The Department of Health and Human Services (HHS) recently issued interim final regulations that adjust for inflation the maximum civil monetary penalties (CMP) that fall under HHS’s jurisdiction. The regulations reflect changes required by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (the Act).
Adjustments under the Act were effective on August 1, 2016, and HHS’s CMP adjustment regulations were effective on September 6, 2016. HHS issued its regulations for immediate implementation, without the notice and comment procedures that normally accompany new regulations.
Under prior rules, CMP adjustments required significant rounding of figures and penalty increases were capped at ten percent. The Act removed the rounding rules (that is, penalties are now simply rounded to the nearest dollar).
Under the regulations, the adjusted penalty amounts apply only to CMPs assessed after August 1, 2016, whose associated violations occurred after November 2, 2015 (the Act’s enactment date).
As a result, violations occurring on or before November 2, 2015, and assessments made prior to August 1, 2016, whose associated violations occurred after November 2, 2015, continue to be subject to either:
- the CMP amounts under existing regulations.
- the amount under the statute, if a penalty had not yet been adjusted by regulations.
The regulations and introductory material include initial catch-up adjustments for CMPs, and the Act requires HHS to publish annual adjustments by January 15 of every year.
Increased CMPs Involving HIPAA Violations
The maximum adjusted penalty for each violation of HIPAA’s administrative simplification provisions prior to February 18, 2009, is $150 (increased from $100). (February 18, 2009, was the effective date of certain increased penalties for HIPAA violations under the Health Information Technology for Economic and Clinical Health Act (HITECH)).
In addition, the maximum adjusted penalties for each violation of HIPAA’s administrative simplification provisions on or after February 18, 2009, are:
- If it is established that a covered entity (CE) or business associate (BA) did not know (and by exercising reasonable diligence would not have known) that the CE or BA violated the provision:
- $110 (increased from $100)
- $55,010 (increased from $50,000)
- If it is established that the violation was due to reasonable cause and not willful neglect:
- $1,100 (increased from $1,000)
- $55,010 (increased from $50,000)
- If it is established that the violation was due to willful neglect and corrected during the 30-day period beginning on the first date the CE or BA knew (or by exercising reasonable diligence would have known) that the violation occurred:
- $11,002 (increased from $10,000)
- $55,010 (increased from $50,000)
- If it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the CE or BA knew (or by exercising reasonable diligence would have known) that the violation occurred:
- $55,010 (increased from $50,000)
- $1,650,300 (increased from $1,500,000)
Increased Penalties for Non-HIPAA Violations
The maximum adjusted penalty for failing to provide summaries of benefits and coverage under the ACA is $1,087 (increased from $1,000). The maximum annual penalty for violations of the ACA’s medical loss ratio reporting and rebating rules is $109 (increased from $100).
The maximum adjusted penalty for an employer (or other entity) that offers a financial or other incentive for an individual who is entitled to benefits not to enroll under a group health plan or large group health plan that would be a primary plan is $8,908 (increased from $5,000).
By Danielle Capilla, Originally published by United Benefit Advisors – Read More