HIPAA Regulatory Alert: Process for administrative simplification complaints
Process for administrative simplification complaints
In the March 25 Federal Register, the Centers for Medicare & Medicaid Services (CMS) published procedures for nonprivacy administrative simplification complaints under HIPAA, along with a description of the procedures the Department of Health and Human Services will follow in reviewing such complaints.
According to CMS, individuals who believe that a covered entity — a health plan, health care clearinghouse, health care provider conducting specified transactions electronically, or prescription drug card sponsor — is not complying with the HIPAA administrative simplification provisions may file a complaint with the agency. Complaints must:
1. be filed in writing on paper or electronically;
2. describe the acts or omissions believed to be violating the administrative simplification
provisions;
3. provide contact information for the complainant and the covered entity;
4. be filed within 180 days of when the complainant knew or should have known the
act or omission occurred.
Once CMS receives a complaint, it will make a preliminary review to determine whether to accept it for processing. If the complaint is complete and appears to allege a failure to comply with an administrative simplification provision, CMS will notify the complainant that the complaint is accepted for processing and further review. This does not represent a determination that a compliance failure has occurred. If additional information is required to make the preliminary determination, the agency will ask the complainant for the additional information and will wait a reasonable time to receive it.
Complaints that are accepted for processing and review will be investigated by CMS. If the agency finds that a compliance failure may have occurred, it will advise the covered entity that a complaint has been filed and inform the covered entity of the alleged compliance failure.
"CMS will work with covered entities to obtain voluntary compliance," the notice stated. CMS will ask the covered entity to respond to the complaint by submitting in writing one of the following:
- a statement demonstrating compliance;
- a statement setting forth with particularity the basis for its disagreement with the allegations;
- a corrective action plan.
Covered entities that dispute allegations made in a complaint are to document:
- compliance;
- in what respect they believe the allegations to be factually incorrect or incomplete;
- why they disagree that their alleged actions or failures to act constitute a failure to comply.
Once it has received that information, CMS may ask for an opportunity to interview knowledgeable people within the covered entity or review additional documents or materials. The agency also may seek additional information from the complainant.
If a corrective action plan is accepted, CMS said it will actively monitor the plan and require the covered entity to periodically report its progress toward compliance. If the covered entity comes into voluntary compliance, CMS will notify the complainant, and the parties will be notified when a complaint is closed. The agency said it will make "reasonable efforts" to secure a timely response from a covered entity that is the subject of a complaint. If the entity fails or refuses to provide the information sought, an investigational subpoena may be issued to require the attendance and testimony of witnesses and/or production of any other evidence sought in furtherance of the investigation.
After finding that a violation exists, the notice said, the secretary of Health and Human Services will pursue other options such as, but not limited to, civil money penalties.
In the March 25 Federal Register, the Centers for Medicare & Medicaid Services published procedures for nonprivacy administrative simplification complaints under HIPAA, along with a description of the procedures the Department of Health and Human Services will follow in reviewing such complaints.
Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.