General Administrative Requirements

Statutory basis and purpose.

This provision identifies the legislative acts that provide the authority for the HIPAA administrative simplification requirements.

Applicability.

This provision defines the entities subject to HIPAA standards, including health plans, clearinghouses, and health care providers transmitting electronic health information.

Definitions.

Except as otherwise provided, the following definitions apply to this subchapter:

Modifications.

This provision outlines the process and frequency by which the Secretary may modify HIPAA standards and implementation specifications.

Compliance dates for implementation of new or modified standards and implementation specifications.

This provision establishes the timeline for covered entities and business associates to comply with new or modified HIPAA standards.

Statutory basis.

This provision identifies the legislative acts providing the authority for the HIPAA subpart regarding the preemption of state law.

Definitions.

For purposes of this subpart, the following terms have the following meanings:

General rule and exceptions.

This provision establishes that federal HIPAA standards preempt contrary state laws, subject to specific exceptions for fraud, public health, and more stringent privacy protections.

Process for requesting exception determinations.

This section outlines the formal process for states to request an exception from federal preemption for specific state laws.

Duration of effectiveness of exception determinations.

This provision specifies the conditions under which an exception to federal preemption remains in effect or is revoked.

Applicability.

This section defines the scope of the enforcement subpart, applying to covered entities and business associates regarding HIPAA compliance.

[Reserved]

This provision is reserved and contains no substantive regulatory requirements.

Principles for achieving compliance.

This section outlines the Secretary's approach to achieving compliance through cooperation and the provision of technical assistance.

Complaints to the Secretary.

This section establishes the right to file a complaint regarding HIPAA noncompliance and outlines the requirements for filing and investigation.

Compliance reviews.

This section authorizes the Secretary to conduct compliance reviews to determine adherence to administrative simplification provisions.

Responsibilities of covered entities and business associates.

This section mandates that covered entities and business associates maintain records, submit reports, and permit access for compliance investigations.

Secretarial action regarding complaints and compliance reviews.

This section details the procedures for resolving noncompliance, including informal resolution, corrective action plans, and the imposition of civil money penalties.

Investigational subpoenas and inquiries.

This provision outlines the Secretary's authority to issue subpoenas, conduct investigational inquiries, and manage witness testimony and evidence during compliance reviews.

Refraining from intimidation or retaliation.

A covered entity or business associate may not threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual or other person for—

Applicability.

This provision establishes the scope of subpart D regarding the imposition of civil money penalties by the Secretary under 42 U.S.C. 1320d-5.

Definitions.

This provision defines key terms such as reasonable cause, reasonable diligence, and willful neglect for the purpose of civil money penalty assessments.

Basis for a civil money penalty.

This provision outlines the conditions under which the Secretary imposes civil money penalties, including liability for agents and affiliated covered entities.

Amount of a civil money penalty.

This provision specifies the tiered penalty amounts for HIPAA violations based on the level of culpability and correction status.

Violations of an identical requirement or prohibition.

This provision explains how the Secretary determines the number of violations for the purpose of calculating civil money penalties, including continuing violations.

Factors considered in determining the amount of a civil money penalty.

This provision lists the factors the Secretary considers when determining the amount of a civil money penalty, including the nature of the violation and the entity's financial condition.

Affirmative defenses.

This provision outlines the affirmative defenses available to covered entities and business associates regarding the imposition of civil money penalties.

Waiver.

The Secretary may waive a civil money penalty in whole or in part if payment would be excessive relative to the violation.

Limitations.

Enforcement actions for HIPAA violations must be commenced by the Secretary within six years of the violation's occurrence.

Authority to settle.

The Secretary retains the authority to settle issues or cases and compromise penalties related to HIPAA violations.

Penalty not exclusive.

Penalties imposed under this part are in addition to any other penalties prescribed by law, except as otherwise provided.

Notice of proposed determination.

The Secretary must provide written notice to a respondent regarding the intent to impose a penalty, including findings of fact and instructions for requesting a hearing.

Failure to request a hearing.

If a respondent fails to request a hearing within the prescribed time, the Secretary will impose the proposed penalty, which becomes final upon receipt of notice.

Collection of penalty.

Once a penalty determination is final, the Secretary may recover the amount through civil action or deduction from sums owed by the United States or a State agency.

Notification of the public and other agencies.

Upon a final penalty determination, the Secretary will notify the public and relevant professional, state, and licensing organizations of the penalty and the reasons for its imposition.

Applicability.

This subpart applies to hearings conducted regarding the imposition of civil money penalties by the Secretary under HIPAA.

Definitions.

Defines the 'Board' as the members of the HHS Departmental Appeals Board who issue decisions in panels of three.

Hearing before an ALJ.

This provision outlines the process for a respondent to request a hearing before an Administrative Law Judge regarding a proposed HIPAA enforcement determination.

Rights of the parties.

This provision defines the procedural rights of parties during an administrative hearing, including representation, discovery, and evidence presentation.

Authority of the ALJ.

This provision details the powers and limitations of the Administrative Law Judge in conducting hearings, including managing evidence, motions, and procedural conduct.

Ex parte contacts.

This provision prohibits unauthorized private communications between parties and the Administrative Law Judge regarding matters at issue in a case.

Prehearing conferences.

This provision mandates the scheduling of prehearing conferences to simplify issues, manage discovery, and facilitate potential settlement of administrative cases.

Authority to settle.

This provision establishes that the Secretary of HHS maintains exclusive authority to settle any issue or case without the consent of the Administrative Law Judge.

Discovery.

This provision governs the production of documents and data during the discovery phase of an administrative hearing, including limitations and protective orders.

Exchange of witness lists, witness statements, and exhibits.

This provision requires parties to exchange witness lists, statements, and exhibits within specified timeframes prior to an administrative hearing.

Subpoenas for attendance at hearing.

This provision outlines the process for requesting and serving subpoenas to compel witness attendance and document production for administrative hearings.

Fees.

This provision requires the party requesting a subpoena to pay the associated witness fees and mileage costs as determined by federal court standards.

Form, filing, and service of papers.

This provision establishes the requirements for the form, filing, and service of documents in administrative hearings regarding HIPAA violations.

Computation of time.

This provision defines the methods for calculating time periods for filings and responses in administrative hearings.

Motions.

This provision outlines the requirements for filing and responding to motions during administrative hearings.

Sanctions.

The ALJ may sanction a person, including any party or attorney, for failing to comply with an order or procedure, for failing to defend an action or for other misconduct that interferes with the speedy, orderly or fair conduct of the hea...

Collateral estoppel.

This provision specifies that a final determination of a HIPAA violation in a prior proceeding is binding in subsequent proceedings.

The hearing.

This provision outlines the conduct of the administrative hearing, including burdens of proof and public access requirements.

Statistical sampling.

This provision allows the Secretary to use statistical sampling as evidence of violations in administrative hearings.

Witnesses.

This provision governs the presentation of witness testimony, including cross-examination and exclusion of witnesses in administrative hearings.

Evidence.

This provision outlines the rules for the admissibility and exclusion of evidence in administrative hearings.

The record.

This provision defines the composition of the hearing record and requirements for transcripts and public access.

Post hearing briefs.

This provision authorizes the ALJ to require post-hearing briefs and sets timelines for their submission.

ALJ's decision.

This provision outlines the requirements for an Administrative Law Judge to issue a decision based on the record, including findings of fact and conclusions of law, and establishes the timeline for finality.

Appeal of the ALJ's decision.

This provision details the procedures for appealing an Administrative Law Judge's decision to the Board, including filing requirements, standards of review, and the process for judicial review.

Stay of the Secretary's decision.

This provision establishes the process for a respondent to request a stay of a penalty pending judicial review, contingent upon posting a bond or security.

Harmless error.

This provision mandates that the ALJ and the Board must disregard procedural errors that do not affect the substantial rights of the parties in administrative proceedings.