If any issuer fails to comply with the requirements of this part, civil penalties, as described in this subpart, may be imposed.

Civil penalties. For the violations listed in this paragraph, HHS may impose civil penalties in the amounts specified in § 158.606 of this subpart on any issuer who fails to do the following:

(a) Submit to HHS a report concerning the data required under this part by the deadline established by HHS.

(b) Submit to HHS a substantially complete or accurate report concerning the data required under this part.

(c) Timely and accurately pay rebates owing pursuant to this part.

(d) Respond to HHS inquiries as part of an investigation of issuer non-compliance.

(e) Maintain records as required under this part for the periodic auditing of books and records used in compiling data reported to HHS and in calculating and paying rebates pursuant to this part.

(f) Allow access and entry to premises, facilities and records that pertain to any aspect of the data reported to HHS or to rebates calculated and paid pursuant to this part.

(g) Comply with corrective actions resulting from audit findings.

(h) Accurately and truthfully represent data, reports or other information that it furnishes to a State or HHS.

If HHS learns of a potential violation described in § 158.602 of this subpart or if a State informs HHS of a potential violation prior to imposing any civil monetary penalty HHS must provide written notice to the issuer, to include the following:

(a) Describe the potential violation.

(b) Provide 30 days from the date of the notice for the responsible entity to respond and to provide additional information to refute an alleged violation.

(c) State that a civil monetary penalty may be assessed if the allegations are not, as determined by HHS, refuted.

In circumstances in which an entity cannot prepare a response to HHS within the 30 days provided in the notice, the entity may make a written request for an extension from HHS detailing the reason for the extension request and showing good cause. If HHS grants the extension, the responsible entity must respond to the notice within the time frame specified in HHS's letter granting the extension of time. Failure to respond within 30 days, or within the extended time frame, may result in HHS's imposition of a civil monetary penalty based upon its determination of a potential violation described in § 158.602 of this subpart.

In determining whether to impose a civil monetary penalty, HHS may review and consider documentation provided in any complaint or other information, as well as any additional information provided by the responsible entity to demonstrate that it has complied with Affordable Care Act requirements. The following are examples of documentation that a potential responsible entity may submit for HHS's consideration in determining whether a civil monetary penalty should be assessed and the amount of any civil monetary penalty:

(a) Any evidence that refutes an alleged noncompliance.

(b) Evidence that the entity did not know, and exercising due diligence could not have known, of the violation.

(c) Evidence documenting the development and implementation of internal policies and procedures by an issuer to ensure compliance with the Affordable Care Act requirements regarding MLR. Those policies and procedures may include or consist of a voluntary compliance program. Any such program should do the following:

(1) Effectively articulate and demonstrate the fundamental mission of compliance and the issuer's commitment to the compliance process.

(2) Include the name of the individual in the organization responsible for compliance.

(3) Include an effective monitoring system to identify practices that do not comply with Affordable Care Act requirements regarding MLRs and to provide reasonable assurance that fraud, abuse, and systemic errors are detected in a timely manner.

(4) Address procedures to improve internal policies when noncompliant practices are identified.

(d) Evidence documenting the entity's record of previous compliance with Affordable Care Act requirements regarding MLRs.

A civil monetary penalty for each violation of § 158.602 of this subpart may not exceed $100 as adjusted annually under 45 CFR part 102 for each day, for each responsible entity, for each individual affected by the violation. Penalties imposed under this part are in addition to any other penalties prescribed or allowed by law.

In determining the amount of any penalty, HHS may take into account the following:

(a) The entity's previous record of compliance. This may include any of the following:

(1) Any history of prior violations by the responsible entity, including whether, at any time before determination of the current violation(s), HHS or any State found the responsible entity liable for civil or administrative sanctions in connection with a violation of Affordable Care Act requirements regarding minimum loss ratios.

(2) Evidence that the responsible entity has never had a complaint for noncompliance with Affordable Care Act requirements regarding MLRs filed with a State or HHS.

(3) Such other factors as justice may require.

(b) The gravity of the violation. This may include any of the following:

(1) The frequency of the violation, taking into consideration whether any violation is an isolated occurrence, represents a pattern, or is widespread.

(2) The level of financial and other impacts on affected individuals.

(3) Other factors as justice may require.

For every violation subject to a civil monetary penalty, if there are substantial or several mitigating circumstances, the aggregate amount of the penalty is set at an amount sufficiently below the maximum permitted by § 158.606 of this subpart to reflect that fact. As guidelines for taking into account the factors listed in § 158.607 of this subpart, HHS considers the following:

(a) Record of prior compliance. It should be considered a mitigating circumstance if the responsible entity has done any of the following:

(1) Before receipt of the notice issued under § 158.603 of this subpart, implemented and followed a compliance plan as described in § 158.605(c) of this subpart.

(2) Had no previous complaints against it for noncompliance.

(b) Gravity of the violation(s). It should be considered a mitigating circumstance if the responsible entity has done any of the following:

(1) Made adjustments to its business practices to come into compliance with the requirements of this part so that the following occur:

(i) Each enrollee adversely affected by the violation has been paid any amount of rebate owed so that, to the extent practicable, that enrollee is in the same position that he, she, or it would have been in had the violation not occurred.

(ii) The rebate payments are completed in a timely manner.

(2) Discovered areas of noncompliance without notice from HHS and voluntarily reported that noncompliance, provided that the responsible entity submits the following:

(i) Documentation verifying that the rights and protections of all individuals adversely affected by the noncompliance have been restored; and

(ii) A plan of correction to prevent future similar violations.

(3) Demonstrated that the violation is an isolated occurrence.

(4) Demonstrated that the financial and other impacts on affected individuals is negligible or nonexistent.

(5) Demonstrated that the noncompliance is correctable and that a high percentage of the violations were corrected.

For every violation subject to a civil monetary penalty, if there are substantial or several aggravating circumstances, HHS may set the aggregate amount of the penalty at an amount sufficiently close to or at the maximum permitted by § 158.606 of this subpart to reflect that fact. HHS considers the following circumstances to be aggravating circumstances:

(a) The frequency of violation indicates a pattern of widespread occurrence.

(b) The violation(s) resulted in significant financial and other impacts on the average affected individual.

(c) The entity does not provide documentation showing that substantially all of the violations were corrected.

HHS may take into account other circumstances of an aggravating or mitigating nature if, in the interests of justice, they require either a reduction or an increase of the penalty in order to assure the achievement of the purposes of this part, and if those circumstances relate to the entity's previous record of compliance or the gravity of the violation.

Nothing in § 158.606 through § 158.610 of this subpart limits the authority of HHS to settle any issue or case described in the notice furnished in accordance with § 158.603 of this subpart or to compromise on any penalty provided for in §§ 158.606 through 158.610 of this subpart.

(a) Circumstances under which a civil monetary penalty is not imposed. HHS does not impose any civil monetary penalty on any failure for the period of time during which none of the responsible entities knew, or exercising reasonable diligence would have known, of the failure. HHS also may not impose a civil monetary penalty for the period of time after any of the responsible entities knew, or exercising reasonable diligence would have known of the failure, if the failure was due to reasonable cause and not due to willful neglect and the failure was corrected within 30 days of the first day that any of the entities against whom the penalty would be imposed knew, or exercising reasonable diligence would have known, that the failure existed.

(b) Burden of establishing knowledge. The burden is on the responsible entity or entities to establish to HHS's satisfaction that no responsible entity knew, or exercising reasonable diligence would have known, that the failure existed.

(a) Contents of notice. If HHS proposes to assess a penalty in accordance with this part, it must provide the issuer written notice of its intent to assess a penalty, which includes the following:

(1) A description of the requirements under this part that HHS has determined the issuer violated.

(2) A description of the information upon which HHS based its determination, including the basis for determining the number of affected individuals and the number of days or weeks for which the violations occurred.

(3) The amount of the proposed penalty as of the date of the notice.

(4) Any considerations described in § 158.607 through § 158.610 of this subpart that were taken into account in determining the amount of the proposed penalty.

(5) A specific statement of the issuer's right to a hearing.

(6) A statement that failure to request a hearing within 30 days after the date of the notice permits the assessment of the proposed penalty without right of appeal in accordance with § 158.615 of this subpart.

(b) Delivery of notice. This notice must be either hand delivered, sent by certified mail, return receipt requested, or sent by overnight delivery service with signature upon delivery required.

Any issuer against which HHS has assessed a penalty under this part may appeal that penalty in accordance with § 150.400 et seq.

If the issuer does not request a hearing within 30 days of the issuance of the notice described in § 158.613 of this subpart, HHS may assess the proposed civil monetary penalty indicated in such notice and may impose additional penalties as described in § 158.606 of this subpart. HHS must notify the issuer in writing of any penalty that has been assessed and of the means by which the issuer may satisfy the penalty. The issuer has no right to appeal a penalty with respect to which it has not requested a hearing in accordance with § 150.405 of this subchapter, unless the responsible entity can show good cause, as determined at § 150.405(b) of this subchapter, for failing to timely exercise its right to a hearing.