45 CFR 155.285 – Bases and process for imposing civil penalties for provision of false or fraudulent information to an Exchange or improper use or disclosure of information
(a) Grounds for imposing civil money penalties. (1) HHS may impose civil money penalties on any person, as defined in paragraph (a)(2) of this section, if, based on credible evidence, HHS reasonably determines that a person has engaged in one or more of the following actions:
(i) Failure to provide correct information under section 1411(b) of the Affordable Care Act where such failure is attributable to negligence or disregard of any rules or regulations of the Secretary with negligence and disregard defined as they are in section 6662 of the Internal Revenue Code of 1986:
(A) “Negligence” includes any failure to make a reasonable attempt to provide accurate, complete, and comprehensive information; and
(B) “Disregard” includes any careless, reckless, or intentional disregard for any rules or regulations of the Secretary.
(ii) Knowing and willful provision of false or fraudulent information required under section 1411(b) of the Affordable Care Act, where knowing and willful means the intentional provision of information that the person knows to be false or fraudulent; or
(iii) Knowing and willful use or disclosure of information in violation of section 1411(g) of the Affordable Care Act, where knowing and willful means the intentional use or disclosure of information in violation of section 1411(g). Such violations would include, but not be limited to, the following:
(A) Any use or disclosure performed which violates relevant privacy and security standards established by the Exchange pursuant to § 155.260;
(B) Any other use or disclosure which has not been determined by the Secretary to be in compliance with section 1411(g)(2)(A) of the Affordable Care Act pursuant to § 155.260(a); and
(C) Any other use or disclosure which is not necessary to carry out a function described in a contract with a non-Exchange entity executed pursuant to § 155.260(b)(2).
(2) For purposes of this section, the term “person” is defined to include, but is not limited to, all individuals; corporations; Exchanges; Medicaid and CHIP agencies; other entities gaining access to personally identifiable information submitted to an Exchange to carry out additional functions which the Secretary has determined ensure the efficient operation of the Exchange pursuant to § 155.260(a)(1); and non-Exchange entities as defined in § 155.260(b) which includes agents, brokers, Web-brokers, QHP issuers, Navigators, non-Navigator assistance personnel, certified application counselors, in-person assistors, and other third party contractors.
(b) Factors in determining the amount of civil money penalties imposed. In determining the amount of civil money penalties, HHS may take into account factors which include, but are not limited to, the following:
(1) The nature and circumstances of the conduct including, but not limited to:
(i) The number of violations;
(ii) The severity of the violations;
(iii) The person’s history with the Exchange including any prior violations that would indicate whether the violation is an isolated occurrence or represents a pattern of behavior;
(iv) The length of time of the violation;
(v) The number of individuals affected or potentially affected;
(vi) The extent to which the person received compensation or other consideration associated with the violation;
(vii) Any documentation provided in any complaint or other information, as well as any additional information provided by the individual to refute performing the violation; and
(viii) Whether other remedies or penalties have been imposed for the same conduct or occurrence.
(2) The nature of the harm resulting from, or reasonably expected to result from, the violation, including but not limited to:
(i) Whether the violation resulted in actual or potential financial harm;
(ii) Whether there was actual or potential harm to an individual’s reputation;
(iii) Whether the violation hindered or could have hindered an individual’s ability to obtain health insurance coverage;
(iv) [Reserved]
(v) The actual or potential impact of the provision of false or fraudulent information or of the improper use or disclosure of the information; and
(vi) Whether any person received a more favorable eligibility determination for enrollment in a QHP or insurance affordability program, such as greater advance payment of the premium tax credits or cost-sharing reductions than he or she would be eligible for if the correct information had been provided.
(3) No penalty will be imposed under paragraph (a)(1)(i) of this section if HHS determines that there was a reasonable cause for the failure to provide correct information required under section 1411(b) of the Affordable Care Act and that the person acted in good faith.
(c) Maximum penalty. The amount of a civil money penalty will be determined by HHS in accordance with paragraph (b) of this section.
(1) The following provisions provide maximum penalties for a single “plan year,” where “plan year” has the same meaning as at § 155.20:
(i) Any person who fails to provide correct information as specified in paragraph (a)(1)(i) of this section may be subject to a maximum civil money penalty of $25,000 as adjusted annually under 45 CFR part 102 for each application, as defined at paragraph (c)(1)(iii) of this section, pursuant to which a person fails to provide correct information.
(ii) Any person who knowingly and willfully provides false information as specified in paragraph (a)(1)(ii) of this section may be subject to a maximum civil money penalty of $250,000 as adjusted annually under 45 CFR part 102 for each application, as defined at paragraph (c)(1)(iii) of this section, on which a person knowingly and willfully provides false information.
(iii) For the purposes of this subsection, “application” is defined as a submission of information, whether through an online portal, over the telephone through a call center, or through a paper submission process, in which the information is provided in relation to an eligibility determination; an eligibility redetermination based on a change in an individual’s circumstances; or an annual eligibility redetermination for any of the following:
(A) Enrollment in a qualified health plan;
(B) Premium tax credits or cost sharing reductions; or
(C) An exemption from the individual shared responsibility payment.
(2) Any person who knowingly or willfully uses or discloses information as specified in paragraph (a)(1)(iii) of this section may be subject to the following civil money penalty:
(i) A civil money penalty for each use or disclosure described in paragraph (a)(1)(iii) of this section of not more than $25,000 as adjusted annually under 45 CFR part 102 per use or disclosure.
(ii) For purposes of paragraph (c) of this section, a use or disclosure includes one separate use or disclosure of a single individual’s personally identifiable information where the person against whom a civil money penalty may be imposed has made the use or disclosure.
(3) These penalties may be imposed in addition to any other penalties that may be prescribed by law.
(d) Notice of intent to issue civil money penalty. If HHS intends to impose a civil money penalty in accordance with this part, HHS will send a written notice of such intent to the person against whom it intends to impose a civil money penalty.
(1) This written notice will be either hand delivered, sent by certified mail, return receipt requested, or sent by overnight delivery service with signature upon delivery required. The written notice must include the following elements:
(i) A description of the findings of fact regarding the violations with respect to which the civil money penalty is proposed;
(ii) The basis and reasons why the findings of fact subject the person to a penalty;
(iii) Any circumstances described in paragraph (b) of this section that were considered in determining the amount of the proposed penalty;
(iv) The amount of the proposed penalty;
(v) An explanation of the person’s right to a hearing under any applicable administrative hearing process;
(vi) A statement that failure to request a hearing within 60 calendar days after the date of issuance printed on the notice permits the assessment of the proposed penalty; and
(vii) Information explaining how to file a request for a hearing and the address to which the hearing request must be sent.
(2) The person may request a hearing before an ALJ on the proposed penalty by filing a request in accordance with the procedure to file an appeal specified in paragraph (f) of this section.
(e) Failure to request a hearing. If the person does not request a hearing within 60 calendar days of the date of issuance printed on the notice described in paragraph (d) of this section, HHS may impose the proposed civil money penalty.
(1) HHS will notify the person in writing of any penalty that has been imposed, the means by which the person may satisfy the penalty, and the date on which the penalty is due.
(2) A person has no right to appeal a penalty with respect to which the person has not timely requested a hearing in accordance with paragraph (d) of this section.
(f) Appeal of proposed penalty. Subject to paragraph (e)(2) of this section, any person against whom HHS proposed to impose a civil money penalty may appeal that penalty in accordance with the rules and procedures outlined at 45 CFR part 150, subpart D, excluding §§ 150.461, 150.463, and 150.465.
(g) Enforcement authority—(1) HHS. HHS may impose civil money penalties up to the maximum amounts specified in paragraph (d) of this section for any of the violations described in paragraph (a) of this section.
(2) OIG. In accordance with the rules and procedures of 42 CFR part 1003, and in place of imposition of penalties by CMS, the OIG may impose civil money penalties for violations described in paragraph (a)(1)(ii) of this section.
(h) Settlement authority. Nothing in this section limits the authority of HHS to settle any issue or case described in the notice furnished in accordance with § 155.285(d) or to compromise on any penalty provided for in this section.
(i) Limitations. No action under this section will be entertained unless commenced, in accordance with § 155.285(d), within 6 years from the date on which the violation occurred.