«Department of Health and Human Services has submitted this rule to the Office of the Federal Register. The official version of the rule will be ...»
Comment: We received several comments on the definition of “person” in §155.285(a)(2). Some commenters found the broad definition of “person” warranted for imposing CMPs for violations of section 1411(g) of the Affordable Care Act. However, a portion of commenters requested that HHS exclude assisters from the definition of “person.” We also received one comment noting that the inclusion of QHP issuers potentially creates confusion regarding the source of required application information provided to establish eligibility to purchase a QHP.
Response: Exchanges involve the coordination of a wide variety of individuals and
these and the possibility that they could engage in the actions enumerated in §155.285(a)(1). We want to ensure that these individuals and entities are on notice of the penalties they could incur for the misuse of information. The inclusion of assisters and similar consumer assistance entities within §155.285 is discussed in detail above in the comment response to questions regarding the application of §155.206 and §155.285 to assisters. Finally, the inclusion of QHP issuers in the definition is purposeful for the reasons noted above and we do not share the concern of the commenter that this creates confusion. Many of the entities included in the definition are required to provide information for use by the Exchange, including QHP issuers; however, it is only the provision of false or fraudulent information or improper use or disclosure of information that is penalized. We finalize the definition as proposed.
Comment: We received many comments in support of the proposed provisions of §155.285(b), which lists the factors used to determine the amount of CMPs imposed. A few commenters suggested additional factors to be considered including, whether the violation resulted in other legal consequences for an individual, attempts at taking corrective action, and the extent to which assistance personnel were deceived by the consumer into providing false or incorrect information.
Response: We appreciate the support we received for the proposed factors used to determine the amount of CMPs imposed. We have considered the factors commenters suggested and find that only minor revisions to the proposed set of factors are necessary. For example, we have added one additional factor at subparagraph (b)(1)(viii) to include a factor allowing HHS to take into consideration whether other remedies or penalties have been imposed for the same conduct or occurrence. We have also clarified the scope of the factors in subparagraphs (b)(2)(i)
harm to an individual’s reputation, respectively. We note that harm to an individual’s reputation could include, for example, actions impacting a consumer’s credit rating or incurring costs on behalf of another person without their knowledge or consent. Additionally, §155.285 does not require a corrective action plan, so we do not include corrective steps taken in the factors provided. We believe the extent to which assistance personnel were deceived by the consumer is adequately encompassed in subparagraph (b)(2). Therefore, we finalize the provisions with the modifications to §155.285(b)(1)(viii) and (b)(2)(i) and (ii) as noted above.
Comment: We received considerable support for the reasonable cause provision proposed in §155.285(b)(3). In addition, several commenters sought clarification or safe harbors regarding circumstances where false information is provided due to a mistake or misunderstanding. We received a couple comments requesting a safe harbor specifically for QHP issuers who rely on information provided to them from both the Exchange and consumers, since QHP issuers may have no way to verify information independently. Another commenter sought a safe harbor for conduct relating to calendar years 2014 and 2015 because of the uncertain environment issuers worked in during initial open enrollment. Commenters believed that levying a CMP in such cases would be too severe.
Response: Section 155.285(b)(3) states that no penalty will be imposed if HHS determines that there was a reasonable cause for the failure to provide correct information and that the person acted in good faith. The situations commenters cited would likely fall within this exception. We note that violations must be knowing and willful and information provided merely by mistake and in good faith is not subject to a CMP.
Comment: We received a handful of comments regarding the imposition of penalties, as
provisions. One commenter shared concern that there is no maximum penalty defined, which could cause financial devastation to some consumer assistance entities. A couple commenters requested more clarity on what constitutes a submission of information and questioned whether an application which is started on the phone but completed online results in two submissions or one. Another commenter was concerned about permitting HHS to estimate the number of consumers affected by the violation to calculate the maximum penalty. The commenter supported, instead, using the number of consumers directly affected by the violation or placing a maximum on the estimate calculated by HHS based on the size of the consumer population served by the consumer assistance entity to prevent unreasonable penalties for the assister community. Finally, one commenter requested clarification that §155.285(c) does not limit penalties under State law or a State’s ability to take action to protect consumers.
Response: Although §155.285(c) provides a maximum cap per violation, there is no global cap on CMPs. CMPs are intended to discourage the misuse of information; therefore, we believe that providing a global cap on CMPs would defeat there intended purpose. In response to the questions received, we note that one application, no matter the number of modes used to complete it, is considered one submission for purposes of imposing a CMP. This concern is further mitigated by the availability of an appeal prior to the imposition of a penalty during which this issue may be explored. We finalize the provisions as proposed. Finally, in response to the request for clarity about the role of State law in relation to §155.285, we note that the standards in §155.285 do not limit a State’s ability to impose penalties or protect consumers under State law.
Comment: In response to §155.285(d), we received a comment requesting that notices be
Response: All Exchange-related notices, including those related to CMPs, must comply with the requirements for notices established in §155.230.
Comment: Some commenters requested that §155.285(e) be amended to provide additional time to request a hearing. The commenters noted, that under the proposed regulation, there are no additional options for an individual who misses the 60-day timeframe to request a hearing. One commenter suggested permitting additional time to request a hearing under a good cause exception. Another commenter suggested permitting an additional 60-day period to request a hearing following the due date of a CMP payment. The commenter noted that a payment date may provide more effective notice to the individual and also that many entities may have segregated chains of duty and the appropriate person may not be notified in time to request a hearing.
Response: We disagree with commenters that 60 days from the date of the notice in §155.285(d) is insufficient for an individual to request a hearing. We believe 60 days to be neither too short to provide adequate notice nor too long to delay the process of imposing a CMP. We finalize the provision as proposed.
Comment: As proposed in §155.206, several commenters recommended that CMS first require any consumer assistance entity that is alleged to have provided false information or improperly used or disclosed information to enter into a corrective action plan before a CMP could be issued.
Response: We believe that §155.285 provides HHS or OIG sufficient flexibility to offer an entity or individual an opportunity to take corrective action or propose a plan of corrective
penalty. Particularly, HHS might offer an opportunity for corrective action in relation to minor infractions that expose entities or individuals to a penalty under §155.285.
Comment: Some commenters requested clarification regarding payment methodologies and timeframes for CMPs. For example, one commenter questioned whether the entirety of the penalty would be due upon payment of taxes or upon notification of being found guilty of a violation.
Response: We do not provide this level of detail in the regulation at this time. We will address this issue in the future.
Comment: One commenter expressed disagreement with the proposed six-year statute of limitations in §155.285(i). The commenter noted that between IRS review, issuer validation of payments, and other methods of cross-referencing and auditing, each incident of a violation should be able to be discovered within two years. The commenter also noted that a longer statute of limitations may lead to collection procedures, such as wage garnishments, to collect unpaid debt, which can extend the efforts needed to collect the money for a CMP.
Response: We believe the six-year statute of limitations period is appropriate. This period is not indefinite and, therefore, will hopefully not discourage efforts by consumer assistance entities. However, HHS’s goal in issuing the CMP rule is to encourage program compliance, prevent misconduct, and remedy violations promptly and, therefore, we do not want to provide a period that is too short to encourage strict compliance with the rule and provide protection for PII. We believe six years provides sufficient time for HHS to discover and investigate any potential CMPs and acknowledges the reality that in many situations, misuse of a consumer’s personally identifiable information may not be discovered by a consumer and reported to HHS
Comment: Several commenters advocated against duplication of penalties in instances where certain types of violations may already subject them to other types of penalties. A few commenters noted that the Health Insurance Portability and Accountability Act already governs certain critical aspects of compliance related to the protection of consumer personal information.
Response: We understand commenters’ concern about the potential duplication of penalties, and have amended §155.285(b)(1) to include a factor allowing HHS to take into consideration whether other remedies or penalties have been imposed for the same conduct or occurrence. It would be the responsibility of the entity to bring such information to HHS’s attention. However, we also note that HHS will consider referring cases to appropriate law enforcement officials based on the facts and circumstances of the violation.
Comment: One commenter requested clarification regarding whether an individual would be held accountable for repayment of an overpayment of the advance premium tax credit or CSRs paid on a consumer’s behalf, in addition to a CMP.
Response: The provisions of §155.285 concern only the imposition of CMPs and not payment or repayment of advance payments of the premium tax credit or CSRs as a result of the misuse of information. This provision has no effect on the Department of Treasury’s authority to recoup overpayments of the advance payment of the premium tax credit or CSRs paid on a consumer’s behalf.
Comment: We received one comment that, although, we reference PII, it is not defined in regulation.
Response: There are various definitions of PII, and we believe the adoption of any one of them at this stage may unduly limit HHS’s ability to adequately redress violations of the rule.
manipulated, combined, and ultimately used to re-identify persons based on de-identified data, we believe that PII is an evolving concept that may not be fully captured in a single definition.
We, therefore, will not provide a specific definition of PII in the text of §155.285 at this time.
We do note that OMB Memoranda M-07-16 (May 22, 2007) generally defines PII as information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name.
Summary of Regulatory Changes We are finalizing the provisions proposed in §155.285 of the proposed rule regarding CMPs, with the following modifications: In an effort to prevent confusion, in §155.285(c) we have removed the references to section 1411(h)(1) and (2) of the Affordable Care Act and have instead inserted the numerical maximum penalty amounts. In §155.285(a)(1)(ii), we have added “or fraudulent” after “knows to be false” to make the text consistent with section 1411(h)(1) of the Affordable Care Act. In §155.285(b)(1) and (2), we have added language to clarify that the factors in these provisions are “including, but not limited to” the factors listed in their subparagraphs. In §155.285(b)(1)(viii), we have added a factor allowing HHS to take into consideration whether other remedies or penalties have been imposed for the same conduct or occurrence. We have clarified the scope of the factors in subparagraphs (b)(2)(i) and (ii) to account for violations that could have resulted in actual or potential financial harm or could have resulted in actual or potential harm to an individual’s reputation, respectively. We have made a minor change to the wording in §155.285(d)(2) by substituting the word “appeal” for “request.”
penalty” in §155.285(d)(2) with a cross reference to §155.285(f). In §155.285(f), we have rephrased the paragraph to read “HHS has proposed to impose” rather than “HHS has imposed.” Finally, we are substituting the reference to “CMS” with “HHS” in (g)(1) and, in consultation with OIG, we are finalizing concurrent jurisdiction with respect to §155.285(a)(1)(ii) and not §155.285(a)(1)(iii) at this time.