(a) CMS will monitor and assess the performance of qualified entities and their contractors using the following methods:

(1) Audits.

(2) Submission of documentation of data sources and quantities of data upon the request of CMS and/or site visits.

(3) Analysis of specific data reported to CMS by qualified entities through annual reports (as described in paragraph (b) of this section) and reports on inappropriate disclosures or uses of beneficiary identifiable data (as described in paragraph (c) of this section).

(4) Analysis of complaints from beneficiaries and/or providers or suppliers.

(b) A qualified entity must provide annual reports to CMS containing information related to the following:

(1) General program adherence, including the following information:

(i) The number of Medicare and private claims combined.

(ii) The percent of the overall market share the number of claims represent in the qualified entity's geographic area.

(iii) The number of measures calculated.

(iv) The number of providers and suppliers profiled by type of provider and supplier.

(v) A measure of public use of the reports.

(2) The provider and supplier data sharing, error correction, and appeals process, including the following information:

(i) The number of providers and suppliers requesting claims data.

(ii) The number of requests for claims data fulfilled.

(iii) The number of error corrections.

(iv) The type(s) of problem(s) leading to the request for error correction.

(v) The amount of time to acknowledge the request for data or error correction.

(vi) The amount of time to respond to the request for error correction.

(vii) The number of requests for error correction resolved.

(3) Non-public analyses provided or sold to authorized users under this subpart, including the following information:

(i) A summary of the analyses provided or sold, including—

(A) The number of analyses.

(B) The number of purchasers of such analyses.

(C) The types of authorized users that purchased analyses.

(D) The total amount of fees received for such analyses.

(E) QE DUA or non-public analyses agreement violations.

(ii) A description of the topics and purposes of such analyses.

(iii) The number of analyses disclosed with unresolved requests for error correction.

(4) Data provided or sold to authorized users under this subpart, including the following information:

(i) The entities who received data.

(ii) The basis under which each entity received such data.

(iii) The total amount of fees received for providing, selling, or sharing the data.

(iv) QE DUA violations.

(c) A qualified entity must inform CMS of inappropriate disclosures or uses of beneficiary identifiable data under the DUA.

(d) CMS may take the following actions against a qualified entity if CMS determines that the qualified entity violated any of the requirements of this subpart, regardless of how CMS learns of a violation:

(1) Provide a warning notice to the qualified entity of the specific concern, which indicates that future deficiencies could lead to termination.

(2) Request a corrective action plan (CAP) from the qualified entity.

(3) Place the qualified entity on a special monitoring plan.

(4) Terminate the qualified entity.

(5) In the case of a violation, as defined at § 401.703(t), of the CMS DUA or the QE DUA, CMS will impose an assessment on a qualified entity in accordance with the following:

(i) Amount of assessment. CMS will calculate the amount of the assessment of up to $100 per individual entitled to, or enrolled for, benefits under part A of title XVIII of the Social Security Act or enrolled for benefits under Part B of such title whose data was implicated in the violation based on the following:

(A) Basic factors. In determining the amount per impacted individual, CMS takes into account the following:

(1) The nature and the extent of the violation.

(2) The nature and the extent of the harm or potential harm resulting from the violation.

(3) The degree of culpability and the history of prior violations.

(B) Criteria to be considered. In establishing the basic factors, CMS considers the following circumstances:

(1) Aggravating circumstances. Aggravating circumstances include the following:

(i) There were several types of violations occurring over a lengthy period of time.

(ii) There were many of these violations or the nature and circumstances indicate a pattern of violations.

(iii) The nature of the violation had the potential or actually resulted in harm to beneficiaries.

(2) Mitigating circumstances. Mitigating circumstances include the following:

(i) All of the violations subject to the imposition of an assessment were few in number, of the same type, and occurring within a short period of time.

(ii) The violation was the result of an unintentional and unrecognized error and the qualified entity took corrective steps immediately after discovering the error.

(C) Effects of aggravating or mitigating circumstances. In determining the amount of the assessment to be imposed under paragraph (d)(5)(i)(A) of this section:

(1) If there are substantial or several mitigating circumstance, the aggregate amount of the assessment is set at an amount sufficiently below the maximum permitted by paragraph (d)(5)(i)(A) of this section to reflect the mitigating circumstances.

(2) If there are substantial or several aggravating circumstances, the aggregate amount of the assessment is set at an amount at or sufficiently close to the maximum permitted by paragraph (d)(5)(i)(A) of this section to reflect the aggravating circumstances.

(D) The standards set for the qualified entity in this paragraph are binding, except to the extent that—

(1) The amount imposed is not less than the approximate amount required to fully compensate the United States, or any State, for its damages and costs, tangible and intangible, including but not limited to the costs attributable to the investigation, prosecution, and administrative review of the case.

(2) Nothing in this section limits the authority of CMS to settle any issue or case as provided by part 1005 of this title or to compromise any assessment as provided by paragraph (d)(5)(ii)(E) of this section.

(ii) Notice of determination. CMS must propose an assessment in accordance with this paragraph (d)(5), by notifying the qualified entity by certified mail, return receipt requested. Such notice must include the following information:

(A) The assessment amount.

(B) The statutory and regulatory bases for the assessment.

(C) A description of the violations upon which the assessment was proposed.

(D) Any mitigating or aggravating circumstances that CMS considered when it calculated the amount of the proposed assessment.

(E) Information concerning response to the notice, including:

(1) A specific statement of the respondent's right to a hearing in accordance with procedures established at Section 1128A of the Act and implemented in 42 CFR part 1005.

(2) A statement that failure to respond within 60 days renders the proposed determination final and permits the imposition of the proposed assessment.

(3) A statement that the debt may be collected through an administrative offset.

(4) In the case of a respondent that has an agreement under section 1866 of the Act, notice that imposition of an exclusion may result in termination of the provider's agreement in accordance with section 1866(b)(2)(C) of the Act.

(F) The means by which the qualified entity may pay the amount if they do not intend to request a hearing.

(iii) Failure to request a hearing. If the qualified entity does not request a hearing within 60 days of receipt of the notice of proposed determination, any assessment becomes final and CMS may impose the proposed assessment.

(A) CMS notifies the qualified entity, by certified mail with return receipt requested, of any assessment that has been imposed and of the means by which the qualified entity may satisfy the judgment.

(B) The qualified entity has no right to appeal an assessment for which the qualified entity has not requested a hearing.

(iv) When an assessment is collectible. An assessment becomes collectible after the earliest of the following:

(A) Sixty (60) days after the qualified entity receives CMS's notice of proposed determination under paragraph (d)(5)(ii) of this section, if the qualified entity has not requested a hearing.

(B) Immediately after the qualified entity abandons or waives its appeal right at any administrative level.

(C) Thirty (30) days after the qualified entity receives the ALJ's decision imposing an assessment under § 1005.20(d) of this title, if the qualified entity has not requested a review before the DAB.

(D) Sixty (60) days after the qualified entity receives the DAB's decision imposing an assessment if the qualified entity has not requested a stay of the decision under § 1005.22(b) of this title.

(v) Collection of an assessment. Once a determination by HHS has become final, CMS is responsible for the collection of any assessment.

(A) The General Counsel may compromise an assessment imposed under this part, after consulting with CMS or OIG, and the Federal government may recover the assessment in a civil action brought in the United States district court for the district where the claim was presented or where the qualified entity resides.

(B) The United States or a state agency may deduct the amount of an assessment when finally determined, or the amount agreed upon in compromise, from any sum then or later owing the qualified entity.

(C) Matters that were raised or that could have been raised in a hearing before an ALJ or in an appeal under section 1128A(e) of the Act may not be raised as a defense in a civil action by the United States to collect an assessment.

[76 FR 76567, Dec. 7, 2011, as amended at 81 FR 44481, July 7, 2016]