«Department of Health and Human Services has submitted this rule to the Office of the Federal Register. The official version of the rule will be ...»
Comment: We received some comments in support of the proposed amendments to §155.260(g). However, a few commenters also requested additional amendments to the provision. For example, one commenter requested that we amend §155.260(g) to clarify that outreach and follow-up efforts made by community assisters is not impeded by the reference to §155.285. Specifically, the commenter encouraged HHS to specify that, with receipt of express consumer consent, PII can be used to conduct outreach to follow up with individuals who still need to complete applications or for outreach to help individuals maintain and renew existing health coverage. Another commenter suggested that the provision note that the use and retention of PII is permissible with the consumer’s consent, in order to ensure consistency with the Navigator provisions at §155.210(e)(6) and §155.225(f) which permit such use. The commenter also requested amendments to §155.260(a) and (b) to specify that retention of PII is permissible with the consent of the consumer.
Response: We acknowledge the importance of consumer assistance entities being able to contact consumers in order to follow-up regarding applications for coverage or annual renewals.
However, §155.260 as proposed, does not impede these types of outreach. Rather, §155.260
proposed rule at §155.285. Similarly, a Navigator’s use of information as described in §155.210(e)(6) and §155.225(f) is not prohibited under §155.260(g) and we do not see the need to include further clarification of that in the rule. Finally, the requested amendments to §155.260(a) and (b) are outside the scope of this proposed rule. Therefore, we intend to finalize §155.260(g) as proposed.
Comment: Some commenters expressed concern about the proposed amendment.
Commenters thought the reference to §155.285 was duplicative and that the application of §155.260 may, in some cases, be broader than the specific prohibitions on disclosure intended by section 1411(g) of the Affordable Care Act and should not be linked to §155.260.
Response: We disagree with the contention that the reference to §155.285 in §155.260 is duplicative. The cross-reference links the improper use and disclosure of PII to the imposition of CMPs as prescribed in section 1411(g) and (h) of the Affordable Care Act. Therefore, we finalize the provision as proposed.
Comment: We received many comments to both §155.260 and §155.285 requesting clarification about the role of PII with respect to CMPs.
Response: Because of the relationship between §155.260 and §155.285, we address comments on §155.206 in the preamble related to §155.285(a) of this final rule.
Summary of Regulatory Changes We are finalizing the addition to §155.260 as proposed, with a minor change where we have inserted the numerical penalty amount instead of a reference to section 1411(h) of the Affordable Care Act where the maximum penalty is specified.
e. Bases and Process for Imposing Civil Money Penalties for Provision of False or Fraudulent
In §155.285(a), in accordance with the grounds on which penalties may be imposed as specified in section 1411(h) of the Affordable Care Act, we proposed the circumstances under which HHS may impose CMPs on a person if HHS determines that the person has provided false or fraudulent information as prohibited by section 1411(h)(1) or improperly used or disclosed information in violation of section 1411(g).
In §155.285(a)(1)(i), we proposed that if any person fails to provide correct information under section 1411(b) of the Affordable Care Act and such failure is attributable to negligence or disregard of any regulations of the Secretary, the person may be subject to a CMP. Under proposed §155.285(a)(1)(i), if a person fails to make a reasonable attempt to provide accurate, complete and comprehensive information and as a result provides incorrect information, the person may be subject to a CMP.
Second, in §155.285(a)(1)(ii), we proposed that if a person knowingly and willfully provides false or fraudulent information under section 1411(b) of the Affordable Care Act, the person may be subject to a CMP. We noted that if consumer assistance personnel such as an agent, broker, Navigator, certified application counselor, or non-Navigator assistance personnel, were to in some manner directly provide false or incorrect information required under section 1411(b), they may also be subject to a CMP. Third, in §155.285(a)(1)(iii), we proposed that if a person knowingly and willfully uses or discloses information in violation of Affordable Care Act section 1411(g), the person may be subject to a CMP. In §155.285(a)(1)(iii)(A) through (C), we proposed types of activities that would be in violation of section 1411(g) of the Affordable Care Act and in §155.285(a)(2), we proposed a definition of the term “person.” In §155.285(b), we proposed the factors that HHS may take into consideration when determining the amount of CMPs to impose. In §155.285(b)(3), we implemented the reasonable
penalty will be imposed under §155.285(a)(1)(i) if HHS determines that there was a reasonable cause for the failure to provide correct information required on an Exchange application and that the person acted in good faith.
In §155.285(c), we proposed maximum penalties for each different type of violation.
In §155.285(d), we proposed standards for a notice of intent to issue a CMP that HHS must send to the person against whom the CMP may be imposed. In §155.285(d)(1)(i)-(viii), we proposed eight elements that must be included in the notice. We proposed that the person may request a hearing before an ALJ on the proposed penalty by filing a request pursuant to the procedure that will be outlined in the notice of intent to impose a penalty that the person receives.
In §155.285(e), we proposed the consequences for a person who fails to request a hearing in a timely manner.
We proposed that HHS may assess the proposed CMP 60 calendar days after the date of issuance printed on the notice of intent to issue a CMP. In §155.285(e)(1), we proposed that HHS will notify the person in writing of any penalty that has been imposed, the means by which the person can satisfy the penalty, and the date on which the penalty is due. We proposed in §155.285(e)(2) that a person has no right to appeal a penalty with respect to which the person has not timely requested a hearing.
In §155.285(f), we proposed to use the existing appeals framework in regulation at 45 CFR Part 150, Subpart D.
In §155.285(g), we proposed that CMS and OIG will share enforcement authority to impose the CMPs in §155.285.
In §155.285(h), we proposed a settlement authority provision to ensure CMS is able to settle any issue or case described in §155.
285(a) if necessary. Finally, in §155.285(i), we proposed a six year statute of limitations, beginning from the date on which the violation
Comment: We received some comments regarding §155.285(a)’s reference to basing the imposition of a CMP on “credible evidence” if HHS “reasonably determines” that someone has violated the rule. The commenters recommended that, because a CMP could be potentially significant, the standard should be based on a preponderance of the evidence. The commenters also noted that this standard is consistent with the Administrative Procedures Act.
Response: We maintain that the standard proposed in §155.285(a) is appropriate in light of the fact that a CMP is not immediately imposed but, instead, imposed only after a process involving notice and the right to a hearing is provided. If HHS identifies circumstances that meet the standard set in §155.285(a), the resultant action is a notice informing the person of the potential imposition of a CMP. The person then has the right to request a hearing in front of an ALJ in accordance with h§155.285(d)(2) before the CMP is levied. For these reasons, we finalize the standard as proposed.
Comment: We received one comment regarding the definition of negligence, provided in §155.285(a)(i)(A). The commenter sought clarification as to what is considered a “reasonable” attempt to provide accurate, complete, and comprehensive information.
Response: The proposed definition of “negligence” is modeled on section 6662 of the Internal Revenue Code and was incorporated based on the similarities between providing information on tax filing forms and completing an application for Exchange coverage. This definition should provide CMS and the public with ample history on which they may rely to assess negligence in this context. We also believe this definition is appropriate because it holds actions that are made through honest mistake and error (which are protected by the reasonable cause provision in §155.285(b)(3)) not culpable for a violation. We finalize the definition as
Comment: We received many comments regarding the imposition of CMPs under §155.206 and §155.285. Some commenters recommended that HHS retain discretion to impose CMPs under both sections, citing some violations under §155.285 will also violate consumer assistance standards and, in those instances, HHS should levy penalties under both provisions.
These commenters noted that allowing penalties under both provisions will give Navigators and assisters in the Federally-facilitate Exchange an extra incentive to maintain the privacy of those they assist. Another group of commenters recommended that where violations of §155.206 and §155.285 overlap, HHS should use its discretion to impose a CMP under only one section.
Similarly, many commenters in this cohort urged HHS to exempt consumer assistance entities from §155.285, explaining that assistance personnel do not actually provide information as part of the process of applying for coverage or an exemption, and therefore it was difficult to see how they could provide false or fraudulent information in violation of §155.285. These commenters considered imposing violations for consumer assistance entities under both sections would be duplicative.
Response: We disagree that consumer assistance personnel should be exempt from the provisions of 45 CFR 155.285. Any Navigator, non-Navigator assistance personnel, or certified application counselor who encourages a consumer to submit false or fraudulent information and then enters that information into the application for the consumer, or enters false or fraudulent information without the knowledge of the consumer, might be in violation of either §155.285 or §155.206. Therefore, we maintain that where conduct by a consumer assistance entity may warrant CMPs under either §155.285 or §155.206, HHS should have discretion to determine
in a situation where CMPs could be imposed under both §155.206 and §155.285, CMS will take that into account as a factor under §155.285(b)(1)(viii).
Comment: Commenters expressed a general concern that the provisions of §155.285 might have a chilling effect on consumer assistance entities, particularly those that rely on voluntary participation. These commenters urged us to limit CMPs to egregious violations of selected requirements where there are no other enforcement mechanisms in place. Commenters felt that fewer people might be willing to become assisters if they feared being held responsible for CMPs, particularly for information provided and attested to by applicants.
Response: We understand the concerns raised by commenters about the potential for these penalties to discourage participation as a consumer assistance entity. However, we are finalizing the provisions, and their application to consumer assistance entities, as proposed. The purpose of these provisions is to ensure consumer information is safeguarded, no matter where it is in the eligibility or enrollment process or whether the consumer seeks the assistance of a consumer assistance entity. HHS’s goal in issuing the CMP rule is to encourage program compliance, prevent misconduct, and remedy violations promptly. We do not think these goals will be served by lessening the proposed standards for imposing CMPs.
Comment: We received comments expressing support for the grounds proposed for imposing CMPs. These commenters viewed the authority to impose CMPs as an effective way to safeguard the use of consumer information. However, many commenters also sought clarification about what constitutes improper use and disclosure of PII under the NPRM and in relation to section 1411(g) of the Affordable Care Act. Several of these commenters requested that §155.285 be amended to note that, with receipt of consent, PII can be used to conduct
help individuals maintain and renew existing health coverage. Other commenters feared any relaxation of PII standards would compromise consumer information and cause harm.
Response: Protection of consumer information is one of the most critical duties of consumer assistance entities and Exchanges. Section 155.260 provides privacy and security standards handling and safeguarding consumers’ PII. Section 155.260 also provides that the Secretary can determine additional uses and disclosures of PII and develop a framework through which Exchanges can seek the Secretary’s approval of other requested uses and disclosures of eligibility and enrollment PII that would ensure the efficient operation of the Exchange, comply with other applicable law and policy, and require the consent of the individual subject of the PII prior to the requested use or disclosure. Uses and disclosures of information that are not permitted by §155.260 or otherwise permitted by statute or regulation, therefore, are prohibited.
Those prohibited uses and disclosures are the focus of the penalties imposed in §155.285 to the extent they are knowing and willful. But, we note that some uses and disclosures, as specified in rule, are permissible with the specific consent of the consumer.