that the act for which a civil money penalty is sought is a
criminal offense.
However, we recognize that section 1176(b)(1) could potentially
present a situation of some difficulty for a respondent, where the
Department of Justice is considering a referral related to the
violations on which the civil money penalty action has been brought.
While the requirement that civil money penalties be authorized by the
Department of Justice before they are brought should prevent such
situations from arising, we cannot assume that they will never arise.
Accordingly, we provide that, unlike the other affirmative defenses,
which are waived if not raised in the request for hearing, this
affirmative defense may be raised at any time during the administrative
proceedings, to permit respondents to better manage such legal risks,
should they ever arise. Provision for this is made in Sec. 160.504(c),
and a conforming change is made to Sec. 160.548(e).
Comment: One comment stated that the fact of referral to the
Department of Justice should constitute conclusive evidence that the
act is one ``punishable'' under section 1177, even if the Department of
Justice declines to prosecute (so that the act is not ``punished''
under section 1177).
Response: We do not agree. Referral to the Department of Justice
constitutes, at most, our preliminary assessment that the act in
question may be subject to criminal prosecution. The Department of
Justice may not agree with our preliminary assessment and may return
the case to us for administrative action.
Comment: One comment requested that knowledge under section 1177 be
defined.
Response: ``Knowingly'' is the term used in section 1177 of the Act
(``A person who knowingly and in violation of this part * * * '').
According to the Office of Legal Counsel of the United States
Department of Justice, `` `the term `knowingly' merely requires proof
of knowledge of the facts that constitute the offense.' '' Justice
Memorandum, at 11, quoting U.S. v. Bryan, 524 U.S. 184, 193 (1998).
c. Section 160.410(b)(2)--``Lack of Knowledge'' Affirmative Defense
Comment: One comment asks HHS to clarify the definition of
knowledge required for a civil money penalty to be imposed.
Response: Under section 1176(b)(2), a civil money penalty may not
be imposed for a violation ``if it is established to the satisfaction
of the Secretary that the person liable for the penalty did not know *
* * that such person violated the provision.'' As we observed at 70 FR
20237--
This language on its face suggests that the knowledge involved
must be knowledge that a ``violation'' has occurred, not just
knowledge of the facts constituting the violation. * * * We, thus,
interpret this knowledge requirement to mean that the covered entity
must have knowledge that a violation has occurred, not just
knowledge of the facts underlying the violation.
Comment: One comment asked whether, if a covered entity were found
not to be liable because the knowledge of an agent could not be imputed
to it, the individual committing the violation would be held liable for
the penalty.
Response: The Enforcement Rule provides that only a covered entity
is liable for a civil money penalty under section 1176. See Sec.
160.402(a) and the definition of ``respondent'' at Sec. 160.302.
Comment: One comment contended that the phrase ``to the
satisfaction of the Secretary'' should be stricken from proposed Sec.
160.410(b)(2). The comment stated that this phrase would preclude the
covered entity from raising an argument before the ALJ that the
Secretary did not properly consider their affirmative defenses before
imposing a penalty. Another comment asked whether this phrase makes the
finding totally discretionary and, thus, unreviewable by the ALJ.
Response: This language is statutory, as may be seen at section
1176(b)(2), set out above. Further, as discussed above, a respondent
may raise affirmative defenses in a hearing. Where so raised,
[[Page 8411]]
the ALJ's decision as to whether the covered entity lacked knowledge
would become the decision of the Secretary, unless reversed on
subsequent appeal.
Comment: One comment asked, with respect to imputing knowledge to
the covered entity, who would be considered to be a ``responsible
officer or manager'' and whether a Privacy Officer is considered a
``responsible officer or manager.''
Response: With respect to who would be considered to be a
responsible officer or manager and whether a Privacy Officer would be
considered a responsible officer or manager, see the discussion above
under Sec. 160.402(c).
Comment: One comment asked whether, if a Privacy Officer mitigates
or corrects a violation, that action would satisfy the requirement that
a responsible officer or manager be made aware of the violation.
Response: We are unsure what the precise concern of this comment
is, as the issue of knowledge typically would arise in the context of
the ``lack of knowledge'' affirmative defense. That defense requires,
for its application, that the covered entity not have actual or
constructive knowledge of the violation. If the violation has been
corrected, as the comment suggests, one would normally presume that the
covered entity knew of the violation, making the lack of knowledge
defense unavailable. Under the scenario posed by the comment, as we
understand it, the issue would be whether the elements of the
``reasonable cause'' affirmative defense were present.
d. Section 160.410(b)(3)--``Reasonable Cause'' Affirmative Defense
Comment: One comment asked that the word ``corrected'' in Sec.
160.410(b)(3)(ii) be changed to ``mitigated,'' because not all
violations can be fully corrected.
Response: We agree with the comment that not all violations of the
HIPAA rules can be fully corrected, in the sense of being undone or
fully remediated. However, we do not agree that the term ``corrected,''
which is the term used by the statute, need be read so narrowly.
Rather, the statute speaks of the ``failure to comply'' being
corrected. Thus, the term ``corrected,'' as used in the statute, could
include correction of a covered entity's noncompliant procedure by
making the procedure compliant. In any event, since the term
``corrected'' is the term used in the statute, we employ it in the rule
below.
Comment: One comment requested clarification as to how a covered
entity could ask for an extension of time to cure a violation under
Sec. 160.410(b)(3)(ii)(B).
Response: The covered entity should make this request in writing
to, as applicable, CMS or OCR. The request should state when the
violation will be corrected and the reasons that support the need for
additional time.
Comment: One comment asked that the 30-day cure period be extended
by an additional 30 days.
Response: The initial cure period is, by statute, 30 days. However,
section 1176(b)(3)(B)(i) permits the Secretary to extend the initial
cure period ``as determined appropriate by the Secretary based on the
nature and extent of the failure to comply.'' Section
160.410(b)(3)(ii)(B) adopts, and does not expand upon, this statutory
language. Thus, HHS could extend the cure period for an additional 30
days (or some greater or lesser period), if it were determined
appropriate to do so.
6. Section 160.412--Waiver
Section 1176(b)(4) of the Act provides for waiver of a civil money
penalty in certain circumstances. Section 1176(b)(4) provides that, if
the failure to comply is ``due to reasonable cause and not to willful
neglect,'' a penalty that has not already been waived under section
1176(b)(3) ``may be waived to the extent that the payment of such
penalty would be excessive relative to the compliance failure
involved.'' If there is reasonable cause and no willful neglect and the
violation has been timely corrected, the imposition of the civil money
penalty would be precluded by section 1176(b)(3). Therefore, waiver
under this section would be available only where there was reasonable
cause for the violation and no willful neglect, but the violation was
not timely corrected.
Proposed rule: Proposed Sec. 160.412 did not propose to elaborate
on the statute in any material way. This provision would provide the
Secretary with the flexibility to utilize the discretion provided by
the statutory language as necessary.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment suggested that this section be removed
entirely. The comment stated that section 1176(b)(4) authorizes, but
does not compel, the Secretary to allow for waiver of civil money
penalties. The comment argued that waiver is an unnecessary avenue for
covered entities to avoid penalties, as the statute and the proposed
rule would provide so many other avenues by which a covered entity
could avoid being penalized for violations.
Response: As was more fully discussed at 70 FR 20239, the statute,
in our view, creates a statutory right for covered entities to request
a waiver, where a violation is due to reasonable cause and not willful
neglect, but has not been corrected within the statutory cure period
(including any extensions thereof). While the grant of a waiver is
within the agency's discretion, the statute clearly contemplates that
covered entities may request a waiver in such circumstances and that
HHS must consider the request. Accordingly, we do not make the change
suggested.
7. Section 160.414--Limitations
Proposed rule: Proposed Sec. 160.414 was adopted by the April 17,
2003 interim final rule as Sec. 160.522. We proposed to move this
section, which sets forth the six-year limitation period provided for
in section 1128A(c)(1), from subpart E to subpart D, because this
provision applies generally to the imposition of civil money penalties
and is not dependent on whether a hearing is requested. We also
proposed to change the language of this provision so that the date of
the occurrence of the violation is the date from which the limitation
is determined.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment requested clarification of record retention
requirements and their interaction with the time limitation on bringing
an enforcement action.
Response: The issue raised by this comment is discussed in
connection with Sec. 160.310 above.
Comment: One comment suggested shortening the time period to two
years in the interest of accomplishing compliance faster and making
record-keeping less burdensome for covered entities.
Response: The six-year limitations period of Sec. 160.414 is
provided for by statute (section 1128A(c)(1) of the Act), and, thus, is
not within our power to change by regulation. Insofar as this comment
suggests changing the record retention requirements of the Privacy and
Security Rules, the requested change is outside the scope of this
rulemaking.
8. Section 160.416--Authority To Settle
Proposed rule: Proposed Sec. 160.416 was adopted by the April 17,
2003 interim final rule as Sec. 160.510. We proposed to move this
section, which addresses the authority of the Secretary to settle any
issue or case or to compromise any penalty imposed on a covered entity,
from subpart E to subpart D, because this provision
[[Page 8412]]
applies generally to the imposition of civil money penalties, and is
not dependent on whether a hearing is requested. No change was proposed
to the text of the provision.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment expressed concern that this provision does not
provide for alternative dispute resolution. The comment urged HHS to
remain committed to the informal resolution process.
Response: We provide in the rule that HHS will attempt to resolve
compliance issues informally, for the reasons discussed above and in
the preamble to the proposed rule. Where this process is insufficient
to resolve the matter, the statute requires provision of a formal
hearing process, if a hearing is requested. We note that under their
current procedures, the ALJ and/or the Departmental Appeals Board
routinely afford parties the opportunity to engage in alternative
dispute resolution.
Comment: Two comments suggested removing Sec. 160.416 from the
final rule, on the ground that it is inappropriate to give the
Secretary this authority without oversight.
Response: We do not adopt this suggestion. The statute explicitly
gives the Secretary the authority to compromise penalties, which would
typically be done through settlement of the case. See section 1128A(f).
9. Section 160.420--Notice of Proposed Determination
Proposed rule: The text of proposed Sec. 160.420 was adopted by
the April 17, 2003 interim final rule as Sec. 160.514. We proposed to
move this section from subpart E, which sets out the procedures and
rights of the parties to a hearing, to subpart D, because the notice
provided for in this section must be given whenever a civil money
penalty is proposed, regardless of whether a hearing is requested. No
changes, other than conforming changes, were proposed to paragraphs
(a)(1) and (a)(3), (a)(4), or to paragraph (b). We proposed to revise
paragraph (a)(2) by adding that, in the event the Secretary employs
statistical sampling techniques under Sec. 160.536, the sample relied
upon and the methodology employed must be generally described in the
notice of proposed determination. A new paragraph (a)(5) would require
the notice to describe any circumstances described in Sec. 160.408
that were considered in determining the amount of the proposed penalty;
this provision would correspond to Sec. 1003.109(a)(5) of the OIG
regulations. Paragraph (a)(5) of Sec. 160.514 of the April 17, 2003
interim final rule would be renumbered as Sec. 160.420(a)(6).
Final rule: We adopt the section as proposed, except that, where
HHS bases the proposed penalty in part on statistical sampling, a copy
of the report of the agency's statistical expert, rather than just a
description of the study and the sampling technique used, must be
provided with the notice of proposed determination.
Comment: One comment requested clarification as to whether the
notice of proposed determination serves as the notice required by the
statute.
Response: Yes, the notice provided for by Sec. 160.420--the notice
of proposed determination--implements the requirement for notice of
section 1128A(c)(1).
Comment: One comment recommended that the final rule retain Sec.
160.420(a)(5) to ensure that covered entities have sufficient
information as to why the penalty was imposed.
Response: This has been done. See Sec. 160.420(a)(5) below.
Comment: Several comments requested that the rule specify that the
notice of proposed determination will be sent to the covered entity's
Privacy Officer or another designated officer.
Response: This issue is discussed below in connection with Sec.
160.504.
Comment: Several comments stated that, if HHS bases its proposed
penalty on statistical sampling, the notice of proposed determination
should include a copy of the study relied upon, so that a covered
entity has adequate notice and time to prepare its defense.
Response: We agree and have made the requested change.
10. Section 160.422--Failure To Request a Hearing
Proposed rule: The text of proposed Sec. 160.422 was adopted by
the April 17, 2003 interim final rule as Sec. 160.516. We proposed to
add language (``and the matter is not settled pursuant to Sec.
160.416'') to recognize that the Secretary and the respondent may agree
to a settlement after the Secretary has issued a notice of proposed
determination. We also proposed that the penalty be final upon receipt
of the penalty notice, to make clear when subsequent actions, such as
collection, may commence.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: Several comments suggested that a provision should be
added allowing the time frame to request a hearing to be extended when
the notice of proposed determination is not received by the appropriate
person within the covered entity.
Response: This issue is discussed in connection with Sec. 160.504
below.
11. Section 160.424--Collection of Penalty
Proposed rule: The text of Sec. 160.424 was adopted by the April
17, 2003 interim final rule as Sec. 160.518. We proposed to move this
section, which addresses how a final penalty is collected, from subpart
E to subpart D, because this provision applies generally to the
imposition of civil money penalties and is not dependent upon whether a
hearing is requested. The rule provides that once a proposed penalty
becomes final, it will be collected by the Secretary, unless
compromised. The Secretary may bring a collection action in the Federal
district court for the district in which the respondent resides, is
found, or is located. The penalty amount, as finally determined, may be
collected by means of offset from Federal funds or state funds owing to
the respondent. Matters that were, or could have been, raised in a
hearing or in an appeal to the U.S. Circuit Court of Appeals may not be
raised as a defense to the collection action.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment asked what interest rate will accrue, if a
penalty is not paid promptly by the covered entity.
Response: Under the Federal Claims Collection rules, interest is
calculated as provided by 31 U.S.C. 3717. See 31 CFR 901.9.
Comment: One comment asked whether, if a penalty is assessed
against a hybrid entity, the part of the entity responsible for the
violation would pay the penalty or the entire hybrid entity would pay
the penalty.
Response: As noted above, a hybrid entity is, by definition, a
single legal entity. Where a penalty is assessed against a covered
entity that has designated itself as a hybrid entity, the legal entity
that is the covered entity is responsible for payment of the penalty.
How the covered entity allocates the penalty payment as a matter of
internal accounting is a business decision of the covered entity.
Comment: One comment asked whether, if an agency with the same
structure as a Medicaid agency is assessed a penalty, federal dollars
can be withheld in lieu of payment of the penalty.
Response: Yes. Section 1128A(f) provides for setoff of penalty
amounts against Federal or state agency funds then or later owing to
the person penalized.
Comment: One comment suggests that the Secretary does not have the
[[Page 8413]]
authority to preclude issues from being raised in a civil action in
federal court. The comment suggests removing Sec. 160.424(d) from the
final rule.
Response: Section 160.424(d) merely states the well-recognized
principle that, where an administrative remedy exists, a plaintiff must
exhaust that remedy as a precondition to raising the issue in question
in court.
12. Section 160.426--Notification of the Public and Other Agencies
Proposed rule: We proposed to require notification of the public
generally whenever a proposed penalty became final, in order to make
the information available to anyone who must make decisions with
respect to covered entities. The regulatory language would provide for
notification in such manner as the Secretary deems appropriate, which
would include posting to an HHS Web site and/or the periodic
publication of a notice in the Federal Register.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: Several comments argued that the provision for
notification of the public in proposed Sec. 160.426 would extend
beyond the scope of the Secretary's statutory authority under section
1128A(h), since section 1128A(h) specifies only that certain types of
organizations and agencies to be notified. They urged that the
requirement be eliminated.
Response: We disagree that the requirement for public notification
is unauthorized. It is true that Sec. 160.426 establishes the means by
which HHS may carry out its obligation to notify various agencies and
organizations under section 1128A(h). However, the basis for the public
notice portion of Sec. 160.426 lies not in section 1128A(h), as the
comments assumed, but in the Freedom of Information Act (FOIA), 5
U.S.C. 552.
FOIA requires final opinions and orders made in adjudication cases
to be made available for public inspection and copying. See 5 U.S.C.
552(a)(2)(A). The adjudicatory process \3\ set forth in the Enforcement
Rule begins with the service upon the respondent of a notice of
proposed determination under Sec. 160.420. This proposed penalty
becomes final if the respondent fails to contest it in the time and
manner provided in Sec. 160.504(b). If the respondent does contest the
proposed penalty, the final agency order is the decision of the ALJ, or
the Board, as the case may be. While it is true that section 1128A(h)
does not require that such notice be given to the public, neither does
it prohibit such wider dissemination of that information, and nothing
in section 1128A(h) suggests that it modifies the Secretary's
obligations under FOIA. FOIA requires making final orders or opinions
available for public inspection and copying by ``computer
telecommunication * * * or other electronic means,'' which would
encompass putting them up on the Department's Web site, and further
provides that, absent actual and timely notice, in order for the
Department to rely upon final opinions that affect a member of the
public or to cite them as precedent against a party, the opinions or
orders must be indexed and made available electronically. See 5 U.S.C.
552(a)(2).
---------------------------------------------------------------------------
\3\ Under the Administrative Procedure Act, ``adjudication means
agency process for the formulation of an order.'' 5 U.S.C. 551(7).
An ``order means the whole or part of a final disposition * * * of
an agency in a matter other than rule making * * *''. 5 U.S.C.
551(6).
---------------------------------------------------------------------------
Comment: Many comments objected to the requirement for public
notice. Comments argued that since final decisions of the Departmental
Appeals Board are available under FOIA, there is no need for further
notice to the public. Further, it was stated that many HIPAA
violations, particularly of the Transactions Rule, are very technical
in nature and the public may be unable to understand the nature of such
violations. Accordingly, public notification may injure the reputation
of covered entities and cause them to lose business, while the
reputational injury attendant on public notification may be wholly
disproportionate to the violations involved. Also, comments argued that
entities that are members of an affiliated covered entity and that are
held liable for the actions of others under Sec. 160.402(b) may be
unfairly labeled as noncompliant. Finally, comments stated that covered
entities may have to expend additional resources to fight complaints,
because the public notification provision would give competitors an
incentive to use the complaint process to gain an unfair business
advantage.
Response: Final decisions of the ALJs and the Departmental Appeals
Board are made public via the Board's Web site. See http://www.hhs.gov/dab/search.html. Such postings, however, would not include penalties
that become final because a request for hearing was not filed under
Sec. 160.422. Notices of proposed determination under Sec. 160.420
that become final because a hearing has not been timely requested,
would likewise be made available for such public inspection and copying
as final orders. By making the entire final opinion or order available
to the public, the facts underlying the penalty determination and the
law applied to those facts will be apparent. Given that information,
the public may discern the nature and extent of the violation as well
as the basis for imposition of the civil money penalty on the covered
entity. Finally, the process established for the review and
investigation of complaints should identify those without merit, or
over which HHS has no jurisdiction under the HIPAA provisions, but, in
any event, we doubt that the notification provisions of this section
will increase the likelihood that complaints will be filed.
Comment: One comment suggested that, rather than mandating the
provision of notice to the public, the rule should give the Secretary
discretion to determine when public notification is prudent, as doing
so may not be appropriate in all instances--for example, where there is
an ongoing investigation or a technical failure is involved. A number
of comments urged HHS to publish violations of HIPAA without the name
of the covered entity. They argued that this approach would enable
covered entities to understand how OCR and CMS apply the HIPAA rules in
particular circumstances and would, thus, encourage voluntary
compliance.
Response: As noted, under FOIA, we must make final orders and
opinions available for public inspection and copying. FOIA permits the
Secretary to withhold information whose release could, for instance,
reasonably be expected to interfere with prospective or ongoing law
enforcement proceedings, but such exemption does not apply where, as in
the case of such final opinions and orders, they are made after the
conclusion of such proceedings. See 5 U.S.C. 552(b)(7)(A). While FOIA
permits the deletion of identifying details to prevent a clearly
unwarranted invasion of personal privacy, identifying the name(s) of
the covered entities against whom penalties are imposed would not be
such an invasion of personal privacy.
Comment: One comment suggested that the rule be revised to require
covered entities to notify the Secretary and potentially affected
individuals when there is a suspected breach of the Privacy Rule. The
comment also suggested that HHS make available a list of violations
organized by entity, including the number of persons affected by each
violation. One comment asked that all final decisions of the ALJ or the
Board, including those to not assess a penalty, be made public,
[[Page 8414]]
so that covered entities could present a better defense in the future
based on past decisions to not impose a penalty in a similar situation.
Another comment supported the proposal to notify the public of final
penalties, on the ground that the public should be aware of violations,
particularly of the Privacy Rule. Another comment suggested that
complainants should be notified when a penalty is imposed.
Response: As noted, final opinions or orders imposing penalties
will be made available to the public for inspection and copying. Given
that this information will be public, we do not accept the other
comments above.
Comment: One comment stated that the public notification rule
should not apply to, or include, matters referred to the Department of
Justice. Another comment asked that HHS confirm that the public
notification provision would not apply to informal resolutions.
Response: In neither of the above situations has a final order on a
penalty proposed under Sec. 160.420 been entered. Consequently,
neither situation would come within the public notification requirement
of Sec. 160.426.
Comment: Several comments expressed concern that publication of a
penalty could occur prematurely, before all of the covered entity's
appeals had been exhausted. They requested clarification as to when a
penalty is considered final for purposes of notification. A couple of
comments stated that the penalty should be considered to be final, for
purposes of the public notification, when all court appeals have been
exhausted.
Response: A civil money penalty is considered to be final, for
purposes of notification, when it is a final agency action--i.e., the
time for administrative appeal has run or the adverse administrative
finding has otherwise become final. The final opinion or order that is
subject to the notification provisions of this section is the notice of
proposed determination, if a request for hearing is not timely filed,
the decision of the ALJ, if that is not appealed, or the final decision
of the Board.
D. Subpart E--Procedures for Hearings
As previously explained, the provisions of section 1128A of the Act
apply to the imposition of a civil money penalty under section 1176
``in the same manner as'' they apply to the imposition of civil money
penalties under section 1128A itself. The provisions of subpart E are,
as a consequence, based in large part upon, and are in many respects
the same as, the OIG regulations implementing section 1128A. We adapt,
re-order, or combine the language of the OIG regulations in a number of
places for clarity of presentation or to reflect concepts unique to the
HIPAA provisions or rules. To avoid confusion, we also employ certain
language usages in order to be consistent with the usages in the other
HIPAA rules (for example, for mandatory duties, ``must'' or ``will''
instead of ``shall'' is used; for discretionary duties, ``may'' instead
of ``has the authority to'' is used).
Subpart E, as adopted by the April 17, 2003 interim final rule,
adopted provisions relating to investigational inquiries and subpoenas
and certain definitions that have now been moved to subpart C. It also
adopted a number of provisions that relate to all civil money penalties
that have now been moved to subpart D. Subpart E, as revised below,
addresses only the administrative hearing phase of the enforcement
process.
General comment: Several comments argued that the proposed
Enforcement Rule, as a whole, would give the government an unfair
advantage and seriously compromise the ability of covered entities to
defend themselves before an ALJ and on an appeal to the Board. It was
argued that the following provisions, in combination, would ``stack the
deck'' in the government's favor:
(1) The severely restricted ability of covered entities to rebut
the statistical sampling report; (2) the ``extraordinary
circumstances'' standard for failure to timely exchange exhibits and
witness statements; (3) the inability to depose prior to the hearing
or question at the hearing the government's statistical sampling
expert; (4) the ability of the * * * ALJ * * * to admit prior
evidence of witnesses which were not subject to cross examination by
the covered entity; (5) the requirements regarding hearing requests;
(6) the limited nature of discovery and the lack of obligation to
share exculpatory evidence; (7) the ALJ's discretion about applying
the Federal Rules of Evidence; (8) the very broad harmless error
rule which significantly restricts a covered entity's appeal rights;
and (9) the limited authority of the ALJ and correspondingly broad
discretion provided to the Secretary.
Response: While we also discuss the above provisions individually,
we provide the following general response. We do not agree that the
proposed rule would have given HHS an unfair advantage or compromised
the ability of covered entities to defend themselves. Most of the
provisions cited should operate even-handedly, providing no greater
advantage to the government than to the respondent. For example, the
limitation on depositions will also mean that the governmental party
cannot depose any statistical expert of the respondent; similarly, the
other limitations on discovery should operate similarly for both
parties, as should the ALJ's discretion with respect to the application
of the Federal Rules of Evidence and the application of the harmless
error rule.
In any event, we have changed several of the provisions cited. We
have required the government's statistical study to be provided with
the notice of proposed determination, we have clarified the conditions
for the admission of written statements, and we have eliminated the
restriction on the ALJ's authority to review the method by which the
number of violations is determined. We believe that the final rule
strikes an appropriate balance and should ensure that neither party has
a procedural advantage.
1. Section 160.504--Hearing Before an ALJ
Proposed rule: The proposed rule proposed few changes to this
section, which was Sec. 160.526 of the April 17, 2003 interim final
rule. Section 160.526(a)(2) of the April 17, 2003 interim final rule
stated that the Departmental party in a hearing is ``the Secretary.''
The term ``Secretary'' is defined at Sec. 160.103 of the HIPAA rules
as ``the Secretary of Health and Human Services or any other officer or
employee of HHS to whom the authority involved has been delegated.''
However, in light of the multiple roles of the Secretary in the context
of a hearing (OCR and/or CMS would be a party, while the ALJ or the
Board would be the adjudicator), we proposed to clarify in Sec.
160.504(a)(2) which part of HHS acts as the ``party'' in the hearing.
Because which component of HHS will be the ``party'' in a particular
case will depend on which rule is alleged to have been violated, and
because a particular case could involve more than one HIPAA rule, we
proposed to define the Secretarial party generically, by reference to
the component with the delegated enforcement authority. Under the
proposed provision, the Secretarial party could consist of more than
one officer or employee, so that it is possible for both CMS and OCR to
be the Secretarial party in a particular case.
Proposed Sec. 160.504(b) provided that the request for a hearing
must be mailed within 60 days, via certified mail, return receipt
requested, to the address specified in the notice of proposed
determination. The last sentence of proposed Sec. 160.504(b) provided
that the date of receipt of the notice of proposed determination is
presumed to be five days after the date of the notice unless the
respondent makes a reasonable
[[Page 8415]]
showing to the contrary. This showing may be made even where the notice
is sent by mail and is not precluded by the computation of time rule of
proposed Sec. 160.526(c), establishing a five-day allowance for
mailing.
Proposed Sec. 160.504(c) would require that the request for
hearing clearly and directly admit, deny, or explain each of the
findings of fact contained in the notice of proposed determination with
respect to which the respondent has knowledge and must also state the
circumstances or arguments that the respondent alleges constitute the
grounds for any defense and the factual and legal basis for opposing
the penalty. Proposed Sec. 160.504(d)(1) would require the ALJ to
dismiss a hearing request where ``[t]he respondent's hearing request is
not filed as required by paragraphs (b) and (c) of this section.''
Proposed Sec. Sec. 160.504(d)(2)-(4) would require dismissal where the
hearing request was, respectively, withdrawn, abandoned, or raised no
issue that could properly be addressed in a hearing.
Final rule: Section 160.504 below revises the proposed rule in
several respects. The proposed 60-day time limit for filing a request
for hearing is extended to 90 days. See Sec. 160.504(b). Section
160.504(c) provides that an affirmative defense under Sec.
160.410(b)(1) may be raised at any time. Section 160.504(d)(1) provides
that a dismissal on the grounds stated in that paragraph may only be
made on motion of the Secretary, and the ground for dismissal under
paragraph (b) is limited to the respondent's failure to comply with the
timely filing requirement of paragraph (b).
Comment: A number of comments objected to the 60-day time limit of
proposed Sec. 160.504(b) as unreasonably short and unfair, given the
detailed showing the covered entity is required to provide in its
request for hearing and the severe consequences, under proposed Sec.
160.504(d)(1), of failing to meet this requirement. A couple of
comments also objected that this provision is not necessary and does
not follow the OIG regulation in this respect. Comments suggested
several changes: (1) That the required specificity of the request for
hearing be eliminated, (2) that the time for response be lengthened,
and/or (3) that there be a provision to excuse an untimely request for
hearing based on good cause.
Response: We accommodate the concerns raised in the public comment
by extending the period for filing a request for hearing from 60 to 90
days. We note that, as so revised, the rule does not parallel the
analogous provision of the OIG regulations (42 CFR 1005.2(c)) in two
respects: (1) It requires more specificity in the hearing request; and
(2) it provides the respondent more time in which to file the hearing
request. We are of the view, however, that the compromise in Sec.
160.504(b), as revised, will promote the conduct of the hearing in an
efficient manner by clarifying at an early stage of the process the
issues in dispute and the basis for those disputes. We retain the
requirement of proposed Sec. 160.504(c) that the request for hearing
clearly and directly admit, deny, or explain each of the findings of
fact and state the circumstances or arguments that the respondent
alleges constitute the grounds for any defense and the factual and
legal basis for opposing the penalty. (However, the respondent need not
provide its statistical study, assuming it has one, until 30 days
before the scheduled hearing. See Sec. 160.518.) This requirement will
facilitate narrowing and refining the issues in dispute, thereby
expediting the conduct of the hearing.
Comment: One comment suggested that, if the 60-day time period for
response were retained, HHS be required to send a reminder to the
covered entity on the 45th day.
Response: We do not adopt this suggestion. The need for the
suggested change is obviated by our decision to extend the 60-day
period.
Comment: Several comments suggested that the rule does not properly
take into account the possibility of notices being delivered to the
wrong official in a covered entity or getting lost in a covered
entity's internal mail system. They recommended that the rule specify
the official(s) in the covered entity to whom the notice of proposed
determination must be sent, so that the covered entity does not lose
time needed to prepare its defense. A few comments suggested that the
notice of proposed determination be sent to the Privacy Officer. It was
suggested that the covered entity be able to show good cause for
failing to respond in a timely manner in such cases, or that the 60-day
time period be tolled.
Response: We do not think it is necessary or feasible to identify
the person(s) to whom the notice of proposed determination should be
addressed. Fed. R. Civ. P. 4 (28 U.S.C. Appendix), which applies under
section 1128A(c), establishes who may be served and applies without
need for further regulatory action. Because the size and other
organizational circumstances of covered entities vary greatly, a rule
that further limited or defined who must be served would most likely be
inappropriate for some covered entities. Further, it is likely that a
notice of proposed determination would be issued after significant
prior contact with the covered entity, so we anticipate that our
investigators would be able to ascertain which officer would be the
appropriate recipient of the notice.
In any event, a respondent can raise the issues of concern raised
by the comments--e.g., failure to reach the appropriate official or the
official to whom the notice of proposed determination was addressed due
to problems in the entity's mail system--under Sec. 160.504(b). Under
that section, if the respondent makes ``a reasonable showing'' to the
ALJ that the mailed notice of proposed determination was not properly
received by the covered entity or by a proper official within the
covered entity, the ALJ can extend the 90-day period to the extent he
or she considers appropriate.
Comment: One comment asked whether findings of fact that are not
contested or about which the claim is made of insufficient knowledge to
respond in the hearing request are deemed admitted.
Response: Section 160.504(c) provides respondents with two choices
with respect to denying findings of fact: (1) The respondent may deny
them; or (2) the respondent may claim a lack of knowledge, in which
case the finding in question is ``deemed denied.'' Since the regulation
deems a finding of fact denied only where lack of knowledge is claimed,
if the respondent has neither denied nor asserted lack of knowledge
with respect to the finding, the finding must be deemed admitted.
Comment: One comment stated that dismissal of a hearing request on
the grounds described in proposed Sec. 160.504(d)(1)-(3) should be
made permissive, not mandatory, and Sec. 160.504(d)(4) (dismissal
where the respondent fails to state an issue that may properly be
addressed in a hearing) should be eliminated, to ensure that covered
entities are provided a fair opportunity to request a hearing and
develop an appropriate defense.
Response: We revise proposed Sec. 160.504(d)(1) to require
dismissal on the ground of failure to comply with paragraph (b) to be
limited to failure to comply with the requirement of the paragraph for
timely filing of the request for hearing. We revise proposed Sec.
160.504(d)(1) to provide that dismissal on this ground may occur only
if the Secretary moves for dismissal on this ground. If the Secretarial
party--OCR, CMS, or both--does not believe that the hearing should be
dismissed due to the insufficiency of the respondent's request
[[Page 8416]]
for hearing, and so does not challenge the timeliness or sufficiency of
the request for hearing under paragraph (b) or (c), respectively, the
hearing should go forward. The revision to paragraph (d)(1) would
permit this to occur.
Like its counterparts in other rules issued pursuant to section
1128A, Sec. 160.504(d)(1)-(3) mandates dismissal so that the limited
resources of the government and of respondents are not expended on
hearing requests that fail to comply with the straightforward
requirements of this section or that have been withdrawn or abandoned
by the respondent. We believe that considerations of economy and
efficiency require the dismissal of cases that fall within the
descriptions of these subsections. However, in response to the
comments, we have added a requirement to Sec. 160.504(d)(1) that the
Secretary must file a motion for dismissal of a hearing request rather
than permit an automatic dismissal by the ALJ. The filing of such a
motion will require the Secretary to enunciate the reasons a hearing
request is deficient under paragraphs (b) and (c) of this section and
allow the respondent the opportunity to answer those charges. We do not
add such a requirement to Sec. 160.504(d)(2)-(3), because we think
that the ALJ should have authority to dismiss such cases for reasons of
withdrawal or abandonment by the respondent without being requested to
do so by the Secretary.
Section 160.504(d)(4) provides the administrative review channel
leading to judicial review of claims that may not be reviewed
administratively, such as constitutional claims. This subsection is
necessary so that there is no confusion about how respondents can
efficiently exhaust the administrative process for such claims. We,
thus, decline to eliminate this subsection.
2. Section 160.508--Authority of the ALJ
Proposed rule: The text of proposed Sec. 160.508 was adopted by
the April 17, 2003 interim final rule as Sec. 160.530. No changes to
paragraphs (a) and (b) were proposed. We proposed to revise paragraph
(c) by adding paragraphs (c)(1) and (c)(5) to the list of limitations
on the authority of the ALJ. Proposed paragraph (c)(1) would require
the ALJ to follow Federal statutes, regulations, and Secretarial
delegations of authority, and to give deference to published guidance
to the extent not inconsistent with statute or regulation; the preamble
to the proposed rule indicated that by ``published guidance'' we meant
guidance that has been publicly disseminated, including posting on the
CMS or OCR Web site. Proposed paragraph (c)(5) would clarify that ALJs
may not review the Secretary's exercise of discretion whether to grant
an extension or to provide technical assistance under section
1176(b)(3)(B) of the Act or the Secretary's exercise of discretion in
the choice of variable(s) under proposed Sec. 160.406.
Final rule: The final rule adopts the provisions of the proposed
rule, except for proposed Sec. 160.508(c)(5)(ii), which is eliminated.
A conforming change is made to Sec. 160.508(c)(5).
a. Section 160.508(b)
Comment: One comment stated that this provision should be amended
to add a provision requiring that a requested hearing be conducted
within a time certain, not to exceed 90 days from receipt of the
request for a hearing. Another comment suggested that the ALJ should
notify a respondent of the date and time for the hearing no later than
90 days after the request for hearing is filed.
Response: It would not be reasonable or appropriate to impose a
fixed deadline by which hearings must be scheduled, and we decline to
do so. In a complicated case, the time for discovery and pre-hearing
motions may take more than 90 days, and, thus, imposing such a deadline
may circumscribe the parties' ability to prepare their cases. Moreover,
the ALJs have other cases on their dockets, and we cannot assume that
they will in all cases be able to begin a hearing on a civil money
penalty within 90 days. The scheduling of the hearing is best left to
the ALJs, in consultation with the parties.
b. Section 160.508(c)
Comment: A number of comments opposed proposed Sec. 160.508(c), on
the ground that it would significantly limit the ALJ's authority to
rule on pertinent issues. They stated that it was questionable under
this section whether the ALJ would have the authority to review the
determination of the number of violations, or imposition of joint and
several liability, since they may be addressed in published guidance to
which the ALJ must give deference. It was suggested that this
limitation would be a problem under proposed Sec. 160.424(d), since
those are issues that a respondent would be unable to raise at the
administrative level.
Response: We do not agree. We believe that it is of importance to
covered entities that ALJ and Board decisions, as components of HHS, be
consistent with one another and with the published compliance guidance
HHS provides to covered entities. Accordingly, we require ALJs and the
Board to follow guidance which has been publicly disseminated, unless
the ALJ or Board finds the guidance to be inconsistent with statute or
regulation. In the examples cited, any published guidance related to
the determination of the number of violations, or when joint and
several liability is appropriate must be consistent with applicable
statute and regulation, matters upon which the ALJ may rule. See
section 1176 and Sec. Sec. 160.402(b)(2), 160.406, and 160.508. While
deference to such published guidance is required of the ALJs and DAB,
as components of HHS, similar deference is not necessarily afforded
such guidance in any judicial review of an adverse final agency
determination sought by a respondent. Section 160.424(d) should not
present a problem, since challenges related to published guidance may
be raised during administrative and judicial reviews of the proposed
penalty.
Comment: One comment stated that ALJs should be allowed to consider
affirmative defenses during a hearing, even if they relate to issues
committed to the Secretary's discretion. The comment argued that an
inability to raise affirmative defenses before the ALJ might impact a
covered entity's ability to subsequently pursue legal remedies under
Sec. 160.424(d).
Response: We agree that the ALJ is allowed to consider affirmative
defenses during a hearing. See the discussion of Sec. 160.410 above.
Comment: A couple of comments agreed that ALJs should have the
authority to evaluate whether there was a violation in the first place
and asked that this provision be retained in the final rule.
Response: We agree and have done so.
c. Section 160.508(c)(1)
Comment: One comment asked, if a guidance in effect at the time a
violation occurred were changed before the date of the hearing, which
version of the guidance the ALJ would have to follow.
Response: The guidance in effect at the time the violation occurred
would govern.
Comment: One comment expressed concern with Sec. 160.508(c)(1),
insofar as it would include in ``published guidance'' FAQs published on
the CMS and OCR Web sites. According to the comment, FAQs have never
been designated in the HIPAA regulations as having the force of
regulations themselves. According to the comment, many covered entities
are not aware of these postings and the industry is unaware that they
will have the same
[[Page 8417]]
force and effect as regulations. The comment further stated that if
FAQs are to have the force of regulation, then the questions and
responses should be organized for such use, and the HIPAA regulation
should specifically designate that covered entities will be held
accountable for compliance with these responses or ``published
guidance.'' Another comment suggested that proposed Sec. 160.508(c)(1)
should be revised to require the ALJ to give consideration to published
guidance and consider whether the covered entity reasonably relied on
such guidance, as is done in the regulations relating to hearings by
the Provider Reimbursement Review Board (PRRB), citing to 42 CFR
405.1867.
Response: The ``published guidances'', including FAQs, inform
covered entities of the approach HHS is taking in the enforcement of
the HIPAA rules. The guidances do not have the force and effect of a
regulation, as the comment suggests, and are not controlling upon the
courts, as would be the case with a regulation. As previously
explained, HHS seeks to provide consistent compliance guidance to
covered entities and, to the extent possible, to render decisions in
the adjudicative process that are both consistent with other
adjudicated cases and with the policy decisions of the Secretary
expressed in HHS rules and guidances. The consistency sought within HHS
is achieved by requiring the ALJ and the Board, which are components of
HHS, to defer to such published guidances, if they are consistent with
statute and regulation. This is consistent with, and recognizes the
effect of, the existing delegations of authority by the Secretary,
which delegate to the programs the Secretary's authority to establish
policy. Requiring that only consideration be given to such published
guidances, as in PRRB hearings, rather than deference, would not
achieve the desired result.
Comment: One comment argued that proposed Sec. 160.508(c)(1)
should be changed to add ``and does not establish requirements in
addition to those specified in the applicable statute or regulation,''
on the ground that covered entities should not be penalized for not
complying with requirements that exceed the plain language of the
statute.
Response: It is not clear what the comment is suggesting, but if
the comment is suggesting that guidance merely parrot what is in the
statute and regulations, guidance would be both unnecessary and
unhelpful. If, however, the comment is suggesting that guidance not
exceed any explicit limits imposed by the statute or regulations, the
language is likewise unnecessary, as the current language would permit
the ALJ or the Board to disregard guidance that was not consistent with
statute or regulations.
d. Section 160.508(c)(5)
Comment: Proposed Sec. 160.508(c)(5)(ii) would have made the
Secretary's selection of the variable under Sec. 160.406 unreviewable
by the ALJ. It was criticized by several commenters as unfair and
inconsistent with the statute on the grounds that the whole purpose of
the hearing before an ALJ is to review the Secretary's assessment of a
penalty. It was argued that, if a covered entity has a reasonable
argument as to why the use of variables or a particular variable was
not appropriate, it should be allowed to present the argument during
the ALJ hearing to which it is entitled by statute. It was also argued
that, since proposed Sec. 160.406 would include a factual
determination of the number of times a covered entity may have failed
to engage in required conduct, or may have engaged in a prohibited act,
each of the parties should be authorized to address, and the ALJ to
consider at a hearing, that factual determination. One comment asked
whether, even if the ALJ lacks authority to directly question the
variable(s) selected, a challenge to the variable could be made through
a claim that ``justice required'' selection of a different variable.
Response: Section 1128A(c)(2) establishes the right to a hearing on
the record for any person who has been given an adverse determination
by the Secretary. In a proceeding under section 1176, the adverse
determination by the Secretary is the civil money penalty proposed in
the notice of proposed determination under Sec. 160.420. Upon review
of the comments regarding proposed Sec. 160.508(c)(5)(ii), we agree
that the count of violations is an integral part of a civil money
penalty and should be reviewable by the ALJ. Thus, we have deleted
proposed subparagraph (ii) from Sec. 160.508(c)(5) in the final rule.
As a conforming change, we have integrated subparagraph (i) into the
text of Sec. 160.508(c)(5).
3. Section 160.512--Prehearing Conferences
Proposed rule: Proposed Sec. 160.512 would adopt Sec. 160.534, as
added by the April 17, 2003 interim final rule, with two changes.
Proposed Sec. 160.512 would revise paragraph (a) to establish a
minimum amount of notice (not less than 14 business days) that must be
provided to the parties in the scheduling of prehearing conferences.
Proposed Sec. 160.512 would also revise paragraph (b)(11) to include
the issue of the protection of individually identifiable health
information as a matter that may be discussed at the prehearing
conference, if appropriate.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment recommended that a provision be added to Sec.
160.512 to require the ALJ to schedule a prehearing conference within
30 days of a request for a hearing, unless both parties agree to a
later date.
Response: The scheduling of a prehearing conference will depend, in
part, on the scheduling of the hearing. For the reasons discussed under
Sec. 160.508(b) above, we do not agree that it is advisable to so
circumscribe the ALJ's flexibility to set the hearing calendar.
Comment: A couple of comments objected that the time frame for
notice of a pre-hearing conference provided for by proposed Sec.
160.512 is inadequate to permit all necessary parties involved to
prepare a response. One comment stated that the rule should extend the
time frame to 25 business days, while the other suggested that the rule
should require at least a 30-day notice of a pre-hearing conference.
Response: Section 160.512 does not prescribe 14 days as the amount
of notice of a pre-hearing conference that must be given; rather, it
simply establishes 14 days as the minimum amount of notice that is
``reasonable.'' In our experience, 14 days should in most cases be
sufficient for the parties to prepare for the conference adequately;
however, nothing in the rule prohibits a party from requesting a longer
period of time to prepare for a pre-hearing conference or the ALJ from
granting such a request.
4. Section 160.516--Discovery
Proposed rule: Proposed Sec. 160.516 would adopt Sec. 160.538 of
the April 17, 2003 interim final rule. As relevant here, proposed Sec.
160.516 would permit requests for production of documents, but would
not permit other forms of discovery, such as interrogatories, requests
for admission, and depositions. Proposed paragraph (d) states that this
section ``may not be construed to require the disclosure of interview
reports or statements obtained by any party, or on behalf of any party,
of persons who will not be called as witnesses by that party, or
analyses and summaries prepared in conjunction with the investigation
or litigation of the case, or any otherwise privileged documents.''
[[Page 8418]]
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: Several comments recommended that proposed Sec. 160.516
should be revised to allow requests for admissions, depositions, and
written interrogatories in the discovery process. It was argued that
permitting these forms of discovery would ensure that covered entities
are able to mount a proper defense. It also was asserted that expert
testimony will be necessary to establish both the alleged violation(s)
and any affirmative defenses. Allowing such discovery would, it was
asserted, help to produce a record, make appeals less likely, and
potentially decrease the length of administrative hearings.
Response: We believe that the level of detail provided to a covered
entity in the notice of proposed determination (including, where
applicable, a copy of HHS's statistical expert's study), coupled with a
right to request the production of documents for copying and
inspection, provides the covered entity with the information reasonably
required to mount its challenge to the proposed civil money penalty or
to determine whether an affirmative defense applies. The additional
discovery mentioned in the comments would result in delays and costs.
Experience with the OIG regulation at 42 CFR 1005.7, which likewise
does not authorize other types of discovery, has demonstrated that the
discovery provided for is appropriate and sufficient.
Comment: Several comments argued that, at a minimum, depositions
should be permitted at least with regard to expert witnesses, including
the government's statistical expert. They asserted that, because
depositions would not be permitted, covered entities would lose another
potential opportunity to question the government's statistician in an
effort to understand and defend against the conclusion and assumptions
made in establishing the proposed civil money penalty, which would be
prejudicial to the covered entity.
Response: We do not agree that depositions are necessary. Under
Sec. 160.420(a)(2), as adopted in this final rule, the study of HHS's
statistical expert must be provided to the respondent with the notice
of proposed determination.
Comment: A couple of comments criticized the proposed rule for not
requiring that OCR and/or CMS hand over potentially exculpatory
information to the entity being investigated. The obligation to provide
exculpatory evidence should include handing over exculpatory interview
reports or statements obtained by the government of persons who will
not be called as witnesses by that party. It was recommended that this
obligation be added to the final rule.
Response: The obligation to provide exculpatory evidence to an
accused, which applies in criminal proceedings, is inapplicable in a
HIPAA administrative simplification enforcement case.
Comment: One comment contended that Sec. 160.516 should be revised
to treat personal health information as privileged information not
subject to discovery, since hearings are open to the public under
proposed Sec. 160.534.
Response: A covered entity concerned with potential public access
to protected health information may raise the issue before the ALJ and
seek a protective order under Sec. 160.512(b)(11). Depending on the
circumstances, an ALJ may require the information to be de-identified
or direct identifiers to be stripped to protect the privacy of
individuals or order other protections routinely afforded to similarly
confidential information within the litigation forum, such as
protective orders on the use of the information in public portions of
the proceedings. In addition, the ALJ may, for good cause shown, order
appropriate redactions made to the record after hearing. See Sec.
160.542(d).
5. Section 160.518--Exchange of Witness Lists, Witness Statements, and
Exhibits
Proposed rule: Proposed Sec. 160.518 would carry forward Sec.
160.540, as adopted by the April 17, 2003 interim final rule, with one
substantive change. It would revise paragraph (a) to provide time
limits within which the exchange of witness lists, statements, and
exhibits must occur prior to a hearing. Under proposed Sec.
160.518(a), these items must be exchanged not more than 60, but not
less than 15, days prior to the scheduled hearing.
Final rule: The final rule revises this provision to require that,
where a respondent retains a statistical expert for the purpose of
challenging the Secretary's statistical sampling, a report by the
respondent's expert be provided to the Secretarial party not less than
30 days prior to the hearing.
Comment: Several comments criticized the time frames of proposed
Sec. 160.518 as problematic in light of the anticipated use of
statistical sampling. They argued that, if HHS uses statistical
sampling to determine the number of violations and to establish its
prima facie case against a covered entity, the covered entity must have
a fair opportunity to rebut this evidence. That fair opportunity should
permit the addition of rebuttal witnesses, statements and exhibits
after the 15-day period and/or requiring the government to provide more
detailed information to the covered entity regarding its statistical
sampling calculations, methodology and assumptions at a time that is
sufficiently prior to the 15-day deadline. The comments requested that
the time frames listed in the regulation be increased to allow a
covered entity adequate time to prepare for a hearing. Specifically,
the comments urged that witness lists, statements, and exhibits for a
hearing be exchanged by the parties not more than 60 days and not less
than 30 days before a scheduled hearing date.
Response: We have accommodated the concern that the details of
HHS's statistical study will not be made available early enough in the
proceeding to allow a fair opportunity for rebuttal by requiring in
Sec. 160.420(a)(2) that a copy of the study be given to the respondent
with the notice of proposed determination. Accordingly, under such
circumstances, there should not be a problem identifying who respondent
should call as a rebuttal witness within the time frames set out in
this section.
We revise Sec. 160.518(a) to require the respondent to provide to
HHS a copy of the report of its statistical expert not less than 30
days before the scheduled hearing. This will give the Secretarial party
adequate time to prepare the statistical part of its case and is
reasonable in light of the fact that the respondent is given HHS's
statistical study at the commencement of the proceeding.
Comment: With respect to proposed Sec. 160.518(b)(2), one comment
asked what would constitute extraordinary circumstances. The comment
stated that this standard seems unnecessarily high and that ``good
cause'' would be a more reasonable and fairer standard, given the need
for covered entities to rebut the evidence of a statistical expert
whose information they will not receive until the exchange of witnesses
and exhibits.
Response: The decision concerning what is sufficient to convince
the ALJ that extraordinary circumstances exist will be case-specific.
The justification for lowering the standard no longer applies, given
our change to Sec. 160.420. Accordingly, we retain the ``extraordinary
circumstances'' standard to emphasize the importance of observing the
time frame for the exchange of such information.
[[Page 8419]]
6. Section 160.520--Subpoenas for Attendance at Hearing
Proposed rule: Proposed Sec. 160.520 would carry forward Sec.
160.542, as adopted by the April 17, 2003 interim final rule, mainly
unchanged. Proposed Sec. 160.520 would clarify that when a subpoena is
served on HHS, the Secretary may comply with the subpoena by
designating any knowledgeable representative to testify. Proposed Sec.
160.520(d) would require a party seeking a subpoena to file a written
motion not less than 30 days before the scheduled hearing, unless
otherwise allowed by the ALJ for good cause shown; the paragraph
specified what such a motion must contain.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment asked that the language in proposed Sec.
160.520(c) be modified to provide that, if a respondent subpoenas a
particular employee or official with specific knowledge of the case at
hand, the identified employee or official would be required to testify.
While acknowledging that it was reasonable for HHS to be able to
substitute a witness if a respondent subpoenas an employee or official
with no knowledge of the case (such as the Secretary), the comment
argued that HHS should not have such discretion if the employee or
official who is subpoenaed has specific knowledge of the case.
Response: We retain the provision as proposed, because it is
necessary to permit the smooth conduct of government business. We do
not agree that the provision will damage a respondent's ability to
litigate his case, as the provision requires that, although the
Secretary may designate an HHS representative, the person so designated
must be ``knowledgeable.'' That person may be the employee or official
upon whom the subpoena was first served, if the Secretary determines
that such person is the appropriate witness, possessed of the requisite
knowledge to testify upon the issues which are the subject of the
subpoena.
Comment: One comment stated concerns with the interplay of proposed
Sec. 160.538 with proposed Sec. 160.520(d). Under proposed Sec.
160.538(b), if a party seeks to admit the testimony of a witness in the
form of a written statement, that statement must be provided to the
other party ``in a manner that allows sufficient time for the other
party to subpoena the witness for cross-examination at the hearing.''
Under proposed Sec. 160.520(d), ``a party seeking a subpoena must file
a written motion not less than 30 days before the date fixed for the
hearing, unless otherwise allowed by the ALJ for good cause shown.''
The comment argued that a party that wanted to subpoena a person whose
written statement was being offered by the opposing party should not
have the burden of showing good cause for moving for a subpoena less
than 30 days before the hearing date. Instead, the party seeking to
admit the written statement should be required to provide that
statement to the other party more than 30 days before the hearing, so
that the other party will have an opportunity to subpoena that witness
under the procedures established by these regulations.
Response: We believe that the rules adequately provide for such a
contingency, and so do not revise Sec. 160.520 as requested. The party
that seeks to introduce testimony, other than expert testimony, in the
form of a written statement must provide the other party with a copy of
the statement and the address of the witness in sufficient time to
allow that other party to subpoena that witness for cross examination.
Since Sec. 160.520(d) requires that motions seeking a subpoena be
filed not less than 30 days before the hearing, the witness statement
and address should be provided in sufficient time to allow a timely
motion to be made. In the event that such statement and/or address is
not provided in sufficient time to allow for a timely motion, good
cause for permitting the motion for subpoena to be made on fewer than
30 days notice would exist.
7. Section 160.522--Fees
Proposed rule: The proposed rule proposed in Sec. 160.522 to carry
forward unchanged Sec. 160.544 of the April 17, 2003 interim final
rule. The provision requires the party subpoenaing a witness to pay the
cost of fees and mileage. Where the respondent is the party subpoenaing
the witness, the check for such fees and mileage must accompany the
subpoena when served, but the check is not required to accompany the
subpoena where the party subpoenaing the witness is the Secretary.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment requested clarification of this provision.
Observing that proposed Sec. 160.522 would require a check for
specific fees to accompany the subpoena except when HHS issues such a
subpoena, the comment questioned whether this meant that HHS would be
required to reimburse someone they subpoenaed or whether the HHS
reimbursement would come at a later date. Further, if it was the case
that HHS was not required to reimburse such fees, the comment asked why
this is the case, since any other party would be required to reimburse
those fees.
Response: HHS is required to, and will, pay to a subpoenaed witness
the fees provided for in this section. The payment, however, need not
accompany the subpoena. This policy is consistent with the usual
procedure when the federal government is a party. See, e.g., Fed. R.
Civ. P. 45(b)(1). (28 U.S.C. Appendix).
8. Section 160.534--The Hearing
Proposed rule: The text of proposed Sec. 160.534 was adopted by
the April 17, 2003 interim final rule as Sec. 160.554. No changes to
paragraphs (a) and (c) were proposed. However, it was proposed to add a
new paragraph (b) allocating the burden of proof at the hearing. Under
proposed Sec. 160.534(b), the respondent would bear the burden of
proof with respect to: (1) Any affirmative defense, including those set
out in section 1176(b) of the Act, as implemented by proposed Sec.
160.410; (2) any challenge to the amount or scope of a proposed penalty
under section 1128A(d), as implemented by proposed Sec. Sec. 160.404-
160.408, including mitigating factors; and (3) any contention that a
proposed penalty should be reduced or waived under section 1176(b)(4),
as implemented by Sec. 160.412. The Secretary would have the burden of
proof with respect to all other issues, including issues of liability
and the factors considered as aggravating factors under proposed Sec.
160.408 in determining the amount of penalties to be imposed. The
burden of persuasion would be judged by a preponderance of the evidence
(i.e., it is more likely than not that the position advocated is true).
We also proposed a new Sec. 160.534(d), which would provide that
any party may present items or information, during its case in chief,
that were discovered after the date of the notice of proposed
determination or request for a hearing, as applicable. The
admissibility of such proffered evidence would be governed generally by
the provisions of proposed Sec. 160.540, and be subject to the 15-day
rule for the exchange of trial exhibits, witness lists and statements
set out at proposed Sec. 160.518(a). If any such evidence is offered
by the Secretary, it would not be admissible, unless relevant and
material to the findings of fact set forth in the notice of proposed
determination, including circumstances that may increase such penalty.
If any such evidence is offered by the respondent, it would not be
admissible unless relevant and material to a
[[Page 8420]]
specific admission, denial, or explanation of a finding of fact, or to
a specific circumstance or argument expressly stated in the
respondent's request for hearing that are alleged to constitute grounds
for any defense or the factual and legal basis for opposing or reducing
the penalty.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment recommended that proposed Sec.
160.534(b)(1)(ii) (placing the burden of proof on the respondent with
respect to any challenge to the amount of a proposed penalty pursuant
to Sec. 160.404-160.408, including mitigating factors) be deleted. It
was argued that due process requires that HHS sustain the burden of
going forward with evidence proving the amount of a proposed penalty
and the burden of persuasion. It was also noted that this section would
place on the respondent the burden of proof with respect to an issue
that is unreviewable under proposed Sec. 160.508(c)(5)--the selection
of variables under Sec. 160.406.
Response: We disagree that Sec. 160.534(b)(1)(ii) violates the due
process clause. Rather, it is consistent with the normal allocation of
the burden of proof, in which the proponent of a fact or argument has
the burden of proving it. Our change to Sec. 160.508(c)(5) renders the
remainder of the comment moot.
Comment: One comment suggested that Sec. 160.534(c) be revised to
require the ALJ, upon the request of either party, to close a public
hearing that could result in disclosure of privacy or security
information that should not be made public and seal the records.
Response: We agree that protecting protected health information is
important and is an issue about which all parties and the ALJ should be
concerned. However, administrative hearings are, in general, required
to be open to the public. See, e.g., Detroit Free Press v. Ashcroft,
303 F.3d 681, 700 (6th Cir. 2002) (stating that INS deportation
hearings and similar administrative proceedings are traditionally open
to the public). An ALJ has means by which he can protect the privacy of
protected health information to be introduced into evidence, if he
determines that this should be done, including requiring redaction of
identifying information and closing part of the hearing. In our view,
the ALJ will be in the best position to balance the competing interests
of the public's right to information and the privacy interests
associated with any protected health information. Accordingly, we do
not mandate closure of the hearing on request.
9. Section 160.536--Statistical Sampling
Proposed rule: Proposed Sec. 160.536 would permit the Secretary to
introduce the results of a statistical sampling study as evidence of
the number of violations under proposed Sec. 160.406(b), or, where
appropriate, any factor considered in determining the amount of the
civil money penalty under proposed Sec. 160.408. If the estimation is
based upon an appropriate sampling and employs valid statistical
methods, it would constitute prima facie evidence of the number of
violations or amount of the penalty sought that is a part of the
Secretary's burden of proof. Such a showing would cause the burden of
going forward to shift to the respondent, although the burden of
persuasion would remain with the Secretary.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: Several comments argued that the proposed rule would
significantly limit a covered entity's ability to challenge HHS's
statistical evidence. Although proposed Sec. 160.420(a)(2) would
require HHS, in the notice of proposed determination, to describe the
sampling technique used by the Secretary, it is unclear what
constitutes a ``brief'' description, and a brief description will most
likely be insufficient to provide the covered entity with enough
information to mount an adequate challenge. Because the covered entity
may not receive a copy of the actual statistical study until 15 days
before the hearing, it would have a very short period of time in which
to review, investigate, critique, and/or rebut the statistical study.
Because proposed Sec. 160.516 would prohibit the taking of
depositions, there would be no way to subject the HHS's statistical
expert to adverse examination until the hearing, if then. The comments
requested that proposed Sec. 160.536 be deleted or, alternatively, the
rule be revised to permit depositions of HHS's statistical expert and
require HHS to give covered entities more detail of the technique
utilized in sufficient time to allow entities to provide a meaningful
defense and rebuttal.
Response: We recognize the concern that to make an effective
challenge to the Secretary's introduction of the results of a
statistical study, a covered entity should be provided with the details
of that study early in the proceeding. Accordingly, we have revised
proposed Sec. 160.420(a)(2) to require HHS to provide a copy of the
study relied upon to the respondent with the notice of proposed
determination. Further, we have revised proposed Sec. 160.504(b) to
enlarge the time within which a respondent seeking a hearing before an
ALJ must mail its request for hearing from 60 to 90 days. We do not
agree that depositions, which are expensive and time consuming, are
required; the statistical study relied upon will be given to respondent
with the notice of proposed determination, allowing an adequate amount
of time to prepare any opposition thereto.
Comment: Several comments contended that permitting proof of
violations by statistical sampling violates basic notions of due
process and fundamental fairness, in that either a violation is
provable or it is not. The comments raised the following specific
objections on this ground. Statistical sampling merely estimates the
number of violations that could have occurred and should not be used as
a ``short cut'' for appropriate investigation and review. The
determination of any variable used to calculate the number of
violations should be based on an objective standard. The proposed
approach would not treat all covered entities the same. The following
example was provided to illustrate this latter concern. Suppose that a
dentist had 3,000 patients of record, and that seven percent of those
patients, or 210, did not receive a Notice of Privacy Practices.
Suppose that a sample of 100 of the 3,000 patients was examined by HHS,
and it was determined that 15 did not receive a notice. A statistical
inference from this sample would estimate that 600, or 15 percent of
all patients of record, did not receive a notice, even though in fact
only 210 had not received a notice. Under Sec. 160.536, the provider
could be charged for 600 violations. While, on average, the sampling
approach would yield the correct estimate of all providers, it would
not necessarily be correct for any specific provider, which would be
unfair to the individual providers involved.
Response: The use of sampling and statistical methods is recognized
under Fed. R. Evid. 702 and under 42 CFR 1003.133 of the OIG rules,
upon which the language of this section is based. The respondent may
challenge whether the estimation offered by the Secretary is based upon
a valid sample and employs valid statistical methods or may otherwise
rebut the statistical evidence submitted. In the example cited by the
comment, the respondent also could rebut the results with evidence that
the actual number of violations is less than the estimate derived from
the statistical sample.
With respect to the concerns regarding the fairness and
appropriateness of using statistical
[[Page 8421]]
sampling to determine the number of violations, HHS will use sampling
methods which follow recognized scientific guidelines for statistical
validity and precision. These methods would be applicable to all types
of covered entities and will objectively measure the number of
violations by a covered entity or the number of occurrences of a
particular aggravating circumstance. Because of the wide range of
possible violations, however, we cannot at this time present specific
sampling designs or levels of acceptable precision. However, the
methodology employed will be documented and made available in the
statistical sampling study provided with the notice of proposed
determination.
Comment: Several comments argued that the use of statistical
sampling is inappropriate to determine violations of the HIPAA rules. A
couple of comments argued that, because of the many variables and
discretionary considerations that can go into determining that a
violation has occurred, and because many complaints or investigations
will relate to individual circumstances, using statistical sampling to
determine the number of violations is not appropriate. Another comment
gave as an example of this problem Privacy Rule violations involving
disclosure of protected health information beyond the ``minimum
necessary;'' it asserted that the number of such violations cannot be
adequately assessed through a statistical sample. Use of statistical
sampling in such a case could preclude a covered entity from asserting
its fact-based affirmative defenses. It was argued that statistical
sampling is appropriate for use in estimating averages, but is not
appropriate for determining the number of violations by a specific
covered entity.
Response: As noted above, statistical sampling is recognized under
the Federal Rules of Evidence and other HHS regulations. See, e.g., 42
CFR 1003.133. The results, if based upon an appropriate sampling and
computed by valid statistical methods, are only prima facie evidence of
the number of violations or the existence of factors material to the
proposed civil money penalty. The respondent may challenge the adequacy
or size of the sample or the statistical methods employed, and may
offer other evidence to rebut the results derived through the
statistical methodology.
We do not agree that statistical methods are, per se, inappropriate
for determining the number of violations that have occurred. For
example, suppose that a health plan with a large volume of electronic
claims is found to have required providers to include on such claims a
data element which is not part of the standard. A sample of the claims
would be selected, and the percentage of claims found to be in
violation of the standard would be computed from the sample and
projected to the universe of claims for the year to establish the total
number of violations of the standard in the calendar year. Of course,
HHS's statistical methods would have to pass muster, and a respondent
could challenge the statistical results, on normal statistical grounds,
e.g., that the sample size was insufficient, that the sample was not
representative, and so on.
Comment: Several comments contended that, by allowing statistical
sampling to be introduced at a hearing, proposed Sec. 160.536 directly
contradicts the language of Sec. 160.508, which does not allow an ALJ
to review issues under the Secretary's discretion, which includes
calculating the number of violations. Other comments stated that, in
the event that statistical sampling is used by HHS to determine the
number of violations, it should be subject to ALJ review and that
insulating it from review would increase the potential for abuse
exponentially.
Response: Proposed Sec. 160.508(c) has been revised to permit the
ALJ to review the Secretary's calculation of the number of violations
of an identical administrative simplification provision under Sec.
160.406. If statistical sampling is employed to determine the number of
violations, the results are subject to challenge before the ALJ.
Comment: The provision of proposed Sec. 160.536 limiting
statistical studies to those ``based upon an appropriate sampling and
computed by valid statistical methods'' was criticized. It was noted
that no criteria for validity are given, even though the comments by
the agency specifically acknowledge the danger of extrapolating from
small sample sizes. It also was argued that the appropriateness and
validity of such sampling techniques are left to the discretion of the
Secretary, who will employ criteria known only to the Secretary. It was
recommended that statistical sampling not be permitted without clearer
guidelines or more flexibility to challenge the study at an early
stage, before significant investment of resources.
Response: By requiring that appropriate sampling and valid
statistical methods be employed, HHS is mirroring the standard by which
the reliability of such expert testimony is assessed under Fed. R.
Evid. 702. If statistical sampling is employed to determine the number
of violations of an administrative simplification provision in a
calendar year, such determination is subject to review by the ALJ. With
respect to a respondent's ability to challenge the study at an earlier
stage, under Sec. 160.420(a)(2), a copy of the study relied upon will
be provided to the respondent with the notice of proposed
determination.
10. Section 160.538--Witnesses
Proposed rule: Proposed Sec. 160.538 would carry forward unchanged
Sec. 160.556, as adopted by the April 17, 2003 interim final rule. As
relevant here, paragraph (b) provides that, at the discretion of the
ALJ and subject to certain conditions, testimony of witnesses other
than the testimony of expert witnesses may be admitted in the form of a
written statement and the ALJ may, at his discretion, admit prior sworn
testimony of experts that has been subject to adverse examination.
Final rule: The final rule adopts the provisions of the proposed
rule, except that the fourth sentence of proposed Sec. 160.538(b) is
placed before the second sentence of proposed Sec. 160.538(b).
Comment: One comment stated that it was unclear whether the
government's statistician could even be required to testify; rather, it
appeared that the government could rely solely on the expert's prior
testimony in other cases and/or the expert's report. Because
depositions are not allowed, this provision must mean that testimony
from experts in other cases may be used. It was argued that this would
be prejudicial, because the covered entity will not have had an
opportunity to subject the testimony to adverse examination and the
facts of different cases would likely not be identical. Therefore, the
expert testimony in one case may not be appropriate for use in a
different case. It was recommended that this section be revised to
require, at the covered entity's request, the testimony at the hearing
of the government's statistical expert and prohibit the use of prior
sworn testimony of experts unless from the specific case at issue.
Response: HHS expects that its statistical expert will testify at
the hearing. Moreover, the respondent may move the ALJ to subpoena
HHS's statistical expert to appear and testify at the hearing. See
Sec. 160.520.
Comment: One comment stated that, when Sec. Sec. 160.538 and
160.516(b) are read together, they would permit an expert's testimony,
taken under oath in a different case, to be admitted into
[[Page 8422]]
evidence, leaving the respondent with no chance to question the expert.
Response: We recognize the concern raised, which we believe arises
out of an inadvertent transposition of a sentence in the text of
proposed Sec. 160.538(b). We intended that the subsection's text
mirror that of the OIG regulation at 45 CFR 1005.16(b) by ending with
the following: ``Any such written statement must be provided to the
other party, along with the last known address of the witness, in a
manner that allows sufficient time for the other party to subpoena the
witness for cross-examination at the hearing. Prior written statements
of witnesses proposed to testify at the hearing must be exchanged as
provided in Sec. 160.518.'' We have corrected this error. As the rule
now reads, the prior sworn testimony of an expert will be treated like
any other witness's statement that a party proposes to offer in lieu of
testimony at the hearing: a copy must be provided to the other party
along with the witness's address in sufficient time to permit such
other party to subpoena and question that witness at the hearing.
11. Section 160.540--Evidence
Proposed rule: Proposed Sec. 160.540 would carry forward unchanged
Sec. 160.558, which was adopted by the April 17, 2003 interim final
rule. Paragraph (b) of this section provides that the ALJ is not bound
by the Federal Rules of Evidence, except as provided in the subpart.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment argued that proposed Sec. 160.540(b) should
be revised. The comment stated that the optional use of the Federal
Rules of Evidence is insufficient and would not allow entities to know
what evidence will be admissible at the hearing or what rules of
evidence will apply. At a minimum, it was argued, the use of hearsay
should be prohibited except pursuant to the hearsay exceptions of the
Federal Rules of Evidence.
Response: The Administrative Procedure Act does not require HHS to
apply the Federal Rules of Evidence to limit the discretion of ALJs to
admit evidence at hearings. See 5 U.S.C. 556(d). To be admissible,
evidence need only be relevant, material, reliable, and probative.
However, the ALJ may apply the Federal Rules of Evidence, where
appropriate. Examples of situations where use of the Federal Rules of
Evidence might be appropriate would include to exclude unreliable
evidence, to weigh the probative value of evidence against the risks
attending its admission, to determine whether a Federal privilege
exists, or to determine whether the evidence relates to an offered
compromise and settlement, which would be inadmissible under Fed. R.
Evid. 408.
Comment: One comment argued that proposed Sec. 160.540(g) should
be deleted. It was argued that this provision is inconsistent with the
six-year time limit in Sec. 160.414, in that it permits admission at
the hearing of ``crimes, wrongs or acts'' without limit as to when they
may have occurred. The comment stated that acts or other behaviors that
are not the subject of civil money penalties are not relevant factors
in determining the penalties that should be imposed, nor are they proof
that the prohibited activity occurred. The Secretary is not required in
a civil administrative proceeding to prove intent or mens rea.
Response: We believe that evidence of prior bad acts, admitted for
the purposes listed (which are consistent with Fed. R. Evid. 404(b))
may be relevant and material in particular cases and, thus, should not
be categorically excluded, as suggested. For instance, such evidence
may be relevant and material to proving a covered entity's knowledge of
the violation or aggravating circumstances affecting the amount of the
civil money penalty imposed. In the latter case, for example, the
evidence would be admitted to prove the aggravating circumstances and
not the actual violations at issue; thus, the statute of limitations
would not apply with respect to the bad acts. (We note, however, that
prior bad acts unrelated to the covered entity's compliance with the
HIPAA provisions or rules would not be admissible to prove aggravating
circumstances under Sec. 160.408(d).) Comment: Another comment argued
that proposed Sec. 160.540(g) should be deleted, but if retained, such
evidence should be reviewable under the other criteria for
admissibility of proposed Sec. 160.540, and HHS should be required to
provide advance notice of its intent to present such evidence.
Response: Evidence of prior bad acts would be subject to the same
criteria for admissibility as other evidence offered at the hearing--
for instance, whether the probative value of such evidence is
substantially outweighed by its potential for prejudice. Such evidence
is also subject to the rules regarding notice that apply to other
evidence; see, e.g., Sec. Sec. 160.420(a)(5), 160.516, and 160.518.
12. Section 160.542--The Record
Proposed rule: This section would carry forward unchanged Sec.
160.560, adopted by the April 17, 2003 interim final rule. Since the
section provides that the record of the proceedings be transcribed, we
proposed to add to paragraph (a) of this section a requirement that the
cost of transcription of the record be borne equally by the parties, in
the interest of fairness.
Final rule: The final rule adopts the provisions of the proposed
rule, except that paragraph (a) is revised to clarify that if a party
requests a copy of the transcript of the hearing proceedings it must
pay the cost of such transcript, unless such payment is waived by the
ALJ or the Board for good cause shown.
Comment: One comment recommended that this fee be assessed at the
end of the investigation and assumed by the responsible party based on
the outcome of the investigation. Another comment requested that HHS
bear the cost of the court reporter's appearance (as opposed to the
cost of copies).
Response: We acknowledge that the language of proposed paragraph
(a) suggested that there is a fee or cost for a court reporter's
appearance, in addition to the cost of obtaining a copy of the
transcript of the hearing proceedings. As there is no such additional
cost, we have revised paragraph (a) to state that a party that requests
a copy of the transcript of hearing is required to pay the cost of
preparing such transcript. We have also added a provision that will
permit the ALJ or the Board, for good cause shown, to waive the cost of
obtaining the transcript.
13. Section 160.546--ALJ Decision
Proposed rule: The proposed rule proposed that the ALJ decision
would be the initial decision of the Secretary, rather than the final
decision of the Secretary as set forth in Sec. 160.564(d) of the April
17, 2003 interim final rule. Thus, we proposed to revise paragraph (d)
to provide that the decision of the ALJ will be final and binding on
the parties 60 days from the date of service of the ALJ decision,
unless it is timely appealed by either party.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment requested that the section be revised to
provide that the ALJ could not increase a penalty beyond the statutory
cap of section 1176(a)(1).
Response: The ALJ is bound by both the statute and the regulations,
which both explicitly address this issue. Section 1176(a)(1) states
that ``the total amount imposed on the person for all violations of an
identical requirement or prohibition during a calendar year may not
exceed $25,000.'' Section
[[Page 8423]]
160.404(b)(1)(ii) states that the Secretary may not impose a civil
money penalty in excess of $25,000 for identical violations during a
calendar year.
In light of these explicit provisions, we do not agree that the
suggested change is necessary.
14. Section 160.548--Appeal of the ALJ Decision
Proposed rule: Proposed Sec. 160.548 would provide that any party
may appeal the initial decision of the ALJ to the Board within 30 days
of the date of service of the ALJ initial decision, unless extended for
good cause. The appealing party must file a written brief specifying
its exceptions to the initial decision. The opposing party may file an
opposition brief, which is limited to the exceptions raised in the
brief accompanying notice of appeal and any relevant issues not
addressed in said exceptions and must be filed within 30 days of
receiving the appealing party's notice of appeal and brief. The
appealing party may, if permitted by the Board, file a reply brief.
These briefs may be the only means that the parties will have to
present their case to the Board, since there is no right to appear
personally before the Board. The proposed rule provided that if a party
demonstrates that additional evidence is material and relevant and
there are reasonable grounds why such evidence was not introduced at
the ALJ hearing, the Board may remand the case to the ALJ for
consideration of the additional evidence. In an appeal to the Board,
the standard of review on a disputed issue of fact would be whether the
ALJ's initial decision is supported by substantial evidence on the
record as a whole; on a disputed issue of law, the standard of review
is whether the ALJ's initial decision is erroneous. The Board could
decline review, affirm, increase, reduce, or reverse any penalty, or
remand a penalty determination to the ALJ.
Under proposed Sec. 160.548(i), the Board must serve its decision
on the parties within 60 days after final briefs are filed. The
decision of the Board becomes the final decision of the Secretary 60
days after service of the decision, except where the decision is to
remand to the ALJ or a party requests reconsideration before the
decision becomes final. Proposed Sec. 160.548(j) provides that a party
may request reconsideration of the Board's decision, provides a
reconsideration process, and provides that the Board's reconsideration
decision becomes final on service. The decision of the Board
constitutes the final decision of the Secretary from which a petition
for judicial review may be filed by a respondent aggrieved by the
Board's decision. Proposed Sec. 160.548(k) provides for a petition for
judicial review of a final decision of the Secretary.
Final rule: The final rule adopts the provisions of the proposed
rule, except that paragraph (e) is revised to make it consistent with
the revision to Sec. 160.504(c). The revision would permit the Board
to consider an affirmative defense under Sec. 160.410(b)(1) that is
raised for the first time before the Board. Thus, under paragraph (f)
of this section, the Board could, but would not be required to, remand
the case to the ALJ for consideration of any evidence adduced with
respect to such defense.
Comment: One comment was received on this section. It requested
that the section be revised to provide that the Board could not
increase a penalty beyond the statutory cap of section 1176(a)(1).
Response: We do not agree that such a provision is necessary, for
the reasons discussed in the preceding section.
15. Section 160.552--Harmless Error
Proposed rule: Proposed Sec. 160.552 proposed to adopt the
``harmless error'' rule that applies to civil litigation in Federal
courts. The provision would provide, in general, that the ALJ and the
Board at every stage of the proceeding will disregard any error or
defect in the proceeding that does not affect the substantial rights of
the parties.
Final rule: The final rule adopts the provisions of the proposed
rule.
Comment: One comment asked for further guidance on, and
clarification of, this provision. Another comment stated that the
provision was far too broad, particularly given the limited discovery
available to covered entities. Concern was expressed that the rule
would severely limit a covered entity's ability to appeal an adverse
ruling.
Response: The proposed rule was modeled after Fed. R. Civ. P. 61
and 42 CFR 1005.23 of the OIG regulations. It is a common provision in
procedural rules that govern civil and administrative adjudications and
is intended to promote efficiency in the resolution of disputes. If a
respondent seeks an appeal because of an error that affects the party's
substantive rights or the case's outcome, this section would not be
applicable. Thus, we do not agree that it would severely limit a
covered entity's ability to appeal an adverse ruling, and we adopt the
section as proposed.
IV. Impact Statement and Other Required Analyses
Comment: Only one comment was received on the impact and other
required analyses of the proposed rule (see 70 FR 20247-49). The
comment asserted that HHS was declaring itself exempt from complying
with the Paperwork Reduction Act, the Regulatory Flexibility Act, the
Unfunded Mandates Reform Act of 1995, the Small Business Regulatory
Enforcement and Fairness Act, and Executive Order 13132, and that an
effort to compute vigorously the range of potential effects is needed
to assure agency accountability.
Response: The comment misstates the position HHS took in the
proposed rules concerning these laws. HHS does not consider itself, or
the Enforcement Rule, exempt from these laws. However, each of these
laws covers only certain types of rules and agency actions. For the
reasons stated in the proposed rule and summarized below, those laws do
not apply to the particular actions taken with respect to this rule.
The comment provides no substantive grounds for altering our prior
conclusions with respect to these laws.
A. Paperwork Reduction Act
We reviewed this final rule to determine whether it raises issues
that would subject it to the Paperwork Reduction Act (PRA). Since the
final rule comes within the exemption of 5 CFR 1320.4(a), as it deals
entirely with administrative investigations and actions against
specific individuals or entities, it need not be reviewed by the Office
of Management and Budget under the authority of the PRA.
B. Executive Order 12866; Regulatory Flexibility Act; Unfunded Mandates
Reform Act of 1995; Small Business Regulatory Enforcement Fairness Act
of 1996; Executive Order 13132
We have examined the impacts of this final rule as required by
Executive Order 12866 (September 1993, Regulatory Planning and Review),
the Regulatory Flexibility Act (RFA) (September 16, 1980, Pub. L. 96-
354), the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), the
Small Business Regulatory Enforcement and Fairness Act, 5 U.S.C. 801,
et seq., and Executive Order 13132.
1. Executive Order 12866
Executive Order 12866 (as amended by Executive Order 13258, which
merely reassigns responsibility of duties) directs agencies to assess
all costs and benefits of available regulatory alternatives and, if
regulation is
[[Page 8424]]
necessary, to select regulatory approaches that maximize net benefits
(including potential economic, environmental, public health and safety
effects, distributive impacts, and equity). Executive Order 12866
defines, at section 3(f), several categories of ``significant
regulatory actions.'' One category is ``economically significant''
rules, which are defined in section 3(f)(1) of the Order as rules that
may ``have an annual effect on the economy of $100 million or more, or
adversely affect in a material way the economy, productivity,
competition, jobs, the environment, public health or safety, or State,
local, or tribal governments or communities.'' Another category, under
section 3(f)(4) of the Order, consists of rules that are ``significant
regulatory actions'' because they ``raise novel legal or policy issues
arising out of legal mandates, the President's priorities, or the
principles set forth in this Executive Order.'' Executive Order 12866
requires a full economic impact analysis only for ``economically
significant'' rules under section 3(f)(1). For the reasons stated at 70
FR 20248-49, we have concluded that this rule should be treated as a
``significant regulatory action'' within the meaning of section 3(f)(4)
of Executive Order 12866, but that the impact of this rule is not such
that it reaches the economically significant threshold under section
3(f)(1) of the Order.
We note, with regard to our prior analysis, that our ongoing
experiences with HIPAA complaints bears out our experience to July
2004, which was discussed at 70 FR 20248. As of October 31, 2005, OCR
had received and initiated review of over 16,000 complaints and had
closed 68 percent of the complaints; at the same time, CMS had received
and initiated review of 413 complaints and closed 67 percent of the
complaints. Thus, we continue to be of the view that the costs
attributable to the provisions of this rule will, in most cases that
are opened, be low. We likewise continue to believe, for the reasons
stated at 70 FR 20249, that the value of the benefits brought by the
HIPAA provisions are sufficient to warrant appropriate enforcement
efforts and that the benefits of these protections far outweigh the
costs of this enforcement regulation.
Thus, in most cases, if covered entities comply with the various
HIPAA rules, they should not incur any significant additional costs as
a result of the Enforcement Rule. This is based on the fact the costs
intrinsic to most of the HIPAA rules and operating directions against
which compliance is evaluated have been scored independently of this
rule, and those requirements are not changed by this rule. We recognize
that the specific requirements against which compliance is evaluated
are not yet well known and may evolve with experience under HIPAA, but
we expect that covered entities have both the ability and expectation
to maintain compliance, especially given our commitment to encouraging
and facilitating voluntary compliance. While not straightforward to
project, it seems likely that the number of times in which the full
civil money penalty enforcement process will be invoked will be
extremely small, based on the evidence to date.
2. Other Analyses
We also examined the impact of this rule as required by the
Regulatory Flexibility Act (RFA). The RFA requires agencies to
determine whether a rule will have a significant economic impact on a
substantial number of small entities. For purposes of the RFA, small
entities include small businesses, nonprofit organizations, and
government jurisdictions; for health care entities, the size standard
for a ``small'' entity ranges from $6 million to $29 million in
revenues in any one year. For the reasons discussed at 70 FR 20249, the
Secretary certifies that this rule will not have a significant economic
impact on a substantial number of small entities.
Section 202 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C.
1531 et seq., also requires that agencies assess anticipated costs and
benefits before issuing any rule that may result in expenditure in any
one year by State, local, or tribal governments, in the aggregate, or
by the private sector, of $100 million, adjusted for inflation. The
Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), 5
U.S.C. 801, et seq., requires that rules that will have an impact on
the economy of $100 million or more per annum be submitted for
Congressional review. For the reasons discussed above and at 70 FR
20248-49, this rule will not impose a burden large enough to require a
section 202 statement under the Unfunded Mandates Reform Act of 1995 or
Congressional review under SBREFA.
Executive Order 13132 establishes certain requirements that an
agency must meet when it adopts a final rule that imposes substantial
direct requirement costs on State and local governments, preempts State
law, or otherwise has Federalism implications. This final rule does not
have ``Federalism implications, `` as it will not have ``substantial
direct effects on the States, on the relationship between the national
government and the States, or on the distribution of power and
responsibilities among the various levels of government,'' nor, for the
reasons previously explained, will it have substantial economic effects
would not be substantial, while any preemption of State law that could
occur would be a function of the underlying HIPAA rules, not this rule.
Therefore, the Enforcement Rule is not subject to Executive Order 13132
(Federalism).
Dated: December 20, 2005.
Michael O. Leavitt,
Secretary.
List of Subjects
45 CFR Part 160
Administrative practice and procedure, Computer technology,
Electronic transactions, Employer benefit plan, Health, Health care,
Health facilities, Health insurance, Health records, Hospitals,
Investigations, Medicaid, Medical research, Medicare, Penalties,
Privacy, Reporting and record keeping requirements, Security.
45 CFR Part 164
Administrative practice and procedure, Electronic information
system, Electronic transactions, Employer benefit plan, Health, Health
care, Health facilities, Health Insurance, Health records, Hospitals,
Medicaid, Medical research, Medicare, Privacy, Reporting and record
keeping requirements, Security.
0
For the reasons set forth in the preamble, the Department of Health and
Human Services amends 45 CFR subtitle A, subchapter C, parts 160 and
164, as set forth below.
PART 160--GENERAL ADMINISTRATIVE REQUIREMENTS
0
1. The authority citation for part 160 is revised to read as follows:
Authority: 42 U.S.C. 1302(a), 42 U.S.C. 1320d--1320d-8, sec. 264
of Pub. L.104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)),
and 5 U.S.C. 552.
0
2. Add to Sec. 160.103 in alphabetical order the definition of
``Person'' to read as follows:
Sec. 160.103 Definitions.
* * * * *
``Person'' means a natural person, trust or estate, partnership,
corporation, professional association or corporation, or other entity,
public or private.
* * * * *
0
3. Revise subpart C to read as follows:
[[Page 8425]]
Subpart C--Compliance and Investigations
Sec.
160.300 Applicability.
160.302 Definitions.
160.304 Principles for achieving compliance.
160.306 Complaints to the Secretary.
160.308 Compliance reviews.
160.310 Responsibilities of covered entities.
160.312 Secretarial action regarding complaints and compliance
reviews.
160.314 Investigational subpoenas and inquiries.
160.316 Refraining from intimidation or retaliation.
Sec. 160.300 Applicability.
This subpart applies to actions by the Secretary, covered entities,
and others with respect to ascertaining the compliance by covered
entities with, and the enforcement of, the applicable provisions of
this part 160 and parts 162 and 164 of this subchapter.
Sec. 160.302 Definitions.
As used in this subpart and subparts D and E of this part, the
following terms have the following meanings:
Administrative simplification provision means any requirement or
prohibition established by:
(1) 42 U.S.C. 1320d--1320d-4, 1320d-7, and 1320d-8;
(2) Section 264 of Pub. L. 104-191; or
(3) This subchapter.
ALJ means Administrative Law Judge.
Civil money penalty or penalty means the amount determined under
Sec. 160.404 of this part and includes the plural of these terms.
Respondent means a covered entity upon which the Secretary has
imposed, or proposes to impose, a civil money penalty.
Violation or violate means, as the context may require, failure to
comply with an administrative simplification provision.
Sec. 160.304 Principles for achieving compliance.
(a) Cooperation. The Secretary will, to the extent practicable,
seek the cooperation of covered entities in obtaining compliance with
the applicable administrative simplification provisions.
(b) Assistance. The Secretary may provide technical assistance to
covered entities to help them comply voluntarily with the applicable
administrative simplification provisions.
Sec. 160.306 Complaints to the Secretary.
(a) Right to file a complaint. A person who believes a covered
entity is not complying with the administrative simplification
provisions may file a complaint with the Secretary.
(b) Requirements for filing complaints. Complaints under this
section must meet the following requirements:
(1) A complaint must be filed in writing, either on paper or
electronically.
(2) A complaint must name the person that is the subject of the
complaint and describe the acts or omissions believed to be in
violation of the applicable administrative simplification provision(s).
(3) A complaint must be filed within 180 days of when the
complainant knew or should have known that the act or omission
complained of occurred, unless this time limit is waived by the
Secretary for good cause shown.
(4) The Secretary may prescribe additional procedures for the
filing of complaints, as well as the place and manner of filing, by
notice in the Federal Register.
(c) Investigation. The Secretary may investigate complaints filed
under this section. Such investigation may include a review of the
pertinent policies, procedures, or practices of the covered entity and
of the circumstances regarding any alleged violation. At the time of
initial written communication with the covered entity about the
complaint, the Secretary will describe the act(s) and/or omission(s)
that are the basis of the complaint.
Sec. 160.308 Compliance reviews.
The Secretary may conduct compliance reviews to determine whether
covered entities are complying with the applicable administrative
simplification provisions.
Sec. 160.310 Responsibilities of covered entities.
(a) Provide records and compliance reports. A covered entity must
keep such records and submit such compliance reports, in such time and
manner and containing such information, as the Secretary may determine
to be necessary to enable the Secretary to ascertain whether the
covered entity has complied or is complying with the applicable
administrative simplification provisions.
(b) Cooperate with complaint investigations and compliance reviews.
A covered entity must cooperate with the Secretary, if the Secretary
undertakes an investigation or compliance review of the policies,
procedures, or practices of the covered entity to determine whether it
is complying with the applicable administrative simplification
provisions.
(c) Permit access to information. (1) A covered entity must permit
access by the Secretary during normal business hours to its facilities,
books, records, accounts, and other sources of information, including
protected health information, that are pertinent to ascertaining
compliance with the applicable administrative simplification
provisions. If the Secretary determines that exigent circumstances
exist, such as when documents may be hidden or destroyed, a covered
entity must permit access by the Secretary at any time and without
notice.
(2) If any information required of a covered entity under this
section is in the exclusive possession of any other agency,
institution, or person and the other agency, institution, or person
fails or refuses to furnish the information, the covered entity must so
certify and set forth what efforts it has made to obtain the
information.
(3) Protected health information obtained by the Secretary in
connection with an investigation or compliance review under this
subpart will not be disclosed by the Secretary, except if necessary for
ascertaining or enforcing compliance with the applicable administrative
simplification provisions, or if otherwise required by law.
Sec. 160.312 Secretarial action regarding complaints and compliance
reviews.
(a) Resolution when noncompliance is indicated. (1) If an
investigation of a complaint pursuant to Sec. 160.306 or a compliance
review pursuant to Sec. 160.308 indicates noncompliance, the Secretary
will attempt to reach a resolution of the matter satisfactory to the
Secretary by informal means. Informal means may include demonstrated
compliance or a completed corrective action plan or other agreement.
(2) If the matter is resolved by informal means, the Secretary will
so inform the covered entity and, if the matter arose from a complaint,
the complainant, in writing.
(3) If the matter is not resolved by informal means, the Secretary
will--
(i) So inform the covered entity and provide the covered entity an
opportunity to submit written evidence of any mitigating factors or
affirmative defenses for consideration under Sec. Sec. 160.408 and
160.410 of this part. The covered entity must submit any such evidence
to the Secretary within 30 days (computed in the same manner as
prescribed under Sec. 160.526 of this part) of receipt of such
notification; and
(ii) If, following action pursuant to paragraph (a)(3)(i) of this
section, the
[[Page 8426]]
Secretary finds that a civil money penalty should be imposed, inform
the covered entity of such finding in a notice of proposed
determination in accordance with Sec. 160.420 of this part.
(b) Resolution when no violation is found. If, after an
investigation pursuant to Sec. 160.306 or a compliance review pursuant
to Sec. 160.308, the Secretary determines that further action is not
warranted, the Secretary will so inform the covered entity and, if the
matter arose from a complaint, the complainant, in writing.
Sec. 160.314 Investigational subpoenas and inquiries.
(a) The Secretary may issue subpoenas in accordance with 42 U.S.C.
405(d) and (e), 1320a-7a(j), and 1320d-5 to require the attendance and
testimony of witnesses and the production of any other evidence during
an investigation or compliance review pursuant to this part. For
purposes of this paragraph, a person other than a natural person is
termed an ``entity.''
(1) A subpoena issued under this paragraph must--
(i) State the name of the person (including the entity, if
applicable) to whom the subpoena is addressed;
(ii) State the statutory authority for the subpoena;
(iii) Indicate the date, time, and place that the testimony will
take place;
(iv) Include a reasonably specific description of any documents or
items required to be produced; and
(v) If the subpoena is addressed to an entity, describe with
reasonable particularity the subject matter on which testimony is
required. In that event, the entity must designate one or more natural
persons who will testify on its behalf, and must state as to each such
person that person's name and address and the matters on which he or
she will testify. The designated person must testify as to matters
known or reasonably available to the entity.
(2) A subpoena under this section must be served by--
(i) Delivering a copy to the natural person named in the subpoena
or to the entity named in the subpoena at its last principal place of
business; or
(ii) Registered or certified mail addressed to the natural person
at his or her last known dwelling place or to the entity at its last
known principal place of business.
(3) A verified return by the natural person serving the subpoena
setting forth the manner of service or, in the case of service by
registered or certified mail, the signed return post office receipt,
constitutes proof of service.
(4) Witnesses are entitled to the same fees and mileage as
witnesses in the district courts of the United States (28 U.S.C. 1821
and 1825). Fees need not be paid at the time the subpoena is served.
(5) A subpoena under this section is enforceable through the
district court of the United States for the district where the
subpoenaed natural person resides or is found or where the entity
transacts business.
(b) Investigational inquiries are non-public investigational
proceedings conducted by the Secretary.
(1) Testimony at investigational inquiries will be taken under oath
or affirmation.
(2) Attendance of non-witnesses is discretionary with the
Secretary, except that a witness is entitled to be accompanied,
represented, and advised by an attorney.
(3) Representatives of the Secretary are entitled to attend and ask
questions.
(4) A witness will have the opportunity to clarify his or her
answers on the record following questioning by the Secretary.
(5) Any claim of privilege must be asserted by the witness on the
record.
(6) Objections must be asserted on the record. Errors of any kind
that might be corrected if promptly presented will be deemed to be
waived unless reasonable objection is made at the investigational
inquiry. Except where the objection is on the grounds of privilege, the
question will be answered on the record, subject to objection.
(7) If a witness refuses to answer any question not privileged or
to produce requested documents or items, or engages in conduct likely
to delay or obstruct the investigational inquiry, the Secretary may
seek enforcement of the subpoena under paragraph (a)(5) of this
section.
(8) The proceedings will be recorded and transcribed. The witness
is entitled to a copy of the transcript, upon payment of prescribed
costs, except that, for good cause, the witness may be limited to
inspection of the official transcript of his or her testimony.
(9)(i) The transcript will be submitted to the witness for
signature.
(A) Where the witness will be provided a copy of the transcript,
the transcript will be submitted to the witness for signature. The
witness may submit to the Secretary written proposed corrections to the
transcript, with such corrections attached to the transcript. If the
witness does not return a signed copy of the transcript or proposed
corrections within 30 days (computed in the same manner as prescribed
under Sec. 160.526 of this part) of its being submitted to him or her
for signature, the witness will be deemed to have agreed that the
transcript is true and accurate.
(B) Where, as provided in paragraph (b)(8) of this section, the
witness is limited to inspecting the transcript, the witness will have
the opportunity at the time of inspection to propose corrections to the
transcript, with corrections attached to the transcript. The witness
will also have the opportunity to sign the transcript. If the witness
does not sign the transcript or offer corrections within 30 days
(computed in the same manner as prescribed under Sec. 160.526 of this
part) of receipt of notice of the opportunity to inspect the
transcript, the witness will be deemed to have agreed that the
transcript is true and accurate.
(ii) The Secretary's proposed corrections to the record of
transcript will be attached to the transcript.
(c) Consistent with Sec. 160.310(c)(3), testimony and other
evidence obtained in an investigational inquiry may be used by HHS in
any of its activities and may be used or offered into evidence in any
administrative or judicial proceeding.
Sec. 160.316 Refraining from intimidation or retaliation.
A covered entity may not threaten, intimidate, coerce, harass,
discriminate against, or take any other retaliatory action against any
individual or other person for--
(a) Filing of a complaint under Sec. 160.306;
(b) Testifying, assisting, or participating in an investigation,
compliance review, proceeding, or hearing under this part; or
(c) Opposing any act or practice made unlawful by this subchapter,
provided the individual or person has a good faith belief that the
practice opposed is unlawful, and the manner of opposition is
reasonable and does not involve a disclosure of protected health
information in violation of subpart E of part 164 of this subchapter.
0
4. Add a new subpart D to read as follows:
Subpart D--Imposition of Civil Money Penalties
160.400 Applicability.
160.402 Basis for a civil money penalty.
160.404 Amount of a civil money penalty.
160.406 Violations of an identical requirement or prohibition.
160.408 Factors considered in determining the amount of a civil
money penalty.
160.410 Affirmative defenses.
160.412 Waiver.
160.414 Limitations.
160.416 Authority to settle.
160.418 Penalty not exclusive.
[[Page 8427]]
160.420 Notice of proposed determination.
160.422 Failure to request a hearing.
160.424 Collection of penalty.
160.426 Notification of the public and other agencies.
Sec. 160.400 Applicability.
This subpart applies to the imposition of a civil money penalty by
the Secretary under 42 U.S.C. 1320d-5.
Sec. 160.402 Basis for a civil money penalty.
(a) General rule. Subject to Sec. 160.410, the Secretary will
impose a civil money penalty upon a covered entity if the Secretary
determines that the covered entity has violated an administrative
simplification provision.
(b) Violation by more than one covered entity. (1) Except as
provided in paragraph (b)(2) of this section, if the Secretary
determines that more than one covered entity was responsible for a
violation, the Secretary will impose a civil money penalty against each
such covered entity.
(2) A covered entity that is a member of an affiliated covered
entity, in accordance with Sec. 164.105(b) of this subchapter, is
jointly and severally liable for a civil money penalty for a violation
of part 164 of this subchapter based on an act or omission of the
affiliated covered entity, unless it is established that another member
of the affiliated covered entity was responsible for the violation.
(c) Violation attributed to a covered entity. A covered entity is
liable, in accordance with the federal common law of agency, for a
civil money penalty for a violation based on the act or omission of any
agent of the covered entity, including a workforce member, acting
within the scope of the agency, unless--
(1) The agent is a business associate of the covered entity;
(2) The covered entity has complied, with respect to such business
associate, with the applicable requirements of Sec. Sec. 164.308(b)
and 164.502(e) of this subchapter; and
(3) The covered entity did not--
(i) Know of a pattern of activity or practice of the business
associate, and
(ii) Fail to act as required by Sec. Sec. 164.314(a)(1)(ii) and
164.504(e)(1)(ii) of this subchapter, as applicable.
Sec. 160.404 Amount of a civil money penalty.
(a) The amount of a civil money penalty will be determined in
accordance with paragraph (b) of this section and Sec. Sec. 160.406,
160.408, and 160.412.
(b) The amount of a civil money penalty that may be imposed is
subject to the following limitations:
(1) The Secretary may not impose a civil money penalty--
(i) In the amount of more than $100 for each violation; or
(ii) In excess of $25,000 for identical violations during a
calendar year (January 1 through the following December 31).
(2) If a requirement or prohibition in one administrative
simplification provision is repeated in a more general form in another
administrative simplification provision in the same subpart, a civil
money penalty may be imposed for a violation of only one of these
administrative simplification provisions.
Sec. 160.406 Violations of an identical requirement or prohibition.
The Secretary will determine the number of violations of an
administrative simplification provision based on the nature of the
covered entity's obligation to act or not act under the provision that
is violated, such as its obligation to act in a certain manner, or
within a certain time, or to act or not act with respect to certain
persons. In the case of continuing violation of a provision, a separate
violation occurs each day the covered entity is in violation of the
provision.
Sec. 160.408 Factors considered in determining the amount of a civil
money penalty.
In determining the amount of any civil money penalty, the Secretary
may consider as aggravating or mitigating factors, as appropriate, any
of the following:
(a) The nature of the violation, in light of the purpose of the
rule violated.
(b) The circumstances, including the consequences, of the
violation, including but not limited to:
(1) The time period during which the violation(s) occurred;
(2) Whether the violation caused physical harm;
(3) Whether the violation hindered or facilitated an individual's
ability to obtain health care; and
(4) Whether the violation resulted in financial harm.
(c) The degree of culpability of the covered entity, including but
not limited to:
(1) Whether the violation was intentional; and
(2) Whether the violation was beyond the direct control of the
covered entity.
(d) Any history of prior compliance with the administrative
simplification provisions, including violations, by the covered entity,
including but not limited to:
(1) Whether the current violation is the same or similar to prior
violation(s);
(2) Whether and to what extent the covered entity has attempted to
correct previous violations;
(3) How the covered entity has responded to technical assistance
from the Secretary provided in the context of a compliance effort; and
(4) How the covered entity has responded to prior complaints.
(e) The financial condition of the covered entity, including but
not limited to:
(1) Whether the covered entity had financial difficulties that
affected its ability to comply;
(2) Whether the imposition of a civil money penalty would
jeopardize the ability of the covered entity to continue to provide, or
to pay for, health care; and
(3) The size of the covered entity.
(f) Such other matters as justice may require.
Sec. 160.410 Affirmative defenses.
(a) As used in this section, the following terms have the following
meanings:
Reasonable cause means circumstances that would make it
unreasonable for the covered entity, despite the exercise of ordinary
business care and prudence, to comply with the administrative
simplification provision violated.
Reasonable diligence means the business care and prudence expected
from a person seeking to satisfy a legal requirement under similar
circumstances.
Willful neglect means conscious, intentional failure or reckless
indifference to the obligation to comply with the administrative
simplification provision violated.
(b) The Secretary may not impose a civil money penalty on a covered
entity for a violation if the covered entity establishes that an
affirmative defense exists with respect to the violation, including the
following:
(1) The violation is an act punishable under 42 U.S.C. 1320d-6;
(2) The covered entity establishes, to the satisfaction of the
Secretary, that it did not have knowledge of the violation, determined
in accordance with the federal common law of agency, and, by exercising
reasonable diligence, would not have known that the violation occurred;
or
(3) The violation is--
(i) Due to reasonable cause and not willful neglect; and
(ii) Corrected during either:
(A) The 30-day period beginning on the date the covered entity
liable for the penalty knew, or by exercising reasonable diligence
would have known, that the violation occurred; or
[[Page 8428]]
(B) Such additional period as the Secretary determines to be
appropriate based on the nature and extent of the failure to comply.
Sec. 160.412 Waiver.
For violations described in Sec. 160.410(b)(3)(i) that are not
corrected within the period described in Sec. 160.410(b)(3)(ii), the
Secretary may waive the civil money penalty, in whole or in part, to
the extent that payment of the penalty would be excessive relative to
the violation.
Sec. 160.414 Limitations.
No action under this subpart may be entertained unless commenced by
the Secretary, in accordance with Sec. 160.420, within 6 years from
the date of the occurrence of the violation.
Sec. 160.416 Authority to settle.
Nothing in this subpart limits the authority of the Secretary to
settle any issue or case or to compromise any penalty.
Sec. 160.418 Penalty not exclusive.
Except as otherwise provided by 42 U.S.C. 1320d-5(b)(1), a penalty
imposed under this part is in addition to any other penalty prescribed
by law.
Sec. 160.420 Notice of proposed determination.
(a) If a penalty is proposed in accordance with this part, the
Secretary must deliver, or send by certified mail with return receipt
requested, to the respondent, written notice of the Secretary's intent
to impose a penalty. This notice of proposed determination must
include--
(1) Reference to the statutory basis for the penalty;
(2) A description of the findings of fact regarding the violations
with respect to which the penalty is proposed (except that, in any case
where the Secretary is relying upon a statistical sampling study in
accordance with Sec. 160.536 of this part, the notice must provide a
copy of the study relied upon by the Secretary);
(3) The reason(s) why the violation(s) subject(s) the respondent to
a penalty;
(4) The amount of the proposed penalty;
(5) Any circumstances described in Sec. 160.408 that were
considered in determining the amount of the proposed penalty; and
(6) Instructions for responding to the notice, including a
statement of the respondent's right to a hearing, a statement that
failure to request a hearing within 90 days permits the imposition of
the proposed penalty without the right to a hearing under Sec. 160.504
or a right of appeal under Sec. 160.548 of this part, and the address
to which the hearing request must be sent.
(b) The respondent may request a hearing before an ALJ on the
proposed penalty by filing a request in accordance with Sec. 160.504
of this part.
Sec. 160.422 Failure to request a hearing.
If the respondent does not request a hearing within the time
prescribed by Sec. 160.504 of this part and the matter is not settled
pursuant to Sec. 160.416, the Secretary will impose the proposed
penalty or any lesser penalty permitted by 42 U.S.C. 1320d-5. The
Secretary will notify the respondent by certified mail, return receipt
requested, of any penalty that has been imposed and of the means by
which the respondent may satisfy the penalty, and the penalty is final
on receipt of the notice. The respondent has no right to appeal a
penalty under Sec. 160.548 of this part with respect to which the
respondent has not timely requested a hearing.
Sec. 160.424 Collection of penalty.
(a) Once a determination of the Secretary to impose a penalty has
become final, the penalty will be collected by the Secretary, subject
to the first sentence of 42 U.S.C. 1320a-7a(f).
(b) The penalty may be recovered in a civil action brought in the
United States district court for the district where the respondent
resides, is found, or is located.
(c) The amount of a penalty, when finally determined, or the amount
agreed upon in compromise, may be deducted from any sum then or later
owing by the United States, or by a State agency, to the respondent.
(d) Matters that were raised or that could have been raised in a
hearing before an ALJ, or in an appeal under 42 U.S.C. 1320a-7a(e), may
not be raised as a defense in a civil action by the United States to
collect a penalty under this part.
Sec. 160.426 Notification of the public and other agencies.
Whenever a proposed penalty becomes final, the Secretary will
notify, in such manner as the Secretary deems appropriate, the public
and the following organizations and entities thereof and the reason it
was imposed: the appropriate State or local medical or professional
organization, the appropriate State agency or agencies administering or
supervising the administration of State health care programs (as
defined in 42 U.S.C. 1320a-7(h)), the appropriate utilization and
quality control peer review organization, and the appropriate State or
local licensing agency or organization (including the agency specified
in 42 U.S.C. 1395aa(a), 1396a(a)(33)).
0
5. Revise subpart E of this part to read as follows:
Subpart E--Procedures for Hearings
Sec.
160.500 Applicability.
160.502 Definitions.
160.504 Hearing before an ALJ.
160.506 Rights of the parties.
160.508 Authority of the ALJ.
160.510 Ex parte contacts.
160.512 Prehearing conferences.
160.514 Authority to settle.
160.516 Discovery.
160.518 Exchange of witness lists, witness statements, and exhibits.
160.520 Subpoenas for attendance at hearing.
160.522 Fees.
160.524 Form, filing, and service of papers.
160.526 Computation of time.
160.528 Motions.
160.530 Sanctions.
160.532 Collateral estoppel.
160.534 The hearing.
160.536 Statistical sampling.
160.538 Witnesses.
160.540 Evidence.
160.542 The record.
160.544 Post hearing briefs.
160.546 ALJ's decision.
160.548 Appeal of the ALJ's decision.
160.550 Stay of the Secretary's decision.
160.552 Harmless error.
Sec. 160.500 Applicability.
This subpart applies to hearings conducted relating to the
imposition of a civil money penalty by the Secretary under 42 U.S.C.
1320d-5.
Sec. 160.502 Definitions.
As used in this subpart, the following term has the following
meaning:
Board means the members of the HHS Departmental Appeals Board, in
the Office of the Secretary, who issue decisions in panels of three.
Sec. 160.504 Hearing before an ALJ.
(a) A respondent may request a hearing before an ALJ. The parties
to the hearing proceeding consist of--
(1) The respondent; and
(2) The officer(s) or employee(s) of HHS to whom the enforcement
authority involved has been delegated.
(b) The request for a hearing must be made in writing signed by the
respondent or by the respondent's attorney and sent by certified mail,
return receipt requested, to the address specified in the notice of
proposed determination. The request for a hearing must be mailed within
90 days after notice of the proposed determination is received by the
respondent. For purposes of this section, the
[[Page 8429]]
respondent's date of receipt of the notice of proposed determination is
presumed to be 5 days after the date of the notice unless the
respondent makes a reasonable showing to the contrary to the ALJ.
(c) The request for a hearing must clearly and directly admit,
deny, or explain each of the findings of fact contained in the notice
of proposed determination with regard to which the respondent has any
knowledge. If the respondent has no knowledge of a particular finding
of fact and so states, the finding shall be deemed denied. The request
for a hearing must also state the circumstances or arguments that the
respondent alleges constitute the grounds for any defense and the
factual and legal basis for opposing the penalty, except that a
respondent may raise an affirmative defense under Sec. 160.410(b)(1)
at any time.
(d) The ALJ must dismiss a hearing request where--
(1) On motion of the Secretary, the ALJ determines that the
respondent's hearing request is not timely filed as required by
paragraphs (b) or does not meet the requirements of paragraph (c) of
this section;
(2) The respondent withdraws the request for a hearing;
(3) The respondent abandons the request for a hearing; or
(4) The respondent's hearing request fails to raise any issue that
may properly be addressed in a hearing.
Sec. 160.506 Rights of the parties.
(a) Except as otherwise limited by this subpart, each party may--
(1) Be accompanied, represented, and advised by an attorney;
(2) Participate in any conference held by the ALJ;
(3) Conduct discovery of documents as permitted by this subpart;
(4) Agree to stipulations of fact or law that will be made part of
the record;
(5) Present evidence relevant to the issues at the hearing;
(6) Present and cross-examine witnesses;
(7) Present oral arguments at the hearing as permitted by the ALJ;
and
(8) Submit written briefs and proposed findings of fact and
conclusions of law after the hearing.
(b) A party may appear in person or by a representative. Natural
persons who appear as an attorney or other representative must conform
to the standards of conduct and ethics required of practitioners before
the courts of the United States.
(c) Fees for any services performed on behalf of a party by an
attorney are not subject to the provisions of 42 U.S.C. 406, which
authorizes the Secretary to specify or limit their fees.
Sec. 160.508 Authority of the ALJ.
(a) The ALJ must conduct a fair and impartial hearing, avoid delay,
maintain order, and ensure that a record of the proceeding is made.
(b) The ALJ may--
(1) Set and change the date, time and place of the hearing upon
reasonable notice to the parties;
(2) Continue or recess the hearing in whole or in part for a
reasonable period of time;
(3) Hold conferences to identify or simplify the issues, or to
consider other matters that may aid in the expeditious disposition of
the proceeding;
(4) Administer oaths and affirmations;
(5) Issue subpoenas requiring the attendance of witnesses at
hearings and the production of documents at or in relation to hearings;
(6) Rule on motions and other procedural matters;
(7) Regulate the scope and timing of documentary discovery as
permitted by this subpart;
(8) Regulate the course of the hearing and the conduct of
representatives, parties, and witnesses;
(9) Examine witnesses;
(10) Receive, rule on, exclude, or limit evidence;
(11) Upon motion of a party, take official notice of facts;
(12) Conduct any conference, argument or hearing in person or, upon
agreement of the parties, by telephone; and
(13) Upon motion of a party, decide cases, in whole or in part, by
summary judgment where there is no disputed issue of material fact. A
summary judgment decision constitutes a hearing on the record for the
purposes of this subpart.
(c) The ALJ--
(1) May not find invalid or refuse to follow Federal statutes,
regulations, or Secretarial delegations of authority and must give
deference to published guidance to the extent not inconsistent with
statute or regulation;
(2) May not enter an order in the nature of a directed verdict;
(3) May not compel settlement negotiations;
(4) May not enjoin any act of the Secretary; or
(5) May not review the exercise of discretion by the Secretary with
respect to whether to grant an extension under Sec.
160.410(b)(3)(ii)(B) of this part or to provide technical assistance
under 42 U.S.C. 1320d-5(b)(3)(B).
Sec. 160.510 Ex parte contacts.
No party or person (except employees of the ALJ's office) may
communicate in any way with the ALJ on any matter at issue in a case,
unless on notice and opportunity for both parties to participate. This
provision does not prohibit a party or person from inquiring about the
status of a case or asking routine questions concerning administrative
functions or procedures.
Sec. 160.512 Prehearing conferences.
(a) The ALJ must schedule at least one prehearing conference, and
may schedule additional prehearing conferences as appropriate, upon
reasonable notice, which may not be less than 14 business days, to the
parties.
(b) The ALJ may use prehearing conferences to discuss the
following--
(1) Simplification of the issues;
(2) The necessity or desirability of amendments to the pleadings,
including the need for a more definite statement;
(3) Stipulations and admissions of fact or as to the contents and
authenticity of documents;
(4) Whether the parties can agree to submission of the case on a
stipulated record;
(5) Whether a party chooses to waive appearance at an oral hearing
and to submit only documentary evidence (subject to the objection of
the other party) and written argument;
(6) Limitation of the number of witnesses;
(7) Scheduling dates for the exchange of witness lists and of
proposed exhibits;
(8) Discovery of documents as permitted by this subpart;
(9) The time and place for the hearing;
(10) The potential for the settlement of the case by the parties;
and
(11) Other matters as may tend to encourage the fair, just and
expeditious disposition of the proceedings, including the protection of
privacy of individually identifiable health information that may be
submitted into evidence or otherwise used in the proceeding, if
appropriate.
(c) The ALJ must issue an order containing the matters agreed upon
by the parties or ordered by the ALJ at a prehearing conference.
Sec. 160.514 Authority to settle.
The Secretary has exclusive authority to settle any issue or case
without the consent of the ALJ.
Sec. 160.516 Discovery.
(a) A party may make a request to another party for production of
documents for inspection and copying
[[Page 8430]]
that are relevant and material to the issues before the ALJ.
(b) For the purpose of this section, the term ``documents''
includes information, reports, answers, records, accounts, papers and
other data and documentary evidence. Nothing contained in this section
may be interpreted to require the creation of a document, except that
requested data stored in an electronic data storage system must be
produced in a form accessible to the requesting party.
(c) Requests for documents, requests for admissions, written
interrogatories, depositions and any forms of discovery, other than
those permitted under paragraph (a) of this section, are not
authorized.
(d) This section may not be construed to require the disclosure of
interview reports or statements obtained by any party, or on behalf of
any party, of persons who will not be called as witnesses by that
party, or analyses and summaries prepared in conjunction with the
investigation or litigation of the case, or any otherwise privileged
documents.
(e)(1) When a request for production of documents has been
received, within 30 days the party receiving that request must either
fully respond to the request, or state that the request is being
objected to and the reasons for that objection. If objection is made to
part of an item or category, the part must be specified. Upon receiving
any objections, the party seeking production may then, within 30 days
or any other time frame set by the ALJ, file a motion for an order
compelling discovery. The party receiving a request for production may
also file a motion for protective order any time before the date the
production is due.
(2) The ALJ may grant a motion for protective order or deny a
motion for an order compelling discovery if the ALJ finds that the
discovery sought--
(i) Is irrelevant;
(ii) Is unduly costly or burdensome;
(iii) Will unduly delay the proceeding; or
(iv) Seeks privileged information.
(3) The ALJ may extend any of the time frames set forth in
paragraph (e)(1) of this section.
(4) The burden of showing that discovery should be allowed is on
the party seeking discovery.
Sec. 160.518 Exchange of witness lists, witness statements, and
exhibits.
(a) The parties must exchange witness lists, copies of prior
written statements of proposed witnesses, and copies of proposed
hearing exhibits, including copies of any written statements that the
party intends to offer in lieu of live testimony in accordance with
Sec. 160.538, not more than 60, and not less than 15, days before the
scheduled hearing, except that if a respondent intends to introduce the
evidence of a statistical expert, the respondent must provide the
Secretarial party with a copy of the statistical expert's report not
less than 30 days before the scheduled hearing.
(b)(1) If, at any time, a party objects to the proposed admission
of evidence not exchanged in accordance with paragraph (a) of this
section, the ALJ must determine whether the failure to comply with
paragraph (a) of this section should result in the exclusion of that
evidence.
(2) Unless the ALJ finds that extraordinary circumstances justified
the failure timely to exchange the information listed under paragraph
(a) of this section, the ALJ must exclude from the party's case-in-
chief--
(i) The testimony of any witness whose name does not appear on the
witness list; and
(ii) Any exhibit not provided to the opposing party as specified in
paragraph (a) of this section.
(3) If the ALJ finds that extraordinary circumstances existed, the
ALJ must then determine whether the admission of that evidence would
cause substantial prejudice to the objecting party.
(i) If the ALJ finds that there is no substantial prejudice, the
evidence may be admitted.
(ii) If the ALJ finds that there is substantial prejudice, the ALJ
may exclude the evidence, or, if he or she does not exclude the
evidence, must postpone the hearing for such time as is necessary for
the objecting party to prepare and respond to the evidence, unless the
objecting party waives postponement.
(c) Unless the other party objects within a reasonable period of
time before the hearing, documents exchanged in accordance with
paragraph (a) of this section will be deemed to be authentic for the
purpose of admissibility at the hearing.
Sec. 160.520 Subpoenas for attendance at hearing.
(a) A party wishing to procure the appearance and testimony of any
person at the hearing may make a motion requesting the ALJ to issue a
subpoena if the appearance and testimony are reasonably necessary for
the presentation of a party's case.
(b) A subpoena requiring the attendance of a person in accordance
with paragraph (a) of this section may also require the person (whether
or not the person is a party) to produce relevant and material evidence
at or before the hearing.
(c) When a subpoena is served by a respondent on a particular
employee or official or particular office of HHS, the Secretary may
comply by designating any knowledgeable HHS representative to appear
and testify.
(d) A party seeking a subpoena must file a written motion not less
than 30 days before the date fixed for the hearing, unless otherwise
allowed by the ALJ for good cause shown. That motion must--
(1) Specify any evidence to be produced;
(2) Designate the witnesses; and
(3) Describe the address and location with sufficient particularity
to permit those witnesses to be found.
(e) The subpoena must specify the time and place at which the
witness is to appear and any evidence the witness is to produce.
(f) Within 15 days after the written motion requesting issuance of
a subpoena is served, any party may file an opposition or other
response.
(g) If the motion requesting issuance of a subpoena is granted, the
party seeking the subpoena must serve it by delivery to the person
named, or by certified mail addressed to that person at the person's
last dwelling place or principal place of business.
(h) The person to whom the subpoena is directed may file with the
ALJ a motion to quash the subpoena within 10 days after service.
(i) The exclusive remedy for contumacy by, or refusal to obey a
subpoena duly served upon, any person is specified in 42 U.S.C. 405(e).
Sec. 160.522 Fees.
The party requesting a subpoena must pay the cost of the fees and
mileage of any witness subpoenaed in the amounts that would be payable
to a witness in a proceeding in United States District Court. A check
for witness fees and mileage must accompany the subpoena when served,
except that, when a subpoena is issued on behalf of the Secretary, a
check for witness fees and mileage need not accompany the subpoena.
Sec. 160.524 Form, filing, and service of papers.
(a) Forms. (1) Unless the ALJ directs the parties to do otherwise,
documents filed with the ALJ must include an original and two copies.
(2) Every pleading and paper filed in the proceeding must contain a
caption setting forth the title of the action, the case number, and a
designation of the paper, such as motion to quash subpoena.
[[Page 8431]]
(3) Every pleading and paper must be signed by and must contain the
address and telephone number of the party or the person on whose behalf
the paper was filed, or his or her representative.
(4) Papers are considered filed when they are mailed.
(b) Service. A party filing a document with the ALJ or the Board
must, at the time of filing, serve a copy of the document on the other
party. Service upon any party of any document must be made by
delivering a copy, or placing a copy of the document in the United
States mail, postage prepaid and addressed, or with a private delivery
service, to the party's last known address. When a party is represented
by an attorney, service must be made upon the attorney in lieu of the
party.
(c) Proof of service. A certificate of the natural person serving
the document by personal delivery or by mail, setting forth the manner
of service, constitutes proof of service.
Sec. 160.526 Computation of time.
(a) In computing any period of time under this subpart or in an
order issued thereunder, the time begins with the day following the
act, event or default, and includes the last day of the period unless
it is a Saturday, Sunday, or legal holiday observed by the Federal
Government, in which event it includes the next business day.
(b) When the period of time allowed is less than 7 days,
intermediate Saturdays, Sundays, and legal holidays observed by the
Federal Government must be excluded from the computation.
(c) Where a document has been served or issued by placing it in the
mail, an additional 5 days must be added to the time permitted for any
response. This paragraph does not apply to requests for hearing under
Sec. 160.504.
Sec. 160.528 Motions.
(a) An application to the ALJ for an order or ruling must be by
motion. Motions must state the relief sought, the authority relied upon
and the facts alleged, and must be filed with the ALJ and served on all
other parties.
(b) Except for motions made during a prehearing conference or at
the hearing, all motions must be in writing. The ALJ may require that
oral motions be reduced to writing.
(c) Within 10 days after a written motion is served, or such other
time as may be fixed by the ALJ, any party may file a response to the
motion.
(d) The ALJ may not grant a written motion before the time for
filing responses has expired, except upon consent of the parties or
following a hearing on the motion, but may overrule or deny the motion
without awaiting a response.
(e) The ALJ must make a reasonable effort to dispose of all
outstanding motions before the beginning of the hearing.
Sec. 160.530 Sanctions.
The ALJ may sanction a person, including any party or attorney, for
failing to comply with an order or procedure, for failing to defend an
action or for other misconduct that interferes with the speedy, orderly
or fair conduct of the hearing. The sanctions must reasonably relate to
the severity and nature of the failure or misconduct. The sanctions may
include--
(a) In the case of refusal to provide or permit discovery under the
terms of this part, drawing negative factual inferences or treating the
refusal as an admission by deeming the matter, or certain facts, to be
established;
(b) Prohibiting a party from introducing certain evidence or
otherwise supporting a particular claim or defense;
(c) Striking pleadings, in whole or in part;
(d) Staying the proceedings;
(e) Dismissal of the action;
(f) Entering a decision by default;
(g) Ordering the party or attorney to pay the attorney's fees and
other costs caused by the failure or misconduct; and
(h) Refusing to consider any motion or other action that is not
filed in a timely manner.
Sec. 160.532 Collateral estoppel.
When a final determination that the respondent violated an
administrative simplification provision has been rendered in any
proceeding in which the respondent was a party and had an opportunity
to be heard, the respondent is bound by that determination in any
proceeding under this part.
Sec. 160.534 The hearing.
(a) The ALJ must conduct a hearing on the record in order to
determine whether the respondent should be found liable under this
part.
(b) (1) The respondent has the burden of going forward and the
burden of persuasion with respect to any:
(i) Affirmative defense pursuant to Sec. 160.410 of this part;
(ii) Challenge to the amount of a proposed penalty pursuant to
Sec. Sec. 160.404-160.408 of this part, including any factors raised
as mitigating factors; or
(iii) Claim that a proposed penalty should be reduced or waived
pursuant to Sec. 160.412 of this part.
(2) The Secretary has the burden of going forward and the burden of
persuasion with respect to all other issues, including issues of
liability and the existence of any factors considered as aggravating
factors in determining the amount of the proposed penalty.
(3) The burden of persuasion will be judged by a preponderance of
the evidence.
(c) The hearing must be open to the public unless otherwise ordered
by the ALJ for good cause shown.
(d)(1) Subject to the 15-day rule under Sec. 160.518(a) and the
admissibility of evidence under Sec. 160.540, either party may
introduce, during its case in chief, items or information that arose or
became known after the date of the issuance of the notice of proposed
determination or the request for hearing, as applicable. Such items and
information may not be admitted into evidence, if introduced--
(i) By the Secretary, unless they are material and relevant to the
acts or omissions with respect to which the penalty is proposed in the
notice of proposed determination pursuant to Sec. 160.420 of this
part, including circumstances that may increase penalties; or
(ii) By the respondent, unless they are material and relevant to an
admission, denial or explanation of a finding of fact in the notice of
proposed determination under Sec. 160.420 of this part, or to a
specific circumstance or argument expressly stated in the request for
hearing under Sec. 160.504, including circumstances that may reduce
penalties.
(2) After both parties have presented their cases, evidence may be
admitted in rebuttal even if not previously exchanged in accordance
with Sec. 160.518.
Sec. 160.536 Statistical sampling.
(a) In meeting the burden of proof set forth in Sec. 160.534, the
Secretary may introduce the results of a statistical sampling study as
evidence of the number of violations under Sec. 160.406 of this part,
or the factors considered in determining the amount of the civil money
penalty under Sec. 160.408 of this part. Such statistical sampling
study, if based upon an appropriate sampling and computed by valid
statistical methods, constitutes prima facie evidence of the number of
violations and the existence of factors material to the proposed civil
money penalty as described in Sec. Sec. 160.406 and 160.408.
(b) Once the Secretary has made a prima facie case, as described in
paragraph (a) of this section, the burden of going forward shifts to
the respondent
[[Page 8432]]
to produce evidence reasonably calculated to rebut the findings of the
statistical sampling study. The Secretary will then be given the
opportunity to rebut this evidence.
Sec. 160.538 Witnesses.
(a) Except as provided in paragraph (b) of this section, testimony
at the hearing must be given orally by witnesses under oath or
affirmation.
(b) At the discretion of the ALJ, testimony of witnesses other than
the testimony of expert witnesses may be admitted in the form of a
written statement. The ALJ may, at his or her discretion, admit prior
sworn testimony of experts that has been subject to adverse
examination, such as a deposition or trial testimony. Any such written
statement must be provided to the other party, along with the last
known address of the witness, in a manner that allows sufficient time
for the other party to subpoena the witness for cross-examination at
the hearing. Prior written statements of witnesses proposed to testify
at the hearing must be exchanged as provided in Sec. 160.518.
(c) The ALJ must exercise reasonable control over the mode and
order of interrogating witnesses and presenting evidence so as to:
(1) Make the interrogation and presentation effective for the
ascertainment of the truth;
(2) Avoid repetition or needless consumption of time; and
(3) Protect witnesses from harassment or undue embarrassment.
(d) The ALJ must permit the parties to conduct cross-examination of
witnesses as may be required for a full and true disclosure of the
facts.
(e) The ALJ may order witnesses excluded so that they cannot hear
the testimony of other witnesses, except that the ALJ may not order to
be excluded--
(1) A party who is a natural person;
(2) In the case of a party that is not a natural person, the
officer or employee of the party appearing for the entity pro se or
designated as the party's representative; or
(3) A natural person whose presence is shown by a party to be
essential to the presentation of its case, including a person engaged
in assisting the attorney for the Secretary.
Sec. 160.540 Evidence.
(a) The ALJ must determine the admissibility of evidence.
(b) Except as provided in this subpart, the ALJ is not bound by the
Federal Rules of Evidence. However, the ALJ may apply the Federal Rules
of Evidence where appropriate, for example, to exclude unreliable
evidence.
(c) The ALJ must exclude irrelevant or immaterial evidence.
(d) Although relevant, evidence may be excluded if its probative
value is substantially outweighed by the danger of unfair prejudice,
confusion of the issues, or by considerations of undue delay or
needless presentation of cumulative evidence.
(e) Although relevant, evidence must be excluded if it is
privileged under Federal law.
(f) Evidence concerning offers of compromise or settlement are
inadmissible to the extent provided in Rule 408 of the Federal Rules of
Evidence.
(g) Evidence of crimes, wrongs, or acts other than those at issue
in the instant case is admissible in order to show motive, opportunity,
intent, knowledge, preparation, identity, lack of mistake, or existence
of a scheme. This evidence is admissible regardless of whether the
crimes, wrongs, or acts occurred during the statute of limitations
period applicable to the acts or omissions that constitute the basis
for liability in the case and regardless of whether they were
referenced in the Secretary's notice of proposed determination under
Sec. 160.420 of this part.
(h) The ALJ must permit the parties to introduce rebuttal witnesses
and evidence.
(i) All documents and other evidence offered or taken for the
record must be open to examination by both parties, unless otherwise
ordered by the ALJ for good cause shown.
Sec. 160.542 The record.
(a) The hearing must be recorded and transcribed. Transcripts may
be obtained following the hearing from the ALJ. A party that requests a
transcript of hearing proceedings must pay the cost of preparing the
transcript unless, for good cause shown by the party, the payment is
waived by the ALJ or the Board, as appropriate.
(b) The transcript of the testimony, exhibits, and other evidence
admitted at the hearing, and all papers and requests filed in the
proceeding constitute the record for decision by the ALJ and the
Secretary.
(c) The record may be inspected and copied (upon payment of a
reasonable fee) by any person, unless otherwise ordered by the ALJ for
good cause shown.
(d) For good cause, the ALJ may order appropriate redactions made
to the record.
Sec. 160.544 Post hearing briefs.
The ALJ may require the parties to file post-hearing briefs. In any
event, any party may file a post-hearing brief. The ALJ must fix the
time for filing the briefs. The time for filing may not exceed 60 days
from the date the parties receive the transcript of the hearing or, if
applicable, the stipulated record. The briefs may be accompanied by
proposed findings of fact and conclusions of law. The ALJ may permit
the parties to file reply briefs.
Sec. 160.546 ALJ's decision.
(a) The ALJ must issue a decision, based only on the record, which
must contain findings of fact and conclusions of law.
(b) The ALJ may affirm, increase, or reduce the penalties imposed
by the Secretary.
(c) The ALJ must issue the decision to both parties within 60 days
after the time for submission of post-hearing briefs and reply briefs,
if permitted, has expired. If the ALJ fails to meet the deadline
contained in this paragraph, he or she must notify the parties of the
reason for the delay and set a new deadline.
(d) Unless the decision of the ALJ is timely appealed as provided
for in Sec. 160.548, the decision of the ALJ will be final and binding
on the parties 60 days from the date of service of the ALJ's decision.
Sec. 160.548 Appeal of the ALJ's decision.
(a) Any party may appeal the decision of the ALJ to the Board by
filing a notice of appeal with the Board within 30 days of the date of
service of the ALJ decision. The Board may extend the initial 30 day
period for a period of time not to exceed 30 days if a party files with
the Board a request for an extension within the initial 30 day period
and shows good cause.
(b) If a party files a timely notice of appeal with the Board, the
ALJ must forward the record of the proceeding to the Board.
(c) A notice of appeal must be accompanied by a written brief
specifying exceptions to the initial decision and reasons supporting
the exceptions. Any party may file a brief in opposition to the
exceptions, which may raise any relevant issue not addressed in the
exceptions, within 30 days of receiving the notice of appeal and the
accompanying brief. The Board may permit the parties to file reply
briefs.
(d) There is no right to appear personally before the Board or to
appeal to the Board any interlocutory ruling by the ALJ.
[[Page 8433]]
(e) Except for an affirmative defense under Sec. 160.410(b)(1) of
this part, the Board may not consider any issue not raised in the
parties' briefs, nor any issue in the briefs that could have been
raised before the ALJ but was not.
(f) If any party demonstrates to the satisfaction of the Board that
additional evidence not presented at such hearing is relevant and
material and that there were reasonable grounds for the failure to
adduce such evidence at the hearing, the Board may remand the matter to
the ALJ for consideration of such additional evidence.
(g) The Board may decline to review the case, or may affirm,
increase, reduce, reverse or remand any penalty determined by the ALJ.
(h) The standard of review on a disputed issue of fact is whether
the initial decision of the ALJ is supported by substantial evidence on
the whole record. The standard of review on a disputed issue of law is
whether the decision is erroneous.
(i) Within 60 days after the time for submission of briefs and
reply briefs, if permitted, has expired, the Board must serve on each
party to the appeal a copy of the Board's decision and a statement
describing the right of any respondent who is penalized to seek
judicial review.
(j)(1) The Board's decision under paragraph (i) of this section,
including a decision to decline review of the initial decision, becomes
the final decision of the Secretary 60 days after the date of service
of the Board's decision, except with respect to a decision to remand to
the ALJ or if reconsideration is requested under this paragraph.
(2) The Board will reconsider its decision only if it determines
that the decision contains a clear error of fact or error of law. New
evidence will not be a basis for reconsideration unless the party
demonstrates that the evidence is newly discovered and was not
previously available.
(3) A party may file a motion for reconsideration with the Board
before the date the decision becomes final under paragraph (j)(1) of
this section. A motion for reconsideration must be accompanied by a
written brief specifying any alleged error of fact or law and, if the
party is relying on additional evidence, explaining why the evidence
was not previously available. Any party may file a brief in opposition
within 15 days of receiving the motion for reconsideration and the
accompanying brief unless this time limit is extended by the Board for
good cause shown. Reply briefs are not permitted.
(4) The Board must rule on the motion for reconsideration not later
than 30 days from the date the opposition brief is due. If the Board
denies the motion, the decision issued under paragraph (i) of this
section becomes the final decision of the Secretary on the date of
service of the ruling. If the Board grants the motion, the Board will
issue a reconsidered decision, after such procedures as the Board
determines necessary to address the effect of any error. The Board's
decision on reconsideration becomes the final decision of the Secretary
on the date of service of the decision, except with respect to a
decision to remand to the ALJ.
(5) If service of a ruling or decision issued under this section is
by mail, the date of service will be deemed to be 5 days from the date
of mailing.
(k)(1) A respondent's petition for judicial review must be filed
within 60 days of the date on which the decision of the Board becomes
the final decision of the Secretary under paragraph (j) of this
section.
(2) In compliance with 28 U.S.C. 2112(a), a copy of any petition
for judicial review filed in any U.S. Court of Appeals challenging the
final decision of the Secretary must be sent by certified mail, return
receipt requested, to the General Counsel of HHS. The petition copy
must be a copy showing that it has been time-stamped by the clerk of
the court when the original was filed with the court.
(3) If the General Counsel of HHS received two or more petitions
within 10 days after the final decision of the Secretary, the General
Counsel will notify the U.S. Judicial Panel on Multidistrict Litigation
of any petitions that were received within the 10 day period.
Sec. 160.550 Stay of the Secretary's decision.
(a) Pending judicial review, the respondent may file a request for
stay of the effective date of any penalty with the ALJ. The request
must be accompanied by a copy of the notice of appeal filed with the
Federal court. The filing of the request automatically stays the
effective date of the penalty until such time as the ALJ rules upon the
request.
(b) The ALJ may not grant a respondent's request for stay of any
penalty unless the respondent posts a bond or provides other adequate
security.
(c) The ALJ must rule upon a respondent's request for stay within
10 days of receipt.
Sec. 160.552 Harmless error.
No error in either the admission or the exclusion of evidence, and
no error or defect in any ruling or order or in any act done or omitted
by the ALJ or by any of the parties is ground for vacating, modifying
or otherwise disturbing an otherwise appropriate ruling or order or
act, unless refusal to take such action appears to the ALJ or the Board
inconsistent with substantial justice. The ALJ and the Board at every
stage of the proceeding must disregard any error or defect in the
proceeding that does not affect the substantial rights of the parties.
PART 164--SECURITY AND PRIVACY
0
1. The authority citation for part 164 is revised to read as follows:
Authority: 42 U.S.C. 1320d-1320d-8 and sec. 264, Pub. L. No.
104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)).
0
2. In Sec. 164.530, revise paragraph (g) to read as follows:
Sec. 164.530 Administrative requirements.
* * * * *
(g) Standard: refraining from intimidating or retaliatory acts. A
covered entity--
(1) May not intimidate, threaten, coerce, discriminate against, or
take other retaliatory action against any individual for the exercise
by the individual of any right established, or for participation in any
process provided for by this subpart, including the filing of a
complaint under this section; and
(2) Must refrain from intimidation and retaliation as provided in
Sec. 160.316 of this subchapter.
* * * * *
[FR Doc. 06-1376 Filed 2-10-06; 2:59 pm]
BILLING CODE 4153-01-P