«Department of Health and Human Services has submitted this rule to the Office of the Federal Register. The official version of the rule will be ...»
CFR 155.260. Consumer assistance entities would also be required to comply with other future requirements when any such requirements go into effect.
Comment: Some commenters were concerned that consumer assistance entities might be penalized for inadvertent, technical, or administrative errors, or misunderstandings, and wanted to ensure that consumer assistance personnel would not be responsible for errors due to system issues, complex and changing systems, policies, workarounds, as well as lack of information from issuers. Other commenters expressed concern about being found in noncompliance on the basis of subregulatory guidance or frequently answered questions (FAQs) that they may not have seen or known about. Some commenters suggested that HHS develop a publicly available, searchable database or warehouse of rules and processes. Additional commenters requested that we provide clarity regarding the level of violation that might trigger investigation, and asked that we limit the use of CMPs to cases of egregious behavior, such as when the violation was a result of willful neglect or results in significant harm to a consumer.
Response: We expect that the changes we have made to proposed §155.206(c) in this final rule will help provide clarity regarding the standards consumers assistance entities must meet in order to avoid any potential CMPs under this section. We also understand commenters’ concerns about changes in best practices and FAQs. As we explained above, HHS’s enforcement authority under this section extends only to requirements that are established under section 1321(a)(1) of the Affordable Care Act. From time to time, we have issued and will continue to issue best practices, FAQs, and other subregulatory guidance interpreting these requirements. We further note that we offer anyone being investigated under this section an opportunity to respond under §155.206(e) and (g), and consumer assistance entities may use this
required, including confusion regarding requirements as interpreted through subregulatory guidance. Finally, pursuant to section 2723(b)(2)(C)(iii) of the PHS Act, we have provided in §155.206(k) that no penalties will be assessed for any period of time during which a consumer assistance entity neither knew nor exercising reasonable diligence should have known of the violation, or any time afterwards if the violation was corrected within 30 days and due to reasonable cause and not wilful neglect. Comment: Some commenters asked us to further define “reasonably determined,” the standard in §155.206(c) for HHS’s finding that a consumer assistance entity has failed to comply with applicable Federal regulatory requirements.
Response: In §155.206(c), we proposed that a reasonable determination would be “based on the outcome of the investigative process outlined in paragraphs (d) through (i) of this section.” This standard is meant to capture the fact that a CMP would not immediately be imposed, but instead imposed only after HHS provides a process involving notice, consideration of any additional information or documentation submitted by the consumer assistance entity pursuant to §155.206(e), consideration of the factors outlined in §155.206(h), and the consumer assistance entity’s right to a hearing pursuant to §155.206(m). If HHS identifies circumstances that meet the standard set in §155.206(c), it will send a notice informing the consumer assistance entity of the assessment of a CMP under §155.206(l). The consumer assistance entity then has the right to request a hearing in front of an Administrative Law Judge in accordance with §155.206(m) before the CMP is levied.
Comment: Several commenters advocated against the duplication of penalties in instances where certain types of violations may already subject them to other types of penalties.
A few commenters noted that the Health Insurance Portability and Accountability Act already
Response: We understand commenters’ concern about the potential for a violation to be punished twice under different enforcement schemes, and we have amended §155.206(h) to include a factor allowing HHS to take into consideration whether other remedies or penalties have been assessed and/or imposed for the same conduct or occurrence. It would be the responsibility of the consumer assistance entity to bring such information to HHS’s attention.
Comment: Several commenters emphasized the need for consumer assistance training about CMP implementation, and more robust training regarding any rules whose violation might trigger a CMP investigation, including circumstances in which consumers’ personally identifiable information (PII) can be collected, and appropriate uses and storage of PII. A few commenters were concerned that the restrictions on retaining consumer PII might prevent consumer assistance entities from keeping sufficient information to refute allegations of misconduct.
Response: We believe that the protection of consumer information is one of the most critical duties of consumer assistance entities. Section 155.215(b)(2)(xi) requires all Navigators in FFEs, including State Partnership Exchanges, as well as all non-Navigator assistance personnel to which §155.215 applies, to receive training on the privacy and security standards applicable under §155.260 for handling and safeguarding consumers’ personally identifiable information. Section 155.215(b)(1)(iii) requires that all Navigators in FFEs, including State Partnership Exchanges, and all non-Navigator assistance personnel to which §155.215 applies, complete and achieve a passing score on all approved certification examinations prior to carrying out any consumer assistance functions under §155.205(d) and (e) or §155.210. And §155.225(d)(3) requires certified application counselors to comply with the Exchange’s privacy
security standards. To implement these requirements, HHS has included detailed privacy and security requirements in its agreements, contracts, and grant terms and conditions with the consumer assistance entities that are carrying out functions in States with an FFE, including a State Partnership Exchange. We recognize that these strong consumer protections restrict the personal consumer information that consumer assistance entities are able to retain and therefore limit the information available to them in preparing a response to a notice of investigation in §155.206(e). If any consumer assistance entity feels limited in their ability to respond to a notice of investigation, we encourage them to explain any rules and policies that prevented them from retaining information they believe would have been exculpatory. HHS may take such explanations into account under the factors outlined in §155.206(h).
Comment: We received a number of comments on our proposed bases for initiating an investigation of a potential violation in §155.206(d). Commenters supported explicitly allowing any entity, individual, or individual’s authorized representative to file a complaint with HHS alleging that a consumer assistance entity has violated the FFE rules applicable to them. Some commenters asked HHS to clarify the process for filing complaints, including whether complaints filed at other HHS offices for other enforcement purposes would, if applicable, be shared with the office responsible for initiating investigations under §155.206 and trigger investigations under this section. Other commenters asked that we require consumer assistance entities to post information about the complaint process to ensure that consumers understand their rights about how to file a complaint.
Response: We anticipate providing further guidance regarding how and where individuals and entities may file complaints against consumer assistance entities or individuals. To ensure
§155.206(d)(1) to clarify that all information received or learned by HHS, whether through communications from sources outside HHS or not, could trigger an investigation into consumer assistance entity noncompliance. For example, if HHS discovers possible noncompliance by reviewing data or information already available to it through its own monitoring efforts, rather than by reviewing new information given to it by external, non-HHS sources, under final §155.206(d)(1) that information could serve as the basis for initiating an investigation. We have also modified proposed §155.206(d)(1)(iii) to align it with language in §155.206(d)(1) and §155.206(d)(2) indicating that HHS may consider information “that a consumer assistance entity may have engaged or may be engaging” in noncompliance as described in §155.206(c). We are finalizing the rest of §155.206(d) as proposed.
Comment: A few commenters asked for clarification regarding the standards HHS will use to determine whether an investigation is warranted. As proposed, §155.206(e) required HHS to provide consumer assistance entities notice of an investigation and 30 days to respond with evidence, each time HHS learns of a potential violation. Instead, commenters requested that HHS make a preliminary assessment of complaints to determine their credibility before initiating a formal investigation under §155.206(e), to avoid imposing unnecessary administrative burdens on consumer assistance entities, and to prevent individuals and organizations from submitting complaints with the purpose of disrupting Exchange operations.
Response: We agree with commenters that HHS should not issue notice to a consumer assistance entity, with the accompanying 30 days to respond to the allegation, until HHS has determined that a formal investigation is warranted. We have amended §155.206(e) to specify that HHS will provide a written notice to the consumer assistance entity when HHS performs a
Comment: One commenter agreed that the CMP process, as proposed, provides a reasonable time frame to close out investigations. Another commenter asked that the time frame for consumer assistance entities to respond to the notice of investigation be increased from 30 days to 60 days.
Response: We believe 30 days to respond to HHS’s notice of investigation in §155.206(e) is a reasonable amount of time, particularly because the consumer assistance entity may request an extension of another 30 days under §155.206(f) if the entity cannot prepare a response within the initial 30-day period. Therefore, we are finalizing the 30-day response period in §155.206(e) as proposed.
Comment: Commenters generally supported the proposed factors in §155.206(h) for determining noncompliance and the amount of any CMPs assessed. Several commenters appreciated the case-by-case nature of this process, and agreed that the determination should take into account factors like the consumer assistance entity’s previous or ongoing record of compliance, the gravity and frequency of the violation, and any financial harm incurred by the consumer. One commenter suggested that HHS should assess penalties only if the violation is intentional and causes harm, and another asked that CMPs be suspended if the entity was acting in good faith on behalf of the individual assisted. One commenter recommended that we move the factor regarding the degree of culpability of the consumer assistance entity, proposed at §155.206(h)(2)(i), from the list of factors that HHS may consider under §155.206(h)(2), to the list of factors that HHS must consider under §155.206(h)(1).
Response: We believe that the factors as proposed in §155.206(h) are responsive to commenters concerns. For example, HHS is required to take into account the harm caused by a
of the violation, which may be determined in part by whether the violation caused, or could reasonably be expected to cause, adverse impacts, and the magnitude of those impacts. We based these factors on a longstanding interpretation of what “gravity of the violation” means and what it may include under the HIPAA enforcement scheme at 45 CFR 150.317. HHS may also take into account the degree of culpability of the consumer assistance entity under §155.206(h)(2)(i). We believe this factor will generally play an important role in HHS’s determination of whether CMPs should be assessed, but we are finalizing this factor as proposed because the mandatory factors in §155.206(h)(1) track the requirements of section 2723(b)(2)(C)(ii) of the PHS Act, while the permissive factors in §155.206(h)(2) are not statutory requirements. Additionally, we believe that the limitations on CMPs described in §155.206(k) provide sufficient protections for consumer assistance entities acting in good faith on behalf of consumers. Therefore, we are finalizing the other factors listed in §155.206(h) as proposed, with the addition, as discussed above, of a factor regarding whether other remedies or penalties have been assessed and/or imposed for the same conduct or occurrence.
Comment: One commenter requested clarity regarding whether HHS could assess a lesser amount per day than the maximum of $100, and recommended against the assessment of a lesser amount. One commenter suggested that when the number of individuals directly affected by the violation cannot be determined, there should be a maximum placed on the estimate calculated by HHS, based on the size of the consumer population previously assisted by the entity. One commenter requested that HHS exclude from the time frame for which a penalty is assessed any time during which the investigation is being conducted, provided the entity or individual stops
Response: The maximum penalty provided in §155.206(i) is the per-day limit on the amount of any CMP that may be assessed. HHS may determine that a lesser amount is appropriate, based on an analysis of the relevant factors in §155.206(h). We believe that a reasonable estimate of individuals directly affected, as we explained in the preamble to the proposed rule, would be based on available information, such as the data from a Federal Navigator grantee’s quarterly or weekly report concerning the number of consumers assisted.