DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary
45 CFR Parts 160 and 162 [CMS--0037--P] RIN 0938-AQ85 Administrative Simplification: Certific ation of Compliance for Health Plans
AGENCY : Office of the Secretary, HHS.
ACTION : Proposed rule.
SUMMARY : This proposed rule would require a controlling health plan (CHP) to submit information and documentation demonstrating that it is compliant with certain standards and operating rules adopted by the Secr etary of Health and Human Serv ices (the Secretary) under the Health Insurance Portability and Accountabi lity Act of 1996 (HIPAA). This proposed rule would also establish penalty fees for a CHP that fails to comply with the certification of compliance requirements.
DATES : To be assured consideration, comments mu st be received at one of the addresses provided, no later than 5 p.m. on [OFR--insert date 60 days afte r date of publication in the Federal Register].
ADDRESSES : In commenting, please refer to file code CMS-0037-P. Because of staff and resource limitations, we ca nnot accept comments by facsimile (FAX) transmission. You may submit comments in one of four ways (please choose only one of the ways listed): 1. Electronically . You may submit electronic comments on this regulation to http://www.regulations.gov . Follow the "Submit a comment" instructions.2 2. By regular mail . You may mail written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-0037-P, P.O. Box 8013, Baltimore, MD 21244-8013. Please allow sufficient time for mailed comments to be received before the close of the comment period. 3. By express or overnight mail . You may send written comments to the following address ONLY: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-0037-P, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850. 4. By hand or courier . Alternatively, you may delive r (by hand or courier) your written comments ONLY to the following addre sses prior to the close of the comment period: a. For delivery in Washington, DC-- Centers for Medicare & Medicaid Services, Department of Health and Human Services, Room 445-G, Hubert H. Humphrey Building,3 200 Independence Avenue, SW., Washington, DC 20201 (Because access to the interior of the Hube rt H. Humphrey Building is not readily available to persons without federal government identification, commenters are encouraged to leave their comments in the CMS drop slots lo cated in the main lobby of the building. A stamp-in clock is available for persons wishing to retain a proof of f iling by stamping in and retaining an extra copy of the comments being filed.) b. For delivery in Baltimore, MD-- Centers for Medicare & Medicaid Services, Department of Health and Human Services, 7500 Security Boulevard, Baltimore, MD 21244-1850. If you intend to deliver your comments to the Baltimore address, call telephone number (410) 786-1066 in advance to schedule your arrival with one of our staff members. Comments erroneously mailed to the addres ses indicated as appr opriate for hand or courier delivery may be delayed a nd received after the comment period. For information on viewing public co mments, see the beginning of the "SUPPLEMENTARY INFORMATION" section.
FOR FURTHER INFORMATION CONTACT : Matthew Albright, (410) 786-2546. Terri Deutsch, (410) 786-9462 for questions re garding Collection of Information and the Regulatory Impact Statement.
SUPPLEMENTARY INFORMATION :4 Inspection of Public Comments : All comments received before the close of the comment period are available for viewing by the public , including any persona lly identifiable or confidential business information that is included in a comment. We post all comments received before the close of the comment period on the fo llowing Web site as soon as possible after they have been received: http://www.regulations.gov . Follow the search instructions on that Web site to view public comments. Comments received timely will also be av ailable for public inspection as they are received, generally beginning approximately 3 w eeks after publication of a document, at the headquarters of the Centers for Medicare & Medicaid Services, 7500 Security Boulevard, Baltimore, Maryland 21244, Monday through Friday of each week from 8:30 a.m. to 4 p.m. To schedule an appointment to view public comments, call 1-800-743-3951. I. Background A. Introduction Many factors contribute to the high cost of h ealth care in the Unite d States, but studies find that administrative costs subs tantially impact spending growth 1 and can likely be reduced. 2 Automated processes, through the use of standardi zed electronic transactions, can lessen health care providers' administrative burden in interacting with health in surers. Under the authority of the Health Insurance Po rtability and Accountability Act of 1996 (HIPAA), the Secretary adopts standards and operating rules that facilitate the us e of electronic transactions by creating greater

1 "Technological Change and the Growth of Health Care Spending," A CBO Paper, Congressional Budget Office, January 2008, pg.4, http://www.cbo.gov/f tpdocs/89xx/doc8947/01-31-TechHealth.pdf 2 Morra, D., Nicholson, S., Levinson, W., Gans, D. N., Ha mmons, T., & Casalino, L. P. "U.S. Physician Practices versus Canadians: Spending Nearly Four Times as Much Money Interacting with Payers," Health Affairs : 30(8):1443-1450, 2011. Blanchfield, Bonnie B., James L. Hefferman, Bradford Osgood, Rosemary R. Sheehan, and Gregg S. Meyer, "Saving Billions of Dollars – and Physician's Time – by Streamlining Billing Practices," Health Affairs: 29(6):1248-1254, 2010.5 uniformity in data exchange and reducing the hea lth care industry's reliance on paper forms and manual processes to transmit data. Although HIPAA standards and operating rule s can reduce administrative burden, the health care industry has experienced difficu lty transitioning to them by the regulatory compliance dates. Many in the industry attribut e at least some implementation difficulties to the lack of a consistent testing process or framew ork before implementation of new standards and operating rules. This proposed rule is intended to serve as an initial step toward the development of a consistent testing process that will enab le entities to better achieve and demonstrate compliance with HIPAA standard s and operating rules. This rule proposes that controlling health pl ans (CHPs) must submit certain information and documentation that demonstrates compliance with the adopted standards and operating rules for three electronic transactions: eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) and remitta nce advice. Such documentation would be an indication that a CHP has completed some internal and external testing. B. Legislative and Regulatory Background This section summarizes the legislative and regulatory history of standards, operating rules, and the enforcement proces ses in order to frame the proce ss we refer to in this proposed rule as certification of compliance. 1. HIPAA Standards and Code Sets Section 1172(a) of the Social Security Act (t he Act) provides that any standard adopted under HIPAA shall apply, in whole or in part, to the following persons, known as "covered entities": (1) a health plan; (2) a health care clearinghouse; and (3) a health care provider who transmits any health information in electronic form in connection with a HIPAA transaction.6 Covered entities are required to conduct as stan dard transactions all el ectronic transactions for which the Secretary has adopted a standard. In the August 17, 2000 Federal Register (65 FR 50312), we published a final rule titled "Health Insurance Reform: Standards for Electroni c Transactions" (hereinafter referred to as the Transactions and Code Sets final rule). That rule implemented some of the HIPAA Administrative Simplificati on requirements by adopting stan dards developed by standards development organizations (SDOs) for certain electronic health ca re transactions, and medical data code sets to be used in those transactions. The Transact ions and Code Sets final rule adopted the Accredited Standards Committ ee (ASC) X12 standards Version 4010/4010A1 and the National Council for Prescription Drug Pr ograms (NCPDP) Telecommunication standard Version 5.1. In the January 16, 2009 (74 FR 3296) final rule titled, "Health Insurance Reform; Modifications to the Health Insurance Portabil ity and Accountability Act (HIPAA) Electronic Transaction Standards" (hereinaft er referred to as the Modifica tions final rule), we adopted updated versions of the standard s (ASC X12 Version 5010) (hereina fter referred to as Version 5010) and NCPDP Telecommunicati on Standard Implementation Gu ide, Version D. Release 0 (hereinafter referred to as Vers ion D.0), and equivalent Standa rd Batch Implementation Guide, Version 1, Release 2 (hereinafter referred to as Version 1.2) fo r the electronic health care transactions that were originally adopted in the Transactions and Code Sets final rule. We also adopted a new standard for the Medicaid pharmacy subrogation transaction – the Batch Standard Medicaid Subrogation Implementation Guide, Vers ion 3, Release 0 (hereinafter referred to as Version 3.0), which is specified at 45 CFR 162, s ubpart S. Covered entities were required to comply with Version 5010 and Version D.0, a nd Version 3.0 for Medicaid pharmacy subrogation7 transactions, effective January 1, 2012 (except for small health pl ans, which were required to comply with Version 3.0 on January 1, 2013). In the January 10, 2012 (77 FR 1556) interim final rule with comment period, titled "Administrative Simplification: Adoption of Standards for Health Care Electronic Funds Transfers (EFT) and Remittance Advice" (hereina fter referred to as the Health Care EFT Standards IFC), we adopted standards for the he alth care electronic funds transfers (EFT) and remittance advice transaction, defined the transa ction, and explained how the adopted standards support and facilitate it. In the September 5, 2012 Federal Register (77 FR 54664), we published a final rule, "Administrative Simplification: Adoption of a St andard for a Unique Health Plan Identifier; Addition to the National Provider Identifier Requirements; and a Change to the Compliance Date for the International Classification of Dis eases, 10th Edition (ICD–10–CM and ICD–10–PCS) Medical Data Code Sets" (hereinafter referred to as the HPID final rule). That rule, as relevant here, adopted the standard for a national unique health plan identifier (HPID), established requirements for HPID implementation, and adopted a data element to serve as an "other entity" identifier (OEID) – an identifier for entities that are not health plans, health care providers, or individuals, but that need to be id entified in standard transactions. 2. HIPAA Operating Rules Section 1173(g) of the Act was added by section 1104 of the Patient Protection and Affordable Care Act (Pub L. 111–148), enacted on March 23, 2010, as amended by the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111–152), enacted on March 30, 2010 (collectively known as and hereinafter referred to as the Affordable Care Act). Section 1173(g) of the Act requires the Secretar y to adopt a single set of operating rules for each of the8

transactions listed in section 1173(a)(1) of the Act. Operati ng rules are defined by section 1171(9) of the Act as ''the necessary business rule s and guidelines for the electronic exchange of information that are not defined by a standard or its implementati on specifications as adopted for purposes of this part.'' Additionally, sections 1173(g)(2)(D), (g)(3)(C), and (g)(3)(D) of the Act clarify aspects of the operating ru les and the requirements of the operating rules authoring entity.
The Council for Affordable Quality Health care (CAQH) Committ ee on Operating Rules for Information Exchange (CORE) was establis hed in 2005 as a nationa l initiative, bringing together over 100 health care industry stakeholde rs to simplify health care administration through the improvement of electronic health care information exchange. CAQH CORE's mission is to "build consensus am ong healthcare industry stakeholde rs on a set of operating rules that facilitate administrative interoperabi lity between providers and health plans." 3 With consensus among health care industry stakeholder members, CAQH CORE, in 2008, developed two sets of operating rules for the e ligibility for a health plan and health care claim status transactions (herei nafter referred to as Phase I and Phase II CAQH CORE Operating Rules). The operating rules built upon applicable HIPAA standard transaction requirements, and enabled providers to submit transactions from a ny system, facilitating admi nistrative and clinical data integration. Numerous h ealth care entities voluntarily adopted the Phas e I and II CAQH CORE Operating Rules, and CAQH CORE demonstrated that the use of these rules yielded a positive return on investment for health plans and providers. 4

3 CAQH CORE website: http://www.caqh.org/ pdf/CORE_MASTER_Presentation_4-15-08.pdf 4 CAQH CORE website: http://www.caqh.or g/pdf/CORE_MASTER_Presentation_4-15-08.pdf http://www.caqh.org/ COREIBMstudy.php9 In August and September, 2010, the National Committee on Vital and Health Statistics 5 (NCVHS), in furtherance of its statutory mi ssion to advise the Secretary, engaged in a comprehensive review of health care operating ru les and their authors. The NCVHS advised the Secretary that CAQH CORE met the requirements of section 1173( g)(2) of the Act to be the operating rules authoring entity for the non-retail pharmacy eligib ility for a health plan and health care claim status transactions. 6 After assessing its qualifications and th e NCVHS's recommendation, the Secretary determined that CAQH CORE was qualified to be the operating rule author ity entity for the eligibility for a health plan and health care cl aim status transactions. In the July 8, 2011 (76 FR 40458) interim final rule with comme nt period (IFC) titled, "Administrative Simplification: Adoption of Operat ing Rules for Eligibility for a Health Plan and Health Care Claim Status Transactions" (herei nafter referred to as the Op erating Rules IFC), we adopted Phase I and II CAQH CORE Operating Rules for the two transactions. 7 The Operating Rules IFC also defined the term "operating rules," revi sed the definition for "standard transaction" to indicate that a standard transa ction is one that complies with both the adopted standards and operating rules, and described the relationship be tween operating rules and standards. In the Operating Rules IFC, we did not adopt th e Phase I and II CAQH CORE Operating Rules requirements regarding acknowledgments, nor di d we adopt CORE's Certification process by

5 Established by the Congress, the NCVHS is a body that advises the Secr etary on health data, statistics, and national health information policy and that has a significant role in the Secretary's adop tion of operating rules under section 1173(g)(3) of the Act. 6 September 30, 2010 letter from NCVHS to Secretary Kathl een Sebelius, re: Affordable Care Act ,Administrative Simplification: Operating Rules for Eligibility and Claims Status Transactions: http://www.ncvhs.hhs .gov/reptrecs.htm 7 CAQH CORE Phases I and II Operating Ru les are available online at no charge at http://www.caqh.org/ COREVersion5010.phb

.10 which an entity demonstrates compliance with Phase I and II CAQH CORE Operating Rules. 8 On March 23, 2011, the NCVHS recommended that CAQH CORE, in collaboration with NACHA – The Electronic Payments Association, be the authoring entity for the health care electronic funds transfers (EFT) and rem ittance advice transaction operating rules. 9 In developing the health care electr onic funds transfers (EFT) and remittance advice transaction operating rules, CAQH CORE held more than th irty open conference ca lls and conducted over 15 straw polls with industry and government re presentatives between March and August 2011. More than 80 health care entities analyzed, re viewed, and achieved consensus on the operating rules. On December 7, 2011, the NCVHS, in its advi sory role, recommende d to the Secretary (subject to CAQH CORE making cer tain revisions) that the Phase III CAQH CORE EFT & ERA Draft Operating Rule Set (or Phase III Operating Rules) be adopted as th e operating rules for the health care electronic funds transfers (EFT ) and remittance advice transaction. On August 10, 2012, in 77 FR 48008, we adopted th ese operating rules in a rule titled "Administrative Simplification: Adoption of Operating Rules for Health Care Electronic Funds Transfers (EFT) and Remittance Advice Transactions; Final Rule" (hereinafter EFT & ERA Operating Rule Set IFC). We did not, however , adopt the CAQH CORE operating rule in the EFT & ERA Operating Rule Set that re quired the use of the Version 5010 999

8 Provisions of the Operating Rule IFC at 76 FR 40461. Information on the CAQH CORE Rules can be found at: http://www.caqh.or g/CORE_phase1.php , http://www.caqh.org/CORE_phase2.php , and http://www.caqh.or g/CORE_phase3.php . CAQH CORE FAQS can be found at: http://www.caqh.org/pdf/COREFAQsPartA.pdf for general information; http://www.caqh.org/pdf/COREFAQsPartC.pdf for Phase I and II. 9 March 23, 2011 NCVHS letter to the Secretary: http://ncvhs.hhs.gov/110323lt.pdf

.11 acknowledgements standard in the Phase III CAQH CORE 350 Health Care Claim Payment/Advice (835) Infrastructure Rule requirement 4.2 (77 FR 48017). 10 The NCVHS recommended in May 2012 that CAQH CORE be the au thoring entity for the operating rules for the remaining HIPAA transactions 11 – health care claims or equivalent encounter information, health claims attachments, enrollment and disenrollment in a health plan, health plan premium payments, and referral certif ication and authorization, with respect to which the Secretary agreed. 12
3. Current HIPAA Administrativ e Simplification Enforcement Under sections 1176 and 1177 of the Act, covere d entities may be subject to civil money penalties (CMPs) and criminal penalties for vi olations of HIPAA Administrative Simplification rules. HHS administers the CMPs under secti on 1176 of the Act and the U.S. Department of Justice administers the criminal pena lties under section 1177 of the Act. Section 1176(b) of the Act sets out limitations on the Secret ary's authority and provides the Secretary certain discretion with respect to imposing CMPs. For example, this section provides that no CMPs may be imposed with resp ect to an act if a penalty has been imposed under section 1177 of the Act with re spect to such act. This secti on also generally precludes the Secretary from imposing a CMP for a violati on corrected during the 30-day period beginning when an individual knew or, by exercising reas onable diligence, would have known that the failure to comply occurred. The Secretary prom ulgated rules pertaining to compliance with, and enforcement of, the HIPAA Administrative Simplific ation rules that are c odified at section 45 part 160, subparts C, D, and E, and collectiv ely referred to as the Enforcement Rule.

10 CAQH CORE FAQS for Ph ase III can be found at http://www.caqh.org/pdf/COREFAQsPartD.pdf

. 11 May 5, 2012 NCVHS letter to the Secretary: http://www.ncvhs.hhs.gov/120505lt.pdf 12 September 12, 2012 letter from Secretary to NCVHS: http://www.ncvhs.hhs.gov/120912lt.pdf12 In the April 17, 2003 Federal Register (68 FR 18895), we issued an interim final rule entitled, "Civil Money Penalties: Procedures for Investigations, Imposition of Penalties, and Hearings" that established the procedural require ments for the imposition of CMPs for violations of HIPAA Administrative Simplif ication requirements. We e xpanded upon that rule with a February 16, 2006 final rule entitled, "HIPAA Ad ministrative Simplification: Enforcement" (71 FR 8390), that made the compliance rule s applicable to all HIPAA Administrative Simplification Rules. That rule also amended the rules relati ng to the imposition of CMPs and clarified the investigat ion process, bases for liability, de termination of the penalty amount, grounds for waiver, conduct of the hearing, and th e appeal process. These rules' preambles provide additional information that may be helpful regarding HIPAA's compliance and enforcement. Section 13410(d) of the Health Informa tion Technology for Economic and Clinical Health Act (HITECH), enacted on February 17, 2 009 as part of the American Recovery and Reinvestment Act of 2009, revise d section 1176 of the Act by stre ngthening enforcement of the HIPAA rules. In the October 30, 2009 Federal Register (74 FR 56123), we published an IFC titled "HIPAA Administrative Simplification: Enforc ement" that conformed HIPAA's enforcement regulations to section 1176 of the Act, as it wa s modified by section 13410( d) of HITECH. That rule amended HIPAA enforcement regulations as they relate to the imposition of CMPs to incorporate the HITECH categorie s of violations, tiered ranges of CMP amounts, and revised limitations on the Secretary's authority to impos e CMPs for established violations of HIPAA Administrative Simplification rules. In the January 25, 2013 Federal Register (78 FR 5566), we published a final rule titled13 "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Econo mic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifi cations to the HIPAA Rules" (hereinafter referred to as the HIPAA Omnibus final rule). Among other modifications to the HIPAA rules, the HIPAA Omnibus final rule modified HIP AA Privacy, Security, and Breach Notification Rules as mandated by HITECH, as well as finali zed a number of modifications to the HIPAA Enforcement Rule, including incorporating a tier ed civil money penalty structure, that were originally published as an in terim final rule on October 30, 2009 (74 FR 56123) and proposed in a notice of proposed rulemaking on July 14, 2010 (75 FR 40868). 4. HIPAA Administrative Si mplification Enforcement under the Affordable Care Act Section 1104 of the Affordable Care Act am ended the Social Security Act by adding sections 1173(h) and (j). S ection 1173(h) of the Act includ es certification of compliance requirements for health plans, and requires the S ecretary to conduct periodic audits of health plans and entities that have serv ice contracts with health plan s. Section 1173(j) of the Act establishes new penalties for health plans that fail to comply with the certification of compliance requirements. 5. Health Plan Certificati on of Compliance Requirements Section 1173(h)(1)(A) of the Act requires he alth plans to file a statement with the Secretary, in such form as the Secretary may require, by December 31, 2013, certifying that their data and information systems are in compliance with the standards and operating rules for the following transactions: eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) a nd remittance advice. In this proposed rule, we refer to the requirements mandated by section 1173(h)(1)(A) of the Act as the "fir st certification of14 compliance requirements." Table 1 displays the specific standards and operating rules to which the requirements for the first cer tification of compliance apply. In similar fashion, section 1173(h)(1)(B) of the Act mandates, by December 31, 2015, health plan certification of co mpliance for the following HIPAA transactions: health care claims or equivalent encounter information, enrollment a nd disenrollment in a health plan, health plan premium payments, health claims attachments, and referral certificati on and authorization. Likewise, section 1173(h)(5) of the Act mandates that health plans meet certification of compliance requirements for later versions of the standards and operating rules. The scope of this proposed rule is limited to the first certifica tion of compliance. Because operating rules for the transactions liste d in section 1173(h)(1)(B) of the Act have not yet been adopted, nor has a standard been adopted for health claims attachments, we cannot yet determine what documentation will be necessary to demonstrate compliance with those standards and operating rules. We will adopt certification of compliance requirements for the transactions listed in section 1173(h)(1)(B) of the Act, and for later adopted versions of standards and operating rules, in subsequent rulemaking.15

TABLE 1: STANDARDS AND OPER ATING RULES TO WHICH THE FIRST CERTIFICATION OF COMPLIANCE APPLIES
TRANSACTIONS STANDARDS OPERATING RULES Eligibility for a Health Plan (request and response) – Dental, Professional, and Institutional. ASC X12 Standards for Electronic Data Interchange Technical Report Type 3— Health Care Eligibility Benefit Inquiry and Response (270/271), April 2008, ASC X12N/005010X279 The following CAQH CORE Phase I and Phase II operating rules, excluding where such rules reference and/or pe rtain to acknowledgements and CORE certification): (1) Phase I CORE 152: Eligibility a nd Benefit Real Time Companion Guide Rule, version 1.1.0, March 2011, and CORE v5010 Master Companion Guide Template. (2) Phase I CORE 153: Eligibility a nd Benefits Connectivity Rule, version 1.1.0, March 2011. (3) Phase I CORE 154: Eligibility a nd Benefits 270/271 Data Content Rule, version 1.1.0, March 2011. (4) Phase I CORE 155: Eligibility a nd Benefits Batch Response Time Rule, version 1.1.0, March 2011. (5) Phase I CORE 156: Eligibility a nd Benefits Real Ti me Response Rule, version 1.1.0, March 2011. (6) Phase I CORE 157: Eligibility a nd Benefits System Availability Rule, version 1.1.0, March 2011. (7) Phase II CORE 258: Eligibility a nd Benefits 270/271 Normalizing Patient Last Name Rule, version 2.1.0, March 2011. (8) Phase II CORE 259: Eligibility and Benefits 270/271 AAA Error Code Reporting Rule, version 2.1.0. (9) Phase II CORE 260: Eligibility & Be nefits Data Content (270/271) Rule, version 2.1.0, March 2011. (10) Phase II CORE 270: Connectivit y Rule, version 2.2.0, March 2011. Eligibility for a Health Plan – Retail Pharmacy Drugs Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007, and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs. Health Care Claim Status ASC X12 Standards for Electronic Data Interchange Technical Report Type 3— Health claim status Request and Response (276/277), August 2006, ASC X12N/005010X212, and Errata to Health claim status Request and Response (276/277), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, April 2008, ASC X12N/005010X212E1 The following CAQH CORE Phase II operating rules (updated for Version 5010), excluding where such rules reference and/or pertain to acknowledgements and CO RE certification: (1) Phase II CORE 250: Claim Status Rule, version 2.1.0, March 2011, and CORE v5010 Master Companion Guide, 00510, 1.2, March 2011. (2) Phase II CORE 270: Connectivit y Rule, version 2.2.0, March 2011.

ERA: ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim Payment/Advice (835), April 2006, ASC X12N/005010X221 Health Care Electronic Funds Transfers (EFT) and Remittance Advice

Stage 1 Payment Initiation : The following CAQH CORE Phase III EFT & ERA Operating Rule Set, approved June 2012: (1) Phase III CORE 380 EFT Enrollment Da ta Rule, version 3.0.0, June 2012. (2) Phase III CORE 382 ERA Enrollment Da ta Rule, version 3.0.0, June 2012. (3) Phase III 360 CORE Uniform Us e of CARCs and RARCs (835) Rule, version 3.0.0, June 2012. (4) CORE-required Code Combinations fo r CORE-defined Business Scenarios for the Phase III CORE 360 Uniform Use of Claim Adjustment Reason Codes and Remittance Advice Rema rk Codes (835) Rule, version 3.0.0, June 2012.16

TRANSACTIONS STANDARDS OPERATING RULES The National Automated Clearing House Association (NACHA) Corporate Credit or Deposit Entry with Addenda Record (CCD+) implementation specifications as contained in the 2011 NACHA Operating Rules & Guidelines: NACHA Operating Rules, Appendix One: ACH File Exchange Specifications; and NACHA Operating Rules, Appendix Three: ACH Record Format Specifications, Subpart 3.1.8 Sequence of Records for CCD Entries. Data content in CCD Addenda Record: Accredited Standards Committee (ASC) X12 Standards for Electronic Data Interchange Technical Report Type 3, "Health Care Claim Payment/Advice (835), April 2006: Section 2.4: 835 Segment Detail: "TRN Reassociation Trace Number," Washington Publishing Company, 005010X221 (5) Phase III CORE 370 EFT & ERA Rea ssociation (CCD+/835) Rule, version 3.0.0, June 2012. (6) Phase III CORE 350 Health Ca re Claim Payment/Advice (835) Infrastructure Rule, version 3.0.0, J une 2012, except Requirement 4.2 titled "Health Care Claim Payment/Advice Ba tch Acknowledgement Requirements". (7) ACME Health Plan, CORE v5010 Master Companion Guide Template, 005010, 1.2, March 2011 (incorporated by reference in § 162.920), as required by the Phase III CORE 350 Health Care Claim Payment/Advice (835) Infrastructure Rule, version 3.0.0, June 2012.

Section 1173(h)(2) of the Act provides that a health plan will not be considered to have met section 1173(h)(1) of the Ac t certification requirements unle ss it provides the Secretary adequate documentation of compliance that--

● Demonstrates to the Secretary that it conduc ts the electronic trans actions specified in section 1173(h)(1) of the Act in a manner that fully complies with the regulations of the Secretary; and

● Shows that it has completed end-to-end tes ting for such transactions with its partners, such as hospitals and physicians. Section 1173(h)(3) of the Act extends the certification a nd submission requirements to entities that have service cont racts with health plans, though the compliance onus remains on the17 health plan. In addition, the Secretary is author ized by section 1173(h)(4) of the Act to designate independent, outside entities to certify that he alth plans have complied with the certification requirements, so long as the certification standard s used by these entities are in accordance with the standards and operating rule s adopted by the Secretary. 6. Penalty Fees Section 1173(j) of the Act spec ifies penalties for health plans that fail to meet section 1173(h) certification and documentation of comp liance requirements. Sections 1173(j)(1)(B) through (F) of the Act specify the amount of, a nd process for assessing, penalty fees against health plans. Section 1173(j)(1)(B) of the Act re quires the Secretary to assess a $1 per covered life per day penalty fee, assessed per person cove red by the plan for which its data systems for major medical policies are not in compliance for each day the plan is not in compliance, against a health plan until certification is complete. Section 1173(j)(1 )(C) of the Act requires the Secretary to double the amount of th e penalty fees assessed against a health plan that knowingly provides inaccurate or incomplete information in certifying comp liance. Section 1173(j)(1)(F) of the Act directs the Secretary to determine the number of covered lives underlying the calculation of the penalty fee amount based upon a health plan 's most recent statements and filings submitted to the Securities and Exchange Commission. Section 1173(j)(1)(D) of the Ac t directs that the penalty f ees be increased on an annual basis by the annual percentage incr ease in total national health care expenditures, as determined by the Secretary. Finally, section 1173(j)(1)(E) of the Act caps the penalties that may be annually imposed on a health plan to $20 per cove red life under such plan, or, in the event of misrepresentation under secti on 1173(j)(1)(C) of the Act, $40 per covered life. 7. Notice, Dispute, and Penalty Process18 Sections 1173(j)(2) thro ugh (4) of the Act outline how the penalty fees are to be assessed and collected. Section 1173(j)(2) of the Act requires the Secret ary to establish a process to assess penalty fees that provide s a health plan with reasonable notice and a dispute resolution procedure prior to the Secretary of the Treasury sending a notice of assessment to a health plan. Section 1173(j)(3) of the Act directs the Secretary, by May 1, 2014, and annually thereafter, to provide the Secretar y of the Treasury with a report of health plans that have been assessed penalty fees. Section 1173(j)(4) of the Act directs the Secretary of the Treasury to collect the penalty fees, and by August 1, 2014 a nd annually thereafter, provide each plan assessed a penalty fee a notice of the amount and due date of the fee. Section 1173(j)(4)(C) of the Act directs health plans assessed penalty f ees to make payment to the Secretary of the Treasury by November 1, 2014, and annually ther eafter. Section 1173( j)(4)(D) of the Act provides that interest, at a rate as determined pursuant to th e underpayment rate established under section 6621 of the Internal Revenue Code of 1986, accrues on any penalty fee not paid by the due date, and that any unpaid pe nalty fees are to be treated as a past due, legally enforceable debt owed to a federal agency for purposes of section 6402(d) of the Inte rnal Revenue Code of 1986. Finally, section 1173(j)(4)(E) of the Act states that any fee charged or allocated for collection activities conducted by the Departme nt of the Treasury's Financial Management System will be passed on to the health plan on a pro-rated basis and added to the penalty fee collected. 8. Audits Section 1173(h)(6) of the Act states that the Secretary shal l conduct periodic audits to ensure that health plans, including entities that have service contracts with health plans, are in19 compliance with the adopted standards and opera ting rules, as referenced in Table 1. The process and scope of these audits are not addressed in this proposed rule. C. Certification of Compliance and Stra tegy for a Consistent Testing Processes Beyond the first certification of compliance, section 1173(h)(5) of the Act requires health plan certification for new and revised standards and operating rules adopted by the Secretary. We intend for future rulemakings in which we adopt new or modified standards and operating rules to also include certification of compliance processes for those new or modified standards and operating rules. We believe the benefit of including the certification of compliance requirements in those rulemakings is that it wi ll move covered entities toward a consistent, industry-wide testing framework that, we believe , will support a more seamless transition to new and modified standards and operating rules. In recent years, the health care industry ha s experienced challenge s in implementing the HIPAA Administrative Simplifi cation requirements, such as Version 5010, ICD-10, and the operating rules for the eligibility for a health plan and health care claim status transaction, by the regulatory compliance dates. We have responde d to industry's needs for additional time by delaying implementation or relaxing enforcem ent periods for the requirements, but such practices can be expensive to industry. While many factors may cause a covered entity to have difficulty implementing a new Administrative Simplification requirement, many in industry a ttribute some implementation issues to the lack of a consiste nt testing process or framework. 13 The health care industry reports

13 Many of the assumptions in this section come from an NCVHS hearing held on June 20, 2012 in which these issues were discussed. The hearing and the NCVHS’ conc lusions are summarized in “Re: Findings from NCVHS Hearings on Administrative Simplification in June 2012 – an Update on Health Care Administrative Transactions,” September 21, 2012 letter to Secretary Sebelius from the Nati onal Committee on Vital and Health Statistics, pg 2. A copy of the letter and testimony from the hear ing can be found at: http://www.ncvhs.hhs.gov/20 that testing is critical to ensure the integrity of internal application systems and confirm a system's capability to conduc t compliant transactions. 14 The NCVHS stated that a uniform testing process that included full end-to-end test ing well before the compliance dates for Version 5010 would have identified issues that could have been mitigated in advance of the compliance date. 15 Ideally, certification of compliance, as ma ndated by section 1173(h) of the Act, should support a standardized process fo r demonstrating compliance. Su ch a standardized process for demonstrating compliance should require a health plan to undergo testin g within a consistent, industry-wide framework that results in the ability to generate sp ecific documents that demonstrate compliance. We believe such a process would solve some of the significant implementation issues the industry has experien ced. The certification of compliance provisions we propose in this rule are the first step towa rd a standardized testi ng framework to support a more seamless transition to new and revi sed standards or operating rules. II. Provisions of the Proposed Rule A. Submission Requirements Section 1173(h) of the Act requires health plan s to provide the Secretary, in such form as the Secretary may require, adequate documenta tion of compliance with the standards and operating rules. In accordance with section 1173 (h) of the Act, we propose the information and documentation that controlling health plans (CHPs) would be required to submit to the Secretary for the first certification of comp liance in the new regulation § 162.926.

14 See "Transaction Compliance and Certification: A Wh ite Paper Describing the Recommended Solutions for Compliance Testing and Certification of the HIPAA Transactions," prepared by the Workgroup for Electronic Data Interchange (WEDI) Transactions Workgroup, March 10, 2010. 15 Ibid.21 In the HPID final rule, we created two categories of health plans 16 for purposes of specifying enumeration requirements for the health plan identifier (HPID) : CHPs and subhealth plans (SHPs). In this proposed rule, we propose that CHPs, on behalf of themselves and their SHPs, if any, be responsible for submitting the information and documentation for the first certification of compliance under § 162.926. Under proposed § 162.926, a CHP would be requir ed to submit the following information and documentation, in one submission, to the Secretary:

● Its number of covered lives on th e date it submits the documentation.

● Documentation that demonstrates it has obtained eith er a CAQH CORE-- ++ Certification Seal for Phase I II CAQH CORE EFT & ERA Operating Rules (hereinafter referred to as a Phase III CORE Seal); or ++ HIPAA Credential for the eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) a nd remittance advice operating rules (hereinafter referred to as the HIPAA Credential). Collectively, these constitute the submissions, and we refer to the requirements to submit them to the Secretary as the "submission requ irements." The submission requirements, as proposed in this rule, are a "snap shot" of a CH P's compliance with the standards and operating rules. Such information and documentation doe s not reflect continuing compliance, nor do we do intend the information or documentation to be updated or resubmitted on a regular basis.

16 The regulatory definition of health pl an at 45 CFR 160.103 was initially adopted in the Transactions and Code Sets final rule. The basis for the additions to, and clarificat ions of, the statutory definition of health plan is further discussed in the preamble to the D ecember 28, 2000 final rule (65 FR 82478 and 82576) titled "Standards for Privacy of Individually Identifiable Health Information.”22 We are not, at this time, proposing the specifi c format for the submission requirements. We will likely require a CHP to submit its number of covered lives through an online form. We may require an electronic versi on or copy of a Phase III CORE S eal or the HIPAA Credential to be submitted online, or we may ask for a trackin g number that links to CAQH CORE records of such. Information about the mechanics for m eeting the submission requirements for the first certification of compliance will be forthcoming at or near the time the final rule is published. 1. Responsibilities of a CHP As previously noted, in § 162.926 we propose that a CHP be responsible for submitting the following on behalf of itself a nd, if it has any, its SHP(s):

● The number of covered lives of a CHP: The number of "covered lives of a CHP," as the term is proposed to be defined in § 162.103, would include the number of covered lives, if any, of a CHP's SHPs. (We discuss the definition of "covered lives of a CHP" in more detail in section II.B.1 of this proposed rule.) The CHP would be responsible for submitting its total number of covered lives as of the date it meets the submission requirements of § 162.926(a)(1) or (b)(1).

● Documentation that demonstrates the CH P has obtained either a Phase III CORE Seal or the HIPAA Credential. In order to obtain the documentation for this submission requirement, a CHP, also representing all of its SHPs, would have to meet the CORE requirements necessary to obtain either a Phase III CORE Seal or the HIPAA Credential. We discuss this documentation requirement in more detail in sect ion II.A.3 of this proposed rule. We believe the proposal that the CHP be responsible for meeting the submission requirements for itself and its SHPs is consistent with the framework of the HPID final rule. A23 CHP is defined at § 162.103 as exercising sufficien t control over its SHPs to direct its/their business activities, actions, or policies. We believe a CHP has sufficient control over its SHPs to require that it be responsible for the § 162.926 requ irements for itself and its SHPs. As described in section II.B.1 of this proposed rule, the CHP would also be responsible for the penalty fees that may be assessed if it fails to meet the first certification of compliance's submission requirements as proposed in § 162.926. We note that a CHP's proposed obligations under § 162.926 would not necessarily extend to other Administrative Simplification compliance or enforcement activities. Nothing in the provisions of this proposed rule would alter the require ment that all health plans must meet Administrative Simplification requirements per § 160.102. As health plans, SHPs are covered entities and independently responsible for ensuri ng they are compliant with the standards and operating rules, but, for purposes of this rule, we propose that the responsibility to meet the first certification of compliance submission requirements lies with the CHP. We emphasize that state and federal government entities that meet the definition of a CHP must meet the requirements of this propo sed rule and may be assessed penalty fees as described in the statute and in this rule; sec tion 1173(h) of the Act provides no exemptions for state or federal government health plans. 2. Proposed Submission Requirements: Number of covered lives of a CHP Section 1173(j)(1) of the Act requires the Secretary to assess a penalty fee against a health plan that fails to meet the certificati on of compliance requirements of section 1173(h). Section 1173(j)(1) of the Act specifies the pena lty fee amount, which is based on the covered lives of a health plan. Because we need to know the number of covered lives of a CHP (including the number of covered lives of its SHPs , if it has any) should circumstances require us24 to calculate penalty fees, we propose in § 162.926(a )(1) and (b)(1) to requir e CHPs to submit to the Secretary the number of covered lives of a CHP. We propose that the number of covered lives of a CHP submitted pursuant to § 162.926(a)(1) and (b)(1) would be th e number of covered lives as of the date the CHP submits the documentation proposed in § 162.926(a)(2) and (b)(2) to the Secretary. For example, if a CHP submits the documentation required by the fi rst certification of compliance on January 1, 2015, then its submission would reflect its number of covered lives as of that date. In § 162.926 (and discussed in section II.A.7 of this proposed rule), we propose that a CHP would have up to 12 months prior to the certif ication of compliance deadlines to satisfy the submission requirements. The definition of the "covered lives of a CHP" is best expl ained in the context of the penalty fees, which we do in section II.B.1 of this proposed rule where we describe the calculation of penalty fees. 3. Proposed Submission Requirements: HIP AA Credential or Phase III CORE Seal We propose to require CHPs to choose among two options, the HIP AA Credential or a Phase III CORE Seal, as described in this se ction, to demonstrate compliance for the first certification of compliance. There are any number of reasons why a CHP may elect to obtain one of these options over the other. A CHP will find that one or th e other better aligns with the implementation process it uses to implem ent new operating rules. a. Process and Requirements fo r Obtaining HIPAA Credential We are proposing in § 162.926(a )(2) and (b)(2) that a CHP has the option of selecting the HIPAA Credential as one of two alternatives fo r meeting the first certification of compliance submission requirements. The HIPAA Cred ential is administered by CAQH CORE and25 demonstrates that a CHP has attested to comp liance with HIPAA standards and operating rules for the eligibility for a health plan, health care claim status, a nd electronic funds transfers (EFT) and remittance advice transactions, and that th e CHP has conducted a certa in level of testing. CAQH CORE is currently developing the HIPAA Cr edential – which we expect to be finalized prior to the time we finalize this rule – a nd we describe here th e expected process and requirements for obtaining it. Just as CAQH CORE provides explicit details about the CORE Seals on its website, we expect it will do the same for the HIPAA Credential. Should the final HIPAA Credential differ in any material way fr om the way we describe it herein, we would reopen the comment period for this t opic to allow for further comment. The scope of the HIPAA Credential would only encompass the HIPAA-mandated standards and operating rules. For example, we have not adopted HIPAA standard s and operating rules for acknowledgements, therefore the HIPAA Credential would not requ ire attestation or compliance with respect to standards and operating rules regarding acknowledgements. To obtain the HIPAA Credential, a CHP would have to submit to CAQH CORE--

● The CAQH CORE HIPAA Attestation Form (similar to the form required for the CORE Certification process, 17 discussed in section II.A.3(b) of this proposed rule);

● An application form (similar to the fo rm required to obtain a CORE Seal) with signature verifying that all forms have been submitted to CAQH CORE and indicating that HHS may view the application and associated forms if such a request is made to CAQH CORE; and

17 http://www.caqh.org/pdf/CL EAN5010/COREHIPAAForm.pdf , http://www.caqh.org/pdf/ COREPIIHIPAAForm.pdf , and http://caqh.org/Host/CORE/EFT-ERA/CORE_PIII_HIPAA_Form.pdf http://www.caqh.org/pdf/CL EAN5010/COREHIPAAForm.pdf , http://www.caqh.org/pdf/ COREPIIHIPAAForm.pdf , and http://caqh.org/Host/CORE/EFT-ERA/CORE_PIII_HIPAA_Form.pdf for the Phase I, II, and III CAQH CORE HIPAA Attestation Forms respectively.26

● An attestation form, with features or re quirements that would include the following: ++ Attestation, in which the CHP confirms that it has successfully tested the operating rules for the eligibility fo r a health plan, health care claim st atus, and health care electronic funds transfers (EFT) and remittance advi ce transactions with trading pa rtners. For each of the three transactions, the CHP must confirm that the numbe r of transactions conduct ed with those trading partners collectively accounts fo r at least 30 percent of the total number of transactions conducted with providers. For each of the three transactions, the CHP must confirm that it has successfully tested with at least three tradi ng partners, but if the number of transactions conducted with three trading partne rs does not account for at leas t 30 percent of the total number of transactions conducted with providers, the CH P could confirm that it has successfully tested with up to 25 trading partners. The CHP woul d have to list those trading partners.
We do not define "successfully tested" in this proposed rule, or prescribe any specific kind or level of testing fo r the HIPAA Credential. ++ When a CHP attests that it has successfu lly tested with trading partners that, collectively, conduct at least 30 percent of the total number of transactions conducted with providers, it is representing itsel f and its SHPs. When calculating 30 percent of the transactions conducted with providers, the tota l of the CHP's and SHPs' transa ctions would be used. ++ The CHP would have to provide contac t information, including, but not limited to, name, phone number, and email address, for each of the listed trading partners. ++ Trading partners may be transaction-spec ific. For example, a CHP may list the same or different trading partners for each of the thr ee transactions, so a CHP may list three or more trading partners.27 ++ Trading partner testing would only be required for current HIPAA-mandated operating rules and standards, so trading partner testing would not be required for the use of acknowledgments, or optiona l aspects of standards. In reviewing CHPs' HIPAA Credential app lication packages, CAQH CORE will likely identify applications containi ng obvious errors, and not award the HIPAA Credential based on such information. CAQH CORE will also identify when required information, such as trading partner contact information, is missing in th e HIPAA Credential application package. While CAQH CORE will likely identify obvious errors or missing information in the HIPAA Credential application package, CAQH CO RE will not be responsible for addressing intent on the part of the CHP with regard to su ch errors or missing information. That is, CAQH CORE will not investigate what a CHP knew or didn't know when it submitted an inaccurate HIPAA Credential application package to C AQH CORE. Similarly, CAQH CORE will not address any claims that may be submitted to CAQH CORE about a CHP's intent behind any inaccuracies or incomplete information in a HI PAA Credential application; for example, CAQH CORE will not address claims that a CHP knowingly provided inaccurate or incomplete information in its HIPAA Credential application. Other aspects of the HIPAA Credential include:

● Unlike the CORE Seals, it would onl y be offered to health plans.

● The HIPAA Credential would not have a re quirement for certification testing, as is required for a Phase III CORE Seal. The HIPA A Credential would not have a requirement to test with a third-pa rty testing vendor.

● The HIPAA Credential requires external testing; however, it does not require a specific approach to external testing, and, thus, does not directly support a consistent,28 industry-wide testing framework to the extent that a Phase III CORE Seal does. Thus, we view the HIPAA Credential as an initial step toward a consistent testing fr amework for CHPs that decide not to undergo the certification testing for a CORE Phase III Seal. b. Process and Requirements for Obtaining a CORE Seal The three current CAQH CORE Operating Rule se ts are referred to as phases: Phase I is the operating rule set for the eligibility for a heal th plan transaction; Phase II includes operating rules for both the eligibility for a health plan a nd the health care claim status transaction; and Phase III is the operating rule set for the heal th care electronic funds transfers (EFT) and remittance advice transaction. The Secretary has a dopted the sets as the operating rules for the respective transactions, with the exceptions we describe in sec tion I.B.2 of this proposed rule. CAQH CORE has developed sepa rate certification testing requirements for each of the three phases of operating rules. Any health car e entity that conducts the applicable electronic health care transactions may voluntarily undergo certification testing with an independent CORE-authorized testing vendor and a certification process through CORE to demonstrate compliance with the three phases. An entity th at successfully completes the testing and submits the appropriate documentation to CAQH CORE is awarded a CORE Seal for the specific phase for which it tested. In order to be awarded a CORE Seal for all three phases, a CHP would be required to conduct certification te sting for compliance with the requirements in Phases I, II, and III, which may be done chronologically or concurrently. We are proposing a Phase III CORE Seal as one of two options a CHP may choose to meet the submission requirements of the first certification of complianc e. The preparation required to apply for, and the documentation requir ed in order to be awarded, a CORE Seal for each phase reflects the kind of consistent intern al and external testi ng and documentation of29 compliance that we believe will ameliorate many of the challenges industry has recently faced during transitioning to new st andards and operating rules. Because we propose that CHPs may choose to obtain a CORE Seal to satisfy the requirements of proposed § 162.926(a)(2) or (b)(2), we describe the steps involved for entities to obtain a CORE Seal: 18 (1) conduct a gap analysis by ev aluating, planning, and completing necessary system upgrades; (2) sign and submit the CAQH CORE Pledge to make a commitment to become a CORE-certified entity with in 180 days; (3) condu ct testing through a CORE-authorized testing vendor; and (4) apply for a Phase III CORE Seal by submitting the proper documentation and fee to CAQH CORE for consideration. This four-step process is described in more detail as follows:

● Step 1: Conduct A Gap Analysis Entities that implement the CAQH CORE Op erating Rules conduct a gap analysis in order to determine what system and business pro cess changes may be necessary to ensure their data and information systems are remediated to address any gaps between existing system requirements and CORE Operating Ru le requirements. (Certification testing is described later in this section.) Project managers, business analysts , system analysts, architects, and other key staff conduct the gap analyses, which in clude an inventory of the sy stems affected by the specific phase of operating rules and the drafting of a deta iled project plan. CORE provides an analysis and planning guide as a gap analysis tool for each of its current phases. 19

● Step 2: Sign and Submit the CORE Pledge An authorized, executive-level employee of the entity that is applying for any of the three

18 Step-by step process for certification fo r Phase I and Phase II can be found at: http://www.caqh.org/CO RE_step_by_step.php 19 http://www.caqh.org/Host/CORE/CAQHC ORE_Analysis&PlanningGuide.pdf and http://www.caqh.org/Host/CORE/CAQHCORE_ EFT&ERA_Analysis&PlanningGuide.pdf30 CORE Seals signs a binding CORE Certification Pledge to adopt , implement, and comply with the CAQH CORE Operating Rules. By signing the pledge, an entity commits to working with a CORE-authorized Testing Vendor to demonstrate th at its product(s) or IT system(s) is operating in accordance with a specific phase of the CORE Operating Rules. (We discuss CORE-authorized Testing Vendors in more depth in section II.A.2.d of th is proposed rule.) Testing with a CORE-authorized Testing Vendor must be completed within 180 days of signing the pledge, 20 though extensions may be granted by signing and submitting a new pledge.

● Step 3: Testing by a CORE-authorized Testing Vendor using CORE Certification Master Test Suites (C ertification Testing) CAQH CORE developed documents called CORE Certification Master Test Suites (Test Suites) for each of its three operating rule phase s. The phase-specific Test Suites are operating rule and documentation requirement s that an entity must meet to be awarded a CORE Seal for that phase. Test Scripts – which include a descrip tion of operating rule -by-operating rule requirements, as well as specific documentati on or information necessary to demonstrate compliance with each operating rule requirement – are the primary tools in each phase-specific Test Suite. Tables 2 and 3 illustrate two examples of Test Scripts for two different operating rule requirements. Table 2 illustrates a test scri pt from Phase I CORE 152 Companion Guide Rule Certification Testing and Table 3 illustrates a test script from Phase I CORE 154 Eligibility and Benefits (270/271) Data Content Rule Certifica tion Testing. As illustrated by Table 2 and Table 3, each Test Script includes th e following five columns:

● Column 1 - The criteria or descript ion of the requirements of the rule.

20 http://www.caqh.org/CO RE_certification.php31

● Column 2 - The expected result of a test of compliance with the rule. Entities upload documents or submit transaction files to CORE -authorized Testing Vendors that demonstrate they have met the requirements of each Test Script.

● Column 3 - The actual result that the entity found upon testing the rule (that is, whether the expected outcome was achieved).

● Column 4 - Indicates whet her the entity was able to produce the expected result in terms of pass or fail.

● Column 5 - Indicates which stakeholder would be required to produce the expected result. For operating rules with requirements about data content, an entity would submit a transaction file to be tested in the CORE-authorized Testi ng Vendor's testing engine. Using the example of the Test Script illustrated in Tabl e 3, an entity would be required to submit a transaction file, detailed in co lumn 2, and receive a "pass" fr om the CORE-authorized Testing Vendor in column 4 indicating the file met the requirement. In other cases, an entity would submit othe r types of documents that demonstrate the expected result of the Test Script . Using the example of the Test Script illustrated in Table 2, an entity would be required to submit an electronic ve rsion of the table of contents of its ASC X12 v5010 270/271 companion document, including an example of the ASC X12 v5010 270/271 content requirements," to the CO RE-authorized Testing Vendor in order for the vendor to give a "pass" to that test. The process of submitting documents or uploading files to CORE-authorized Testing Vendors is virtual, and an entity may access the CORE-authorized Testing Vendor's testing portal from a desktop computer.32 The certification testing, descri bed here as a key step in obtaining a CORE Seal, would be conducted after an entity has conducted internal and external testing of the operating rules. CORE's standardized certification testing demonstrates that a cons istent and standard IT system testing has been completed. Theref ore, certification testing, such as that which is described here, reflects our intent of supporting an industry-wide consistent trad ing partner testing process or framework.
TABLE 2: ILLUSTRATION A: SAMPLE TEST SCRIPTS FROM PHASE I CORE CERTIFICATION TEST SUITE SAMPLE TEST SCRIPT FOR PHAS E I CORE 152 COMPANION GUIDE RULE CERTIFICATION TESTING Criteria Expected Result Actual result Pass/Fail Stakeholder
Provider Health Plan Clearing house N/A Companion Document conforms to the flow and format of the CORE master Companion Document Template Submission of the Table of Contents of the v5010 270/271 companion document, including a example of the v5010 270/271 content requirements □ Pass □ Fail □ □ □ □

TABLE 3: ILLUSTRATION B: SAMPLE TEST SCRIPTS FROM PHASE I CORE CERTIFICATION TEST SUITE A TEST SCRIPT FROM PHASE I CORE 154 ELIGIBILITY AND BENEFITS (270/271) DATA CONTENT RULE CERTIFICATION TESTING

Criteria Expected Result Actual result Pass/Fail Stakeholder
Provider Health Plan Clearing house N/A Create a valid v5010 271response transaction as defined in the CORE rule indicating the patient financial responsibility for each of the Output a valid fully enveloped v5010 271eligibility response transaction set with the correct co-insurance, co-payment, and deductible patient □ Pass □ Fail □ □ □ □33

benefits covering the individual (Key Rule Requirement #6 through #18) financial responsibilities for both in/out of network in either EB08-954 or EB07-782 at either the subscriber loop 2110C or dependent loop 2100D levels

● Step 4: Apply for a CORE Seal Once an entity successfully completes the ce rtification testing w ith a CORE-authorized Testing Vendor, it submits an application p ackage to CAQH CORE, and the CAQH CORE staff then reviews the application package prior to granting the appropriate CORE Seal. The application package include s the following: ++ Documentation from a CORE-authorized Testing Vendor demonstrating the entity's compliance with the phase-specific CAQH CORE Operating Rules through successful certification testing. ++ The CAQH CORE HIPAA Attestation Fo rm, signed by a senior-level executive, indicating that, to the best of the applicant's knowledge, the entity is HIPAA compliant for security, privacy, and the transactio n standards. This form is addr essed in more detail in section II.A.3(c) of this proposed rule. ++ The CAQH CORE Health Plan IT Exemption Form, if applicable. This form and its relationship with the submission requirements of th e first certification of compliance is discussed in section II.A.3(e) of this proposed rule. ++ The CAQH CORE Application. This fo rm collects contact information for the individual responsible for the organization's CORE -certification process. The form also outlines the required materials for a complete CORE Certification Applicati on, the process by which34 CAQH CORE will review and approve appli cations, and terms and conditions for CORE Certification. ++ A fee, as illustrated in Table 4. Upon receipt of this docum entation, CAQH CORE will co mplete a final assessment within 30 business days unless there are extenuating circumstan ces. CAQH CORE reviews test results and maintains records for each en tity that is awarded a CORE Seal. A health plan must be awarded a CORE Seal in a previous phase to be eligible for a subsequent phase's Seal. 21 For example, a health plan must be awarded a CORE Seal for Phase I and II Operating Rules in order to be eligible for a CORE Seal for Phase III Operating Rules. CAQH CORE provides the option of applying for and conducting certifi cation testing for all three phases concurrently. In the context of the requirements for the first certification of compliance, this means that a CHP that chooses the option to submit a CORE Seal for Phase III Operating Rules will need to obtain CORE Seal s for Phases I and II first, or concurrently. We believe that the CORE Seal, obtained th rough the CORE certifica tion process, is a reasonable and appropriate demonstration of compliance with the operating rules because --

● CAQH CORE develops its CORE S eal certification process through a multi-stakeholder approach. CAQH CORE is an industry-wide collaboration committed to the development and adoption of national operating ru les for administrative transactions. The more than 140 CORE Participants represent all key st akeholders including prov iders, health plans, vendors, clearinghouses, government agencies, Me dicaid, banks and standard development organizations. CAQH CORE draws on this re presentation to develop the requirements for CORE Certification (Test Suites and Test Scri pts) through a transpar ent, consensus-based

21 See question #4, page 9 of 23 at http://www.caqh.org/pdf/ COREFAQsPartA.pdf35 process. To our knowledge, no other entity currently has an equivalent multi-stakeholder process for developing certificati on testing for operating rules;

● Through the CORE-authorized Testing Ve ndor framework, CAQH CORE has created a marketplace for multiple commercial te sting vendors to compete, while requiring CORE-authorized Testing Vendors to utilize sta ndardized Test Scripts and specific submission requirements in testing entities. In its role as the "certifier," in cont rast to a "tester," CAQH CORE maintains a third party pos ition, independent from both the entity seeking the CORE Seal and the testing vendors with commercial interest s. This allows CAQH CORE to carry out the certifying process – and enforcement, appeal s and exception policies and processes – in a neutral, transparent manner;

● CORE Certification is recognized as an Ad ministrative Simplification tool for health plans and states. Currently, over 30 health plans have been awar ded or have pledged to seek CORE Seals for Phases I, II, or III, or have pledged to seek the CORE Seal. 22 CORE Certification is also a crucial element in stat e-based health care reform initiatives in Oregon 23 and Colorado. Colorado, for example, requires that, "[w]hen installing new operating systems after December 31, 2012, all carriers are re quired to use CORE-certified systems for communications, those systems which meet CORE certification standards, or contract with a vendor who has applied by January 1, 2013 to be CORE- certified." 24 The Colorado regulation also states that "Phase I CORE certification shall be accepted as evidence of compliance" with

22 For updated information on entities that have CO RE-certification or have committed to receive CORE-certification, please refer to http://www.caqh.org/CORE_organizations.php

. 23 O.A.R. 836-100-0115(1): http://arcweb.sos.state.or.us/pages/ rules/oars_800/oar_836/836_100.html 24 3 CCR 702-4-2-32: http://cdn.colorado.gov/cs/Satellite?blobcol=urldata&blobheadername1=Content-Disposition&blobheadername2=C ontent-Type&blobheadervalue1=inline%3B+filename%3D%224-2-32+Standardized+Electronic+Identification+An d+Communication+Systems+Guidelines+For+Health+Benefit+Plans.pdf%22&blobheadervalue2=application%2Fp df&blobkey=id&blobtable=MungoBlobs&blobwhere=1251823308663&ssbinary=true36 the CORE operating rules that the regulation also adopted; 25 and

● CAQH CORE's Certification Infrastructure. CAQH CORE's infrastructure includes: robust on-line and live support for entities during the certificati on process; a complaint-driven enforcement mechanism that identifies instan ces of non-compliance; an exemption policy and process; a re-certification process; and an appeal s process allowing an entity to request a hearing if it disagrees with CAQH CORE's decision of non-compliance. We request comments on a Phase III CORE S eal as an option for CHPS to meet the documentation requirements for the firs t certification of compliance. c. CAQH CORE HIPAA Attestation Forms as Documentation of Compliance with the HIPAA Standards In order to obtain a CORE Seal for each of the operating rule phases, an entity must sign the CAQH CORE HIPAA Attestation Form by which it attests to complian ce with applicable HIPAA transaction provisions, and the HIPAA priv acy and security provis ions, of 45 CFR Parts 160, 162, and 164. We anticipate that CAQH CORE 's HIPAA Credential application process will similarly require such an attestation fo r the HIPAA Credential, and we find such an attestation to be an essential document of compliance for purposes of the first certification of compliance. We note that, attesting to comp liance with the HIPAA privacy and security provisions or obtaining a CORE Seal (or the HIPAA Credential) does not prevent or preclude the Office for Civil Rights from conducting HIP AA Privacy or Security Rules investigations, compliance reviews or audits; settling cases; making findings of non-co mpliance; or imposing civil money penalties for HIPAA violations.

25 Ibid., Section 5.37 The proposed submission requirements of § 162.926(a)(2) and (b)(2) demonstrate a CHP is compliant with applicable standards and operating rules. We considered proposing a framework by which CHPs would demonstrate co mpliance with applicable standards styled similarly to the proposed framework for demonstra ting compliance with operat ing rules. That is, we considered requiring a CHP to obtain documenta tion from a third-party demonstrating it has conducted external testing with th e standards adopted for the eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT) and remittance advice transactions. At this time, however, we be lieve CAQH CORE's HIPAA Attestation Form satisfies the section 1173 (h)(2) mandate that health plans submit adequate documentation of compliance with the applicable standards for purpos es of the first certific ation of compliance. We chose this approach because we--

● Believe that requiring just the CAQH CORE HIPAA A ttestation Form minimizes CHPs' burdens in complying with the first ce rtification submission re quirements, while not altering or undermining the statutory requirement s or our objectives in ensuring compliance; and

● Are not aware of existing pr ograms that demonstrate consistent testing for compliance with the standards that parallel the proposed process for certify ing health plans for compliance with the operating rules. There may be commer cial entities that "certify" entities as being compliant with the standards, but we do not know of any that have developed a standards certification process, certificat ion testing, or certification in frastructure with significant participation from industry. We also recognize that, while the HIPAA Cr edential option relies on entities having successfully conducted testing with trading partne rs, it does not directly support a consistent, industry-wide testing framework of new standards and operating rules. We view the first38 certification of compliance submissi on requirements as an initial st ep in that direction. We solicit comments on our assumptions and proposed approach. d. CAQH CORE documentation and policies We are proposing that CHPs may choose between two CAQH CORE documents – a Phase III CORE Seal or the HIPAA Credential – to demonstrate compliance for the first certification of compliance. We believe either of these documents through CAQH CORE is a reasonable approach because CAQH CORE --

● Is recognized as a technical expert in the implementation of operating rules and supports the standards for those transactions to which the operating rules apply, a dopted by the Secretary (after a vetting process discusse d in section I.B.2 of this propo sed rule). CAQH CORE is the authoring entity of the operating rules and is, therefore, well-versed in the operating rules and their interpretation and implementation, and how they coordinate with the adopted standards;

● Has infrastructure to reach out to, and educate, CHPs that will be required by this proposed rule to obtain either a Phase III CORE Seal or HIPAA Credential; and

● Has the ability to convene workgroups with significant and diverse health care industry participation to continually inform , and, where appropriate, improve processes associated with the CORE Seal and HIPAA Credential products. We solicit comments on our proposal to li mit CHPs' options to documents obtained through processes governed by CAQH CORE. e. CAQH CORE's Exemption and Enforcement Po licies as applied to the Proposed Submission Requirements (1) CAQH CORE Certifica tion Exemption Policies39 Under proposed § 162.926(a)(2) and (b)(2), we specify that a CHP may not be under the CORE IT Exemption Policy at the ti me of submission with regard to the CORE Phase I, II, or III CORE Seals that the CHP uses to meet the submission requirements. 26 CAQH CORE's Certification Exemption Poli cy enables a health plan, in certain situations, to be awarded a CORE Seal for a particular phase ev en if all of its IT systems do not pass the Test Scripts for that phase . So long as the remainder of a health plan's IT systems are compliant, CAQH CORE may grant a health plan a Health Plan IT System Exemption if it has a scheduled migration, within the upcoming 12 months, of an existing, non-conforming IT system(s). 27 Subsequent to the migration(s), CAQH CORE requires the health plan to submit documentation demonstrating the new IT system(s) complies with the operating rules, standards, and other items required by CORE Certification. 28 Although a health plan may obtain a CORE Seal under such a CAQH CORE exemption, we make clear in § 162.926(a)(2) and (b)(2) that , on the date a CHP submits documentation to meet the submission requirements of the first cer tification of compliance, it may not be under such an exemption with respect to the CORE Phase I, II, or III Se als. To be clear, a CHP may receive a CORE Seal under CAQH CORE's Health Pl an IT System Exemption policy. However, a CHP that receives a CORE Seal under CAQH CORE 's Health Plan IT System Exemption must no longer be exempted on the date it provides its s ubmissions to the Secretary in order to meet

26 For Phases I, II, and III, CORE addresses certification exemptions at: http://www.caqh.org/pdf/CLEAN5010/103.pdf , , http://www.caqh.org/pdf/CLEAN5010/203.pdf and http://caqh.org/Host/CORE/EFT-ERA/303_Exemption_Policy.pdf Forms at: http://www.caqh.org/pdf/CLEAN5010/CO REPII_ITExemptionRequestForm.pdf , http://www.caqh.org/pdf/CLEAN5010/103.pdf , and http://caqh.org/Host/CORE/EFT-ERA/303_Exemption_Policy.pdf for Phases I, II and III. 27 These exempted IT systems must serve no more than 30 percent of the health plan’s membership or applicable transactions. 28 For Phases I, II, and III, CORE addresses certification exemptions at: http://www.caqh.org/pdf/CLEAN5010/103.pdf , , http://www.caqh.org/pdf/CLEAN5010/203.pdf and http://caqh.org/Host/CORE/EFT-ERA/303_Exemption_Policy.pdf40 the first certification of compliance requirements. CAQH CORE's Health Plan IT System Exem ption Policy does not apply to the HIPAA Credential, so a health plan's systems must be fully compliant with the applicable operating rules to obtain the HIPAA Credential. (2) CORE Enforcement Policy CAQH CORE's Enforcement Policy 29 is a complaint driven process that, under the guidance of the CORE Enforcement Committ ee comprised of CAQH CORE participants, reviews complaints for completeness and timelin ess, and verifies or dismisses complaints. CAQH CORE's Enforcement Policy applies to its CORE Seal product (not the HIPAA Credential), and thus would apply to CHPs that elect to obtain a Phase III CORE Seal to fulfill the submission requirements proposed in this rule. (3) A CHP is Decertified by CORE CAQH CORE's policies specify a number of circumstances by which an entity may be "decertified," could "lose" its CORE Seal, or ha ve its certification "ter minated" because of instances of noncompliance with the operating ru les for which it is certified. One such policy with this possible consequence is the CAQH CORE IT Exempti on Policy, described in section II.A.3 (e) of this proposed rule, whereby a health plan that ha s obtained a CORE Seal under the policy may be decertified if its new IT system fail s to pass the applicable Test Scripts within a prescribed timeframe. 30 Similarly, CAQH CORE's Enforcemen t Policy specifies that an entity with a CORE Seal may be decertif ied if it is found to be out of compliance with an operating

29 See http://www.caqh.org/pdf/CLEAN5010/105.pdf , http://www.caqh.org/pdf/CLEAN5010/205.pdf , and http://caqh.org/Host/CORE/EFT-ERA/305_Enforcement_Policy.pdf for Phase I, II, and III enforcement policies. 30 http://www.caqh.org/pdf/CLEAN5010/103.pdf , http://caqh.org/Host/CORE/EFT-ERA/303_Exemption_Policy.pdf , http://www.caqh.org/pdf/CLEAN5010/103.pdf , and http://www.caqh.org/pdf/CLEAN5010/203.pdf41 rule(s) or standard if the violation is not remedied w ithin the allowed grace period. 31 As discussed previously, on the date a CHP submits its documentation, none of the CHP's CORE Seals may be terminated or the CHP decertified by CAQH CORE. In keeping with the "snap shot" approach desc ribed in section II.A. of this proposed rule, we will not track the status of a CHP's CORE Certification (that is, whether it has been terminated or has come under the CAQH CORE IT Exemption Policy) subsequent to the date it meets the proposed submission requirements. 32 (4) CHP's Responsibilities with respect to Entities Conducting Transa ctions on its Behalf Section 1173(h)(3) of the Act re quires a health plan to "ensure that any entities that provide services pursuant to a cont ract with such health plan shall comply with any applicable certification and compliance requirements (a nd provide the Secretary with adequate documentation of such compliance) under this su bsection." Because section 1173(h) of the Act is concerned with certification of compliance w ith the HIPAA standards and operating rules, we believe "services pursuant to contract" means serv ices provided by business associates (BAs), as that term is defined at § 160.103, that are contracted to condu ct all or part of a HIPAA transaction on behalf of a health plan. Although we considered requiring CHPs to require their BAs to comply directly with the requirements of § 162.926, we are not pursuing th at option. Rather, when a CHP submits documentation in accordance with the submission requirements of § 162.926, we believe that, by virtue of meeting the requirements of § 162.923(c) (which requires covered entities that use BAs to conduct transactions on their behalf to require those BAs to comply with the requirements of

31 http://www.caqh.org/pdf/CLEAN5010/105.pdf, http://www.caqh.org/pdf/CLEAN5010/205.pdf , and http://caqh.org/Host/CORE/EFT-ERA/305_Enforcement_Policy.pdf 32 However, to be clear, health plans are covered en tities obligated to continually abide by adopted HIPAA standards and operating rules, and the requirements of this proposed rule do not impede our enforcement authority.42 part 162), it will be certifying that its, and its SHP(s)', BAs that conduct all or part of a HIPAA transactions on its/their behalf are compliant with the HIPAA sta ndards and operating rules. We do not believe section 1173(h)(3) of the Act places any new requi rements or burdens on health plans with regard to their BAs that are not already accounted for in § 162.923(c). Under CAQH CORE policy, to obtain a CORE S eal, a health plan mu st demonstrate that entities or vendor products that c onduct all or part of a transac tion related to a CAQH CORE are compliant with the operating rules. 33 This CAQH CORE policy on non-health plan entities that conduct all or part of a transac tion related to a CAQH CORE phase on behalf of a health plan aligns with our approach to BAs that conduct part or all of a tran saction on behalf of a CHP or its SHPs. Likewise, as we have descri bed here, if a BA that is not a health plan conducts all or part of a transaction on behalf of the CHP or its SHP( s), then the CHP is responsible for ensuring the entity conducts any HIPAA standard transact ions in accord with any applicable HIPAA transactions standards and operating rules. As noted previously, CAQH CORE requires th at any health plan wishing to obtain a CORE Seal that is dependent on a BA – for the h ealth plan to meet one or more of the CORE operating rule requirements – must have that BA achieve CORE certification. Similarly, if the health plan is dependent on a software vendor to meet one or more of the CORE rule requirements, then the vendor's product na me and vendor must be CORE-certified. ( 5) Documentation Demonstrating End-to-End Testing Section 1173(h)(2)(B) of the Act st ates that a health plan sha ll not be considered to have provided adequate documentation of compliance unl ess it "provides documentation showing that

33 See CAQH CORE FAQs on CORE Certification & Endorsement: http://www.caqh.org/ pdf/COREFAQsPartF.pdf43 [it] has completed end-to-end testin g for such transactions with [ its] partners, such as hospitals and physicians." Even outside the context of health plan certification, the meaning of the phrase "end-to-end testing" – as well as the types of te sting necessary for successful transitions to new or revised standards, code sets, or operating rule s – is presently the subject of active discussion in the health care industry. HHS, th rough the Office of E-Health Sta ndards and Services (OESS), is conducting a pilot that seeks to develop a proc ess and methodology for testing the transaction standards, operating rules, c ode sets, identifiers, and othe r Administrative Simplification requirements based on industry feedback and participat ion. One of the goals of that effort is to establish a definition for end-to-end testing in th is context that can be applied industry-wide. Although we know of no standard definition for end-to-end testing at this time, we believe the concept of end-to-end testing likely requires, at a mi nimum, external testing with trading partners. We emphasize th at in order to obtain either a Phase III CORE Seal or the HIPAA Credential, some external testing is requ ired. Note that certif ication testing, as is required to obtain a CORE Seal, is not the same as internal or external testing. However, certification testing includes submitting documenta tion that demonstrates certain levels of internal and external testing have taken place. By contrast, the HIPAA Credential directly requires external testing with trading partners. Thus, we believe CHPs that meet the submission requirements proposed in this rule meet the se ction 1173(h)(2)(B) of the Act's requirement. (6) Other Considerations about CORE Certification (a) Cost of CORE Seal and CORE HIPAA Credential CAQH CORE charges entities a fee, on a sliding scale acco rding to net annual revenue, for administering and awarding CO RE Seals. Table 4 illustrate s the current fees that CAQH44 CORE charges a health plan. Table 4 reflects the total costs for a CHP to obtain three CORE Seals, one for each CAQH CORE Operating Rule phase. 34 The fees to obtain the CORE Seals do not include the cost for certification test ing with a CORE-authorized testing vendor. 35 Table 4 also illustrates the approximate fees that we expect CAQH CORE will charge CHPs for the HIPAA Credential it is currently developing. CAQH CORE does not charge federal and stat e government entities for the CORE Seals, but we expect federal or state government entities will be charged $100 to obtain the HIPAA Credential. TABLE 4: CAQH CORE FEES FOR CO RE SEAL AND HIPAA CREDENTIAL

Size of Health Plan Fee for HIPAA Credential Fee for CAQH Phase III CORE Seal including Phase I and II Seals Federal and State government health plans $100 No charge CAQH Member Plans No charge No charge Below $5 million in net annual revenue $100 $5 million to below $25 million net annual revenue $1,000 $25 million to below $50 million net annual revenue $2,000 $50 million to below $75 million net annual revenue $12,000 ($4,000 per phase)

$75 million and above net annual revenue $4,000 $18,000 ($6,000 per phase)
(b) Treatment of Acknowledgements We have previously stated in both th e Operating Rules IFC and the EFT & ERA Operating Rules IFC that we do not require cove red entities to comply with any CAQH CORE Operating Rule requirements pertaining to ackno wledgments in Phases I, II, and III (§ 162.1203, § 162.1403, and § 162.1603). However, each of CORE's three phase-specific Test Suites require that applicants demonstrate compliance with ack nowledgments-related operating rules. CHPs that seek to obtain a Phase III CORE Seal will be bound by CAQH CORE's requirements; in

34 The current CORE fee st ructure for the CORE S eal can be found at: http://www.caqh.org/CORE_phase1_fees.php

. 35 As of this writing, the single CORE-authorized testing ve ndor does not charge a fee for entities to test with it.45
other words, the fact that HHS does not require compliance with acknowledgments-related operating rules does not relieve th e burden of CHPs seeking a CORE seal to abide by CAQH CORE's requirements. By contrast, the requirements underlyi ng CAQH CORE's HIPAA Credential will only apply to the operating rules adopted by the Secretar y, so CHPs will not have to comply with the acknowledgements operating rules to obtain the HIPAA Credential. (7) Compliance Timelines for CHPs to Meet Submission Requirements for the First Certification of Compliance (a) CHPs that obtain an HPID before January 1, 2015 (i) Submit documentation by December 31, 2015 In § 162.926(a), we propose that a CHP that obtains an HPID before January 1, 2015, would be required to meet the submission requirements (proposed in section II.A of this proposed rule) for the first cer tification of compliance on or before December 31, 2015. See Table 5, Row 1. Per the requirements of § 162.504, a ll CHPs (except those th at are small health plans) must obtain HPIDs on or before Novemb er 5, 2014. CHPS that are small health plans must obtain HPIDs on or before November 5, 20 15. Based on our analysis, we think very few health plans meet the defini tion of a small health plan, 36 so we anticipate most CHPs will have obtained HPIDs on or before November 5, 2014. We propose a different date (December 31, 2015) than that in sect ion 1173(h)(1) of the Act (December 31, 2013) for most CHPs to m eet the first certification of compliance

36 In the HPID proposed rule, we concluded there were approximately 138 health maintenance organizations that were small entities by virtue of their nonprofit status though “few, if any of them are small by SBA size standards” (77 FR 23000) and that no other category of health plan could be considered “small” (77 FR 22999). Our conclusions were based on an analysis included in a pro posed rule on the establishm ent of the Medicare Advantage program (69 FR 46866, August 3, 2004).46 requirements because we believe, for the followi ng reasons, CHPs will likely need until the end of 2015 to meet the requirements for th e first certification of compliance:

● In section II.A.3(b) of this proposed rule , we discuss the steps a CHP would have to take in order to obtain a CORE Phase III Seal, sh ould it elect to pursue th at option. We believe the deadlines proposed in this rule offer CHPs adequate time to complete the gap analysis (planning and evaluation, design and developmen t, and internal and external testing) and subsequent certification testi ng with a CORE-authorized test ing vendor necessary to obtain CORE Seals for Phase I, II, and III Operating Ru les. CAQH CORE suggests it will take 20 to 60 days of staff time to conduct certification te sting with a CORE-authorized testing vendor and complete and submit one CORE Seal Application packet. 37 A CHP may also choose to simultaneously pursue CORE Seals for all three ph ases. Therefore, for CHPs that do not now have, but choose to obtain, a Phase III CORE Seal , it could take up to 180 days to obtain Seals for all three operating rules phases, not incl uding any time that CORE requires to review applications.

● In section II.A.3(a) of th is proposed rule, we discuss the broad requirements of the HIPAA Credential. Like a Phase III CORE Seal, it will take some time to meet the requirements for the HIPAA Credential, though many CHPs may ha ve already met the testing requirements.

● In section II.A.1 of this proposed rule , we propose that a CHP, in meeting the submission requirements for the fi rst certification of compliance re quirements, will demonstrate not only that it is compliant with operating rules and standards, but that its SHP(s), if it has any, are compliant. This task will also take time.

● October 1, 2014 is the compliance date for the International Classi fication of Diseases,

37 See FAQ #11 at http://www.caqh.org/pdf/ COREFAQsPartA.pdf47

10 th Edition (ICD-10) Medical Data Code Sets. Facilitating the health care industry's smooth transition to ICD-10 is of param ount importance, and health plans need to prepare and fully test their systems to ensure a smooth and coordinate d transition. We expect health plans to be dedicating significant resources to wards the ICD-10 transition prio r to, and for a time after, the compliance date, which transition may require participation from the same human and IT resources as will be necessary to meet the first certification of compliance submission requirements. We believe the proposed December 31, 2015 deadline for completing the first certification of compliance requirements would a llow sufficient time for health plans to deploy resources to make both in itiatives successful. Furthermore, the December 31, 2015 date ali gns with the requirement for a CHP to obtain an HPID, as all CHPs must obtain an HPID on or before November 5, 2015. Moreover, by virtue of this alignment of dates, we will have a database of all CHPs that will be required to meet the submission requirements proposed in this rule on or before December 31, 2015, and thus should be able to identify any CHPs that do not meet the submission requirements proposed in this rule. As noted in section I.C of this proposed ru le, our goal with the fi rst certification of compliance is to help move the health care i ndustry incrementally toward consistent testing processes in order to transition as seamlessly as possible to new st andards or operating rules. We believe a certification of compliance process that penalizes more CHPs than it incentivizes to carry out testing would not accomp lish this goal and, for the reasons previously articulated, we believe it would be unreasonable to require CHPs to abide by the statutory date of December 31, 2013. To be clear, however, this does not mean CHPs may delay complia nce with the operating rules beyond their respective co mpliance dates. All covered entities were required to be48 compliant with the operating rules for the eligibility for a health plan and health care claim status transactions on January 1, 2013, 38 and must be compliant with the EFT & ERA Operating Rule Set adopted for health care electronic funds tran sfers (EFT) and remittance advice transactions on January 1, 2014. Those compliance requirements and dates continue to govern HHS's separate HIPAA enforcement processes. (2) Date when CHPs can begin Submitting Information and Documentation We propose that a CHP that obtains an HPID before January 1, 2015 may begin to meet the submission requirements of proposed § 162.926(a) on January 1, 2015; this is the "start date" by when we will be ready to accept the submissi on of documents. This does not mean a CHP must obtain a CORE Phase III Seal or HIPAA Credential during the period of January 1, 2015 through December 31, 2015, as the CHP could be aw arded either one earlier. For example, a CHP that has been awarded a CORE Phase III Se al prior to January 1, 2015, would already have the documentation required under this proposed rule, which it would then submit on or after January 1, 2015, and on or before December 31, 2015. (b) CHPs that obtain an HPID on or afte r January 1, 2015 and on or before December 31, 2016 We propose in § 162.926(b) that a CHP that obt ains an HPID on or after January 1, 2015, and on or before December 31, 2016 would be requi red to meet the submission requirements for the first certification of complian ce within 365 calendar days of obt aining an HPID (see Table 5, Row 2). Under § 162.504, any large or small health plans now extant that meet the definition of a CHP must obtain an HPID on or before November 5, 2015, thus any health plans enumerated as

38 Early in 2013, CMS announced a 90-day enforcement di scretion period for compliance with the Operating Rules IFC stating that it would not initiate enforcement action until March 31, 2013. See http://www.cms.gov/Outreach-and-Edu cation/Outreach/OpenDoorForums/D ownloads/010213Sec1104ofACAAnno uncement.pdf49 CHPs after November 5, 2015 are likely new CHPs. We propose that such CHPs be allowed one year from the time they obtain an HPID to s ubmit the documentation pro posed in § 162.926(b). CHPs that obtain HPIDs on or after January 1, 2015 and on or before December 31, 2016 will have to: coordinate with thei r SHP(s), if applicable; gather the appropriate documentation to complete certification testing, a nd apply for a Phase III CORE Seal or HIPAA Credential; and meet the documentation submission requirements fo r the first certification of compliance. We believe one year from obtaining an HPID will be adequate for a new CHP to complete that process, but solicit comments on this assumption. We propose that a CHP that obtains an HPID after December 31, 2016 would not be required to meet the requirements proposed in this rule for the first cert ification of compliance (see Table 5, Row 3). A CHP that obtains an HPID after December 31, 2016, if given the same time to meet the requirements as CHPs that obtain HPIDs on or before December 31, 2016, would be meeting the requirements into 2018. There are too many unknowns that far into the future for us to establish requirements for this category of CHPs. For instance, we may have adopted new or modified versions of the standards a nd operating rules for th e eligibility for a health plan, health care claim status, and health care electr onic funds transfers (EFT) and remittance advice transactions. We may address requirements for a CHP that obtains an HPID after December 31, 2016 for the first certificat ion of compliance in a later rule. We solicit industry and stakeholder co mments on our proposed certification of compliance dates.50

TABLE 5: COMPARISON OF OPERATIN G RULE SETS COMPLIANCE DATES, THE

STATUTORY DEADLINES FOR COMPLETING THE FIRST CERTIFICATION OF COMPLIANCE REQUIREMENTS, AND THE PROPOSED DEADLINES FOR COMPLETING THE FIRST CERTIFICATIO N OF COMPLIANCE REQUIREMENTS

Col 1 Col 2 Col 3 Operating Rule Sets Compliance date for health plans to comply with the operating rules Deadline for health plans to meet first certification of compliance requirements as mandated by section 1173(h)(1) of the Act Deadlines for health plans * to meet first

certification of compliance requirements

as proposed in this rule Eligibility for a health plan

Health care claim status January 1, 2013

Health care electronic funds transfers (EFT) and remittance advice January 1, 2014 December 31, 2013 December 31, 2015 for CHPs that obtain an HPID before January 1, 2015. Within 365 calendar days of obtaining an HPID for CHPs that obtain their HPID on or after January 1, 2015 and on or before December 31, 2016

* Requirements for CHPs that obtain their HPID after D ecember 31, 2016 are not addressed in this proposed rule. B. Certification of Compliance Penalty Fees 1. Calculating Penalty Fees: Defining Covere d Lives of a CHP and Major Medical Policies Section 1173(j)(1) of the Act sp ecifies that the penalty fee amount assessed when a health plan does not meet the certification of complia nce requirements is based on its number of covered lives. So that we may calculate th e potential penalty fee amount should we find a violation(s) of the firs t certification of compliance, we must know the number of covered lives of
a CHP. Section 1173(j)(1)(F) of the Act requires th e Secretary to determine the number of covered lives under a health plan "based upon the most recent statements and filings that have been submitted by such plan to the Securities and Exchange Commission" (SEC). We have learned, however, that the SEC only collects da ta from publicly traded health plans (that51 represent a mere subset of the total number of health plans), 39 and, even then, health plans submitting filings to the SEC are not required to include in such filings the number of "covered lives" or any comparable measure. Some hea lth plans may volunteer th is information in a descriptive text section of a filing called the 10-K, used to desc ribe the business and its attributes, but this is not a requirement of the 10-K. 40 In fact, according to a 2007 study on enrollment in U.S. health insurance products, "[t]here is no na tional databank containing enrollment figures for all the public and private health insurers in th e United States, nor is there a single database linking all the federal programs." 41 Therefore, we propose to use the number of covered lives the CHP reports in accordance with the proposed submission requirements under § 160.926(a)(1) and (b)(1) as the primary source for the number of covered lives to calcul ate penalty fees. Should a CHP fail to include the number of covered lives as part of its § 162.926 submission, or should we have reason to question the CHP's number of self-reported covered lives, we may undertake an independent investigation through means that may include, bu t would not be limited to: analyzing recent filings, if any, submitted by the CHP to the SEC; a nd researching data bases or publicly available documents such as news articles, reports, a dvertisements, brochures, and web pages where the number of covered lives of a CH P is referenced or estimated. In § 162.103, we propose to define "covered lives of a CHP" as indivi duals covered by or enrolled in major medical policies of a CHP and the SHP(s) of that CHP. Individuals may be

39 For information on the SEC’s role, see http://www.sec.gov/about/whatwedo.shtml 40 10-K filings and other publically available company filings can be viewed through the EDGAR database: http://www.sec.gov/edgar/searchedgar/companysearch.html . For more information on the 10-K see http://www.sec.gov/answers/form10k.htm . For the 10-K form itself: http://www.sec.gov/about/forms/form10-k.pdf 41 “Health Care Delivery Covered Lives – Summary of Findings,” John F. Kennedy School of Government: Harvard University, Mossavar-Rahmani Center for Business & Government (http://www.hks.harvard.edu/m-rcbg/hcdp/numb ers/Covered%20Lives%20Summary.pdf).52 described in such major medical policies by terms, including, but not lim ited to the following:--

● Individuals.

● Spouses.

● Dependents.

● Employees.

● Subscribers.

● Policyholders.

● Medicaid recipients.

● Medicare beneficiaries.

● Tricare beneficiaries.

● Veterans.

● Survivors. In section II.B.1 of this proposed rule, we discuss in more detail how the definition of covered lives of a CHP would be used to calcul ate penalty fees. We include spouses, partners, and dependents in the proposed definition to make clear that covered liv es of a CHP includes more than just the policyholde r, and encompasses all indivi duals covered by major medical policies, and also include in the definition exampl es of terms that government payers may use to describe their covered lives. Within the definition, we clarify that cove red lives includes on ly those individuals enrolled in major medical policies. Section 1173(j)(1)(B) of the Ac t states that penalty fees may only be assessed for persons "covered by the plan for which its data systems for major medical policies are not in compliance." We only include individuals enro lled in major medical policies in the definition since individuals that are not covered by such polic ies will not be included in the53 calculation of the penalty fee. In cases in which an individual is covered by both a major medical policy and another policy/(ies) that does not meet the definition of major medical policy, the definition contemplates that such individual would be consid ered a covered life of a CHP. In § 160.604, we propose that, for purposes of th is proposed rule, "major medical policy" be defined as "an insurance policy that covers accident and sickness and provides outpatient, hospital, medical, and surgical expense coverage ." We developed this definition by surveying how the term major medi cal policy is defined in various contexts. To be clear, we propose in § 162.926 that all CHPs, irrespective of whether they issue major medical policies, must meet the first ce rtification submission requirements. However, only CHPs with major medical policies may be a ssessed penalty fees. Moreover, should a CHP be assessed a penalty fee, the basis for the assessment calculation would be using only those covered lives that are covered or enrolled in a major medical policy. We indicate in the definition th at covered lives of a CHP includes the covered lives of the CHP, and, if it has any, its SHP( s). We include the covered li ves of any SHP(s) of the CHP because, under the provisions discussed in sectio n II.A.1 of this proposed rule, the submission requirements and applicable penalty fees ar e the CHP's, not its SHP's, responsibility. We intend to only include those individuals who are enrolled in or covered by health insurance in the definition of c overed lives of a CHP, as opposed to those individuals who are merely eligible, but not enrolled or covered. We propose to use the phrase "covered by or en rolled in" to indicate a distinction that is sometimes made – but that we are not making he re – between voluntary enrollment or automatic coverage in a health plan. That is, irrespective of the actions of an individual, we would consider an individual who has major medical coverage under a health plan to be a covered life of a CHP.54 For example, we would consider an individual w ho is automatically enrolled in Medicare Part A upon turning 65 years old to be a covered life of Medicare. We solicit comments on the proposed defin ition of covered lives of a CHP and the definition of major medical policy. 2. Basis for the Assessment of a Penalty Fee and the Amount of the Penalty Fee Section 1173(j)(1)(B) of the Act requires the Secretary to assess a penalty fee against a health plan in the amount of $1 per covered life per day until certification is complete. Section 1173(j)(1)(C) of the Act requires the Secretary to double the amount of the penalty fee assessed against a health plan that knowi ngly provided inaccurate or incomp lete information in certifying compliance. Section 1173(j)(1)(E) of the Act caps the penalties th at may be imposed on a health plan, providing that a penalty f ee against a health plan shall no t exceed, on an annual basis, an amount equal to $20 per covered life under such pla n, or an amount equal to $40 per covered life where misrepresentation has occurred unde r section 1173(j)(1)(C) of the Act. In § 160.612, we propose the bases for asse ssing penalty fees and, in § 160.614, we propose the amounts of penalty fees that would be assessed. We think the bases for penalty fees that we propose in § 160.612 and the amount of the penalty fee proposed in § 160.614 are sufficiently intertwined so that it is more effective to describe the proposed provisions together. a. Failure to Submit Required Documentation by the Deadlines In § 160.612(a), we propose that the Secretary would assess a penalty fee against a CHP that fails to comply with the submission requir ements specified in § 162.926(a)(2) or (b)(2). This means the Secretary would assess a pe nalty fee when a CHP fails to provide the documentation that demonstrates the CHP has b een awarded a Phase II I CORE Seal or the HIPAA Credential.55 The basis for the penalty fee proposed in § 160.612(a) would apply when a CHP does not provide the required documenta tion at all, or does so after the deadlines specified in § 162.926(a)(2) or (b)(2). A CHP that does not provide the required documentation by the deadlines would be assessed $1 pe r covered life of the CHP per da y until the requirements of § 162.926 have been met, and as limited by the cap described by proposed § 160.614(a)(1). For example, if a CHP with 100 covered lives enrolle d in major medical policies obtains an HPID before January 1, 2015 and then submits the required documentation in § 162.926 on January 1, 2016 — 1 day past December 31, 2015 (the deadlin e that would be requ ired under § 162.926(a)) — the CHP would be assessed a penalty fee of $1 per covered life of the CHP, for a penalty fee totaling $100. In § 160.614(a), we propose that a CHP that is assessed a penalty fee under § 160.612(a) – failure to provide the require d documentation according to the deadlines in § 162.926(a)(2) or (b)(2) – may not be assessed a penalty fee that exceeds $20 per covered life of the CHP. For example, a CHP that obtains an HPID before January 1, 2015 that fails to make the required submissions on or before December 31, 2015 woul d, starting January 1, 2016, be assessed a $1 per covered life penalty fee th at, per section 1173(j)(1)(E)(i) of the Act as implemented by proposed § 160.614(a)(1), would reach its maximu m, and be capped, on January 21, 2016 at $20 per covered life of the CHP. The same maximu m penalty cap would apply in instances where a CHP fails to ever provid e the required documentation. We will utilize all reasonable means to ensure that CHPs satisfy their obligations under this proposed rule. Because all CHPs are require d to obtain an HPID, we will, for example, once this proposed rule is finalized a nd implemented, compare a roster of the CHPs that have satisfied the requirements of the rule with a roster of CH Ps that have obtained HPIDs. Moreover, we note56 that section 1173(j)(3) of the Act re quires us to report unpaid penalty fees to the Secretary of the Treasury and that unpaid penalty fe es, per section 1173(j)(4 )(D) of the Act, shall be increased by the interest accrued. We solicit comments on our proposal fo r assessing penalty fees for CHPs. b. Knowingly providing inaccurate or incomplete information The penalty fee for knowingly pr oviding inaccurate or incomplete information that we propose in § 160.612(b) implements section 1173(j)( 1)(C) of the Act, which provides that a "health plan that knowingly provides inaccurate or incomplete information in a statement of certification or documentation of compliance . . . sh all be subject to a pe nalty fee that is double the amount that would otherwise be imposed." In § 160.612(b), we propose that a basis for assessment of a penalty fee is providing inaccurate or incomplete information with actual knowledge of th e inaccuracy or the incompleteness of the information, or acting in de liberate ignorance or reckless disregard of the accuracy or completeness of the information. We clarify in § 160.612(b) that information may be in the form of statements, in documents, or ot herwise. Hereinafter, we refer to the basis for assessment of a penalty fee proposed in § 160.612( b) as "knowingly prov iding inaccurate or incomplete information." In § 160.614(a)(2), we propose that a CHP woul d be assessed a penalty fee of $40 per covered life of the CHP when a ssessed a penalty fee on the basi s of § 160.612(b). To be clear, we do not believe a "per day" calculation (as described in section II.b.2.a) would apply to a situation in which a CHP has knowingly provide d inaccurate or incomplete information. Because the first certif ication of compliance is a "snap s hot" of compliance on the date a CHP makes its § 162.926 submission, the CHP either know ingly provided inaccurate or incomplete57 information on that day or it did not. A CHP does not knowingly provide inaccurate or incomplete information on the date submitted, and, on the next, or succeeding, day(s), discontinue the state of "know ingly providing inaccurate or incomplete information or documentation." Hence, we would apply only th e maximum penalty fee in such a situation. We interpret the statutory language as inte nding a cap of $40, thus, in § 160.614(b), we propose that a CHP may not be assessed more than $40 per covered life of the CHP, even where a CHP meets the bases for penalty fees under bot h § 160.614(a)(1) and (2). For instance, a CHP may provide the required documenta tion to the Secretary past the a pplicable deadline, and, later, also be found to have knowingly provided inaccu rate or incomplete information; such a CHP would be assessed a penalty fee of $40 per covered life. Following are two examples (not meant to be inclusive of all possible scenarios) wher e we would determine a CHP to have knowingly provided inaccurate or incomplete info rmation as described in § 160.612(b):

● To obtain a CORE Seal, a CHP would submit documentation to a CORE-authorized testing vendor during certificati on testing, and to CAQH CORE in applying for the Seal. We would have a basis for assessing a penalty fee under § 160.612(b) should a CHP knowingly provide inaccurate information in the documentati on it submits to the testing vendor or to CAQH CORE as part of the certification process, that, in turn, would then be submitted as part of the § 162.926 submission requirements.

● To obtain the HIPAA Credential, a CHP must attest that it has successfully completed testing with at least three of its trading partners . We would have a basi s for assessing a penalty fee under § 160.612(b) should a CHP be found to have knowingly provided inaccurate information with respect to the minimum required nu mber of trading partners that would then be submitted as part of the § 162.926 submission re quirements. We solicit comment on our58 proposed penalty fee policy for a CHP that knowingly provides inaccurate or incomplete documentation or information. 3. Annual Fee Increase Section 1173(j)(1)(D) of the Act provides for an annual increase in penalty fees by the annual percentage increase in to tal national health car e expenditures. We are not proposing an annual increase methodology at this time because the first certification of compliance framework we propose here would assess only a one-time penalty fee, not a penalty fee that would be assessed year after year. We may revi sit this issue in future rulemaking. 4. Notice of Penalty Fee, CHP's Response to Notice of Penalty Fee, and Defenses In § 160.616, we propose that the Secretar y would provide a CHP notice (sent by certified mail with a return receipt requested) th at it meets one or more bases to be assessed a penalty fee under proposed § 160.612. Such a notice would specify:

● The penalty fee amount;

● Reference to the bases, under proposed § 160.612, for the penalty fee;

● A description of the findi ngs of fact regarding the vi olations upon which the penalty fee is based; and

● The reason(s) why the violation(s) subject the CHP to a penalty fee. We believe these notice elements would en able a CHP to understand why it met the criteria to potentially be asse ssed a penalty fee, and the amou nt proposed to be assessed. In § 160.618, we propose that a CHP may submit evidence of any of the defenses described in § 160.620 in response to the notice of penalty fee. Under proposed § 160.618(b), a CHP must assert any such defense( s) in writing, and within 30 da ys of receipt of the notice of59 penalty fee. We propose in § 162.620 that the Secretary will consider only the following defenses:

● The CHP is not subject to the requirem ents of § 162.926. For a number of reasons, the documentation or deadline requirements of the firs t certification of comp liance may not apply to a particular CHP. For instance, a CHP may not offer any major medical policies, and, therefore, may not be assessed a penalty fee.

● The CHP's failure to meet the requir ements of § 162.926 was attributable to a ministerial and non-substantive er ror. We propose to apply th is defense narrowly; such a ministerial and non-substantive er ror might include a typographical mistake made in the process of providing the required doc umentation to the Secretary.

● The failure to meet the requirements of § 162.926 was beyond the control of the CHP. As with the previous defense, we propose to ap ply this defense narrowly. A failure to meet the documentation or deadline requirements of § 162.926 beyond the control of the CHP conceivably might include an "act of god" (and not an act of the CHP or SHP's own making) that made it impossible for the CHP to meet the requ irements. Given the length of time that we propose CHPs would have to meet the submission requirements, however, we believe successful application of this defense would be extrao rdinarily rare, and limite d only to catastrophic situations. By proposing to limit the scope of the defenses the Secretary will consider in § 160.620, we make clear that that Secretar y will not consider any other asse rted defense, including, but not limited to, any defense associated with a CHP's co st considerations in meeting the requirements, or lack of knowledge or confus ion about either the requirements of the first certification of compliance or about the operating ru les and standards themselves.60 We propose to allow a CHP to respond to a not ice of penalty fee as an opportunity to present the circumstances that prevented it from meeting the first certification of compliance requirements prior to a potential appeal to an administrative law judge (A LJ). This opportunity to present defenses is analogous to, but much narrower than, our complaint-driven process when a covered entity may resolve a complaint brought against it before CMPs are imposed in a notice of determination under § 160.420. We solicit comments on the defenses the Secretary may consider. 5. Notice of Determination and a CHP's Hearing Rights In § 160.624, we propose sending a notice of determ ination (by certified mail with return receipt requested) to a CHP indicating whether a penalty fee is, or is no t, being assessed. A notice of determination will be sent irrespective of whether a CHP responds to the proposed § 160.616 notice of penalty fee, and irrespective of whether the Secretary determines to assess, or not to assess, a penalty fee. Should a penalty fee will be assessed, § 160.624 proposes that the notice of determination would specify:

● A description of the statutory basis for the assessment of the penalty fee;

● The amount of the penalty fee;

● The regulatory basis, under § 160.612, fo r the assessment of the penalty fee;

● The findings of fact regarding the viola tions on which the assessment of the penalty fee is based;

● Any defenses described in § 160.620 that we re considered in determining whether to assess the penalty fee and the reason(s ) why the defenses were rejected;

● Instructions for appea ling the penalty fee; and61

● A statement that the failure to reques t a hearing within 90 days results in the imposition of the penalty fee. We believe the proposed contents of the notic e of determination would be sufficient to enable a CHP to understand why it is being assessed a penalty fee, the amount of the penalty fee, and how the CHP could appeal the penalty fee. We solicit comment on the proposed contents of the notice of determination. Should the Secretary determine not to assess a penalty fee, the notice of determination would indicate why any defense( s) raised under § 160.620 was/were successful, and what, if any, actions the CHP must take. Because the firs t certification of compliance process does not otherwise envision the application of a corr ective action process, the only actions we contemplate would be associated with remedying th e situations associated with the exercise of successful defenses asserted unde r proposed § 1620.620(b) or (c). 6. Administrative Appeals Process In § 160.626, we propose that, upon receiving a notice of determination assessing a penalty fee described in § 160.624(a), a CHP may file a request for a hearing before an administrative law judge (ALJ). Should the CHP fail to request a hearing within 90 days of receiving the notice of determination (or otherw ise affirmatively waive its right to a hearing within that 90 days), it would forego its right to a hearing and the Secr etary would notify it that the penalty fee assessed in the not ice of determination is final a nd inform it how the penalty fee must be paid. If a CHP timely requests a hearing with an AL J, the CHP would par ticipate in a process that is already largely codifi ed at § 160.500 through § 160.552. Administrative appeals before ALJs are widely used to adjudicate di sputes between government agencies and62 individuals/entities aggrieved by agency decision s, and such a process is currently used for HIPAA Administrative Simplificati on violations. We believe that using the ALJs that already have jurisdiction over HIPAA Ad ministrative Simplification violations handled under § 160.300, and using the same appeals process, would support consistency in adjudication of HIPAA Administrative Simplif ication appeals. Section 160.500 is the Applicab ility provision for Subpart E— Procedures for Hearings, and provides, "[t]his subpart ap plies to hearings conducted rela ting to the imposition of a civil money penalty by the Secretary under 42 U.S.C. 1320d-5." We propose to revise this provision by adding a reference to 42 U.S.C. 1320d-2(j), to indicate that Subpart E also applies to the assessment of a penalty fee under Subpart F. The term "respondent" is defined in § 160.103 as "a covered entity or business associate upon which the Secretary has imposed, or proposes to impose, a civil money penalty." In order to make clear that the term respondent, when used in Subpart E, includes entities that are assessed a penalty fee pursuant to Subpart F, we propose to revise the de finition to state that respondent "means a covered entity or business as sociate upon which the Secretary has imposed or proposes to impose, a penalty fee under Subpart F or a civil money penalty." Section 160.506 specifies the rights of the part ies. The ALJ authority is delineated in § 160.508. Sections 160.510 through 160.544 describe th e ALJ hearing process. The right to appeal the ALJ decision to the Departmental Appeals Board is addressed in § 160.548. As noted, we propose applying most of § 160.500 th rough § 160.552, as already promulgated, as the procedure for CHPs to use in appealing a notice of determination. Because it is not always clear from those provisions that the process may apply to penalty fee assessments under Subpart F, in the following sections we propose to revise th e regulation text to ex plicitly account for the63 specific health plan certificat ion of compliance penalty fees and notice procedures: § 160.500, § 160.504, § 160.534, § 160.540, § 160.546, § 160.548, and § 160.550. 7. Other Issues: a. Relationship of Certification of Comp liance Process to Complaint-Driven Process In section I.B.3 of this propos ed rule, we describe the cu rrent HIPAA complaint-driven enforcement procedure through which an entity may bring a complaint against any entity it believes is not in compliance with adopted HIPAA transaction standards, ope rating rules, or code sets. Such a complaint would generate a fact-f inding and resolution process, which could result in a corrective action plan, the imposition of CMPs, or a hearing before an ALJ. The complaint-driven and first certificati on of compliance enforcement processes are markedly different, even though both may result in a determination that may be appealed to an ALJ. The complaint-driven enforcement process is initiated as a result of a complaint, uses an informal fact-finding process, employs a correc tive action plan if the complaint is valid, and imposes CMPs if the corrective action plan is no t followed. Conversely, th e first certification of compliance requires certain submissions by speci fic dates, and provides for an enforcement process with respect to a CHP that fails in vari ous ways to abide by these requirements. Notably, the first certification of compliance, as proposed in this rule, does not employ a corrective action plan should a CHP fail to meet the cert ification of complia nce requirements. These two distinct enforcement processes assess CMPs (in the case of the complaint-driven process) or pena lty fees (in the case of the firs t certification of compliance) for different reasons. The complaint-driven pro cess addresses complaints regarding a covered entity's failure to comply with any Administrative Simplification requirement, with the exception of a failure to comply with the first certifi cation requirements proposed in this rule (as we64 describe in this section). The first certifica tion of compliance process assesses penalty fees for CHPs that fail to meet the submission requireme nts or that knowingly provide inaccurate or incomplete documentation associated with su ch submissions, as proposed in this rule. Nothing in this proposed rule prohibits the Secretary from pursuing both processes at the same time against a CHP – through CMPs, in the cas e of the complaint-driven process for failure to comply with Administrative Simplification re quirements, and through penalty fees for failure to meet the first certification of compliance requirements. Furthe r, an investigation through the complaint-driven process could lead to the assessme nt of a penalty fee for a first certification of compliance violation if it revealed through that investigation that the CHP failed to meet the first certification of compliance requirements or kno wingly provided inaccurate or incomplete information required for the first certification of compliance. For instance, if an investigation based on a complaint revealed that a CHP never submitted documentation or knowingly submitted inaccurate or incomplete documentation in order to be awarded a CORE Phase III Seal or HIPAA Credential under § 162.926, it is po ssible both CMPs and penalty fees may be imposed/assessed. Section 160.300 is the Applicability pr ovision under Subpart C—Compliance and Investigations—which is the complaint-driv en enforcement process for Administrative Simplification violations. We propose to amend this section, that now states "[t]his subpart applies to actions by the Secretar y, covered entities, business associ ates, and others with respect to ascertaining the compliance by covered entities and busine ss associates with, and the enforcement of, the applicable provisions of this part 160 and parts 162 and 164 of this subchapter," to clarify that the complaint driven process does not apply to the requirements in65 § 162.926. That is, we propose that a complaint may not be filed against a health plan alleging that it fails to meet the ce rtification of compliance subm ission requirements in § 162.926. III. Collection of Information Requirements Under the Paperwork Reduction Act of 1995 (P RA), we are required to provide 60-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an informati on collection should be approved by OMB, section 3506(c)(2)(a) of the PRA requi res that we solicit co mment on the following issues:

● The need for the information collection and its usefulness in carrying out the proper functions of our agency.

● The accuracy of our estimate of the information collection burden.

● The quality, utility, and clarity of the information to be collected.

● Recommendations to minimize the inform ation collection burden on the affected public, including automate d collection techniques. We are soliciting public comment on the information collection requirements (ICRs) regarding the first certifica tion of compliance documentation requirements. Among other requirements, the Affordable Care Act requires hea lth plans to file statem ents with the Secretary certifying that they are compliant with standards and operating ru les for specific transactions. The Affordable Care Act also mandates that the Secretary assess a penalty fee against a health plan that fails to file a statement with the Secret ary certifying that it is compliant and/or fails to submit adequate documentation of compliance.66 In section II. of this proposed rule, we discuss the proposed requirements for the first certification of compliance. In se ction II.A.7 of this proposed rule , we discuss our proposal that a CHP must comply with the first certification of complian ce requirements based on when it obtains its HPID. Submission requirements ar e explained in section II.A.2 and .3 of this proposed rule. We discuss the pe nalty fees that may be assessed on a CHP that does not meet the submission requirements or knowingl y provides inaccurate or incomplete information in section II.B. of this proposed rule. The provisions in this proposed rule ali gn with existing statutory and regulatory mandates. In previous regulations , specified in section I.B.1 and 2 of this proposed rule, we have mandated compliance with the adopted standards and operating rules for the HIPAA transactions for which documentation of compliance is proposed in this rule. Other existing regulations that are complimented through this proposed rule include § 160.310 wh ich requires covered entities to maintain records and compliance reports and pr ovide these to the Secr etary if requested, and § 162.923, that requires covered enti ties to require their BAs to co mply with applicable HIPAA standards and operating rules. In this proposed rule and in this ICR, we are focused on the one-time requirement that CHPs, as defined by § 162.103, must provide th e Secretary the following information and documentation for the first certification of complia nce: (1) the number of covered lives of a CHP; and (2) documentation that demonstrates th at the CHP has obtained a Phase III CORE Seal or the HIPAA Credential. We do not know at this time how many health plans would meet the definition of a CHP as defined in § 162.103. In the HPID final rule (77 FR 54696), we identified 12,000 self-insured group health plans, 1,827 health insurance issuers, and 60 government health plans that might67 meet the definition of health plan. We belie ve there will be considerably less than the approximately 15,000 health plans that would meet the definition of a CHP, but we will not know the actual number of CHPs until after the dead line for CHPs to obtain an HPID has passed; that is, November 5, 2015. While we do not have objective data that identifies which or how many health plans would be CHPs, for the purpo se of the ICRs, we assume that 3,000 to 5,000 health plans may meet the definition of a CH P. Health plans have been increasingly consolidating into larger organizations whereby a single CHP exercises sufficient control over an increasing number of SHPs to direct their busine ss activities, actions, or policies. Thus, we do not believe that more than one-third (5,000) of health plans meet the definition of a CHP and, in fact, believe the number may be significantly le ss. We solicit comments on our assumption of the number of CHPs. A. ICRs Regarding Submission of the Number of Covered Lives (§ 162.926(a)(1) and (b)(1)) Proposed § 162.926(a)(2) would require that a CHP that obtains an HPID before January 1, 2015 must provide to the Secret ary documents demonstrating compliance as explained in section II.A.3. of this proposed ru le. Proposed § 162.926(b)(2) would require that a CHP that obtains an HPID on or after Ja nuary 1, 2015 and on or before December 31, 2016, must, within 365 days of obtaining an HPID, provi de to the Secretary documents demonstrating compliance as explained in section II.A.7. of this proposed rule. Proposed § 162.926(a)(1) and (b)(1) require a CHP to submit the number of covered lives of a CHP (as defined in § 162.103) on the date that the documentation required in § 162.926(a)(2) and (b)(2) is submitted. In section II.A.1. of this proposed rule, we indicate that the number of covered lives must include the number of covered lives of a CH P's SHPs, if it has any. We e xplain the submission requirements68

of covered lives in section II.A .2. of this proposed rule, includ ing the reason for including the number of covered lives of the SHPs of the CHP. The one-time burden associated with this requi rement is the time and effort associated with the CHP to: (1) obtain the number of c overed lives of the CHP (including those of its SHPs); (2) calculate the total number of covered lives of the CHP and its SHPs that would meet the definition of major medical policy as define d in proposed § 160.604; (3) have the information reviewed by a CHP executive; and (4) submit the number of covere d lives to the Secretary. We believe that a CHP would have accurate records of the number of covered lives of the CHP and each of its SHPs and would be able to access this easily. Therefore, we assume that the CHPs would not need to contact each SHP to obtain the required information. We also believe that CHPs would have easily accessible data on the tota l number of covered lives of the CHP and its SHPs that have major medical policies. We ma ke these assumptions on the basis that a CHP's data on the number of covered live s and policies – used to determin e, for example, risk, costs of care, human resource needs, and other factors– is essential information to have in order to for a CHP to conduct business. We estimate this burden for proposed § 162.926(a)(1) and (b)(1) would be 2 hours for each CHP to obtain the number of covered lives for the CHP and each of its SHPs, 2 hours to calculate the total number of c overed lives that have major me dical policies, one hour for an executive to review the number of covered lives with major medical policies, and, 30 minutes to submit the number of covered lives of the CHP and its SHPs to HHS. We used the median hourly labor rate of $38.31 for a computer information system analyst; $58.15 for a computer and informati on system manager; and $80.84 for a chief executive as reported by the Department of La bor, Bureau of Labor Statistics, May 2012, found69

at: http://www.bls.gov/oes/cu rrent/oes_nat.htm#13-0000

. We believe that a computer analyst would be an appropriate position to obtain the number of covered lives and submit the number to the Secretary, a computer and systems manager to do the calculation, and a chief executive would verify the accuracy of the information to be submitted. All CHPs must comply with these requirements. We estimate that proposed § 162.926(a)(1) and (b)(1) would impose a one-time, 5.5 hour burden on each CHP. The total burden associated with this task for each of the estimated 3,000 to 5,000 CHPs would be: (1) $76.62 ($38.31 x 2 hours) to obtain the number of covered lives; (2) $116.30 ($58.15 x 2 hours) to calculate the number of covered lives in major medical plans; (3) $80.84 ($80.84 x 1 hour) for an executive to review the number of covered lives; and (4) $19.16 ($38.31 x 0.5 hours) to submit the number of cove red lives to the secretary. We estimate that the total cost for each CHP would be $292.92. The estimated annual burden for this requirement would be 16,500 (3,000 CHPs x 5.5 hours) to 27,500 hours (5000 CHPs x 5.5 hours). The total estimated one-time cost associated with all of the requirements in proposed § 162.926(a)(1) and (b)(1) would be approximately $878,760 ($292.92 x 3000 CHPs) to $1,464,600 ($292.92 x 5000 CHPs). B. ICRs Regarding Submission of a Phase III CORE Seal (§ 162.926(a)(2)(i) and (b)(2)) Section 162.926(a)(2)(i) and (b)(2) would require that a CHP provide documentation demonstrating it obtained a Phase III CORE S eal or the HIPAA Credential. Should a CHP choose to obtain a Phase III CORE Seal, propos ed § 162.926(a)(2)(i) and (b)(2) would require that it provide documentation demo nstrating it had obtained a Phase III CORE Seal. We explain in section II.A.3.(b). of this proposed rule that a CHP electing to obtain a Phase III CORE Seal must obtain the seal for each of the three C AQH CORE operating rules phases, or, in other70
words, a CHP must obtain a CORE Seal for Phases I and II to obtain a Phase III CORE Seal. However, as proposed in § 162.926(a)(2), we requ ire only the submission of a Phase III CORE Seal to comply with the certification complia nce documentation requirements. Consequently, for the ICR in this proposed rule, we considered the time and effort for submitting documentation that the CHP has obtained the Phas e III CORE Seal and not the time and effort for a CHP to obtain the CORE Phase I and II Seals. In sections II.A.3.(b). and II.A .3.(d). of this proposed rule, we discuss CORE certification testing, CORE-authorized Testing Vendors, and th e CORE certification proc ess. We describe the four-step process required to be awarded any of the CORE Seals: (1) conduct a gap analysis by evaluating, planning, and completing necessary upgrades; (2) sign the CAQH CORE Pledge committing to become CORE certified; (3) condu ct testing through a CORE-authorized Testing Vendor (certification testing); and (4) apply for a Phase III CORE S eal. In section II.A.3. of this proposed rule, we explain that the documentation that demonstrates that the CHP has obtained a Phase III CORE Seal is considered adequate documentation of compliance by the CHP and its SHPs with the operating rules for the eligibility for a health plan, health care claim status, and health care electronic funds transfers (EFT ) and remittance advice transactions. For the purposes of the ICR, we do not include the time and effort for a CHP to obtain a CORE Phase III Seal because we believe that the process of obtaining a Phase III CORE Seal is inherent in the cost of doing business and we account ed for the time and effort as well as the cost for complying with the operating rules in previo us rule making. As we indicated, we have mandated compliance with the adopted standards and operating rules for HIPAA transactions in previous regulations. The cost s associated with compliance includes for example, analyzing existing data capability and infrastructure, development or enhancement of existing71 infrastructure, and testing of the CHPs systems bot h internally and externally. We believe that, because CHPs are expected to be compliant with the operating rules, they have undertaken the steps necessary to ensure that they are compliant and are able to perform transactions with their trading partners according to th e adopted standards and operating ru les. In this rule, we are proposing submission documentation requirements; therefore, in this analysis, we are only analyzing the cost of submitting this documentation. We have proposed two options for documentation that demonstrates compliance with the operating rules and standards. We expect that the decision to obtain the CORE Phase I and II Seals and provide documentation of the CORE Phas e III Seal would be a business decision based on a health plan's strategy for implementing ne w standards or operating rules. Therefore, because the time and effort for compliance w ith standards and operating rules have been addressed in previous rule making and, because a CHP determines if it wishes to obtain the CORE Phase I and II Seal and submit the Ph ase III CORE Seal to comply with the documentation requirements, we do not include any costs for the time and effort associated with infrastructure development or enhancement or tes ting of systems to ensure compliance. We also do not include the time and effort costs in the ICR to comply with any of CORE's specific requirements to obtain the CORE Seals. Finally , we do not account for the variability in time, readiness and success that may or may exist fo r a CHP to meet CORE's requirements for the CORE Seals. There may be CHPs that have undergone extensive testi ng and will be able to undergo the CORE process efficiently and in a re latively short time. Other CHPs may require assistance and guidance and a more extensive tim e period to meet CORE's requirements. Included in the CORE fee paid by each CHP is assistance and guidance for CHPs. We account for the fee to CORE in the regulatory Im pact Statement in this proposed rule. For the72 purposes of the ICR in this proposed rule, we co nsidered the time and effort for a CHP to obtain documentation of the Phase III CORE Seal awar ded by CORE, and the time and effort for the CHP to submit the documentation of that Seal to the Secretary. As we discussed previously, in this proposed rule, we only consider the time an d effort to comply with the certification of compliance requirements described in this proposed rule. At the current time, we do not know how ma ny CHPs will elect to obtain a Phase III CORE Seal. According to CAQH CORE's website at http://www.caqh.org/CORE_organizations.php , 30 health plans have voluntarily obtained CORE Seals for Phases I and II, and it reports at http://www.caqh.org/ben_participating.php that 25 health plans and 16 government agencies are CO RE participating orga nizations. Ten CORE participating health plans have obtained Phase I and Phase II CORE Seals. We assume that any health plan that has obtained the CORE Seal for Phases I and II will obtain a Phase III CORE Seal and therefore meet the requirements of § 162.926( a)(2)(i) or (b)(2). We also assume that there may be CORE participating health plans that will obtain a Phase III CORE Seal. Because we are unable to quantify the number of CHPs that will obtain a Phase III CORE Seal, we are unable to estimate the total cost with any certainty. Therefor e, for the purposes of the ICR, we estimate that 40 percent of health plans that would meet the definition of a CHP (that is, 1,200 to 2,000 CHPS) will obtain a Phase III CORE Seal and submit documentation of a Phase III CORE Seal to comply with § 162.926(a )(2) and (b)(2)(i). We solicit comment on our assumption of the number of CHPs that would obtain a Phase III CORE Seal. The one-time burden associated with § 162.926(a)(2)( i) or (b)(2) is the time and effort for the estimated 1,200 to 2,000 CHPs to (1) obtain a Phase III CORE Seal from CAQH CORE; and (2) submit the documentation of a Phase III CORE Seal to the Secretary. We estimate this73

burden to be 1 hour to obtain the Phase III CO RE Seal from CAQH CORE and 30 minutes to submit documentation of the CORE Seal to the Secr etary. We used the median hourly labor rate of $38.31 for a computer information system anal yst as reported by the Department of Labor, Bureau of Labor Statis tics, May 2012, found at: http://www.bls.gov/oes/current/oes_nat.htm#13-0000 because we believe that a computer analyst would be required to obtain the Phase III CORE S eal and submit documentation to the Secretary. We estimate that proposed § 162.926(a)(2)(i) and (b)(2) would impose an estimated one-time, one and one half hour burden on each CH P. The total estimated burden associated with this task for each CHP would be: (1) $38.3 1 ($38.31 x 1 hour) to obtain the Phase III CORE Seal from CAQH CORE; and (2) $19.16 ($38.31 x 0.50 hours) to submit documentation of the CORE Seal to the Secretary. The estimated one-time burden in proposed § 162.926(a)(2)(i) and (b)(2) would be 1,800 (1,200 CHPs x 1.5 hours) to 3,000 hours (2,000 CHPs x 1.5 hours). The total estimated one-time cost a ssociated with the requirement § 162.926(a)(2)(i) and (b)(2) would be approximately $68,958 ($38.31 x 1,800 hours) to $114,930 ($38.31 x 3,000 hours). C. ICRs Regarding Submission of the HI PAA Credential (§ 162.926(a)(2)(ii) and (b)(2)) In section II.A.3(a) of this proposed rule, we explain that the HIPAA Credential indicates that the CHP has confirmed that it has successfully tested the ope rating rules for the eligibility for a health plan, health care cl aim status, and health care elec tronic funds transfers (EFT) and remittance advice transactions with trading partners. For each of the three transactions, the CHP must confirm that the number of transactions conducted with those tradi ng partners collectively accounts for at least 30 percent of the total number of transactions conducted with providers. For each of the three transactions, th e CHP must confirm that it has su ccessfully tested with at least three trading partners, bu t if the number of transactions condu cted with three trading partners74 does not account for at least 30 percent of th e total number of transa ctions conducted with providers, the CHP could confirm that it has succe ssfully tested with up to 25 trading partners. The CHP would be required to provide a list of the names of the trading partners and their contact information to CORE. A CHP would be re presenting itself as well as all of its SHPs with the attestation. Should a CHP choose to obtain the HIPAA Cr edential, proposed § 162.926(a)(2)(ii) and (b)(2) would require the CHP to provide documen tation that it has obtained the CORE HIPAA Credential. In section II.A.3 of this proposed rule, we explain that the documentation that demonstrates that the CHP has obtained the HIPAA Credential is considered adequate documentation of compliance by the CHP and its SHPs with the operating rules for the applicable transactions. For the purpose of the ICR, we are not c onsidering the time and effort for a CHP to perform testing with its trading partners because, as we have discussed previously, we addressed the time and effort to comply with the operating rules in prev ious rule making, which includes testing with the CHPs trading partners. The CORE HIPAA Credential will require testing before being obtained, and we assume that every health plan's implementation preparation plan requires internal and external testing prior to imple menting new standards or operating rules. However, in previous rule making, we did not account for the time and effort for a CHP to identify at least three trading partners with which it or its SHPs have successfully tested the operating rules for each of the three transactions (e ligibility for a health pl an, health care claim status, and electronic funds transfers (EFT) a nd remittance advice transactions). The estimated one-time burden associated with § 162.926(a)(2)(ii) and (b)(2) for the HIPAA Credential is the time and ef fort to: (1) confir m that testing has been conducted for each75

of the three transactions with trading partners that collectively conduct no le ss than 30 percent of the total number of transactions conducted with providers; (2) list the names of the trading partners and their contact information; (3) veri fy the accuracy of the trading partner list; (4) obtain the HIPAA Credential from CORE; a nd (5) submit documentation of the HIPAA Credential to the Secretary. The tasks associated with the application fo r and submission of the HIPAA Credential – and, therefore, the estimated burden to a CHP – may change if warranted by any changes in the draft requirements for the HIPAA Credential. As mentioned, we are unable to determin e how many CHPs will choose to obtain the HIPAA Credential to fulfill the re quirements of § 162.926(a)(2)(ii) a nd (b)(2)(ii), but we believe that most CHPs will choose the least costly ce rtification option. Because we are unable to quantify the number of health plans that will obtain the HIP AA Credential, we cannot estimate the total cost with any certai nty. We estimate that 60 percen t of CHPs (that is 1,800 to 3,000 CHPS) will obtain the HIPAA Credential and submit documentation of such the HIPAA Credential to comply with § 162.926(a)(2)(ii) an d (b)(2). We solicit comment on our assumption of the number of CHPs likely to obtain the HIPAA Credential. As mentioned, CAQH CORE is currently developing the HIPAA Credential – which we expect to be finalized prior to the time we fi nalize this proposed rule – and we described in section II.3.(a) the expected pr ocess and requirements for obtaini ng it. Should the requirements for the final HIPAA Credential differ in any way fr om the way we described it in section II.3.(a), we would reopen the comment period to perm it additional comment on the HIPAA Credential, including on the topic of the estimated number of health plans that would obtain the HIPAA Credential. We estimate that the burden associated w ith proposed § 162.926(a)(2 )(ii) and (b)(2) for76
each of the estimated 1,800 to 3,000 CHPs would be 2 hours to obtain documentation of the three testing partners; one hour to prepare the trading pa rtner list; one hour to verify accuracy of the list; one hour to obtain the HIPAA credenti al form CORE; and 30 minutes to submit the CORE HIPAA Credential to the secretary. We used the median salaries as reported by the Department of Labor, Bureau of Labor Statistics, May 2012, found at: http://www.bls.gov/oes/current/oes_nat.htm#13-0000. We used the median hourly labor rate of $38.31 for a computer information system analyst to prepare the trading partner list, obtain the HIPAA credential from CORE and submit th e documentation; $58.15 for a computer and information system manager to confirm that testi ng has been conducted with trading partners that collectively conduct no less than 30 pe rcent of the total transactions conducted with providers for each of the three transactions (e ligibility of a health plan, health care claim status, and the electronic funds transfers (EFT) and remittance advice transactions); and $80.84 for an executive to verify the trading partner list. We estimate that proposed § 162.926(a)(2)(ii ) and (b)(2) will impose a one-time, 5.5 hours burden on each CHP. The total time and effo rt burden associated with this task for each CHP would be: (1) $116.30 ($58.15 x 2) to obtai n the trading partner documentation; (2) $38.31 ($38.31 x 1) to compile the trading partner li st; (3) $80.84 ($80.84 x 1) to verify the trading partner list; (4) $38.31 ($38.31 x 1) to obtain th e HIPAA Credential from CORE; and (5) $19.16 ($38.31 x 0.5) to submit documentation of the HIPAA Credential to the Secretary. We estimate the total burden for each CHP would be $292.92. The total estimated one-time burden associated with all of the requirements in proposed § 162.926(a)(2)(ii) and (b)(2) would be 9,900 (1,800 CHPs x 5.5 hours) to 16,500 hours (3,000 CHPs x 5.5 hours) and approximately $527,256 ($292.92 x 1,800 CHPs) to $878,760 ($292.92 x77 x 3,000 CHPs). Calculations are illustrated in Table 6. For simplicity, Tabl e 6 demonstrates burdens and costs based on the high estimate of CHPs (5,000) that are expected to certify compliance.

TABLE 6: ESTIMATED ANNUAL BURDEN FOR REPORTING, RECORDKEEPING AND THIRD-PARTY DISCLO SURE REQUIREMENTS

Regulation Section OMB Control

No. Respondents Responses Burden Per Response

(hours) Annual Burden (hours) Hourly Labor Cost of Reporting ($) Total Labor Cost of Reporting ($) Total Costs ($) 162.926(a)(1) and (b)(1) 0938-New 5, 000 15,000 2.5 12,500* 38.31 478,875 478,875 162.926(a)(1) and (b)(1) 0938-New 5,000 5,000 1 5,000 80.84 404,200 404,200 162.926(a)(1) and (b)(1) 0938-New 5,000 5,000 2 10,000 58.15 581,500 581,500 162.926(a)(2)(i)and (b)(2) 0938-New 2,000 5,000 1.5 3,000** 38.31 114,930 114,930 162.926(a)(2)(ii) and (b)(2) 0938-Ne w 3,000 7500 2.5 7,500** 38.31 287,325 287,325 162.926(a)(2)(ii) and (b)(2) 0938-Ne w 3,000 3,000 1 3,000 80.84 242,520 242,520 162.926(a)(2)(ii) and (b)(2) 0938-Ne w 3,000 3,000 2 6,000 58.15 348,900 348,900 Total 10,000 27,000 37,500** 2,458,250 * There are no capital or maintenance costs associat ed with the information collection requirements contained in this notice of proposed rulemaking. Ther efore, we have removed the designated column from Table 6. ** Even though the information collection requireme nts are comprised of one-time burdens, all burden estimates have been annualized over the standard 3-year OMB approval period.

IV. Regulatory Impact Statement We have examined the impact of this pr oposed rule as required by Executive Order 12866 on Regulatory Planning and Review (Sep tember 30, 1993), Executive Order 13563 on Improving Regulation and Regulator y Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Social S ecurity Act, section 202 of the Unfunded Mandates Reform Act of 19 95 (March 22, 1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999) and th e Congressional Review Act (5 U.S.C. 804(2)). Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and78 safety effects, distributives, and equity). A regul atory analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). We believe this proposed rule does not reach the economic th reshold for being cons idered economically significant, and thus, is not considered a major rule. We solicit comment on, and data regarding, the assumptions and findings presented in this initial regulatory analysis. The proposed rule would require a CHP to submit documentation to the Secretary that demonstrates compliance with the standards a nd operating rules adopte d by the Secretary under HIPAA, establish the first certification of compliance process, and establish penalty fees for CHPs that fail to comply with the first certifi cation of compliance requirements. This proposed rule would implement elements of the certification of compliance mandate in the Affordable Care Act. We expect that the fi rst certification of comp liance provision is an initial step toward a consistent, industry-wide testing framework. As discussed in more detail earlier in this proposed rule, many of the requirements of this proposed rule build on already existing statutor y and regulatory mandates. In the ICRs, we estimate a total one-time burden of approximately $1,475,000 to $2,458,000 for 3,000 to 5,000 CHPs to comply with the submission requirements of proposed § 162.926. In sections II.A.3.(a) and A.3.(b). of this proposed rule, we discuss the two options for meeting the submission requirements: a Phase III CORE Seal and the HIPAA Credential, respectively. A CHP may choose either option. In section II.A.3.(a) and (b) of this proposed rule, we describe the process for obtaining e ither a Phase III CORE Seal or the HIPAA Credential. We expect that certification testing, such as that required for CHPs obtaining the CORE Phase III Seal, would become more widespread as a result of this proposed rule, and thus the rule79 would generate costs associated with creden tialing activities and greater compliance with operating rules (which requires upd ating infrastructure). We ar e unable to quantify either the current rate of non-compliance with HIPAA requirements, the number of CHPs that would become newly compliant as a result of this pr oposed rule, or the cost, per CHP becoming newly compliant, of infrastructure upda tes and requisite testing. A category of impacts for which we have b een able to make estimates is the CAQH CORE fees. 42 In section II.A.6.(a) of this proposed rule, we discuss the cost of a Phase III CORE Seal and HIPAA Credential based on current fees that CAQH CORE charges for a Phase III CORE Seal and the fees that CAQH CORE believes that it will charge for the HIPAA Credential. Federal and state government entities are currently not charged for a Phase III CORE Seal, nor are CAQH member plans. However, CAQH CORE will charge government entities a $100 fee for obtaining the HIPAA Credential. We assumed the same number of CHPs that we use in the ICRs (that is 1,200 to 2,000 CHPs would obtain a Phase III CORE Seal and 1,800 to 3,000 CHPs would obtain the HIPAA Credential). For the purpose of th is analysis, we considered the cost to obtain either the CORE Seals (Phase I, II, and III) or the HIPAA Cr edential for all of the estimated 3,000 to 5,000 CHPs and did not account for the CHPs that currently ha ve obtained the CORE Seal for Phase I and II or CAQH member plans. That means we did not deduct the number of health plans with current Phase I and Phase II CORE Seals or CAQH member plans that ar e not assessed a fee by CAQH CORE to obtain a Phase III CORE Seal. For the purpose of the impact analysis, we di d not account for any penalty fees that could be assessed for CHPs that fail to comply with the certification of compliance submission

42 We believe that, in general, these fees represent real cost s to society, in the form of labor and other resources used by CAQH CORE for conducting certification.80 requirements. We believe that we have structured the provisions of this proposed rule such that most CHPs will be able to meet the submission requirements. They will have had significant time to implement the applicable standards and operating rules, conduct the transactions in a compliant manner, and conduct certification testi ng or testing with their trading partners. Further, because the penalty fees are substantial, we believe they serve as a strong disincentive for noncompliance. We therefore believe few CHPs will fail to certify compliance, and the total amount of assessed penalty fees will be insignificant. For the 1,200 to 3,000 CHPs we estimate w ould obtain a Phase III CORE Seal, we assumed that 50 percent would have net annua l revenues less than $75 million with a CAQH CORE fee of $12,000 each ($4,000 for each of the three CAQH CORE Operating Rule Phases). We assumed that 50 percent of the CHPs would ha ve net annual revenues equal or greater than $75 million with a CAQH CORE fee of $18,000 each ($6,000 for each of the three CAQH CORE Operating Rule Phases). We estimate that the total cost for all CHPs that would obtain a CORE Seal would be approximately $18 million [($12,000 x 600 CHPs) + ($18,000 x 600 CHPs)] to $30 million [($12,000 x 1000 CHPs) + ($18,000 x 1000 CHPs)]. For the 1,800 to 2,000 CHPs that we estimat e would obtain a HIPAA Credential, we assumed that 5 percent would have net annual revenues less than $5 million with a CAQH CORE fee of $100 each; 20 percent would have net annual revenues of $5 million to below $25 million with a fee of $1000 each; 20 percent would have net annual revenues $25 million to less than $50 million with a fee of $2,000 each; and 55 percent would have net annual revenues of greater than $50 million with a f ee of $4,000 each. The estimated total cost for all CHPs that would obtain the HIPAA Credential is approximately $5,049,000 [($100 x 90 CHPs) + ($1,000 x 360 CHPs) + ($2,000 x 360 CHPs) + ($4,000 x 990 CHPs)] to $8,415,000 [($100 x 150 CHPs) +81 ($1,000 x 600 CHPs) + ($2,000 x 600 CHPs) + ($4,000 x 1,650 CHPs)]. We note, because government entities do not generate net annual revenues, they have been included in the 5 percent computation of CHPs with net annual revenues less than $5 million. Consequently, we estimate the total cost to comply with § 162.926 (that is, for the estimated 3,000 to 5,000 CHPs to provide the docume ntation of obtaining the CORE Seal or the HIPAA Credential) would be approximately $25 m illion to $41 million. This total cost includes the time and effort discussed in the ICR. The calculation is as follows: [Time and effort in ICR: $1,475,000 to $2,458,000] + [total fee for CORE Seals: $18,000,000 to $30,000,000] + [total fee for the HIPAA cr edential: $5,049,000 t o$8,415,000] = $24,524,000 to $40,873,000. We are proposing in § 162.926 that a CHP th at obtains an HPID before January 1, 2015 must meet the submission require ments proposed in this rule on or before December 31, 2015. We explained in section II.A.7.(a)(1) of this proposed rule that this date is different than that in section 1173(h)(1) of the Act: D ecember 13, 2013. We describe here the impact in benefits and penalty fees of the 2 year difference between th e date in section 1173(h )(1) of the Act and the date proposed in this rule. In the Modifications final rule, Operating Rules IFC, Health Care EFT Standards IFC, and the EFT & ERA Operating Rule Set IFC, descri bed in the background of this proposed rule, we described the financial and qualitative benefi ts to implementing the standards and operating rules for the eligibility for a health plan, health claim stat us, and health care electronic funds transfers (EFT) and remittance advi ce transactions. Those rules measured the financial benefits of the standards and operating rules from the comp liance dates of those pa rticular standards and operating rules: January 1, 2012 is the compliance date for Version 5010 st andards for the three transactions; January 1, 2013 is the compliance date for operating rules for the eligibility for a82 health plan and claim status transactions; and January 1, 2014 is the compliance date for the standards and operating rules for the health care electronic funds transfers (EFT) and remittance advice transaction. The cost and savings of implementing thos e standards and oper ating rules on their compliance dates are not addressed in this propo sed rule as they are accounted for in the previously mentioned rules, and the first certification of complia nce requirements, as proposed in this rule, do not affect the co sts and benefits of implementi ng these standards and operating rules. It is possible that some CHPs may view th e first certification of compliance deadline, December 31, 2015, as proposed in this rule, as an opportunity to implement the required standards and operating rules later than the co mpliance dates of those standards and operating rules as required in the appli cable regulations. However, we assume that the number of CHPs that would slow or delay implementation based on the first certification of compliance deadline is quite small. As we noted before, thirty h ealth plans have already obtained a Phase I CORE Seal, and many of those have obtained or are pursuing a Phase II CORE Seal. This growing group of CORE Certified entities represents many major health plans with extensive reach in terms of commercially covered lives. 43 Further, the complaint-driven process for enforcing compliance with these standards and operating ru les applies as of their respective compliance dates. We assume that the CORE-certified health plans include the process of obtaining CORE Seals for each phase of operating rules as part of their process to successfully implement new standards or operating rules. We assume th ese CORE-certified health plans make CORE

43 See map with data on commercially insured lives that ha ve policies with a CORE Cer tified health plan on CAQH CORE website: http://www.caqh.org/pdf/COREPIwebmap.pdf83 Certification part of their implementation strategy regardless of the first certification of compliance submission requirements as proposed in this rule. As discussed in section II.A.7(a)(1) of this proposed ru le, the December 31, 2015 deadline for submission of information and documentation, proposed in this rule, gives th ese CORE Certified entiti es time to obtain the Phase III CORE Seal. It also gives CHPs that would not otherwise use the CORE Certification process time to obtain either the CORE Phase I, II, and III Seals or the HIPAA Credential. Because we believe that a negligible nu mber of CHPs will use the December 31, 2015 deadline proposed in this rule as a reason to slow implementati on of the standards or operating rules required by previous rules, and because the financial bene fits for those standards and operating rules were calculated over 10-year peri ods, we believe the impact of the December 31, 2015 deadline on the overall financial and qualita tive benefits to using these standards and operating rules to be negligible. The amount in penalty fees that would have been assessed with a December 31, 2013 deadline cannot be determined under the proposed certification of compliance requirements because the December 31, 2015 date and other requirements proposed in this rule were developed to align chronologically with other regulatory and comme rcial sector initiatives. For instance, CAQH CORE began offering a Phase III CORE Seal in 2013; 44 the first entity to receive a Phase III CORE Seal did so in August 2013. 45 Given this timeframe, it is unlikely that many CHPs could have obtained a Phase II I CORE Seal earlier than December 31, 2015. Likewise, CHPs have until November 2015 to obta in an HPID, and the first certification of compliance requirements apply only to CHPs. Therefore, due to the vast difference in re quirements associated with the December 31,

44 CORE Webpage: http://www.c aqh.org/ORMandate_EFT.php 45 http://www.instamed.com/news-and-events/industry-first -instamed-achieves-phase-iii-caqh-core-certification/84 2013 and the December 31, 2015 deadlines, we are unable to perform an analysis of the amount of penalty fees that would have been assesse d with the December 31, 2013 deadline as it would entail assuming a completely different set of requirements. The Regulatory Flexibility Analysis ( RFA), as amended, requires agencies to analyze options for regulatory relief of small businesses, if a rule has a significant impact on a substantial number of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions The health insurance industry was examin ed in depth in the RIA prepared for the proposed rule on establishmen t of the Medicare Advantage program (69 FR 46866, August 3, 2004). It was determined, in that analysis, that there were few, if any, "insurance firms,'' including HMOs that fell below the size threshol ds for "small'' business established by the SBA Health. We assume that the "insurance firms' ' are synonymous, for the most part, with health plans that conduct standard tran sactions with other covered entit ies and are, therefore, the entities that will have costs a ssociated with meeting the first certification of compliance requirements. In fact, at the time the analys is for the Medicare Advantage program was done, and even more so now, the market for health in surance is dominated by a relative handful of firms with substantial market shares. However, there are a number of health maintenance organizations (HMOs) that are small entities by virtue of their nonprofit status even though few if any of them are small by SBA size standards. There are approximately 100 such HMOs which may meet the definition of, and therefore define themselves, as CHPs. These HM Os and the Blue Cross and Blue Shield plans that are non-profit organizations, like the other CH Ps affected by this proposed rule, will be required to meet the first certification of compliance requirements.85 Accordingly, this proposed rule may affect a number of small entities. We estimate, however, that the costs of this proposed rule on "small" health plans do not remotely approach the amounts necessary to be a "significant economic impact'' on firms with revenues of tens of millions of dollars. Therefore, th e Secretary proposes to certify th at this proposed rule would not have a significant economic imp act on a substantial number of small entities. We welcome industry and stakeholder input on our assumption in this regard. In addition, section 1102(b) of the Act requires us to prep are a regulatory analysis for "any rule or regulation proposed under title XVIII, title XIX, or part B of [the Act] that may have significant impact on the operations of a substantial number of sm all rural hospitals." This proposed rule, however, is being proposed under title XI, part C, "Administration Simplification," of the Act, and, therefore, does not apply. Regardless, this requirement of this proposed rule is only applicable to CHPs and will not have a significant impact on the operations of small rural hospitals. Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benef its before issuing any rule w hose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2013, that threshold is approximately $141 million. This pr oposed rule would impose a minimal effect on state, local, or tribal governmen ts or on the private sector becaus e the requirements for all CHPs regardless of ownership, to comply with th e certification of compliance documentation requirements. The related costs for all 5,000 estimated CHPs is approximately $40 million, which is less than $141 million. Executive Order 13132 establishes certain requirem ents that an agency must meet when it promulgates a proposed rule (and subsequent fi nal rule) that imposes substantial direct86 requirement costs on state and local governme nts, preempts state law, or otherwise has federalism implications. Since this regulation do es not impose any substantial costs on state or local governments, the requirements of Executive Order 13132 ar e not applicable. In accordance with the provisions of Executiv e Order 12866, this rule was reviewed by the Office of Management and Budget.87
List of Subjects
45 CFR Part 160 Administrative practice and pr ocedure, Computer technology, Electronic information system, Electronic transactions, Employer benefit plan, Health, Health car e, Health facilities, Health insurance, Health records, Hospitals, Investig ations, Medicaid, Medica l research, Medicare, Penalties, Privacy, Reporting and reco rdkeeping requirements, Security.
45 CFR Part 162 Administrative practice and pro cedures, Electronic transactions , Health facilities, Health insurance, Hospitals, Incorporation by re ference, Medicaid, Me dicare, Reporting and recordkeeping requirements.88 For the reasons set forth in this preamble, th e Department of Health and Human Services proposes to amend 45 CFR parts 160 and 162 to read as follows:
PART 160--GENERAL ADMINIS TRATIVE REQUIREMENTS 1. The authority citation for part 16 0 continues to read as follows: Authority : 42 U.S.C. 1302(a); 42 U.S.C. 1320d-1320d-9; sec. 264, Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2 (note)); 5 U.S.C. 552; secs. 13400-13424, Pub. L. 111-5, 123 Stat. 258-279; and sec. 1104 of Pub. L. 111-148, 124 Stat. 146-154. 2. Section 160.103 is amended by— A. Adding the definition of "Pena lty fee" in alphabetical order. B. Revising the definition of "Respondent". The addition and revision read as follows: § 160.103 Definitions. * * * * * Penalty fee means the amount determined under § 160.614.
* * * * * Respondent means a covered entity or business associate upon which the Secretary has imposed, or proposes to impose, a penalty f ee under subpart F or a civil money penalty.
* * * * * § 160.300 [Amended] 3. Section 160.300 is amended by removing the phrase "parts 162 and" and adding in its place the phrase "parts 162 (excluding § 162.926) and". 4. Section 160.500 is revise d to read as follows: § 160.500 Applicability

.89 This subpart applies to hearings c onducted relating to the following: (a) The imposition of a civil money pe nalty by the Secretary under 42 U.S.C. 1320d-5. (b) The assessment of a penalty fee by the Secretary under 42 U.S.C. 1320d-2(j). 5. Section 160.504 is amended by revising paragraph (c) to read as follows: § 160.504 Hearing before an ALJ. * * * * * (c) The request for a hearing must do the following: (1) Clearly and directly admit, deny, or explain each of the findings of fact contained in the notice of proposed determination under § 160. 420 or in the notice of determination under § 160.624 with regard to which the respondent has any knowledge. If the respondent has no knowledge of a particular finding of fact and so states, the finding shall be deemed denied. (2) State the circumstances or arguments that the respondent alleges constitute the grounds for any defense and the factual and legal basis for opposing the penalty or penalty fee, except that a respondent may raise an affirm ative defense under § 160.410 (b)(1) or § 160.620(a) at any time.
* * * * * 6. Section 160.534 is amended by revising pa ragraphs (b)(1) and (d )(1) to read as follows: § 160.534 The hearing. * * * * * (b)(1) The respondent has the burden of going forward and the burden of persuasion with respect to any of the following: (i) Affirmative defense under § 160.410 or defense under§ 160.620 of this part.90 (ii) Challenge to the amount of a proposed penalty pursuant to § 160.404 through § 160.408, including any factors raised as mitigating factors, or to the amount of the penalty fee pursuant to § 160.624. (iii) Claim that a proposed penalty should be reduced or waived pursuant to § 160.412 . (iv) Compliance with subpart D of part 164, as provided under § 164.414(b).
* * * * * (d)(1) Subject to the 15-day rule under § 160.518(a) and the admissibility of evidence under § 160.540, either party may introduce, during its case in chief, items or information that arose or became known after the date of the i ssuance of the notice of proposed determination under § 160.420, the notice of determination unde r § 160.624, or the request for hearing under § 160.504, as applicable. Such items and information may not be admitted into evidence, if introduced— (i) By the Secretary, unless they are material and relevant to the acts or omissions with respect to which the penalty is proposed in the notice of proposed determination under § 160.420 or in the notice of determination under § 160.62 4, including circumstances that may increase penalties or penalty fees; or (ii) By the respondent, unless they are materi al and relevant to an admission, denial or explanation of a finding of fact in the notice of proposed determination under § 160.420 or in the notice of determination under § 160.624, or to a specific circumstance or argument expressly stated in the request for hearing under § 160.504, including circumstances that may reduce penalties or penalty fees.
* * * * * § 160.540 [Amended]91 7. In § 160.540, paragraph (g) is amended by removing the phrase" notice of proposed determination under§ 160.420 of this part " a nd adding in its place th e phrase "notice of proposed determination under § 160.420 or in the Secretary's notice of determination under § 160.624." 8. Section 160.546 is amended by revising paragraph (b) to read as follows: § 160.546 ALJ's decision.
* * * * * (b) The ALJ may affirm, increase, or reduce the penalties or penalty fees imposed by the Secretary. * * * * * § 160.548 [Amended] 9. Section 160.548 is amended by: A. In paragraph (e), removing the phrase "of this part" and adding in its place the phrase "or a defense under § 160.620(a) ". B. In paragraph (g), removing the phrase "any penalty determined by the ALJ" and adding in its place the phrase "any penalty or penalty fee determined by the ALJ." § 160.550 [Amended] 10. In § 160.550, paragraphs (a) and (b) are amended by removing the phrase " penalty" and by adding in its place the phrase " penalty or penalty fee" each time it appears. 11. Subpart F is added to pa rt 160 to read as follows: Subpart F—Imposition of Penalty Fees
Sec. 160.602 Applicability.92

160.604 Definitions. 160.612 Basis for the assessment of a penalty fee. 160.614 Amount of the penalty fee for failure to comply with submission requirements or knowingly providing inaccurate or incomplete information. 160.616 Notice of penalty fee. 160.618 CHP's response to notice of penalty fee. 160.620 Defenses that may be raised in response to notice of penalty fee. 160.624 Notice of determination. 160.626 Right to a hearing. Subpart F—Imposition of Penalty Fees § 160.602 Applicability. This subpart applies to the imposition of pe nalty fees by the Secretary under 42 U.S.C. 1320d-2. § 160.604 Definitions. As used in this subpart, the following definitions apply: Controlling health plan (CHP) means a health plan as defined at § 162.103 of this subchapter. Major medical policy means an insurance policy that covers accident and sickness and provides outpatient, hospital, medical and surgical expense coverage. § 160.612 Basis for the assessment of a penalty fee. The Secretary assesses a penalty fee against a CHP with major medical policies if the Secretary determines the CHP did either of the following: (a) Failed to provide the documentation in accordance with § 162.926(a)(2) or (b)(2) of this subchapter.93 (b) With respect to information submitted to the Secretary under to § 162.926 of this subchapter—made by statements, in documents, or otherwise—upon which either a CORE Seal (under § 162.926(a)(2) or (b)(2) of this subchapter) or the HIPAA Credential (under § 162.926(a)(2) or (b)(2) of this subchapter) is based, provides inaccurate or incomplete information-- (1) With actual knowledge of the inaccuracy or incompleteness of the information; or (2) Acting in deliberate ignorance or reckle ss disregard of the accuracy or completeness of the information. § 160.614 Amount of the penalty fee for failure to comply with submission requirements or knowingly providing inaccurate or incomplete information. (a) The penalty fee amounts are as follows: (1) For the basis specified at § 160.612(a), $1 per covered life of the CHP per day until the requirements of § 162.926(a)(2) or (b)(2) of this subchapter, as applicable, have been met, not to exceed $20 per covered life. (2) For the basis specified at § 160.612( b), $40 per covered lif e of the CHP. (b) A CHP is not assessed more than $40 pe r covered life of the CHP under the basis specified at § 160.612. § 160.616 Notice of penalty fee. The Secretary provides notice, by certified mail with return receipt requested, to a CHP that meets any of the bases for a penalty fee in § 160. 612. A notice of penalty fee includes all of the following: (a) The penalty fee amount. (b) Reference to the regulatory ba sis, under § 160.612, for the penalty fee.94 (c) A description of the findings of fact re garding the violations upon which the penalty fee is based. (d) The reasons(s) why the violation(s) subject the CHP to a penalty fee. § 160.618 CHP's response to notice of penalty fee. (a) In response to a notice of pena lty fee under § 160.616, a CHP may submit to the Secretary evidence of an y of the defenses described in § 160.620. (b)(1) A CHP that chooses to assert a defense( s) under paragraph (a) of this section must do so in writing within 30 calendar days of receipt of the notice under § 160.616. (2) For purposes of this secti on, the CHP's date of receipt of the notice of penalty fee is presumed to be 5 days after the date of the no tice unless the CHP makes a reasonable showing to the contrary to the Secretary. § 160.620 Defenses that may be raised in response to notice of penalty fee. The Secretary will consider no defenses aside from the following in response to a notice of penalty fee under § 160.616: (a) The CHP is not subject to the requi rements of § 162.926 of this subchapter. (b) The CHP's failure to m eet the requirements of § 162.926 of this subchapter was attributable to a ministeria l and non-substantive error. (c) The failure to meet the requirements of § 162.926 of this subchapter was beyond the CHP's control. § 160.624 Notice of determination. The Secretary sends the CHP, by certified mail with return receipt requested, a notice of determination as to whether a penalty fee is assessed. (a) A notice of determination to assess a penalty fee includes all of the following:95 (1) A description of the statutory basi s for the assessment of the penalty fee. (2) The amount of the penalty fee. (3) Reference to the regulatory basis, under § 160.612, for the assessment of the penalty fee. (4) The findings of fact rega rding the violations on which a ssessment of the penalty fee is based. (5) Any defenses described in § 160.620 that were considered in determining whether to assess the penalty fee and the reason(s ) why the defenses were rejected. (6) Instructions for re questing a hearing under § 160.626. (7) A statement that the failure to request a hearing within 90 days results in the imposition of the penalty fee specified in the notice of determination. (b) A notice of determination to not a ssess a penalty fee includes the following: (1) Any defenses described in § 160.620 that were considered in determining whether to assess the penalty fee and the reason(s) why the defenses were accepted; and (2) Actions the CHP must take. § 160.626 Right to a hearing. (a) Upon receipt of a notice of determin ation under § 160.624(a), a CHP may request a hearing before an ALJ by filing a request in accordance with § 160.504. (b) If a CHP does not request a heari ng within the time prescribed by § 160.504, the Secretary notifies the CHP that th e penalty fee in the notice of determination is final and the means by which the CHP must pay the penalty fee. PART 162-- ADMINISTRATIVE REQUIREMENTS 12. The authority citation for part 162 continues to read as follows:96
Authority : Secs. 1171 through 1180 of the Social Security Act (42 U.S.C. 1320d-1320d-9), as added by sec. 262 of Pub. L. 104-191, 110 Stat. 2021-2031, sec. 105 of Pub. L. 110-233, 122 Stat. 881-922, and sec. 264 of Pub. L. 104-191, 110 Stat. 2033-2034 (42 U.S.C. 1320d-2(note), and secs. 1104 and 10109 of Pub. L. 111-148, 124 Stat. 146-154 and 915-917. 13. Section 162.103 is amended by adding the de finitions of "Covered lives of a CHP" and "EFT" in alphabetical or der to read as follows: § 162.103 Definitions. * * * * * Covered lives of a CHP means individuals covered by or enrolled in major medical policies of a CHP and the SHP(s) of that CHP. Individuals may be described in such major medical policies by terms, including, but not limited to, the following: (1) Individuals. (2) Spouses. (3) Dependents. (4) Employees. (5) Subscribers. (6) Policyholders. (7) Medicaid recipients. (8) Medicare beneficiaries. (9) Tricare beneficiaries. (10) Veterans. (11) Survivors.
* * * * *97

EFT stands for electronic funds transfers.
* * * * * 14. Section 162.926 is added to read as follows: § 162.926 Certification of Complian ce – submission requirements (a) Submission requirements for a CHP th at obtains an HPID before January 1, 2015 . For the health care electronic funds transfers (EFT) and remittance a dvice, eligibility for a health plan, and health care claim stat us transactions, a CHP that obtains an HPID before January 1, 2015 must, on or after January 1, 2015 and on or before December 31, 2015, provide the following to the Secretary in one submission: (1) The number of covered lives of a CHP (a s that term is defined in § 162.103 of this subpart) on the date that the documentation requ ired under paragraph (a) of this section is submitted. (2) Documentation that demonstrates th e CHP has obtained a Council for Affordable Quality Healthcare (CAQH) Committee on Op erating Rules for Information Exchange (CORE)— (i) Certification Seal for Phase III CAQH CORE EFT & ERA Operating Rules. The CHP must not be under the CORE IT Exemption Policy at the time of submission with regard to the CORE Phase I, II, and III Seals; or (ii) HIPAA Credential for the operating rules fo r the transactions liste d in paragraph (a) of this section. (b) Submission requirements for a CHP that obtains an HPID on or after January 1, 2015 and on or before December 31, 2016 . A CHP that obtains an HPID on or after January 1, 201598
and on or before December 31, 2016, must, with in 365 calendar days of obtaining an HPID, provide the following to the S ecretary in one submission: (1) The number of covered lives of a CHP (as that term is defined in § 162.103) on the date the documentation required under paragraph (b) of this section is submitted. (2) The documentation required under paragraph (a)(2) of this section.CMS-0037-P

Dated: December 20, 2013

__________________________________ Marilyn Tavenner , Administrator , Centers for Medicare & Medicaid Services.

Dated: December 20, 2013

_____________________________ Kathleen Sebelius , Secretary, Department of Health and Human Services.

BILLING CODE 4120-01-PCMS-0037-P

[FR Doc. 2013-31318 Filed 12/31/2013 at 8:45 am; Publication Date: 01/02/2014]