Procedures for Non-Privacy Administrative Simplification Complaints Under the Health Insurance Portability and Accountability Act of 1996, 15329-15331 [05-5795]
Download as PDF
<![CDATA[
Federal Register / Vol. 70, No. 57 / Friday, March 25, 2005 / Notices
requirements at § 493.1100 through
§ 493.1105.
Subpart K—Quality System for
Nonwaived Testing
The ASHI requirements are equal to
or more stringent than the CLIA
requirements at § 493.1200 through
§ 493.1299. For instance, ASHI’s control
procedure requirements for the test
procedures Nucleic Acid Testing and
Flow Cytometry are more specific and
detailed than the CLIA language for
requirements for control procedures.
Sections 493.1256(c)(1) and (c)(2)
require control materials that will detect
immediate errors and monitor accuracy
and precision of test performance that
may be caused by test system failures,
environmental conditions and variance
in operator performance. ASHI
standards provide detailed, specific
requirements for the control materials to
be used to meet these CLIA
requirements.
Subpart M—Personnel for Nonwaived
Testing
We have determined that ASHI
requirements are equal to or more
stringent than the CLIA requirements at
§ 493.1403 through § 493.1495 for
laboratories that perform moderate and
high complexity testing. Experience
requirements for Director, Technical
Supervisor, and General Supervisor
exceed CLIA’s personnel experience
requirements in the specialty of
Histocompatibility.
Subpart Q—Inspections
We have determined that the ASHI
requirements are equal to or more
stringent than the CLIA requirements at
§ 493.1771 through § 493.1780. The
ASHI inspections are more frequent
than CLIA requires. ASHI performs an
onsite inspection every 2 years and
requires submission of a self-evaluation
inspection in the intervening years. If
the self-evaluation inspection indicates
that an onsite inspection is warranted,
ASHI conducts an additional onsite
review. In addition, ASHI inspectors
provide onsite proficiency testing
samples to be processed during the
inspection.
Subpart R—Enforcement Procedures
The ASHI meets the requirements of
subpart R to the extent that it applies to
accreditation organizations. The ASHI
policy sets forth the actions the
organization takes when laboratories it
accredits do not comply with its
requirements and standards for
accreditation. When appropriate, the
ASHI will deny, suspend, or, revoke
accreditation in a laboratory accredited
VerDate jul<14>2003
16:11 Mar 24, 2005
Jkt 205001
by the ASHI and report that action to us
within 30 days. The ASHI also provides
an appeals process for laboratories that
have had accreditation denied,
suspended, or revoked.
We have determined that the ASHI’s
laboratory enforcement and appeal
policies are equal to or more stringent
than the requirements of part 493
subpart R as they apply to accreditation
organizations.
IV. Federal Validation Inspections and
Continuing Oversight
The Federal validation inspections of
ASHI accredited laboratories may be
conducted on a representative sample
basis or in response to substantial
allegations of noncompliance (that is,
complaint inspections). The outcome of
those validation inspections, performed
by us or our agents, the State survey
agencies, will be our principal means
for verifying that the laboratories
accredited by ASHI remain in
compliance with CLIA requirements.
This Federal monitoring is an ongoing
process.
V. Removal of Approval as an
Accrediting Organization
Our regulations provide that we may
rescind the approval of an accreditation
organization, such as that of the ASHI,
for cause, before the end of the effective
date of approval. If we determine that
the ASHI failed to adopt requirements
that are equal to, or more stringent than,
the CLIA requirements, or that systemic
problems exist in its inspection process,
we may give it a probationary period,
not to exceed 1 year to allow the ASHI
to adopt comparable requirements.
Should circumstances result in our
withdrawal of the ASHI’s approval, we
will publish a notice in the Federal
Register explaining the basis for
removing its approval.
VI. Collection of Information
Requirements
This notice does not impose any
information collection and record
keeping requirements subject to the
Paperwork Reduction Act (PRA).
Consequently, it does not need to be
reviewed by the Office of Management
and Budget (OMB) under the authority
of the PRA. The requirements associated
with the accreditation process for
clinical laboratories under the Clinical
Laboratory Improvement Amendments
of 1988 (CLIA) program, codified in 42
CFR part 493 subpart E, are currently
approved by OMB under OMB approval
number 0938–0686.
PO 00000
Frm 00054
Fmt 4703
Sfmt 4703
15329
VII. Executive Order 12866 Statement
In accordance with the provisions of
Executive Order 12866, this notice was
not reviewed by the Office of
Management and Budget.
Authority: Section 353 of the Public Health
Service Act (42 U.S.C. 263a).
Dated: March 10, 2005.
Mark B. McClellan,
Administrator, Centers For Medicare &
Medicaid Services.
[FR Doc. 05–5595 Filed 3–24–05; 8:45 am]
BILLING CODE 4121–01–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Medicare & Medicaid
Services
[CMS–0014–N]
Procedures for Non-Privacy
Administrative Simplification
Complaints Under the Health
Insurance Portability and
Accountability Act of 1996
Centers for Medicare &
Medicaid Services (CMS), HHS.
ACTION: Notice.
AGENCY:
SUMMARY: This notice sets forth the
procedures for filing with the Secretary
of the Department of Health and Human
Services a complaint of non-compliance
by a covered entity with certain
provisions of the administrative
simplification rules under 45 CFR parts
160, 162, and 164. It also describes the
procedures the Department employs to
review the complaints. These
procedures are intended to facilitate the
investigation and resolution of these
complaints.
Effective Date: This notice is
effective on April 25, 2005.
FOR FURTHER INFORMATION CONTACT:
Michael Phillips, (410) 786–6713.
ADDRESSES: Complaints may be filed
with CMS in two ways: (1) By Internet
using the Administrative Simplification
Enforcement Tool at https://htct.hhs.gov/.
(2) By mail at: The Centers for Medicare
& Medicaid Services, HIPAA TCS
Enforcement Activities, P.O. Box 8030,
Baltimore, MD 21244–8030.
SUPPLEMENTARY INFORMATION: The
Secretary of Health and Human Services
delegated to the Administrator, Centers
for Medicare & Medicaid Services
(CMS), the authority to investigate
complaints of noncompliance with, and
to make decisions regarding the
interpretation, implementation, and
enforcement of certain regulations
adopting administrative simplification
DATES:
E:\FR\FM\25MRN1.SGM
25MRN1
15330
Federal Register / Vol. 70, No. 57 / Friday, March 25, 2005 / Notices
standards. See 68 FR 60694 (October 23,
2003). These regulations are codified at
45 CFR, parts 160, 162, and 164. This
delegation includes authority with
respect to the regulations known as
follows: the Transaction and Code Set
Rule (TCS), 65 FR 50313 (August 17,
2000), the National Employer Identifier
Number (EIN) Rule, 67 FR 38009 (May
31, 2002), the Security Rule, 68 FR 8334
(February 20, 2003), the National
Provider Identifier Rule, 69 FR 3434
(January 23, 2004), and the National
Plan Identifier Rule (currently under
development).
This delegation does not include
authority with respect to the regulations
adopted under section 264 of the Health
Insurance Portability and
Accountability Act of 1996 (HIPAA),
Pub. L. 104–191, as amended, known as
the Privacy Rule. The Secretary has
delegated to the Office for Civil Rights
the authority to receive and investigate
complaints as they may relate to the
Privacy Rule codified at 45 CFR parts
160 and 164. For the purpose of this
notice, ‘‘administrative simplification
provisions’’ means the administrative
simplification regulatory requirements
under HIPAA, other than privacy. For
more information about the
administrative simplification provisions
of HIPAA or what entities the law
covers, go to https://www.cms.hhs.gov/
hipaa/hipaa2.
1. Procedures for Filing Complaints
A person who believes that a covered
entity is not complying with the
applicable administrative simplification
provisions may file a complaint with
CMS. The term ‘‘covered entity’’ is
defined at 45 CFR 160.103 and includes
health plans, health care clearinghouses,
and health care providers who conduct
certain health care transactions
electronically. A fourth type of covered
entity, prescription drug card sponsors,
was added by the Medicare Prescription
Drug, Improvement, and Modernization
Act of 2003 (Pub. L. 108–173). CMS will
not accept complaints until on or after
the compliance date for the specific
administrative simplification provision
in question. (For example, complaints
alleging a failure to comply with the
Security Rule will not be accepted until
after April 20, 2005.)
In order to permit efficient use of
CMS resources, complaints must meet
all of the following requirements:
• Be filed in writing, either on paper
or electronically. CMS will not accept
faxed complaints.
• Describe the acts or omissions
believed to be in violation of the
applicable administrative simplification
provisions.
VerDate jul<14>2003
16:11 Mar 24, 2005
Jkt 205001
• Provide contact information,
including name, address, and telephone
number, for the complainant and the
covered entity that are the subject of the
complaint.
• Be filed within 180 days of when
the complainant knew or should have
known that the act or omission that is
the subject of the complaint occurred,
unless this time limit is waived by CMS
for good cause shown.
Complainants may, but are not
required to, use the CMS complaint
form, which can be downloaded at
https://www.cms.hhs.gov.
2. Procedures for Initial Processing of
Complaints
Upon receipt of a complaint, CMS
will review the complaint to determine
if CMS will accept it for processing.
CMS reserves the right to reject
complaints. CMS will acknowledge its
receipt of a complaint filed within 14
calendar days of receipt. That
acknowledgment may be either
electronic or on paper.
After CMS receives the complaint,
CMS will make a preliminary review of
the complaint to determine whether it is
complete and appears to allege a failure
to comply with an administrative
simplification provision. The review
will typically proceed as follows:
• If the complaint is complete and
appears to allege a failure to comply
with the applicable administrative
simplification provisions, CMS will
notify the complainant that the
complaint is accepted for processing
and further review. Acceptance of a
complaint for processing and further
review does not represent a
determination that a compliance failure
has occurred.
• If additional information is required
to make the preliminary determination,
CMS will ask the complainant to
provide the additional information
within a reasonable time, and the
complaint will be held in abeyance until
that information is received. Failure to
provide the requested additional
information when requested by CMS
may lead to closure of the complaint,
without prejudice to the complainant’s
right to re-file the complaint.
• CMS will close a complaint if it
does not state a claim upon which CMS
may act.
A complaint may be withdrawn at any
time, upon notice to CMS in such form
and manner as CMS may require. Even
if a complaint is withdrawn, CMS may
nonetheless determine to continue its
investigation of the alleged noncompliance complaint. In general, a
complaint that has been withdrawn
before investigation may be re-filed.
PO 00000
Frm 00055
Fmt 4703
Sfmt 4703
Complainants are, however, cautioned
that they must re-file their complaint
within 180 days of the date on which
the complainant knew or should have
known that the act or omission that is
the subject of the complaint occurred,
and should not assume that this time
limit will be waived by CMS.
3. Complaint Processing and Review—
Procedures
If after initial processing, as outlined
in the previous section, a complaint is
accepted for processing and review,
CMS will begin an investigation of the
complaint. CMS may request from the
complainant such additional
information and materials as it may
require in order to evaluate whether a
compliance failure may have occurred,
as alleged in the complaint. Failure to
provide the information when requested
may result in closure of the complaint.
If based on the preliminary review
and any additional information
gathering CMS ascertains that a
compliance failure by a covered entity
may have occurred, CMS will advise the
covered entity that a complaint has been
filed and will inform the covered entity
of the alleged compliance failure.
CMS will work with covered entities
to obtain voluntary compliance. CMS
will ask the covered entity to respond to
the alleged compliance failure by
submitting in writing: (1) A statement
demonstrating compliance; or (2) a
statement setting forth with particularity
the basis for its disagreement with the
allegations; or (3) a corrective action
plan. CMS will afford the covered entity
a reasonable time to respond to CMS’
request for information, generally 30
days. Extensions may be granted, on a
case-by-case basis, at CMS’s sole
discretion, and for good cause shown. It
is expected that, in most cases, no more
than one extension, of an additional 30
days, will be granted.
A covered entity that disagrees with
the allegations made should set forth
and document, where possible: (1)
Compliance; (2) in what respect it
believes the allegations to be factually
incorrect or incomplete; and/or (3) why
it disagrees that its alleged actions or
failures to act constitute a failure to
comply. Upon receipt of this response
from the covered entity, CMS may
communicate further with the covered
entity and request the opportunity to
interview knowledgeable persons or to
review additional documents or
materials. CMS expects that additional
information or access to witnesses will
be provided in a timely manner. CMS
may also seek additional information
from the complainant.
E:\FR\FM\25MRN1.SGM
25MRN1
Federal Register / Vol. 70, No. 57 / Friday, March 25, 2005 / Notices
A covered entity may amend or
supplement its response at any time and
may propose voluntary compliance
through a corrective action plan at any
time. CMS may require modifications in
the terms of a proposed corrective
action plan as a prerequisite to
accepting the corrective action plan. If
a corrective action plan is accepted,
CMS will actively monitor the plan, and
the covered entity will be required to
periodically report to CMS its progress
towards compliance. If the covered
entity comes into voluntary compliance,
CMS will notify the complainant by
mail or electronically. The parties to the
complaint will be notified, as
appropriate, when the complaint is
closed.
CMS will make reasonable efforts to
secure a timely response from the
covered entity. If the covered entity fails
or refuses to provide the information
sought, an investigational subpoena may
be issued in accordance with 45 CFR
160.504 to require the attendance and
testimony of witnesses and/or the
production of any other evidence sought
in furtherance of the investigation.
After finding that a violation exists,
the Secretary will pursue other options,
such as, but not limited to, civil money
penalties.
Collection of Information Requirements
The form associated with this
complaint process entitled, ‘‘HIPAA
Non-Privacy Complaint Form’’, is
currently approved under OMB control
number 0938–0948.
Authority: Sections 1102 and 1171 through
1179 of the Social Security Act (42 U.S.C.
1302a and 1320d through 1320d–8).
Dated: December 7, 2004.
Tommy G. Thompson,
Secretary.
[FR Doc. 05–5795 Filed 3–24–05; 8:45 am]
BILLING CODE 4120–01–P
DEPARTMENT OF HEALTH AND
HUMAN SERVICES
Centers for Medicare & Medicaid
Services
[CMS–2204–FN]
Medicare and Medicaid Programs;
Reapproval of the Deeming Authority
of the Joint Commission on
Accreditation of Healthcare
Organizations (JCAHO) for Home
Health Agencies
Centers for Medicare &
Medicaid Services, HHS.
ACTION: Final notice.
AGENCY:
VerDate jul<14>2003
16:11 Mar 24, 2005
Jkt 205001
SUMMARY: This notice announces our
decision to approve the Joint
Commission on Accreditation of
Healthcare Organizations for continued
recognition as a national accreditation
program for home health agencies
seeking to participate in the Medicare or
Medicaid programs.
EFFECTIVE DATE: This final notice is
effective March 31, 2005 through March
31, 2008.
FOR FURTHER INFORMATION CONTACT:
Cindy Melanson, (410) 786–0310.
SUPPLEMENTARY INFORMATION:
I. Background
Under the Medicare program, eligible
beneficiaries may receive covered
services in a Home Health Agency
(HHA) provided certain requirements
are met. Sections 1861(o) and 1891 of
the Social Security Act (the Act)
establish distinct criteria for facilities
seeking designation as an HHA program.
The regulations at 42 CFR part 484
specify the conditions that an HHA
must meet in order to participate in the
Medicare program, the scope of covered
services, and the conditions for
Medicare payment for home health care.
Regulations concerning provider
agreements are at 42 CFR part 489 and
those pertaining to activities relating to
the survey and certification of facilities
are at 42 CFR part 488.
Generally, to enter into an agreement,
an HHA must first be certified by a state
survey agency as complying with the
conditions or requirements set forth in
part 484 of our regulations. Then, the
HHA is subject to regular surveys by a
state survey agency to determine
whether it continues to meet those
requirements. There is an alternative,
however, to surveys by state agencies.
Section 1865(b)(1) of the Act provides
that, if a provider entity demonstrates
through accreditation by an approved
national accreditation organization that
all applicable Medicare conditions are
met or exceeded, we would ‘‘deem’’
those provider entities as having met the
requirements. Accreditation by an
accreditation organization is voluntary
and is not required for Medicare
participation.
If an accreditation organization is
recognized by the Secretary as having
standards for accreditation that meet or
exceed Medicare requirements, any
provider entity accredited by the
national accrediting body’s approved
program would be deemed to meet the
Medicare conditions. A national
accreditation organization applying for
approval of deeming authority under
part 488, subpart A must provide us
with reasonable assurance that the
PO 00000
Frm 00056
Fmt 4703
Sfmt 4703
15331
accreditation organization requires the
accredited provider entities to meet
requirements that are at least as
stringent as the Medicare conditions.
Our regulations concerning reapproval
of accrediting organizations are set forth
at § 488.4 and § 488.8(d)(3). The
regulations at § 488.8(d)(3) require
accreditation organizations to reapply
for continued approval of deeming
authority every 6 years or sooner as we
determine. The Joint Commission on
Accreditation of Healthcare
Organizations’ (JCAHO’s) term of
approval as a recognized accreditation
program for HHAs expires March 31,
2005.
II. Deeming Applications Approval
Process
Section 1865(b)(3)(A) of the Act
provides a statutory timetable to ensure
that our review of deeming applications
is conducted in a timely manner. The
Act provides us with 210-calendar days
after the date of receipt of an application
to complete our survey activities and
application review process. Within 60
days of receiving a completed
application, we must publish a notice in
the Federal Register that identifies the
national accreditation body making the
request, describes the request, and
provides no less than a 30-day public
comment period. At the end of the 210day period, we must publish an
approval or denial of the application.
III. Proposed Notice
On September 24, 2004, we published
a proposed notice (69 FR 57305)
announcing the JCAHO’s request for
reapproval as a deeming organization
for HHAs. In the proposed notice, we
detailed our evaluation criteria. Under
section 1865(b)(2) of the Act and our
regulations at § 488.4 (Application and
reapplication procedures for
accreditation organizations) and § 488.8
(Federal review of accreditation
organization), we conducted a review of
the JCAHO application in accordance
with the criteria specified by our
regulation, which include, but are not
limited to the following:
• An onsite administrative review of
JCAHO’s (1) corporate policies; (2)
financial and human resources available
to accomplish the proposed surveys; (3)
procedures for training, monitoring, and
evaluation of its surveyors; (4) ability to
investigate and respond appropriately to
complaints against accredited facilities;
and (5) survey review and decisionmaking process for accreditation.
• A comparison of JCAHO’s HHA
accreditation standards to our current
Medicare HHA conditions for
participation.
E:\FR\FM\25MRN1.SGM
25MRN1
]]>Agencies
[Federal Register Volume 70, Number 57 (Friday, March 25, 2005)]
[Notices]
[Pages 15329-15331]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-5795]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
[CMS-0014-N]
Procedures for Non-Privacy Administrative Simplification
Complaints Under the Health Insurance Portability and Accountability
Act of 1996
AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.
ACTION: Notice.
-----------------------------------------------------------------------
SUMMARY: This notice sets forth the procedures for filing with the
Secretary of the Department of Health and Human Services a complaint of
non-compliance by a covered entity with certain provisions of the
administrative simplification rules under 45 CFR parts 160, 162, and
164. It also describes the procedures the Department employs to review
the complaints. These procedures are intended to facilitate the
investigation and resolution of these complaints.
DATES: Effective Date: This notice is effective on April 25, 2005.
FOR FURTHER INFORMATION CONTACT: Michael Phillips, (410) 786-6713.
ADDRESSES: Complaints may be filed with CMS in two ways: (1) By
Internet using the Administrative Simplification Enforcement Tool at
https://htct.hhs.gov/. (2) By mail at: The Centers for Medicare &
Medicaid Services, HIPAA TCS Enforcement Activities, P.O. Box 8030,
Baltimore, MD 21244-8030.
SUPPLEMENTARY INFORMATION: The Secretary of Health and Human Services
delegated to the Administrator, Centers for Medicare & Medicaid
Services (CMS), the authority to investigate complaints of
noncompliance with, and to make decisions regarding the interpretation,
implementation, and enforcement of certain regulations adopting
administrative simplification
[[Page 15330]]
standards. See 68 FR 60694 (October 23, 2003). These regulations are
codified at 45 CFR, parts 160, 162, and 164. This delegation includes
authority with respect to the regulations known as follows: the
Transaction and Code Set Rule (TCS), 65 FR 50313 (August 17, 2000), the
National Employer Identifier Number (EIN) Rule, 67 FR 38009 (May 31,
2002), the Security Rule, 68 FR 8334 (February 20, 2003), the National
Provider Identifier Rule, 69 FR 3434 (January 23, 2004), and the
National Plan Identifier Rule (currently under development).
This delegation does not include authority with respect to the
regulations adopted under section 264 of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA), Pub. L. 104-191, as
amended, known as the Privacy Rule. The Secretary has delegated to the
Office for Civil Rights the authority to receive and investigate
complaints as they may relate to the Privacy Rule codified at 45 CFR
parts 160 and 164. For the purpose of this notice, ``administrative
simplification provisions'' means the administrative simplification
regulatory requirements under HIPAA, other than privacy. For more
information about the administrative simplification provisions of HIPAA
or what entities the law covers, go to https://www.cms.hhs.gov/hipaa/
hipaa2.
1. Procedures for Filing Complaints
A person who believes that a covered entity is not complying with
the applicable administrative simplification provisions may file a
complaint with CMS. The term ``covered entity'' is defined at 45 CFR
160.103 and includes health plans, health care clearinghouses, and
health care providers who conduct certain health care transactions
electronically. A fourth type of covered entity, prescription drug card
sponsors, was added by the Medicare Prescription Drug, Improvement, and
Modernization Act of 2003 (Pub. L. 108-173). CMS will not accept
complaints until on or after the compliance date for the specific
administrative simplification provision in question. (For example,
complaints alleging a failure to comply with the Security Rule will not
be accepted until after April 20, 2005.)
In order to permit efficient use of CMS resources, complaints must
meet all of the following requirements:
Be filed in writing, either on paper or electronically.
CMS will not accept faxed complaints.
Describe the acts or omissions believed to be in violation
of the applicable administrative simplification provisions.
Provide contact information, including name, address, and
telephone number, for the complainant and the covered entity that are
the subject of the complaint.
Be filed within 180 days of when the complainant knew or
should have known that the act or omission that is the subject of the
complaint occurred, unless this time limit is waived by CMS for good
cause shown.
Complainants may, but are not required to, use the CMS complaint
form, which can be downloaded at https://www.cms.hhs.gov.
2. Procedures for Initial Processing of Complaints
Upon receipt of a complaint, CMS will review the complaint to
determine if CMS will accept it for processing. CMS reserves the right
to reject complaints. CMS will acknowledge its receipt of a complaint
filed within 14 calendar days of receipt. That acknowledgment may be
either electronic or on paper.
After CMS receives the complaint, CMS will make a preliminary
review of the complaint to determine whether it is complete and appears
to allege a failure to comply with an administrative simplification
provision. The review will typically proceed as follows:
If the complaint is complete and appears to allege a
failure to comply with the applicable administrative simplification
provisions, CMS will notify the complainant that the complaint is
accepted for processing and further review. Acceptance of a complaint
for processing and further review does not represent a determination
that a compliance failure has occurred.
If additional information is required to make the
preliminary determination, CMS will ask the complainant to provide the
additional information within a reasonable time, and the complaint will
be held in abeyance until that information is received. Failure to
provide the requested additional information when requested by CMS may
lead to closure of the complaint, without prejudice to the
complainant's right to re-file the complaint.
CMS will close a complaint if it does not state a claim
upon which CMS may act.
A complaint may be withdrawn at any time, upon notice to CMS in
such form and manner as CMS may require. Even if a complaint is
withdrawn, CMS may nonetheless determine to continue its investigation
of the alleged non-compliance complaint. In general, a complaint that
has been withdrawn before investigation may be re-filed. Complainants
are, however, cautioned that they must re-file their complaint within
180 days of the date on which the complainant knew or should have known
that the act or omission that is the subject of the complaint occurred,
and should not assume that this time limit will be waived by CMS.
3. Complaint Processing and Review--Procedures
If after initial processing, as outlined in the previous section, a
complaint is accepted for processing and review, CMS will begin an
investigation of the complaint. CMS may request from the complainant
such additional information and materials as it may require in order to
evaluate whether a compliance failure may have occurred, as alleged in
the complaint. Failure to provide the information when requested may
result in closure of the complaint.
If based on the preliminary review and any additional information
gathering CMS ascertains that a compliance failure by a covered entity
may have occurred, CMS will advise the covered entity that a complaint
has been filed and will inform the covered entity of the alleged
compliance failure.
CMS will work with covered entities to obtain voluntary compliance.
CMS will ask the covered entity to respond to the alleged compliance
failure by submitting in writing: (1) A statement demonstrating
compliance; or (2) a statement setting forth with particularity the
basis for its disagreement with the allegations; or (3) a corrective
action plan. CMS will afford the covered entity a reasonable time to
respond to CMS' request for information, generally 30 days. Extensions
may be granted, on a case-by-case basis, at CMS's sole discretion, and
for good cause shown. It is expected that, in most cases, no more than
one extension, of an additional 30 days, will be granted.
A covered entity that disagrees with the allegations made should
set forth and document, where possible: (1) Compliance; (2) in what
respect it believes the allegations to be factually incorrect or
incomplete; and/or (3) why it disagrees that its alleged actions or
failures to act constitute a failure to comply. Upon receipt of this
response from the covered entity, CMS may communicate further with the
covered entity and request the opportunity to interview knowledgeable
persons or to review additional documents or materials. CMS expects
that additional information or access to witnesses will be provided in
a timely manner. CMS may also seek additional information from the
complainant.
[[Page 15331]]
A covered entity may amend or supplement its response at any time
and may propose voluntary compliance through a corrective action plan
at any time. CMS may require modifications in the terms of a proposed
corrective action plan as a prerequisite to accepting the corrective
action plan. If a corrective action plan is accepted, CMS will actively
monitor the plan, and the covered entity will be required to
periodically report to CMS its progress towards compliance. If the
covered entity comes into voluntary compliance, CMS will notify the
complainant by mail or electronically. The parties to the complaint
will be notified, as appropriate, when the complaint is closed.
CMS will make reasonable efforts to secure a timely response from
the covered entity. If the covered entity fails or refuses to provide
the information sought, an investigational subpoena may be issued in
accordance with 45 CFR 160.504 to require the attendance and testimony
of witnesses and/or the production of any other evidence sought in
furtherance of the investigation.
After finding that a violation exists, the Secretary will pursue
other options, such as, but not limited to, civil money penalties.
Collection of Information Requirements
The form associated with this complaint process entitled, ``HIPAA
Non-Privacy Complaint Form'', is currently approved under OMB control
number 0938-0948.
Authority: Sections 1102 and 1171 through 1179 of the Social
Security Act (42 U.S.C. 1302a and 1320d through 1320d-8).
Dated: December 7, 2004.
Tommy G. Thompson,
Secretary.
[FR Doc. 05-5795 Filed 3-24-05; 8:45 am]
BILLING CODE 4120-01-P
