Title 45—Public Welfare--Volume 5

§ 160.101 Statutory basis and purpose.

The requirements of this subchapter implement sections 1171-1180 of the Social Security Act (the Act), sections 262 and 264 of Public Law 104-191, section 105 of Public Law 110-233, sections 13400-13424 of Public Law 111-5, and section 1104 of Public Law 111-148.

[78 FR 5687, Jan. 25, 2013]

§ 160.102 Applicability.

(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to the following entities:

(1) A health plan.

(2) A health care clearinghouse.

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

(b) Where provided, the standards, requirements, and implementation specifications adopted under this subchapter apply to a business associate.

(c) To the extent required under the Social Security Act, 42 U.S.C. 1320a-7c(a)(5), nothing in this subchapter shall be construed to diminish the authority of any Inspector General, including such authority as provided in the Inspector General Act of 1978, as amended (5 U.S.C. App.).

[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 78 FR 5687, Jan. 25, 2013]

§ 160.103 Definitions.

Except as otherwise provided, the following definitions apply to this subchapter:

Act means the Social Security Act.

Administrative simplification provision means any requirement or prohibition established by:

(1) 42 U.S.C. 1320d-1320d-4, 1320d-7, 1320d-8, and 1320d-9;

(2) Section 264 of Pub. L. 104-191;

(3) Sections 13400-13424 of Public Law 111-5; or

(4) This subchapter.

ALJ means Administrative Law Judge.

ANSI stands for the American National Standards Institute.

Business associate: (1) Except as provided in paragraph (4) of this definition, business associate means, with respect to a covered entity, a person who:

(i) On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(ii) Provides, other than in the capacity of a member of the workforce of such covered entity, legal, actuarial, accounting, consulting, data aggregation (as defined in § 164.501 of this subchapter), management, administrative, accreditation, or financial services to or for such covered entity, or to or for an organized health care arrangement in which the covered entity participates, where the provision of the service involves the disclosure of protected health information from such covered entity or arrangement, or from another business associate of such covered entity or arrangement, to the person.

(2) A covered entity may be a business associate of another covered entity.

(3) Business associate includes:

(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.

(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.

(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.

(4) Business associate does not include:

(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.

(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of § 164.504(f) of this subchapter apply and are met.

(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.

(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.

Civil money penalty or penalty means the amount determined under § 160.404 of this part and includes the plural of these terms.

CMS stands for Centers for Medicare & Medicaid Services within the Department of Health and Human Services.

Compliance date means the date by which a covered entity or business associate must comply with a standard, implementation specification, requirement, or modification adopted under this subchapter.

Covered entity means:

(1) A health plan.

(2) A health care clearinghouse.

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

Disclosure means the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.

EIN stands for the employer identification number assigned by the Internal Revenue Service, U.S. Department of the Treasury. The EIN is the taxpayer identifying number of an individual or other entity (whether or not an employer) assigned under one of the following:

(1) 26 U.S.C. 6011(b), which is the portion of the Internal Revenue Code dealing with identifying the taxpayer in tax returns and statements, or corresponding provisions of prior law.

(2) 26 U.S.C. 6109, which is the portion of the Internal Revenue Code dealing with identifying numbers in tax returns, statements, and other required documents.

Electronic media means:

(1) Electronic storage material on which data is or may be recorded electronically, including, for example, devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card;

(2) Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the Internet, extranet or intranet, leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission.

Electronic protected health information means information that comes within paragraphs (1)(i) or (1)(ii) of the definition of protected health information as specified in this section.

Employer is defined as it is in 26 U.S.C. 3401(d).

Family member means, with respect to an individual:

(1) A dependent (as such term is defined in 45 CFR 144.103), of the individual; or

(2) Any other person who is a first-degree, second-degree, third-degree, or fourth-degree relative of the individual or of a dependent of the individual. Relatives by affinity (such as by marriage or adoption) are treated the same as relatives by consanguinity (that is, relatives who share a common biological ancestor). In determining the degree of the relationship, relatives by less than full consanguinity (such as half-siblings, who share only one parent) are treated the same as relatives by full consanguinity (such as siblings who share both parents).

(i) First-degree relatives include parents, spouses, siblings, and children.

(ii) Second-degree relatives include grandparents, grandchildren, aunts, uncles, nephews, and nieces.

(iii) Third-degree relatives include great-grandparents, great-grandchildren, great aunts, great uncles, and first cousins.

(iv) Fourth-degree relatives include great-great grandparents, great-great grandchildren, and children of first cousins.

Genetic information means:

(1) Subject to paragraphs (2) and (3) of this definition, with respect to an individual, information about:

(i) The individual's genetic tests;

(ii) The genetic tests of family members of the individual;

(iii) The manifestation of a disease or disorder in family members of such individual; or

(iv) Any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any family member of the individual.

(2) Any reference in this subchapter to genetic information concerning an individual or family member of an individual shall include the genetic information of:

(i) A fetus carried by the individual or family member who is a pregnant woman; and

(ii) Any embryo legally held by an individual or family member utilizing an assisted reproductive technology.

(3) Genetic information excludes information about the sex or age of any individual.

Genetic services means:

(1) A genetic test;

(2) Genetic counseling (including obtaining, interpreting, or assessing genetic information); or

(3) Genetic education.

Genetic test means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.

Group health plan (also see definition of health plan in this section) means an employee welfare benefit plan (as defined in section 3(1) of the Employee Retirement Income and Security Act of 1974 (ERISA), 29 U.S.C. 1002(1)), including insured and self-insured plans, to the extent that the plan provides medical care (as defined in section 2791(a)(2) of the Public Health Service Act (PHS Act), 42 U.S.C. 300gg-91(a)(2)), including items and services paid for as medical care, to employees or their dependents directly or through insurance, reimbursement, or otherwise, that:

(1) Has 50 or more participants (as defined in section 3(7) of ERISA, 29 U.S.C. 1002(7)); or

(2) Is administered by an entity other than the employer that established and maintains the plan.

HHS stands for the Department of Health and Human Services.

Health care means care, services, or supplies related to the health of an individual. Health care includes, but is not limited to, the following:

(1) Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body; and

(2) Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.

Health care clearinghouse means a public or private entity, including a billing service, repricing company, community health management information system or community health information system, and “value-added” networks and switches, that does either of the following functions:

(1) Processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction.

(2) Receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.

Health care provider means a provider of services (as defined in section 1861(u) of the Act, 42 U.S.C. 1395x(u)), a provider of medical or health services (as defined in section 1861(s) of the Act, 42 U.S.C. 1395x(s)), and any other person or organization who furnishes, bills, or is paid for health care in the normal course of business.

Health information means any information, including genetic information, whether oral or recorded in any form or medium, that:

(1) Is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Health insurance issuer (as defined in section 2791(b)(2) of the PHS Act, 42 U.S.C. 300gg-91(b)(2) and used in the definition of health plan in this section) means an insurance company, insurance service, or insurance organization (including an HMO) that is licensed to engage in the business of insurance in a State and is subject to State law that regulates insurance. Such term does not include a group health plan.

Health maintenance organization (HMO) (as defined in section 2791(b)(3) of the PHS Act, 42 U.S.C. 300gg-91(b)(3) and used in the definition of health plan in this section) means a federally qualified HMO, an organization recognized as an HMO under State law, or a similar organization regulated for solvency under State law in the same manner and to the same extent as such an HMO.

Health plan means an individual or group plan that provides, or pays the cost of, medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).

(1) Health plan includes the following, singly or in combination:

(i) A group health plan, as defined in this section.

(ii) A health insurance issuer, as defined in this section.

(iii) An HMO, as defined in this section.

(iv) Part A or Part B of the Medicare program under title XVIII of the Act.

(v) The Medicaid program under title XIX of the Act, 42 U.S.C. 1396, et seq.

(vi) The Voluntary Prescription Drug Benefit Program under Part D of title XVIII of the Act, 42 U.S.C. 1395w-101 through 1395w-152.

(vii) An issuer of a Medicare supplemental policy (as defined in section 1882(g)(1) of the Act, 42 U.S.C. 1395ss(g)(1)).

(viii) An issuer of a long-term care policy, excluding a nursing home fixed indemnity policy.

(ix) An employee welfare benefit plan or any other arrangement that is established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers.

(x) The health care program for uniformed services under title 10 of the United States Code.

(xi) The veterans health care program under 38 U.S.C. chapter 17.

(xii) The Indian Health Service program under the Indian Health Care Improvement Act, 25 U.S.C. 1601, et seq.

(xiii) The Federal Employees Health Benefits Program under 5 U.S.C. 8902, et seq.

(xiv) An approved State child health plan under title XXI of the Act, providing benefits for child health assistance that meet the requirements of section 2103 of the Act, 42 U.S.C. 1397, et seq.

(xv) The Medicare Advantage program under Part C of title XVIII of the Act, 42 U.S.C. 1395w-21 through 1395w-28.

(xvi) A high risk pool that is a mechanism established under State law to provide health insurance coverage or comparable coverage to eligible individuals.

(xvii) Any other individual or group plan, or combination of individual or group plans, that provides or pays for the cost of medical care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-91(a)(2)).

(2) Health plan excludes:

(i) Any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits that are listed in section 2791(c)(1) of the PHS Act, 42 U.S.C. 300gg-91(c)(1); and

(ii) A government-funded program (other than one listed in paragraph (1)(i)-(xvi) of this definition):

(A) Whose principal purpose is other than providing, or paying the cost of, health care; or

(B) Whose principal activity is:

(1) The direct provision of health care to persons; or

(2) The making of grants to fund the direct provision of health care to persons.

Implementation specification means specific requirements or instructions for implementing a standard.

Individual means the person who is the subject of protected health information.

Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:

(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and

(i) That identifies the individual; or

(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.

Manifestation or manifested means, with respect to a disease, disorder, or pathological condition, that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved. For purposes of this subchapter, a disease, disorder, or pathological condition is not manifested if the diagnosis is based principally on genetic information.

Modify or modification refers to a change adopted by the Secretary, through regulation, to a standard or an implementation specification.

Organized health care arrangement means:

(1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider;

(2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities:

(i) Hold themselves out to the public as participating in a joint arrangement; and

(ii) Participate in joint activities that include at least one of the following:

(A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf;

(B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or

(C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk.

(3) A group health plan and a health insurance issuer or HMO with respect to such group health plan, but only with respect to protected health information created or received by such health insurance issuer or HMO that relates to individuals who are or who have been participants or beneficiaries in such group health plan;

(4) A group health plan and one or more other group health plans each of which are maintained by the same plan sponsor; or

(5) The group health plans described in paragraph (4) of this definition and health insurance issuers or HMOs with respect to such group health plans, but only with respect to protected health information created or received by such health insurance issuers or HMOs that relates to individuals who are or have been participants or beneficiaries in any of such group health plans.

Person means a natural person (meaning a human being who is born alive), trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.

Protected health information means individually identifiable health information:

(1) Except as provided in paragraph (2) of this definition, that is:

(i) Transmitted by electronic media;

(ii) Maintained in electronic media; or

(iii) Transmitted or maintained in any other form or medium.

(2) Protected health information excludes individually identifiable health information:

(i) In education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g;

(ii) In records described at 20 U.S.C. 1232g(a)(4)(B)(iv);

(iii) In employment records held by a covered entity in its role as employer; and

(iv) Regarding a person who has been deceased for more than 50 years.

Public health, as used in the terms “public health surveillance,” “public health investigation,” and “public health intervention,” means population-level activities to prevent disease in and promote the health of populations. Such activities include identifying, monitoring, preventing, or mitigating ongoing or prospective threats to the health or safety of a population, which may involve the collection of protected health information. But such activities do not include those with any of the following purposes:

(1) To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating health care.

(2) To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating health care.

(3) To identify any person for any of the activities described at paragraphs (1) or (2) of this definition.

Reproductive health care means health care, as defined in this section, that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This definition shall not be construed to set forth a standard of care for or regulate what constitutes clinically appropriate reproductive health care.

Respondent means a covered entity or business associate upon which the Secretary has imposed, or proposes to impose, a civil money penalty.

Small health plan means a health plan with annual receipts of $5 million or less.

Standard means a rule, condition, or requirement:

(1) Describing the following information for products, systems, services, or practices:

(i) Classification of components;

(ii) Specification of materials, performance, or operations; or

(iii) Delineation of procedures; or

(2) With respect to the privacy of protected health information.

Standard setting organization (SSO) means an organization accredited by the American National Standards Institute that develops and maintains standards for information transactions or data elements, or any other standard that is necessary for, or will facilitate the implementation of, this part.

State refers to one of the following:

(1) For a health plan established or regulated by Federal law, State has the meaning set forth in the applicable section of the United States Code for such health plan.

(2) For all other purposes, State means any of the several States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Commonwealth of the Northern Mariana Islands.

Subcontractor means a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.

Trading partner agreement means an agreement related to the exchange of information in electronic transactions, whether the agreement is distinct or part of a larger agreement, between each party to the agreement. (For example, a trading partner agreement may specify, among other things, the duties and responsibilities of each party to the agreement in conducting a standard transaction.)

Transaction means the transmission of information between two parties to carry out financial or administrative activities related to health care. It includes the following types of information transmissions:

(1) Health care claims or equivalent encounter information.

(2) Health care payment and remittance advice.

(3) Coordination of benefits.

(4) Health care claim status.

(5) Enrollment and disenrollment in a health plan.

(6) Eligibility for a health plan.

(7) Health plan premium payments.

(8) Referral certification and authorization.

(9) First report of injury.

(10) Health care claims attachments.

(11) Health care electronic funds transfers (EFT) and remittance advice.

(12) Other transactions that the Secretary may prescribe by regulation.

Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

Violation or violate means, as the context may require, failure to comply with an administrative simplification provision.

Workforce means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate.

[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 38019, May 31, 2002; 67 FR 53266, Aug. 14, 2002; 68 FR 8374, Feb. 20, 2003; 71 FR 8424, Feb. 16, 2006; 76 FR 40495, July 8, 2011; 77 FR 1589, Jan. 10, 2012; 78 FR 5687, Jan. 25, 2013; 89 FR 33062, Apr. 26, 2024; 91 FR 14404, Mar. 24, 2026]

§ 160.104 Modifications.

(a) Except as provided in paragraph (b) of this section, the Secretary may adopt a modification to a standard or implementation specification adopted under this subchapter no more frequently than once every 12 months.

(b) The Secretary may adopt a modification at any time during the first year after the standard or implementation specification is initially adopted, if the Secretary determines that the modification is necessary to permit compliance with the standard or implementation specification.

(c) The Secretary will establish the compliance date for any standard or implementation specification modified under this section.

(1) The compliance date for a modification is no earlier than 180 days after the effective date of the final rule in which the Secretary adopts the modification.

(2) The Secretary may consider the extent of the modification and the time needed to comply with the modification in determining the compliance date for the modification.

(3) The Secretary may extend the compliance date for small health plans, as the Secretary determines is appropriate.

[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 38019, May 31, 2002]

§ 160.105 Compliance dates for implementation of new or modified standards and implementation specifications.

Except as otherwise provided, with respect to rules that adopt new standards and implementation specifications or modifications to standards and implementation specifications in this subchapter in accordance with § 160.104 that become effective after January 25, 2013, covered entities and business associates must comply with the applicable new standards and implementation specifications, or modifications to standards and implementation specifications, no later than 180 days from the effective date of any such standards or implementation specifications.

[78 FR 5689, Jan. 25, 2013]

§ 160.201 Statutory basis.

The provisions of this subpart implement section 1178 of the Act, section 262 of Public Law 104-191, section 264(c) of Public Law 104-191, and section 13421(a) of Public Law 111-5.

[78 FR 5689, Jan. 25, 2013]

§ 160.202 Definitions.

For purposes of this subpart, the following terms have the following meanings:

Contrary, when used to compare a provision of State law to a standard, requirement, or implementation specification adopted under this subchapter, means:

(1) A covered entity or business associate would find it impossible to comply with both the State and Federal requirements; or

(2) The provision of State law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of part C of title XI of the Act, section 264 of Public Law 104-191, or sections 13400-13424 of Public Law 111-5, as applicable.

More stringent means, in the context of a comparison of a provision of State law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a State law that meets one or more of the following criteria:

(1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter, except if the disclosure is:

(i) Required by the Secretary in connection with determining whether a covered entity or business associate is in compliance with this subchapter; or

(ii) To the individual who is the subject of the individually identifiable health information.

(2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable.

(3) With respect to information to be provided to an individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies, provides the greater amount of information.

(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable.

(5) With respect to recordkeeping or requirements relating to accounting of disclosures, provides for the retention or reporting of more detailed information or for a longer duration.

(6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information.

Relates to the privacy of individually identifiable health information means, with respect to a State law, that the State law has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way.

State law means a constitution, statute, regulation, rule, common law, or other State action having the force and effect of law.

[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 74 FR 42767, Aug. 24, 2009; 78 FR 5689, Jan. 25, 2013]

§ 160.203 General rule and exceptions.

A standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law. This general rule applies, except if one or more of the following conditions is met:

(a) A determination is made by the Secretary under § 160.204 that the provision of State law:

(1) Is necessary:

(i) To prevent fraud and abuse related to the provision of or payment for health care;

(ii) To ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation;

(iii) For State reporting on health care delivery or costs; or

(iv) For purposes of serving a compelling need related to public health, safety, or welfare, and, if a standard, requirement, or implementation specification under part 164 of this subchapter is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or

(2) Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.

(b) The provision of State law relates to the privacy of individually identifiable health information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.

(c) The provision of State law, including State procedures established under such law, as applicable, provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention.

(d) The provision of State law requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals.

[65 FR 82798, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002]

§ 160.204 Process for requesting exception determinations.

(a) A request to except a provision of State law from preemption under § 160.203(a) may be submitted to the Secretary. A request by a State must be submitted through its chief elected official, or his or her designee. The request must be in writing and include the following information:

(1) The State law for which the exception is requested;

(2) The particular standard, requirement, or implementation specification for which the exception is requested;

(3) The part of the standard or other provision that will not be implemented based on the exception or the additional data to be collected based on the exception, as appropriate;

(4) How health care providers, health plans, and other entities would be affected by the exception;

(5) The reasons why the State law should not be preempted by the federal standard, requirement, or implementation specification, including how the State law meets one or more of the criteria at § 160.203(a); and

(6) Any other information the Secretary may request in order to make the determination.

(b) Requests for exception under this section must be submitted to the Secretary at an address that will be published in the Federal Register. Until the Secretary's determination is made, the standard, requirement, or implementation specification under this subchapter remains in effect.

(c) The Secretary's determination under this section will be made on the basis of the extent to which the information provided and other factors demonstrate that one or more of the criteria at § 160.203(a) has been met.

§ 160.205 Duration of effectiveness of exception determinations.

An exception granted under this subpart remains in effect until:

(a) Either the State law or the federal standard, requirement, or implementation specification that provided the basis for the exception is materially changed such that the ground for the exception no longer exists; or

(b) The Secretary revokes the exception, based on a determination that the ground supporting the need for the exception no longer exists.

§ 160.300 Applicability.

This subpart applies to actions by the Secretary, covered entities, business associates, and others with respect to ascertaining the compliance by covered entities and business associates with, and the enforcement of, the applicable provisions of this part 160 and parts 162 and 164 of this subchapter.

[78 FR 5690, Jan. 25, 2013]

§ 160.302 [Reserved]

§ 160.304 Principles for achieving compliance.

(a) Cooperation. The Secretary will, to the extent practicable and consistent with the provisions of this subpart, seek the cooperation of covered entities and business associates in obtaining compliance with the applicable administrative simplification provisions.

(b) Assistance. The Secretary may provide technical assistance to covered entities and business associates to help them comply voluntarily with the applicable administrative simplification provisions.

[78 FR 5690, Jan. 25, 2013]

§ 160.306 Complaints to the Secretary.

(a) Right to file a complaint. A person who believes a covered entity or business associate is not complying with the administrative simplification provisions may file a complaint with the Secretary.

(b) Requirements for filing complaints. Complaints under this section must meet the following requirements:

(1) A complaint must be filed in writing, either on paper or electronically.

(2) A complaint must name the person that is the subject of the complaint and describe the acts or omissions believed to be in violation of the applicable administrative simplification provision(s).

(3) A complaint must be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless this time limit is waived by the Secretary for good cause shown.

(4) The Secretary may prescribe additional procedures for the filing of complaints, as well as the place and manner of filing, by notice in the Federal Register.

(c) Investigation. (1) The Secretary will investigate any complaint filed under this section when a preliminary review of the facts indicates a possible violation due to willful neglect.

(2) The Secretary may investigate any other complaint filed under this section.

(3) An investigation under this section may include a review of the pertinent policies, procedures, or practices of the covered entity or business associate and of the circumstances regarding any alleged violation.

(4) At the time of the initial written communication with the covered entity or business associate about the complaint, the Secretary will describe the acts and/or omissions that are the basis of the complaint.

[71 FR 8424, Feb. 16, 2006, as amended at 78 FR 5690, Jan. 25, 2013]

§ 160.308 Compliance reviews.

(a) The Secretary will conduct a compliance review to determine whether a covered entity or business associate is complying with the applicable administrative simplification provisions when a preliminary review of the facts indicates a possible violation due to willful neglect.

(b) The Secretary may conduct a compliance review to determine whether a covered entity or business associate is complying with the applicable administrative simplification provisions in any other circumstance.

[78 FR 5690, Jan. 25, 2013]

§ 160.310 Responsibilities of covered entities and business associates.

(a) Provide records and compliance reports. A covered entity or business associate must keep such records and submit such compliance reports, in such time and manner and containing such information, as the Secretary may determine to be necessary to enable the Secretary to ascertain whether the covered entity or business associate has complied or is complying with the applicable administrative simplification provisions.

(b) Cooperate with complaint investigations and compliance reviews. A covered entity or business associate must cooperate with the Secretary, if the Secretary undertakes an investigation or compliance review of the policies, procedures, or practices of the covered entity or business associate to determine whether it is complying with the applicable administrative simplification provisions.

(c) Permit access to information. (1) A covered entity or business associate must permit access by the Secretary during normal business hours to its facilities, books, records, accounts, and other sources of information, including protected health information, that are pertinent to ascertaining compliance with the applicable administrative simplification provisions. If the Secretary determines that exigent circumstances exist, such as when documents may be hidden or destroyed, a covered entity or business associate must permit access by the Secretary at any time and without notice.

(2) If any information required of a covered entity or business associate under this section is in the exclusive possession of any other agency, institution, or person and the other agency, institution, or person fails or refuses to furnish the information, the covered entity or business associate must so certify and set forth what efforts it has made to obtain the information.

(3) Protected health information obtained by the Secretary in connection with an investigation or compliance review under this subpart will not be disclosed by the Secretary, except if necessary for ascertaining or enforcing compliance with the applicable administrative simplification provisions, if otherwise required by law, or if permitted under 5 U.S.C. 552a(b)(7).

[78 FR 5690, Jan. 25, 2013]

§ 160.312 Secretarial action regarding complaints and compliance reviews.

(a) Resolution when noncompliance is indicated. (1) If an investigation of a complaint pursuant to § 160.306 or a compliance review pursuant to § 160.308 indicates noncompliance, the Secretary may attempt to reach a resolution of the matter satisfactory to the Secretary by informal means. Informal means may include demonstrated compliance or a completed corrective action plan or other agreement.

(2) If the matter is resolved by informal means, the Secretary will so inform the covered entity or business associate and, if the matter arose from a complaint, the complainant, in writing.

(3) If the matter is not resolved by informal means, the Secretary will—

(i) So inform the covered entity or business associate and provide the covered entity or business associate an opportunity to submit written evidence of any mitigating factors or affirmative defenses for consideration under §§ 160.408 and 160.410 of this part. The covered entity or business associate must submit any such evidence to the Secretary within 30 days (computed in the same manner as prescribed under § 160.526 of this part) of receipt of such notification; and

(ii) If, following action pursuant to paragraph (a)(3)(i) of this section, the Secretary finds that a civil money penalty should be imposed, inform the covered entity or business associate of such finding in a notice of proposed determination in accordance with § 160.420 of this part.

(b) Resolution when no violation is found. If, after an investigation pursuant to § 160.306 or a compliance review pursuant to § 160.308, the Secretary determines that further action is not warranted, the Secretary will so inform the covered entity or business associate and, if the matter arose from a complaint, the complainant, in writing.

[78 FR 5690, Jan. 25, 2013]

§ 160.314 Investigational subpoenas and inquiries.

(a) The Secretary may issue subpoenas in accordance with 42 U.S.C. 405(d) and (e), 1320a-7a(j), and 1320d-5 to require the attendance and testimony of witnesses and the production of any other evidence during an investigation or compliance review pursuant to this part. For purposes of this paragraph, a person other than a natural person is termed an “entity.”

(1) A subpoena issued under this paragraph must—

(i) State the name of the person (including the entity, if applicable) to whom the subpoena is addressed;

(ii) State the statutory authority for the subpoena;

(iii) Indicate the date, time, and place that the testimony will take place;

(iv) Include a reasonably specific description of any documents or items required to be produced; and

(v) If the subpoena is addressed to an entity, describe with reasonable particularity the subject matter on which testimony is required. In that event, the entity must designate one or more natural persons who will testify on its behalf, and must state as to each such person that person's name and address and the matters on which he or she will testify. The designated person must testify as to matters known or reasonably available to the entity.

(2) A subpoena under this section must be served by—

(i) Delivering a copy to the natural person named in the subpoena or to the entity named in the subpoena at its last principal place of business; or

(ii) Registered or certified mail addressed to the natural person at his or her last known dwelling place or to the entity at its last known principal place of business.

(3) A verified return by the natural person serving the subpoena setting forth the manner of service or, in the case of service by registered or certified mail, the signed return post office receipt, constitutes proof of service.

(4) Witnesses are entitled to the same fees and mileage as witnesses in the district courts of the United States (28 U.S.C. 1821 and 1825). Fees need not be paid at the time the subpoena is served.

(5) A subpoena under this section is enforceable through the district court of the United States for the district where the subpoenaed natural person resides or is found or where the entity transacts business.

(b) Investigational inquiries are non-public investigational proceedings conducted by the Secretary.

(1) Testimony at investigational inquiries will be taken under oath or affirmation.

(2) Attendance of non-witnesses is discretionary with the Secretary, except that a witness is entitled to be accompanied, represented, and advised by an attorney.

(3) Representatives of the Secretary are entitled to attend and ask questions.

(4) A witness will have the opportunity to clarify his or her answers on the record following questioning by the Secretary.

(5) Any claim of privilege must be asserted by the witness on the record.

(6) Objections must be asserted on the record. Errors of any kind that might be corrected if promptly presented will be deemed to be waived unless reasonable objection is made at the investigational inquiry. Except where the objection is on the grounds of privilege, the question will be answered on the record, subject to objection.

(7) If a witness refuses to answer any question not privileged or to produce requested documents or items, or engages in conduct likely to delay or obstruct the investigational inquiry, the Secretary may seek enforcement of the subpoena under paragraph (a)(5) of this section.

(8) The proceedings will be recorded and transcribed. The witness is entitled to a copy of the transcript, upon payment of prescribed costs, except that, for good cause, the witness may be limited to inspection of the official transcript of his or her testimony.

(9)(i) The transcript will be submitted to the witness for signature.

(A) Where the witness will be provided a copy of the transcript, the transcript will be submitted to the witness for signature. The witness may submit to the Secretary written proposed corrections to the transcript, with such corrections attached to the transcript. If the witness does not return a signed copy of the transcript or proposed corrections within 30 days (computed in the same manner as prescribed under § 160.526 of this part) of its being submitted to him or her for signature, the witness will be deemed to have agreed that the transcript is true and accurate.

(B) Where, as provided in paragraph (b)(8) of this section, the witness is limited to inspecting the transcript, the witness will have the opportunity at the time of inspection to propose corrections to the transcript, with corrections attached to the transcript. The witness will also have the opportunity to sign the transcript. If the witness does not sign the transcript or offer corrections within 30 days (computed in the same manner as prescribed under § 160.526 of this part) of receipt of notice of the opportunity to inspect the transcript, the witness will be deemed to have agreed that the transcript is true and accurate.

(ii) The Secretary's proposed corrections to the record of transcript will be attached to the transcript.

(c) Consistent with § 160.310(c)(3), testimony and other evidence obtained in an investigational inquiry may be used by HHS in any of its activities and may be used or offered into evidence in any administrative or judicial proceeding.

§ 160.316 Refraining from intimidation or retaliation.

A covered entity or business associate may not threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual or other person for—

(a) Filing of a complaint under § 160.306;

(b) Testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing under this part; or

(c) Opposing any act or practice made unlawful by this subchapter, provided the individual or person has a good faith belief that the practice opposed is unlawful, and the manner of opposition is reasonable and does not involve a disclosure of protected health information in violation of subpart E of part 164 of this subchapter.

[71 FR 8424, Feb. 16, 2006, as amended at 78 FR 5691, Jan. 25, 2013]

§ 160.400 Applicability.

This subpart applies to the imposition of a civil money penalty by the Secretary under 42 U.S.C. 1320d-5.

§ 160.401 Definitions.

As used in this subpart, the following terms have the following meanings:

Reasonable cause means an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associate did not act with willful neglect.

Reasonable diligence means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances.

Willful neglect means conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated.

[74 FR 56130, Oct. 30, 2009, as amended at 78 FR 5691, Jan. 25, 2013]

§ 160.402 Basis for a civil money penalty.

(a) General rule. Subject to § 160.410, the Secretary will impose a civil money penalty upon a covered entity or business associate if the Secretary determines that the covered entity or business associate has violated an administrative simplification provision.

(b) Violation by more than one covered entity or business associate. (1) Except as provided in paragraph (b)(2) of this section, if the Secretary determines that more than one covered entity or business associate was responsible for a violation, the Secretary will impose a civil money penalty against each such covered entity or business associate.

(2) A covered entity that is a member of an affiliated covered entity, in accordance with § 164.105(b) of this subchapter, is jointly and severally liable for a civil money penalty for a violation of part 164 of this subchapter based on an act or omission of the affiliated covered entity, unless it is established that another member of the affiliated covered entity was responsible for the violation.

(c) Violation attributed to a covered entity or business associate. (1) A covered entity is liable, in accordance with the Federal common law of agency, for a civil money penalty for a violation based on the act or omission of any agent of the covered entity, including a workforce member or business associate, acting within the scope of the agency.

(2) A business associate is liable, in accordance with the Federal common law of agency, for a civil money penalty for a violation based on the act or omission of any agent of the business associate, including a workforce member or subcontractor, acting within the scope of the agency.

[78 FR 5691, Jan. 25, 2013]

§ 160.404 Amount of a civil money penalty.

(a) The amount of a civil money penalty will be determined in accordance with paragraph (b) of this section, and §§ 160.406, 160.408, and 160.412. These amounts were adjusted in accordance with the Federal Civil Monetary Penalty Inflation Adjustment Act of 1990, (Pub. L. 101-140), as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015, (section 701 of Pub. L. 114-74), and appear at 45 CFR part 102. These amounts will be updated annually and published at 45 CFR part 102.

(b) The amount of a civil money penalty that may be imposed is subject to the following limitations:

(1) For violations occurring prior to February 18, 2009, the Secretary may not impose a civil money penalty—

(i) In the amount of more than $100 for each violation; or

(ii) In excess of $25,000 for identical violations during a calendar year (January 1 through the following December 31);

(2) For violations occurring on or after February 18, 2009, the Secretary may not impose a civil money penalty—

(i) For a violation in which it is established that the covered entity or business associate did not know and, by exercising reasonable diligence, would not have known that the covered entity or business associate violated such provision,

(A) In the amount of less than $100 or more than $50,000 for each violation; or

(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31);

(ii) For a violation in which it is established that the violation was due to reasonable cause and not to willful neglect,

(A) In the amount of less than $1,000 or more than $50,000 for each violation; or

(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31);

(iii) For a violation in which it is established that the violation was due to willful neglect and was corrected during the 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred,

(A) In the amount of less than $10,000 or more than $50,000 for each violation; or

(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31);

(iv) For a violation in which it is established that the violation was due to willful neglect and was not corrected during the 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred,

(A) In the amount of less than $50,000 for each violation; or

(B) In excess of $1,500,000 for identical violations during a calendar year (January 1 through the following December 31).

(3) If a requirement or prohibition in one administrative simplification provision is repeated in a more general form in another administrative simplification provision in the same subpart, a civil money penalty may be imposed for a violation of only one of these administrative simplification provisions.

[71 FR 8426, Feb. 16, 2006, as amended at 74 FR 56130, Oct. 30, 2009; 78 FR 5691, Jan. 25, 2013; 81 FR 61581, Sept. 6, 2016]

§ 160.406 Violations of an identical requirement or prohibition.

The Secretary will determine the number of violations of an administrative simplification provision based on the nature of the covered entity's or business associate's obligation to act or not act under the provision that is violated, such as its obligation to act in a certain manner, or within a certain time, or to act or not act with respect to certain persons. In the case of continuing violation of a provision, a separate violation occurs each day the covered entity or business associate is in violation of the provision.

[78 FR 5691, Jan. 25, 2013]

§ 160.408 Factors considered in determining the amount of a civil money penalty.

In determining the amount of any civil money penalty, the Secretary will consider the following factors, which may be mitigating or aggravating as appropriate:

(a) The nature and extent of the violation, consideration of which may include but is not limited to:

(1) The number of individuals affected; and

(2) The time period during which the violation occurred;

(b) The nature and extent of the harm resulting from the violation, consideration of which may include but is not limited to:

(1) Whether the violation caused physical harm;

(2) Whether the violation resulted in financial harm;

(3) Whether the violation resulted in harm to an individual's reputation; and

(4) Whether the violation hindered an individual's ability to obtain health care;

(c) The history of prior compliance with the administrative simplification provisions, including violations, by the covered entity or business associate, consideration of which may include but is not limited to:

(1) Whether the current violation is the same or similar to previous indications of noncompliance;

(2) Whether and to what extent the covered entity or business associate has attempted to correct previous indications of noncompliance;

(3) How the covered entity or business associate has responded to technical assistance from the Secretary provided in the context of a compliance effort; and

(4) How the covered entity or business associate has responded to prior complaints;

(d) The financial condition of the covered entity or business associate, consideration of which may include but is not limited to:

(1) Whether the covered entity or business associate had financial difficulties that affected its ability to comply;

(2) Whether the imposition of a civil money penalty would jeopardize the ability of the covered entity or business associate to continue to provide, or to pay for, health care; and

(3) The size of the covered entity or business associate; and

(e) Such other matters as justice may require.

[78 FR 5691, Jan. 25, 2013]

§ 160.410 Affirmative defenses.

(a) The Secretary may not:

(1) Prior to February 18, 2011, impose a civil money penalty on a covered entity or business associate for an act that violates an administrative simplification provision if the covered entity or business associate establishes that the violation is punishable under 42 U.S.C. 1320d-6.

(2) On or after February 18, 2011, impose a civil money penalty on a covered entity or business associate for an act that violates an administrative simplification provision if the covered entity or business associate establishes that a penalty has been imposed under 42 U.S.C. 1320d-6 with respect to such act.

(b) For violations occurring prior to February 18, 2009, the Secretary may not impose a civil money penalty on a covered entity for a violation if the covered entity establishes that an affirmative defense exists with respect to the violation, including the following:

(1) The covered entity establishes, to the satisfaction of the Secretary, that it did not have knowledge of the violation, determined in accordance with the Federal common law of agency, and by exercising reasonable diligence, would not have known that the violation occurred; or

(2) The violation is—

(i) Due to circumstances that would make it unreasonable for the covered entity, despite the exercise of ordinary business care and prudence, to comply with the administrative simplification provision violated and is not due to willful neglect; and

(ii) Corrected during either:

(A) The 30-day period beginning on the first date the covered entity liable for the penalty knew, or by exercising reasonable diligence would have known, that the violation occurred; or

(B) Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply.

(c) For violations occurring on or after February 18, 2009, the Secretary may not impose a civil money penalty on a covered entity or business associate for a violation if the covered entity or business associate establishes to the satisfaction of the Secretary that the violation is—

(1) Not due to willful neglect; and

(2) Corrected during either:

(i) The 30-day period beginning on the first date the covered entity or business associate liable for the penalty knew, or, by exercising reasonable diligence, would have known that the violation occurred; or

(ii) Such additional period as the Secretary determines to be appropriate based on the nature and extent of the failure to comply.

[78 FR 5692, Jan. 25, 2013]

§ 160.412 Waiver.

For violations described in § 160.410(b)(2) or (c) that are not corrected within the period specified under such paragraphs, the Secretary may waive the civil money penalty, in whole or in part, to the extent that the payment of the penalty would be excessive relative to the violation.

[8 FR 5692, Jan. 25, 2013]

§ 160.414 Limitations.

No action under this subpart may be entertained unless commenced by the Secretary, in accordance with § 160.420, within 6 years from the date of the occurrence of the violation.

§ 160.416 Authority to settle.

Nothing in this subpart limits the authority of the Secretary to settle any issue or case or to compromise any penalty.

§ 160.418 Penalty not exclusive.

Except as otherwise provided by 42 U.S.C. 1320d-5(b)(1) and 42 U.S.C. 299b-22(f)(3), a penalty imposed under this part is in addition to any other penalty prescribed by law.

[78 FR 5692, Jan. 25, 2013]

§ 160.420 Notice of proposed determination.

(a) If a penalty is proposed in accordance with this part, the Secretary must deliver, or send by certified mail with return receipt requested, to the respondent, written notice of the Secretary's intent to impose a penalty. This notice of proposed determination must include—

(1) Reference to the statutory basis for the penalty;

(2) A description of the findings of fact regarding the violations with respect to which the penalty is proposed (except that, in any case where the Secretary is relying upon a statistical sampling study in accordance with § 160.536 of this part, the notice must provide a copy of the study relied upon by the Secretary);

(3) The reason(s) why the violation(s) subject(s) the respondent to a penalty;

(4) The amount of the proposed penalty and a reference to the subparagraph of § 160.404 upon which it is based.

(5) Any circumstances described in § 160.408 that were considered in determining the amount of the proposed penalty; and

(6) Instructions for responding to the notice, including a statement of the respondent's right to a hearing, a statement that failure to request a hearing within 90 days permits the imposition of the proposed penalty without the right to a hearing under § 160.504 or a right of appeal under § 160.548 of this part, and the address to which the hearing request must be sent.

(b) The respondent may request a hearing before an ALJ on the proposed penalty by filing a request in accordance with § 160.504 of this part.

[71 FR 8426, Feb. 16, 2006, as amended at 74 FR 56131, Oct. 30, 2009]

§ 160.422 Failure to request a hearing.

If the respondent does not request a hearing within the time prescribed by § 160.504 of this part and the matter is not settled pursuant to § 160.416, the Secretary will impose the proposed penalty or any lesser penalty permitted by 42 U.S.C. 1320d-5. The Secretary will notify the respondent by certified mail, return receipt requested, of any penalty that has been imposed and of the means by which the respondent may satisfy the penalty, and the penalty is final on receipt of the notice. The respondent has no right to appeal a penalty under § 160.548 of this part with respect to which the respondent has not timely requested a hearing.

§ 160.424 Collection of penalty.

(a) Once a determination of the Secretary to impose a penalty has become final, the penalty will be collected by the Secretary, subject to the first sentence of 42 U.S.C. 1320a-7a(f).

(b) The penalty may be recovered in a civil action brought in the United States district court for the district where the respondent resides, is found, or is located.

(c) The amount of a penalty, when finally determined, or the amount agreed upon in compromise, may be deducted from any sum then or later owing by the United States, or by a State agency, to the respondent.

(d) Matters that were raised or that could have been raised in a hearing before an ALJ, or in an appeal under 42 U.S.C. 1320a-7a(e), may not be raised as a defense in a civil action by the United States to collect a penalty under this part.

§ 160.426 Notification of the public and other agencies.

Whenever a proposed penalty becomes final, the Secretary will notify, in such manner as the Secretary deems appropriate, the public and the following organizations and entities thereof and the reason it was imposed: the appropriate State or local medical or professional organization, the appropriate State agency or agencies administering or supervising the administration of State health care programs (as defined in 42 U.S.C. 1320a-7(h)), the appropriate utilization and quality control peer review organization, and the appropriate State or local licensing agency or organization (including the agency specified in 42 U.S.C. 1395aa(a), 1396a(a)(33)).

§ 160.500 Applicability.

This subpart applies to hearings conducted relating to the imposition of a civil money penalty by the Secretary under 42 U.S.C. 1320d-5.

§ 160.502 Definitions.

As used in this subpart, the following term has the following meaning:

Board means the members of the HHS Departmental Appeals Board, in the Office of the Secretary, who issue decisions in panels of three.

§ 160.504 Hearing before an ALJ.

(a) A respondent may request a hearing before an ALJ. The parties to the hearing proceeding consist of—

(1) The respondent; and

(2) The officer(s) or employee(s) of HHS to whom the enforcement authority involved has been delegated.

(b) The request for a hearing must be made in writing signed by the respondent or by the respondent's attorney and sent by certified mail, return receipt requested, to the address specified in the notice of proposed determination. The request for a hearing must be mailed within 90 days after notice of the proposed determination is received by the respondent. For purposes of this section, the respondent's date of receipt of the notice of proposed determination is presumed to be 5 days after the date of the notice unless the respondent makes a reasonable showing to the contrary to the ALJ.

(c) The request for a hearing must clearly and directly admit, deny, or explain each of the findings of fact contained in the notice of proposed determination with regard to which the respondent has any knowledge. If the respondent has no knowledge of a particular finding of fact and so states, the finding shall be deemed denied. The request for a hearing must also state the circumstances or arguments that the respondent alleges constitute the grounds for any defense and the factual and legal basis for opposing the penalty, except that a respondent may raise an affirmative defense under § 160.410(b)(1) at any time.

(d) The ALJ must dismiss a hearing request where—

(1) On motion of the Secretary, the ALJ determines that the respondent's hearing request is not timely filed as required by paragraphs (b) or does not meet the requirements of paragraph (c) of this section;

(2) The respondent withdraws the request for a hearing;

(3) The respondent abandons the request for a hearing; or

(4) The respondent's hearing request fails to raise any issue that may properly be addressed in a hearing.

§ 160.506 Rights of the parties.

(a) Except as otherwise limited by this subpart, each party may—

(1) Be accompanied, represented, and advised by an attorney;

(2) Participate in any conference held by the ALJ;

(3) Conduct discovery of documents as permitted by this subpart;

(4) Agree to stipulations of fact or law that will be made part of the record;

(5) Present evidence relevant to the issues at the hearing;

(6) Present and cross-examine witnesses;

(7) Present oral arguments at the hearing as permitted by the ALJ; and

(8) Submit written briefs and proposed findings of fact and conclusions of law after the hearing.

(b) A party may appear in person or by a representative. Natural persons who appear as an attorney or other representative must conform to the standards of conduct and ethics required of practitioners before the courts of the United States.

(c) Fees for any services performed on behalf of a party by an attorney are not subject to the provisions of 42 U.S.C. 406, which authorizes the Secretary to specify or limit their fees.

§ 160.508 Authority of the ALJ.

(a) The ALJ must conduct a fair and impartial hearing, avoid delay, maintain order, and ensure that a record of the proceeding is made.

(b) The ALJ may—

(1) Set and change the date, time and place of the hearing upon reasonable notice to the parties;

(2) Continue or recess the hearing in whole or in part for a reasonable period of time;

(3) Hold conferences to identify or simplify the issues, or to consider other matters that may aid in the expeditious disposition of the proceeding;

(4) Administer oaths and affirmations;

(5) Issue subpoenas requiring the attendance of witnesses at hearings and the production of documents at or in relation to hearings;

(6) Rule on motions and other procedural matters;

(7) Regulate the scope and timing of documentary discovery as permitted by this subpart;

(8) Regulate the course of the hearing and the conduct of representatives, parties, and witnesses;

(9) Examine witnesses;

(10) Receive, rule on, exclude, or limit evidence;

(11) Upon motion of a party, take official notice of facts;

(12) Conduct any conference, argument or hearing in person or, upon agreement of the parties, by telephone; and

(13) Upon motion of a party, decide cases, in whole or in part, by summary judgment where there is no disputed issue of material fact. A summary judgment decision constitutes a hearing on the record for the purposes of this subpart.

(c) The ALJ—

(1) May not find invalid or refuse to follow Federal statutes, regulations, or Secretarial delegations of authority and must give deference to published guidance to the extent not inconsistent with statute or regulation;

(2) May not enter an order in the nature of a directed verdict;

(3) May not compel settlement negotiations;

(4) May not enjoin any act of the Secretary; or

(5) May not review the exercise of discretion by the Secretary with respect to whether to grant an extension under § 160.410(b)(2)(ii)(B) or (c)(2)(ii) of this part or to provide technical assistance under 42 U.S.C. 1320d-5(b)(2)(B).

[71 FR 8428, Feb. 16, 2006, as amended at 78 FR 34266, June 7, 2013]

§ 160.510 Ex parte contacts.

No party or person (except employees of the ALJ's office) may communicate in any way with the ALJ on any matter at issue in a case, unless on notice and opportunity for both parties to participate. This provision does not prohibit a party or person from inquiring about the status of a case or asking routine questions concerning administrative functions or procedures.

§ 160.512 Prehearing conferences.

(a) The ALJ must schedule at least one prehearing conference, and may schedule additional prehearing conferences as appropriate, upon reasonable notice, which may not be less than 14 business days, to the parties.

(b) The ALJ may use prehearing conferences to discuss the following—

(1) Simplification of the issues;

(2) The necessity or desirability of amendments to the pleadings, including the need for a more definite statement;

(3) Stipulations and admissions of fact or as to the contents and authenticity of documents;

(4) Whether the parties can agree to submission of the case on a stipulated record;

(5) Whether a party chooses to waive appearance at an oral hearing and to submit only documentary evidence (subject to the objection of the other party) and written argument;

(6) Limitation of the number of witnesses;

(7) Scheduling dates for the exchange of witness lists and of proposed exhibits;

(8) Discovery of documents as permitted by this subpart;

(9) The time and place for the hearing;

(10) The potential for the settlement of the case by the parties; and

(11) Other matters as may tend to encourage the fair, just and expeditious disposition of the proceedings, including the protection of privacy of individually identifiable health information that may be submitted into evidence or otherwise used in the proceeding, if appropriate.

(c) The ALJ must issue an order containing the matters agreed upon by the parties or ordered by the ALJ at a prehearing conference.

§ 160.514 Authority to settle.

The Secretary has exclusive authority to settle any issue or case without the consent of the ALJ.

§ 160.516 Discovery.

(a) A party may make a request to another party for production of documents for inspection and copying that are relevant and material to the issues before the ALJ.

(b) For the purpose of this section, the term “documents” includes information, reports, answers, records, accounts, papers and other data and documentary evidence. Nothing contained in this section may be interpreted to require the creation of a document, except that requested data stored in an electronic data storage system must be produced in a form accessible to the requesting party.

(c) Requests for documents, requests for admissions, written interrogatories, depositions and any forms of discovery, other than those permitted under paragraph (a) of this section, are not authorized.

(d) This section may not be construed to require the disclosure of interview reports or statements obtained by any party, or on behalf of any party, of persons who will not be called as witnesses by that party, or analyses and summaries prepared in conjunction with the investigation or litigation of the case, or any otherwise privileged documents.

(e)(1) When a request for production of documents has been received, within 30 days the party receiving that request must either fully respond to the request, or state that the request is being objected to and the reasons for that objection. If objection is made to part of an item or category, the part must be specified. Upon receiving any objections, the party seeking production may then, within 30 days or any other time frame set by the ALJ, file a motion for an order compelling discovery. The party receiving a request for production may also file a motion for protective order any time before the date the production is due.

(2) The ALJ may grant a motion for protective order or deny a motion for an order compelling discovery if the ALJ finds that the discovery sought—

(i) Is irrelevant;

(ii) Is unduly costly or burdensome;

(iii) Will unduly delay the proceeding; or

(iv) Seeks privileged information.

(3) The ALJ may extend any of the time frames set forth in paragraph (e)(1) of this section.

(4) The burden of showing that discovery should be allowed is on the party seeking discovery.

§ 160.518 Exchange of witness lists, witness statements, and exhibits.

(a) The parties must exchange witness lists, copies of prior written statements of proposed witnesses, and copies of proposed hearing exhibits, including copies of any written statements that the party intends to offer in lieu of live testimony in accordance with § 160.538, not more than 60, and not less than 15, days before the scheduled hearing, except that if a respondent intends to introduce the evidence of a statistical expert, the respondent must provide the Secretarial party with a copy of the statistical expert's report not less than 30 days before the scheduled hearing.

(b)(1) If, at any time, a party objects to the proposed admission of evidence not exchanged in accordance with paragraph (a) of this section, the ALJ must determine whether the failure to comply with paragraph (a) of this section should result in the exclusion of that evidence.

(2) Unless the ALJ finds that extraordinary circumstances justified the failure timely to exchange the information listed under paragraph (a) of this section, the ALJ must exclude from the party's case-in-chief—

(i) The testimony of any witness whose name does not appear on the witness list; and

(ii) Any exhibit not provided to the opposing party as specified in paragraph (a) of this section.

(3) If the ALJ finds that extraordinary circumstances existed, the ALJ must then determine whether the admission of that evidence would cause substantial prejudice to the objecting party.

(i) If the ALJ finds that there is no substantial prejudice, the evidence may be admitted.

(ii) If the ALJ finds that there is substantial prejudice, the ALJ may exclude the evidence, or, if he or she does not exclude the evidence, must postpone the hearing for such time as is necessary for the objecting party to prepare and respond to the evidence, unless the objecting party waives postponement.

(c) Unless the other party objects within a reasonable period of time before the hearing, documents exchanged in accordance with paragraph (a) of this section will be deemed to be authentic for the purpose of admissibility at the hearing.

§ 160.520 Subpoenas for attendance at hearing.

(a) A party wishing to procure the appearance and testimony of any person at the hearing may make a motion requesting the ALJ to issue a subpoena if the appearance and testimony are reasonably necessary for the presentation of a party's case.

(b) A subpoena requiring the attendance of a person in accordance with paragraph (a) of this section may also require the person (whether or not the person is a party) to produce relevant and material evidence at or before the hearing.

(c) When a subpoena is served by a respondent on a particular employee or official or particular office of HHS, the Secretary may comply by designating any knowledgeable HHS representative to appear and testify.

(d) A party seeking a subpoena must file a written motion not less than 30 days before the date fixed for the hearing, unless otherwise allowed by the ALJ for good cause shown. That motion must—

(1) Specify any evidence to be produced;

(2) Designate the witnesses; and

(3) Describe the address and location with sufficient particularity to permit those witnesses to be found.

(e) The subpoena must specify the time and place at which the witness is to appear and any evidence the witness is to produce.

(f) Within 15 days after the written motion requesting issuance of a subpoena is served, any party may file an opposition or other response.

(g) If the motion requesting issuance of a subpoena is granted, the party seeking the subpoena must serve it by delivery to the person named, or by certified mail addressed to that person at the person's last dwelling place or principal place of business.

(h) The person to whom the subpoena is directed may file with the ALJ a motion to quash the subpoena within 10 days after service.

(i) The exclusive remedy for contumacy by, or refusal to obey a subpoena duly served upon, any person is specified in 42 U.S.C. 405(e).

§ 160.522 Fees.

The party requesting a subpoena must pay the cost of the fees and mileage of any witness subpoenaed in the amounts that would be payable to a witness in a proceeding in United States District Court. A check for witness fees and mileage must accompany the subpoena when served, except that, when a subpoena is issued on behalf of the Secretary, a check for witness fees and mileage need not accompany the subpoena.

§ 160.524 Form, filing, and service of papers.

(a) Forms. (1) Unless the ALJ directs the parties to do otherwise, documents filed with the ALJ must include an original and two copies.

(2) Every pleading and paper filed in the proceeding must contain a caption setting forth the title of the action, the case number, and a designation of the paper, such as motion to quash subpoena.

(3) Every pleading and paper must be signed by and must contain the address and telephone number of the party or the person on whose behalf the paper was filed, or his or her representative.

(4) Papers are considered filed when they are mailed.

(b) Service. A party filing a document with the ALJ or the Board must, at the time of filing, serve a copy of the document on the other party. Service upon any party of any document must be made by delivering a copy, or placing a copy of the document in the United States mail, postage prepaid and addressed, or with a private delivery service, to the party's last known address. When a party is represented by an attorney, service must be made upon the attorney in lieu of the party.

(c) Proof of service. A certificate of the natural person serving the document by personal delivery or by mail, setting forth the manner of service, constitutes proof of service.

§ 160.526 Computation of time.

(a) In computing any period of time under this subpart or in an order issued thereunder, the time begins with the day following the act, event or default, and includes the last day of the period unless it is a Saturday, Sunday, or legal holiday observed by the Federal Government, in which event it includes the next business day.

(b) When the period of time allowed is less than 7 days, intermediate Saturdays, Sundays, and legal holidays observed by the Federal Government must be excluded from the computation.

(c) Where a document has been served or issued by placing it in the mail, an additional 5 days must be added to the time permitted for any response. This paragraph does not apply to requests for hearing under § 160.504.

§ 160.528 Motions.

(a) An application to the ALJ for an order or ruling must be by motion. Motions must state the relief sought, the authority relied upon and the facts alleged, and must be filed with the ALJ and served on all other parties.

(b) Except for motions made during a prehearing conference or at the hearing, all motions must be in writing. The ALJ may require that oral motions be reduced to writing.

(c) Within 10 days after a written motion is served, or such other time as may be fixed by the ALJ, any party may file a response to the motion.

(d) The ALJ may not grant a written motion before the time for filing responses has expired, except upon consent of the parties or following a hearing on the motion, but may overrule or deny the motion without awaiting a response.

(e) The ALJ must make a reasonable effort to dispose of all outstanding motions before the beginning of the hearing.

§ 160.530 Sanctions.

The ALJ may sanction a person, including any party or attorney, for failing to comply with an order or procedure, for failing to defend an action or for other misconduct that interferes with the speedy, orderly or fair conduct of the hearing. The sanctions must reasonably relate to the severity and nature of the failure or misconduct. The sanctions may include—

(a) In the case of refusal to provide or permit discovery under the terms of this part, drawing negative factual inferences or treating the refusal as an admission by deeming the matter, or certain facts, to be established;

(b) Prohibiting a party from introducing certain evidence or otherwise supporting a particular claim or defense;

(c) Striking pleadings, in whole or in part;

(d) Staying the proceedings;

(e) Dismissal of the action;

(f) Entering a decision by default;

(g) Ordering the party or attorney to pay the attorney's fees and other costs caused by the failure or misconduct; and

(h) Refusing to consider any motion or other action that is not filed in a timely manner.

§ 160.532 Collateral estoppel.

When a final determination that the respondent violated an administrative simplification provision has been rendered in any proceeding in which the respondent was a party and had an opportunity to be heard, the respondent is bound by that determination in any proceeding under this part.

§ 160.534 The hearing.

(a) The ALJ must conduct a hearing on the record in order to determine whether the respondent should be found liable under this part.

(b) (1) The respondent has the burden of going forward and the burden of persuasion with respect to any:

(i) Affirmative defense pursuant to § 160.410 of this part;

(ii) Challenge to the amount of a proposed penalty pursuant to §§ 160.404-160.408 of this part, including any factors raised as mitigating factors; or

(iii) Claim that a proposed penalty should be reduced or waived pursuant to § 160.412 of this part; and

(iv) Compliance with subpart D of part 164, as provided under § 164.414(b).

(2) The Secretary has the burden of going forward and the burden of persuasion with respect to all other issues, including issues of liability other than with respect to subpart D of part 164, and the existence of any factors considered aggravating factors in determining the amount of the proposed penalty.

(3) The burden of persuasion will be judged by a preponderance of the evidence.

(c) The hearing must be open to the public unless otherwise ordered by the ALJ for good cause shown.

(d)(1) Subject to the 15-day rule under § 160.518(a) and the admissibility of evidence under § 160.540, either party may introduce, during its case in chief, items or information that arose or became known after the date of the issuance of the notice of proposed determination or the request for hearing, as applicable. Such items and information may not be admitted into evidence, if introduced—

(i) By the Secretary, unless they are material and relevant to the acts or omissions with respect to which the penalty is proposed in the notice of proposed determination pursuant to § 160.420 of this part, including circumstances that may increase penalties; or

(ii) By the respondent, unless they are material and relevant to an admission, denial or explanation of a finding of fact in the notice of proposed determination under § 160.420 of this part, or to a specific circumstance or argument expressly stated in the request for hearing under § 160.504, including circumstances that may reduce penalties.

(2) After both parties have presented their cases, evidence may be admitted in rebuttal even if not previously exchanged in accordance with § 160.518.

[71 FR 8428, Feb. 16, 2006, as amended at 74 FR 42767, Aug. 24, 2009; 78 FR 5692, Jan. 25, 2013]

§ 160.536 Statistical sampling.

(a) In meeting the burden of proof set forth in § 160.534, the Secretary may introduce the results of a statistical sampling study as evidence of the number of violations under § 160.406 of this part, or the factors considered in determining the amount of the civil money penalty under § 160.408 of this part. Such statistical sampling study, if based upon an appropriate sampling and computed by valid statistical methods, constitutes prima facie evidence of the number of violations and the existence of factors material to the proposed civil money penalty as described in §§ 160.406 and 160.408.

(b) Once the Secretary has made a prima facie case, as described in paragraph (a) of this section, the burden of going forward shifts to the respondent to produce evidence reasonably calculated to rebut the findings of the statistical sampling study. The Secretary will then be given the opportunity to rebut this evidence.

§ 160.538 Witnesses.

(a) Except as provided in paragraph (b) of this section, testimony at the hearing must be given orally by witnesses under oath or affirmation.

(b) At the discretion of the ALJ, testimony of witnesses other than the testimony of expert witnesses may be admitted in the form of a written statement. The ALJ may, at his or her discretion, admit prior sworn testimony of experts that has been subject to adverse examination, such as a deposition or trial testimony. Any such written statement must be provided to the other party, along with the last known address of the witness, in a manner that allows sufficient time for the other party to subpoena the witness for cross-examination at the hearing. Prior written statements of witnesses proposed to testify at the hearing must be exchanged as provided in § 160.518.

(c) The ALJ must exercise reasonable control over the mode and order of interrogating witnesses and presenting evidence so as to:

(1) Make the interrogation and presentation effective for the ascertainment of the truth;

(2) Avoid repetition or needless consumption of time; and

(3) Protect witnesses from harassment or undue embarrassment.

(d) The ALJ must permit the parties to conduct cross-examination of witnesses as may be required for a full and true disclosure of the facts.

(e) The ALJ may order witnesses excluded so that they cannot hear the testimony of other witnesses, except that the ALJ may not order to be excluded—

(1) A party who is a natural person;

(2) In the case of a party that is not a natural person, the officer or employee of the party appearing for the entity pro se or designated as the party's representative; or

(3) A natural person whose presence is shown by a party to be essential to the presentation of its case, including a person engaged in assisting the attorney for the Secretary.

§ 160.540 Evidence.

(a) The ALJ must determine the admissibility of evidence.

(b) Except as provided in this subpart, the ALJ is not bound by the Federal Rules of Evidence. However, the ALJ may apply the Federal Rules of Evidence where appropriate, for example, to exclude unreliable evidence.

(c) The ALJ must exclude irrelevant or immaterial evidence.

(d) Although relevant, evidence may be excluded if its probative value is substantially outweighed by the danger of unfair prejudice, confusion of the issues, or by considerations of undue delay or needless presentation of cumulative evidence.

(e) Although relevant, evidence must be excluded if it is privileged under Federal law.

(f) Evidence concerning offers of compromise or settlement are inadmissible to the extent provided in Rule 408 of the Federal Rules of Evidence.

(g) Evidence of crimes, wrongs, or acts other than those at issue in the instant case is admissible in order to show motive, opportunity, intent, knowledge, preparation, identity, lack of mistake, or existence of a scheme. This evidence is admissible regardless of whether the crimes, wrongs, or acts occurred during the statute of limitations period applicable to the acts or omissions that constitute the basis for liability in the case and regardless of whether they were referenced in the Secretary's notice of proposed determination under § 160.420 of this part.

(h) The ALJ must permit the parties to introduce rebuttal witnesses and evidence.

(i) All documents and other evidence offered or taken for the record must be open to examination by both parties, unless otherwise ordered by the ALJ for good cause shown.

§ 160.542 The record.

(a) The hearing must be recorded and transcribed. Transcripts may be obtained following the hearing from the ALJ. A party that requests a transcript of hearing proceedings must pay the cost of preparing the transcript unless, for good cause shown by the party, the payment is waived by the ALJ or the Board, as appropriate.

(b) The transcript of the testimony, exhibits, and other evidence admitted at the hearing, and all papers and requests filed in the proceeding constitute the record for decision by the ALJ and the Secretary.

(c) The record may be inspected and copied (upon payment of a reasonable fee) by any person, unless otherwise ordered by the ALJ for good cause shown.

(d) For good cause, the ALJ may order appropriate redactions made to the record.

§ 160.544 Post hearing briefs.

The ALJ may require the parties to file post-hearing briefs. In any event, any party may file a post-hearing brief. The ALJ must fix the time for filing the briefs. The time for filing may not exceed 60 days from the date the parties receive the transcript of the hearing or, if applicable, the stipulated record. The briefs may be accompanied by proposed findings of fact and conclusions of law. The ALJ may permit the parties to file reply briefs.

§ 160.546 ALJ's decision.

(a) The ALJ must issue a decision, based only on the record, which must contain findings of fact and conclusions of law.

(b) The ALJ may affirm, increase, or reduce the penalties imposed by the Secretary.

(c) The ALJ must issue the decision to both parties within 60 days after the time for submission of post-hearing briefs and reply briefs, if permitted, has expired. If the ALJ fails to meet the deadline contained in this paragraph, he or she must notify the parties of the reason for the delay and set a new deadline.

(d) Unless the decision of the ALJ is timely appealed as provided for in § 160.548, the decision of the ALJ will be final and binding on the parties 60 days from the date of service of the ALJ's decision.

§ 160.548 Appeal of the ALJ's decision.

(a) Any party may appeal the decision of the ALJ to the Board by filing a notice of appeal with the Board within 30 days of the date of service of the ALJ decision. The Board may extend the initial 30 day period for a period of time not to exceed 30 days if a party files with the Board a request for an extension within the initial 30 day period and shows good cause.

(b) If a party files a timely notice of appeal with the Board, the ALJ must forward the record of the proceeding to the Board.

(c) A notice of appeal must be accompanied by a written brief specifying exceptions to the initial decision and reasons supporting the exceptions. Any party may file a brief in opposition to the exceptions, which may raise any relevant issue not addressed in the exceptions, within 30 days of receiving the notice of appeal and the accompanying brief. The Board may permit the parties to file reply briefs.

(d) There is no right to appear personally before the Board or to appeal to the Board any interlocutory ruling by the ALJ.

(e) Except for an affirmative defense under § 160.410(a)(1) or (2) of this part, the Board may not consider any issue not raised in the parties' briefs, nor any issue in the briefs that could have been raised before the ALJ but was not.

(f) If any party demonstrates to the satisfaction of the Board that additional evidence not presented at such hearing is relevant and material and that there were reasonable grounds for the failure to adduce such evidence at the hearing, the Board may remand the matter to the ALJ for consideration of such additional evidence.

(g) The Board may decline to review the case, or may affirm, increase, reduce, reverse or remand any penalty determined by the ALJ.

(h) The standard of review on a disputed issue of fact is whether the initial decision of the ALJ is supported by substantial evidence on the whole record. The standard of review on a disputed issue of law is whether the decision is erroneous.

(i) Within 60 days after the time for submission of briefs and reply briefs, if permitted, has expired, the Board must serve on each party to the appeal a copy of the Board's decision and a statement describing the right of any respondent who is penalized to seek judicial review.

(j)(1) The Board's decision under paragraph (i) of this section, including a decision to decline review of the initial decision, becomes the final decision of the Secretary 60 days after the date of service of the Board's decision, except with respect to a decision to remand to the ALJ or if reconsideration is requested under this paragraph.

(2) The Board will reconsider its decision only if it determines that the decision contains a clear error of fact or error of law. New evidence will not be a basis for reconsideration unless the party demonstrates that the evidence is newly discovered and was not previously available.

(3) A party may file a motion for reconsideration with the Board before the date the decision becomes final under paragraph (j)(1) of this section. A motion for reconsideration must be accompanied by a written brief specifying any alleged error of fact or law and, if the party is relying on additional evidence, explaining why the evidence was not previously available. Any party may file a brief in opposition within 15 days of receiving the motion for reconsideration and the accompanying brief unless this time limit is extended by the Board for good cause shown. Reply briefs are not permitted.

(4) The Board must rule on the motion for reconsideration not later than 30 days from the date the opposition brief is due. If the Board denies the motion, the decision issued under paragraph (i) of this section becomes the final decision of the Secretary on the date of service of the ruling. If the Board grants the motion, the Board will issue a reconsidered decision, after such procedures as the Board determines necessary to address the effect of any error. The Board's decision on reconsideration becomes the final decision of the Secretary on the date of service of the decision, except with respect to a decision to remand to the ALJ.

(5) If service of a ruling or decision issued under this section is by mail, the date of service will be deemed to be 5 days from the date of mailing.

(k)(1) A respondent's petition for judicial review must be filed within 60 days of the date on which the decision of the Board becomes the final decision of the Secretary under paragraph (j) of this section.

(2) In compliance with 28 U.S.C. 2112(a), a copy of any petition for judicial review filed in any U.S. Court of Appeals challenging the final decision of the Secretary must be sent by certified mail, return receipt requested, to the General Counsel of HHS. The petition copy must be a copy showing that it has been time-stamped by the clerk of the court when the original was filed with the court.

(3) If the General Counsel of HHS received two or more petitions within 10 days after the final decision of the Secretary, the General Counsel will notify the U.S. Judicial Panel on Multidistrict Litigation of any petitions that were received within the 10 day period.

[71 FR 8428, Feb. 16, 2006, as amended at 78 FR 34266, June 7, 2013]

§ 160.550 Stay of the Secretary's decision.

(a) Pending judicial review, the respondent may file a request for stay of the effective date of any penalty with the ALJ. The request must be accompanied by a copy of the notice of appeal filed with the Federal court. The filing of the request automatically stays the effective date of the penalty until such time as the ALJ rules upon the request.

(b) The ALJ may not grant a respondent's request for stay of any penalty unless the respondent posts a bond or provides other adequate security.

(c) The ALJ must rule upon a respondent's request for stay within 10 days of receipt.

§ 160.552 Harmless error.

No error in either the admission or the exclusion of evidence, and no error or defect in any ruling or order or in any act done or omitted by the ALJ or by any of the parties is ground for vacating, modifying or otherwise disturbing an otherwise appropriate ruling or order or act, unless refusal to take such action appears to the ALJ or the Board inconsistent with substantial justice. The ALJ and the Board at every stage of the proceeding must disregard any error or defect in the proceeding that does not affect the substantial rights of the parties.

§ 162.100 Applicability.

Covered entities (as defined in § 160.103 of this subchapter) must comply with the applicable requirements of this part.

§ 162.103 Definitions.

For purposes of this part, the following definitions apply:

Attachment information means documentation that enables the health plan to make a decision about health care that is not included in a health care claims or equivalent encounter information transaction, as described in § 162.1101.

Code set means any set of codes used to encode data elements, such as tables of terms, medical concepts, medical diagnostic codes, or medical procedure codes. A code set includes the codes and the descriptors of the codes.

Code set maintaining organization means an organization that creates and maintains the code sets adopted by the Secretary for use in the transactions for which standards are adopted in this part.

Covered health care provider means a health care provider that meets the definition at paragraph (3) of the definition of “covered entity” at § 160.103.

Data condition means the rule that describes the circumstances under which a covered entity must use a particular data element or segment.

Data content means all the data elements and code sets inherent to a transaction, and not related to the format of the transaction. Data elements that are related to the format are not data content.

Data element means the smallest named unit of information in a transaction.

Data set means a semantically meaningful unit of information exchanged between two parties to a transaction.

Descriptor means the text defining a code.

Designated standard maintenance organization (DSMO) means an organization designated by the Secretary under § 162.910(a).

Direct data entry means the direct entry of data (for example, using dumb terminals or web browsers) that is immediately transmitted into a health plan's computer.

Electronic signature means an electronic sound, symbol, or process, attached to, or logically associated with attachment information and executed by a person with the intent to sign the attachment information.

Format refers to those data elements that provide or control the enveloping or hierarchical structure, or assist in identifying data content of, a transaction.

HCPCS stands for the Health [Care Financing Administration] Common Procedure Coding System.

Maintain or maintenance refers to activities necessary to support the use of a standard adopted by the Secretary, including technical corrections to an implementation specification, and enhancements or expansion of a code set. This term excludes the activities related to the adoption of a new standard or implementation specification, or modification to an adopted standard or implementation specification.

Maximum defined data set means all of the required data elements for a particular standard based on a specific implementation specification.

Operating rules means the necessary business rules and guidelines for the electronic exchange of information that are not defined by a standard or its implementation specifications as adopted for purposes of this part.

Segment means a group of related data elements in a transaction.

Stage 1 payment initiation means a health plan's order, instruction or authorization to its financial institution to make a health care claims payment using an electronic funds transfer (EFT) through the ACH Network.

Standard transaction means a transaction that complies with an applicable standard and associated operating rules adopted under this part.

[65 FR 50367, Aug. 17, 2000, as amended at 68 FR 8374, Feb. 20, 2003; 74 FR 3324, Jan. 16, 2009; 76 FR 40495, July 8, 2011; 77 FR 1589, Jan. 10, 2012; 77 FR 54719, Sept. 5, 2012; 84 FR 57629, Oct. 28, 2019; 91 FR 14404, Mar. 24, 2026]

§ 162.402 [Reserved]

§ 162.404 Compliance dates of the implementation of the standard unique health identifier for health care providers.

(a) Health care providers. A covered health care provider must comply with the implementation specifications in § 162.410 no later than May 23, 2007.

(b) Health plans. A health plan must comply with the implementation specifications in § 162.412 no later than one of the following dates:

(1) A health plan that is not a small health plan—May 23, 2007.

(2) A small health plan—May 23, 2008.

(c) Health care clearinghouses. A health care clearinghouse must comply with the implementation specifications in § 162.414 no later than May 23, 2007.

[69 FR 3468, Jan. 23, 2004, as amended at 77 FR 54719, Sept. 5, 2012]

§ 162.406 Standard unique health identifier for health care providers.

(a) Standard. The standard unique health identifier for health care providers is the National Provider Identifier (NPI). The NPI is a 10-position numeric identifier, with a check digit in the 10th position, and no intelligence about the health care provider in the number.

(b) Required and permitted uses for the NPI. (1) The NPI must be used as stated in §§ 162.410, 162.412, and 162.414.

(2) The NPI may be used for any other lawful purpose.

§ 162.408 National Provider System.

National Provider System. The National Provider System (NPS) shall do the following:

(a) Assign a single, unique NPI to a health care provider, provided that—

(1) The NPS may assign an NPI to a subpart of a health care provider in accordance with paragraph (g); and

(2) The Secretary has sufficient information to permit the assignment to be made.

(b) Collect and maintain information about each health care provider that has been assigned an NPI and perform tasks necessary to update that information.

(c) If appropriate, deactivate an NPI upon receipt of appropriate information concerning the dissolution of the health care provider that is an organization, the death of the health care provider who is an individual, or other circumstances justifying deactivation.

(d) If appropriate, reactivate a deactivated NPI upon receipt of appropriate information.

(e) Not assign a deactivated NPI to any other health care provider.

(f) Disseminate NPS information upon approved requests.

(g) Assign an NPI to a subpart of a health care provider on request if the identifying data for the subpart are unique.

§ 162.410 Implementation specifications: Health care providers.

(a) A covered entity that is a covered health care provider must:

(1) Obtain, by application if necessary, an NPI from the National Provider System (NPS) for itself or for any subpart of the covered entity that would be a covered health care provider if it were a separate legal entity. A covered entity may obtain an NPI for any other subpart that qualifies for the assignment of an NPI.

(2) Use the NPI it obtained from the NPS to identify itself on all standard transactions that it conducts where its health care provider identifier is required.

(3) Disclose its NPI, when requested, to any entity that needs the NPI to identify that covered health care provider in a standard transaction.

(4) Communicate to the NPS any changes in its required data elements in the NPS within 30 days of the change.

(5) If it uses one or more business associates to conduct standard transactions on its behalf, require its business associate(s) to use its NPI and other NPIs appropriately as required by the transactions that the business associate(s) conducts on its behalf.

(6) If it has been assigned NPIs for one or more subparts, comply with the requirements of paragraphs (a)(2) through (a)(5) of this section with respect to each of those NPIs.

(b) An organization covered health care provider that has as a member, employs, or contracts with, an individual health care provider who is not a covered entity and is a prescriber, must require such health care provider to—

(1) Obtain an NPI from the National Plan and Provider Enumeration System (NPPES); and

(2) To the extent the prescriber writes a prescription while acting within the scope of the prescriber's relationship with the organization, disclose the NPI upon request to any entity that needs it to identify the prescriber in a standard transaction.

(c) A health care provider that is not a covered entity may obtain, by application if necessary, an NPI from the NPS.

[69 FR 3468, Jan. 23, 2004, as amended at 77 FR 54719, Sept. 5, 2012]

§ 162.412 Implementation specifications: Health plans.

(a) A health plan must use the NPI of any health care provider (or subpart(s), if applicable) that has been assigned an NPI to identify that health care provider on all standard transactions where that health care provider's identifier is required.

(b) A health plan may not require a health care provider that has been assigned an NPI to obtain an additional NPI.

§ 162.414 Implementation specifications: Health care clearinghouses.

A health care clearinghouse must use the NPI of any health care provider (or subpart(s), if applicable) that has been assigned an NPI to identify that health care provider on all standard transactions where that health care provider's identifier is required.

§ 162.600 Compliance dates of the implementation of the standard unique employer identifier.

(a) Health care providers. Health care providers must comply with the requirements of this subpart no later than July 30, 2004.

(b) Health plans. A health plan must comply with the requirements of this subpart no later than one of the following dates:

(1) Health plans other than small health plans—July 30, 2004.

(2) Small health plans—August 1, 2005.

(c) Health care clearinghouses. Health care clearinghouses must comply with the requirements of this subpart no later than July 30, 2004.

§ 162.605 Standard unique employer identifier.

The Secretary adopts the EIN as the standard unique employer identifier provided for by 42 U.S.C. 1320d-2(b).

§ 162.610 Implementation specifications for covered entities.

(a) The standard unique employer identifier of an employer of a particular employee is the EIN that appears on that employee's IRS Form W-2, Wage and Tax Statement, from the employer.

(b) A covered entity must use the standard unique employer identifier (EIN) of the appropriate employer in standard transactions that require an employer identifier to identify a person or entity as an employer, including where situationally required.

(c) Required and permitted uses for the Employer Identifier.

(1) The Employer Identifier must be used as stated in § 162.610(b).

(2) The Employer Identifier may be used for any other lawful purpose.

[67 FR 38020, May 31, 2002, as amended at 69 FR 3469, Jan. 23, 2004]

§ 162.900 [Reserved]

§ 162.910 Maintenance of standards and adoption of modifications and new standards.

(a) Designation of DSMOs. (1) The Secretary may designate as a DSMO an organization that agrees to conduct, to the satisfaction of the Secretary, the following functions:

(i) Maintain standards adopted under this subchapter.

(ii) Receive and process requests for adopting a new standard or modifying an adopted standard.

(2) The Secretary designates a DSMO by notice in the Federal Register.

(b) Maintenance of standards. Maintenance of a standard by the appropriate DSMO constitutes maintenance of the standard for purposes of this part, if done in accordance with the processes the Secretary may require.

(c) Process for modification of existing standards and adoption of new standards. The Secretary considers a recommendation for a proposed modification to an existing standard, or a proposed new standard, only if the recommendation is developed through a process that provides for the following:

(1) Open public access.

(2) Coordination with other DSMOs.

(3) An appeals process for each of the following, if dissatisfied with the decision on the request:

(i) The requestor of the proposed modification.

(ii) A DSMO that participated in the review and analysis of the request for the proposed modification, or the proposed new standard.

(4) Expedited process to address content needs identified within the industry, if appropriate.

(5) Submission of the recommendation to the National Committee on Vital and Health Statistics (NCVHS).

§ 162.915 Trading partner agreements.

A covered entity must not enter into a trading partner agreement that would do any of the following:

(a) Change the definition, data condition, or use of a data element or segment in a standard or operating rule, except where necessary to implement State or Federal law, or to protect against fraud and abuse.

(b) Add any data elements or segments to the maximum defined data set.

(c) Use any code or data elements that are either marked “not used” in the standard's implementation specification or are not in the standard's implementation specification(s).

(d) Change the meaning or intent of the standard's implementation specification(s).

[65 FR 50367, Aug. 17, 2000, as amended at 76 FR 40495, July 8, 2011]

§ 162.920 Availability of implementation specifications and operating rules.

Certain material is incorporated by reference into this part with the approval of the Director of the Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51. To enforce any edition other than that specified in this section, the Department of Health and Human Services must publish a document in the Federal Register and the material must be available to the public. All approved incorporation by reference (IBR) material is available for inspection at the Centers for Medicaid & Medicare Services (CMS) and the National Archives and Records Administration (NARA). Contact CMS at: 7500 Security Boulevard, Baltimore, Maryland 21244; administrativesimplification@cms.hhs.gov; (410) 786-6597. For information on the availability of this material at NARA, www.archives.gov/federal-register/cfr/ibr-locations or email fr.inspection@nara.gov. The material may be obtained from the following source(s):

(a) ASC X12, 7600 Leesburg Pike, Suite 430, Falls Church, VA 22043; Telephone (703) 970-4480; www.X12.org. ASC X12N specifications and the ASC X12 Standard for Electronic Data Interchange Technical Report Type 3:

(1) The ASC X12N 837—Health Care Claim: Dental, Version 4010, May 2000, Washington Publishing Company, 004010X097 and Addenda to Health Care Claim: Dental, Version 4010, October 2002, Washington Publishing Company, 004010X097A1, as referenced in § 162.1102 and § 162.1802.

(2) The ASC X12N 837—Health Care Claim: Professional, Volumes 1 and 2, Version 4010, May 2000, Washington Publishing Company, 004010X098 and Addenda to Health Care Claim: Professional, Volumes 1 and 2, Version 4010, October 2002, Washington Publishing Company, 004010X098A1, as referenced in § 162.1102 and § 162.1802.

(3) The ASC X12N 837—Health Care Claim: Institutional, Volumes 1 and 2, Version 4010, May 2000, Washington Publishing Company, 004010X096 and Addenda to Health Care Claim: Institutional, Volumes 1 and 2, Version 4010, October 2002, Washington Publishing Company, 004010X096A1 as referenced in § 162.1102 and § 162.1802.

(4) The ASC X12N 835—Health Care Claim Payment/Advice, Version 4010, May 2000, Washington Publishing Company, 004010X091, and Addenda to Health Care Claim Payment/Advice, Version 4010, October 2002, Washington Publishing Company, 004010X091A1 as referenced in § 162.1602.

(5) ASC X12N 834—Benefit Enrollment and Maintenance, Version 4010, May 2000, Washington Publishing Company, 004010X095 and Addenda to Benefit Enrollment and Maintenance, Version 4010, October 2002, Washington Publishing Company, 004010X095A1, as referenced in § 162.1502.

(6) The ASC X12N 820—Payroll Deducted and Other Group Premium Payment for Insurance Products, Version 4010, May 2000, Washington Publishing Company, 004010X061, and Addenda to Payroll Deducted and Other Group Premium Payment for Insurance Products, Version 4010, October 2002, Washington Publishing Company, 004010X061A1, as referenced in § 162.1702.

(7) The ASC X12N 278—Health Care Services Review—Request for Review and Response, Version 4010, May 2000, Washington Publishing Company, 004010X094 and Addenda to Health Care Services Review—Request for Review and Response, Version 4010, October 2002, Washington Publishing Company, 004010X094A1, as referenced in § 162.1302.

(8) The ASC X12N-276/277 Health Care Claim Status Request and Response, Version 4010, May 2000, Washington Publishing Company, 004010X093 and Addenda to Health Care Claim Status Request and Response, Version 4010, October 2002, Washington Publishing Company, 004010X093A1, as referenced in § 162.1402.

(9) The ASC X12N 270/271—Health Care Eligibility Benefit Inquiry and Response, Version 4010, May 2000, Washington Publishing Company, 004010X092 and Addenda to Health Care Eligibility Benefit Inquiry and Response, Version 4010, October 2002, Washington Publishing Company, 004010X092A1, as referenced in § 162.1202.

(10) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Dental (837), May 2006, ASC X12N/005010X224, and Type 1 Errata to Health Care Claim Dental (837), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X224A1, as referenced in § 162.1102 and § 162.1802.

(11) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Professional (837), May 2006, ASC X12, 005010X222, as referenced in § 162.1102 and § 162.1802.

(12) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Institutional (837), May 2006, ASC X12/N005010X223, and Type 1 Errata to Health Care Claim: Institutional (837), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X223A1, as referenced in § 162.1102 and § 162.1802.

(13) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim Payment/Advice (835), April 2006, ASC X12N/005010X221, as referenced in § 162.1602.

(14) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Benefit Enrollment and Maintenance (834), August 2006, ASC X12N/005010X220, as referenced in § 162.1502.

(15) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Payroll Deducted and Other Group Premium Payment for Insurance Products (820), February 2007, ASC X12N/005010X218, as referenced in § 162.1702.

(16) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Services Review—Request for Review and Response (278), May 2006, ASC X12N/005010X217, and Errata to Health Care Services Review—Request for Review and Response (278), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, April 2008, ASC X12N/005010X217E1, as referenced in § 162.1302.

(17) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim Status Request and Response (276/277), August 2006, ASC X12N/005010X212, and Errata to Health Care Claim Status Request and Response (276/277), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, April 2008, ASC X12N/005010X212E1, as referenced in § 162.1402.

(18) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Eligibility Benefit Inquiry and Response (270/271), April 2008, ASC X12N/005010X279, as referenced in § 162.1202.

(19) The ASC X12N/006020X314, Additional Information to Support a Health Care Claim or Encounter (275), September 2014; as referenced in § 162.2002(c).

(20) The ASC X12N/006020X313, Health Care Claim Request for Additional Information (277), September 2014; IBR approved for § 162.2002(d).

(b) Retail pharmacy specifications and Medicaid pharmacy subrogation implementation guides. The implementation specifications for the retail pharmacy standards and the implementation specifications for the batch standard for the Medicaid pharmacy subrogation transaction may be obtained from the National Council for Prescription Drug Programs, 9240 East Raintree Drive, Scottsdale, AZ 85260. Telephone (480) 477-1000; FAX (480) 767-1042. They are also available through the internet at www.ncpdp.org. A fee is charged for all NCPDP Implementation Guides. Charging for such publications is consistent with the policies of other publishers of standards. The transaction implementation specifications are as follows:

(1) The Telecommunication Standard Implementation Guide Version 5, Release 1 (Version 5.1), September 1999, National Council for Prescription Drug Programs, as referenced in §§ 162.1102, 162.1202, 162.1302, 162.1602, and 162.1802.

(2) The Batch Standard Batch Implementation Guide, Version 1, Release 1 (Version 1.1), January 2000, supporting Telecommunication Standard Implementation Guide, Version 5, Release 1 (Version 5.1) for the NCPDP Data Record in the Detail Data Record, National Council for Prescription Drug Programs, as referenced in §§ 162.1102, 162.1202, 162.1302, and 162.1802.

(3) The National Council for Prescription Drug Programs (NCPDP) equivalent NCPDP Batch Standard Batch Implementation Guide, Version 1, Release 0, February 1, 1996, as referenced in §§ 162.1102, 162.1202, 162.1602, and 162.1802.

(4) The Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007, National Council for Prescription Drug Programs, as referenced in §§ 162.1102, 162.1202, 162.1302, and 162.1802.

(5) The Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), January 2006, National Council for Prescription Drug Programs, as referenced in §§ 162.1102, 162.1202, 162.1302, and 162.1802.

(6) The Batch Standard Medicaid Subrogation Implementation Guide, Version 3, Release 0 (Version 3.0), July 2007, National Council for Prescription Drug Programs, as referenced in § 162.1902.

(7) The Telecommunication Standard Implementation Guide Version F6 published January 2020; as referenced in §§ 162.1102; 162.1202; 162.1302; 162.1802.

(8) The Batch Standard Implementation Guide, Version 15, published October 2017; as referenced in §§ 162.1102; 162.1202; 162.1302; 162.1802.

(9) The Subrogation Implementation Guide for Batch Standard, Version 10, republished September 2019; as referenced in § 162.1902.

(c) Council for Affordable Quality Healthcare's (CAQH) Committee on Operating Rules for Information Exchange (CORE), 601 Pennsylvania Avenue, NW. South Building, Suite 500 Washington, DC 20004; Telephone (202) 861-1492; Fax (202) 861- 1454; E-mail info@CAQH.org; and Internet at http://www.caqh.org/benefits.php.

(1) CAQH, Committee on Operating Rules for Information Exchange, CORE Phase I Policies and Operating Rules, Approved April 2006, v5010 Update March 2011.

(i) Phase I CORE 152: Eligibility and Benefit Real Time Companion Guide Rule, version 1.1.0, March 2011, as referenced in § 162.1203.

(ii) Phase I CORE 153: Eligibility and Benefits Connectivity Rule, version 1.1.0, March 2011, as referenced in § 162.1203.

(iii) Phase I CORE 154: Eligibility and Benefits 270/271 Data Content Rule, version 1.1.0, March 2011, as referenced in § 162.1203.

(iv) Phase I CORE 155: Eligibility and Benefits Batch Response Time Rule, version 1.1.0, March 2011, as referenced in § 162.1203.

(v) Phase I CORE 156: Eligibility and Benefits Real Time Response Time Rule, version 1.1.0, March 2011, as referenced in § 162.1203.

(vi) Phase I CORE 157: Eligibility and Benefits System Availability Rule, version 1.1.0, March 2011, as referenced in § 162.1203.

(2) ACME Health Plan, HIPAA Transaction Standard Companion Guide, Refers to the Implementation Guides Based on ASC X12 version 005010, CORE v5010 Master Companion Guide Template, 005010, 1.2, (CORE v 5010 Master Companion Guide Template, 005010, 1.2), March 2011, as referenced in §§ 162.1203, 162.1403, and 162.1603.

(3) CAQH, Committee on Operating Rules for Information Exchange, CORE Phase II Policies and Operating Rules, Approved July 2008, v5010 Update March 2011.

(i) Phase II CORE 250: Claim Status Rule, version 2.1.0, March 2011, as referenced in § 162.1403.

(ii) Phase II CORE 258: Eligibility and Benefits 270/271 Normalizing Patient Last Name Rule, version 2.1.0, March 2011, as referenced in § 162.1203.

(iii) Phase II CORE 259: Eligibility and Benefits 270/271 AAA Error Code Reporting Rule, version 2.1.0, March 2011, as referenced in § 162.1203.

(iv) Phase II CORE 260: Eligibility & Benefits Data Content (270/271) Rule, version 2.1.0, March 2011, as referenced in § 162.1203.

(v) Phase II CORE 270: Connectivity Rule, version 2.2.0, March 2011, as referenced in § 162.1203 and § 162.1403.

(4) Council for Affordable Quality Healthcare (CAQH) Phase III Committee on Operating Rules for Information Exchange (CORE) EFT & ERA Operating Rule Set, Approved June 2012, as specified in this paragraph and referenced in § 162.1603.

(i) Phase III CORE 380 EFT Enrollment Data Rule, version 3.0.0, June 2012.

(ii) Phase III CORE 382 ERA Enrollment Data Rule, version 3.0.0, June 2012.

(iii) Phase III 360 CORE Uniform Use of CARCs and RARCs (835) Rule, version 3.0.0, June 2012.

(iv) CORE-required Code Combinations for CORE-defined Business Scenarios for the Phase III CORE 360 Uniform Use of Claim Adjustment Reason Codes and Remittance Advice Remark Codes (835) Rule, version 3.0.0, June 2012.

(v) Phase III CORE 370 EFT & ERA Reassociation (CCD+/835) Rule, version 3.0.0, June 2012.

(vi) Phase III CORE 350 Health Care Claim Payment/Advice (835) Infrastructure Rule, version 3.0.0, June 2012, except Requirement 4.2 titled “Health Care Claim Payment/Advice Batch Acknowledgement Requirements”.

(d) The National Automated Clearing House Association (NACHA), The Electronic Payments Association, 1350 Sunrise Valle Drive, Suite 100, Herndon, Virginia 20171 (Phone) (703) 561-1100; (Fax) (703) 713-1641; Email: info@nacha.org; and Internet at http://www.nacha.org. The implementation specifications are as follows:

(1) 2011 NACHA Operating Rules & Guidelines, A Complete Guide to the Rules Governing the ACH Network, NACHA Operating Rules, Appendix One: ACH File Exchange Specifications (Operating Rule 59) as referenced in § 162.1602.

(2) 2011 NACHA Operating Rules & Guidelines, A Complete Guide to the Rules Governing the ACH Network, NACHA Operating Rules Appendix Three: ACH Record Format Specifications (Operating Rule 78), Part 3.1, Subpart 3.1.8 Sequence of Records for CCD Entries as referenced in § 162.1602.

(e) Health Level Seven International (HL7), 3300 Washtenaw Avenue, Suite 227, Ann Arbor, MI 48104; Telephone (734) 677-7777; F www.hl7.org.

(1) HL7 CDA R2 Attachment Implementation Guide: Exchange of C-CDA Based Documents, Release 2—US Realm, Version 2.1.0.1; September 2023; IBR approved for § 162.2002(a).

(2) HL7 Implementation Guide for CDA Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume One—Introductory Material, August 2015 with 2019 June Errata; IBR approved for § 162.2002(b).

(3) HL7 Implementation Guide for CDA Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume Two—Templates and Supporting Material, June 2019; IBR approved for § 162.2002(b).

(4) HL7 Implementation Guide for CDA Release 2: Digital Signatures and Delegation of Rights, Release 1, Draft Standard for Trial Use, October 2014; IBR approved for § 162.2002(e).

[68 FR 8396, Feb. 20, 2003, as amended at 69 FR 18803, Apr. 9, 2004; 74 FR 3324, Jan. 16, 2009; 76 FR 40495, July 8, 2011; 77 FR 1590, Jan. 10, 2012; 77 FR 48043, Aug. 10, 2012; 89 FR 100787, Dec. 13, 2024; 91 FR 14404, Mar. 24, 2026]

§ 162.923 Requirements for covered entities.

(a) General rule. Except as otherwise provided in this part, if a covered entity conducts, with another covered entity that is required to comply with a transaction standard adopted under this part (or within the same covered entity), using electronic media, a transaction for which the Secretary has adopted a standard under this part, the covered entity must conduct the transaction as a standard transaction.

(b) Exception for direct data entry transactions. A health care provider electing to use direct data entry offered by a health plan to conduct a transaction for which a standard has been adopted under this part must use the applicable data content and data condition requirements of the standard when conducting the transaction. The health care provider is not required to use the format requirements of the standard.

(c) Use of a business associate. A covered entity may use a business associate, including a health care clearinghouse, to conduct a transaction covered by this part. If a covered entity chooses to use a business associate to conduct all or part of a transaction on behalf of the covered entity, the covered entity must require the business associate to do the following:

(1) Comply with all applicable requirements of this part.

(2) Require any agent or subcontractor to comply with all applicable requirements of this part.

[65 FR 50367, Aug. 17, 2000, as amended at 74 FR 3325, Jan. 16, 2009]

§ 162.925 Additional requirements for health plans.

(a) General rules. (1) If an entity requests a health plan to conduct a transaction as a standard transaction, the health plan must do so.

(2) A health plan may not delay or reject a transaction, or attempt to adversely affect the other entity or the transaction, because the transaction is a standard transaction.

(3) A health plan may not reject a standard transaction on the basis that it contains data elements not needed or used by the health plan (for example, coordination of benefits information).

(4) A health plan may not offer an incentive for a health care provider to conduct a transaction covered by this part as a transaction described under the exception provided for in § 162.923(b).

(5) A health plan that operates as a health care clearinghouse, or requires an entity to use a health care clearinghouse to receive, process, or transmit a standard transaction may not charge fees or costs in excess of the fees or costs for normal telecommunications that the entity incurs when it directly transmits, or receives, a standard transaction to, or from, a health plan.

(6) During the period from March 17, 2009 through December 31, 2011, a health plan may not delay or reject a standard transaction, or attempt to adversely affect the other entity or the transaction, on the basis that it does not comply with another adopted standard for the same period.

(b) Coordination of benefits. If a health plan receives a standard transaction and coordinates benefits with another health plan (or another payer), it must store the coordination of benefits data it needs to forward the standard transaction to the other health plan (or other payer).

(c) Code sets. A health plan must meet each of the following requirements:

(1) Accept and promptly process any standard transaction that contains codes that are valid, as provided in subpart J of this part.

(2) Keep code sets for the current billing period and appeals periods still open to processing under the terms of the health plan's coverage.

[65 FR 50367, Aug. 17, 2000, as amended at 74 FR 3325, Jan. 16, 2009]

§ 162.930 Additional rules for health care clearinghouses.

When acting as a business associate for another covered entity, a health care clearinghouse may perform the following functions:

(a) Receive a standard transaction on behalf of the covered entity and translate it into a nonstandard transaction (for example, nonstandard format and/or nonstandard data content) for transmission to the covered entity.

(b) Receive a nonstandard transaction (for example, nonstandard format and/or nonstandard data content) from the covered entity and translate it into a standard transaction for transmission on behalf of the covered entity.

§ 162.940 Exceptions from standards to permit testing of proposed modifications.

(a) Requests for an exception. An organization may request an exception from the use of a standard from the Secretary to test a proposed modification to that standard. For each proposed modification, the organization must meet the following requirements:

(1) Comparison to a current standard. Provide a detailed explanation, no more than 10 pages in length, of how the proposed modification would be a significant improvement to the current standard in terms of the following principles:

(i) Improve the efficiency and effectiveness of the health care system by leading to cost reductions for, or improvements in benefits from, electronic health care transactions.

(ii) Meet the needs of the health data standards user community, particularly health care providers, health plans, and health care clearinghouses.

(iii) Be uniform and consistent with the other standards adopted under this part and, as appropriate, with other private and public sector health data standards.

(iv) Have low additional development and implementation costs relative to the benefits of using the standard.

(v) Be supported by an ANSI-accredited SSO or other private or public organization that would maintain the standard over time.

(vi) Have timely development, testing, implementation, and updating procedures to achieve administrative simplification benefits faster.

(vii) Be technologically independent of the computer platforms and transmission protocols used in electronic health transactions, unless they are explicitly part of the standard.

(viii) Be precise, unambiguous, and as simple as possible.

(ix) Result in minimum data collection and paperwork burdens on users.

(x) Incorporate flexibility to adapt more easily to changes in the health care infrastructure (such as new services, organizations, and provider types) and information technology.

(2) Specifications for the proposed modification. Provide specifications for the proposed modification, including any additional system requirements.

(3) Testing of the proposed modification. Provide an explanation, no more than 5 pages in length, of how the organization intends to test the standard, including the number and types of health plans and health care providers expected to be involved in the test, geographical areas, and beginning and ending dates of the test.

(4) Trading partner concurrences. Provide written concurrences from trading partners who would agree to participate in the test.

(b) Basis for granting an exception. The Secretary may grant an initial exception, for a period not to exceed 3 years, based on, but not limited to, the following criteria:

(1) An assessment of whether the proposed modification demonstrates a significant improvement to the current standard.

(2) The extent and length of time of the exception.

(3) Consultations with DSMOs.

(c) Secretary's decision on exception. The Secretary makes a decision and notifies the organization requesting the exception whether the request is granted or denied.

(1) Exception granted. If the Secretary grants an exception, the notification includes the following information:

(i) The length of time for which the exception applies.

(ii) The trading partners and geographical areas the Secretary approves for testing.

(iii) Any other conditions for approving the exception.

(2) Exception denied. If the Secretary does not grant an exception, the notification explains the reasons the Secretary considers the proposed modification would not be a significant improvement to the current standard and any other rationale for the denial.

(d) Organization's report on test results. Within 90 days after the test is completed, an organization that receives an exception must submit a report on the results of the test, including a cost-benefit analysis, to a location specified by the Secretary by notice in the Federal Register.

(e) Extension allowed. If the report submitted in accordance with paragraph (d) of this section recommends a modification to the standard, the Secretary, on request, may grant an extension to the period granted for the exception.

§ 162.1000 General requirements.

When conducting a transaction covered by this part, a covered entity must meet the following requirements:

(a) Medical data code sets. Use the applicable medical data code sets described in § 162.1002 as specified in the implementation specification adopted under this part that are valid at the time the health care is furnished.

(b) Nonmedical data code sets. Use the nonmedical data code sets as described in the implementation specifications adopted under this part that are valid at the time the transaction is initiated.

§ 162.1002 Medical data code sets.

The Secretary adopts the following maintaining organization's code sets as the standard medical data code sets:

(a) For the period from October 16, 2002 through October 15, 2003:

(1) International Classification of Diseases, 9th Edition, Clinical Modification, (ICD-9-CM), Volumes 1 and 2 (including The Official ICD-9-CM Guidelines for Coding and Reporting), as maintained and distributed by HHS, for the following conditions:

(i) Diseases.

(ii) Injuries.

(iii) Impairments.

(iv) Other health problems and their manifestations.

(v) Causes of injury, disease, impairment, or other health problems.

(2) International Classification of Diseases, 9th Edition, Clinical Modification, Volume 3 Procedures (including The Official ICD-9-CM Guidelines for Coding and Reporting), as maintained and distributed by HHS, for the following procedures or other actions taken for diseases, injuries, and impairments on hospital inpatients reported by hospitals:

(i) Prevention.

(ii) Diagnosis.

(iii) Treatment.

(iv) Management.

(3) National Drug Codes (NDC), as maintained and distributed by HHS, in collaboration with drug manufacturers, for the following:

(i) Drugs

(ii) Biologics.

(4) Code on Dental Procedures and Nomenclature, as maintained and distributed by the American Dental Association, for dental services.

(5) The combination of Health Care Financing Administration Common Procedure Coding System (HCPCS), as maintained and distributed by HHS, and Current Procedural Terminology, Fourth Edition (CPT-4), as maintained and distributed by the American Medical Association, for physician services and other health care services. These services include, but are not limited to, the following:

(i) Physician services.

(ii) Physical and occupational therapy services.

(iii) Radiologic procedures.

(iv) Clinical laboratory tests.

(v) Other medical diagnostic procedures.

(vi) Hearing and vision services.

(vii) Transportation services including ambulance.

(6) The Health Care Financing Administration Common Procedure Coding System (HCPCS), as maintained and distributed by HHS, for all other substances, equipment, supplies, or other items used in health care services. These items include, but are not limited to, the following:

(i) Medical supplies.

(ii) Orthotic and prosthetic devices.

(iii) Durable medical equipment.

(b) For the period on and after October 16, 2003 through September 30, 2015:

(1) The code sets specified in paragraphs (a)(1), (a)(2),(a)(4), and (a)(5) of this section.

(2) National Drug Codes (NDC), as maintained and distributed by HHS, for reporting the following by retail pharmacies:

(i) Drugs.

(ii) Biologics.

(3) The Healthcare Common Procedure Coding System (HCPCS), as maintained and distributed by HHS, for all other substances, equipment, supplies, or other items used in health care services, with the exception of drugs and biologics. These items include, but are not limited to, the following:

(i) Medical supplies.

(ii) Orthotic and prosthetic devices.

(iii) Durable medical equipment.

(c) For the period on and after October 1, 2015:

(1) The code sets specified in paragraphs (a)(4), (a)(5), (b)(2), and (b)(3) of this section.

(2) International Classification of Diseases, 10th Revision, Clinical Modification (ICD-10-CM) (including The Official ICD-10-CM Guidelines for Coding and Reporting), as maintained and distributed by HHS, for the following conditions:

(i) Diseases.

(ii) Injuries.

(iii) Impairments.

(iv) Other health problems and their manifestations.

(v) Causes of injury, disease, impairment, or other health problems.

(3) International Classification of Diseases, 10th Revision, Procedure Coding System (ICD-10-PCS) (including The Official ICD-10-PCS Guidelines for Coding and Reporting), as maintained and distributed by HHS, for the following procedures or other actions taken for diseases, injuries, and impairments on hospital inpatients reported by hospitals:

(i) Prevention.

(ii) Diagnosis.

(iii) Treatment.

(iv) Management.

[65 FR 50367, Aug. 17, 2000, as amended at 68 FR 8397, Feb. 20, 2003; 74 FR 3362, Jan. 16, 2009; 77 FR 54720, Sept. 5, 2012; 79 FR 45134, Aug. 4, 2014]

§ 162.1011 Valid code sets.

Each code set is valid within the dates specified by the organization responsible for maintaining that code set.

§ 162.1101 Health care claims or equivalent encounter information transaction.

The health care claims or equivalent encounter information transaction is the transmission of either of the following:

(a) A request to obtain payment, and the necessary accompanying information from a health care provider to a health plan, for health care.

(b) If there is no direct claim, because the reimbursement contract is based on a mechanism other than charges or reimbursement rates for specific services, the transaction is the transmission of encounter information for the purpose of reporting health care.

§ 162.1102 Standards for health care claims or equivalent encounter information transaction.

The Secretary adopts the following standards for the health care claims or equivalent encounter information transaction:

(a) For the period from October 16, 2003 through March 16, 2009:

(1) Retail pharmacy drugs claims. The National Council for Prescription Drug Programs (NCPDP) Telecommunication Standards Implementation Guide, Version 5, Release 1, September 1999, and equivalent NCPDP Batch Standards Batch Implementation Guide, Version 1, Release 1, (Version 1.1), January 2000, supporting Telecomunication Version 5.1 for the NCPDP Data Record in the Detail Data Record. (Incorporated by reference in § 162.920).

(2) Dental, health care claims. The ASC X12N 837—Health Care Claim: Dental, Version 4010, May 2000, Washington Publishing Company, 004010X097. and Addenda to Health Care Claim: Dental, Version 4010, October 2002, Washington Publishing Company, 004010X097A1. (Incorporated by reference in § 162.920).

(3) Professional health care claims. The ASC X12N 837—Health Care Claims: Professional, Volumes 1 and 2, Version 4010, may 2000, Washington Publishing Company, 004010X098 and Addenda to Health Care Claims: Professional, Volumes 1 and 2, Version 4010, October 2002, Washington Publishing Company, 004010x098A1. (Incorporated by reference in § 162.920).

(4) Institutional health care claims. The ASC X12N 837—Health Care Claim: Institutional, Volumes 1 and 2, Version 4010, May 2000, Washington Publishing Company, 004010X096 and Addenda to Health Care Claim: Institutional, Volumes 1 and 2, Version 4010, October 2002, Washington Publishing Company, 004010X096A1. (Incorporated by reference in § 162.920).

(b) For the period from March 17, 2009 through December 31, 2011, both:

(1)(i) The standards identified in paragraph (a) of this section; and

(ii) For retail pharmacy supplies and professional services claims, the following: The ASC X12N 837—Health Care Claim: Professional, Volumes 1 and 2, Version 4010, May 2000, Washington Publishing Company, 004010X096, October 2002 (Incorporated by reference in § 162.920); and

(2)(i) Retail pharmacy drug claims. The Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007 and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs. (Incorporated by reference in § 162.920.)

(ii) Dental health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3— Health Care Claim: Dental (837), May 2006, ASC X12N/005010X224, and Type 1 Errata to Health Care Claim: Dental (837) ASC X12 Standards for Electronic Date Interchange Technical Report Type 3, October 2007, ASC X12N/005010X224A1. (Incorporated by reference in § 162.920.)

(iii) Professional health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Professional (837), May 2006, ASC X12N/005010X222. (Incorporated by reference in § 162.920.)

(iv) Institutional health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Institutional (837), May 2006, ASC X12N/005010X223, and Type 1 Errata to Health Care Claim: Institutional (837) ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X223A1. (Incorporated by reference in § 162.920.)

(v) Retail pharmacy supplies and professional services claims. (A) The Telecommunication Standard, Implementation Guide Version 5, Release 1, September 1999. (Incorporated by reference in § 162.920.)

(B) The Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007, and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs (Incorporated by reference in § 162.920); and

(C) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Professional (837), May 2006, ASC X12N/005010X222. (Incorporated by reference in § 162.920.)

(c) For the period from January 1, 2012 through August 14, 2027, the standards identified in paragraph (b)(2) of this section, except the standard identified in paragraph (b)(2)(v)(A) of this section.

(d) For the period on and after September 21, 2020 through August 14, 2027, the Quantity Prescribed (460-ET) field, as set forth in the Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007 and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs, must be treated as required where the transmission meets both of the following:

(1) Is for a Schedule II drug, as defined in 21 CFR 1308.12.

(2) Uses the standard identified in paragraph (b)(2)(i) of this section.

(e) For the period from August 14, 2027 through April 14, 2028, both of the following:

(1) The standards identified in paragraphs (c) and (d) of this section.

(2) The following standards:

(i) Retail pharmacy drug claims. The NCPDP Telecommunication Standard Implementation Guide Version F6, January 2020 and equivalent NCPDP Batch Standard Implementation Guide, Version 15, October 2017 (both incorporated by reference in § 162.920).

(ii) Dental health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Dental (837), May 2006, ASC X12N/005010X224, and Type 1 Errata to Health Care Claim: Dental (837) ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X224A1 (both incorporated by reference in § 162.920).

(iii) Professional health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Professional (837), May 2006, ASC X12N/005010X222 (incorporated by reference in § 162.920).

(iv) Institutional health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Institutional (837), May 2006, ASC X12N/005010X223, and Type 1 Errata to Health Care Claim: Institutional (837) ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X223A1 (both incorporated by reference in § 162.920).

(3) Retail pharmacy supplies and professional services claims. (i) The NCPDP Telecommunication Standard Implementation Guide Version F6, January 2020 and equivalent NCPDP Batch Standard Implementation Guide, Version 15, October 2017 (both incorporated by reference in § 162.920).

(ii) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3-Health Care Claim: Professional (837), May 2006, ASC X12N/005010X222 (incorporated by reference in § 162.920).

(f) For the period on and after April 14, 2028, the standards identified in paragraph (e)(2) of this section.

[68 FR 8397, Feb. 20, 2003; 68 FR 11445, Mar. 10, 2003, as amended at 74 FR 3325, Jan. 16, 2009; 85 FR 4242, Jan. 24, 2020; 89 FR 100788, Dec. 13, 2024; 90 FR 40749, Aug. 21, 2025]

§ 162.1201 Eligibility for a health plan transaction.

The eligibility for a health plan transaction is the transmission of either of the following:

(a) An inquiry from a health care provider to a health plan, or from one health plan to another health plan, to obtain any of the following information about a benefit plan for an enrollee:

(1) Eligibility to receive health care under the health plan.

(2) Coverage of health care under the health plan.

(3) Benefits associated with the benefit plan.

(b) A response from a health plan to a health care provider's (or another health plan's) inquiry described in paragraph (a) of this section.

§ 162.1202 Standards for eligibility for a health plan transaction.

The Secretary adopts the following standards for the eligibility for a health plan transaction:

(a) For the period from October 16, 2003 through March 16, 2009:

(1) Retail pharmacy drugs. The National Council for Prescription Drug Programs Telecommunication Standard Implementation Guide, Version 5, Release 1 (Version 5.1), September 1999, and equivalent NCPDP Batch Standard Batch Implementation Guide, Version 1, Release 1 (Version 1.1), January 2000 supporting Telecommunications Standard Implementation Guide, Version 5, Release 1 (Version 5.1) for the NCPDP Data Record in the Detail Data Record. (Incorporated by reference in § 162.920).

(2) Dental, professional, and institutional health care eligibility benefit inquiry and response. The ASC X12N 270/271—Health Care Eligibility Benefit Inquiry and Response, Version 4010, May 2000, Washington Publishing Company, 004010X092 and Addenda to Health Care Eligibility Benefit Inquiry and Response, Version 4010, October 2002, Washington Publishing Company, 004010X092A1. (Incorporated by reference in § 162.920).

(b) For the period from March 17, 2009 through December 31, 2011 both:

(1) The standards identified in paragraph (a) of this section; and

(2)(i) Retail pharmacy drugs. The Telecommunication Standard Implementation Guide Version D, Release 0 (Version D.0), August 2007, and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs. (Incorporated by reference in § 162.920.)

(ii) Dental, professional, and institutional health care eligibility benefit inquiry and response. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Eligibility Benefit Inquiry and Response (270/271), April 2008, ASC X12N/005010X279. (Incorporated by reference in § 162.920.)

(c) For the period from January 1, 2012 through August 14, 2027, the standards identified in paragraph (b)(2) of this section.

(d) For the period from August 14, 2027 through April 14, 2028, both of the following:

(1) The standards identified in paragraph (c) of this section.

(2) The following standards:

(i) Retail pharmacy drugs. The NCPDP Telecommunication Standard Implementation Guide Version F6, January 2020 and equivalent NCPDP Batch Standard Implementation Guide, Version 15, October 2017 (both incorporated by reference in § 162.920).

(ii) Dental, professional, and institutional health care eligibility benefit inquiry and response. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Eligibility Benefit Inquiry and Response (270/271), April 2008, ASC X12N/005010X279 (incorporated by reference in § 162.920).

(e) For the period on and after April 14, 2028, the standards identified in paragraph (d)(2) of this section.

[68 FR 8398, Feb. 20, 2003; 68 FR 11445, Mar. 10, 2003, as amended at 74 FR 3326, Jan. 16, 2009; 89 FR 100788, Dec. 13, 2024; 90 FR 40749, Aug. 21, 2025]

§ 162.1203 Operating rules for eligibility for a health plan transaction.

On and after January 1, 2013, the Secretary adopts the following:

(a) Except as specified in paragraph (b) of this section, the following CAQH CORE Phase I and Phase II operating rules (updated for Version 5010) for the eligibility for a health plan transaction:

(1) Phase I CORE 152: Eligibility and Benefit Real Time Companion Guide Rule, version 1.1.0, March 2011, and CORE v5010 Master Companion Guide Template. (Incorporated by reference in § 162.920).

(2) Phase I CORE 153: Eligibility and Benefits Connectivity Rule, version 1.1.0, March 2011. (Incorporated by reference in § 162.920).

(3) Phase I CORE 154: Eligibility and Benefits 270/271 Data Content Rule, version 1.1.0, March 2011. (Incorporated by reference in § 162.920).

(4) Phase I CORE 155: Eligibility and Benefits Batch Response Time Rule, version 1.1.0, March 2011. (Incorporated by reference in § 162.920).

(5) Phase I CORE 156: Eligibility and Benefits Real Time Response Rule, version 1.1.0, March 2011. (Incorporated by reference in § 162.920).

(6) Phase I CORE 157: Eligibility and Benefits System Availability Rule, version 1.1.0, March 2011. (Incorporated by reference in § 162.920).

(7) Phase II CORE 258: Eligibility and Benefits 270/271 Normalizing Patient Last Name Rule, version 2.1.0, March 2011. (Incorporated by reference in § 162.920).

(8) Phase II CORE 259: Eligibility and Benefits 270/271 AAA Error Code Reporting Rule, version 2.1.0. (Incorporated by reference in § 162.920).

(9) Phase II CORE 260: Eligibility & Benefits Data Content (270/271) Rule, version 2.1.0, March 2011. (Incorporated by reference in § 162.920).

(10) Phase II CORE 270: Connectivity Rule, version 2.2.0, March 2011. (Incorporated by reference in § 162.920).

(b) Excluding where the CAQH CORE rules reference and pertain to acknowledgements and CORE certification.

[76 FR 40496, July 8, 2011]

§ 162.1301 Referral certification and authorization transaction.

The referral certification and authorization transaction is any of the following transmissions:

(a) A request from a health care provider to a health plan for the review of health care to obtain an authorization for the health care.

(b) A request from a health care provider to a health plan to obtain authorization for referring an individual to another health care provider.

(c) A response from a health plan to a health care provider to a request described in paragraph (a) or paragraph (b) of this section.

[74 FR 3326, Jan. 16, 2009]

§ 162.1302 Standards for referral certification and authorization transaction.

The Secretary adopts the following standards for the referral certification and authorization transaction:

(a) For the period from October 16, 2003 through March 16, 2009:

(1) Retail pharmacy drug referral certification and authorization. The NCPDP Telecommunication Standard Implementation Guide, Version 5, Release 1 (Version 5.1), September 1999, and equivalent NCPDP Batch Standard Batch Implementation Guide, Version 1, Release 1 (Version 1.1), January 2000, supporting Telecommunications Standard Implementation Guide, Version 5, Release 1 (Version 5.1) for the NCPDP Data Record in the Detail Data Record. (Incorporated by reference in § 162.920).

(2) Dental, professional, and institutional referral certification and authorization. The ASC X12N 278—Health Care Services Review—Request for Review and Response, Version 4010, May 2000, Washington Publishing Company, 004010X094 and Addenda to Health Care Services Review—Request for Review and Response, Version 4010, October 2002, Washington Publishing Company, 004010X094A1. (Incorporated by reference in § 162.920).

(b) For the period from March 17, 2009 through December 31, 2011 both—

(1) The standards identified in paragraph (a) of this section; and

(2)(i) Retail pharmacy drugs. The Telecommunication Standard Implementation Guide Version D, Release 0 (Version D.0), August 2007, and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs. (Incorporated by reference in § 162.920.)

(ii) Dental, professional, and institutional request for review and response. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Services Review—Request for Review and Response (278), May 2006, ASC X12N/005010X217, and Errata to Health Care Services Review-—Request for Review and Response (278), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, April 2008, ASC X12N/005010X217E1. (Incorporated by reference in § 162.920.)

(c) For the period from January 1, 2012 through August 14, 2027, the standards identified in paragraph (b)(2) of this section.

(d) For the period on and after September 21, 2020 through August 14, 2027, the Quantity Prescribed (460-ET) field, as set forth in the Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007 and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs, must be treated as required where the transmission meets both of the following:

(1) Is for a Schedule II drug, as defined in 21 CFR 1308.12.

(2) Uses the standard identified in paragraph (b)(2)(i) of this section.

(e) For the period from August 14, 2027 through April 14, 2028, both of the following:

(1) The standards identified in paragraph (c) and (d) of this section.

(2) The following standards:

(i) Retail pharmacy drugs. The NCPDP Telecommunication Standard Implementation Guide Version F6, January 2020 and equivalent NCPDP Batch Standard Implementation Guide, Version 15, October 2017 (both incorporated by reference in § 162.920).

(ii) Dental, professional, and institutional request for review and response. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Services Review—Request for Review and Response (278), May 2006, ASC X12N/005010X217, and Errata to Health Care Services Review—Request for Review and Response (278), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, April 2008, ASC X12N/005010X217E1 (both incorporated by reference in § 162.920).

(f) For the period on and after April 14, 2028, the standards identified in paragraph (e)(2) of this section.

[68 FR 8398, Feb. 20, 2003, as amended at 74 FR 3326, Jan. 16, 2009; 85 FR 4242, Jan. 24, 2020; 89 FR 100788, Dec. 13, 2024; 90 FR 40749, Aug. 21, 2025]

§ 162.1401 Health care claim status transaction.

The health care claim status transaction is the transmission of either of the following:

(a) An inquiry from a health care provider to a health plan to determine the status of a health care claim.

(b) A response from a health plan to a health care provider about the status of a health care claim.

[74 FR 3326, Jan. 16, 2009]

§ 162.1402 Standards for health care claim status transaction.

The Secretary adopts the following standards for the health care claim status transaction:

(a) For the period from October 16, 2003 through March 16, 2009: The ASC X12N-276/277 Health Care Claim Status Request and Response, Version 4010, May 2000, Washington Publishing Company, 004010X093 and Addenda to Health Care Claim Status Request and Response, Version 4010, October 2002, Washington Publishing Company, 004010X093A1. (Incorporated by reference in § 162.920.)

(b) For the period from March 17, 2009 through December 31, 2011, both:

(1) The standard identified in paragraph (a) of this section; and

(2) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim Status Request and Response (276/277), August 2006, ASC X12N/005010X212, and Errata to Health Care Claim Status Request and Response (276/277), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, April 2008, ASC X12N/005010X212E1. (Incorporated by reference in § 162.920.)

(c) For the period on and after January 1, 2012, the standard identified in paragraph (b)(2) of this section.

[74 FR 3326, Jan. 16, 2009]

§ 162.1403 Operating rules for health care claim status transaction.

On and after January 1, 2013, the Secretary adopts the following:

(a) Except as specified in paragraph (b) of this section, the following CAQH CORE Phase II operating rules (updated for Version 5010) for the health care claim status transaction:

(1) Phase II CORE 250: Claim Status Rule, version 2.1.0, March 2011, and CORE v5010 Master Companion Guide, 00510, 1.2, March 2011. (Incorporated by reference in § 162.920).

(2) Phase II CORE 270: Connectivity Rule, version 2.2.0, March 2011. (Incorporated by reference in § 162.920).

(b) Excluding where the CAQH CORE rules reference and pertain to acknowledgements and CORE certification.

[76 FR 40496, July 8, 2011]

§ 162.1501 Enrollment and disenrollment in a health plan transaction.

The enrollment and disenrollment in a health plan transaction is the transmission of subscriber enrollment information from the sponsor of the insurance coverage, benefits, or policy, to a health plan to establish or terminate insurance coverage.

[74 FR 3327, Jan. 16, 2009]

§ 162.1502 Standards for enrollment and disenrollment in a health plan transaction.

The Secretary adopts the following standards for enrollment and disenrollment in a health plan transaction.

(a) For the period from October 16, 2003 through March 16, 2009: ASC X12N 834—Benefit Enrollment and Maintenance, Version 4010, May 2000, Washington Publishing Company, 004010X095 and Addenda to Benefit Enrollment and Maintenance, Version 4010, October 2002, Washington Publishing Company, 004010X095A1. (Incorporated by reference in § 162.920.)

(b) For the period from March 17, 2009 through December 31, 2011, both:

(1) The standard identified in paragraph (a) of this section; and

(2) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Benefit Enrollment and Maintenance (834), August 2006, ASC X12N/005010X220 (Incorporated by reference in § 162.920)

(c) For the period on and after January 1, 2012, the standard identified in paragraph (b)(2) of this section.

[74 FR 3327, Jan. 16, 2009]

§ 162.1601 Health care electronic funds transfers (EFT) and remittance advice transaction.

The health care electronic funds transfers (EFT) and remittance advice transaction is the transmission of either of the following for health care:

(a) The transmission of any of the following from a health plan to a health care provider:

(1) Payment.

(2) Information about the transfer of funds.

(3) Payment processing information.

(b) The transmission of either of the following from a health plan to a health care provider:

(1) Explanation of benefits.

(2) Remittance advice.

[65 FR 50367, Aug. 17, 2000, as amended at 77 FR 1590, Jan. 10, 2012; 77 FR 48043, Aug. 10, 2012]

§ 162.1602 Standards for health care electronic funds transfers (EFT) and remittance advice transaction.

The Secretary adopts the following standards:

(a) For the period from October 16, 2003 through March 16, 2009: Health care claims and remittance advice. The ASC X12N 835—Health Care Claim Payment/Advice, Version 4010, May 2000, Washington Publishing Company, 004010X091, and Addenda to Health Care Claim Payment/Advice, Version 4010, October 2002, Washington Publishing Company, 004010X091A1. (Incorporated by reference in § 162.920.)

(b) For the period from March 17, 2009 through December 31, 2011, both of the following standards:

(1) The standard identified in paragraph (a) of this section.

(2) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim Payment/Advice (835), April 2006, ASC X12N/005010X221. (Incorporated by reference in § 162.920.)

(c) For the period from January 1, 2012 through December 31, 2013, the standard identified in paragraph (b)(2) of this section.

(d) For the period on and after January 1, 2014, the following standards:

(1) Except when transmissions as described in § 162.1601(a) and (b) are contained within the same transmission, for Stage 1 Payment Initiation transmissions described in § 162.1601(a), all of the following standards:

(i) The National Automated Clearing House Association (NACHA) Corporate Credit or Deposit Entry with Addenda Record (CCD+) implementation specifications as contained in the 2011 NACHA Operating Rules & Guidelines, A Complete Guide to the Rules Governing the ACH Network as follows (incorporated by reference in § 162.920)—

(A) NACHA Operating Rules, Appendix One: ACH File Exchange Specifications; and

(B) NACHA Operating Rules, Appendix Three: ACH Record Format Specifications, Subpart 3.1.8 Sequence of Records for CCD Entries.

(ii) For the CCD Addenda Record (“7”), field 3, of the standard identified in 1602(d)(1)(i), the Accredited Standards Committee (ASC) X12 Standards for Electronic Data Interchange Technical Report Type 3, “Health Care Claim Payment/Advice (835), April 2006: Section 2.4: 835 Segment Detail: “TRN Reassociation Trace Number,” Washington Publishing Company, 005010X221 (Incorporated by reference in § 162.920).

(2) For transmissions described in § 162.1601(b), including when transmissions as described in § 162.1601(a) and (b) are contained within the same transmission, the ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, “Health Care Claim Payment/Advice (835), April 2006, ASC X12N/005010X221. (Incorporated by reference in § 162.920).

[77 FR 1590, Jan. 10, 2012]

§ 162.1603 Operating rules for health care electronic funds transfers (EFT) and remittance advice transaction.

On and after January 1, 2014, the Secretary adopts the following for the health care electronic funds transfers (EFT) and remittance advice transaction:

(a) The Phase III CORE EFT & ERA Operating Rule Set, Approved June 2012 (Incorporated by reference in § 162.920) which includes the following rules:

(1) Phase III CORE 380 EFT Enrollment Data Rule, version 3.0.0, June 2012.

(2) Phase III CORE 382 ERA Enrollment Data Rule, version 3.0.0, June 2012.

(3) Phase III 360 CORE Uniform Use of CARCs and RARCs (835) Rule, version 3.0.0, June 2012.

(4) CORE-required Code Combinations for CORE-defined Business Scenarios for the Phase III CORE 360 Uniform Use of Claim Adjustment Reason Codes and Remittance Advice Remark Codes (835) Rule, version 3.0.0, June 2012.

(5) Phase III CORE 370 EFT & ERA Reassociation (CCD+/835) Rule, version 3.0.0, June 2012.

(6) Phase III CORE 350 Health Care Claim Payment/Advice (835) Infrastructure Rule, version 3.0.0, June 2012, except Requirement 4.2 titled “Health Care Claim Payment/Advice Batch Acknowledgement Requirements”.

(b) ACME Health Plan, CORE v5010 Master Companion Guide Template, 005010, 1.2, March 2011 (incorporated by reference in § 162.920), as required by the Phase III CORE 350 Health Care Claim Payment/Advice (835) Infrastructure Rule, version 3.0.0, June 2012.

[77 FR 48043, Aug. 10, 2012]

§ 162.1701 Health plan premium payments transaction.

The health plan premium payment transaction is the transmission of any of the following from the entity that is arranging for the provision of health care or is providing health care coverage payments for an individual to a health plan:

(a) Payment.

(b) Information about the transfer of funds.

(c) Detailed remittance information about individuals for whom premiums are being paid.

(d) Payment processing information to transmit health care premium payments including any of the following:

(1) Payroll deductions.

(2) Other group premium payments.

(3) Associated group premium payment information.

§ 162.1702 Standards for health plan premium payments transaction.

The Secretary adopts the following standards for the health plan premium payments transaction:

(a) For the period from October 16, 2003 through March 16, 2009: The ASC X12N 820—Payroll Deducted and Other Group Premium Payment for Insurance Products, Version 4010, May 2000, Washington Publishing Company, 004010X061, and Addenda to Payroll Deducted and Other Group Premium Payment for Insurance Products, Version 4010, October 2002, Washington Publishing Company, 004010X061A1. (Incorporated by reference in § 162.920.)

(b) For the period from March 17, 2009 through December 31, 2011, both:

(1) The standard identified in paragraph (a) of this section, and

(2) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Payroll Deducted and Other Group Premium Payment for Insurance Products (820), February 2007, ASC X12N/005010X218. (Incorporated by reference in § 162.920.)

(c) For the period on and after January 1, 2012, the standard identified in paragraph (b)(2) of this section.

[74 FR 3327, Jan. 16, 2009]

§ 162.1801 Coordination of benefits transaction.

The coordination of benefits transaction is the transmission from any entity to a health plan for the purpose of determining the relative payment responsibilities of the health plan, of either of the following for health care:

(a) Claims.

(b) Payment information.

§ 162.1802 Standards for coordination of benefits information transaction.

The Secretary adopts the following standards for the coordination of benefits information transaction.

(a) For the period from October 16, 2003 through March 16, 2009:

(1) Retail pharmacy drug claims. The National Council for Prescription Drug Programs Telecommunication Standard Implementation Guide, Version 5, Release 1 (Version 5.1), September 1999, and equivalent NCPDP Batch Standard Batch Implementation Guide, Version 1, Release 1 (Version 1.1), January 2000, supporting Telecommunications Standard Implementation Guide, Version 5, Release 1 (Version 5.1) for the NCPDP Data Record in the Detail Data Record. (Incorporated by reference in § 162.920).

(2) Dental health care claims. The ASC X12N 837—Health Care Claim: Dental, Version 4010, May 2000, Washington Publishing Company, 004010X097 and Addenda to Health Care Claim: Dental, Version 4010, October 2002, Washington Publishing Company, 004010X097A1. (Incorporated by reference in § 162.920).

(3) Professional health care claims. The ASC X12N 837—Health Care Claim: Professional, Volumes 1 and 2, Version 4010, May 2000, Washington Publishing Company, 004010X098 and Addenda to Health Care Claim: Professional, Volumes 1 and 2, Version 4010, October 2002, Washington Publishing Company, 004010X098A1. (Incorporated by reference in § 162.920).

(4) Institutional health care claims. The ASC X12N 837—Health Care Claim: Institutional, Volumes 1 and 2, Version 4010, May 2000, Washington Publishing Company, 004010X096 and Addenda to Health Care Claim: Institutional, Volumes 1 and 2, Version 4010, October 2002, Washington Publishing Company, 004010X096A1. (Incorporated by reference in § 162.920).

(b) For the period from March 17, 2009 through December 31, 2011, both:

(1) The standards identified in paragraph (a) of this section; and

(2)(i) Retail pharmacy drug claims. The Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007, and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs. (Incorporated by reference in § 162.920.)

(ii) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Dental (837), May 2006, ASC X12N/005010X224, and Type 1 Errata to Health Care Claim: Dental (837), ASC X12 Standards for Electronic Date Interchange Technical Report Type 3, October 2007, ASC X12N/005010X224A1. (Incorporated by reference in § 162.920.)

(iii) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Professional (837), May 2006, ASC X12N/005010X222. (Incorporated by reference in § 162.920.)

(iv) The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Institutional (837), May 2006, ASC X12N/005010X223, and Type 1 Errata to Health Care Claim: Institutional (837), ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X223A1. (Incorporated by reference in § 162.920.)

(c) For the period from January 1, 2012 through August 14, 2027, the standards identified in paragraph (b)(2) of this section.

(d) For the period on and after September 21, 2020 through August 14, 2027, the Quantity Prescribed (460-ET) field, as set forth in the Telecommunication Standard Implementation Guide, Version D, Release 0 (Version D.0), August 2007 and equivalent Batch Standard Implementation Guide, Version 1, Release 2 (Version 1.2), National Council for Prescription Drug Programs, must be treated as required where the transmission meets both of the following:

(1) Is for a Schedule II drug, as defined in 21 CFR 1308.12.

(2) Uses the standard identified in paragraph (b)(2)(i) of this section.

(e) For the period from August 14, 2027 through April 14, 2028, both of the following:

(1) The standards identified in paragraphs (c) and (d) of this section.

(2) The following standards:

(i) Retail pharmacy drug claims. The NCPDP Telecommunication Standard Implementation Guide Version F6, January 2020 and equivalent NCPDP Batch Standard Implementation Guide, Version 15, October 2017 (both incorporated by reference in § 162.920).

(ii) Dental health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Dental (837), May 2006, ASC X12N/005010X224, and Type 1 Errata to Health Care Claim: Dental (837) ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X224A1 (both incorporated by reference in § 162.920).

(3) Professional health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Professional (837), May 2006, ASC X12N/005010X222 (incorporated by reference in § 162.920).

(4) Institutional health care claims. The ASC X12 Standards for Electronic Data Interchange Technical Report Type 3—Health Care Claim: Institutional (837), May 2006, ASC X12N/005010X223, and Type 1 Errata to Health Care Claim: Institutional (837) ASC X12 Standards for Electronic Data Interchange Technical Report Type 3, October 2007, ASC X12N/005010X223A1 (incorporated by reference in § 162.920).

(f) For the period on and after April 14, 2028, the standards identified in paragraph (e)(2) of this section.

[68 FR 8399, Feb. 20, 2003, as amended at 74 FR 3327, Jan. 16, 2009; 85 FR 4242, Jan. 24, 2020; 89 FR 100789, Dec. 13, 2024; 90 FR 40749, Aug. 21, 2025]

§ 162.1901 Medicaid pharmacy subrogation transaction.

The Medicaid pharmacy subrogation transaction is the transmission of a claim from a Medicaid agency to a payer for the purpose of seeking reimbursement from the responsible health plan for a pharmacy claim the State has paid on behalf of a Medicaid recipient.

§ 162.1902 Standard for Medicaid pharmacy subrogation transaction.

The Secretary adopts the following standards for the Medicaid pharmacy subrogation transaction:

(a) For the period from January 1, 2012 through August 14, 2027—The NCPDP Batch Standard Medicaid Subrogation Implementation Guide, Version 3.0, July 2007 (incorporated by reference at § 162.920).

(b) For the period from August 14, 2027 through April 14, 2028—

(1) The standards identified in paragraph (a) of this section; and

(2) The NCPDP Subrogation Implementation Guide for Batch Standard, Version 10, September 2019 (incorporated by reference at § 162.920).

(c) For the period on and after April 14, 2028, the standard identified in paragraph (b) of this section.

[89 FR 100789, Dec. 13, 2024, as amended at 90 FR 40749, Aug. 21, 2025]

§ 162.2001 Health care claims attachments transaction.

A health care claims attachments transaction is the transmission of either of the following:

(a) Attachment information from a health care provider to a health plan in support of a health care claims or equivalent encounter transaction, as described in § 162.1101.

(b) A request from a health plan to a health care provider for attachment information.

§ 162.2002 Standards for health care claims attachments transaction.

The Secretary adopts the following standards for the period on and after May 26, 2028:

(a) For transmissions described in § 162.2001, HL7 CDA Release 2: Attachment Implementation Guide: Exchange of C-CDA Based Documents, Release 2—US Realm, Version 2.1.0.1 September 2023 (incorporated by reference, see § 162.920).

(b) For transmissions described in § 162.2001(a)—

(1) HL7 Implementation Guide for CDA Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume One—Introductory Material, August 2015 with 2019 June Errata (incorporated by reference, see § 162.920)

(2) HL7 Implementation Guide for CDA Release 2: Consolidated CDA Templates for Clinical Notes (US Realm) Draft Standard for Trial Use Release 2.1, Volume Two—Templates and Supporting Material, June 2019 (incorporated by reference, see § 162.920).

(c) For transmissions described in § 162.2001(a), the ASC X12N/06020X314—Additional Information to Support a Health Care Claim or Encounter (275) (incorporated by reference, see § 162.920).

(d) For transmissions described in section 162.2001(b) that pertain to § 162.2001(a) transmissions, the ASC X12N/006020X313—Health Care Claim Request for Additional Information (277) (incorporated by reference, see § 162.920).

(e) For transmissions described in § 162.2001(a), where a health care provider uses an electronic signature, the HL7 Implementation Guide for CDA Release 2: Digital Signatures and Delegation of Rights, Release 1, Draft Standard for Trial Use, October 2014 (incorporated by reference, see § 162.920).

§ 164.102 Statutory basis.

The provisions of this part are adopted pursuant to the Secretary's authority to prescribe standards, requirements, and implementation specifications under part C of title XI of the Act, section 264 of Public Law 104-191, and sections 13400-13424 of Public Law 111-5.

[78 FR 5692, Jan. 25, 2013]

§ 164.103 Definitions.

As used in this part, the following terms have the following meanings:

Common control exists if an entity has the power, directly or indirectly, significantly to influence or direct the actions or policies of another entity.

Common ownership exists if an entity or entities possess an ownership or equity interest of 5 percent or more in another entity.

Covered functions means those functions of a covered entity the performance of which makes the entity a health plan, health care provider, or health care clearinghouse.

Health care component means a component or combination of components of a hybrid entity designated by the hybrid entity in accordance with § 164.105(a)(2)(iii)(D).

Hybrid entity means a single legal entity:

(1) That is a covered entity;

(2) Whose business activities include both covered and non-covered functions; and

(3) That designates health care components in accordance with paragraph § 164.105(a)(2)(iii)(D).

Law enforcement official means an officer or employee of any agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, who is empowered by law to:

(1) Investigate or conduct an official inquiry into a potential violation of law; or

(2) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

Plan sponsor is defined as defined at section 3(16)(B) of ERISA, 29 U.S.C. 1002(16)(B).

Required by law means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law. Required by law includes, but is not limited to, court orders and court-ordered warrants; subpoenas or summons issued by a court, grand jury, a governmental or tribal inspector general, or an administrative body authorized to require the production of information; a civil or an authorized investigative demand; Medicare conditions of participation with respect to health care providers participating in the program; and statutes or regulations that require the production of information, including statutes or regulations that require such information if payment is sought under a government program providing public benefits.

[68 FR 8374, Feb. 20, 2003, as amended at 74 FR 42767, Aug. 24, 2009; 78 FR 34266, June 7, 2013]

§ 164.104 Applicability.

(a) Except as otherwise provided, the standards, requirements, and implementation specifications adopted under this part apply to the following entities:

(1) A health plan.

(2) A health care clearinghouse.

(3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.

(b) Where provided, the standards, requirements, and implementation specifications adopted under this part apply to a business associate.

[68 FR 8375, Feb. 20, 2003, as amended at 78 FR 5692, Jan. 25, 2013]

§ 164.105 Organizational requirements.

(a)(1) Standard: Health care component. If a covered entity is a hybrid entity, the requirements of this part, other than the requirements of this section, §§ 164.314, and 164.504, apply only to the health care component(s) of the entity, as specified in this section.

(2) Implementation specifications:

(i) Application of other provisions. In applying a provision of this part, other than the requirements of this section, §§ 164.314, and 164.504, to a hybrid entity:

(A) A reference in such provision to a “covered entity” refers to a health care component of the covered entity;

(B) A reference in such provision to a “health plan,” “covered health care provider,” or “health care clearinghouse,” refers to a health care component of the covered entity if such health care component performs the functions of a health plan, health care provider, or health care clearinghouse, as applicable;

(C) A reference in such provision to “protected health information” refers to protected health information that is created or received by or on behalf of the health care component of the covered entity; and

(D) A reference in such provision to “electronic protected health information” refers to electronic protected health information that is created, received, maintained, or transmitted by or on behalf of the health care component of the covered entity.

(ii) Safeguard requirements. The covered entity that is a hybrid entity must ensure that a health care component of the entity complies with the applicable requirements of this part. In particular, and without limiting this requirement, such covered entity must ensure that:

(A) Its health care component does not disclose protected health information to another component of the covered entity in circumstances in which subpart E of this part would prohibit such disclosure if the health care component and the other component were separate and distinct legal entities;

(B) Its health care component protects electronic protected health information with respect to another component of the covered entity to the same extent that it would be required under subpart C of this part to protect such information if the health care component and the other component were separate and distinct legal entities;

(C) If a person performs duties for both the health care component in the capacity of a member of the workforce of such component and for another component of the entity in the same capacity with respect to that component, such workforce member must not use or disclose protected health information created or received in the course of or incident to the member's work for the health care component in a way prohibited by subpart E of this part.

(iii) Responsibilities of the covered entity. A covered entity that is a hybrid entity has the following responsibilities:

(A) For purposes of subpart C of part 160 of this subchapter, pertaining to compliance and enforcement, the covered entity has the responsibility of complying with this part.

(B) The covered entity is responsible for complying with §§ 164.316(a) and 164.530(i), pertaining to the implementation of policies and procedures to ensure compliance with applicable requirements of this part, including the safeguard requirements in paragraph (a)(2)(ii) of this section.

(C) The covered entity is responsible for complying with §§ 164.314 and 164.504 regarding business associate arrangements and other organizational requirements.

(D) The covered entity is responsible for designating the components that are part of one or more health care components of the covered entity and documenting the designation in accordance with paragraph (c) of this section, provided that, if the covered entity designates one or more health care components, it must include any component that would meet the definition of a covered entity or business associate if it were a separate legal entity. Health care component(s) also may include a component only to the extent that it performs covered functions.

(b)(1) Standard: Affiliated covered entities. Legally separate covered entities that are affiliated may designate themselves as a single covered entity for purposes of this part.

(2) Implementation specifications—(i) Requirements for designation of an affiliated covered entity. (A) Legally separate covered entities may designate themselves (including any health care component of such covered entity) as a single affiliated covered entity, for purposes of this part, if all of the covered entities designated are under common ownership or control.

(B) The designation of an affiliated covered entity must be documented and the documentation maintained as required by paragraph (c) of this section.

(ii) Safeguard requirements. An affiliated covered entity must ensure that it complies with the applicable requirements of this part, including, if the affiliated covered entity combines the functions of a health plan, health care provider, or health care clearinghouse, §§ 164.308(a)(4)(ii)(A) and 164.504(g), as applicable.

(c)(1) Standard: Documentation. A covered entity must maintain a written or electronic record of a designation as required by paragraphs (a) or (b) of this section.

(2) Implementation specification: Retention period. A covered entity must retain the documentation as required by paragraph (c)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

[68 FR 8375, Feb. 20, 2003, as amended at 78 FR 5692, Jan. 25, 2013]

§ 164.106 Relationship to other parts.

In complying with the requirements of this part, covered entities and, where provided, business associates, are required to comply with the applicable provisions of parts 160 and 162 of this subchapter.

[78 FR 5693, Jan. 25, 2013]

§ 164.302 Applicability.

A covered entity or business associate must comply with the applicable standards, implementation specifications, and requirements of this subpart with respect to electronic protected health information of a covered entity.

[78 FR 5693, Jan. 25, 2013]

§ 164.304 Definitions.

As used in this subpart, the following terms have the following meanings:

Access means the ability or the means necessary to read, write, modify, or communicate data/information or otherwise use any system resource. (This definition applies to “access” as used in this subpart, not as used in subparts D or E of this part.)

Administrative safeguards are administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected health information and to manage the conduct of the covered entity's or business associate's workforce in relation to the protection of that information.

Authentication means the corroboration that a person is the one claimed.

Availability means the property that data or information is accessible and useable upon demand by an authorized person.

Confidentiality means the property that data or information is not made available or disclosed to unauthorized persons or processes.

Encryption means the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.

Facility means the physical premises and the interior and exterior of a building(s).

Information system means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people.

Integrity means the property that data or information have not been altered or destroyed in an unauthorized manner.

Malicious software means software, for example, a virus, designed to damage or disrupt a system.

Password means confidential authentication information composed of a string of characters.

Physical safeguards are physical measures, policies, and procedures to protect a covered entity's or business associate's electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion.

Security or Security measures encompass all of the administrative, physical, and technical safeguards in an information system.

Security incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

Technical safeguards means the technology and the policy and procedures for its use that protect electronic protected health information and control access to it.

User means a person or entity with authorized access.

Workstation means an electronic computing device, for example, a laptop or desktop computer, or any other device that performs similar functions, and electronic media stored in its immediate environment.

[68 FR 8376, Feb. 20, 2003, as amended at 74 FR 42767, Aug. 24, 2009; 78 FR 5693, Jan. 25, 2013]

§ 164.306 Security standards: General rules.

(a) General requirements. Covered entities and business associates must do the following:

(1) Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.

(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.

(3) Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part.

(4) Ensure compliance with this subpart by its workforce.

(b) Flexibility of approach. (1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.

(2) In deciding which security measures to use, a covered entity or business associate must take into account the following factors:

(i) The size, complexity, and capabilities of the covered entity or business associate.

(ii) The covered entity's or the business associate's technical infrastructure, hardware, and software security capabilities.

(iii) The costs of security measures.

(iv) The probability and criticality of potential risks to electronic protected health information.

(c) Standards. A covered entity or business associate must comply with the applicable standards as provided in this section and in §§ 164.308, 164.310, 164.312, 164.314 and 164.316 with respect to all electronic protected health information.

(d) Implementation specifications. In this subpart:

(1) Implementation specifications are required or addressable. If an implementation specification is required, the word “Required” appears in parentheses after the title of the implementation specification. If an implementation specification is addressable, the word “Addressable” appears in parentheses after the title of the implementation specification.

(2) When a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes required implementation specifications, a covered entity or business associate must implement the implementation specifications.

(3) When a standard adopted in § 164.308, § 164.310, § 164.312, § 164.314, or § 164.316 includes addressable implementation specifications, a covered entity or business associate must—

(i) Assess whether each implementation specification is a reasonable and appropriate safeguard in its environment, when analyzed with reference to the likely contribution to protecting electronic protected health information; and

(ii) As applicable to the covered entity or business associate—

(A) Implement the implementation specification if reasonable and appropriate; or

(B) If implementing the implementation specification is not reasonable and appropriate—

$(1) Document why it would not be reasonable and appropriate to implement the implementation specification; and

$(2) Implement an equivalent alternative measure if reasonable and appropriate.

(e) Maintenance. A covered entity or business associate must review and modify the security measures implemented under this subpart as needed to continue provision of reasonable and appropriate protection of electronic protected health information, and update documentation of such security measures in accordance with § 164.316(b)(2)(iii).

[68 FR 8376, Feb. 20, 2003; 68 FR 17153, Apr. 8, 2003; 78 FR 5693, Jan. 25, 2013]

§ 164.308 Administrative safeguards.

(a) A covered entity or business associate must, in accordance with § 164.306:

(1)(i) Standard: Security management process. Implement policies and procedures to prevent, detect, contain, and correct security violations.

(ii) Implementation specifications:

(A) Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

(B) Risk management (Required). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).

(C) Sanction policy (Required). Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate.

(D) Information system activity review (Required). Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

(2) Standard: Assigned security responsibility. Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate.

(3)(i) Standard: Workforce security. Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information, as provided under paragraph (a)(4) of this section, and to prevent those workforce members who do not have access under paragraph (a)(4) of this section from obtaining access to electronic protected health information.

(ii) Implementation specifications:

(A) Authorization and/or supervision (Addressable). Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.

(B) Workforce clearance procedure (Addressable). Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.

(C) Termination procedures (Addressable). Implement procedures for terminating access to electronic protected health information when the employment of, or other arrangement with, a workforce member ends or as required by determinations made as specified in paragraph (a)(3)(ii)(B) of this section.

(4)(i) Standard: Information access management. Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.

(ii) Implementation specifications:

(A) Isolating health care clearinghouse functions (Required). If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.

(B) Access authorization (Addressable). Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism.

(C) Access establishment and modification (Addressable). Implement policies and procedures that, based upon the covered entity's or the business associate's access authorization policies, establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process.

(5)(i) Standard: Security awareness and training. Implement a security awareness and training program for all members of its workforce (including management).

(ii) Implementation specifications. Implement:

(A) Security reminders (Addressable). Periodic security updates.

(B) Protection from malicious software (Addressable). Procedures for guarding against, detecting, and reporting malicious software.

(C) Log-in monitoring (Addressable). Procedures for monitoring log-in attempts and reporting discrepancies.

(D) Password management (Addressable). Procedures for creating, changing, and safeguarding passwords.

(6)(i) Standard: Security incident procedures. Implement policies and procedures to address security incidents.

(ii) Implementation specification: Response and reporting (Required). Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.

(7)(i) Standard: Contingency plan. Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.

(ii) Implementation specifications:

(A) Data backup plan (Required). Establish and implement procedures to create and maintain retrievable exact copies of electronic protected health information.

(B) Disaster recovery plan (Required). Establish (and implement as needed) procedures to restore any loss of data.

(C) Emergency mode operation plan (Required). Establish (and implement as needed) procedures to enable continuation of critical business processes for protection of the security of electronic protected health information while operating in emergency mode.

(D) Testing and revision procedures (Addressable). Implement procedures for periodic testing and revision of contingency plans.

(E) Applications and data criticality analysis (Addressable). Assess the relative criticality of specific applications and data in support of other contingency plan components.

(8) Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart.

(b)(1) Business associate contracts and other arrangements. A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(2) A business associate may permit a business associate that is a subcontractor to create, receive, maintain, or transmit electronic protected health information on its behalf only if the business associate obtains satisfactory assurances, in accordance with § 164.314(a), that the subcontractor will appropriately safeguard the information.

(3) Implementation specifications: Written contract or other arrangement (Required). Document the satisfactory assurances required by paragraph (b)(1) or (b)(2) of this section through a written contract or other arrangement with the business associate that meets the applicable requirements of § 164.314(a).

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

§ 164.310 Physical safeguards.

A covered entity or business associate must, in accordance with § 164.306:

(a)(1) Standard: Facility access controls. Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed.

(2) Implementation specifications:

(i) Contingency operations (Addressable). Establish (and implement as needed) procedures that allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency.

(ii) Facility security plan (Addressable). Implement policies and procedures to safeguard the facility and the equipment therein from unauthorized physical access, tampering, and theft.

(iii) Access control and validation procedures (Addressable). Implement procedures to control and validate a person's access to facilities based on their role or function, including visitor control, and control of access to software programs for testing and revision.

(iv) Maintenance records (Addressable). Implement policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (for example, hardware, walls, doors, and locks).

(b) Standard: Workstation use. Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access electronic protected health information.

(c) Standard: Workstation security. Implement physical safeguards for all workstations that access electronic protected health information, to restrict access to authorized users.

(d)(1) Standard: Device and media controls. Implement policies and procedures that govern the receipt and removal of hardware and electronic media that contain electronic protected health information into and out of a facility, and the movement of these items within the facility.

(2) Implementation specifications:

(i) Disposal (Required). Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored.

(ii) Media re-use (Required). Implement procedures for removal of electronic protected health information from electronic media before the media are made available for re-use.

(iii) Accountability (Addressable). Maintain a record of the movements of hardware and electronic media and any person responsible therefore.

(iv) Data backup and storage (Addressable). Create a retrievable, exact copy of electronic protected health information, when needed, before movement of equipment.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

§ 164.312 Technical safeguards.

A covered entity or business associate must, in accordance with § 164.306:

(a)(1) Standard: Access control. Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights as specified in § 164.308(a)(4).

(2) Implementation specifications:

(i) Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.

(ii) Emergency access procedure (Required). Establish (and implement as needed) procedures for obtaining necessary electronic protected health information during an emergency.

(iii) Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

(iv) Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information.

(b) Standard: Audit controls. Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.

(c)(1) Standard: Integrity. Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.

(2) Implementation specification: Mechanism to authenticate electronic protected health information (Addressable). Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.

(d) Standard: Person or entity authentication. Implement procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed.

(e)(1) Standard: Transmission security. Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.

(2) Implementation specifications:

(i) Integrity controls (Addressable). Implement security measures to ensure that electronically transmitted electronic protected health information is not improperly modified without detection until disposed of.

(ii) Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013]

§ 164.314 Organizational requirements.

(a)(1) Standard: Business associate contracts or other arrangements. The contract or other arrangement required by § 164.308(b)(3) must meet the requirements of paragraph (a)(2)(i), (a)(2)(ii), or (a)(2)(iii) of this section, as applicable.

(2) Implementation specifications (Required)—(i) Business associate contracts. The contract must provide that the business associate will—

(A) Comply with the applicable requirements of this subpart;

(B) In accordance with § 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of the business associate agree to comply with the applicable requirements of this subpart by entering into a contract or other arrangement that complies with this section; and

(C) Report to the covered entity any security incident of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410.

(ii) Other arrangements. The covered entity is in compliance with paragraph (a)(1) of this section if it has another arrangement in place that meets the requirements of § 164.504(e)(3).

(iii) Business associate contracts with subcontractors. The requirements of paragraphs (a)(2)(i) and (a)(2)(ii) of this section apply to the contract or other arrangement between a business associate and a subcontractor required by § 164.308(b)(4) in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.

(b)(1) Standard: Requirements for group health plans. Except when the only electronic protected health information disclosed to a plan sponsor is disclosed pursuant to § 164.504(f)(1)(ii) or (iii), or as authorized under § 164.508, a group health plan must ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard electronic protected health information created, received, maintained, or transmitted to or by the plan sponsor on behalf of the group health plan.

(2) Implementation specifications (Required). The plan documents of the group health plan must be amended to incorporate provisions to require the plan sponsor to—

(i) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of the group health plan;

(ii) Ensure that the adequate separation required by § 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures;

(iii) Ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures to protect the information; and

(iv) Report to the group health plan any security incident of which it becomes aware.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5694, Jan. 25, 2013; 78 FR 34266, June 7, 2013]

§ 164.316 Policies and procedures and documentation requirements.

A covered entity or business associate must, in accordance with § 164.306:

(a) Standard: Policies and procedures. Implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of this subpart, taking into account those factors specified in § 164.306(b)(2)(i), (ii), (iii), and (iv). This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirements of this subpart. A covered entity or business associate may change its policies and procedures at any time, provided that the changes are documented and are implemented in accordance with this subpart.

(b)(1) Standard: Documentation. (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and

(ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.

(2) Implementation specifications:

(i) Time limit (Required). Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later.

(ii) Availability (Required). Make documentation available to those persons responsible for implementing the procedures to which the documentation pertains.

(iii) Updates (Required). Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.

[68 FR 8376, Feb. 20, 2003, as amended at 78 FR 5695, Jan. 25, 2013]

§ 164.318 Compliance dates for the initial implementation of the security standards.

(a) Health plan. (1) A health plan that is not a small health plan must comply with the applicable requirements of this subpart no later than April 20, 2005.

(2) A small health plan must comply with the applicable requirements of this subpart no later than April 20, 2006.

(b) Health care clearinghouse. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 20, 2005.

(c) Health care provider. A covered health care provider must comply with the applicable requirements of this subpart no later than April 20, 2005.

§ 164.400 Applicability.

The requirements of this subpart shall apply with respect to breaches of protected health information occurring on or after September 23, 2009.

§ 164.402 Definitions.

As used in this subpart, the following terms have the following meanings:

Breach means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E of this part which compromises the security or privacy of the protected health information.

(1) Breach excludes:

(i) Any unintentional acquisition, access, or use of protected health information by a workforce member or person acting under the authority of a covered entity or a business associate, if such acquisition, access, or use was made in good faith and within the scope of authority and does not result in further use or disclosure in a manner not permitted under subpart E of this part.

(ii) Any inadvertent disclosure by a person who is authorized to access protected health information at a covered entity or business associate to another person authorized to access protected health information at the same covered entity or business associate, or organized health care arrangement in which the covered entity participates, and the information received as a result of such disclosure is not further used or disclosed in a manner not permitted under subpart E of this part.

(iii) A disclosure of protected health information where a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

(2) Except as provided in paragraph (1) of this definition, an acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

(i) The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;

(ii) The unauthorized person who used the protected health information or to whom the disclosure was made;

(iii) Whether the protected health information was actually acquired or viewed; and

(iv) The extent to which the risk to the protected health information has been mitigated.

Unsecured protected health information means protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of Public Law 111-5.

[78 FR 5695, Jan. 25, 2013]

§ 164.404 Notification to individuals.

(a) Standard—(1) General rule. A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.

(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, §§ 164.406(a), and 164.408(a), a breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity. A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity (determined in accordance with the federal common law of agency).

(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification—(1) Elements. The notification required by paragraph (a) of this section shall include, to the extent possible:

(A) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;

(B) A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);

(C) Any steps individuals should take to protect themselves from potential harm resulting from the breach;

(D) A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and

(E) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.

(2) Plain language requirement. The notification required by paragraph (a) of this section shall be written in plain language.

(d) Implementation specifications: Methods of individual notification. The notification required by paragraph (a) of this section shall be provided in the following form:

(1) Written notice. (i) Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail. The notification may be provided in one or more mailings as information is available.

(ii) If the covered entity knows the individual is deceased and has the address of the next of kin or personal representative of the individual (as specified under § 164.502(g)(4) of subpart E), written notification by first-class mail to either the next of kin or personal representative of the individual. The notification may be provided in one or more mailings as information is available.

(2) Substitute notice. In the case in which there is insufficient or out-of-date contact information that precludes written notification to the individual under paragraph (d)(1)(i) of this section, a substitute form of notice reasonably calculated to reach the individual shall be provided. Substitute notice need not be provided in the case in which there is insufficient or out-of-date contact information that precludes written notification to the next of kin or personal representative of the individual under paragraph (d)(1)(ii).

(i) In the case in which there is insufficient or out-of-date contact information for fewer than 10 individuals, then such substitute notice may be provided by an alternative form of written notice, telephone, or other means.

(ii) In the case in which there is insufficient or out-of-date contact information for 10 or more individuals, then such substitute notice shall:

(A) Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and

(B) Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.

(3) Additional notice in urgent situations. In any case deemed by the covered entity to require urgency because of possible imminent misuse of unsecured protected health information, the covered entity may provide information to individuals by telephone or other means, as appropriate, in addition to notice provided under paragraph (d)(1) of this section.

§ 164.406 Notification to the media.

(a) Standard. For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, a covered entity shall, following the discovery of the breach as provided in § 164.404(a)(2), notify prominent media outlets serving the State or jurisdiction.

(b) Implementation specification: Timeliness of notification. Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification. The notification required by paragraph (a) of this section shall meet the requirements of § 164.404(c).

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

§ 164.408 Notification to the Secretary.

(a) Standard. A covered entity shall, following the discovery of a breach of unsecured protected health information as provided in § 164.404(a)(2), notify the Secretary.

(b) Implementation specifications: Breaches involving 500 or more individuals. For breaches of unsecured protected health information involving 500 or more individuals, a covered entity shall, except as provided in § 164.412, provide the notification required by paragraph (a) of this section contemporaneously with the notice required by § 164.404(a) and in the manner specified on the HHS Web site.

(c) Implementation specifications: Breaches involving less than 500 individuals. For breaches of unsecured protected health information involving less than 500 individuals, a covered entity shall maintain a log or other documentation of such breaches and, not later than 60 days after the end of each calendar year, provide the notification required by paragraph (a) of this section for breaches discovered during the preceding calendar year, in the manner specified on the HHS web site.

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

§ 164.410 Notification by a business associate.

(a) Standard—(1) General rule. A business associate shall, following the discovery of a breach of unsecured protected health information, notify the covered entity of such breach.

(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, a breach shall be treated as discovered by a business associate as of the first day on which such breach is known to the business associate or, by exercising reasonable diligence, would have been known to the business associate. A business associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the business associate (determined in accordance with the Federal common law of agency).

(b) Implementation specifications: Timeliness of notification. Except as provided in § 164.412, a business associate shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.

(c) Implementation specifications: Content of notification. (1) The notification required by paragraph (a) of this section shall include, to the extent possible, the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the business associate to have been, accessed, acquired, used, or disclosed during the breach.

(2) A business associate shall provide the covered entity with any other available information that the covered entity is required to include in notification to the individual under § 164.404(c) at the time of the notification required by paragraph (a) of this section or promptly thereafter as information becomes available.

[74 FR 42767, Aug. 24, 2009, as amended at 78 FR 5695, Jan. 25, 2013]

§ 164.412 Law enforcement delay.

If a law enforcement official states to a covered entity or business associate that a notification, notice, or posting required under this subpart would impede a criminal investigation or cause damage to national security, a covered entity or business associate shall:

(a) If the statement is in writing and specifies the time for which a delay is required, delay such notification, notice, or posting for the time period specified by the official; or

(b) If the statement is made orally, document the statement, including the identity of the official making the statement, and delay the notification, notice, or posting temporarily and no longer than 30 days from the date of the oral statement, unless a written statement as described in paragraph (a) of this section is submitted during that time.

§ 164.414 Administrative requirements and burden of proof.

(a) Administrative requirements. A covered entity is required to comply with the administrative requirements of § 164.530(b), (d), (e), (g), (h), (i), and (j) with respect to the requirements of this subpart.

(b) Burden of proof. In the event of a use or disclosure in violation of subpart E, the covered entity or business associate, as applicable, shall have the burden of demonstrating that all notifications were made as required by this subpart or that the use or disclosure did not constitute a breach, as defined at § 164.402.

§ 164.500 Applicability.

(a) Except as otherwise provided herein, the standards, requirements, and implementation specifications of this subpart apply to covered entities with respect to protected health information.

(b) Health care clearinghouses must comply with the standards, requirements, and implementation specifications as follows:

(1) When a health care clearinghouse creates or receives protected health information as a business associate of another covered entity, the clearinghouse must comply with:

(i) Section 164.500 relating to applicability;

(ii) Section 164.501 relating to definitions;

(iii) Section 164.502 relating to uses and disclosures of protected health information, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;

(iv) Section 164.504 relating to the organizational requirements for covered entities;

(v) Section 164.512 relating to uses and disclosures for which individual authorization or an opportunity to agree or object is not required, except that a clearinghouse is prohibited from using or disclosing protected health information other than as permitted in the business associate contract under which it created or received the protected health information;

(vi) Section 164.532 relating to transition requirements; and

(vii) Section 164.534 relating to compliance dates for initial implementation of the privacy standards.

(2) When a health care clearinghouse creates or receives protected health information other than as a business associate of a covered entity, the clearinghouse must comply with all of the standards, requirements, and implementation specifications of this subpart.

(c) Where provided, the standards, requirements, and implementation specifications adopted under this subpart apply to a business associate with respect to the protected health information of a covered entity.

(d) The standards, requirements, and implementation specifications of this subpart do not apply to the Department of Defense or to any other federal agency, or non-governmental organization acting on its behalf, when providing health care to overseas foreign national beneficiaries.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5695, Jan. 25, 2013]

§ 164.501 Definitions.

As used in this subpart, the following terms have the following meanings:

Correctional institution means any penal or correctional facility, jail, reformatory, detention center, work farm, halfway house, or residential community program center operated by, or under contract to, the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, for the confinement or rehabilitation of persons charged with or convicted of a criminal offense or other persons held in lawful custody. Other persons held in lawful custody includes juvenile offenders adjudicated delinquent, aliens detained awaiting deportation, persons committed to mental institutions through the criminal justice system, witnesses, or others awaiting charges or trial.

Data aggregation means, with respect to protected health information created or received by a business associate in its capacity as the business associate of a covered entity, the combining of such protected health information by the business associate with the protected health information received by the business associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities.

Designated record set means:

(1) A group of records maintained by or for a covered entity that is:

(i) The medical records and billing records about individuals maintained by or for a covered health care provider;

(ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or

(iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals.

(2) For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.

Direct treatment relationship means a treatment relationship between an individual and a health care provider that is not an indirect treatment relationship.

Health care operations means any of the following activities of the covered entity to the extent that the activities are related to covered functions:

(1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20); population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment;

(2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities;

(3) Except as prohibited under § 164.502(a)(5)(i), underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance), provided that the requirements of § 164.514(g) are met, if applicable;

(4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs;

(5) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies; and

(6) Business management and general administrative activities of the entity, including, but not limited to:

(i) Management activities relating to implementation of and compliance with the requirements of this subchapter;

(ii) Customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer.

(iii) Resolution of internal grievances;

(iv) The sale, transfer, merger, or consolidation of all or part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity; and

(v) Consistent with the applicable requirements of § 164.514, creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity.

Health oversight agency means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is authorized by law to oversee the health care system (whether public or private) or government programs in which health information is necessary to determine eligibility or compliance, or to enforce civil rights laws for which health information is relevant.

Indirect treatment relationship means a relationship between an individual and a health care provider in which:

(1) The health care provider delivers health care to the individual based on the orders of another health care provider; and

(2) The health care provider typically provides services or products, or reports the diagnosis or results associated with the health care, directly to another health care provider, who provides the services or products or reports to the individual.

Inmate means a person incarcerated in or otherwise confined to a correctional institution.

Marketing:

(1) Except as provided in paragraph (2) of this definition, marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

(2) Marketing does not include a communication made:

(i) To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication.

(ii) For the following treatment and health care operations purposes, except where the covered entity receives financial remuneration in exchange for making the communication:

(A) For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual;

(B) To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health-related products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits; or

(C) For case management or care coordination, contacting of individuals with information about treatment alternatives, and related functions to the extent these activities do not fall within the definition of treatment.

(3) Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described. Direct or indirect payment does not include any payment for treatment of an individual.

Payment means:

(1) The activities undertaken by:

(i) Except as prohibited under § 164.502(a)(5)(i), a health plan to obtain premiums or to determine or fulfill its responsibility for coverage and provision of benefits under the health plan; or

(ii) A health care provider or health plan to obtain or provide reimbursement for the provision of health care; and

(2) The activities in paragraph (1) of this definition relate to the individual to whom health care is provided and include, but are not limited to:

(i) Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;

(ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics;

(iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing;

(iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges;

(v) Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and

(vi) Disclosure to consumer reporting agencies of any of the following protected health information relating to collection of premiums or reimbursement:

(A) Name and address;

(B) Date of birth;

(C) Social security number;

(D) Payment history;

(E) Account number; and

(F) Name and address of the health care provider and/or health plan.

Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.

Public health authority means an agency or authority of the United States, a State, a territory, a political subdivision of a State or territory, or an Indian tribe, or a person or entity acting under a grant of authority from or contract with such public agency, including the employees or agents of such public agency or its contractors or persons or entities to whom it has granted authority, that is responsible for public health matters as part of its official mandate.

Research means a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.

Treatment means the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53266, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 74 FR 42769, Aug. 24, 2009; 78 FR 5695, Jan. 25, 2013]

§ 164.502 Uses and disclosures of protected health information: General rules.

(a) Standard. A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter.

(1) Covered entities: Permitted uses and disclosures. A covered entity is permitted to use or disclose protected health information as follows:

(i) To the individual;

(ii) For treatment, payment, or health care operations, as permitted by and in compliance with § 164.506;

(iii) Incident to a use or disclosure otherwise permitted or required by this subpart, provided that the covered entity has complied with the applicable requirements of §§ 164.502(b), 164.514(d), and 164.530(c) with respect to such otherwise permitted or required use or disclosure;

(iv) Except for uses and disclosures prohibited under § 164.502(a)(5)(i), pursuant to and in compliance with a valid authorization under § 164.508;

(v) Pursuant to an agreement under, or as otherwise permitted by, § 164.510; and

(vi) As permitted by and in compliance with any of the following:

(A) This section.

(B) Section 164.512 and, where applicable, § 164.509.

(C) Section 164.514(e), (f), or (g).

(2) Covered entities: Required disclosures. A covered entity is required to disclose protected health information:

(i) To an individual, when requested under, and required by § 164.524 or § 164.528; and

(ii) When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the covered entity's compliance with this subchapter.

(3) Business associates: Permitted uses and disclosures. A business associate may use or disclose protected health information only as permitted or required by its business associate contract or other arrangement pursuant to § 164.504(e) or as required by law. The business associate may not use or disclose protected health information in a manner that would violate the requirements of this subpart, if done by the covered entity, except for the purposes specified under § 164.504(e)(2)(i)(A) or (B) if such uses or disclosures are permitted by its contract or other arrangement.

(4) Business associates: Required uses and disclosures. A business associate is required to disclose protected health information:

(i) When required by the Secretary under subpart C of part 160 of this subchapter to investigate or determine the business associate's compliance with this subchapter.

(ii) To the covered entity, individual, or individual's designee, as necessary to satisfy a covered entity's obligations under § 164.524(c)(2)(ii) and (3)(ii) with respect to an individual's request for an electronic copy of protected health information.

(5) Prohibited uses and disclosures—(i) Use and disclosure of genetic information for underwriting purposes: Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan:

(A) Except as provided in paragraph (a)(5)(i)(B) of this section:

(1) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);

(2) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);

(3) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and

(4) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.

(B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.

(ii) Sale of protected health information:

(A) Except pursuant to and in compliance with § 164.508(a)(4), a covered entity or business associate may not sell protected health information.

(B) For purposes of this paragraph, sale of protected health information means:

(1) Except as provided in paragraph (a)(5)(ii)(B)(2) of this section, a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information.

(2) Sale of protected health information does not include a disclosure of protected health information:

(i) For public health purposes pursuant to § 164.512(b) or § 164.514(e);

(ii) For research purposes pursuant to § 164.512(i) or § 164.514(e), where the only remuneration received by the covered entity or business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes;

(iii) For treatment and payment purposes pursuant to § 164.506(a);

(iv) For the sale, transfer, merger, or consolidation of all or part of the covered entity and for related due diligence as described in paragraph (6)(iv) of the definition of health care operations and pursuant to § 164.506(a);

(v) To or by a business associate for activities that the business associate undertakes on behalf of a covered entity, or on behalf of a business associate in the case of a subcontractor, pursuant to §§ 164.502(e) and 164.504(e), and the only remuneration provided is by the covered entity to the business associate, or by the business associate to the subcontractor, if applicable, for the performance of such activities;

(vi) To an individual, when requested under § 164.524 or § 164.528;

(vii) Required by law as permitted under § 164.512(a); and

(viii) For any other purpose permitted by and in accordance with the applicable requirements of this subpart, where the only remuneration received by the covered entity or business associate is a reasonable, cost-based fee to cover the cost to prepare and transmit the protected health information for such purpose or a fee otherwise expressly permitted by other law.

(iii) Reproductive health care—(A) Prohibition. Subject to paragraphs (a)(5)(iii)(B) and (C) of this section, a covered entity or business associate may not use or disclose protected health information for any of the following activities:

(1) To conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

(2) To impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

(3) To identify any person for any purpose described in paragraphs (a)(5)(iii)(A)(1) or (2) of this section.

(B) Rule of applicability. The prohibition at paragraph (a)(5)(iii)(A) of this section applies only where the relevant activity is in connection with any person seeking, obtaining, providing, or facilitating reproductive health care, and the covered entity or business associate that received the request for protected health information has reasonably determined that one or more of the following conditions exists:

(1) The reproductive health care is lawful under the law of the state in which such health care is provided under the circumstances in which it is provided.

(2) The reproductive health care is protected, required, or authorized by Federal law, including the United States Constitution, under the circumstances in which such health care is provided, regardless of the state in which it is provided.

(3) The presumption at paragraph (a)(5)(iii)(C) of this section applies.

(C) Presumption. The reproductive health care provided by another person is presumed lawful under paragraph (a)(5)(iii)(B)(1) or (2) of this section unless the covered entity or business associate has any of the following:

(1) Actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided.

(2) Factual information supplied by the person requesting the use or disclosure of protected health information that demonstrates a substantial factual basis that the reproductive health care was not lawful under the specific circumstances in which it was provided.

(D) Scope. For the purposes of this subpart, seeking, obtaining, providing, or facilitating reproductive health care includes, but is not limited to, any of the following: expressing interest in, using, performing, furnishing, paying for, disseminating information about, arranging, insuring, administering, authorizing, providing coverage for, approving, counseling about, assisting, or otherwise taking action to engage in reproductive health care; or attempting any of the same.

(b) Standard: Minimum necessary— Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

(2) Minimum necessary does not apply. This requirement does not apply to:

(i) Disclosures to or requests by a health care provider for treatment;

(ii) Uses or disclosures made to the individual, as permitted under paragraph (a)(1)(i) of this section or as required by paragraph (a)(2)(i) of this section;

(iii) Uses or disclosures made pursuant to an authorization under § 164.508;

(iv) Disclosures made to the Secretary in accordance with subpart C of part 160 of this subchapter;

(v) Uses or disclosures that are required by law, as described by § 164.512(a); and

(vi) Uses or disclosures that are required for compliance with applicable requirements of this subchapter.

(c) Standard: Uses and disclosures of protected health information subject to an agreed upon restriction. A covered entity that has agreed to a restriction pursuant to § 164.522(a)(1) may not use or disclose the protected health information covered by the restriction in violation of such restriction, except as otherwise provided in § 164.522(a).

(d) Standard: Uses and disclosures of de-identified protected health information—(1) Uses and disclosures to create de-identified information. A covered entity may use protected health information to create information that is not individually identifiable health information or disclose protected health information only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity.

(2) Uses and disclosures of de-identified information. Health information that meets the standard and implementation specifications for de-identification under § 164.514(a) and (b) is considered not to be individually identifiable health information, i.e., de-identified. The requirements of this subpart do not apply to information that has been de-identified in accordance with the applicable requirements of § 164.514, provided that:

(i) Disclosure of a code or other means of record identification designed to enable coded or otherwise de-identified information to be re-identified constitutes disclosure of protected health information; and

(ii) If de-identified information is re-identified, a covered entity may use or disclose such re-identified information only as permitted or required by this subpart.

(e)(1) Standard: Disclosures to business associates. (i) A covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

(ii) A business associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit protected health information on its behalf, if the business associate obtains satisfactory assurances, in accordance with § 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

(2) Implementation specification: Documentation. The satisfactory assurances required by paragraph (e)(1) of this section must be documented through a written contract or other written agreement or arrangement with the business associate that meets the applicable requirements of § 164.504(e).

(f) Standard: Deceased individuals. A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.

(g)(1) Standard: Personal representatives. As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter.

(2) Implementation specification: Adults and emancipated minors. If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

(3)(i) Implementation specification: Unemancipated minors. If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if:

(A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative;

(B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person authorized by law consents to such health care service; or

(C) A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.

(ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section:

(A) If, and to the extent, permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or provide access in accordance with § 164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis;

(B) If, and to the extent, prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or provide access in accordance with § 164.524 to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; and

(C) Where the parent, guardian, or other person acting in loco parentis, is not the personal representative under paragraphs (g)(3)(i)(A), (B), or (C) of this section and where there is no applicable access provision under State or other law, including case law, a covered entity may provide or deny access under § 164.524 to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment.

(4) Implementation specification: Deceased individuals. If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.

(5) Implementation specification: Abuse, neglect, endangerment situations. Notwithstanding a State law or any requirement of this paragraph to the contrary, a covered entity may elect not to treat a person as the personal representative, provided that the conditions at paragraphs (g)(5)(i) and (ii) of this section are met:

(i) Paragraphs (g)(5)(i)(A) and (B) of this section both apply.

(A) The covered entity has a reasonable belief that any of the following is true:

(1) The individual has been or may be subjected to domestic violence, abuse, or neglect by such person.

(2) Treating such person as the personal representative could endanger the individual.

(B) The covered entity, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual's personal representative.

(ii) The covered entity does not have a reasonable belief under paragraph (g)(5)(i)(A) of this section if the basis for their belief is the provision or facilitation of reproductive health care by such person for and at the request of the individual.

(h) Standard: Confidential communications. A covered health care provider or health plan must comply with the applicable requirements of § 164.522(b) in communicating protected health information.

(i) Standard: Uses and disclosures consistent with notice. A covered entity that is required by § 164.520 to have a notice may not use or disclose protected health information in a manner inconsistent with such notice. A covered entity that is required by § 164.520(b)(1)(iii) to include a specific statement in its notice if it intends to engage in an activity listed in § 164.520(b)(1)(iii)(A)-(C), may not use or disclose protected health information for such activities, unless the required statement is included in the notice.

(j) Standard: Disclosures by whistleblowers and workforce member crime victims—(1) Disclosures by whistleblowers. A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce or a business associate discloses protected health information, provided that:

(i) The workforce member or business associate believes in good faith that the covered entity has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or that the care, services, or conditions provided by the covered entity potentially endangers one or more patients, workers, or the public; and

(ii) The disclosure is to:

(A) A health oversight agency or public health authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions of the covered entity or to an appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by the covered entity; or

(B) An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct described in paragraph (j)(1)(i) of this section.

(2) Disclosures by workforce members who are victims of a crime. A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce who is the victim of a criminal act discloses protected health information to a law enforcement official, provided that:

(i) The protected health information disclosed is about the suspected perpetrator of the criminal act; and

(ii) The protected health information disclosed is limited to the information listed in § 164.512(f)(2)(i).

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53267, Aug. 14, 2002; 78 FR 5696, Jan. 25, 2013; 89 FR 33063, Apr. 26, 2024]

§ 164.504 Uses and disclosures: Organizational requirements.

(a) Definitions. As used in this section:

Plan administration functions means administration functions performed by the plan sponsor of a group health plan on behalf of the group health plan and excludes functions performed by the plan sponsor in connection with any other benefit or benefit plan of the plan sponsor.

Summary health information means information, that may be individually identifiable health information, and:

(1) That summarizes the claims history, claims expenses, or type of claims experienced by individuals for whom a plan sponsor has provided health benefits under a group health plan; and

(2) From which the information described at § 164.514(b)(2)(i) has been deleted, except that the geographic information described in § 164.514(b)(2)(i)(B) need only be aggregated to the level of a five digit zip code.

(b)-(d) [Reserved]

(e)(1) Standard: Business associate contracts. (i) The contract or other arrangement required by § 164.502(e)(2) must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as applicable.

(ii) A covered entity is not in compliance with the standards in § 164.502(e) and this paragraph, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate's obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

(iii) A business associate is not in compliance with the standards in § 164.502(e) and this paragraph, if the business associate knew of a pattern of activity or practice of a subcontractor that constituted a material breach or violation of the subcontractor's obligation under the contract or other arrangement, unless the business associate took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.

(2) Implementation specifications: Business associate contracts. A contract between the covered entity and a business associate must:

(i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that:

(A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and

(B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.

(ii) Provide that the business associate will:

(A) Not use or further disclose the information other than as permitted or required by the contract or as required by law;

(B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract;

(C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410;

(D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;

(E) Make available protected health information in accordance with § 164.524;

(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with § 164.526;

(G) Make available the information required to provide an accounting of disclosures in accordance with § 164.528;

(H) To the extent the business associate is to carry out a covered entity's obligation under this subpart, comply with the requirements of this subpart that apply to the covered entity in the performance of such obligation.

(I) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary for purposes of determining the covered entity's compliance with this subpart; and

(J) At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

(iii) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.

(3) Implementation specifications: Other arrangements. (i) If a covered entity and its business associate are both governmental entities:

(A) The covered entity may comply with this paragraph and § 164.314(a)(1), if applicable, by entering into a memorandum of understanding with the business associate that contains terms that accomplish the objectives of paragraph (e)(2) of this section and § 164.314(a)(2), if applicable.

(B) The covered entity may comply with this paragraph and § 164.314(a)(1), if applicable, if other law (including regulations adopted by the covered entity or its business associate) contains requirements applicable to the business associate that accomplish the objectives of paragraph (e)(2) of this section and § 164.314(a)(2), if applicable.

(ii) If a business associate is required by law to perform a function or activity on behalf of a covered entity or to provide a service described in the definition of business associate in § 160.103 of this subchapter to a covered entity, such covered entity may disclose protected health information to the business associate to the extent necessary to comply with the legal mandate without meeting the requirements of this paragraph and § 164.314(a)(1), if applicable, provided that the covered entity attempts in good faith to obtain satisfactory assurances as required by paragraph (e)(2) of this section and § 164.314(a)(1), if applicable, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.

(iii) The covered entity may omit from its other arrangements the termination authorization required by paragraph (e)(2)(iii) of this section, if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate.

(iv) A covered entity may comply with this paragraph and § 164.314(a)(1) if the covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function and the covered entity has a data use agreement with the business associate that complies with §§ 164.514(e)(4) and 164.314(a)(1), if applicable.

(4) Implementation specifications: Other requirements for contracts and other arrangements. (i) The contract or other arrangement between the covered entity and the business associate may permit the business associate to use the protected health information received by the business associate in its capacity as a business associate to the covered entity, if necessary:

(A) For the proper management and administration of the business associate; or

(B) To carry out the legal responsibilities of the business associate.

(ii) The contract or other arrangement between the covered entity and the business associate may permit the business associate to disclose the protected health information received by the business associate in its capacity as a business associate for the purposes described in paragraph (e)(4)(i) of this section, if:

(A) The disclosure is required by law; or

(B)(1) The business associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person; and

(2) The person notifies the business associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(5) Implementation specifications: Business associate contracts with subcontractors. The requirements of § 164.504(e)(2) through (e)(4) apply to the contract or other arrangement required by § 164.502(e)(1)(ii) between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.

(f)(1) Standard: Requirements for group health plans. (i) Except as provided under paragraph (f)(1)(ii) or (iii) of this section or as otherwise authorized under § 164.508, a group health plan, in order to disclose protected health information to the plan sponsor or to provide for or permit the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO with respect to the group health plan, must ensure that the plan documents restrict uses and disclosures of such information by the plan sponsor consistent with the requirements of this subpart.

(ii) Except as prohibited by § 164.502(a)(5)(i), the group health plan, or a health insurance issuer or HMO with respect to the group health plan, may disclose summary health information to the plan sponsor, if the plan sponsor requests the summary health information for purposes of:

(A) Obtaining premium bids from health plans for providing health insurance coverage under the group health plan; or

(B) Modifying, amending, or terminating the group health plan.

(iii) The group health plan, or a health insurance issuer or HMO with respect to the group health plan, may disclose to the plan sponsor information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan.

(2) Implementation specifications: Requirements for plan documents. The plan documents of the group health plan must be amended to incorporate provisions to:

(i) Establish the permitted and required uses and disclosures of such information by the plan sponsor, provided that such permitted and required uses and disclosures may not be inconsistent with this subpart.

(ii) Provide that the group health plan will disclose protected health information to the plan sponsor only upon receipt of a certification by the plan sponsor that the plan documents have been amended to incorporate the following provisions and that the plan sponsor agrees to:

(A) Not use or further disclose the information other than as permitted or required by the plan documents or as required by law;

(B) Ensure that any agents to whom it provides protected health information received from the group health plan agree to the same restrictions and conditions that apply to the plan sponsor with respect to such information;

(C) Not use or disclose the information for employment-related actions and decisions or in connection with any other benefit or employee benefit plan of the plan sponsor;

(D) Report to the group health plan any use or disclosure of the information that is inconsistent with the uses or disclosures provided for of which it becomes aware;

(E) Make available protected health information in accordance with § 164.524;

(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with § 164.526;

(G) Make available the information required to provide an accounting of disclosures in accordance with § 164.528;

(H) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from the group health plan available to the Secretary for purposes of determining compliance by the group health plan with this subpart;

(I) If feasible, return or destroy all protected health information received from the group health plan that the sponsor still maintains in any form and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible; and

(J) Ensure that the adequate separation required in paragraph (f)(2)(iii) of this section is established.

(iii) Provide for adequate separation between the group health plan and the plan sponsor. The plan documents must:

(A) Describe those employees or classes of employees or other persons under the control of the plan sponsor to be given access to the protected health information to be disclosed, provided that any employee or person who receives protected health information relating to payment under, health care operations of, or other matters pertaining to the group health plan in the ordinary course of business must be included in such description;

(B) Restrict the access to and use by such employees and other persons described in paragraph (f)(2)(iii)(A) of this section to the plan administration functions that the plan sponsor performs for the group health plan; and

(C) Provide an effective mechanism for resolving any issues of noncompliance by persons described in paragraph (f)(2)(iii)(A) of this section with the plan document provisions required by this paragraph.

(3) Implementation specifications: Uses and disclosures. A group health plan may:

(i) Disclose protected health information to a plan sponsor to carry out plan administration functions that the plan sponsor performs only consistent with the provisions of paragraph (f)(2) of this section;

(ii) Not permit a health insurance issuer or HMO with respect to the group health plan to disclose protected health information to the plan sponsor except as permitted by this paragraph;

(iii) Not disclose and may not permit a health insurance issuer or HMO to disclose protected health information to a plan sponsor as otherwise permitted by this paragraph unless a statement required by § 164.520(b)(1)(iii)(C) is included in the appropriate notice; and (iv) Not disclose protected health information to the plan sponsor for the purpose of employment-related actions or decisions or in connection with any other benefit or employee benefit plan of the plan sponsor.

(g) Standard: Requirements for a covered entity with multiple covered functions. (1) A covered entity that performs multiple covered functions that would make the entity any combination of a health plan, a covered health care provider, and a health care clearinghouse, must comply with the standards, requirements, and implementation specifications of this subpart, as applicable to the health plan, health care provider, or health care clearinghouse covered functions performed.

(2) A covered entity that performs multiple covered functions may use or disclose the protected health information of individuals who receive the covered entity's health plan or health care provider services, but not both, only for purposes related to the appropriate function being performed.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53267, Aug. 14, 2002; 68 FR 8381, Feb. 20, 2003; 78 FR 5697, Jan. 25, 2013]

§ 164.506 Uses and disclosures to carry out treatment, payment, or health care operations.

(a) Standard: Permitted uses and disclosures. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart.

(b) Standard: Consent for uses and disclosures permitted. (1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.

(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under § 164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.

(c) Implementation specifications: Treatment, payment, or health care operations. (1) A covered entity may use or disclose protected health information for its own treatment, payment, or health care operations.

(2) A covered entity may disclose protected health information for treatment activities of a health care provider.

(3) A covered entity may disclose protected health information to another covered entity or a health care provider for the payment activities of the entity that receives the information.

(4) A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is:

(i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations; or

(ii) For the purpose of health care fraud and abuse detection or compliance.

(5) A covered entity that participates in an organized health care arrangement may disclose protected health information about an individual to other participants in the organized health care arrangement for any health care operations activities of the organized health care arrangement.

[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5698, Jan. 25, 2013]

§ 164.508 Uses and disclosures for which an authorization is required.

(a) Standard: Authorizations for uses and disclosures—(1) Authorization required: General rule. Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.

(2) Authorization required: Psychotherapy notes. Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:

(i) To carry out the following treatment, payment, or health care operations:

(A) Use by the originator of the psychotherapy notes for treatment;

(B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or

(C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and

(ii) A use or disclosure that is required by § 164.502(a)(2)(ii) or permitted by § 164.512(a); § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; § 164.512(g)(1); or § 164.512(j)(1)(i).

(3) Authorization required: Marketing. (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:

(A) A face-to-face communication made by a covered entity to an individual; or

(B) A promotional gift of nominal value provided by the covered entity.

(ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.

(4) Authorization required: Sale of protected health information. (i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart. (ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.

(b) Implementation specifications: General requirements—(1) Valid authorizations. (i) A valid authorization is a document that meets the requirements in paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1), and (c)(2) of this section, as applicable.

(ii) A valid authorization may contain elements or information in addition to the elements required by this section, provided that such additional elements or information are not inconsistent with the elements required by this section.

(2) Defective authorizations. An authorization is not valid, if the document submitted has any of the following defects:

(i) The expiration date has passed or the expiration event is known by the covered entity to have occurred;

(ii) The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section, if applicable;

(iii) The authorization is known by the covered entity to have been revoked;

(iv) The authorization violates paragraph (b)(3) or (4) of this section, if applicable;

(v) Any material information in the authorization is known by the covered entity to be false.

(3) Compound authorizations. An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization, except as follows:

(i) An authorization for the use or disclosure of protected health information for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of protected health information for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with a consent to participate in research. Where a covered health care provider has conditioned the provision of research-related treatment on the provision of one of the authorizations, as permitted under paragraph (b)(4)(i) of this section, any compound authorization created under this paragraph must clearly differentiate between the conditioned and unconditioned components and provide the individual with an opportunity to opt in to the research activities described in the unconditioned authorization.

(ii) An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.

(iii) An authorization under this section, other than an authorization for a use or disclosure of psychotherapy notes, may be combined with any other such authorization under this section, except when a covered entity has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits under paragraph (b)(4) of this section on the provision of one of the authorizations. The prohibition in this paragraph on combining authorizations where one authorization conditions the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits under paragraph (b)(4) of this section does not apply to a compound authorization created in accordance with paragraph (b)(3)(i) of this section.

(4) Prohibition on conditioning of authorizations. A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except:

(i) A covered health care provider may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of protected health information for such research under this section;

(ii) A health plan may condition enrollment in the health plan or eligibility for benefits on provision of an authorization requested by the health plan prior to an individual's enrollment in the health plan, if:

(A) The authorization sought is for the health plan's eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations; and

(B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and

(iii) A covered entity may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.

(5) Revocation of authorizations. An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that:

(i) The covered entity has taken action in reliance thereon; or

(ii) If the authorization was obtained as a condition of obtaining insurance coverage, other law provides the insurer with the right to contest a claim under the policy or the policy itself.

(6) Documentation. A covered entity must document and retain any signed authorization under this section as required by § 164.530(j).

(c) Implementation specifications: Core elements and requirements—(1) Core elements. A valid authorization under this section must contain at least the following elements:

(i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.

(ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.

(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.

(iv) A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.

(v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.

(vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.

(2) Required statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:

(i) The individual's right to revoke the authorization in writing, and either:

(A) The exceptions to the right to revoke and a description of how the individual may revoke the authorization; or

(B) To the extent that the information in paragraph (c)(2)(i)(A) of this section is included in the notice required by § 164.520, a reference to the covered entity's notice.

(ii) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization, by stating either:

(A) The covered entity may not condition treatment, payment, enrollment or eligibility for benefits on whether the individual signs the authorization when the prohibition on conditioning of authorizations in paragraph (b)(4) of this section applies; or

(B) The consequences to the individual of a refusal to sign the authorization when, in accordance with paragraph (b)(4) of this section, the covered entity can condition treatment, enrollment in the health plan, or eligibility for benefits on failure to obtain such authorization.

(iii) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart.

(3) Plain language requirement. The authorization must be written in plain language.

(4) Copy to the individual. If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization.

[67 FR 53268, Aug. 14, 2002, as amended at 78 FR 5699, Jan. 25, 2013]

§ 164.509 Uses and disclosures for which an attestation is required.

(a) Standard: Attestations for certain uses and disclosures of protected health information to persons other than covered entities or business associates. (1) A covered entity or business associate may not use or disclose protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1), without obtaining an attestation that is valid under paragraph (b)(1) of this section from the person requesting the use or disclosure and complying with all applicable conditions of this part.

(2) A covered entity or business associate that uses or discloses protected health information potentially related to reproductive health care for purposes specified in § 164.512(d), (e), (f), or (g)(1), in reliance on an attestation that is defective under paragraph (b)(2) of this section, is not in compliance with this section.

(b) Implementation specifications: General requirements—(1) Valid attestations. (i) A valid attestation is a document that meets the requirements of paragraph (c)(1) of this section.

(ii) A valid attestation verifies that the use or disclosure is not otherwise prohibited by § 164.502(a)(5)(iii).

(iii) A valid attestation may be electronic, provided that it meets the requirements in paragraph (c)(1) of this section, as applicable.

(2) Defective attestations. An attestation is not valid if the document submitted has any of the following defects:

(i) The attestation lacks an element or statement required by paragraph (c) of this section.

(ii) The attestation contains an element or statement not required by paragraph (c) of this section

(iii) The attestation violates paragraph (b)(3) of this section.

(iv) The covered entity or business associate has actual knowledge that material information in the attestation is false.

(v) A reasonable covered entity or business associate in the same position would not believe that the attestation is true with respect to the requirement at paragraph (c)(1)(iv) of this section.

(3) Compound attestation. An attestation may not be combined with any other document except where such other document is needed to satisfy the requirements at paragraph (c)(iv) of this section or at § 164.502(a)(5)(iii)(C), as applicable.

(c) Implementation specifications: Content requirements and other obligations—(1) Required elements. A valid attestation under this section must contain the following elements:

(i) A description of the information requested that identifies the information in a specific fashion, including one of the following:

(A) The name of any individual(s) whose protected health information is sought, if practicable.

(B) If including the name(s) of any individual(s) whose protected health information is sought is not practicable, a description of the class of individuals whose protected health information is sought.

(ii) The name or other specific identification of the person(s), or class of persons, who are requested to make the use or disclosure.

(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity is to make the requested use or disclosure.

(iv) A clear statement that the use or disclosure is not for a purpose prohibited under § 164.502(a)(5)(iii).

(v) A statement that a person may be subject to criminal penalties pursuant to 42 U.S.C. 1320d-6 if that person knowingly and in violation of HIPAA obtains individually identifiable health information relating to an individual or discloses individually identifiable health information to another person.

(vi) Signature of the person requesting the protected health information, which may be an electronic signature, and date. If the attestation is signed by a representative of the person requesting the information, a description of such representative's authority to act for the person must also be provided.

(2) Plain language requirement. The attestation must be written in plain language.

(d) Material misrepresentations. If, during the course of using or disclosing protected health information in reasonable reliance on a facially valid attestation, a covered entity or business associate discovers information reasonably showing that any representation made in the attestation was materially false, leading to a use or disclosure for a purpose prohibited under § 164.502(a)(5)(iii), the covered entity or business associate must cease such use or disclosure.

[89 FR 33063, Apr. 26, 2024]

§ 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object.

A covered entity may use or disclose protected health information, provided that the individual is informed in advance of the use or disclosure and has the opportunity to agree to or prohibit or restrict the use or disclosure, in accordance with the applicable requirements of this section. The covered entity may orally inform the individual of and obtain the individual's oral agreement or objection to a use or disclosure permitted by this section.

(a) Standard: Use and disclosure for facility directories—(1) Permitted uses and disclosure. Except when an objection is expressed in accordance with paragraphs (a)(2) or (3) of this section, a covered health care provider may:

(i) Use the following protected health information to maintain a directory of individuals in its facility:

(A) The individual's name;

(B) The individual's location in the covered health care provider's facility;

(C) The individual's condition described in general terms that does not communicate specific medical information about the individual; and

(D) The individual's religious affiliation; and

(ii) Use or disclose for directory purposes such information:

(A) To members of the clergy; or

(B) Except for religious affiliation, to other persons who ask for the individual by name.

(2) Opportunity to object. A covered health care provider must inform an individual of the protected health information that it may include in a directory and the persons to whom it may disclose such information (including disclosures to clergy of information regarding religious affiliation) and provide the individual with the opportunity to restrict or prohibit some or all of the uses or disclosures permitted by paragraph (a)(1) of this section.

(3) Emergency circumstances. (i) If the opportunity to object to uses or disclosures required by paragraph (a)(2) of this section cannot practicably be provided because of the individual's incapacity or an emergency treatment circumstance, a covered health care provider may use or disclose some or all of the protected health information permitted by paragraph (a)(1) of this section for the facility's directory, if such disclosure is:

(A) Consistent with a prior expressed preference of the individual, if any, that is known to the covered health care provider; and

(B) In the individual's best interest as determined by the covered health care provider, in the exercise of professional judgment.

(ii) The covered health care provider must inform the individual and provide an opportunity to object to uses or disclosures for directory purposes as required by paragraph (a)(2) of this section when it becomes practicable to do so.

(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes—(1) Permitted uses and disclosures. (i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person's involvement with the individual's health care or payment related to the individual's health care.

(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual's location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable.

(2) Uses and disclosures with the individual present. If the individual is present for, or otherwise available prior to, a use or disclosure permitted by paragraph (b)(1) of this section and has the capacity to make health care decisions, the covered entity may use or disclose the protected health information if it:

(i) Obtains the individual's agreement;

(ii) Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or

(iii) Reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure.

(3) Limited uses and disclosures when the individual is not present. If the individual is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the individual's incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person's involvement with the individual's care or payment related to the individual's health care or needed for notification purposes. A covered entity may use professional judgment and its experience with common practice to make reasonable inferences of the individual's best interest in allowing a person to act on behalf of the individual to pick up filled prescriptions, medical supplies, X-rays, or other similar forms of protected health information.

(4) Uses and disclosures for disaster relief purposes. A covered entity may use or disclose protected health information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities the uses or disclosures permitted by paragraph (b)(1)(ii) of this section. The requirements in paragraphs (b)(2), (b)(3), or (b)(5) of this section apply to such uses and disclosures to the extent that the covered entity, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.

(5) Uses and disclosures when the individual is deceased. If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual's care or payment for health care prior to the individual's death, protected health information of the individual that is relevant to such person's involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53270, Aug. 14, 2002; 78 FR 5699, Jan. 25, 2013]

§ 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required.

Except as provided by § 164.502(a)(5)(iii), a covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section, subject to the applicable requirements of this section and § 164.509. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity's information and the individual's agreement may be given verbally.

(a) Standard: Uses and disclosures required by law. (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law.

(2) A covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for uses or disclosures required by law.

(b) Standard: Uses and disclosures for public health activities—(1) Permitted uses and disclosures. A covered entity may use or disclose protected health information for the public health activities and purposes described in this paragraph to:

(i) A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority;

(ii) A public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect;

(iii) A person subject to the jurisdiction of the Food and Drug Administration (FDA) with respect to an FDA-regulated product or activity for which that person has responsibility, for the purpose of activities related to the quality, safety or effectiveness of such FDA-regulated product or activity. Such purposes include:

(A) To collect or report adverse events (or similar activities with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product), or biological product deviations;

(B) To track FDA-regulated products;

(C) To enable product recalls, repairs, or replacement, or lookback (including locating and notifying individuals who have received products that have been recalled, withdrawn, or are the subject of lookback); or

(D) To conduct post marketing surveillance;

(iv) A person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the covered entity or public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation; or

(v) An employer, about an individual who is a member of the workforce of the employer, if:

(A) The covered entity is a covered health care provider who provides health care to the individual at the request of the employer:

(1) To conduct an evaluation relating to medical surveillance of the workplace; or

(2) To evaluate whether the individual has a work-related illness or injury;

(B) The protected health information that is disclosed consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;

(C) The employer needs such findings in order to comply with its obligations, under 29 CFR parts 1904 through 1928, 30 CFR parts 50 through 90, or under state law having a similar purpose, to record such illness or injury or to carry out responsibilities for workplace medical surveillance; and

(D) The covered health care provider provides written notice to the individual that protected health information relating to the medical surveillance of the workplace and work-related illnesses and injuries is disclosed to the employer:

(1) By giving a copy of the notice to the individual at the time the health care is provided; or

(2) If the health care is provided on the work site of the employer, by posting the notice in a prominent place at the location where the health care is provided.

(vi) A school, about an individual who is a student or prospective student of the school, if:

(A) The protected health information that is disclosed is limited to proof of immunization;

(B) The school is required by State or other law to have such proof of immunization prior to admitting the individual; and

(C) The covered entity obtains and documents the agreement to the disclosure from either:

(1) A parent, guardian, or other person acting in loco parentis of the individual, if the individual is an unemancipated minor; or

(2) The individual, if the individual is an adult or emancipated minor.

(2) Permitted uses. If the covered entity also is a public health authority, the covered entity is permitted to use protected health information in all cases in which it is permitted to disclose such information for public health activities under paragraph (b)(1) of this section.

(c) Standard: Disclosures about victims of abuse, neglect, or domestic violence—(1) Permitted disclosures. Except for reports of child abuse or neglect permitted by paragraph (b)(1)(ii) of this section, a covered entity may disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence:

(i) To the extent the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of such law;

(ii) If the individual agrees to the disclosure; or

(iii) To the extent the disclosure is expressly authorized by statute or regulation and:

(A) The covered entity, in the exercise of professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or

(B) If the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the protected health information for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.

(2) Informing the individual. A covered entity that makes a disclosure permitted by paragraph (c)(1) of this section must promptly inform the individual that such a report has been or will be made, except if:

(i) The covered entity, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or

(ii) The covered entity would be informing a personal representative, and the covered entity reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.

(3) Rule of construction. Nothing in this section shall be construed to permit disclosures prohibited by § 164.502(a)(5)(iii) when the sole basis of the report of abuse, neglect, or domestic violence is the provision or facilitation of reproductive health care.

(d) Standard: Uses and disclosures for health oversight activities—(1) Permitted disclosures. A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:

(i) The health care system;

(ii) Government benefit programs for which health information is relevant to beneficiary eligibility;

(iii) Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or

(iv) Entities subject to civil rights laws for which health information is necessary for determining compliance.

(2) Exception to health oversight activities. For the purpose of the disclosures permitted by paragraph (d)(1) of this section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to:

(i) The receipt of health care;

(ii) A claim for public benefits related to health; or

(iii) Qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services.

(3) Joint activities or investigations. Nothwithstanding paragraph (d)(2) of this section, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of paragraph (d) of this section.

(4) Permitted uses. If a covered entity also is a health oversight agency, the covered entity may use protected health information for health oversight activities as permitted by paragraph (d) of this section.

(e) Standard: Disclosures for judicial and administrative proceedings—(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:

(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or

(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:

(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or

(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.

(iii) For the purposes of paragraph (e)(1)(ii)(A) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:

(A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address);

(B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and

(C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and:

(1) No objections were filed; or

(2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.

(iv) For the purposes of paragraph (e)(1)(ii)(B) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:

(A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or

(B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.

(v) For purposes of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that:

(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and

(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.

(vi) Notwithstanding paragraph (e)(1)(ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e)(1)(ii) of this section without receiving satisfactory assurance under paragraph (e)(1)(ii)(A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(v) of this section.

(2) Other uses and disclosures under this section. The provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information.

(f) Standard: Disclosures for law enforcement purposes. A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this section are met, as applicable.

(1) Permitted disclosures: Pursuant to process and as otherwise required by law. A covered entity may disclose protected health information:

(i) As required by law including laws that require the reporting of certain types of wounds or other physical injuries, except for laws subject to paragraph (b)(1)(ii) or (c)(1)(i) of this section; or

(ii) In compliance with and as limited by the relevant requirements of:

(A) A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer;

(B) A grand jury subpoena; or

(C) An administrative request for which response is required by law, including an administrative subpoena or summons, a civil or an authorized investigative demand, or similar process authorized under law, provided that:

(1) The information sought is relevant and material to a legitimate law enforcement inquiry;

(2) The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and

(3) De-identified information could not reasonably be used.

(2) Permitted disclosures: Limited information for identification and location purposes. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that:

(i) The covered entity may disclose only the following information:

(A) Name and address;

(B) Date and place of birth;

(C) Social security number;

(D) ABO blood type and rh factor;

(E) Type of injury;

(F) Date and time of treatment;

(G) Date and time of death, if applicable; and

(H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.

(ii) Except as permitted by paragraph (f)(2)(i) of this section, the covered entity may not disclose for the purposes of identification or location under paragraph (f)(2) of this section any protected health information related to the individual's DNA or DNA analysis, dental records, or typing, samples or analysis of body fluids or tissue.

(3) Permitted disclosure: Victims of a crime. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime, other than disclosures that are subject to paragraph (b) or (c) of this section, if:

(i) The individual agrees to the disclosure; or

(ii) The covered entity is unable to obtain the individual's agreement because of incapacity or other emergency circumstance, provided that:

(A) The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred, and such information is not intended to be used against the victim;

(B) The law enforcement official represents that immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure; and

(C) The disclosure is in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.

(4) Permitted disclosure: Decedents. A covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicion that such death may have resulted from criminal conduct.

(5) Permitted disclosure: Crime on premises. A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.

(6) Permitted disclosure: Reporting crime in emergencies. (i) A covered health care provider providing emergency health care in response to a medical emergency, other than such emergency on the premises of the covered health care provider, may disclose protected health information to a law enforcement official if such disclosure appears necessary to alert law enforcement to:

(A) The commission and nature of a crime;

(B) The location of such crime or of the victim(s) of such crime; and

(C) The identity, description, and location of the perpetrator of such crime.

(ii) If a covered health care provider believes that the medical emergency described in paragraph (f)(6)(i) of this section is the result of abuse, neglect, or domestic violence of the individual in need of emergency health care, paragraph (f)(6)(i) of this section does not apply and any disclosure to a law enforcement official for law enforcement purposes is subject to paragraph (c) of this section.

(g) Standard: Uses and disclosures about decedents—(1) Coroners and medical examiners. A covered entity may disclose protected health information to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. A covered entity that also performs the duties of a coroner or medical examiner may use protected health information for the purposes described in this paragraph.

(2) Funeral directors. A covered entity may disclose protected health information to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent. If necessary for funeral directors to carry out their duties, the covered entity may disclose the protected health information prior to, and in reasonable anticipation of, the individual's death.

(h) Standard: Uses and disclosures for cadaveric organ, eye or tissue donation purposes. A covered entity may use or disclose protected health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.

(i) Standard: Uses and disclosures for research purposes—(1) Permitted uses and disclosures. A covered entity may use or disclose protected health information for research, regardless of the source of funding of the research, provided that:

(i) Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by § 164.508 for use or disclosure of protected health information has been approved by either:

(A) An Institutional Review Board (IRB), established in accordance with 7 CFR lc.107, 10 CFR 745.107, 14 CFR 1230.107, 15 CFR 27.107, 16 CFR 1028.107, 21 CFR 56.107, 22 CFR 225.107, 24 CFR 60.107, 28 CFR 46.107, 32 CFR 219.107, 34 CFR 97.107, 38 CFR 16.107, 40 CFR 26.107, 45 CFR 46.107, 45 CFR 690.107, or 49 CFR 11.107; or

(B) A privacy board that:

(1) Has members with varying backgrounds and appropriate professional competency as necessary to review the effect of the research protocol on the individual's privacy rights and related interests;

(2) Includes at least one member who is not affiliated with the covered entity, not affiliated with any entity conducting or sponsoring the research, and not related to any person who is affiliated with any of such entities; and

(3) Does not have any member participating in a review of any project in which the member has a conflict of interest.

(ii) Reviews preparatory to research. The covered entity obtains from the researcher representations that:

(A) Use or disclosure is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research;

(B) No protected health information is to be removed from the covered entity by the researcher in the course of the review; and

(C) The protected health information for which use or access is sought is necessary for the research purposes.

(iii) Research on decedent's information. The covered entity obtains from the researcher:

(A) Representation that the use or disclosure sought is solely for research on the protected health information of decedents;

(B) Documentation, at the request of the covered entity, of the death of such individuals; and

(C) Representation that the protected health information for which use or disclosure is sought is necessary for the research purposes.

(2) Documentation of waiver approval. For a use or disclosure to be permitted based on documentation of approval of an alteration or waiver, under paragraph (i)(1)(i) of this section, the documentation must include all of the following:

(i) Identification and date of action. A statement identifying the IRB or privacy board and the date on which the alteration or waiver of authorization was approved;

(ii) Waiver criteria. A statement that the IRB or privacy board has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:

(A) The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements;

(1) An adequate plan to protect the identifiers from improper use and disclosure;

(2) An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and

(3) Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;

(B) The research could not practicably be conducted without the waiver or alteration; and

(C) The research could not practicably be conducted without access to and use of the protected health information.

(iii) Protected health information needed. A brief description of the protected health information for which use or access has been determined to be necessary by the institutional review board or privacy board, pursuant to paragraph (i)(2)(ii)(C) of this section;

(iv) Review and approval procedures. A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures, as follows:

(A) An IRB must follow the requirements of the Common Rule, including the normal review procedures (7 CFR 1c.108(b), 10 CFR 745.108(b), 14 CFR 1230.108(b), 15 CFR 27.108(b), 16 CFR 1028.108(b), 21 CFR 56.108(b), 22 CFR 225.108(b), 24 CFR 60.108(b), 28 CFR 46.108(b), 32 CFR 219.108(b), 34 CFR 97.108(b), 38 CFR 16.108(b), 40 CFR 26.108(b), 45 CFR 46.108(b), 45 CFR 690.108(b), or 49 CFR 11.108(b)) or the expedited review procedures (7 CFR 1c.110, 10 CFR 745.110, 14 CFR 1230.110, 15 CFR 27.110, 16 CFR 1028.110, 21 CFR 56.110, 22 CFR 225.110, 24 CFR 60.110, 28 CFR 46.110, 32 CFR 219.110, 34 CFR 97.110, 38 CFR 16.110, 40 CFR 26.110, 45 CFR 46.110, 45 CFR 690.110, or 49 CFR 11.110);

(B) A privacy board must review the proposed research at convened meetings at which a majority of the privacy board members are present, including at least one member who satisfies the criterion stated in paragraph (i)(1)(i)(B)(2) of this section, and the alteration or waiver of authorization must be approved by the majority of the privacy board members present at the meeting, unless the privacy board elects to use an expedited review procedure in accordance with paragraph (i)(2)(iv)(C) of this section;

(C) A privacy board may use an expedited review procedure if the research involves no more than minimal risk to the privacy of the individuals who are the subject of the protected health information for which use or disclosure is being sought. If the privacy board elects to use an expedited review procedure, the review and approval of the alteration or waiver of authorization may be carried out by the chair of the privacy board, or by one or more members of the privacy board as designated by the chair; and

(v) Required signature. The documentation of the alteration or waiver of authorization must be signed by the chair or other member, as designated by the chair, of the IRB or the privacy board, as applicable.

(j) Standard: Uses and disclosures to avert a serious threat to health or safety—(1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:

(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and

(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat; or

(ii) Is necessary for law enforcement authorities to identify or apprehend an individual:

(A) Because of a statement by an individual admitting participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to the victim; or

(B) Where it appears from all the circumstances that the individual has escaped from a correctional institution or from lawful custody, as those terms are defined in § 164.501.

(2) Use or disclosure not permitted. A use or disclosure pursuant to paragraph (j)(1)(ii)(A) of this section may not be made if the information described in paragraph (j)(1)(ii)(A) of this section is learned by the covered entity:

(i) In the course of treatment to affect the propensity to commit the criminal conduct that is the basis for the disclosure under paragraph (j)(1)(ii)(A) of this section, or counseling or therapy; or

(ii) Through a request by the individual to initiate or to be referred for the treatment, counseling, or therapy described in paragraph (j)(2)(i) of this section.

(3) Limit on information that may be disclosed. A disclosure made pursuant to paragraph (j)(1)(ii)(A) of this section shall contain only the statement described in paragraph (j)(1)(ii)(A) of this section and the protected health information described in paragraph (f)(2)(i) of this section.

(4) Presumption of good faith belief. A covered entity that uses or discloses protected health information pursuant to paragraph (j)(1) of this section is presumed to have acted in good faith with regard to a belief described in paragraph (j)(1)(i) or (ii) of this section, if the belief is based upon the covered entity's actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority.

(k) Standard: Uses and disclosures for specialized government functions—(1) Military and veterans activities—(i) Armed Forces personnel. A covered entity may use and disclose the protected health information of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, if the appropriate military authority has published by notice in the Federal Register the following information:

(A) Appropriate military command authorities; and

(B) The purposes for which the protected health information may be used or disclosed.

(ii) Separation or discharge from military service. A covered entity that is a component of the Departments of Defense or Homeland Security may disclose to the Department of Veterans Affairs (DVA) the protected health information of an individual who is a member of the Armed Forces upon the separation or discharge of the individual from military service for the purpose of a determination by DVA of the individual's eligibility for or entitlement to benefits under laws administered by the Secretary of Veterans Affairs.

(iii) Veterans. A covered entity that is a component of the Department of Veterans Affairs may use and disclose protected health information to components of the Department that determine eligibility for or entitlement to, or that provide, benefits under the laws administered by the Secretary of Veterans Affairs.

(iv) Foreign military personnel. A covered entity may use and disclose the protected health information of individuals who are foreign military personnel to their appropriate foreign military authority for the same purposes for which uses and disclosures are permitted for Armed Forces personnel under the notice published in the Federal Register pursuant to paragraph (k)(1)(i) of this section.

(2) National security and intelligence activities. A covered entity may disclose protected health information to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act (50 U.S.C. 401, et seq.) and implementing authority (e.g., Executive Order 12333).

(3) Protective services for the President and others. A covered entity may disclose protected health information to authorized Federal officials for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056 or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct of investigations authorized by 18 U.S.C. 871 and 879.

(4) Medical suitability determinations. A covered entity that is a component of the Department of State may use protected health information to make medical suitability determinations and may disclose whether or not the individual was determined to be medically suitable to the officials in the Department of State who need access to such information for the following purposes:

(i) For the purpose of a required security clearance conducted pursuant to Executive Orders 10450 and 12968;

(ii) As necessary to determine worldwide availability or availability for mandatory service abroad under sections 101(a)(4) and 504 of the Foreign Service Act; or

(iii) For a family to accompany a Foreign Service member abroad, consistent with section 101(b)(5) and 904 of the Foreign Service Act.

(5) Correctional institutions and other law enforcement custodial situations—(i) Permitted disclosures. A covered entity may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual, if the correctional institution or such law enforcement official represents that such protected health information is necessary for:

(A) The provision of health care to such individuals;

(B) The health and safety of such individual or other inmates;

(C) The health and safety of the officers or employees of or others at the correctional institution;

(D) The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another;

(E) Law enforcement on the premises of the correctional institution; or

(F) The administration and maintenance of the safety, security, and good order of the correctional institution.

(ii) Permitted uses. A covered entity that is a correctional institution may use protected health information of individuals who are inmates for any purpose for which such protected health information may be disclosed.

(iii) No application after release. For the purposes of this provision, an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.

(6) Covered entities that are government programs providing public benefits. (i) A health plan that is a government program providing public benefits may disclose protected health information relating to eligibility for or enrollment in the health plan to another agency administering a government program providing public benefits if the sharing of eligibility or enrollment information among such government agencies or the maintenance of such information in a single or combined data system accessible to all such government agencies is required or expressly authorized by statute or regulation.

(ii) A covered entity that is a government agency administering a government program providing public benefits may disclose protected health information relating to the program to another covered entity that is a government agency administering a government program providing public benefits if the programs serve the same or similar populations and the disclosure of protected health information is necessary to coordinate the covered functions of such programs or to improve administration and management relating to the covered functions of such programs.

(7) National Instant Criminal Background Check System. A covered entity may use or disclose protected health information for purposes of reporting to the National Instant Criminal Background Check System the identity of an individual who is prohibited from possessing a firearm under 18 U.S.C. 922(g)(4), provided the covered entity:

(i) Is a State agency or other entity that is, or contains an entity that is:

(A) An entity designated by the State to report, or which collects information for purposes of reporting, on behalf of the State, to the National Instant Criminal Background Check System; or

(B) A court, board, commission, or other lawful authority that makes the commitment or adjudication that causes an individual to become subject to 18 U.S.C. 922(g)(4); and

(ii) Discloses the information only to:

(A) The National Instant Criminal Background Check System; or

(B) An entity designated by the State to report, or which collects information for purposes of reporting, on behalf of the State, to the National Instant Criminal Background Check System; and

(iii)(A) Discloses only the limited demographic and certain other information needed for purposes of reporting to the National Instant Criminal Background Check System; and

(B) Does not disclose diagnostic or clinical information for such purposes.

(l) Standard: Disclosures for workers' compensation. A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53270, Aug. 14, 2002; 78 FR 5699, Jan. 25, 2013; 78 FR 34266, June 7, 2013; 81 FR 395, Jan. 6, 2016; 89 FR 33064, Apr. 26, 2024]

§ 164.514 Other requirements relating to uses and disclosures of protected health information.

(a) Standard: De-identification of protected health information. Health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual is not individually identifiable health information.

(b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if:

(1) A person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable:

(i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify an individual who is a subject of the information; and

(ii) Documents the methods and results of the analysis that justify such determination; or

(2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:

(A) Names;

(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and

(2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;

(D) Telephone numbers;

(E) Fax numbers;

(F) Electronic mail addresses;

(G) Social security numbers;

(H) Medical record numbers;

(I) Health plan beneficiary numbers;

(J) Account numbers;

(K) Certificate/license numbers;

(L) Vehicle identifiers and serial numbers, including license plate numbers;

(M) Device identifiers and serial numbers;

(N) Web Universal Resource Locators (URLs);

(O) Internet Protocol (IP) address numbers;

(P) Biometric identifiers, including finger and voice prints;

(Q) Full face photographic images and any comparable images; and

(R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and

(ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.

(c) Implementation specifications: Re-identification. A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that:

(1) Derivation. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and

(2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

(d)(1) Standard: minimum necessary requirements. In order to comply with § 164.502(b) and this section, a covered entity must meet the requirements of paragraphs (d)(2) through (d)(5) of this section with respect to a request for, or the use and disclosure of, protected health information.

(2) Implementation specifications: Minimum necessary uses of protected health information. (i) A covered entity must identify:

(A) Those persons or classes of persons, as appropriate, in its workforce who need access to protected health information to carry out their duties; and

(B) For each such person or class of persons, the category or categories of protected health information to which access is needed and any conditions appropriate to such access.

(ii) A covered entity must make reasonable efforts to limit the access of such persons or classes identified in paragraph (d)(2)(i)(A) of this section to protected health information consistent with paragraph (d)(2)(i)(B) of this section.

(3) Implementation specification: Minimum necessary disclosures of protected health information. (i) For any type of disclosure that it makes on a routine and recurring basis, a covered entity must implement policies and procedures (which may be standard protocols) that limit the protected health information disclosed to the amount reasonably necessary to achieve the purpose of the disclosure.

(ii) For all other disclosures, a covered entity must:

(A) Develop criteria designed to limit the protected health information disclosed to the information reasonably necessary to accomplish the purpose for which disclosure is sought; and

(B) Review requests for disclosure on an individual basis in accordance with such criteria.

(iii) A covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when:

(A) Making disclosures to public officials that are permitted under § 164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s);

(B) The information is requested by another covered entity;

(C) The information is requested by a professional who is a member of its workforce or is a business associate of the covered entity for the purpose of providing professional services to the covered entity, if the professional represents that the information requested is the minimum necessary for the stated purpose(s); or

(D) Documentation or representations that comply with the applicable requirements of § 164.512(i) have been provided by a person requesting the information for research purposes.

(4) Implementation specifications: Minimum necessary requests for protected health information. (i) A covered entity must limit any request for protected health information to that which is reasonably necessary to accomplish the purpose for which the request is made, when requesting such information from other covered entities.

(ii) For a request that is made on a routine and recurring basis, a covered entity must implement policies and procedures (which may be standard protocols) that limit the protected health information requested to the amount reasonably necessary to accomplish the purpose for which the request is made.

(iii) For all other requests, a covered entity must:

(A) Develop criteria designed to limit the request for protected health information to the information reasonably necessary to accomplish the purpose for which the request is made; and

(B) Review requests for disclosure on an individual basis in accordance with such criteria.

(5) Implementation specification: Other content requirement. For all uses, disclosures, or requests to which the requirements in paragraph (d) of this section apply, a covered entity may not use, disclose or request an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.

(e)(1) Standard: Limited data set. A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient, in accordance with paragraph (e)(4) of this section.

(2) Implementation specification: Limited data set: A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual:

(i) Names;

(ii) Postal address information, other than town or city, State, and zip code;

(iii) Telephone numbers;

(iv) Fax numbers;

(v) Electronic mail addresses;

(vi) Social security numbers;

(vii) Medical record numbers;

(viii) Health plan beneficiary numbers;

(ix) Account numbers;

(x) Certificate/license numbers;

(xi) Vehicle identifiers and serial numbers, including license plate numbers;

(xii) Device identifiers and serial numbers;

(xiii) Web Universal Resource Locators (URLs);

(xiv) Internet Protocol (IP) address numbers;

(xv) Biometric identifiers, including finger and voice prints; and

(xvi) Full face photographic images and any comparable images.

(3) Implementation specification: Permitted purposes for uses and disclosures. (i) A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations.

(ii) A covered entity may use protected health information to create a limited data set that meets the requirements of paragraph (e)(2) of this section, or disclose protected health information only to a business associate for such purpose, whether or not the limited data set is to be used by the covered entity.

(4) Implementation specifications: Data use agreement—(i) Agreement required. A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only if the covered entity obtains satisfactory assurance, in the form of a data use agreement that meets the requirements of this section, that the limited data set recipient will only use or disclose the protected health information for limited purposes.

(ii) Contents. A data use agreement between the covered entity and the limited data set recipient must:

(A) Establish the permitted uses and disclosures of such information by the limited data set recipient, consistent with paragraph (e)(3) of this section. The data use agreement may not authorize the limited data set recipient to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity;

(B) Establish who is permitted to use or receive the limited data set; and

(C) Provide that the limited data set recipient will:

(1) Not use or further disclose the information other than as permitted by the data use agreement or as otherwise required by law;

(2) Use appropriate safeguards to prevent use or disclosure of the information other than as provided for by the data use agreement;

(3) Report to the covered entity any use or disclosure of the information not provided for by its data use agreement of which it becomes aware;

(4) Ensure that any agents to whom it provides the limited data set agree to the same restrictions and conditions that apply to the limited data set recipient with respect to such information; and

(5) Not identify the information or contact the individuals.

(iii) Compliance. (A) A covered entity is not in compliance with the standards in paragraph (e) of this section if the covered entity knew of a pattern of activity or practice of the limited data set recipient that constituted a material breach or violation of the data use agreement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful:

(1) Discontinued disclosure of protected health information to the recipient; and

(2) Reported the problem to the Secretary.

(B) A covered entity that is a limited data set recipient and violates a data use agreement will be in noncompliance with the standards, implementation specifications, and requirements of paragraph (e) of this section.

(f) Fundraising communications—(1) Standard: Uses and disclosures for fundraising. Subject to the conditions of paragraph (f)(2) of this section, a covered entity may use, or disclose to a business associate or to an institutionally related foundation, the following protected health information for the purpose of raising funds for its own benefit, without an authorization meeting the requirements of § 164.508:

(i) Demographic information relating to an individual, including name, address, other contact information, age, gender, and date of birth;

(ii) Dates of health care provided to an individual;

(iii) Department of service information;

(iv) Treating physician;

(v) Outcome information; and

(vi) Health insurance status.

(2) Implementation specifications: Fundraising requirements. (i) A covered entity may not use or disclose protected health information for fundraising purposes as otherwise permitted by paragraph (f)(1) of this section unless a statement required by § 164.520(b)(1)(iii)(A) is included in the covered entity's notice of privacy practices.

(ii) With each fundraising communication made to an individual under this paragraph, a covered entity must provide the individual with a clear and conspicuous opportunity to elect not to receive any further fundraising communications. The method for an individual to elect not to receive further fundraising communications may not cause the individual to incur an undue burden or more than a nominal cost.

(iii) A covered entity may not condition treatment or payment on the individual's choice with respect to the receipt of fundraising communications.

(iv) A covered entity may not make fundraising communications to an individual under this paragraph where the individual has elected not to receive such communications under paragraph (f)(2)(ii) of this section.

(v) A covered entity may provide an individual who has elected not to receive further fundraising communications with a method to opt back in to receive such communications.

(g) Standard: Uses and disclosures for underwriting and related purposes. If a health plan receives protected health information for the purpose of underwriting, premium rating, or other activities relating to the creation, renewal, or replacement of a contract of health insurance or health benefits, and if such health insurance or health benefits are not placed with the health plan, such health plan may only use or disclose such protected health information for such purpose or as may be required by law, subject to the prohibition at § 164.502(a)(5)(i) with respect to genetic information included in the protected health information.

(h)(1) Standard: Verification requirements. Prior to any disclosure permitted by this subpart, a covered entity must:

(i) Except with respect to disclosures under § 164.510, verify the identity of a person requesting protected health information and the authority of any such person to have access to protected health information under this subpart, if the identity or any such authority of such person is not known to the covered entity; and

(ii) Obtain any documentation, statements, or representations, whether oral or written, from the person requesting the protected health information when such documentation, statement, or representation is a condition of the disclosure under this subpart.

(2) Implementation specifications: Verification—(i) Conditions on disclosures. If a disclosure is conditioned by this subpart on particular documentation, statements, or representations from the person requesting the protected health information, a covered entity may rely, if such reliance is reasonable under the circumstances, on documentation, statements, or representations that, on their face, meet the applicable requirements.

(A) The conditions in § 164.512(f)(1)(ii)(C) may be satisfied by the administrative subpoena or similar process or by a separate written statement that, on its face, demonstrates that the applicable requirements have been met.

(B) The documentation required by § 164.512(i)(2) may be satisfied by one or more written statements, provided that each is appropriately dated and signed in accordance with § 164.512(i)(2)(i) and (v).

(ii) Identity of public officials. A covered entity may rely, if such reliance is reasonable under the circumstances, on any of the following to verify identity when the disclosure of protected health information is to a public official or a person acting on behalf of the public official:

(A) If the request is made in person, presentation of an agency identification badge, other official credentials, or other proof of government status;

(B) If the request is in writing, the request is on the appropriate government letterhead; or

(C) If the disclosure is to a person acting on behalf of a public official, a written statement on appropriate government letterhead that the person is acting under the government's authority or other evidence or documentation of agency, such as a contract for services, memorandum of understanding, or purchase order, that establishes that the person is acting on behalf of the public official.

(iii) Authority of public officials. A covered entity may rely, if such reliance is reasonable under the circumstances, on any of the following to verify authority when the disclosure of protected health information is to a public official or a person acting on behalf of the public official:

(A) A written statement of the legal authority under which the information is requested, or, if a written statement would be impracticable, an oral statement of such legal authority;

(B) If a request is made pursuant to legal process, warrant, subpoena, order, or other legal process issued by a grand jury or a judicial or administrative tribunal is presumed to constitute legal authority.

(iv) Exercise of professional judgment. The verification requirements of this paragraph are met if the covered entity relies on the exercise of professional judgment in making a use or disclosure in accordance with § 164.510 or acts on a good faith belief in making a disclosure in accordance with § 164.512(j).

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53270, Aug. 14, 2002; 78 FR 5700, Jan. 25, 2013; 78 FR 34266, June 7, 2013]

§ 164.520 Notice of privacy practices for protected health information.

(a) Standard: Notice of privacy practices—(1) Right to notice. Except as provided by paragraph (a)(3) or (4) of this section, an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information.

(2) Notice requirements for covered entities creating or maintaining records subject to 42 U.S.C. 290dd-2. As provided in 42 CFR 2.22, an individual who is the subject of records protected under 42 CFR part 2 has a right to adequate notice of the uses and disclosures of such records, and of the individual's rights and the covered entity's legal duties with respect to such records.

(3) Exception for group health plans. (i) An individual enrolled in a group health plan has a right to notice:

(A) From the group health plan, if, and to the extent that, such an individual does not receive health benefits under the group health plan through an insurance contract with a health insurance issuer or HMO; or

(B) From the health insurance issuer or HMO with respect to the group health plan through which such individuals receive their health benefits under the group health plan.

(ii) A group health plan that provides health benefits solely through an insurance contract with a health insurance issuer or HMO, and that creates or receives protected health information in addition to summary health information as defined in § 164.504(a) or information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan, must:

(A) Maintain a notice under this section; and

(B) Provide such notice upon request to any person. The provisions of paragraph (c)(1) of this section do not apply to such group health plan.

(iii) A group health plan that provides health benefits solely through an insurance contract with a health insurance issuer or HMO, and does not create or receive protected health information other than summary health information as defined in § 164.504(a) or information on whether an individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan, is not required to maintain or provide a notice under this section.

(4) Exception for inmates. An inmate does not have a right to notice under this section, and the requirements of this section do not apply to a correctional institution that is a covered entity.

(b) Implementation specifications: Content of notice—(1) Required elements. The covered entity, including any covered entity receiving or maintaining records subject to 42 U.S.C. 290dd-2, must provide a notice that is written in plain language and that contains the elements required by this paragraph.

(i) Header. The notice must contain the following statement as a header or otherwise prominently displayed:

“THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”

(ii) Uses and disclosures. The notice must contain:

(A) A description, including at least one example, of the types of uses and disclosures that the covered entity is permitted by this subpart to make for each of the following purposes: treatment, payment, and health care operations.

(B) A description of each of the other purposes for which the covered entity is permitted or required by this subpart to use or disclose protected health information without the individual's written authorization.

(C) If a use or disclosure for any purpose described in paragraphs (b)(1)(ii)(A) or (B) of this section is prohibited or materially limited by other applicable law, such as 42 CFR part 2, the description of such use or disclosure must reflect the more stringent law as defined in § 160.202 of this subchapter.

(D) For each purpose described in paragraph (b)(1)(ii)(A) or (B) of this section, the description must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by this subpart and other applicable law, such as 42 CFR part 2.

(E) A description of the types of uses and disclosures that require an authorization under § 164.508(a)(2)-(a)(4), a statement that other uses and disclosures not described in the notice will be made only with the individual's written authorization, and a statement that the individual may revoke an authorization as provided by § 164.508(b)(5).

(F) A description, including at least one example, of the types of uses and disclosures prohibited under § 164.502(a)(5)(iii) in sufficient detail for an individual to understand the prohibition.

(G) A description, including at least one example, of the types of uses and disclosures for which an attestation is required under § 164.509.

(H) A statement adequate to put the individual on notice of the potential for information disclosed pursuant to this subpart to be subject to redisclosure by the recipient and no longer protected by this subpart

(iii) Separate statements for certain uses or disclosures. If the covered entity intends to engage in any of the following activities, the description required by paragraph (b)(1)(ii)(A) or (B) of this section must include a separate statement informing the individual of such activities, as applicable:

(A) In accordance with § 164.514(f)(1), the covered entity may contact the individual to raise funds for the covered entity and the individual has a right to opt out of receiving such communications;

(B) In accordance with § 164.504(f), the group health plan, or a health insurance issuer or HMO with respect to a group health plan, may disclose protected health information to the sponsor of the plan;

(C) If a covered entity that is a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, intends to use or disclose protected health information for underwriting purposes, a statement that the covered entity is prohibited from using or disclosing protected health information that is genetic information of an individual for such purposes;

(D) Substance use disorder treatment records received from programs subject to 42 CFR part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed; or

(E) If a covered entity that creates or maintains records subject to 42 CFR part 2 intends to use or disclose such records for fundraising for the benefit of the covered entity, the individual must first be provided with a clear and conspicuous opportunity to elect not to receive any fundraising communications.

(iv) Individual rights. The notice must contain a statement of the individual's rights with respect to protected health information and a brief description of how the individual may exercise these rights, as follows:

(A) The right to request restrictions on certain uses and disclosures of protected health information as provided by § 164.522(a), including a statement that the covered entity is not required to agree to a requested restriction, except in case of a disclosure restricted under § 164.522(a)(1)(vi);

(B) The right to receive confidential communications of protected health information as provided by § 164.522(b), as applicable;

(C) The right to inspect and copy protected health information as provided by § 164.524;

(D) The right to amend protected health information as provided by § 164.526;

(E) The right to receive an accounting of disclosures of protected health information as provided by § 164.528; and

(F) The right of an individual, including an individual who has agreed to receive the notice electronically in accordance with paragraph (c)(3) of this section, to obtain a paper copy of the notice from the covered entity upon request.

(v) Covered entity's duties. The notice must contain:

(A) A statement that the covered entity is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices, and to notify affected individuals following a breach of unsecured protected health information;

(B) A statement that the covered entity is required to abide by the terms of the notice currently in effect; and

(C) For the covered entity to apply a change in a privacy practice that is described in the notice to protected health information that the covered entity created or received prior to issuing a revised notice, in accordance with § 164.530(i)(2)(ii), a statement that it reserves the right to change the terms of its notice and to make the new notice provisions effective for all protected health information that it maintains. The statement must also describe how it will provide individuals with a revised notice.

(vi) Complaints. The notice must contain a statement that individuals may complain to the covered entity and to the Secretary if they believe their privacy rights have been violated, a brief description of how the individual may file a complaint with the covered entity, and a statement that the individual will not be retaliated against for filing a complaint.

(vii) Contact. The notice must contain the name, or title, and telephone number of a person or office to contact for further information as required by § 164.530(a)(1)(ii).

(viii) Effective date. The notice must contain the date on which the notice is first in effect, which may not be earlier than the date on which the notice is printed or otherwise published.

(2) Optional elements. (i) In addition to the information required by paragraph (b)(1) of this section, if a covered entity elects to limit the uses or disclosures that it is permitted to make under this subpart, the covered entity may describe its more limited uses or disclosures in its notice, provided that the covered entity may not include in its notice a limitation affecting its right to make a use or disclosure that is required by law or permitted by § 164.512(j)(1)(i).

(ii) For the covered entity to apply a change in its more limited uses and disclosures to protected health information created or received prior to issuing a revised notice, in accordance with § 164.530(i)(2)(ii), the notice must include the statements required by paragraph (b)(1)(v)(C) of this section.

(3) Revisions to the notice. The covered entity must promptly revise and distribute its notice whenever there is a material change to the uses or disclosures, the individual's rights, the covered entity's legal duties, or other privacy practices stated in the notice. Except when required by law, a material change to any term of the notice may not be implemented prior to the effective date of the notice in which such material change is reflected.

(c) Implementation specifications: Provision of notice. A covered entity must make the notice required by this section available on request to any person and to individuals as specified in paragraphs (c)(1) through (c)(3) of this section, as applicable.

(1) Specific requirements for health plans. (i) A health plan must provide the notice:

(A) No later than the compliance date for the health plan, to individuals then covered by the plan;

(B) Thereafter, at the time of enrollment, to individuals who are new enrollees.

(ii) No less frequently than once every three years, the health plan must notify individuals then covered by the plan of the availability of the notice and how to obtain the notice.

(iii) The health plan satisfies the requirements of paragraph (c)(1) of this section if notice is provided to the named insured of a policy under which coverage is provided to the named insured and one or more dependents.

(iv) If a health plan has more than one notice, it satisfies the requirements of paragraph (c)(1) of this section by providing the notice that is relevant to the individual or other person requesting the notice.

(v) If there is a material change to the notice:

(A) A health plan that posts its notice on its web site in accordance with paragraph (c)(3)(i) of this section must prominently post the change or its revised notice on its web site by the effective date of the material change to the notice, and provide the revised notice, or information about the material change and how to obtain the revised notice, in its next annual mailing to individuals then covered by the plan.

(B) A health plan that does not post its notice on a web site pursuant to paragraph (c)(3)(i) of this section must provide the revised notice, or information about the material change and how to obtain the revised notice, to individuals then covered by the plan within 60 days of the material revision to the notice.

(2) Specific requirements for certain covered health care providers. A covered health care provider that has a direct treatment relationship with an individual must:

(i) Provide the notice:

(A) No later than the date of the first service delivery, including service delivered electronically, to such individual after the compliance date for the covered health care provider; or

(B) In an emergency treatment situation, as soon as reasonably practicable after the emergency treatment situation.

(ii) Except in an emergency treatment situation, make a good faith effort to obtain a written acknowledgment of receipt of the notice provided in accordance with paragraph (c)(2)(i) of this section, and if not obtained, document its good faith efforts to obtain such acknowledgment and the reason why the acknowledgment was not obtained;

(iii) If the covered health care provider maintains a physical service delivery site:

(A) Have the notice available at the service delivery site for individuals to request to take with them; and

(B) Post the notice in a clear and prominent location where it is reasonable to expect individuals seeking service from the covered health care provider to be able to read the notice; and

(iv) Whenever the notice is revised, make the notice available upon request on or after the effective date of the revision and promptly comply with the requirements of paragraph (c)(2)(iii) of this section, if applicable.

(3) Specific requirements for electronic notice. (i) A covered entity that maintains a web site that provides information about the covered entity's customer services or benefits must prominently post its notice on the web site and make the notice available electronically through the web site.

(ii) A covered entity may provide the notice required by this section to an individual by e-mail, if the individual agrees to electronic notice and such agreement has not been withdrawn. If the covered entity knows that the e-mail transmission has failed, a paper copy of the notice must be provided to the individual. Provision of electronic notice by the covered entity will satisfy the provision requirements of paragraph (c) of this section when timely made in accordance with paragraph (c)(1) or (2) of this section.

(iii) For purposes of paragraph (c)(2)(i) of this section, if the first service delivery to an individual is delivered electronically, the covered health care provider must provide electronic notice automatically and contemporaneously in response to the individual's first request for service. The requirements in paragraph (c)(2)(ii) of this section apply to electronic notice.

(iv) The individual who is the recipient of electronic notice retains the right to obtain a paper copy of the notice from a covered entity upon request.

(d) Implementation specifications: Joint notice by separate covered entities. Covered entities that participate in organized health care arrangements may comply with this section by a joint notice, provided that:

(1) The covered entities participating in the organized health care arrangement agree to abide by the terms of the notice with respect to protected health information created or received by the covered entity as part of its participation in the organized health care arrangement;

(2) The joint notice meets the implementation specifications in paragraph (b) of this section, except that the statements required by this section may be altered to reflect the fact that the notice covers more than one covered entity; and

(i) Describes with reasonable specificity the covered entities, or class of entities, to which the joint notice applies;

(ii) Describes with reasonable specificity the service delivery sites, or classes of service delivery sites, to which the joint notice applies; and

(iii) If applicable, states that the covered entities participating in the organized health care arrangement will share protected health information with each other, as necessary to carry out treatment, payment, or health care operations relating to the organized health care arrangement.

(3) The covered entities included in the joint notice must provide the notice to individuals in accordance with the applicable implementation specifications of paragraph (c) of this section. Provision of the joint notice to an individual by any one of the covered entities included in the joint notice will satisfy the provision requirement of paragraph (c) of this section with respect to all others covered by the joint notice.

(4) The permission in paragraph (d) of this section for covered entities that participate in an organized health care arrangement to issue a joint notice may not be construed to remove any obligations or duties of entities creating or maintaining records subject to 42 U.S.C. 290dd-2, or to remove any rights of patients who are the subjects of such records.

(e) Implementation specifications: Documentation. A covered entity must document compliance with the notice requirements, as required by § 164.530(j), by retaining copies of the notices issued by the covered entity and, if applicable, any written acknowledgments of receipt of the notice or documentation of good faith efforts to obtain such written acknowledgment, in accordance with paragraph (c)(2)(ii) of this section.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002; 78 FR 5701, Jan. 25, 2013; 89 FR 33064, Apr. 26, 2024]

§ 164.522 Rights to request privacy protection for protected health information.

(a)(1) Standard: Right of an individual to request restriction of uses and disclosures. (i) A covered entity must permit an individual to request that the covered entity restrict:

(A) Uses or disclosures of protected health information about the individual to carry out treatment, payment, or health care operations; and

(B) Disclosures permitted under § 164.510(b).

(ii) Except as provided in paragraph (a)(1)(vi) of this section, a covered entity is not required to agree to a restriction.

(iii) A covered entity that agrees to a restriction under paragraph (a)(1)(i) of this section may not use or disclose protected health information in violation of such restriction, except that, if the individual who requested the restriction is in need of emergency treatment and the restricted protected health information is needed to provide the emergency treatment, the covered entity may use the restricted protected health information, or may disclose such information to a health care provider, to provide such treatment to the individual.

(iv) If restricted protected health information is disclosed to a health care provider for emergency treatment under paragraph (a)(1)(iii) of this section, the covered entity must request that such health care provider not further use or disclose the information.

(v) A restriction agreed to by a covered entity under paragraph (a) of this section, is not effective under this subpart to prevent uses or disclosures permitted or required under § 164.502(a)(2)(ii), § 164.510(a) or § 164.512.

(vi) A covered entity must agree to the request of an individual to restrict disclosure of protected health information about the individual to a health plan if:

(A) The disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and

(B) The protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full.

(2) Implementation specifications: Terminating a restriction. A covered entity may terminate a restriction, if:

(i) The individual agrees to or requests the termination in writing;

(ii) The individual orally agrees to the termination and the oral agreement is documented; or

(iii) The covered entity informs the individual that it is terminating its agreement to a restriction, except that such termination is:

(A) Not effective for protected health information restricted under paragraph (a)(1)(vi) of this section; and

(B) Only effective with respect to protected health information created or received after it has so informed the individual.

(3) Implementation specification: Documentation. A covered entity must document a restriction in accordance with § 160.530(j) of this subchapter.

(b)(1) Standard: Confidential communications requirements. (i) A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations.

(ii) A health plan must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the health plan by alternative means or at alternative locations, if the individual clearly states that the disclosure of all or part of that information could endanger the individual.

(2) Implementation specifications: Conditions on providing confidential communications. (i) A covered entity may require the individual to make a request for a confidential communication described in paragraph (b)(1) of this section in writing.

(ii) A covered entity may condition the provision of a reasonable accommodation on:

(A) When appropriate, information as to how payment, if any, will be handled; and

(B) Specification of an alternative address or other method of contact.

(iii) A covered health care provider may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis.

(iv) A health plan may require that a request contain a statement that disclosure of all or part of the information to which the request pertains could endanger the individual.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002; 78 FR 5701, Jan. 25, 2013]

§ 164.524 Access of individuals to protected health information.

(a) Standard: Access to protected health information—(1) Right of access. Except as otherwise provided in paragraph (a)(2) or (a)(3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set, except for:

(i) Psychotherapy notes; and

(ii) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

(2) Unreviewable grounds for denial. A covered entity may deny an individual access without providing the individual an opportunity for review, in the following circumstances.

(i) The protected health information is excepted from the right of access by paragraph (a)(1) of this section.

(ii) A covered entity that is a correctional institution or a covered health care provider acting under the direction of the correctional institution may deny, in whole or in part, an inmate's request to obtain a copy of protected health information, if obtaining such copy would jeopardize the health, safety, security, custody, or rehabilitation of the individual or of other inmates, or the safety of any officer, employee, or other person at the correctional institution or responsible for the transporting of the inmate.

(iii) An individual's access to protected health information created or obtained by a covered health care provider in the course of research that includes treatment may be temporarily suspended for as long as the research is in progress, provided that the individual has agreed to the denial of access when consenting to participate in the research that includes treatment, and the covered health care provider has informed the individual that the right of access will be reinstated upon completion of the research.

(iv) An individual's access to protected health information that is contained in records that are subject to the Privacy Act, 5 U.S.C. 552a, may be denied, if the denial of access under the Privacy Act would meet the requirements of that law.

(v) An individual's access may be denied if the protected health information was obtained from someone other than a health care provider under a promise of confidentiality and the access requested would be reasonably likely to reveal the source of the information.

(3) Reviewable grounds for denial. A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed, as required by paragraph (a)(4) of this section, in the following circumstances:

(i) A licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger the life or physical safety of the individual or another person;

(ii) The protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or

(iii) The request for access is made by the individual's personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.

(4) Review of a denial of access. If access is denied on a ground permitted under paragraph (a)(3) of this section, the individual has the right to have the denial reviewed by a licensed health care professional who is designated by the covered entity to act as a reviewing official and who did not participate in the original decision to deny. The covered entity must provide or deny access in accordance with the determination of the reviewing official under paragraph (d)(4) of this section.

(b) Implementation specifications: Requests for access and timely action—(1) Individual's request for access. The covered entity must permit an individual to request access to inspect or to obtain a copy of the protected health information about the individual that is maintained in a designated record set. The covered entity may require individuals to make requests for access in writing, provided that it informs individuals of such a requirement.

(2) Timely action by the covered entity. (i) Except as provided in paragraph (b)(2)(ii) of this section, the covered entity must act on a request for access no later than 30 days after receipt of the request as follows.

(A) If the covered entity grants the request, in whole or in part, it must inform the individual of the acceptance of the request and provide the access requested, in accordance with paragraph (c) of this section.

(B) If the covered entity denies the request, in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d) of this section.

(ii) If the covered entity is unable to take an action required by paragraph (b)(2)(i)(A) or (B) of this section within the time required by paragraph (b)(2)(i) of this section, as applicable, the covered entity may extend the time for such actions by no more than 30 days, provided that:

(A) The covered entity, within the time limit set by paragraph (b)(2)(i) of this section, as applicable, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request; and

(B) The covered entity may have only one such extension of time for action on a request for access.

(c) Implementation specifications: Provision of access. If the covered entity provides an individual with access, in whole or in part, to protected health information, the covered entity must comply with the following requirements.

(1) Providing the access requested. The covered entity must provide the access requested by individuals, including inspection or obtaining a copy, or both, of the protected health information about them in designated record sets. If the same protected health information that is the subject of a request for access is maintained in more than one designated record set or at more than one location, the covered entity need only produce the protected health information once in response to a request for access.

(2) Form of access requested. (i) The covered entity must provide the individual with access to the protected health information in the form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable hard copy form or such other form and format as agreed to by the covered entity and the individual.

(ii) Notwithstanding paragraph (c)(2)(i) of this section, if the protected health information that is the subject of a request for access is maintained in one or more designated record sets electronically and if the individual requests an electronic copy of such information, the covered entity must provide the individual with access to the protected health information in the electronic form and format requested by the individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual.

(iii) The covered entity may provide the individual with a summary of the protected health information requested, in lieu of providing access to the protected health information or may provide an explanation of the protected health information to which access has been provided, if:

(A) The individual agrees in advance to such a summary or explanation; and

(B) The individual agrees in advance to the fees imposed, if any, by the covered entity for such summary or explanation.

(3) Time and manner of access. (i) The covered entity must provide the access as requested by the individual in a timely manner as required by paragraph (b)(2) of this section, including arranging with the individual for a convenient time and place to inspect or obtain a copy of the protected health information, or mailing the copy of the protected health information at the individual's request. The covered entity may discuss the scope, format, and other aspects of the request for access with the individual as necessary to facilitate the timely provision of access.

(ii) If an individual's request for access directs the covered entity to transmit the copy of protected health information directly to another person designated by the individual, the covered entity must provide the copy to the person designated by the individual. The individual's request must be in writing, signed by the individual, and clearly identify the designated person and where to send the copy of protected health information.

(4) Fees. If the individual requests a copy of the protected health information or agrees to a summary or explanation of such information, the covered entity may impose a reasonable, cost-based fee, provided that the fee includes only the cost of:

(i) Labor for copying the protected health information requested by the individual, whether in paper or electronic form;

(ii) Supplies for creating the paper copy or electronic media if the individual requests that the electronic copy be provided on portable media;

(iii) Postage, when the individual has requested the copy, or the summary or explanation, be mailed; and

(iv) Preparing an explanation or summary of the protected health information, if agreed to by the individual as required by paragraph (c)(2)(iii) of this section.

(d) Implementation specifications: Denial of access. If the covered entity denies access, in whole or in part, to protected health information, the covered entity must comply with the following requirements.

(1) Making other information accessible. The covered entity must, to the extent possible, give the individual access to any other protected health information requested, after excluding the protected health information as to which the covered entity has a ground to deny access.

(2) Denial. The covered entity must provide a timely, written denial to the individual, in accordance with paragraph (b)(2) of this section. The denial must be in plain language and contain:

(i) The basis for the denial;

(ii) If applicable, a statement of the individual's review rights under paragraph (a)(4) of this section, including a description of how the individual may exercise such review rights; and

(iii) A description of how the individual may complain to the covered entity pursuant to the complaint procedures in § 164.530(d) or to the Secretary pursuant to the procedures in § 160.306. The description must include the name, or title, and telephone number of the contact person or office designated in § 164.530(a)(1)(ii).

(3) Other responsibility. If the covered entity does not maintain the protected health information that is the subject of the individual's request for access, and the covered entity knows where the requested information is maintained, the covered entity must inform the individual where to direct the request for access.

(4) Review of denial requested. If the individual has requested a review of a denial under paragraph (a)(4) of this section, the covered entity must designate a licensed health care professional, who was not directly involved in the denial to review the decision to deny access. The covered entity must promptly refer a request for review to such designated reviewing official. The designated reviewing official must determine, within a reasonable period of time, whether or not to deny the access requested based on the standards in paragraph (a)(3) of this section. The covered entity must promptly provide written notice to the individual of the determination of the designated reviewing official and take other action as required by this section to carry out the designated reviewing official's determination.

(e) Implementation specification: Documentation. A covered entity must document the following and retain the documentation as required by § 164.530(j):

(1) The designated record sets that are subject to access by individuals; and

(2) The titles of the persons or offices responsible for receiving and processing requests for access by individuals.

[65 FR 82802, Dec. 28, 2000, as amended at 78 FR 5701, Jan. 25, 2013; 78 FR 34266, June 7, 2013; 79 FR 7316, Feb. 6, 2014]

§ 164.526 Amendment of protected health information.

(a) Standard: Right to amend. (1) Right to amend. An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set.

(2) Denial of amendment. A covered entity may deny an individual's request for amendment, if it determines that the protected health information or record that is the subject of the request:

(i) Was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of protected health information is no longer available to act on the requested amendment;

(ii) Is not part of the designated record set;

(iii) Would not be available for inspection under § 164.524; or

(iv) Is accurate and complete.

(b) Implementation specifications: Requests for amendment and timely action—(1) Individual's request for amendment. The covered entity must permit an individual to request that the covered entity amend the protected health information maintained in the designated record set. The covered entity may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements.

(2) Timely action by the covered entity. (i) The covered entity must act on the individual's request for an amendment no later than 60 days after receipt of such a request, as follows.

(A) If the covered entity grants the requested amendment, in whole or in part, it must take the actions required by paragraphs (c)(1) and (2) of this section.

(B) If the covered entity denies the requested amendment, in whole or in part, it must provide the individual with a written denial, in accordance with paragraph (d)(1) of this section.

(ii) If the covered entity is unable to act on the amendment within the time required by paragraph (b)(2)(i) of this section, the covered entity may extend the time for such action by no more than 30 days, provided that:

(A) The covered entity, within the time limit set by paragraph (b)(2)(i) of this section, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will complete its action on the request; and

(B) The covered entity may have only one such extension of time for action on a request for an amendment.

(c) Implementation specifications: Accepting the amendment. If the covered entity accepts the requested amendment, in whole or in part, the covered entity must comply with the following requirements.

(1) Making the amendment. The covered entity must make the appropriate amendment to the protected health information or record that is the subject of the request for amendment by, at a minimum, identifying the records in the designated record set that are affected by the amendment and appending or otherwise providing a link to the location of the amendment.

(2) Informing the individual. In accordance with paragraph (b) of this section, the covered entity must timely inform the individual that the amendment is accepted and obtain the individual's identification of and agreement to have the covered entity notify the relevant persons with which the amendment needs to be shared in accordance with paragraph (c)(3) of this section.

(3) Informing others. The covered entity must make reasonable efforts to inform and provide the amendment within a reasonable time to:

(i) Persons identified by the individual as having received protected health information about the individual and needing the amendment; and

(ii) Persons, including business associates, that the covered entity knows have the protected health information that is the subject of the amendment and that may have relied, or could foreseeably rely, on such information to the detriment of the individual.

(d) Implementation specifications: Denying the amendment. If the covered entity denies the requested amendment, in whole or in part, the covered entity must comply with the following requirements.

(1) Denial. The covered entity must provide the individual with a timely, written denial, in accordance with paragraph (b)(2) of this section. The denial must use plain language and contain:

(i) The basis for the denial, in accordance with paragraph (a)(2) of this section;

(ii) The individual's right to submit a written statement disagreeing with the denial and how the individual may file such a statement;

(iii) A statement that, if the individual does not submit a statement of disagreement, the individual may request that the covered entity provide the individual's request for amendment and the denial with any future disclosures of the protected health information that is the subject of the amendment; and

(iv) A description of how the individual may complain to the covered entity pursuant to the complaint procedures established in § 164.530(d) or to the Secretary pursuant to the procedures established in § 160.306. The description must include the name, or title, and telephone number of the contact person or office designated in § 164.530(a)(1)(ii).

(2) Statement of disagreement. The covered entity must permit the individual to submit to the covered entity a written statement disagreeing with the denial of all or part of a requested amendment and the basis of such disagreement. The covered entity may reasonably limit the length of a statement of disagreement.

(3) Rebuttal statement. The covered entity may prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the covered entity must provide a copy to the individual who submitted the statement of disagreement.

(4) Recordkeeping. The covered entity must, as appropriate, identify the record or protected health information in the designated record set that is the subject of the disputed amendment and append or otherwise link the individual's request for an amendment, the covered entity's denial of the request, the individual's statement of disagreement, if any, and the covered entity's rebuttal, if any, to the designated record set.

(5) Future disclosures. (i) If a statement of disagreement has been submitted by the individual, the covered entity must include the material appended in accordance with paragraph (d)(4) of this section, or, at the election of the covered entity, an accurate summary of any such information, with any subsequent disclosure of the protected health information to which the disagreement relates.

(ii) If the individual has not submitted a written statement of disagreement, the covered entity must include the individual's request for amendment and its denial, or an accurate summary of such information, with any subsequent disclosure of the protected health information only if the individual has requested such action in accordance with paragraph (d)(1)(iii) of this section.

(iii) When a subsequent disclosure described in paragraph (d)(5)(i) or (ii) of this section is made using a standard transaction under part 162 of this subchapter that does not permit the additional material to be included with the disclosure, the covered entity may separately transmit the material required by paragraph (d)(5)(i) or (ii) of this section, as applicable, to the recipient of the standard transaction.

(e) Implementation specification: Actions on notices of amendment. A covered entity that is informed by another covered entity of an amendment to an individual's protected health information, in accordance with paragraph (c)(3) of this section, must amend the protected health information in designated record sets as provided by paragraph (c)(1) of this section.

(f) Implementation specification: Documentation. A covered entity must document the titles of the persons or offices responsible for receiving and processing requests for amendments by individuals and retain the documentation as required by § 164.530(j).

§ 164.528 Accounting of disclosures of protected health information.

(a) Standard: Right to an accounting of disclosures of protected health information. (1) An individual has a right to receive an accounting of disclosures of protected health information made by a covered entity in the six years prior to the date on which the accounting is requested, except for disclosures:

(i) To carry out treatment, payment and health care operations as provided in § 164.506;

(ii) To individuals of protected health information about them as provided in § 164.502;

(iii) Incident to a use or disclosure otherwise permitted or required by this subpart, as provided in § 164.502;

(iv) Pursuant to an authorization as provided in § 164.508;

(v) For the facility's directory or to persons involved in the individual's care or other notification purposes as provided in § 164.510;

(vi) For national security or intelligence purposes as provided in § 164.512(k)(2);

(vii) To correctional institutions or law enforcement officials as provided in § 164.512(k)(5);

(viii) As part of a limited data set in accordance with § 164.514(e); or

(ix) That occurred prior to the compliance date for the covered entity.

(2)(i) The covered entity must temporarily suspend an individual's right to receive an accounting of disclosures to a health oversight agency or law enforcement official, as provided in § 164.512(d) or (f), respectively, for the time specified by such agency or official, if such agency or official provides the covered entity with a written statement that such an accounting to the individual would be reasonably likely to impede the agency's activities and specifying the time for which such a suspension is required.

(ii) If the agency or official statement in paragraph (a)(2)(i) of this section is made orally, the covered entity must:

(A) Document the statement, including the identity of the agency or official making the statement;

(B) Temporarily suspend the individual's right to an accounting of disclosures subject to the statement; and

(C) Limit the temporary suspension to no longer than 30 days from the date of the oral statement, unless a written statement pursuant to paragraph (a)(2)(i) of this section is submitted during that time.

(3) An individual may request an accounting of disclosures for a period of time less than six years from the date of the request.

(b) Implementation specifications: Content of the accounting. The covered entity must provide the individual with a written accounting that meets the following requirements.

(1) Except as otherwise provided by paragraph (a) of this section, the accounting must include disclosures of protected health information that occurred during the six years (or such shorter time period at the request of the individual as provided in paragraph (a)(3) of this section) prior to the date of the request for an accounting, including disclosures to or by business associates of the covered entity.

(2) Except as otherwise provided by paragraphs (b)(3) or (b)(4) of this section, the accounting must include for each disclosure:

(i) The date of the disclosure;

(ii) The name of the entity or person who received the protected health information and, if known, the address of such entity or person;

(iii) A brief description of the protected health information disclosed; and

(iv) A brief statement of the purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or, in lieu of such statement, a copy of a written request for a disclosure under § 164.502(a)(2)(ii) or § 164.512, if any.

(3) If, during the period covered by the accounting, the covered entity has made multiple disclosures of protected health information to the same person or entity for a single purpose under § 164.502(a)(2)(ii) or § 164.512, the accounting may, with respect to such multiple disclosures, provide:

(i) The information required by paragraph (b)(2) of this section for the first disclosure during the accounting period;

(ii) The frequency, periodicity, or number of the disclosures made during the accounting period; and

(iii) The date of the last such disclosure during the accounting period.

(4)(i) If, during the period covered by the accounting, the covered entity has made disclosures of protected health information for a particular research purpose in accordance with § 164.512(i) for 50 or more individuals, the accounting may, with respect to such disclosures for which the protected health information about the individual may have been included, provide:

(A) The name of the protocol or other research activity;

(B) A description, in plain language, of the research protocol or other research activity, including the purpose of the research and the criteria for selecting particular records;

(C) A brief description of the type of protected health information that was disclosed;

(D) The date or period of time during which such disclosures occurred, or may have occurred, including the date of the last such disclosure during the accounting period;

(E) The name, address, and telephone number of the entity that sponsored the research and of the researcher to whom the information was disclosed; and

(F) A statement that the protected health information of the individual may or may not have been disclosed for a particular protocol or other research activity.

(ii) If the covered entity provides an accounting for research disclosures, in accordance with paragraph (b)(4) of this section, and if it is reasonably likely that the protected health information of the individual was disclosed for such research protocol or activity, the covered entity shall, at the request of the individual, assist in contacting the entity that sponsored the research and the researcher.

(c) Implementation specifications: Provision of the accounting. (1) The covered entity must act on the individual's request for an accounting, no later than 60 days after receipt of such a request, as follows.

(i) The covered entity must provide the individual with the accounting requested; or

(ii) If the covered entity is unable to provide the accounting within the time required by paragraph (c)(1) of this section, the covered entity may extend the time to provide the accounting by no more than 30 days, provided that:

(A) The covered entity, within the time limit set by paragraph (c)(1) of this section, provides the individual with a written statement of the reasons for the delay and the date by which the covered entity will provide the accounting; and

(B) The covered entity may have only one such extension of time for action on a request for an accounting.

(2) The covered entity must provide the first accounting to an individual in any 12 month period without charge. The covered entity may impose a reasonable, cost-based fee for each subsequent request for an accounting by the same individual within the 12 month period, provided that the covered entity informs the individual in advance of the fee and provides the individual with an opportunity to withdraw or modify the request for a subsequent accounting in order to avoid or reduce the fee.

(d) Implementation specification: Documentation. A covered entity must document the following and retain the documentation as required by § 164.530(j):

(1) The information required to be included in an accounting under paragraph (b) of this section for disclosures of protected health information that are subject to an accounting under paragraph (a) of this section;

(2) The written accounting that is provided to the individual under this section; and

(3) The titles of the persons or offices responsible for receiving and processing requests for an accounting by individuals.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53271, Aug. 14, 2002]

§ 164.530 Administrative requirements.

(a)(1) Standard: Personnel designations. (i) A covered entity must designate a privacy official who is responsible for the development and implementation of the policies and procedures of the entity.

(ii) A covered entity must designate a contact person or office who is responsible for receiving complaints under this section and who is able to provide further information about matters covered by the notice required by § 164.520.

(2) Implementation specification: Personnel designations. A covered entity must document the personnel designations in paragraph (a)(1) of this section as required by paragraph (j) of this section.

(b)(1) Standard: Training. A covered entity must train all members of its workforce on the policies and procedures with respect to protected health information required by this subpart and subpart D of this part, as necessary and appropriate for the members of the workforce to carry out their functions within the covered entity.

(2) Implementation specifications: Training. (i) A covered entity must provide training that meets the requirements of paragraph (b)(1) of this section, as follows:

(A) To each member of the covered entity's workforce by no later than the compliance date for the covered entity;

(B) Thereafter, to each new member of the workforce within a reasonable period of time after the person joins the covered entity's workforce; and

(C) To each member of the covered entity's workforce whose functions are affected by a material change in the policies or procedures required by this subpart or subpart D of this part, within a reasonable period of time after the material change becomes effective in accordance with paragraph (i) of this section.

(ii) A covered entity must document that the training as described in paragraph (b)(2)(i) of this section has been provided, as required by paragraph (j) of this section.

(c)(1) Standard: Safeguards. A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.

(2)(i) Implementation specification: Safeguards. A covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of this subpart.

(ii) A covered entity must reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

(d)(1) Standard: Complaints to the covered entity. A covered entity must provide a process for individuals to make complaints concerning the covered entity's policies and procedures required by this subpart and subpart D of this part or its compliance with such policies and procedures or the requirements of this subpart or subpart D of this part.

(2) Implementation specification: Documentation of complaints. As required by paragraph (j) of this section, a covered entity must document all complaints received, and their disposition, if any.

(e)(1) Standard: Sanctions. A covered entity must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity or the requirements of this subpart or subpart D of this part. This standard does not apply to a member of the covered entity's workforce with respect to actions that are covered by and that meet the conditions of § 164.502(j) or paragraph (g)(2) of this section.

(2) Implementation specification: Documentation. As required by paragraph (j) of this section, a covered entity must document the sanctions that are applied, if any.

(f) Standard: Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect that is known to the covered entity of a use or disclosure of protected health information in violation of its policies and procedures or the requirements of this subpart by the covered entity or its business associate.

(g) Standard: Refraining from intimidating or retaliatory acts. A covered entity—

(1) May not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for the exercise by the individual of any right established, or for participation in any process provided for, by this subpart or subpart D of this part, including the filing of a complaint under this section; and

(2) Must refrain from intimidation and retaliation as provided in § 160.316 of this subchapter.

(h) Standard: Waiver of rights. A covered entity may not require individuals to waive their rights under § 160.306 of this subchapter, this subpart, or subpart D of this part, as a condition of the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits.

(i)(1) Standard: Policies and procedures. A covered entity must implement policies and procedures with respect to protected health information that are designed to comply with the standards, implementation specifications, or other requirements of this subpart and subpart D of this part. The policies and procedures must be reasonably designed, taking into account the size and the type of activities that relate to protected health information undertaken by a covered entity, to ensure such compliance. This standard is not to be construed to permit or excuse an action that violates any other standard, implementation specification, or other requirement of this subpart.

(2) Standard: Changes to policies and procedures. (i) A covered entity must change its policies and procedures as necessary and appropriate to comply with changes in the law, including the standards, requirements, and implementation specifications of this subpart or subpart D of this part.

(ii) When a covered entity changes a privacy practice that is stated in the notice described in § 164.520, and makes corresponding changes to its policies and procedures, it may make the changes effective for protected health information that it created or received prior to the effective date of the notice revision, if the covered entity has, in accordance with § 164.520(b)(1)(v)(C), included in the notice a statement reserving its right to make such a change in its privacy practices; or

(iii) A covered entity may make any other changes to policies and procedures at any time, provided that the changes are documented and implemented in accordance with paragraph (i)(5) of this section.

(3) Implementation specification: Changes in law. Whenever there is a change in law that necessitates a change to the covered entity's policies or procedures, the covered entity must promptly document and implement the revised policy or procedure. If the change in law materially affects the content of the notice required by § 164.520, the covered entity must promptly make the appropriate revisions to the notice in accordance with § 164.520(b)(3). Nothing in this paragraph may be used by a covered entity to excuse a failure to comply with the law.

(4) Implementation specifications: Changes to privacy practices stated in the notice. (i) To implement a change as provided by paragraph (i)(2)(ii) of this section, a covered entity must:

(A) Ensure that the policy or procedure, as revised to reflect a change in the covered entity's privacy practice as stated in its notice, complies with the standards, requirements, and implementation specifications of this subpart;

(B) Document the policy or procedure, as revised, as required by paragraph (j) of this section; and

(C) Revise the notice as required by § 164.520(b)(3) to state the changed practice and make the revised notice available as required by § 164.520(c). The covered entity may not implement a change to a policy or procedure prior to the effective date of the revised notice.

(ii) If a covered entity has not reserved its right under § 164.520(b)(1)(v)(C) to change a privacy practice that is stated in the notice, the covered entity is bound by the privacy practices as stated in the notice with respect to protected health information created or received while such notice is in effect. A covered entity may change a privacy practice that is stated in the notice, and the related policies and procedures, without having reserved the right to do so, provided that:

(A) Such change meets the implementation specifications in paragraphs (i)(4)(i)(A)-(C) of this section; and

(B) Such change is effective only with respect to protected health information created or received after the effective date of the notice.

(5) Implementation specification: Changes to other policies or procedures. A covered entity may change, at any time, a policy or procedure that does not materially affect the content of the notice required by § 164.520, provided that:

(i) The policy or procedure, as revised, complies with the standards, requirements, and implementation specifications of this subpart; and

(ii) Prior to the effective date of the change, the policy or procedure, as revised, is documented as required by paragraph (j) of this section.

(j)(1) Standard: Documentation. A covered entity must:

(i) Maintain the policies and procedures provided for in paragraph (i) of this section in written or electronic form;

(ii) If a communication is required by this subpart to be in writing, maintain such writing, or an electronic copy, as documentation; and

(iii) If an action, activity, or designation is required by this subpart to be documented, maintain a written or electronic record of such action, activity, or designation.

(iv) Maintain documentation sufficient to meet its burden of proof under § 164.414(b).

(2) Implementation specification: Retention period. A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.

(k) Standard: Group health plans. (1) A group health plan is not subject to the standards or implementation specifications in paragraphs (a) through (f) and (i) of this section, to the extent that:

(i) The group health plan provides health benefits solely through an insurance contract with a health insurance issuer or an HMO; and

(ii) The group health plan does not create or receive protected health information, except for:

(A) Summary health information as defined in § 164.504(a); or

(B) Information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan.

(2) A group health plan described in paragraph (k)(1) of this section is subject to the standard and implementation specification in paragraph (j) of this section only with respect to plan documents amended in accordance with § 164.504(f).

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53272, Aug. 14, 2002; 71 FR 8433, Feb. 16, 2006; 74 FR 42769, Aug. 24, 2009]

§ 164.532 Transition provisions.

(a) Standard: Effect of prior authorizations. Notwithstanding §§ 164.508 and 164.512(i), a covered entity may use or disclose protected health information, consistent with paragraphs (b) and (c) of this section, pursuant to an authorization or other express legal permission obtained from an individual permitting the use or disclosure of protected health information, informed consent of the individual to participate in research, a waiver of informed consent by an IRB, or a waiver of authorization in accordance with § 164.512(i)(1)(i).

(b) Implementation specification: Effect of prior authorization for purposes other than research. Notwithstanding any provisions in § 164.508, a covered entity may use or disclose protected health information that it created or received prior to the applicable compliance date of this subpart pursuant to an authorization or other express legal permission obtained from an individual prior to the applicable compliance date of this subpart, provided that the authorization or other express legal permission specifically permits such use or disclosure and there is no agreed-to restriction in accordance with § 164.522(a).

(c) Implementation specification: Effect of prior permission for research. Notwithstanding any provisions in §§ 164.508 and 164.512(i), a covered entity may, to the extent allowed by one of the following permissions, use or disclose, for research, protected health information that it created or received either before or after the applicable compliance date of this subpart, provided that there is no agreed-to restriction in accordance with § 164.522(a), and the covered entity has obtained, prior to the applicable compliance date, either:

(1) An authorization or other express legal permission from an individual to use or disclose protected health information for the research;

(2) The informed consent of the individual to participate in the research;

(3) A waiver, by an IRB, of informed consent for the research, in accordance with 7 CFR 1c.116(d), 10 CFR 745.116(d), 14 CFR 1230.116(d), 15 CFR 27.116(d), 16 CFR 1028.116(d), 21 CFR 50.24, 22 CFR 225.116(d), 24 CFR 60.116(d), 28 CFR 46.116(d), 32 CFR 219.116(d), 34 CFR 97.116(d), 38 CFR 16.116(d), 40 CFR 26.116(d), 45 CFR 46.116(d), 45 CFR 690.116(d), or 49 CFR 11.116(d), provided that a covered entity must obtain authorization in accordance with § 164.508 if, after the compliance date, informed consent is sought from an individual participating in the research; or

(4) A waiver of authorization in accordance with § 164.512(i)(1)(i).

(d) Standard: Effect of prior contracts or other arrangements with business associates. Notwithstanding any other provisions of this part, a covered entity, or business associate with respect to a subcontractor, may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf pursuant to a written contract or other written arrangement with such business associate that does not comply with §§ 164.308(b), 164.314(a), 164.502(e), and 164.504(e), only in accordance with paragraph (e) of this section.

(e) Implementation specification: Deemed compliance—(1) Qualification. Notwithstanding other sections of this part, a covered entity, or business associate with respect to a subcontractor, is deemed to be in compliance with the documentation and contract requirements of §§ 164.308(b), 164.314(a), 164.502(e), and 164.504(e), with respect to a particular business associate relationship, for the time period set forth in paragraph (e)(2) of this section, if:

(i) Prior to January 25, 2013, such covered entity, or business associate with respect to a subcontractor, has entered into and is operating pursuant to a written contract or other written arrangement with the business associate that complies with the applicable provisions of § 164.314(a) or § 164.504(e) that were in effect on such date; and

(ii) The contract or other arrangement is not renewed or modified from March 26, 2013, until September 23, 2013.

(2) Limited deemed compliance period. A prior contract or other arrangement that meets the qualification requirements in paragraph (e) of this section shall be deemed compliant until the earlier of:

(i) The date such contract or other arrangement is renewed or modified on or after September 23, 2013; or

(ii) September 22, 2014.

(3) Covered entity responsibilities. Nothing in this section shall alter the requirements of a covered entity to comply with part 160, subpart C of this subchapter and §§ 164.524, 164.526, 164.528, and 164.530(f) with respect to protected health information held by a business associate.

(f) Effect of prior data use agreements. If, prior to January 25, 2013, a covered entity has entered into and is operating pursuant to a data use agreement with a recipient of a limited data set that complies with § 164.514(e), notwithstanding § 164.502(a)(5)(ii), the covered entity may continue to disclose a limited data set pursuant to such agreement in exchange for remuneration from or on behalf of the recipient of the protected health information until the earlier of:

(1) The date such agreement is renewed or modified on or after September 23, 2013; or

(2) September 22, 2014.

[65 FR 82802, Dec. 28, 2000, as amended at 67 FR 53272, Aug. 14, 2002; 78 FR 5702, Jan. 25, 2013; 78 FR 34266, June 7, 2013]

§ 164.534 Compliance dates for initial implementation of the privacy standards.

(a) Health care providers. A covered health care provider must comply with the applicable requirements of this subpart no later than April 14, 2003.

(b) Health plans. A health plan must comply with the applicable requirements of this subpart no later than the following as applicable:

(1) Health plans other than small health plans. April 14, 2003.

(2) Small health plans. April 14, 2004.

(c) Health clearinghouses. A health care clearinghouse must comply with the applicable requirements of this subpart no later than April 14, 2003.

[66 FR 12434, Feb. 26, 2001]

§ 164.535 Severability.

If any provision of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy is held to be invalid or unenforceable facially, or as applied to any person, plaintiff, or circumstance, it shall be construed to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which case the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances.

[89 FR 33066, Apr. 26, 2024]

§ 170.100 Statutory basis and purpose.

The provisions of this subchapter implement sections 3001(c)(5) and 3004 of the Public Health Service Act.

[75 FR 36203, June 24, 2010]

§ 170.101 Applicability.

(a) The standards, implementation specifications, and certification criteria adopted in this part apply to health information technology and the testing and certification of Health IT Modules.

(b) If any provision of this part is held to be invalid or unenforceable facially, or as applied to any person, plaintiff, or circumstance, it shall be construed to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which case the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances.

[89 FR 101809, Dec. 16, 2024]

§ 170.102 Definitions.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

For the purposes of this part:

Base EHR means an electronic record of health-related information on an individual that—

(1) Includes patient demographic and clinical health information, such as medical history and problem lists;

(2) Has the capacity—

(i) To provide clinical decision support;

(ii) To support physician order entry;

(iii) To capture and query information relevant to healthcare quality;

(iv) To exchange electronic health information with, and integrate such information from other sources; and

(3) Has been certified to the certification criteria adopted by the Secretary in all of the following:

(i) Section 170.315(a)(1), (2), or (3); (a)(5) and (14), (b)(1), (c)(1), and (g)(7), (9), (10); and (h)(1) or (2).

(ii) Section 170.315(a)(9) or (b)(11) for the period up to and including December 31, 2024.

(iii) Section 170.315(b)(11) on and after January 1, 2025.

(iv) Section 170.315(b)(4) on and after January 1, 2028.

Certification criteria means criteria:

(1) To establish that health information technology meets applicable standards and implementation specifications adopted by the Secretary; or

(2) That are used to test and certify that health information technology includes required capabilities.

Common Clinical Data Set means the following data expressed, where indicated, according to the specified standard(s):

(1) Patient name.

(2) Sex: The standard specified in § 170.207(n)(1).

(3) Date of birth.

(4) Race:

(i) The standard specified in § 170.207(f)(2); and

(ii) The standard specified in § 170.207(f)(1) for each race identified in accordance § 170.207(f)(2).

(5) Ethnicity:

(i) The standard specified in § 170.207(f)(2); and

(ii) The standard specified in § 170.207(f)(1) for each ethnicity identified in accordance § 170.207(f)(2).

(6) Preferred language: The standard specified in § 170.207(g)(2).

(7) Smoking status.

(8) Problems: At a minimum, the standard specified in § 170.207(a)(4).

(9) Medications: At a minimum, the standard specified in § 170.207(d)(3).

(10) Medication allergies: At a minimum, the standard specified in § 170.207(d)(3).

(11) Laboratory test(s): At a minimum, the standard specified in § 170.207(c)(3).

(12) Laboratory value(s)/result(s).

(13) Vital signs:

(i) The patient's diastolic blood pressure, systolic blood pressure, body height, body weight, heart rate, respiratory rate, body temperature, pulse oximetry, and inhaled oxygen concentration must be exchanged in numerical values only; and

(ii) In accordance with the standard specified in § 170.207(c)(3) and with the associated applicable unit of measure for the vital sign measurement in the standard specified in § 170.207(m)(1).

(iii) Optional: The patient's BMI percentile per age and sex for youth 2-20 years of age, weight for age per length and sex for children less than 3 years of age, and head occipital-frontal circumference for children less than 3 years of age must be recorded in numerical values only in accordance with the standard specified in § 170.207(c)(3) and with the associated applicable unit of measure for the vital sign measurement in the standard specified in § 170.207(m)(1). For BMI percentile per age and sex for youth 2-20 years of age and weight for age per length and sex for children less than 3 years of age, the reference range/scale or growth curve should be included as appropriate.

(14) Procedures:

(i) At a minimum, the version of the standard specified in § 170.207(a)(4) or § 170.207(b)(2); or

(ii) For technology primarily developed to record dental procedures, the standard specified in § 170.207(b)(3).

(iii) Optional: The standard specified in § 170.207(b)(4).

(15) Care team member(s).

(16) Immunizations: In accordance with, at a minimum, the standards specified in § 170.207(e)(3) and (4).

(17) Unique device identifier(s) for a patient's implantable device(s): In accordance with the “Product Instance” in the “Procedure Activity Procedure Section” of the standard specified in § 170.205(a)(4).

(18) Assessment and plan of treatment:

(i) In accordance with the “Assessment and Plan Section (V2)” of the standard specified in § 170.205(a)(4); or

(ii) In accordance with the “Assessment Section (V2)” and “Plan of Treatment Section (V2)” of the standard specified in § 170.205(a)(4).

(19) Goals: In accordance with the “Goals Section” of the standard specified in § 170.205(a)(4).

(20) Health concerns: In accordance with the “Health Concerns Section” of the standard specified in § 170.205(a)(4).

Day or Days means a calendar day or calendar days.

Device identifier is defined as it is in 21 CFR 801.3.

Disclosure is defined as it is in 45 CFR 160.103.

Electronic health information (EHI) is defined as it is in § 171.102.

Fee is defined as it is in § 171.102 of this subchapter.

Global Unique Device Identification Database (GUDID) is defined as it is in 21 CFR 801.3.

Health information technology means hardware, software, integrated technologies or related licenses, IP, upgrades, or packaged solutions sold as services that are designed for or support the use by health care entities or patients for the electronic creation, maintenance, access, or exchange of health information.

Health IT Module means any service, component, or combination thereof that can meet the requirements of at least one certification criterion adopted by the Secretary.

Human readable format means a format that enables a human to read and easily comprehend the information presented to him or her regardless of the method of presentation.

Implantable device is defined as it is in 21 CFR 801.3.

Implementation specification means specific requirements or instructions for implementing a standard.

Interoperability is, with respect to health information technology, such health information technology that—

(1) Enables the secure exchange of electronic health information with, and use of electronic health information from, other health information technology without special effort on the part of the user;

(2) Allows for complete access, exchange, and use of all electronically accessible health information for authorized use under applicable State or Federal law; and

(3) Does not constitute information blocking as defined in § 171.103 of this subchapter.

Interoperability element is defined as it is in § 171.102 of this subchapter.

ONC certification criteria for health IT means the certification criteria in § 170.315.

Predictive Decision Support Intervention or Predictive DSI means technology that supports decision-making based on algorithms or models that derive relationships from training data and then produces an output that results in prediction, classification, recommendation, evaluation, or analysis.

Production identifier is defined as it is in 21 CFR 801.3.

Provide means the action or actions taken by a developer of certified Health IT Modules to make the certified health IT available to its customers.

Qualified EHR means an electronic record of health-related information on an individual that:

(1) Includes patient demographic and clinical health information, such as medical history and problem lists; and

(2) Has the capacity:

(i) To provide clinical decision support;

(ii) To support physician order entry;

(iii) To capture and query information relevant to health care quality; and

(iv) To exchange electronic health information with, and integrate such information from other sources.

Revised certification criterion (or criteria) means a certification criterion that meets at least one of the following:

(1) Has added or changed the capabilities described in the existing criterion in this part;

(2) Has an added or changed standard or implementation specification referenced in the existing criterion in this part; or

(3) Is specified through notice and comment rulemaking as an iterative or replacement version of an existing criterion in this part.

Standard means a technical, functional, or performance-based rule, condition, requirement, or specification that stipulates instructions, fields, codes, data, materials, characteristics, or actions.

Unique device identifier is defined as it is in 21 CFR 801.3.

[75 FR 2042, Jan. 13, 2010, as amended at 75 FR 36203, June 24, 2010; 75 FR 44649, July 28, 2010; 77 FR 54283, Sept. 4, 2012; 78 FR 65887, Nov. 4, 2013; 79 FR 52933, Sept. 4, 2014; 79 FR 54477, 54478, Sept. 11, 2014; 80 FR 62741, Oct. 16, 2015; 80 FR 76871, Dec. 11, 2015; 85 FR 25939, May 1, 2020; 85 FR 70082, Nov. 4, 2020; 89 FR 1426, Jan. 9, 2024; 90 FR 37208, Aug. 4, 2025]

§ 170.200 Applicability.

The standards and implementation specifications adopted in this part apply with respect to Health Information technology.

[85 FR 70082, Nov. 4, 2020]

§ 170.202 Transport standards and other protocols.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

The Secretary adopts the following transport standards:

(a) Direct Project. (1) [Reserved]

(2) Standard. ONC Applicability Statement for Secure Health Transport, Version 1.2 (incorporated by reference in § 170.299).

(b) Standard. ONC XDR and XDM for Direct Messaging Specification (incorporated by reference in § 170.299).

(c) Standard. ONC Transport and Security Specification (incorporated by reference in § 170.299).

(d) Standard. ONC Implementation Guide for Direct Edge Protocols (incorporated by reference in § 170.299).

(e) Delivery notification—(1) Standard. ONC Implementation Guide for Delivery Notification in Direct (incorporated by reference in § 170.299).

(2) [Reserved]

[77 FR 54284, Sept. 4, 2012, as amended at 79 FR 54478, Sept. 11, 2014; 80 FR 62743, Oct. 16, 2015; 85 FR 25940, May 1, 2020]

§ 170.204 Functional standards.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

The Secretary adopts the following functional standards:

(a) Accessibility—(1) Standard. Web Content Accessibility Guidelines (WCAG) 2.0, Level A Conformance (incorporated by reference in § 170.299).

(2) Standard. Web Content Accessibility Guidelines (WCAG) 2.0, Level AA Conformance (incorporated by reference in § 170.299).

(b) Reference source. Standard. HL7 Version 3 Standard: Context-Aware Retrieval Application (Infobutton) (incorporated by reference in § 170.299).

(1)-(2) [Reserved]

(3) Standard. HL7 Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2 (incorporated by reference in § 170.299). Implementation specifications. HL7 Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1 (incorporated by reference in § 170.299).

(4) Standard. HL7 Version 3 Standard: Context Aware Knowledge Retrieval Application (“Infobutton”), Knowledge Request, Release 2 (incorporated by reference in § 170.299). Implementation specifications. HL7 Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4 (incorporated by reference in § 170.299).

[77 FR 54284, Sept. 4, 2012, as amended at 80 FR 62743, Oct. 16, 2015; 85 FR 25940, May 1, 2020]

§ 170.205 Content exchange standards and implementation specifications for exchanging electronic health information.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

The Secretary adopts the following content exchange standards and associated implementation specifications:

(a) Patient summary record. (1) [Reserved]

(2) [Reserved]

(3) Standard. HL7 Implementation Guide for CDA® Release 2: IHE Health Story Consolidation, (incorporated by reference in § 170.299). The use of the “unstructured document” document-level template is prohibited.

(4) Standard. HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use, Volume 1—Introductory Material, Release 2.1 and HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use, Volume 2—Templates and Supporting Material, Release 2.1 (incorporated by reference in § 170.299).

(5) Standard. HL7 CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2 (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026.

(6) Standard. HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1—US Realm (incorporated by reference, see § 170.299).

(b) Electronic prescribing—(1) Standard. National Council for Prescription Drug Programs (NCPDP): SCRIPT Standard Implementation Guide; Version 2017071 (incorporated by reference in § 170.299). The Secretary's adoption of this standard expires on January 1, 2028.

(2) Standard. NCPDP SCRIPT Standard, Implementation Guide, Version 2023011 (incorporated by reference in § 170.299).

(c) Real-time prescription benefit—(1) Standard. NCPDP Real-Time Prescription Benefit Standard, Implementation Guide, Version 13 (incorporated by reference in § 170.299).

(2) [Reserved]

(d) Electronic submission to public health agencies for surveillance or reporting. (1) [Reserved]

(2) Standard. HL7 2.5.1 (incorporated by reference in § 170.299).

(3) [Reserved]

(4) Standard. HL7 2.5.1 (incorporated by reference in § 170.299). Implementation specifications. PHIN Messaging Guide for Syndromic Surveillance: Emergency Department, Urgent Care, Inpatient and Ambulatory Care Settings, Release 2.0, April 21, 2015 (incorporated by reference in § 170.299) and Erratum to the CDC PHIN 2.0 Implementation Guide, August 2015; Erratum to the CDC PHIN 2.0 Messaging Guide, April 2015 Release for Syndromic Surveillance: Emergency Department, Urgent Care, Inpatient and Ambulatory Care Settings (incorporated by reference in § 170.299).

(e) Electronic submission to immunization registries. (1) [Reserved]

(2)-(3) [Reserved]

(4) Standard. HL7 2.5.1 (incorporated by reference in § 170.299). Implementation specifications. HL7 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5 (incorporated by reference in § 170.299) and HL7 Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015 (incorporated by reference in § 170.299).

(f) [Reserved]

(g) Electronic transmission of lab results to public health agencies. Standard. HL7 2.5.1 (incorporated by reference in § 170.299). Implementation specifications. HL7 Version 2.5.1 Implementation Guide: Electronic Laboratory Reporting to Public Health, Release 1 (US Realm) (incorporated by reference in § 170.299) with Errata and Clarifications, (incorporated by reference in § 170.299) and ELR 2.5.1 Clarification Document for EHR Technology Certification, (incorporated by reference in § 170.299).

(h) Clinical quality measure data import, export and reporting. (1) [Reserved]

(2) Standard. HL7 CDA® R2 Implementation Guide: Quality Reporting Document Architecture—Category I (QRDA I); Release 1, DSTU Release 3 (US Realm), Volume 1—Introductory Material and HL7 CDA® R2 Implementation Guide: Quality Reporting Document Architecture—Category I (QRDA I); Release 1, DSTU Release 3 (US Realm), Volume 2—Templates and Supporting Material (incorporated by reference in § 170.299).

(3) Standard. CMS Implementation Guide for Quality Reporting Document Architecture: Category I; Hospital Quality Reporting; Implementation Guide for 2020 (incorporated by reference in § 170.299).

(i) Cancer information. (1) [Reserved]

(2) Standard. HL7 Clinical Document Architecture (CDA), Release 2.0, Normative Edition (incorporated by reference in § 170.299). Implementation specifications. HL7 CDA© Release 2 Implementation Guide: Reporting to Public Health Cancer Registries from Ambulatory Healthcare Providers, Release 1; DSTU Release 1.1, Volume 1—Introductory Material and HL7 CDA© Release 2 Implementation Guide: Reporting to Public Health Cancer Registries from Ambulatory Healthcare Providers, Release 1; DSTU Release 1.1 (US Realm), Volume 2—Templates and Supporting Material (incorporated by reference in § 170.299).

(j) [Reserved]

(k) Clinical quality measure aggregate reporting—(1) Standard. Quality Reporting Document Architecture Category III, Implementation Guide for CDA Release 2 (incorporated by reference in § 170.299).

(2) Standard. Errata to the HL7 Implementation Guide for CDA® Release 2: Quality Reporting Document Architecture—Category III, DSTU Release 1 (US Realm), September 2014 (incorporated by reference in § 170.299).

(3) Standard. CMS Implementation Guide for Quality Reporting Document Architecture: Category III; Eligible Clinicians and Eligible Professionals Programs; Implementation Guide for 2020 (incorporated by reference in § 170.299).

(l)-(n) [Reserved]

(o) Data segmentation for privacy—(1) Standard. HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1 (incorporated by reference in § 170.299).

(2) [Reserved]

(p) XDM package processing—(1) Standard. IHE IT Infrastructure Technical Framework Volume 2b (ITI TF-2b) (incorporated by reference in § 170.299).

(2) [Reserved]

(q) [Reserved]

(r) Public health—antimicrobial use and resistance information—(1) Standard. The following sections of HL7 Implementation Guide for CDA® Release 2—Level 3: Healthcare Associated Infection Reports, Release 1, U.S. Realm (incorporated by reference in § 170.299). Technology is only required to conform to the following sections of the implementation guide:

(i) HAI Antimicrobial Use and Resistance (AUR) Antimicrobial Resistance Option (ARO) Report (Numerator) specific document template in Section 2.1.2.1 (pages 69-72);

(ii) Antimicrobial Resistance Option (ARO) Summary Report (Denominator) specific document template in Section 2.1.1.1 (pages 54-56); and

(iii) Antimicrobial Use (AUP) Summary Report (Numerator and Denominator) specific document template in Section 2.1.1.2 (pages 56-58).

(2) [Reserved]

(s) Public health—health care survey information—(1) Standard. HL7 Implementation Guide for CDA® Release 2: National Health Care Surveys (NHCS), Release 1—US Realm, HL7 Draft Standard for Trial Use, Volume 1—Introductory Material and HL7 Implementation Guide for CDA® Release 2: National Health Care Surveys (NHCS), Release 1—US Realm, HL7 Draft Standard for Trial Use, Volume 2—Templates and Supporting Material (incorporated by reference in § 170.299).

(2) [Reserved]

(t) Public health—electronic case reporting—(1) Standard. HL7® FHIR® Implementation Guide: Electronic Case Reporting (eCR)—US Realm 2.1.0—STU 2 US (HL7 FHIR eCR IG) (incorporated by reference, see § 170.299).

(2) Standard. HL7 CDA® R2 Implementation Guide: Public Health Case Report—the Electronic Initial Case Report (eICR) Release 2, STU Release 3.1—US Realm (HL7 CDA eICR IG) (incorporated by reference, see § 170.299).

(3) Standard. HL7® CDA® R2 Implementation Guide: Reportability Response, Release 1, STU Release 1.1—US Realm (HL7 CDA RR IG) (incorporated by reference, see § 170.299).

(4) Standard. Reportable Conditions Trigger Codes Value Set for Electronic Case Reporting. (incorporated by reference, see § 170.299).

(u) Formulary and benefit—(1) Standard. NCPDP Formulary and Benefit Standard Version 60 (incorporated by reference in § 170.299).

(2) [Reserved]

[75 FR 44649, July 28, 2010, as amended at 75 FR 62690, Oct. 13, 2010; 77 FR 54284, Sept. 4, 2012; 79 FR 54478, Sept. 11, 2014; 80 FR 62743, Oct. 16, 2015; 85 FR 25940, May 1, 2020; 85 FR 70082, Nov. 4, 2020; 89 FR 1426, Jan. 9, 2024; 89 FR 51265, June 17, 2024]

§ 170.207 Vocabulary standards for representing electronic health information.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

The Secretary adopts the following code sets, terminology, and nomenclature as the vocabulary standards for the purpose of representing electronic health information:

(a) Problems.

(1) Standard. SNOMED CT®, U.S. Edition, March 2022 Release (incorporated by reference, see § 170.299).

(2)-(3) [Reserved]

(4) Standard. IHTSDO SNOMED CT®, U.S. Edition, September 2015 Release (incorporated by reference in § 170.299).

(b) Procedures. (1) [Reserved]

(2) Standard. The code set specified at 45 CFR 162.1002(a)(5).

(3) Standard. The code set specified at 45 CFR 162.1002(a)(4).

(4) Standard. The code set specified at 45 CFR 162.1002(c)(3) for the indicated procedures or other actions taken.

(c) Laboratory tests.

(1) Standard. Logical Observation Identifiers Names and Codes (LOINC®) Database Version 2.72, a universal code system for identifying health measurements, observations, and documents produced by the Regenstrief Institute, Inc., February 16, 2022 (incorporated by reference, see § 170.299).

(2) [Reserved]

(3) Standard. Logical Observation Identifiers Names and Codes (LOINC®) Database version 2.52, a universal code system for identifying laboratory and clinical observations produced by the Regenstrief Institute, Inc. (incorporated by reference in § 170.299).

(d) Medications—(1) Clinical drugs—(i) Standard. RxNorm, a standardized nomenclature for clinical drugs produced by the United States National Library of Medicine, December 4, 2023, Full Update Release (incorporated by reference in § 170.299).

(ii) Standard. RxNorm, a standardized nomenclature for clinical drugs produced by the United States National Library of Medicine, Full Update Release, July 5, 2022 (incorporated by reference, see § 170.299).

(iii) Standard. RxNorm, a standardized nomenclature for clinical drugs produced by the United States National Library of Medicine, September 8, 2015, Full Release Update (incorporated by reference in § 170.299).

(2) Standard. National Drug Codes. The code set specified at 45 CFR 162.1002(b)(2) as referenced in 45 CFR 162.1002(c)(1) for the time period on or after October 1, 2015.

(3)-(4) [Reserved]

(e) Immunizations.

(1) Standard. HL7® Standard Code Set CVX—Vaccines Administered, dated through June 15, 2022 (incorporated by reference, see § 170.299).

(2) Standard. National Drug Code Directory (NDC)—Vaccine NDC Linker, dated July 19, 2022 (incorporated by reference, see § 170.299).

(3) Standard. HL7 Standard Code Set CVX—Vaccines Administered, updates through August 17, 2015 (incorporated by reference in § 170.299).

(4) Standard. National Drug Code Directory (NDC)—Vaccine NDC Linker, updates through August 17, 2015 (incorporated by reference in § 170.299).

(f) Race and Ethnicity—(1) Standard. The Office of Management and Budget Standards for Maintaining, Collecting, and Presenting Federal Data on Race and Ethnicity, Statistical Policy Directive No. 15, as revised, October 30, 1997 (incorporated by reference in § 170.299).

(2) Standard. CDC Race and Ethnicity Code Set Version 1.0 (March 2000) (incorporated by reference in § 170.299).

(3) Standard. CDC Race and Ethnicity Code Set Version 1.2 (July 08, 2021) (incorporated by reference, see § 170.299).

(g) Preferred language. (1) [Reserved]

(2) Standard. Request for Comments (RFC) 5646 (incorporated by reference in § 170.299).

(h) [Reserved]

(i) Encounter diagnoses. Standard. The code set specified at 45 CFR 162.1002(c)(2) for the indicated conditions.

(j)-(l) [Reserved]

(m) Numerical references—(1) Standard. The Unified Code of Units of Measure, Revision 1.9 (incorporated by reference in § 170.299).

(2) Standard. The Unified Code for Units of Measure, Version 2.1, November 21, 2017 (incorporated by reference, see § 170.299).

(n) Sex—(1) Standard. Birth sex must be coded in accordance with HL7® Version 3 Standard, Value Sets for AdministrativeGender and NullFlavor (incorporated by reference, see § 170.299), up until the adoption of this standard expires January 1, 2026, attributed as follows:

(i) Male. M;

(ii) Female. F;

(iii) Unknown. NullFlavor UNK.

(2) Standard. Sex must be coded in accordance with, at a minimum, the version of SNOMED CT ® U.S. Edition codes specified in paragraph (a)(1) of this section.

(3) Standard. Sex Parameter for Clinical Use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section.

(o) Sexual orientation and gender information—(1) Standard. Sexual orientation must be coded in accordance with, at a minimum, the version of SNOMED-CT® U.S. Edition codes specified in paragraph (a)(4) of this section for paragraphs (o)(1)(i) through (iii) of this section and HL7 Version 3 Standard, Value Sets for AdministrativeGender and NullFlavor (incorporated by reference, see § 170.299), up until the adoption of this standard expires on January 1, 2026, for paragraphs (o)(1)(iv) through (vi) of this section, attributed as follows:

(i) Lesbian, gay or homosexual. 38628009

(ii) Straight or heterosexual. 20430005

(iii) Bisexual. 42035005

(iv) Something else, please describe. NullFlavor OTH

(v) Don't know. NullFlavor UNK

(vi) Choose not to disclose. NullFlavor ASKU

(2) Standard. Gender identity must be coded in accordance with, at a minimum, the version of SNOMED-CT® codes specified in paragraph (a)(4) of this section for paragraphs (o)(2)(i) through (v) of this section and HL7® Version 3 Standard, Value Sets for AdministrativeGender and NullFlavor (incorporated by reference in § 170.299), up until the adoption of this standard expires January 1, 2026, for paragraphs (o)(2)(vi) and (vii) of this section, attributed as follows:

(i) Male. 446151000124109

(ii) Female. 446141000124107

(iii) Female-to-Male (FTM)/Transgender Male/Trans Man. 407377005

(iv) Male-to-Female (MTF)/Transgender Female/Trans Woman. 407376001

(v) Genderqueer, neither exclusively male nor female. 446131000124102

(vi) Additional gender category or other, please specify. NullFlavor OTH

(vii) Choose not to disclose. NullFlavor ASKU

(3) Standard. Sexual Orientation and Gender Identity must be coded in accordance with, at a minimum, the version of SNOMED CT® codes specified in paragraph (a)(1) of this section.

(4) Standard. Pronouns must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section.

(p) Social, psychological, and behavioral data—(1) Financial resource strain. Financial resource strain must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® code 76513-1 and LOINC® answer list ID LL3266-5.

(2) Education. Education must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® code 63504-5 and LOINC® answer list ID LL1069-5.

(3) Stress. Stress must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® code 76542-0 and LOINC® answer list LL3267-3.

(4) Depression. Depression must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® codes 55757-9, 44250-9 (with LOINC® answer list ID LL361-7), 44255-8 (with LOINC® answer list ID LL361-7), and 55758-7 (with the answer coded with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section).

(5) Physical activity. Physical activity must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® codes 68515-6 and 68516-4. The answers must be coded with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section.

(6) Alcohol use. Alcohol use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® codes 72109-2, 68518-0 (with LOINC® answer list ID LL2179-1), 68519-8 (with LOINC® answer list ID LL2180-9), 68520-6 (with LOINC® answer list ID LL2181-7), and 75626-2 (with the answer coded with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section).

(7) Social connection and isolation. Social connection and isolation must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® codes 76506-5, 63503-7 (with LOINC® answer list ID LL1068-7), 76508-1 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section), 76509-9 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section), 76510-7 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section), 76511-5 (with LOINC answer list ID LL963-0), and 76512-3 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section).

(8) Exposure to violence (intimate partner violence). Exposure to violence: Intimate partner violence must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® code 76499-3, 76500-8 (with LOINC® answer list ID LL963-0), 76501-6 (with LOINC® answer list ID LL963-0), 76502-4 (with LOINC® answer list ID LL963-0), 76503-2 (with LOINC® answer list ID LL963-0), and 76504-0 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section).

(q) Patient matching—(1) Phone number standard. ITU-T E.123, Series E: Overall Network Operation, Telephone Service, Service Operation and Human Factors, International operation—General provisions concerning users: Notation for national and international telephone numbers, email addresses and web addresses (incorporated by reference in § 170.299); and ITU-T E.164, Series E: Overall Network Operation, Telephone Service, Service Operation and Human Factors, International operation—Numbering plan of the international telephone service: The international public telecommunication numbering plan (incorporated by reference in § 170.299).

(2) [Reserved]

(r) Provider type—(1) Standard. Crosswalk: Medicare Provider/Supplier to Healthcare Provider Taxonomy, April 2, 2015 (incorporated by reference in § 170.299).

(2) Standard. Medicare Provider and Supplier Taxonomy Crosswalk, 2021 (incorporated by reference, see § 170.299).

(s) Patient insurance—(1) Standard. Public Health Data Standards Consortium Source of Payment Typology Code Set Version 5.0 (October 2011) (incorporated by reference in § 170.299).

(2) Standard. Public Health Data Standards Consortium Users Guide for Source of Payment Typology, Version 9.2 (incorporated by reference, see § 170.299).

[75 FR 44649, July 28, 2010, as amended at 77 FR 54284, Sept. 4, 2012; 79 FR 54478, Sept. 11, 2014; 80 FR 62744, Oct. 16, 2015; 80 FR 76871, Dec. 11, 2015; 85 FR 25940, May 1, 2020; 89 FR 1426, Jan. 9, 2024; 90 FR 37208, Aug. 4, 2025]

§ 170.210 Standards for health information technology to protect electronic health information created, maintained, and exchanged.

The Secretary adopts the following standards to protect electronic health information created, maintained, and exchanged:

(a) Encryption and decryption of electronic health information. (1) [Reserved]

(2) General. Any encryption algorithm identified by the National Institute of Standards and Technology (NIST) as an approved security function in Annex A of the Federal Information Processing Standards (FIPS) Publication 140-2, October 8, 2014 (incorporated by reference in § 170.299).

(b) [Reserved]

(c) Hashing of electronic health information. (1) [Reserved]

(2) Standard. A hashing algorithm with a security strength equal to or greater than SHA-2 as specified by NIST in FIPS Publication 180-4 (August 2015) (incorporated by reference in § 170.299).

(d) Record treatment, payment, and health care operations disclosures. The date, time, patient identification, user identification, and a description of the disclosure must be recorded for disclosures for treatment, payment, and health care operations, as these terms are defined at 45 CFR 164.501.

(e) Record actions related to electronic health information, audit log status, and encryption of end-user devices. (1)(i) The audit log must record the information specified in sections 7.1.1 and 7.1.2 and 7.1.6 through 7.1.9 of the standard specified in § 170.210(h) and changes to user privileges when health IT is in use.

(ii) The date and time must be recorded in accordance with the standard specified at § 170.210(g).

(2)(i) The audit log must record the information specified in sections 7.1.1 and 7.1.7 of the standard specified at § 170.210(h) when the audit log status is changed.

(ii) The date and time each action occurs in accordance with the standard specified at § 170.210(g).

(3) The audit log must record the information specified in sections 7.1.1 and 7.1.7 of the standard specified at § 170.210(h) when the encryption status of electronic health information locally stored by health IT on end-user devices is changed. The date and time each action occurs in accordance with the standard specified at § 170.210(g).

(f) Encryption and hashing of electronic health information. Any encryption and hashing algorithm identified by the National Institute of Standards and Technology (NIST) as an approved security function in Annex A of the FIPS Publication 140-2 (incorporated by reference in § 170.299).

(g) Synchronized clocks. The date and time recorded utilize a system clock that has been synchronized using any Network Time Protocol (NTP) standard.

(h) Audit log content. ASTM E2147-18, (incorporated by reference in § 170.299).

[75 FR 44649, July 28, 2010, as amended at 77 FR 54285, Sept. 4, 2012; 79 FR 54478, Sept. 11, 2014; 80 FR 62745, Oct. 16, 2015; 85 FR 25940, May 1, 2020; 85 FR 70082, Nov. 4, 2020; 89 FR 1428, Jan. 9, 2024]

§ 170.213 United States Core Data for Interoperability.

The Secretary adopts the following versions of the United States Core Data for Interoperability standard:

(a) Standard. United States Core Data for Interoperability (USCDI), July 2020 Errata, Version 1 (v1) (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026.

(b) Standard. United States Core Data for Interoperability Version 3 (USCDI v3) (incorporated by reference, see § 170.299).

[89 FR 1428, Jan. 9, 2024]

§ 170.215 Application Programming Interface Standards.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

The Secretary adopts the following standards and associated implementation specifications as the available standards for application programming interfaces (API):

(a) API base standard. The following are applicable for purposes of standards-based APIs.

(1) Standard. HL7® Fast Healthcare Interoperability Resources (FHIR®) Release 4.0.1 (incorporated by reference, see § 170.299).

(2) [Reserved]

(b) API constraints and profiles. The following are applicable for purposes of constraining and profiling data standards.

(1) United States Core Data Implementation Guides—(i) Implementation specification. HL7® FHIR® US Core Implementation Guide STU 3.1.1 (incorporated by reference in § 170.299). The adoption of this standard expires on January 1, 2026.

(ii) Implementation Specification. HL7® FHIR® US Core Implementation Guide STU 6.1.0 (incorporated by reference, see § 170.299).

(2) [Reserved]

(c) Application access and launch. The following are applicable for purposes of enabling client applications to access and integrate with data systems.

(1) Implementation specification. HL7® SMART Application Launch Framework Implementation Guide Release 1.0.0, including mandatory support for the “SMART Core Capabilities” (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026.

(2) Implementation specification. HL7® SMART App Launch Implementation Guide Release 2.0.0, including mandatory support for the “Capability Sets” of “Patient Access for Standalone Apps” and “Clinician Access for EHR Launch”; all “Capabilities” as defined in “8.1.2 Capabilities,” excepting the “permission-online” capability; “Token Introspection” as defined in “7 Token Introspection” (incorporated by reference, see § 170.299).

(d) Bulk export and data transfer standards. The following are applicable for purposes of enabling access to large volumes of information on a group of individuals.

(1) Implementation specification. FHIR® Bulk Data Access (Flat FHIR®) (v1.0.0: STU 1), including mandatory support for the “group-export” “OperationDefinition” (incorporated by reference, see § 170.299).

(2) [Reserved]

(e) API authentication, security, and privacy. The following are applicable for purposes of authorizing and authenticating client applications.

(1) Standard. OpenID Connect Core 1.0, incorporating errata set 1 (incorporated by reference, see § 170.299).

(2) [Reserved]

(f) API-based workflow triggers. The following are applicable for purposes of initiating calls to decision support services or initiating interactions that can be presented to users synchronously in their workflows.

(1) Implementation specification. HL7 FHIR® CDS Hooks Implementation Guide, Version 2.0.1—STU 2 Release 2 (incorporated by reference in § 170.299).

(2) [Reserved]

(g) [Reserved]

(h) API-based event notifications. The following are applicable for the purposes of supporting proactive notifications from a server to a client when new information has been added or existing information has been updated.

(1) FHIR Subscriptions: Implementation specification. HL7® FHIR® Subscriptions R5 Backport Implementation Guide, Version 1.1.0—Standard for Trial Use (incorporated by reference in § 170.299).

(2) [Reserved]

(i) [Reserved]

(j) Prior authorization—(1) Coverage requirements discovery—(i) Implementation specification. HL7 FHIR® Da Vinci—Coverage Requirements Discovery IG [Implementation Guide], Version 2.2.1-STU 2.2 (incorporated by reference in § 170.299).

(ii) [Reserved]

(2) Prior authorization documentation—(i) Implementation specification. HL7 FHIR® Da Vinci—Documentation Templates and Rules Implementation Guide, Version 2.2.0-STU 2.2 (incorporated by reference in § 170.299).

(ii) [Reserved]

(3) Prior authorization submission—(i) Implementation specification. HL7 FHIR® Da Vinci Prior Authorization Support (PAS) FHIR Implementation Guide, Version 2.2.1-STU 2.2 (incorporated by reference in § 170.299).

(ii) [Reserved]

(k) Payer data exchange—(1) Blue button—(i) Implementation specification. HL7 FHIR® CARIN Consumer Directed Payer Data Exchange (CARIN IG for Blue Button®) [Implementation Guide], Version 2.2.0-STU 2.2 (incorporated by reference in § 170.299).

(ii) [Reserved]

(2) Payer data exchange—(i) Implementation specification. HL7 FHIR® Da Vinci Payer Data Exchange (PDex) Implementation Guide, Version 2.1.0-STU 2.1 (incorporated by reference in § 170.299).

(ii) [Reserved]

(3) Clinical data exchange—(i) Implementation specification. HL7 FHIR® Da Vinci Clinical Data Exchange (CDex) IG [Implementation Guide], Version 2.1.0-STU 2.1 (incorporated by reference in § 170.299).

(l) [Reserved]

(m) Drug formulary—(1) Implementation specification. HL7 FHIR® Da Vinci Payer Data Exchange (PDex) US Drug Formulary Implementation Guide, Version 2.1.0-STU 2.1 (incorporated by reference in § 170.299).

(2) [Reserved]

(n) Directory information—(1) Implementation specification. HL7 FHIR® Da Vinci PDex [Payer Data Exchange] Plan Net Implementation Guide, Version 1.2.0-STU 1.2 (incorporated by reference in § 170.299).

(2) [Reserved]

[89 FR 1428, Jan. 9, 2024, as amended at 90 FR 37208, Aug. 4, 2025; 91 FR 50367, Aug. 4, 2026]

§ 170.299 Incorporation by reference.

Link to an amendment published at 91 FR 67992, Oct. 28, 2026.

Link to an amendment published at 91 FR 67994, Oct. 28, 2026.

(a) Certain material is incorporated by reference into this part with the approval of the Director of the Federal Register under 5 U.S.C. 552(b) and 1 CFR part 51. All approved incorporation by reference (IBR) material is available for inspection at the U.S. Department of Health and Human Services (HHS) and at the National Archives and Records Administration (NARA). Contact HHS at: U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, 330 C Street SW, Washington, DC 20201; call ahead to arrange for inspection at 202-690-7151. For information on the availability of this material at NARA, visit www.archives.gov/federal-register/cfr/ibr-locations or email fr.inspection@nara.gov. The material may be obtained from the sources in the following paragraphs of this section.

(b) American National Standards Institute, Health Information Technology Standards Panel (HITSP) Secretariat, 25 West 43rd Street—Fourth Floor, New York, NY 10036, http://www.hitsp.org.

(1) HITSP Summary Documents Using HL7 Continuity of Care Document (CCD) Component, HITSP/C32, July 8, 2009, Version 2.5, IBR approved for § 170.205.

(2) [Reserved]

(c) ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA, 19428-2959 USA; Telephone (610) 832-9585 or http://www.astm.org/.

(1) ASTM E2147-18 Standard Specification for Audit and Disclosure Logs for Use in Health Information Systems, approved May 1, 2018, IBR approved for § 170.210(h).

(2)-(3) [Reserved]

(d) Centers for Disease Control and Prevention, 2500 Century Parkway, Mailstop E-78, Atlanta, GA 30333; phone: (800) 232-4636); website: www.cdc.gov/cdc-info/index.html

(1) HL7 Standard Code Set CVX—Vaccines Administered, July 30, 2009, IBR approved for § 170.207.

(2) [Reserved]

(3) Implementation Guide for Immunization Data Transactions using Version 2.3.1 of the Health Level Seven (HL7)Standard Protocol Implementation Guide Version 2.2, June 2006, IBR approved for § 170.205.

(4) HL7 2.5.1 Implementation Guide for Immunization Messaging Release 1.0, May 1, 2010, IBR approved for § 170.205.

(5) PHIN Messaging Guide for Syndromic Surveillance: Emergency Department and Urgent Care Data, ADT Messages A01, A03, A04, and A08, HL7 Version 2.5.1 (Version 2.3.1 Compatible), Release 1.1, August 2012, IBR approved for § 170.205.

(6) Conformance Clarification for EHR Certification of Electronic Syndromic Surveillance, ADT MESSAGES A01, A03, A04, and A08, HL7 Version 2.5.1, Addendum to PHIN Messaging Guide for Syndromic Surveillance: Emergency Department and Urgent Care Data (Release 1.1), August 2012, IBR approved for § 170.205.

(7)-(8) [Reserved]

(9) ELR 2.5.1 Clarification Document for EHR Technology Certification, July 16, 2012, IBR approved for § 170.205.

(10) PHIN Messaging Guide for Syndromic Surveillance: Emergency Department, Urgent Care, Inpatient and Ambulatory Care Settings, Release 2.0, April 21, 2015, IBR approved for § 170.205(d).

(11) Erratum to the CDC PHIN 2.0 Implementation Guide, August 2015; Erratum to the CDC PHIN 2.0 Messaging Guide, April 2015 Release for Syndromic Surveillance: Emergency Department, Urgent Care, Inpatient and Ambulatory Care Settings, IBR approved for § 170.205(d).

(12) HL7 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 1, 2014, IBR approved for § 170.205(e).

(13) HL7 Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015, IBR approved for § 170.205(e).

(14) HL7 Standard Code Set CVX—Vaccines Administered, updates through August 17, 2015, IBR approved for § 170.207(e).

(15) National Drug Code Directory (NDC)—Vaccine NDC Linker, updates through August 17, 2015, IBR approved for § 170.207(e).

(16) CDC Race and Ethnicity Code Set Version 1.0 (March 2000), IBR approved for § 170.207(f).

(17) HL7® Standard Code Set CVX—Vaccines Administered, dated June 15, 2022; IBR approved for § 170.207(e).

(18) National Drug Code Directory (NDC)—Vaccine NDC Linker, dated July 19, 2022; IBR approved for § 170.207(e).

(19) CDC Race and Ethnicity Code Set version 1.2 (July 08, 2021); IBR approved for § 170.207(f).

(e) Centers for Medicare & Medicaid Services, Office of Clinical Standards and Quality, 7500 Security Boulevard, Baltimore, Maryland 21244; phone: (410) 786-3000; website: www.cms.gov.

(1) CMS PQRI 2009 Registry XML Specifications, IBR approved for § 170.205.

(2) 2009 Physician Quality Reporting Initiative Measure Specifications Manual for Claims and Registry, Version 3.0, December 8, 2008 IBR approved for § 170.205.

(3) Crosswalk: Medicare Provider/Supplier to Healthcare Provider Taxonomy, April 2, 2015, IBR approved for § 170.207(r).

(4) CMS Implementation Guide for Quality Reporting Document Architecture: Category I; Hospital Quality Reporting Implementation Guide for 2020; published December 3, 2019, IBR approved for § 170.205(h).

(5) CMS Implementation Guide for Quality Reporting Document Architecture: Category III; Eligible Clinicians and Eligible Professionals Programs Implementation Guide for 2020; published April 30, 2020, IBR approved for § 170.205(k).

(6) Medicare Provider and Supplier Taxonomy Crosswalk, 2021; IBR approved for § 170.207(r).

(f) Council of State and Territorial Epidemiologists, 2635 Century Parkway NE, Suite 700, Atlanta, GA 30345; phone: (770) 458-3811; website: www.cste.org/

(1) Reportable Conditions Trigger Codes Value Set for Electronic Case Reporting. RCTC OID: 2.16.840.1.114222.4.11.7508, Release March 29, 2022; IBR approved for § 170.205(t).

(2) [Reserved]

(g) Health Level Seven, 3300 Washtenaw Avenue, Suite 227, Ann Arbor, MI 48104; phone: (734) 677-7777; website: www.hl7.org/

(1) Health Level Seven Standard Version 2.3.1 (HL7 2.3.1), An Application Protocol for Electronic Data Exchange in Healthcare Environments, April 14, 1999, IBR approved for § 170.205.

(2) Health Level Seven Messaging Standard Version 2.5.1 (HL7 2.5.1), An Application Protocol for Electronic Data Exchange in Healthcare Environments, February 21, 2007, IBR approved for § 170.205.

(3) [Reserved]

(4) HL7 Version 2.5.1 Implementation Guide: Electronic Laboratory Reporting to Public Health, Release 1 (US Realm) HL7 Version 2.5.1: ORU^R01, HL7 Informative Document, February, 2010, IBR approved for § 170.205.

(5) HL7 Version 3 Standard: Context-Aware Retrieval Application (Infobutton); Release 1, July 2010, IBR approved for § 170.204.

(6)-(7) [Reserved]

(8) HL7 Implementation Guide for CDA® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012, IBR approved for § 170.205.

(9) HL7 Clinical Document Architecture, Release 2.0, Normative Edition, May 2005, IBR approved for § 170.205.

(10)-(11) [Reserved]

(12) HL7 Implementation Guide for CDA® Release 2: Quality Reporting Document Architecture, DTSU Release 2 (Universal Realm), Draft Standard for Trial Use, July 2012, IBR approved for § 170.205.

(13) HL7 v2.5.1 IG: Electronic Laboratory Reporting to Public Health (US Realm), Release 1 Errata and Clarifications, September, 29, 2011, IBR approved for § 170.205.

(14) HL7 Implementation Guide for CDA® Release 2: Quality Reporting Document Architecture—Category III, DSTU Release 1 (US Realm) Draft Standard for Trial Use, November 2012, IBR approved for § 170.205.

(15) HL7 Version 3 Standard: Context Aware Retrieval Application (“Infobutton”), Knowledge Request, Release 2, 2014 Release, IBR approved for § 170.204(b).

(16) HL7 Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1, August 9, 2013, IBR approved for § 170.204(b).

(17) HL7 Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4, June 13, 2014, IBR approved for § 170.204(b).

(18) HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use, Volume 1—Introductory Material, Release 2.1, August 2015, IBR approved for § 170.205(a).

(19) HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use, Volume 2—Templates and Supporting Material, Release 2.1, August 2015, IBR approved for § 170.205(a).

(20) HL7 CDA® R2 Implementation Guide: Quality Reporting Document Architecture—Category I (QRDA I); Release 1, DSTU Release 3 (US Realm), Volume 1—Introductory Material, June 2015, IBR approved for § 170.205(h).

(21) HL7 CDA® R2 Implementation Guide: Quality Reporting Document Architecture—Category I (QRDA I); Release 1, DSTU Release 3 (US Realm), Volume 2—Templates and Supporting Material, June 2015, IBR approved for § 170.205(h).

(22) HL7 CDA© Release 2 Implementation Guide: Reporting to Public Health Cancer Registries from Ambulatory Healthcare Providers, Release 1; DSTU Release 1.1 (US Realm), Volume 1—Introductory Material, April 2015, IBR approved for § 170.205(i).

(23) HL7 CDA© Release 2 Implementation Guide: Reporting to Public Health Cancer Registries from Ambulatory Healthcare Providers, Release 1; DSTU Release 1.1 (US Realm), Volume 2—Templates and Supporting Material, April 2015, IBR approved for § 170.205(i).

(24) Errata to the HL7 Implementation Guide for CDA® Release 2: Quality Reporting Document Architecture—Category III, DSTU Release 1 (US Realm), September 2014, IBR approved for § 170.205(k).

(25) HL7 Version 3 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1, Part 1: CDA R2 and Privacy Metadata Reusable Content Profile, May 16, 2014, IBR approved for § 170.205(o).

(26) HL7 Implementation Guide for CDA® Release 2—Level 3: Healthcare Associated Infection Reports, Release 1 (U.S. Realm), August 9, 2013, IBR approved for § 170.205(r).

(27) HL7 Implementation Guide for CDA® Release 2: National Health Care Surveys (NHCS), Release 1—US Realm, HL7 Draft Standard for Trial Use, Volume 1—Introductory Material, December 2014, IBR approved for § 170.205(s).

(28) HL7 Implementation Guide for CDA® Release 2: National Health Care Surveys (NHCS), Release 1—US Realm, HL7 Draft Standard for Trial Use, Volume 2—Templates and Supporting Material, December 2014, IBR approved for § 170.205(s).

(29) HL7 Version 3 (V3) Standard, Value Sets for AdministrativeGender and NullFlavor, published August 1, 2013, IBR approved for § 170.207(n) and (o).

(30) HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2-US Realm, October 2019, IBR approved for § 170.205(a).

(31) HL7 FHIR® Bulk Data Access (Flat FHIR®) (v1.0.0: STU 1), August 22, 2019, IBR approved for § 170.215(a).

(32) HL7 FHIR SMART Application Launch Framework Implementation Guide Release 1.0.0, November 13, 2018, IBR approved for § 170.215(a).

(33) HL7 Fast Healthcare Interoperability Resources Specification (FHIR®) Release 4, Version 4.0.1: R4, October 30, 2019, including Technical Correction #1, November 1, 2019, IBR approved for § 170.215(a).

(34) HL7 FHIR® US Core Implementation Guide STU3 Release 3.1.1, August 28, 2020, IBR approved for § 170.215(a).

(35) HL7 CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 (US Realm) Standard for Trial Use, Specification Version: 4.1.1, June 2023 (including appendices A and B); IBR approved for § 170.205(a).

(36) HL7 FHIR® Implementation Guide: Electronic Case Reporting (eCR)—US Realm, Version 2.1.0—STU 2 US (HL7 FHIR eCR IG), August 31, 2022; IBR approved for § 170.205(t).

(37) HL7 CDA® R2 Implementation Guide: Public Health Case Report—the Electronic Initial Case Report (eICR) Release 2, STU Release 3.1—US Realm (HL7 CDA eICR IG), July 2022, volumes 1 and 2; IBR approved for § 170.205(t).

(38) HL7 CDA® R2 Implementation Guide: Reportability Response, Release 1, STU Release 1.1—US Realm (HL7 CDA RR IG), July 2022, volumes 1 through 4; IBR approved for § 170.205(t).

(39) HL7 FHIR US Core Implementation Guide Version 6.1.0—STU 6, June 19, 2023; IBR approved for § 170.215(b).

(40) HL7 FHIR® SMART App Launch [Implementation Guide], 2.0.0—Standard for Trial Use, November 26, 2021; IBR approved for § 170.215(c).

(41) HL7 FHIR® Da Vinci—Coverage Requirements Discovery IG [Implementation Guide], Version 2.2.1-STU 2.2, Generated March 27, 2026; IBR approved for § 170.215(j).

(42) HL7 FHIR® Da Vinci—Documentation Templates and Rules Implementation Guide, Version 2.2.0-STU 2.2, Generated March 27, 2026; IBR approved for § 170.215(j).

(43) HL7 FHIR® Da Vinci Prior Authorization Support (PAS) FHIR Implementation Guide, Version 2.2.1-STU 2.2, Generated March 27, 2026; IBR approved for § 170.215(j).

(44) HL7 FHIR® CARIN Consumer Directed Payer Data Exchange (CARIN IG for Blue Button®) [Implementation Guide], Version 2.2.0-STU 2.2, Generated March 27, 2026; IBR approved for § 170.215(k).

(45) HL7 FHIR® Da Vinci Payer Data Exchange (PDex) Implementation Guide, Version 2.1.0—STU 2.1, June 18, 2025, IBR approved for § 170.215(k).

(46) HL7 FHIR® Da Vinci Payer Data Exchange (PDex) US Drug Formulary Implementation Guide, Version 2.1.0-STU 2.1, Generated February 26, 2025; IBR approved for § 170.215(m).

(47) HL7 FHIR® Da Vinci PDex [Payer Data Exchange] Plan Net Implementation Guide, Version 1.2.0-STU 1.2, Generated February 25, 2025; IBR approved for § 170.215(n).

(48) HL7 FHIR® Subscriptions R5 Backport Implementation Guide, Version 1.1.0—Standard for Trial Use, draft as of January 11, 2023, IBR approved for § 170.215(h).

(49) HL7 FHIR® CDS Hooks Implementation Guide, Version 2.0.1—STU 2 Release 2, March 12, 2025, IBR approved for § 170.215(f).

(50) HL7 FHIR® Da Vinci Clinical Data Exchange (CDex) IG [Implementation Guide], Version 2.1.0-STU 2.1, Generated February 11, 2025; IBR approved for § 170.215(k).

(h) Integrating the Healthcare Enterprise (IHE), 820 Jorie Boulevard, Oak Brook, IL, Telephone (630) 481-1004, http://www.ihe.net/.

(1) IHE IT Infrastructure Technical Framework Volume 2b (ITI TF-2b), Transactions Part B—Sections 3.29—2.43, Revision 7.0, August 10, 2010, IBR approved for § 170.205(p).

(2) [Reserved]

(i) Internet Engineering Task Force (IETF) Secretariat, c/o Association Management Solutions, LLC (AMS), 48377 Fremont Blvd., Suite 117, Fremont, CA, 94538, Telephone (510) 492-4080, http://www.ietf.org/rfc.html.

(1) [Reserved]

(2) Network Time Protocol Version 4: Protocol and Algorithms Specification, June 2010, IBR approved for § 170.210.

(3) Request for Comment (RFC) 5646, “Tags for Identifying Languages, September 2009,” copyright 2009, IBR approved for § 170.207(g).

(j) International Telecommunication Union (ITU), Place des Nations, 1211 Geneva 20 Switzerland, Telephone (41) 22 730 511, http://www.itu.int/en/pages/default.aspx.

(1) ITU-T E.123, Series E: Overall Network Operation, Telephone Service, Service Operation and Human Factors, International operation—General provisions concerning users: Notation for national and international telephone numbers, e-mail addresses and web addresses, February 2001, IBR approved for § 170.207(q).

(2) ITU-T E.164, Series E: Overall Network Operation, Telephone Service, Service Operation and Human Factors, International operation—Numbering plan of the international telephone service, The international public telecommunication numbering plan, November 2010, IBR approved for § 170.207(q).

(k) National Council for Prescription Drug Programs (NCPDP), Incorporated, 9240 E Raintree Drive, Scottsdale, AZ 85260-7518; phone (480) 477-1000; fax: (480) 767-1042: website: www.ncpdp.org.

(1) NCPDP SCRIPT Standard, Implementation Guide, Version 2017071, ANSI-approved July 28, 2017; IBR approved for § 170.205(b).

(2) NCPDP SCRIPT Standard, Implementation Guide, Version 2023011, ANSI-approved January 17, 2023; IBR approved for § 170.205(b).

(3) NCPDP Real-Time Prescription Benefit Standard, Implementation Guide, Version 13, ANSI-approved May 19, 2022; IBR approved for § 170.205(c).

(4) NCPDP Formulary and Benefit Standard, Implementation Guide, Version 60, ANSI-approved April 12, 2023; IBR approved for § 170.205(u).

(l) National Institute of Standards and Technology, Information Technology Laboratory, National Institute of Standards and Technology, 100 Bureau Drive, Gaithersburg, MD 20899-8930, http://csrc.nist.gov/groups/STM/cmvp/standards.html.

(1) Annex A: Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules, Draft, January 27, 2010, IBR approved for § 170.210.

(2) Annex A: Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules, Draft, May 30, 2012, IBR approved for § 170.210.

(3) [Reserved]

(4) FIPS PUB 180-4, Secure Hash Standard (August 2015), IBR approved for § 170.210(c).

(m) Office of the National Coordinator for Health Information Technology (ONC), 330 C Street SW, Washington, DC 20201; phone: (202) 690-7151; website: https://healthit.gov.

(1) Applicability Statement for Secure Health Transport, Version 1.1, July 10, 2012, IBR approved for § 170.202; available at http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov__direct_project/3338.

(2) XDR and XDM for Direct Messaging Specification, Version 1, March 9, 2011, IBR approved for § 170.202; available at http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov__direct_project/3338.

(3) Transport and Security Specification, Version 1.0, June 19, 2012, IBR approved for § 170.202.

(4) ONC Implementation Guide for Direct Edge Protocols, Version 1.1, June 25, 2014, IBR approved for § 170.202; available at http://www.healthit.gov/sites/default/files/implementationguidefordirectedgeprotocolsv1_1.pdf.

(5) United States Core Data for Interoperability (USCDI), Version 1, July 2020 Errata, IBR approved for § 170.213; available at https://www.healthit.gov/USCDI.

(6) United States Core Data for Interoperability (USCDI), Version 3 (v3), October 2022 Errata; IBR approved for § 170.213(b).

(n) OpenID Foundation, 2400 Camino Ramon, Suite 375, San Ramon, CA 94583, Telephone +1 925-275-6639, http://openid.net/.

(1) OpenID Connect Core 1.0 Incorporating errata set 1, November 8, 2014, IBR approved for § 170.215(b).

(2) [Reserved]

(o) Public Health Data Standards Consortium, 111 South Calvert Street, Suite 2700, Baltimore, MD 21202; phone: (801) 532-2299; website: www.Ph.D.sc.org/.

(1) Public Health Data Standards Consortium Source of Payment Typology Code Set Version 5.0 (October 2011), IBR approved for § 170.207(s).

(2) Users Guide for Source of Payment Typology, Version 9.2, December 2020; IBR approved for § 170.207(s).

(p) Regenstrief Institute, Inc., LOINC® c/o Regenstrief Center for Biomedical Informatics, Inc., 410 West 10th Street, Suite 2000, Indianapolis, IN 46202-3012; phone: (317) 274-9000; website: https://loinc.org/ and https://ucum.org/ucum.

(1) Logical Observation Identifiers Names and Codes (LOINC®) version 2.27, June 15, 2009, IBR approved for § 170.207.

(2) Logical Observation Identifiers Names and Codes (LOINC®) Database version 2.40, Released June 2012, IBR approved for § 170.207.

(3) Logical Observation Identifiers Names and Codes (LOINC®) Database version 2.52, Released June 2015, IBR approved for § 170.207(c).

(4) The Unified Code of Units for Measure, Revision 1.9, October 23, 2013, IBR approved for § 170.207.

(5) Logical Observation Identifiers Names and Codes (LOINC®) Database Version 2.72, February 2022; IBR approved for § 170.207(c).

(6) The Unified Code for Units of Measure, Version 2.1, November 21, 2017; IBR approved for § 170.207(m).

(q) The Direct Project, c/o the Office of the National Coordinator for Health Information Technology (ONC), 330 C Street SW., Washington, DC 20201, http://healthit.hhs.gov.

(1) Applicability Statement for Secure Health Transport, Version 1.2, August 2015, IBR approved for § 170.202(a).

(2) Implementation Guide for Delivery Notification in Direct, Version 1.0, June 29, 2012, IBR approved for § 170.202(e).

(r) U.S. National Library of Medicine, 8600 Rockville Pike, Bethesda, MD 20894; phone (301) 594-5983; website: www.nlm.nih.gov/.

(1) International Health Terminology Standards Development Organization Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT®), International Release, July 2009, IBR approved for § 170.207.

(2) International Health Terminology Standards Development Organisation (IHTSDO) Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT®) International Release July 31, 2012, IBR approved for § 170.207.

(3) US Extension to SNOMED CT® March 2012 Release, IBR approved for § 170.207.

(4)-(5) [Reserved]

(6) International Health Terminology Standards Development Organization (IHTSDO) Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT®) U.S. Edition, September 2015 Release, IBR approved for § 170.207(a).

(7) RxNorm, September 8, 2015 Full Release Update, IBR approved for § 170.207(d).

(8) SNOMED CT® [Systematized Nomenclature of Medicine Clinical Terms] U.S. Edition, March 2022 Release; IBR approved for § 170.207(a).

(9) RxNorm, Full Update Release, July 5, 2022; IBR approved for § 170.207(d).

(10) RxNorm, December 4, 2023, Full Update Release, IBR approved for § 170.207(d).

(s) World Wide Web Consortium (W3C)/MIT, 32 Vassar Street, Room 32-G515, Cambridge, MA 02139 USA, http://www.w3.org/standards/

(1) Web Content Accessibility Guidelines (WCAG) 2.0, December 11, 2008, IBR approved for § 170.204.

(2) [Reserved]

[75 FR 44649, July 28, 2010, as amended at 75 FR 62690, Oct. 13, 2010; 77 FR 54285, Sept. 4, 2012; 77 FR 72991, Dec. 7, 2012; 79 FR 54478, Sept. 11, 2014; 80 FR 62745, Oct. 16, 2015; 81 FR 72463, Oct. 19, 2016; 85 FR 25941, May 1, 2020; 85 FR 70082, Nov. 4, 2020; 89 FR 1428, Jan. 9, 2024; 89 FR 51265, June 17, 2024; 90 FR 37209, Aug. 4, 2025; 91 FR 50367, Aug. 4, 2026]

§ 170.300 Applicability.

(a) The certification criteria adopted in this subpart apply to the testing and certification of Health IT Modules.

(b) When a certification criterion refers to two or more standards as alternatives, use of at least one of the alternative standards will be considered compliant.

(c) Health Modules are not required to be compliant with certification criteria or capabilities specified within a certification criterion that are designated as optional.

(d) In § 170.315, all certification criteria and all capabilities specified within a certification criterion have general applicability (i.e., apply to any health care setting) unless designated as “inpatient setting only” or “ambulatory setting only.”

[75 FR 44649, July 28, 2010, as amended at 77 FR 54286, Sept. 4, 2012; 80 FR 62747, Oct. 16, 2015; 85 FR 25941, May 1, 2020; 85 FR 70083, Nov. 4, 2020]

§§ 170.302-170.306 [Reserved]

§ 170.314 [Reserved]

§ 170.315 ONC certification criteria for Health IT.

Link to an amendment published at 91 FR 67994, Oct. 28, 2026.

Link to an amendment published at 91 FR 67996, Oct. 28, 2026.

The Secretary adopts the following certification criteria for health IT. Health IT must be able to electronically perform the following capabilities in accordance with applicable standards and implementation specifications adopted in this part. For all criteria in this section, a health IT developer with a Health IT Module certified to any revised certification criterion, as defined in § 170.102, shall update the Health IT Module and shall provide such update to their customers in accordance with the dates identified for each revised certification criterion and for each applicable standard in 45 CFR part 170 subpart B.

(a) Clinical—(1) Computerized provider order entry—medications. (i) Enable a user to record, change, and access medication orders.

(ii) Optional. Include a “reason for order” field.

(2) Computerized provider order entry—laboratory. (i) Enable a user to record, change, and access laboratory orders.

(ii) Optional. Include a “reason for order” field.

(3) Computerized provider order entry—diagnostic imaging. (i) Enable a user to record, change, and access diagnostic imaging orders.

(ii) Optional. Include a “reason for order” field.

(4) Drug-drug, drug-allergy interaction checks for CPOE—(i) Interventions. Before a medication order is completed and acted upon during computerized provider order entry (CPOE), interventions must automatically indicate to a user drug-drug and drug-allergy contraindications based on a patient's medication list and medication allergy list.

(ii) Adjustments. (A) Enable the severity level of interventions provided for drug-drug interaction checks to be adjusted.

(B) Limit the ability to adjust severity levels in at least one of these two ways:

(1) To a specific set of identified users.

(2) As a system administrative function.

(5) Patient demographics and observations. (i) Enable a user to record, change, and access patient demographic and observations data including race, ethnicity, preferred language, sex, sex parameter for clinical use, sexual orientation, gender identity, name to use, pronouns, and date of birth.

(A) Race and ethnicity. (1) Enable each one of a patient's races to be recorded in accordance with, at a minimum, the standard specified in § 170.207(f)(3) and whether a patient declines to specify race.

(2) Enable each one of a patient's ethnicities to be recorded in accordance with, at a minimum, the standard specified in § 170.207(f)(3) and whether a patient declines to specify ethnicity.

(3) Aggregate each one of the patient's races and ethnicities recorded in accordance with paragraphs (a)(5)(i)(A)(1) and (2) of this section to the categories in the standard specified in § 170.207(f)(1).

(B) Preferred language. Enable preferred language to be recorded in accordance with the standard specified in § 170.207(g)(2) and whether a patient declines to specify a preferred language.

(C) Sex. Enable sex to be recorded in accordance with the standard specified in § 170.207(n)(1) for the period up to and including December 31, 2025; or § 170.207(n)(2).

(D) Sexual orientation. Enable sexual orientation to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(o)(1) for the period up to and including December 31, 2025; or § 170.207(o)(3), as well as whether a patient declines to specify sexual orientation.

(E) Gender identity. Enable gender identity to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(o)(2) for the period up to and including December 31, 2025; or § 170.207(o)(3), as well as whether a patient declines to specify gender identity.

(F) Sex Parameter for Clinical Use. Enable at least one sex parameter for clinical use to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(n)(3). Conformance with this paragraph is required by January 1, 2026.

(G) Name to Use. Enable at least one preferred name to use to be recorded. Conformance with this paragraph is required by January 1, 2026.

(H) Pronouns. Enable at least one pronoun to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(o)(4). Conformance with this paragraph is required by January 1, 2026.

(ii) Inpatient setting only. Enable a user to record, change, and access the preliminary cause of death and date of death in the event of mortality.

(6)-(8) [Reserved]

(9) Clinical decision support (CDS)—(i) CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.

(ii) CDS configuration. (A) Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.

(B) Enable interventions:

(1) Based on the following data:

(i) Problem list;

(ii) Medication list;

(iii) Allergy and intolerance list;

(iv) At least one demographic specified in paragraph (a)(5)(i) of this section;

(v) Laboratory tests; and

(vi) Vital signs.

(2) When a patient's medications, allergies and intolerance, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.

(iii) Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.

(iv) Linked referential CDS. (A) Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:

(1) The standard and implementation specifications specified in § 170.204(b)(3).

(2) The standard and implementation specifications specified in § 170.204(b)(4).

(B) For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.

(v) Source attributes. Enable a user to review the attributes as indicated for all CDS resources:

(A) For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:

(1) Bibliographic citation of the intervention (clinical research/guideline);

(2) Developer of the intervention (translation from clinical research/guideline);

(3) Funding source of the intervention development technical implementation; and

(4) Release and, if applicable, revision date(s) of the intervention or reference source.

(B) For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).

(vi) Expiration of criterion. The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.

(10)-(11) [Reserved]

(12) Family health history. Enable a user to record, change, and access a patient's family health history in accordance with the familial concepts or expressions included in, at a minimum, the version of the standard in § 170.207(a)(1).

(13) [Reserved]

(14) Implantable device list. (i) Record Unique Device Identifiers associated with a patient's Implantable Devices.

(ii) Parse the following identifiers from a Unique Device Identifier:

(A) Device Identifier; and

(B) The following identifiers that compose the Production Identifier:

(1) The lot or batch within which a device was manufactured;

(2) The serial number of a specific device;

(3) The expiration date of a specific device;

(4) The date a specific device was manufactured; and

(5) For an HCT/P regulated as a device, the distinct identification code required by 21 CFR 1271.290(c).

(iii) Obtain and associate with each Unique Device Identifier:

(A) A description of the implantable device referenced by at least one of the following:

(1) The “GMDN PT Name” attribute associated with the Device Identifier in the Global Unique Device Identification Database.

(2) The “SNOMED CT® Description” mapped to the attribute referenced in in paragraph (a)(14)(iii)(A)(1) of this section.

(B) The following Global Unique Device Identification Database attributes:

(1) “Brand Name”;

(2) “Version or Model”;

(3) “Company Name”;

(4) “What MRI safety information does the labeling contain?”; and

(5) “Device required to be labeled as containing natural rubber latex or dry natural rubber (21 CFR 801.437).”

(iv) Display to a user an implantable device list consisting of:

(A) The active Unique Device Identifiers recorded for the patient;

(B) For each active Unique Device Identifier recorded for a patient, the description of the implantable device specified by paragraph (a)(14)(iii)(A) of this section; and

(C) A method to access all Unique Device Identifiers recorded for a patient.

(v) For each Unique Device Identifier recorded for a patient, enable a user to access:

(A) The Unique Device Identifier;

(B) The description of the implantable device specified by paragraph (a)(14)(iii)(A) of this section;

(C) The identifiers associated with the Unique Device Identifier, as specified by paragraph (a)(14)(ii) of this section; and

(D) The attributes associated with the Unique Device Identifier, as specified by paragraph (a)(14)(iii)(B) of this section.

(vi) Enable a user to change the status of a Unique Device Identifier recorded for a patient.

(15) Social, psychological, and behavioral data. Enable a user to record, change, and access the following patient social, psychological, and behavioral data:

(i) Financial resource strain. Enable financial resource strain to be recorded in accordance with the standard specified in § 170.207(p)(1) and whether a patient declines to specify financial resource strain.

(ii) Education. Enable education to be recorded in accordance with the standard specified in § 170.207(p)(2) and whether a patient declines to specify education.

(iii) Stress. Enable stress to be recorded in accordance with the standard specified in § 170.207(p)(3) and whether a patient declines to specify stress.

(iv) Depression. Enable depression to be recorded in accordance with the standard specified in § 170.207(p)(4) and whether a patient declines to specify depression.

(v) Physical activity. Enable physical activity to be recorded in accordance with the standard specified in § 170.207(p)(5) and whether a patient declines to specify physical activity.

(vi) Alcohol use. Enable alcohol use to be recorded in accordance with the standard specified in § 170.207(p)(6) and whether a patient declines to specify alcohol use.

(vii) Social connection and isolation. Enable social connection and isolation to be recorded in accordance the standard specified in § 170.207(p)(7) and whether a patient declines to specify social connection and isolation.

(viii) Exposure to violence (intimate partner violence). Enable exposure to violence (intimate partner violence) to be recorded in accordance with the standard specified in § 170.207(p)(8) and whether a patient declines to specify exposure to violence (intimate partner violence).

(b) Care coordination—(1) Transitions of care—(i) Send and receive via edge protocol. (A) Send transition of care/referral summaries through a method that conforms to the standard specified in § 170.202(d) and that leads to such summaries being processed by a service that has implemented the standard specified in § 170.202(a)(2); and

(B) Receive transition of care/referral summaries through a method that conforms to the standard specified in § 170.202(d) from a service that has implemented the standard specified in § 170.202(a)(2).

(C) XDM processing. Receive and make available the contents of a XDM package formatted in accordance with the standard adopted in § 170.205(p)(1) when the technology is also being certified using an SMTP-based edge protocol.

(ii) Validate and display—(A) Validate C-CDA conformance—system performance. Demonstrate the ability to detect valid and invalid transition of care/referral summaries received and formatted in accordance with the standards specified in § 170.205(a)(3), (4), and (5) for the Continuity of Care Document, Referral Note, and (inpatient setting only) Discharge Summary document templates. This includes the ability to:

(1) Parse each of the document types.

(2) Detect errors in corresponding “document-templates,” “section-templates,” and “entry-templates,” including invalid vocabulary standards and codes not specified in the standards adopted in § 170.205(a)(3), (4), and (5).

(3) Identify valid document-templates and process the data elements required in the corresponding section-templates and entry-templates from the standards adopted in § 170.205(a)(3), (4), and (5).

(4) Correctly interpret empty sections and null combinations.

(5) Record errors encountered and allow a user through at least one of the following ways to:

(i) Be notified of the errors produced.

(ii) Review the errors produced.

(B) Display. Display in human readable format the data included in transition of care/referral summaries received and formatted according to the standards specified in § 170.205(a)(3), (4), and (5).

(C) Display section views. Allow for the individual display of each section (and the accompanying document header information) that is included in a transition of care/referral summary received and formatted in accordance with the standards adopted in § 170.205(a)(3), (4), and (5) in a manner that enables the user to:

(1) Directly display only the data within a particular section;

(2) Set a preference for the display order of specific sections; and

(3) Set the initial quantity of sections to be displayed.

(iii) Create. Enable a user to create a transition of care/referral summary formatted in accordance with the standard specified in § 170.205(a)(3), (4), and (5) using the Continuity of Care Document, Referral Note, and (inpatient setting only) Discharge Summary document templates that includes, at a minimum:

(A)(1) The data classes expressed in the standards in § 170.213 and in accordance with § 170.205(a)(4), (5), and paragraphs (b)(1)(iii)(A)(3)(i) through (iii) of this section for the time period up to and including December 31, 2025, or

(2) The data classes expressed in the standards in § 170.213 and in accordance with § 170.205(a)(4), (6), and paragraphs (b)(1)(iii)(A)(3)(i) through (iii) of this section, and

(3) The following data classes:

(i) Assessment and plan of treatment. In accordance with the “Assessment and Plan Section (V2)” of the standard specified in § 170.205(a)(4); or in accordance with the “Assessment Section (V2)” and “Plan of Treatment Section (V2)” of the standard specified in § 170.205(a)(4).

(ii) Goals. In accordance with the “Goals Section” of the standard specified in § 170.205(a)(4).

(iii) Health concerns. In accordance with the “Health Concerns Section” of the standard specified in § 170.205(a)(4).

(iv) Unique device identifier(s) for a patient's implantable device(s). In accordance with the “Product Instance” in the “Procedure Activity Procedure Section” of the standard specified in § 170.205(a)(4).

(B) Encounter diagnoses. Formatted according to at least one of the following standards:

(1) The standard specified in § 170.207(i).

(2) At a minimum, the version of the standard specified in § 170.207(a)(1).

(C) Cognitive status.

(D) Functional status.

(E) Ambulatory setting only. The reason for referral; and referring or transitioning provider's name and office contact information.

(F) Inpatient setting only. Discharge instructions.

(G) Patient matching data. First name, last name, previous name, middle name (including middle initial), suffix, date of birth, current address, phone number, and sex. The following constraints apply:

(1) Date of birth constraint. (i) The year, month and day of birth must be present for a date of birth. The technology must include a null value when the date of birth is unknown.

(ii) Optional. When the hour, minute, and second are associated with a date of birth the technology must demonstrate that the correct time zone offset is included.

(2) Phone number constraint. Represent phone number (home, business, cell) in accordance with the standards adopted in § 170.207(q)(1). All phone numbers must be included when multiple phone numbers are present.

(3) Sex Constraint: Represent sex with the standard adopted in § 170.207(n)(1) up to and including December 31, 2025; or with the standard adopted in § 170.207(n)(2).

(2) Clinical information reconciliation and incorporation—(i) General requirements. Paragraphs (b)(2)(ii) and (iii) of this section must be completed based on the receipt of a transition of care/referral summary formatted in accordance with the standards adopted in § 170.205(a)(3) through (5) using the Continuity of Care Document, Referral Note, and (inpatient setting only) Discharge Summary document templates, for time period up to and including December 31, 2025; or in accordance with the standards adopted in § 170.205(a)(3), (4), (6).

(ii) Correct patient. Upon receipt of a transition of care/referral summary formatted according to the standards adopted § 170.205(a)(3) through (5) for the period up to and including December 31, 2025; or according to the standards adopted § 170.205(a)(3), (4), and (6), technology must be able to demonstrate that the transition of care/referral summary received can be properly matched to the correct patient.

(iii) Reconciliation. Enable a user to reconcile the data that represent a patient's active medication list, allergies and intolerance list, and problem list as follows. For each list type:

(A) Simultaneously display (i.e., in a single view) the data from at least two sources in a manner that allows a user to view the data and their attributes, which must include, at a minimum, the source and last modification date.

(B) Enable a user to create a single reconciled list of each of the following: Medications; Allergies and Intolerances; and problems.

(C) Enable a user to review and validate the accuracy of a final set of data.

(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standards:

(1) Medications. At a minimum, the version of the standard specified in § 170.213;

(2) Allergies and intolerance. At a minimum, the version of the standard specified in § 170.213; and

(3) Problems. At a minimum, the version of the standard specified in § 170.213.

(iv) System verification. Based on the data reconciled and incorporated, the technology must be able to create a file formatted according to the standard specified in § 170.205(a)(4) using the Continuity of Care Document template and the standard specified in § 170.205(a)(5) on and after December 31, 2022.

(iv) System verification. Based on the data reconciled and incorporated, the technology must be able to create a file formatted according to the standard specified in § 170.205(a)(4) using the Continuity of Care Document template and the standard specified in paragraph (a)(5) of this section for the time period up to and including December 31, 2025; or according to the standard specified in § 170.205(a)(4) using the Continuity of Care Document template and the standard specified in paragraph (a)(6) of this section.

(3) Electronic prescribing. (i) [Reserved]

(ii) For technology certified subsequent to June 30, 2020:

(A)(1) For the time period up to and including December 31, 2027, enable a user to perform the prescription-related electronic transactions specified in paragraph (b)(3)(ii)(A)(3) of this section in accordance with the standards specified in § 170.205(b)(1) or (2).

(i) At a minimum, at least one of the versions of the standard adopted in § 170.207(d)(1).

(ii) The standard in § 170.207(d)(2) if using the standard in § 170.205(b)(2).

(2) On and after January 1, 2028, enable a user to perform the prescription-related electronic transactions specified in paragraph (b)(3)(ii)(A)(3) of this section in accordance with the standard specified in § 170.205(b)(2).

(i) At a minimum, at least one of the versions of the standard adopted in § 170.207(d)(1).

(ii) The standard in § 170.207(d)(2).

(3) The prescription-related electronic transactions are as follows:

(i) New prescriptions (NewRx).

(ii) Request and respond to change prescriptions (RxChangeRequest, RxChangeResponse).

(iii) Request and respond to cancel prescriptions (CancelRx, CancelRxResponse).

(iv) Request and respond to renew prescriptions (RxRenewalRequest, RxRenewalResponse).

(v) Receive fill status notifications (RxFill).

(vi) Request and receive medication history (RxHistoryRequest, RxHistoryResponse).

(vii) Relay acceptance of a transaction back to the sender (Status).

(viii) Respond that there was a problem with the transaction (Error).

(ix) Respond that a transaction requesting a return receipt has been received (Verify).

(x) Electronic prior authorization transactions (PAInitiationRequest, PAInitiationResponse, PARequest, PAResponse, PAAppealRequest, PAAppealResponse, PACancelRequest, PACancelResponse, and PANotification). These transactions are required if using the standard in § 170.205(b)(2).

(B) Enable a user to exchange race and ethnicity information when performing the following prescription-related electronic transactions, if using the standard in § 170.205(b)(2):

(1) Receive fill status notifications (RxFill).

(2) Request and respond to change prescriptions (RxChangeRequest, RxChangeResponse).

(3) Request to cancel prescriptions (CancelRx).

(4) Request and respond to renew prescriptions (RxRenewalRequest, RxRenewalResponse).

(C) For the following prescription-related transactions, the technology must be able to receive and transmit the diagnosis or diagnoses that are the reason for prescription:

(1) Required transactions:

(i) New prescriptions (NewRx).

(ii) Request and respond to change prescriptions (RxChangeRequest, RxChangeResponse).

(iii) Cancel prescriptions (CancelRx).

(iv) Request and respond to renew prescriptions (RxRenewalRequest, RxRenewalResponse).

(v) Receive fill status notifications (RxFill).

(vi) [Reserved]

(vii) Electronic prior authorization transactions (PAInitiationRequest, PAInitiationResponse, PARequest, PAResponse, PAAppealRequest, PAAppealResponse and PACancelRequest, PACancelResponse, PANotification). These transactions are required if using the standard in § 170.205(b)(2).

(2) [Reserved]

(D) [Reserved]

(E) Limit a user's ability to prescribe all oral liquid medications in only metric standard units of mL (that is, not cc).

(F) Always insert leading zeroes before the decimal point for amounts less than one and must not allow trailing zeroes after a decimal point when a user prescribes medications.

(4) Real-time prescription benefit—(i) Send and receive information. Enable a user to perform the following transactions using the XML format in accordance with at least one of the versions of the standards adopted in § 170.205(c); at a minimum, a standard adopted in § 170.207(d)(1); and the standard in § 170.207(d)(2), as follows:

(A) Request patient-specific prescription benefit information, estimated cost information, and alternative products, in accordance with the RTPBRequest transaction.

(B) Receive patient-specific prescription benefit information, estimated cost information, and alternative products in response to a request, in accordance with the RTPBResponse transaction.

(ii) Display. Display to a user in human readable format patient-specific prescription benefit information, estimated cost information, and alternative products, in accordance with at least one of the versions of the standard adopted in § 170.205(c).

(5)-(6) [Reserved]

(7) Security tags—summary of care—send. Enable a user to create a summary record formatted in accordance with the standard adopted in § 170.205(a)(4) that is tagged as restricted and subject to restrictions on re-disclosure according to the standard adopted in § 170.205(o)(1) at the document, section, and entry (data element) level.

(8) Security tags—summary of care—receive. (i) Enable a user to receive a summary record that is formatted in accordance with the standard adopted in § 170.205(a)(4) that is tagged as restricted and subject to restrictions on re-disclosure according to the standard adopted in § 170.205(o)(1) at the document, section, and entry (data element) level; and

(ii) Preserve privacy markings to ensure fidelity to the tagging based on consent and with respect to sharing and re-disclosure restrictions.

(9) Care plan. Enable a user to record, change, access, create, and receive care plan information in accordance with:

(i) The Care Plan document template, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2), in the standard specified in § 170.205(a)(4); and

(ii) The standard in § 170.205(a)(5) for the time period up to and including December 31, 2025; or § 170.205(a)(6).

(10) Electronic Health Information export—(i) Single patient electronic health information export. (A) Enable a user to timely create an export file(s) with all of a single patient's electronic health information that can be stored at the time of certification by the product, of which the Health IT Module is a part.

(B) A user must be able to execute this capability at any time the user chooses and without subsequent developer assistance to operate.

(C) Limit the ability of users who can create export file(s) in at least one of these two ways:

(1) To a specific set of identified users

(2) As a system administrative function.

(D) The export file(s) created must be electronic and in a computable format.

(E) The publicly accessible hyperlink of the export's format must be included with the exported file(s).

(ii) Patient population electronic health information export. Create an export of all the electronic health information that can be stored at the time of certification by the product, of which the Health IT Module is a part.

(A) The export created must be electronic and in a computable format.

(B) The publicly accessible hyperlink of the export's format must be included with the exported file(s).

(iii) Documentation. The export format(s) used to support paragraphs (b)(10)(i) and (ii) of this section must be kept up-to-date.

(11) Decision support interventions—

(i) Decision support intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.

(ii) Decision support configuration. (A) Enable interventions specified in paragraphs (b)(11)(iii) of this section to be configured by a limited set of identified users based on a user's role.

(B) Enable interventions when a patient's medications, allergies and intolerance, and problems are incorporated from a transition of care or referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.

(C) Enable a user to provide electronic feedback data for evidence-based decision support interventions selected via the capability provided in paragraph (b)(11)(iii)(A) of this section and make available such feedback data to a limited set of identified users for export, in a computable format, including at a minimum the intervention, action taken, user feedback provided (if applicable), user, date, and location.

(iii) Decision support intervention selection. Enable a limited set of identified users to select (i.e., activate) electronic decision support interventions (in addition to drug-drug and drug-allergy contraindication checking) that are:

(A) Evidence-based decision support interventions and use any data based on the following data expressed in the standards in § 170.213:

(1) Problems;

(2) Medications;

(3) Allergies and Intolerances;

(4) At least one demographic specified in paragraph (a)(5)(i) of this section;

(5) Laboratory;

(6) Vital Signs;

(7) Unique Device Identifier(s) for a Patient's Implantable Device(s); and

(8) Procedures.

(B) Predictive Decision Support Interventions and use any data expressed in the standards in § 170.213.

(iv) Source attributes. Source attributes listed in paragraphs (b)(11)(iv)(A) and (B) of this section must be supported.

(A) For evidence-based decision support interventions:

(1) Bibliographic citation of the intervention (clinical research or guideline);

(2) Developer of the intervention (translation from clinical research or guideline);

(3) Funding source of the technical implementation for the intervention(s) development;

(4) Release and, if applicable, revision dates of the intervention or reference source;

(5) Use of race as expressed in the standards in § 170.213;

(6) Use of ethnicity as expressed in the standards in § 170.213;

(7) Use of language as expressed in the standards in § 170.213;

(8) Use of sexual orientation as expressed in the standards in § 170.213;

(9) Use of gender identity as expressed in the standards in § 170.213;

(10) Use of sex as expressed in the standards in § 170.213;

(11) Use of date of birth as expressed in the standards in § 170.213;

(12) Use of social determinants of health data as expressed in the standards in § 170.213; and

(13) Use of health status assessments data as expressed in the standards in § 170.213.

(B) For Predictive Decision Support Interventions:

(1) Details and output of the intervention, including:

(i) Name and contact information for the intervention developer;

(ii) Funding source of the technical implementation for the intervention(s) development;

(iii) Description of value that the intervention produces as an output; and

(iv) Whether the intervention output is a prediction, classification, recommendation, evaluation, analysis, or other type of output.

(2) Purpose of the intervention, including:

(i) Intended use of the intervention;

(ii) Intended patient population(s) for the intervention's use;

(iii) Intended user(s); and

(iv) Intended decision-making role for which the intervention was designed to be used/for (e.g., informs, augments, replaces clinical management).

(3) Cautioned out-of-scope use of the intervention, including:

(i) Description of tasks, situations, or populations where a user is cautioned against applying the intervention; and

(ii) Known risks, inappropriate settings, inappropriate uses, or known limitations.

(4) Intervention development details and input features, including at a minimum:

(i) Exclusion and inclusion criteria that influenced the training data set;

(ii) Use of variables in paragraphs (b)(11)(iv)(A)(5) through (13) of this section as input features;

(iii) Description of demographic representativeness according to variables in paragraphs (b)(11)(iv)(A)(5) through (13) of this section including, at a minimum, those used as input features in the intervention;

(iv) Description of relevance of training data to intended deployed setting; and

(5) Process used to ensure fairness in development of the intervention, including:

(i) Description of the approach the intervention developer has taken to ensure that the intervention's output is fair; and

(ii) Description of approaches to manage, reduce, or eliminate bias.

(6) External validation process, including:

(i) Description of the data source, clinical setting, or environment where an intervention's validity and fairness has been assessed, other than the source of training and testing data

(ii) Party that conducted the external testing;

(iii) Description of demographic representativeness of external data according to variables in paragraph (b)(11)(iv)(A)(5)-(13) including, at a minimum, those used as input features in the intervention; and

(iv) Description of external validation process.

(7) Quantitative measures of performance, including:

(i) Validity of intervention in test data derived from the same source as the initial training data;

(ii) Fairness of intervention in test data derived from the same source as the initial training data;

(iii) Validity of intervention in data external to or from a different source than the initial training data;

(iv) Fairness of intervention in data external to or from a different source than the initial training data;

(v) References to evaluation of use of the intervention on outcomes, including, bibliographic citations or hyperlinks to evaluations of how well the intervention reduced morbidity, mortality, length of stay, or other outcomes;

(8) Ongoing maintenance of intervention implementation and use, including:

(i) Description of process and frequency by which the intervention's validity is monitored over time;

(ii) Validity of intervention in local data;

(iii) Description of the process and frequency by which the intervention's fairness is monitored over time;

(iv) Fairness of intervention in local data; and

(9) Update and continued validation or fairness assessment schedule, including:

(i) Description of process and frequency by which the intervention is updated; and

(ii) Description of frequency by which the intervention's performance is corrected when risks related to validity and fairness are identified.

(v) Source attribute access and modification—(A) Access. (1) For evidence-based decision support interventions and Predictive Decision Support Interventions supplied by the health IT developer as part of its Health IT Module, the Health IT Module must enable a limited set of identified users to access complete and up-to-date plain language descriptions of source attribute information specified in paragraphs (b)(11)(iv)(A) and (B) of this section.

(2) For Predictive Decision Support Interventions supplied by the health IT developer as part of its Health IT Module, the Health IT Module must indicate when information is not available for review for source attributes in paragraphs (b)(11)(iv)(B)(6); (b)(11)(iv)(B)(7)(iii), (iv), and (v); (b)(11)(iv)(B)(8)(ii) and (iv); and (b)(11)(iv)(B)(9) of this section.

(B) Modify. (1) For evidence-based decision support interventions and Predictive Decision Support Interventions, the Health IT Module must enable a limited set of identified users to record, change, and access source attributes in paragraphs (b)(11)(iv)(A) and (B) of this section.

(2) For Predictive Decision Support Interventions, the Health IT Module must enable a limited set of identified users to record, change, and access additional source attributes not specified in paragraph (b)(11)(iv)(B) of this section.

(vi) Intervention risk management. Intervention risk management practices must be applied for each Predictive Decision Support Intervention supplied by the health IT developer as part of its Health IT Module.

(A) Risk analysis. The Predictive Decision Support Intervention(s) must be subject to analysis of potential risks and adverse impacts associated with the following characteristics: validity, reliability, robustness, fairness, intelligibility, safety, security, and privacy.

(B) Risk mitigation. The Predictive Decision Support Intervention (s) must be subject to practices to mitigate risks, identified in accordance with paragraph (b)(11)(vi)(A) of this section; and

(C) Governance. The Predictive Decision Support Intervention(s) must be subject to policies and implemented controls for governance, including how data are acquired, managed, and used.

(c) Clinical quality measures—(1) Clinical quality measures—record and export—(i) Record. For each and every CQM for which the technology is presented for certification, the technology must be able to record all of the data that would be necessary to calculate each CQM. Data required for CQM exclusions or exceptions must be codified entries, which may include specific terms as defined by each CQM, or may include codified expressions of “patient reason,” “system reason,” or “medical reason.”

(ii) Export. A user must be able to export a data file at any time the user chooses and without subsequent developer assistance to operate:

(A) Formatted in accordance with the standard specified in § 170.205(h)(2);

(B) Ranging from one to multiple patients; and

(C) That includes all of the data captured for each and every CQM to which technology was certified under paragraph (c)(1)(i) of this section.

(2) Clinical quality measures—import and calculate—(i) Import. Enable a user to import a data file in accordance with the standard specified in § 170.205(h)(2) for one or multiple patients and use such data to perform the capability specified in paragraph (c)(2)(ii) of this section. A user must be able to execute this capability at any time the user chooses and without subsequent developer assistance to operate.

(ii) Calculate each and every clinical quality measure for which it is presented for certification.

(3) Clinical quality measures—report. Enable a user to electronically create a data file for transmission of clinical quality measurement data:

(i) In accordance with the applicable implementation specifications specified by the CMS implementation guides for Quality Reporting Document Architecture (QRDA), category I, for inpatient measures in § 170.205(h)(3) and CMS implementation guide for QRDA, category III for ambulatory measures in § 170.205 (k)(3); or

(ii) In accordance with the standards specified in § 170.205(h)(2) and § 170.205(k)(1) and (2) for the period before December 31, 2022.

(4) Clinical quality measures—filter. (i) Record the data listed in paragraph (c)(4)(iii) of this section in accordance with the identified standards, where specified.

(ii) Filter CQM results at the patient and aggregate levels by each one and any combination of the data listed in paragraph (c)(4)(iii) of this section and be able to:

(A) Create a data file of the filtered data in accordance with the standards adopted in § 170.205(h)(2) and § 170.205(k)(1) and (2); and

(B) Display the filtered data results in human readable format.

(iii) Data.

(A) Taxpayer Identification Number.

(B) National Provider Identifier.

(C) Provider type in accordance with, at a minimum, the standard specified in § 170.207(r)(2).

(D) Practice site address.

(E) Patient insurance in accordance with the standard specified in § 170.207(s)(2).

(F) Patient age.

(G) Patient sex in accordance with the version of the standard specified in § 170.207(n)(2).

(H) Patient race and ethnicity in accordance with, at a minimum, the version of the standard specified in § 170.207(f)(3).

(I) Patient problem list data in accordance with, at a minimum, the version of the standard specified in § 170.207(a)(1).

(d) Privacy and security—(1) Authentication, access control, and authorization. (i) Verify against a unique identifier(s) (e.g., username or number) that a user seeking access to electronic health information is the one claimed; and

(ii) Establish the type of access to electronic health information a user is permitted based on the unique identifier(s) provided in paragraph (d)(1)(i) of this section, and the actions the user is permitted to perform with the technology.

(2) Auditable events and tamper-resistance—(i) Record actions. Technology must be able to:

(A) Record actions related to electronic health information in accordance with the standard specified in § 170.210(e)(1);

(B) Record the audit log status (enabled or disabled) in accordance with the standard specified in § 170.210(e)(2) unless it cannot be disabled by any user; and

(C) Record the encryption status (enabled or disabled) of electronic health information locally stored on end-user devices by technology in accordance with the standard specified in § 170.210(e)(3) unless the technology prevents electronic health information from being locally stored on end-user devices (see paragraph (d)(7) of this section).

(ii) Default setting. Technology must be set by default to perform the capabilities specified in paragraph (d)(2)(i)(A) of this section and, where applicable, paragraphs (d)(2)(i)(B) and (d)(2)(i)(C) of this section.

(iii) When disabling the audit log is permitted. For each capability specified in paragraphs (d)(2)(i)(A) through (C) of this section that technology permits to be disabled, the ability to do so must be restricted to a limited set of users.

(iv) Audit log protection. Actions and statuses recorded in accordance with paragraph (d)(2)(i) of this section must not be capable of being changed, overwritten, or deleted by the technology.

(v) Detection. Technology must be able to detect whether the audit log has been altered.

(3) Audit report(s). Enable a user to create an audit report for a specific time period and to sort entries in the audit log according to each of the data specified in the standards in § 170.210(e).

(4) Amendments. Enable a user to select the record affected by a patient's request for amendment and perform the capabilities specified in paragraph (d)(4)(i) or (ii) of this section.

(i) Accepted amendment. For an accepted amendment, append the amendment to the affected record or include a link that indicates the amendment's location.

(ii) Denied amendment. For a denied amendment, at a minimum, append the request and denial of the request in at least one of the following ways:

(A) To the affected record.

(B) Include a link that indicates this information's location.

(5) Automatic access time-out. (i) Automatically stop user access to health information after a predetermined period of inactivity.

(ii) Require user authentication in order to resume or regain the access that was stopped.

(6) Emergency access. Permit an identified set of users to access electronic health information during an emergency.

(7) End-user device encryption. The requirements specified in one of the following paragraphs (that is, paragraphs (d)(7)(i) and (d)(7)(ii) of this section) must be met to satisfy this certification criterion.

(i) Technology that is designed to locally store electronic health information on end-user devices must encrypt the electronic health information stored on such devices after use of the technology on those devices stops.

(A) Electronic health information that is stored must be encrypted in accordance with the standard specified in § 170.210(a)(2).

(B) Default setting. Technology must be set by default to perform this capability and, unless this configuration cannot be disabled by any user, the ability to change the configuration must be restricted to a limited set of identified users.

(ii) Technology is designed to prevent electronic health information from being locally stored on end-user devices after use of the technology on those devices stops.

(8) Integrity. (i) Create a message digest in accordance with the standard specified in § 170.210(c)(2).

(ii) Verify in accordance with the standard specified in § 170.210(c)(2) upon receipt of electronically exchanged health information that such information has not been altered.

(9) Trusted connection. Establish a trusted connection using one of the following methods:

(i) Message-level. Encrypt and integrity protect message contents in accordance with the standards specified in § 170.210(a)(2) and (c)(2).

(ii) Transport-level. Use a trusted connection in accordance with the standards specified in § 170.210(a)(2) and (c)(2).

(10) Auditing actions on health information. (i) By default, be set to record actions related to electronic health information in accordance with the standard specified in § 170.210(e)(1).

(ii) If technology permits auditing to be disabled, the ability to do so must be restricted to a limited set of users.

(iii) Actions recorded related to electronic health information must not be capable of being changed, overwritten, or deleted by the technology.

(iv) Technology must be able to detect whether the audit log has been altered.

(11) Accounting of disclosures. Record disclosures made for treatment, payment, and health care operations in accordance with the standard specified in § 170.210(d).

(12) Encrypt authentication credentials. Health IT developers must make one of the following attestations and may provide the specified accompanying information, where applicable:

(i) Yes—the Health IT Module encrypts stored authentication credentials in accordance with standards adopted in § 170.210(a)(2).

(ii) No—the Health IT Module does not encrypt stored authentication credentials. When attesting “no,” the health IT developer may explain why the Health IT Module does not support encrypting stored authentication credentials.

(13) Multi-factor authentication. Health IT developers must make one of the following attestations and, as applicable, provide the specified accompanying information:

(i) Yes—the Health IT Module supports the authentication, through multiple elements, of the user's identity with the use of industry-recognized standards. When attesting “yes,” the health IT developer must describe the use cases supported.

(ii) No—the Health IT Module does not support authentication, through multiple elements, of the user's identity with the use of industry-recognized standards. When attesting “no,” the health IT developer may explain why the Health IT Module does not support authentication, through multiple elements, of the user's identity with the use of industry-recognized standards.

(e) Patient engagement—(1) View, download, and transmit to 3rd party. (i) Patients (and their authorized representatives) must be able to use internet-based technology to view, download, and transmit their health information to a 3rd party in the manner specified below. Such access must be consistent and in accordance with the standard adopted in § 170.204(a)(1) and may alternatively be demonstrated in accordance with the standard specified in § 170.204(a)(2).

(A) View. Patients (and their authorized representatives) must be able to use health IT to view, at a minimum, the following data:

(1) The data classes expressed in the standards in § 170.213 (which should be in their English (i.e., non-coded) representation if they associate with a vocabulary/code set), and in accordance with § 170.205(a)(4) and (a)(5), and paragraphs (e)(1)(i)(A)(3)(i) through (iii) of this section for the time period up to and including December 31, 2025, or

(2) The data classes expressed in the standards in § 170.213 (which should be in their English (i.e., non-coded) representation if they associate with a vocabulary/code set), and in accordance with § 170.205(a)(4) and (a)(6), and paragraphs (e)(1)(i)(A)(3)(i) through (iii) of this section.

(3) The following data classes:

(i) Assessment and plan of treatment. In accordance with the “Assessment and Plan Section (V2)” of the standard specified in § 170.205(a)(4); or in accordance with the “Assessment Section (V2)” and “Plan of Treatment Section (V2)” of the standard specified in § 170.205(a)(4).

(ii) Goals. In accordance with the “Goals Section” of the standard specified in § 170.205(a)(4).

(iii) Health concerns. In accordance with the “Health Concerns Section” of the standard specified in § 170.205(a)(4).

(iv) Unique device identifier(s) for a patient's implantable device(s). In accordance with the “Product Instance” in the “Procedure Activity Procedure Section” of the standards specified in § 170.205(a)(4).

(4) Ambulatory setting only. Provider's name and office contact information.

(5) Inpatient setting only. Admission and discharge dates and locations; discharge instructions; and reason(s) for hospitalization.

(6) Laboratory test report(s). Laboratory test report(s), including:

(i) The information for a test report as specified all the data specified in 42 CFR 493.1291(c)(1) through (7);

(ii) The information related to reference intervals or normal values as specified in 42 CFR 493.1291(d); and

(iii) The information for corrected reports as specified in 42 CFR 493.1291(k)(2).

(7) Diagnostic image report(s).

(B) Download. (1) Patients (and their authorized representatives) must be able to use technology to download an ambulatory summary or inpatient summary (as applicable to the health IT setting for which certification is requested) in the following formats:

(i) Human readable format; and

(ii) The format specified in accordance with the standard specified in § 170.205(a)(4) and (5) for the time period up to and including December 31, 2025, or § 170.205(a)(4) and (6), and following the CCD document template.

(2) When downloaded according to the standard specified in § 170.205(a)(4) through (6) following the CCD document template, the ambulatory summary or inpatient summary must include, at a minimum, the following data (which, for the human readable version, should be in their English representation if they associate with a vocabulary/code set):

(i) Ambulatory setting only. All of the data specified in paragraph (e)(1)(i)(A)(1), (2), (4), and (5) of this section.

(ii) Inpatient setting only. All of the data specified in paragraphs (e)(1)(i)(A)(1), and (3) through (5) of this section.

(3) Inpatient setting only. Patients (and their authorized representatives) must be able to download transition of care/referral summaries that were created as a result of a transition of care (pursuant to the capability expressed in the certification criterion specified in paragraph (b)(1) of this section).

(C) Transmit to third party. Patients (and their authorized representatives) must be able to:

(1) Transmit the ambulatory summary or inpatient summary (as applicable to the health IT setting for which certification is requested) created in paragraph (e)(1)(i)(B)(2) of this section in accordance with both of the following ways:

(i) Email transmission to any email address; and

(ii) An encrypted method of electronic transmission.

(2) Inpatient setting only. Transmit transition of care/referral summaries (as a result of a transition of care/referral as referenced by (e)(1)(i)(B)(3)) of this section selected by the patient (or their authorized representative) in both of the ways referenced (e)(1)(i)(C)(1)(i) and (ii) of this section).

(D) Timeframe selection. With respect to the data available to view, download, and transmit as referenced paragraphs (e)(1)(i)(A), (B), and (C) of this section, patients (and their authorized representatives) must be able to:

(1) Select data associated with a specific date (to be viewed, downloaded, or transmitted); and

(2) Select data within an identified date range (to be viewed, downloaded, or transmitted).

(ii) Activity history log. (A) When any of the capabilities included in paragraphs (e)(1)(i)(A) through (C) of this section are used, the following information must be recorded and made accessible to the patient (or his/her authorized representative):

(1) The action(s) (i.e., view, download, transmission) that occurred;

(2) The date and time each action occurred in accordance with the standard specified in § 170.210(g);

(3) The user who took the action; and

(4) Where applicable, the addressee to whom an ambulatory summary or inpatient summary was transmitted.

(B) [Reserved]

(iii) Request for restrictions. Patients (and their authorized representatives) must be able to use an internet-based method to request a restriction to be applied for any data expressed in the standards in § 170.213. Conformance with this paragraph is required by January 1, 2026.

(2) [Reserved]

(3) Patient health information capture. Enable a user to:

(i) Identify, record, and access information directly and electronically shared by a patient (or authorized representative).

(ii) Reference and link to patient health information documents.

(f) Public health—(1) Transmission to immunization registries. (i) Create immunization information for electronic transmission in accordance with:

(A) The standard and applicable implementation specifications specified in § 170.205(e)(4).

(B) At a minimum, the version of the standard specified in § 170.207(e)(1) for historical vaccines.

(C) At a minimum, the version of the standard specified in § 170.207(e)(2) for administered vaccines.

(ii) Enable a user to request, access, and display a patient's evaluated immunization history and the immunization forecast from an immunization registry in accordance with the standard at § 170.205(e)(4).

(2) Transmission to public health agencies—syndromic surveillance. Create syndrome-based public health surveillance information for electronic transmission in accordance with the standard (and applicable implementation specifications) specified in § 170.205(d)(4).

(3) Transmission to public health agencies—reportable laboratory tests and values/results. Create reportable laboratory tests and values/results for electronic transmission in accordance with:

(i) The standard (and applicable implementation specifications) specified in § 170.205(g).

(ii) At a minimum, the versions of the standards specified in § 170.207(a)(1) and (c)(1).

(4) Transmission to cancer registries. Create cancer case information for electronic transmission in accordance with:

(i) The standard (and applicable implementation specifications) specified in § 170.205(i)(2).

(ii) At a minimum, the versions of the standards specified in § 170.207(a)(1) and (c)(1).

(5) Transmission to public health agencies—electronic case reporting. Enable a user to create a case report for electronic transmission meeting the requirements described in paragraphs (f)(5)(i) of this section for the time period up to and including December 31, 2025; or the requirements described in paragraph (f)(5)(ii) of this section.

(i) Functional electronic case reporting. A Health IT Module must enable a user to create a case report for electronic transmission in accordance with the following:

(A) Consume and maintain a table of trigger codes to determine which encounters may be reportable.

(B) Match a patient visit or encounter to the trigger code based on the parameters of the trigger code table.

(C) Case report creation. Create a case report for electronic transmission:

(1) Based on a matched trigger from paragraph (f)(5)(i)(B).

(2) That includes, at a minimum:

(i) The data classes expressed in the standards in § 170.213.

(ii) Encounter diagnoses formatted according to at least one of the standards specified in § 170.207(i) or § 170.207(a)(1).

(iii) The provider's name, office contact information, and reason for visit.

(iv) An identifier representing the row and version of the trigger table that triggered the case report.

(ii) Standards-based electronic case reporting. A Health IT Module must enable a user to create a case report for electronic transmission in accordance with the following:

(A) Consume and process case reporting trigger codes and identify a reportable patient visit or encounter based on a match from the Reportable Conditions Trigger Code value set in § 170.205(t)(4).

(B) Create a case report consistent with at least one of the following standards:

(1) The eICR profile of the HL7 FHIR eCR IG in § 170.205(t)(1); or

(2) The HL7 CDA eICR IG in § 170.205(t)(2).

(C) Receive, consume, and process a case report response that is formatted to either the reportability response profile of the HL7 FHIR eCR IG in § 170.205(t)(1) or the HL7 CDA RR IG in § 170.205(t)(3) as determined by the standard used in (f)(5)(ii)(B) of this section.

(D) Transmit a case report electronically to a system capable of receiving a case report.

(6) Transmission to public health agencies—antimicrobial use and resistance reporting. Create antimicrobial use and resistance reporting information for electronic transmission in accordance with the standard specified in § 170.205(r)(1).

(7) Transmission to public health agencies—health care surveys. Create health care survey information for electronic transmission in accordance with the standard specified in § 170.205(s)(1).

(g) Design and performance—(1) Automated numerator recording. For each Promoting Interoperability Programs percentage-based measure, technology must be able to create a report or file that enables a user to review the patients or actions that would make the patient or action eligible to be included in the measure's numerator. The information in the report or file created must be of sufficient detail such that it enables a user to match those patients or actions to meet the measure's denominator limitations when necessary to generate an accurate percentage.

(2) Automated measure calculation. For each Promoting Interoperability Programs percentage-based measure that is supported by a capability included in a technology, record the numerator and denominator and create a report including the numerator, denominator, and resulting percentage associated with each applicable measure.

(3) Safety-enhanced design. (i) User-centered design processes must be applied to each capability technology includes that is specified in the following certification criteria: paragraphs (a)(1) through (5), (9) (until the criterion's expiration date), and (14) and (b)(2), (3), and (11) of this section.

(ii) Number of test participants. A minimum of 10 test participants must be used for the testing of each capability identified in paragraph (g)(3)(i) of this section.

(iii) One of the following must be submitted on the user-centered design processed used:

(A) Name, description and citation (URL and/or publication citation) for an industry or federal government standard.

(B) Name the process(es), provide an outline of the process(es), a short description of the process(es), and an explanation of the reason(s) why use of any of the existing user-centered design standards was impractical.

(iv) The following information/sections from NISTIR 7742 must be submitted for each capability to which user-centered design processes were applied:

(A) Name and product version; date and location of the test; test environment; description of the intended users; and total number of participants;

(B) Description of participants, including: Sex; age; education; occupation/role; professional experience; computer experience; and product experience;

(C) Description of the user tasks that were tested and association of each task to corresponding certification criteria;

(D) The specific metrics captured during the testing of each user task performed in (g)(3)(iv)(C) of this section, which must include: Task success (%); task failures (%); task standard deviations (%); task performance time; and user satisfaction rating (based on a scale with 1 as very difficult and 5 as very easy) or an alternative acceptable user satisfaction measure;

(E) Test results for each task using the metrics identified above in paragraph (g)(3)(iv)(D) of this section; and

(F) Results and data analysis narrative, including: Major test finding; effectiveness; efficiency; satisfaction; and areas for improvement.

(v) Submit test scenarios used in summative usability testing.

(4) Quality management system. (i) For each capability that a technology includes and for which that capability's certification is sought, the use of a Quality Management System (QMS) in the development, testing, implementation, and maintenance of that capability must be identified that satisfies one of the following ways:

(A) The QMS used is established by the Federal government or a standards developing organization.

(B) The QMS used is mapped to one or more QMS established by the Federal government or standards developing organization(s).

(ii) When a single QMS was used for applicable capabilities, it would only need to be identified once.

(iii) When different QMS were applied to specific capabilities, each QMS applied would need to be identified.

(5) Accessibility-centered design. For each capability that a Health IT Module includes and for which that capability's certification is sought, the use of a health IT accessibility-centered design standard or law in the development, testing, implementation and maintenance of that capability must be identified.

(i) When a single accessibility-centered design standard or law was used for applicable capabilities, it would only need to be identified once.

(ii) When different accessibility-centered design standards and laws were applied to specific capabilities, each accessibility-centered design standard or law applied would need to be identified. This would include the application of an accessibility-centered design standard or law to some capabilities and none to others.

(iii) When no accessibility-centered design standard or law was applied to all applicable capabilities such a response is acceptable to satisfy this certification criterion.

(6) Consolidated CDA creation performance. The following technical and performance outcomes must be demonstrated related to Consolidated CDA creation. The capabilities required under paragraphs (g)(6)(i) through (v) of this section can be demonstrated in tandem and do not need to be individually addressed in isolation or sequentially.

(i) This certification criterion's scope includes:

(A) The data classes expressed in the standards in § 170.213 in accordance with § 170.205(a)(4) and (a)(5) and paragraphs (g)(6)(i)(C)(1) through (4) of this section for the time period up to and including December 31, 2025; or

(B) The data classes expressed in the standards in § 170.213, and in accordance with § 170.205(a)(4) and (6) and paragraphs (g)(6)(i)(C)(1) through (3) of this section.

(C) The following data classes:

(1) Assessment and plan of treatment. In accordance with the “Assessment and Plan Section (V2)” of the standard specified in § 170.205(a)(4); or in accordance with the “Assessment Section (V2)” and “Plan of Treatment Section (V2)” of the standard specified in § 170.205(a)(4).

(2) Goals. In accordance with the “Goals Section” of the standard specified in § 170.205(a)(4).

(3) Health concerns. In accordance with the “Health Concerns Section” of the standard specified in § 170.205(a)(4).

(4) Unique device identifier(s) for a patient's implantable device(s). In accordance with the “Product Instance” in the “Procedure Activity Procedure Section” of the standard specified in § 170.205(a)(4).

(ii) Reference C-CDA match. (A) For health IT certified to (g)(6)(i)(A) of this section, create a data file formatted in accordance with the standard adopted in § 170.205(a)(4) and (5) that matches a gold-standard, reference data file.

(B) For health IT certified to (g)(6)(i)(B) of this section, create a data file formatted in accordance with the standard adopted in § 170.205(a)(4) that matches a gold-standard, reference data file.

(iii) Document-template conformance. (A) For health IT certified to (g)(6)(i)(A) of this section, create a data file formatted in accordance with the standard adopted in § 170.205(a)(4) and (5) that demonstrates a valid implementation of each document template applicable to the certification criterion or criteria within the scope of the certificate sought.

(B) For health IT certified to (g)(6)(i)(B) of this section, create a data file formatted in accordance with the standard adopted in § 170.205(a)(4) that demonstrates a valid implementation of each document template applicable to the certification criterion or criteria within the scope of the certificate sought.

(iv) Vocabulary conformance. (A) For health IT certified to (g)(6)(i)(A) of this section, create a data file formatted in accordance with the standard adopted in § 170.205(a)(4) and (5) that demonstrates the required vocabulary standards (and value sets) are properly implemented.

(B) For health IT certified to (g)(6)(i)(B) of this section, create a data file formatted in accordance with the standard adopted in § 170.205(a)(4) that demonstrates the required vocabulary standards (and value sets) are properly implemented.

(v) Completeness verification. Create a data file for each of the applicable document templates referenced in paragraph (g)(6)(iii) of this section without the omission of any of the data included in either paragraph (g)(6)(i)(A) or (B) of this section, as applicable.

(7) Application access—patient selection. The following technical outcome and conditions must be met through the demonstration of an application programming interface (API).

(i) Functional requirement. The technology must be able to receive a request with sufficient information to uniquely identify a patient and return an ID or other token that can be used by an application to subsequently execute requests for that patient's data.

(ii) Documentation. (A) The API must include accompanying documentation that contains, at a minimum:

(1) API syntax, function names, required and optional parameters and their data types, return variables and their types/structures, exceptions and exception handling methods and their returns.

(2) The software components and configurations that would be necessary for an application to implement in order to be able to successfully interact with the API and process its response(s).

(B) The documentation used to meet paragraph (g)(7)(ii)(A) of this section must be available via a publicly accessible hyperlink.

(8) [Reserved]

(9) Application access—all data request. The following technical outcome and conditions must be met through the demonstration of an application programming interface.

(i) Functional requirements. (A)(1) Respond to requests for patient data (based on an ID or other token) for all of the data classes expressed in the standards in § 170.213 at one time and return such data (according to the specified standards, where applicable) in a summary record formatted in accordance with § 170.205(a)(4) and (5) following the CCD document template, and as specified in paragraphs (g)(9)(i)(A)(3)(i) through (iv) of this section for the time period up to and including December 31, 2025; or

(2) Respond to requests for patient data (based on an ID or other token) for all of the data classes expressed in the standards in § 170.213 at one time and return such data (according to the specified standards, where applicable) in a summary record formatted in accordance with § 170.205(a)(4) and (6) following the CCD document template, and as specified in paragraphs (g)(9)(i)(A)(3)(i) through (iv) of this section.

(3) The following data classes:

(i) Assessment and plan of treatment. In accordance with the “Assessment and Plan Section (V2)” of the standards specified in § 170.205(a)(4); or in accordance with the “Assessment Section (V2)” and “Plan of Treatment Section (V2)” of the standards specified in § 170.205(a)(4).

(ii) Goals. In accordance with the “Goals Section” of the standards specified in § 170.205(a)(4).

(iii) Health concerns. In accordance with the “Health Concerns Section” of the standards specified in § 170.205(a)(4).

(iv) Unique device identifier(s) for a patient's implantable device(s). In accordance with the “Product Instance” in the “Procedure Activity Procedure Section” of the standards specified in § 170.205(a)(4).

(B) Respond to requests for patient data associated with a specific date as well as requests for patient data within a specified date range.

(ii) Documentation—(A) The API must include accompanying documentation that contains, at a minimum:

(1) API syntax, function names, required and optional parameters and their data types, return variables and their types/structures, exceptions and exception handling methods and their returns.

(2) The software components and configurations that would be necessary for an application to implement in order to be able to successfully interact with the API and process its response(s).

(B) The documentation used to meet paragraph (g)(9)(ii)(A) of this section must be available via a publicly accessible hyperlink.

(10) Standardized API for patient and population services. The following technical outcomes and conditions must be met through the demonstration of application programming interface technology.

(i) Data response. (A) Respond to requests for a single patient's data according to the standards and implementation specifications adopted in § 170.215(a) and in § 170.215(b)(1), including the mandatory capabilities described in “US Core Server CapabilityStatement,” for each of the data included in the standards adopted in § 170.213. All data elements indicated as “mandatory” and “must support” by the standards and implementation specifications must be supported.

(B) Respond to requests for multiple patients' data as a group according to the standards and implementation specifications adopted in § 170.215(a), (b)(1), and (d), for each of the data included in the standards adopted in § 170.213. All data elements indicated as “mandatory” and “must support” by the standards and implementation specifications must be supported.

(ii) Supported search operations. (A) Respond to search requests for a single patient's data consistent with the search criteria included in the implementation specifications adopted in § 170.215(b)(1), specifically the mandatory capabilities described in “US Core Server CapabilityStatement.”

(B) Respond to search requests for multiple patients' data consistent with the search criteria included in the implementation specification adopted in § 170.215(d).

(iii) Application registration. Enable an application to register with the Health IT Module's “authorization server.”

(iv) Secure connection. (A) Establish a secure and trusted connection with an application that requests data for patient and user scopes in accordance with the implementation specifications adopted in § 170.215(b)(1) and (c).

(B) Establish a secure and trusted connection with an application that requests data for system scopes in accordance with the implementation specification adopted in § 170.215(d).

(v) Authentication and authorization—(A) Authentication and authorization for patient and user scopes—(1) First time connections. (i) Authentication and authorization must occur during the process of granting access to patient data in accordance with the implementation specification adopted in § 170.215(c) and standard adopted in § 170.215(e).

(ii) A Health IT Module's authorization server must issue a refresh token valid for a period of no less than three months to applications using the “confidential app” profile according to an implementation specification adopted in § 170.215(c).

(iii) A Health IT Module's authorization server must issue a refresh token for a period of no less than three months to native applications capable of securing a refresh token

(2) Subsequent connections. (i) Access must be granted to patient data in accordance with the implementation specification adopted in § 170.215(c) without requiring re-authorization and re-authentication when a valid refresh token is supplied by the application.

(ii) A Health IT Module's authorization server must issue a refresh token valid for a new period of no less than three months to applications using the “confidential app” profile according to an implementation specification adopted in § 170.215(c).

(B) Authentication and authorization for system scopes. Authentication and authorization must occur during the process of granting an application access to patient data in accordance with the “SMART Backend Services: Authorization Guide” section of the implementation specification adopted in § 170.215(d) and the application must be issued a valid access token.

(vi) Patient authorization revocation. A Health IT Module's authorization server must be able to revoke and must revoke an authorized application's access at a patient's direction within 1 hour of the request.

(vii) Token introspection. A Health IT Module's authorization server must be able to receive and validate tokens it has issued in accordance with an implementation specification in § 170.215(c).

(viii) Documentation. (A) The API(s) must include complete accompanying documentation that contains, at a minimum:

(1) API syntax, function names, required and optional parameters supported and their data types, return variables and their types/structures, exceptions and exception handling methods and their returns.

(2) The software components and configurations that would be necessary for an application to implement in order to be able to successfully interact with the API and process its response(s).

(3) All applicable technical requirements and attributes necessary for an application to be registered with a Health IT Module's authorization server.

(B) The documentation used to meet paragraph (g)(10)(viii)(A) of this section must be available via a publicly accessible hyperlink without any preconditions or additional steps.

(11)-(30) [Reserved]

(31) Provider prior authorization API—coverage requirements discovery. Support the following capabilities to enable users to request and receive coverage requirements.

(i) Coverage discovery. Support the capability to initiate and exchange information as a “CRD Client” to enable the identification of coverage requirements according to at least one of the versions of the implementation specification adopted in § 170.215(j)(1), including the following:

(A) Registration. Support registration capabilities applicable to “CRD Clients”.

(B) CDS Hooks support. Support the capabilities in paragraph (j)(20) of this section to enable workflow triggers to call decision support services including support for the “order-sign” CDS Hook.

(C) CRD Client capabilities. Support all requirements and required capabilities applicable to a “CRD Client.”

(ii) Documentation. Supported API server capabilities of “CRD Clients” from an implementation specification adopted in § 170.215(j)(1) must include complete accompanying technical documentation.

(32) Provider prior authorization API—documentation templates and rules. Support the capability for users to request and populate prior authorization documentation using templates and rules as a “Full DTR EHR” according to at least one of the versions of the implementation specification adopted in § 170.215(j)(2), including:

(i) Registration. Support registration capabilities applicable to a “Full DTR EHR.”

(ii) Authentication and authorization. Support system authentication and authorization as a client in accordance with the “Backend Services” section of at least one of the versions of the implementation specification adopted in § 170.215(c).

(iii) Full DTR EHR capabilities. Support all requirements and required capabilities applicable to a “Full DTR EHR.”

(33) Provider prior authorization API—prior authorization support. Support the following capabilities to enable users to submit prior authorization requests.

(i) Prior authorization submission. Support submitting a prior authorization request as a client in accordance with at least one of the versions of the implementation specification adopted in § 170.215(j)(3) including the following:

(A) Registration. Support registration capabilities applicable to a client system.

(B) Authentication and authorization. Support system authentication and authorization as a client in accordance with the “Backend Services” section of at least one of the versions of the implementation specification adopted in § 170.215(c).

(C) Prior authorization transactions. Support the ability to submit a prior authorization request as a client system including the following:

(1) Support the capabilities in the “EHR PAS Capabilities” Capability Statement.

(2) Support the ability to consume and process a “ClaimResponse.”

(3) Support subscriptions as a client according to the requirements in paragraph (j)(21) of this section in order to support “pended authorization responses.”

(ii) Documentation. Supported subscriptions client endpoint capabilities for the “REST-Hook” channel from implementation specifications adopted in § 170.215(j)(3) must include complete accompanying technical documentation.

(h) Transport methods and other protocols—(1) Direct Project—(i) Applicability Statement for Secure Health Transport. Able to send and receive health information in accordance with the standard specified in § 170.202(a)(2), including formatted only as a “wrapped” message.

(ii) Delivery Notification in Direct. Able to send and receive health information in accordance with the standard specified in § 170.202(e)(1).

(2) Direct Project, Edge Protocol, and XDR/XDM. (i) Able to send and receive health information in accordance with:

(A) The standard specified in § 170.202(a)(2), including formatted only as a “wrapped” message;

(B) The standard specified in § 170.202(b), including support for both limited and full XDS metadata profiles; and

(C) Both edge protocol methods specified by the standard in § 170.202(d).

(ii) Delivery Notification in Direct. Able to send and receive health information in accordance with the standard specified in § 170.202(e)(1).

(i) [Reserved]

(j) Modular API capabilities. The following technical outcomes and conditions must be met through the demonstration of application programming interface technology.

(1)-(19) [Reserved]

(20) Workflow triggers for decision support interventions—clients. Support the requirements applicable to a “CDS Client” according to at least one of the implementation specifications in § 170.215(f) including the following:

(i) Registration. Support registration capabilities applicable to “CDS Clients”.

(ii) Authentication and authorization. Support authentication and authorization, including the following:

(A) Support for client authentication using JSON web tokens (JWT).

(B) Support for data access authorization of a “CDS Service” using access tokens.

(iii) Workflow triggers. Support the execution of decision support workflow triggers.

(iv) Information exchange. Send a decision support request to a “CDS Service,” including support for the following:

(A) Resource access via API. Support access to HL7 FHIR Resources via a RESTful API to support decision support intervention workflows according to the “FHIR Resource Access” section.

(B) Receive and display response. Support the receipt of a decision support response, including support for the display of the contents of a decision support response to an end-user.

(21) Subscriptions—client. Support subscriptions as a client according to at least one of the implementation specifications in § 170.215(h), including the following:

(i) Support the requirements in section “Topic-Based Subscriptions—FHIR R4.”

(ii) Support the “R4/B Topic-Based Subscription” profile.

(iii) Support the accompanying client capabilities for the minimum requirements included in the “R4 Topic-Based Subscription Server Capability Statement,” including support for “create,” “update,” and “delete” interactions for Subscription Resources.

(iv) Receive subscription notifications according to section “Topic-Based Subscriptions—FHIR R4,” including support for consuming notifications via the “REST-Hook” channel as specified in the “Channels” section.

[80 FR 62747, Oct. 16, 2015, as amended at 80 FR 76871, Dec. 11, 2015; 85 FR 25941, May 1, 2020; 85 FR 47099, Aug. 4, 2020; 85 FR 70083, Nov. 4, 2020; 85 FR 78236, Dec. 4, 2020; 89 FR 1429, Jan. 9, 2024; 89 FR 8548, Feb. 8, 2024; 89 FR 16470, Mar. 7, 2024; 89 FR 101809, Dec. 16, 2024; 90 FR 37210, Aug. 4, 2025]

§ 170.400 Basis and scope.

This subpart implements section 3001(c)(5)(D) of the Public Health Service Act by setting forth certain Conditions and Maintenance of Certification requirements for health IT developers participating in the ONC Health IT Certification Program.

§ 170.401 Information blocking.

(a) Condition of Certification requirement. A health IT developer must not take any action that constitutes information blocking as defined in 42 U.S.C. 300jj-52 and § 171.103 on or after April 5, 2021.

(b) [Reserved]

[85 FR 25945, May 1, 2020, as amended at 85 FR 70084, Nov. 4, 2020]

§ 170.402 Assurances.

Link to an amendment published at 91 FR 67996, Oct. 28, 2026.

(a) Condition of Certification requirement. (1) A health IT developer must provide assurances satisfactory to the Secretary that the health IT developer will not take any action that constitutes information blocking as defined in 42 U.S.C. 300jj-52 and § 171.103 of this chapter on and after April 5, 2021, unless for legitimate purposes as specified by the Secretary; or any other action that may inhibit the appropriate exchange, access, and use of electronic health information.

(2) A health IT developer must ensure that its health IT certified under the ONC Health IT Certification Program conforms to the full scope of the certification criteria.

(3) A health IT developer must not take any action that could interfere with a user's ability to access or use certified capabilities for any purpose within the full scope of the technology's certification.

(4) A health IT developer of a certified Health IT Module that is part of a health IT product which electronically stores EHI must certify to the certification criterion in § 170.315(b)(10).

(5) A health IT developer must not inhibit its customer's timely access to interoperable health IT certified under the Program.

(b) Maintenance of Certification requirements. (1) A health IT developer must retain all records and information necessary to demonstrate initial and ongoing compliance with the requirements of the ONC Health IT Certification Program for:

(i) A period of 10 years beginning from the date a developer's Health IT Module(s) is first certified under the Program; or

(ii) If for a shorter period of time, a period of 3 years from the effective date that removes all of the certification criteria to which the developer's health IT is certified from the Code of Federal Regulations.

(2)(i) By December 31, 2023, a health IT developer that must comply with the requirements of paragraph (a)(4) of this section must provide all of its customers of certified health IT with the health IT certified to the certification criterion in § 170.315(b)(10).

(ii) On and after December 31, 2023, a health IT developer that must comply with the requirements of paragraph (a)(4) of this section must provide all of its customers of certified health IT with the health IT certified to the certification criterion in § 170.315(b)(10).

(3)(i) Update. A health IT developer must update a Health IT Module, once certified to a certification criterion adopted in § 170.315, to all applicable revised certification criteria, including the most recently adopted capabilities and standards included in the revised certification criterion.

(ii) Provide. A health IT developer must provide all Health IT Modules certified to a revised certification criterion, including the most recently adopted capabilities and standards included in the revised certification criterion, to its customers of such certified health IT.

(iii) Timeliness. A health IT developer must complete the actions specified in paragraphs (b)(3)(i) and (ii) of this section:

(A) Consistent with the timeframes specified in part 170; or

(B) If the developer obtains new customers of health IT certified to the revised criterion after the effective date of the final rule adopting the revised criterion or criteria, then the health IT developer must provide the health IT certified to the revised criterion to such customers within whichever of the following timeframes that expires last:

(1) The timeframe provided in paragraph (b)(3)(iii)(A) of this section; or

(2) No later than 12 months after the purchasing or licensing relationship has been established between the health IT developer and the new customer for the health IT certified to the revised criterion.

(4) For developers of Health IT Modules certified to § 170.315(b)(11), starting January 1, 2025, and on an ongoing basis thereafter, review and update as necessary source attribute information in § 170.315(b)(11)(iv)(A) and (B), intervention risk management practices described in § 170.315(b)(11)(vi), and summary information provided through § 170.523(f)(1)(xxi).

[85 FR 25945, May 1, 2020, as amended at 85 FR 70084, Nov. 4, 2020; 85 FR 70084, Nov. 4, 2020; 89 FR 1433, Jan. 9, 2024]

§ 170.403 Communications.

(a) Condition of Certification requirements. (1) A health IT developer may not prohibit or restrict any communication regarding—

(i) The usability of its health IT;

(ii) The interoperability of its health IT;

(iii) The security of its health IT;

(iv) Relevant information regarding users' experiences when using its health IT;

(v) The business practices of developers of health IT related to exchanging electronic health information; and

(vi) The manner in which a user of the health IT has used such technology.

(2) A health IT developer must not engage in any practice that prohibits or restricts a communication regarding the subject matters enumerated in paragraph (a)(1) of this section, unless the practice is specifically permitted by this paragraph and complies with all applicable requirements of this paragraph.

(i) Unqualified protection for certain communications. A health IT developer must not prohibit or restrict any person or entity from communicating any information whatsoever (including proprietary information, confidential information, and intellectual property) when the communication is about one or more of the subject matters enumerated in paragraph (a)(1) of this section and is made for any of the following purposes:

(A) Making a disclosure required by law;

(B) Communicating information about adverse events, hazards, and other unsafe conditions to government agencies, health care accreditation organizations, and patient safety organizations;

(C) Communicating information about cybersecurity threats and incidents to government agencies;

(D) Communicating information about information blocking and other unlawful practices to government agencies; or

(E) Communicating information about a health IT developer's failure to comply with a Condition of Certification requirement, or with any other requirement of this part, to ONC or an ONC-ACB.

(ii) Permitted prohibitions and restrictions. For communications about one or more of the subject matters enumerated in paragraph (a)(1) of this section that is not entitled to unqualified protection under paragraph (a)(2)(i) of this section, a health IT developer may prohibit or restrict communications only as expressly permitted by paragraphs (a)(2)(ii)(A) through (E) of this section.

(A) Developer employees and contractors. (1) A health IT developer may prohibit or restrict the communications of the developer's employees or contractors.

(2) A self-developer must not prohibit or restrict communications of users of their health IT who are also employees or contractors.

(B) Non-user-facing aspects of health IT. A health IT developer may prohibit or restrict communications that disclose information about non-user-facing aspects of the developer's health IT.

(C) Intellectual property. A health IT developer may prohibit or restrict communications that involve the use or disclosure of intellectual property existing in the developer's health IT (including third-party intellectual property), provided that any prohibition or restriction imposed by a developer must be no broader than necessary to protect the developer's legitimate intellectual property interests and consistent with all other requirements of paragraph (a)(2)(ii) of this section. A restriction or prohibition is deemed broader than necessary and inconsistent with the requirements of paragraph (a)(2)(ii) of this section if it would restrict or preclude a public display of a portion of a work subject to copyright protection (without regard to whether the copyright is registered) that would reasonably constitute a “fair use” of that work.

(D) Screenshots and video. A health IT developer may require persons who communicate screenshots or video to—

(1) Not alter the screenshots or video, except to annotate the screenshots or video or resize the screenshots or video;

(2) Limit the sharing of screenshots to the relevant number of screenshots needed to communicate about the health IT regarding one or more of the six subject areas in paragraph (a)(1) of this section; and

(3) Limit the sharing of video to:

(i) The relevant amount of video needed to communicate about the health IT regarding one or more of the six subject areas in paragraph (a)(1) of this section; and

(ii) Only videos that address temporal matters that cannot be communicated through screenshots or other forms of communication.

(E) Pre-market testing and development. A health IT developer may prohibit or restrict communications that disclose information or knowledge solely acquired in the course of participating in pre-market product development and testing activities carried out for the benefit of the developer or for the joint benefit of the developer and communicator. A developer must not, once the subject health IT is released or marketed for purposes other than product development and testing, and subject to the permitted prohibitions and restrictions described in paragraph (a)(2)(ii) of this section, prohibit or restrict communications about matters enumerated in paragraph (a)(1) of this section.

(b) Maintenance of Certification requirements—(1) Notice. Health IT developers must issue a written notice to all customers and those with which it has contracts or agreements containing provisions that contravene paragraph (a) of this section annually, beginning in calendar year 2021, until paragraph (b)(2)(ii) of this section is fulfilled, stating that any communication or contract provision that contravenes paragraph (a) of this section will not be enforced by the health IT developer.

(2) Contracts and agreements. (i) A health IT developer must not establish, renew, or enforce any contract or agreement that contravenes paragraph (a) of this section.

(ii) If a health IT developer has a contract or agreement in existence as of June 30, 2020, that contravenes paragraph (a) of this section, then the developer must amend the contract or agreement to remove or void the contractual provision that contravenes paragraph (a) of this section whenever the contract is next modified for other reasons or renewed.

(c) Communication, defined. “Communication” as used in this section means any communication, irrespective of the form or medium. The term includes visual communications, such as screenshots and video.

[85 FR 25945, May 1, 2020, as amended at 85 FR 43711, July 20, 2020; 85 FR 70084, Nov. 4, 2020]

§ 170.404 Application programming interfaces.

Link to an amendment published at 91 FR 67996, Oct. 28, 2026.

The following Condition and Maintenance of Certification requirements apply to developers of Health IT Modules certified to any of the certification criteria adopted in § 170.315(g)(7) through (10), and (31) through (g)(33) unless otherwise specified in this section.

(a) Condition of certification requirements—(1) General. A Certified API Developer must publish APIs and allow electronic health information from such technology to be accessed, exchanged, and used without special effort through the use of APIs or successor technology or standards, as provided for under applicable law, including providing access to all data elements of a patient's electronic health record to the extent permissible under applicable privacy laws.

(2) Transparency conditions—(i) Complete business and technical documentation. A Certified API Developer must publish complete business and technical documentation, including the documentation described in paragraph (a)(2)(ii) of this section, via a publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps.

(ii) Terms and conditions—(A) Material information. A Certified API Developer must publish all terms and conditions for its certified API technology, including any fees, restrictions, limitations, obligations, registration process requirements, or other similar requirements that would be:

(1) Needed to develop software applications to interact with the certified API technology;

(2) Needed to distribute, deploy, and enable the use of software applications in production environments that use the certified API technology;

(3) Needed to use software applications, including to access, exchange, and use electronic health information by means of the certified API technology;

(4) Needed to use any electronic health information obtained by means of the certified API technology;

(5) Used to verify the authenticity of API Users; and

(6) Used to register software applications.

(B) API fees. Any and all fees charged by a Certified API Developer for the use of its certified API technology must be described in detailed, plain language. The description of the fees must include all material information, including but not limited to:

(1) The persons or classes of persons to whom the fee applies;

(2) The circumstances in which the fee applies; and

(3) The amount of the fee, which for variable fees must include the specific variable(s) and methodology(ies) that will be used to calculate the fee.

(3) Fees conditions—(i) General conditions—(A) All fees. All fees related to certified API technology not otherwise permitted by this section are prohibited from being imposed by a Certified API Developer. The permitted fees in paragraphs (a)(3)(ii) and (iv) of this section may include fees that result in a reasonable profit margin in accordance with § 171.302.

(B) Permitted fees requirements. For all permitted fees, a Certified API Developer must:

(1) Ensure that such fees are based on objective and verifiable criteria that are uniformly applied to all similarly situated API Information Sources and API Users;

(2) Ensure that such fees imposed on API Information Sources are reasonably related to the Certified API Developer's costs to supply certified API technology to, and if applicable, support certified API technology for, API Information Sources;

(3) Ensure that such fees to supply and, if applicable, support certified API technology are reasonably allocated among all similarly situated API Information Sources; and

(4) Ensure that such fees are not based on whether API Information Sources or API Users are competitors, potential competitors, or will be using the certified API technology in a way that facilitates competition with the Certified API Developer.

(C) Prohibited fees. A Certified API Developer is prohibited from charging fees for the following:

(1) Costs associated with intangible assets other than actual development or acquisition costs of such assets;

(2) Opportunity costs unrelated to the access, exchange, or use of electronic health information; and

(3) The permitted fees in this section cannot include any costs that led to the creation of intellectual property if the actor charged a royalty for that intellectual property pursuant to § 171.303 and that royalty included the development costs for the creation of the intellectual property.

(D) Record-keeping requirements. A Certified API Developer must keep for inspection detailed records of any fees charged with respect to the certified API technology, the methodology(ies) used to calculate such fees, and the specific costs to which such fees are attributed.

(ii) Permitted fee—development, deployment, and upgrades. A Certified API Developer is permitted to charge fees to an API Information Source to recover the costs reasonably incurred by the Certified API Developer to develop, deploy, and upgrade certified API technology.

(iii) Permitted fee—recovering API usage costs. A Certified API Developer is permitted to charge fees to an API Information Source related to the use of certified API technology. The fees must be limited to the recovery of incremental costs reasonably incurred by the Certified API Developer when it hosts certified API technology on behalf of the API Information Source.

(iv) Permitted fee—value-added services. A Certified API Developer is permitted to charge fees to an API User for value-added services related to certified API technology, so long as such services are not necessary to efficiently and effectively develop and deploy production-ready software that interacts with certified API technology.

(4) Openness and pro-competitive conditions; general condition. A Certified API Developer must grant an API Information Source the independent ability to permit an API User to interact with the certified API technology deployed by the API Information Source.

(i) Non-discrimination. (A) A Certified API Developer must provide certified API technology to an API Information Source on terms that are no less favorable than it provides to itself and its own customers, suppliers, partners, and other persons with whom it has a business relationship.

(B) The terms on which a Certified API Developer provides certified API technology must be based on objective and verifiable criteria that are uniformly applied to all substantially similar or similarly situated classes of persons and requests.

(C) A Certified API Developer must not offer different terms or services based on:

(1) Whether a competitive relationship exists or would be created;

(2) The revenue or other value that another party may receive from using the API technology.

(ii) Rights to access and use certified API technology—(A) Rights that must be granted. A Certified API Developer must have and, upon request, must grant to API Information Sources and API Users all rights that may be reasonably necessary to:

(1) Access and use the Certified API Developer's certified API technology in a production environment;

(2) Develop products and services that are designed to interact with the Certified API Developer's certified API technology; and

(3) Market, offer, and distribute products and services associated with the Certified API Developer's certified API technology.

(B) Prohibited conduct. A Certified API Developer is prohibited from conditioning the receipt of the rights described in paragraph (a)(4)(ii)(A) of this section on:

(1) Receiving a fee, including but not limited to a license fee, royalty, or revenue-sharing arrangement;

(2) Agreeing to not compete with the Certified API Developer in any product, service, or market;

(3) Agreeing to deal exclusively with the Certified API Developer in any product, service, or market;

(4) Obtaining additional licenses, products, or services that are not related to or can be unbundled from the certified API technology;

(5) Licensing, granting, assigning, or transferring any intellectual property to the Certified API Developer;

(6) Meeting any Certified API Developer-specific testing or certification requirements; and.

(7) Providing the Certified API Developer or its technology with reciprocal access to application data.

(iii) Service and support obligations. A Certified API Developer must provide all support and other services reasonably necessary to enable the effective development, deployment, and use of certified API technology by API Information Sources and API Users in production environments.

(A) Changes and updates to certified API technology. A Certified API Developer must make reasonable efforts to maintain the compatibility of its certified API technology and to otherwise avoid disrupting the use of certified API technology in production environments.

(B) Changes to terms and conditions. Except as exigent circumstances require, prior to making changes to its certified API technology or to the terms and conditions thereof, a Certified API Developer must provide notice and a reasonable opportunity for API Information Sources and API Users to update their applications to preserve compatibility with certified API technology and to comply with applicable terms and conditions.

(b) Maintenance of certification requirements—(1) Authenticity verification and registration for production use. The following apply to a Certified API Developer with a Health IT Module certified to one or more of § 170.315(g)(10), (31), and (33):

(i) Authenticity verification. A Certified API Developer is permitted to institute a process to verify the authenticity of API Users so long as such process is objective and the same for all API Users and completed within ten business days of receipt of an API User's request to register their software application for use with the Certified API Developer's Health IT Module certified to § 170.315(g)(10), (g)(31), and (g)(33).

(ii) Registration for production use. A Certified API Developer must register and enable all applications for production use within five business days of completing its verification of an API User's authenticity, pursuant to paragraph (b)(1)(i) of this section.

(2) Service base URL publication. For all Health IT Modules certified to § 170.315(g)(10), a Certified API Developer must publish, at no charge, the service base URLs and related organization details that can be used by patients to access their electronic health information, by December 31, 2024. This includes all customers regardless of whether the Health IT Modules certified to § 170.315(g)(10) are centrally managed by the Certified API Developer or locally deployed by an API Information Source. These service base URLs and organization details must conform to the following:

(i) Service base URLs must be publicly published in Endpoint resource format according to the standard adopted in § 170.215(a).

(ii) Organization details for each service base URL must be publicly published in Organization resource format according to the standard adopted in § 170.215(a). Each Organization resource must contain:

(A) A reference, in the Organization.endpoint element, to the Endpoint resources containing service base URLs managed by this organization.

(B) The organization's name, location, and facility identifier.

(iii) Endpoint and Organization resources must be:

(A) Collected into a Bundle resource formatted according to the standard adopted in § 170.215(a) for publication; and

(B) Reviewed quarterly and, as necessary, updated.

(3) Rollout of (g)(10)-certified APIs. A Certified API Developer with certified API technology previously certified to the certification criterion in § 170.315(g)(8) must provide all API Information Sources with such certified API technology deployed with certified API technology certified to the certification criterion in § 170.315(g)(10) by no later than December 31, 2022.

(4) Compliance for existing certified API technology. By no later than April 5, 2021, a Certified API Developer with Health IT Module(s) certified to the certification criteria in § 170.315(g)(7), (8), or (9) must comply with paragraph (a) of this section, including revisions to their existing business and technical API documentation and make such documentation available via a publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps.

(c) Definitions. The following definitions apply to this section:

API Information Source means an organization that deploys certified API technology created by a “Certified API Developer;”

API User means a person or entity that creates or uses software applications that interact with the “certified API technology” developed by a “Certified API Developer” and deployed by an “API Information Source;”

Certified API Developer means a health IT developer that creates “certified API technology.”

Certified API technology means the capabilities of Health IT Modules that are certified to any of the API-focused certification criteria adopted in § 170.315(g)(7) through (10), and (31) through (33).

[85 FR 25945, May 1, 2020, as amended at 85 FR 70084, Nov. 4, 2020; 89 FR 1433, Jan. 9, 2024; 90 FR 37211, Aug. 4, 2025]

§ 170.405 Real world testing.

Link to an amendment published at 91 FR 67996, Oct. 28, 2026.

(a) Condition of Certification requirement. A health IT developer with one or more Health IT Module(s) certified to any one or more of the ONC Certification Criteria for Health IT in § 170.315(b), (c)(1) through (3), (e)(1), (f), (g)(7) through (10), (g)(31) through (33), (h), and (j)(20) and (21) must successfully test the real world use of those Health IT Module(s) for interoperability (as defined in 42 U.S.C. 300jj(9) and § 170.102) in the type of setting in which such Health IT Module(s) would be/is marketed.

(b) Maintenance of Certification requirements—(1) Real world testing plan submission. A health IT developer with Health IT Module(s) certified to any one or more of the criteria referenced in paragraph (a) of this section must submit to its ONC-ACB an annual real world testing plan addressing each of those certified Health IT Modules by a date determined by the ONC-ACB that enables the ONC-ACB to publish a publicly available hyperlink to the plan on CHPL no later than December 15 of each calendar year, beginning in 2021.

(i) The plan must be approved by a health IT developer authorized representative capable of binding the health IT developer for execution of the plan and include the representative's contact information.

(ii) The plan must include all health IT certified to any one or more of the criteria referenced in paragraph (a) of this section as of August 31 of the year in which the plan is submitted, and address the real world testing to be conducted in the calendar year immediately following plan submission.

(iii) The plan must address the following for each of the certification criteria identified in paragraph (a) of this section that are included in each Health IT Module's scope of certification:

(A) The testing method(s)/methodology(ies) that will be used to demonstrate real world interoperability and conformance to the full scope of the certification criterion's requirements, including scenario- and use case-focused testing;

(B) The care setting(s) that will be tested for real world interoperability and an explanation for the health IT developer's choice of care setting(s) to test;

(C) For any standards and implementation specifications referenced by the criterion that the developer has chosen to certify to National Coordinator-approved newer versions pursuant to paragraph (b)(8) or (9) of this section, a description of how the developer will test and demonstrate conformance to all requirements of the criterion using all versions of the adopted standards to which each Health IT Module was certified as of August 31 of the year in which the real world testing plan is due.

(D) A schedule of key real world testing milestones;

(E) A description of the expected outcomes of real world testing;

(F) At least one measurement/metric associated with the real world testing; and

(G) A justification for the health IT developer's real world testing approach.

(2) Real world testing results reporting. (i) If in the course of conducting real world testing the developer discovers one or more non-conformities with the full scope of any certification criterion under the Program, the developer must report that non-conformity to the ONC-ACB within 30 days.

(ii) For real world testing activities conducted during the immediately preceding calendar year, a health IT developer must submit to its ONC-ACB an annual real world testing results report addressing each of its certified Health IT Modules that include certification criteria referenced in paragraph (a) of this section by a date determined by the ONC-ACB that enables the ONC-ACB to publish a publicly available hyperlink to the results report on CHPL no later than March 15 of each calendar year, beginning in 2023. For certified Health IT Modules included in paragraph (a) of this section that are updated using Inherited Certified Status after August 31 of the year in which the plan is submitted, a health IT developer must include the newer version of the certified Health IT Module(s) in its annual real world testing results report. The real world testing results must report the following for each of the certification criteria identified in paragraph (a) of this section that are included in the Health IT Module's scope of certification:

(A) The method(s) that was used to demonstrate real world interoperability;

(B) The care setting(s) that was tested for real world interoperability;

(C) The voluntary updates to standards and implementation specifications that the National Coordinator has approved through the Standards Version Advancement Process;

(D) A list of the key milestones met during real world testing;

(E) The outcomes of real world testing including a description of any challenges encountered during real world testing; and

(F) At least one measurement/metric associated with the real world testing.

(3)-(7) [Reserved]

(8) Standards Version Advancement Process—voluntary updates of certified health IT to newer versions of standards and implementation specifications. A health IT developer subject to this paragraph (b) is permitted to update Health IT Module(s) certified to any one or more of the certification criteria referenced in paragraph (a) of this section to a newer version of any adopted standard or implementation specification included in the criterion, provided that newer version is approved by the National Coordinator for use in certifications issued under the ONC Health IT Certification Program. A developer that pursues such updates to its certified Health IT Module(s) must:

(i) Provide advance notice to all affected customers and its ONC-ACB—

(A) Expressing its intent to update the certified Health IT Module(s) to the National Coordinator-approved advanced version of the standard implementation specification;

(B) The developer's expectations for how the update(s) will affect real world interoperability for the Health IT Module(s);

(C) Whether the developer intends to continue to support the certificate(s) for the existing certified Health IT Module(s) version(s) for some period of time and how long or if the existing certified Health IT Module(s) version(s) will be deprecated; and

(ii) Successfully demonstrate conformance with approved more recent versions of the standard(s) or implementation specification(s) included in each certification criterion under which the developer chooses to update its certified Health IT Module(s).

(iii) Maintain the updated certified Health IT Module(s) in full conformance with all applicable Program requirements.

(9) Standards Version Advancement Process—voluntary certification to newer versions of standards and implementation specifications. A Health IT developer is permitted to seek certification for its Health IT Module(s) to any one or more of the certification criteria referenced in paragraph (a) of this section using a newer version of any adopted standard(s) or implementation specification(s) included in the criterion without first obtaining certification to the version of that adopted standard or implementation specification that is incorporated by reference in § 170.299, provided that the newer version is approved by the National Coordinator for use in certifications issued under the ONC Health IT Certification Program. Developers may, for each standard and implementation specification included in each criterion, choose on an itemized basis whether to seek certification to the version incorporated by reference in § 170.299, or to one or more newer version(s) approved by the National Coordinator for use in Health IT Module certifications issued pursuant to section 3001(c)(5) of the Public Health Service Act, or to both.

(10) [Reserved]

[85 FR 25945, May 1, 2020, as amended at 85 FR 43711, July 20, 2020; 85 FR 70084, Nov. 4, 2020; 85 FR 78236, Dec. 4, 2020; 89 FR 1434, Jan. 9, 2024; 90 FR 37211, Aug. 4, 2025]

§ 170.406 Attestations.

Link to an amendment published at 91 FR 67997, Oct. 28, 2026.

(a) Condition of Certification requirement. A health IT developer, or its authorized representative that is capable of binding the health IT developer, must provide the Secretary an attestation of compliance with the following Conditions and Maintenance of Certification requirements:

(1) Section 170.401;

(2) Section 170.402, but only for § 170.402(a)(4) and (b)(2) if the health IT developer certified a Health IT Module(s) that is part of a health IT product which can store electronic health information;

(3) Section 170.403;

(4) Section 170.404 if the health IT developer has a Health IT Module(s) certified to any of the certification criteria adopted in § 170.315(g)(7) through (10); and such health IT developer must also ensure that health IT allows for health information to be exchanged, accessed, and used, in the manner described in § 170.404; and

(5) Section 170.405 if a health IT developer has a Health IT Module(s) certified to any one or more ONC Certification Criteria for Health IT in § 170.315(b), (c)(1) through (3), (e)(1), (f), (g)(7) through (10), and (h).

(b) Maintenance of Certification requirement. (1) A health IT developer, or its authorized representative that is capable of binding the health IT developer, must provide the attestation specified in paragraph (a) of this section semiannually for any Health IT Modules that have or have had an active certification at any time under the ONC Health IT Certification Program during the prior six months.

(2) [Reserved] [85 FR 25945, May 1, 2020, as amended at 89 FR 8549, Feb. 8, 2024]

§ 170.407 Insights Condition and Maintenance of Certification.

Link to an amendment published at 91 FR 67997, Oct. 28, 2026.

(a) Condition of Certification—(1) Measure responses. A health IT developer must submit (to the independent entity designated by the Secretary) for each reporting period pursuant to paragraph (b) of this section:

(i) Responses for the measures specified in this section, which must include:

(A) Data aggregated at the product level (across versions);

(B) Documentation related to the data sources and methodology used to generate measures; and

(C) Percentage of total customers (e.g., hospital sites, individual clinician users) represented in provided data; or

(ii) A response (attestation) that it does not:

(A) Meet the minimum reporting qualifications requirement in paragraph (a)(2) of this section; or

(B) Have health IT certified to the certification criteria specified in each measure in paragraphs (a)(3)(i) through (vii) of this section; or

(C) Have any users using the certified health IT specified in each measure in paragraphs (a)(3)(i) through (vii) of this section during the reporting period.

(2) Minimum reporting qualifications requirement. At least 50 hospital sites or 500 individual clinician users across the developer's certified health IT.

(3) Measures—(i) Individuals' access to electronic health information through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(e)(1) or (g)(10) or both, then the health IT developer must submit responses for the number of unique individuals who access electronic health information (EHI) overall and by different methods of access through certified health IT.

(ii) Consolidated clinical document architecture (C-CDA) problems, medications, and allergies reconciliation and incorporation through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(b)(2), then the health IT developer must submit responses for:

(A) Encounters;

(B) Unique patients with an encounter;

(C) C-CDA documents obtained (unique and overall); and

(D) C-CDA documents reconciled and incorporated both through manual and automated processes.

(iii) Applications supported through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(g)(10), then the health IT developer must submit responses on how their certified health IT is supporting the application ecosystem, by providing the following information for applications that are connected to their certified health IT including:

(A) Application Name(s);

(B) Application Developer Name(s);

(C) Intended Purpose(s) of Application;

(D) Intended Application User(s); and

(E) Application Status.

(iv) Use of FHIR in apps through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(g)(10), then the health IT developer must submit responses on the number of requests made to distinct certified health IT deployments that returned FHIR resources, number of distinct certified health IT deployments active at any time, the number of distinct deployments active at any time that returned FHIR resources in response to API calls from apps connected to certified health IT, including stratifying responses by the following:

(A) User type;

(B) FHIR resource; and

(C) US Core Implementation Guide version.

(v) Use of FHIR bulk data access through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(g)(10), then the health IT developer must submit responses for the total number of FHIR bulk data access requests completed through the certified health IT, and the number of distinct deployments of the certified health IT active at any time overall, and by whether at least one bulk data download request was completed.

(vi) Immunization administrations electronically submitted to immunization information systems through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(f)(1), then the health IT developer must submit responses for the use of certified health IT to electronically send immunizations administered to immunization information systems (IIS), including stratifying responses based on the following subgroups:

(A) IIS; and

(B) Age group.

(vii) Immunization history and forecasts through certified health IT. If a health IT developer has a Health IT Module certified to § 170.315(f)(1), then the health IT developer must submit responses for the use of certified health IT to query immunization history and forecast information from immunization information systems (IIS), including stratifying responses based on the following subgroup:

(A) IIS.

(B) [Reserved]

(b) Maintenance of Certification. (1) A health IT developer must provide responses to the Insights Condition of Certification specified in paragraph (a) of this section annually for any Health IT Module that has or has had an active certification at any time under the ONC Health IT Certification Program during the prior six months:

(i) A health IT developer must provide responses for measures specified in:

(A) Paragraphs (a)(3)(i), (iii), (iv)(A) and (B), and (vi) of this section beginning July 2027;

(B) Paragraphs (a)(3)(ii)(A) through (C), (iv)(C), (v), (vi)(A) and (B), and (vii) of this section beginning July 2028; and

(C) Paragraph (a)(3)(ii)(D), (vii)(A) of this section beginning July 2029.

(ii) [Reserved]

(2) [Reserved]

[89 FR 1434, Jan. 9, 2024; 89 FR 16470, Mar. 7, 2024]

§ 170.500 Basis and scope.

This subpart implements section 3001(c)(5) of the Public Health Service Act and sets forth the rules and procedures related to the ONC Health IT Certification Program for health information technology (health IT) administered by the National Coordinator for Health Information Technology.

[76 FR 1325, Dec. 7, 2011, as amended at 77 FR 54291, Sept. 4, 2012]

§ 170.501 Applicability.

(a) This subpart establishes the processes that applicants for ONC-ACB status must follow to be granted ONC-ACB status by the National Coordinator; the processes the National Coordinator will follow when assessing applicants and granting ONC-ACB status; the requirements that ONC-ACBs must follow to maintain ONC-ACB status; and the requirements of ONC-ACBs for certifying Health IT Module(s), and other types of health IT in accordance with the applicable certification criteria adopted by the Secretary in subpart C of this part.

(b) This subpart establishes the processes that applicants for ONC-ATL status must follow to be granted ONC-ATL status by the National Coordinator; the processes the National Coordinator will follow when assessing applicants and granting ONC-ATL status; the requirements that ONC-ATLs must follow to maintain ONC-ATL status; and the requirements of ONC-ATLs for testing Health IT Modules in accordance with the applicable certification criteria adopted by the Secretary in subpart C of this part.

(c) [Reserved]

(d) This subpart establishes the processes the National Coordinator will follow when exercising direct review of certified health IT and related requirements for ONC-ACBs, ONC-ATLs, and developers of health IT certified under the ONC Health IT Certification Program.

[81 FR 72464, Oct. 19, 2016, as amended at 85 FR 25950, May 1, 2020]

§ 170.502 Definitions.

For the purposes of this subpart:

Applicant means a single organization or a consortium of organizations that seeks to become an ONC-ACB or ONC-ATL by submitting an application to the National Coordinator for such status.

Deployment site means the physical location where a Health IT Module(s) or other type of health IT resides or is being or has been implemented.

Development site means the physical location where a Health IT Module(s) or other type of health IT was developed.

Gap certification means the certification of a previously certified Health IT Module(s) to:

(1) All applicable new and/or revised certification criteria adopted by the Secretary at subpart C of this part based on test results issued by a NVLAP-accredited testing laboratory under the ONC Health IT Certification Program or an ONC-ATL; and

(2) All other applicable certification criteria adopted by the Secretary at subpart C of this part based on the test results used to previously certify the Health IT Module(s) under the ONC Health IT Certification Program.

ONC-Authorized Certification Body or ONC-ACB means an organization or a consortium of organizations that has applied to and been authorized by the National Coordinator pursuant to this subpart to perform the certification of Health IT Module(s), and/or other types of health IT under the ONC Health IT Certification Program.

ONC-Authorized Testing Lab or ONC-ATL means an organization or a consortium of organizations that has applied to and been authorized by the National Coordinator pursuant to this subpart to perform the testing of Health IT Modules to certification criteria adopted by the Secretary at subpart C of this part.

Providing or provide an updated certification means the action taken by an ONC-ACB to ensure that the developer of a previously certified Health IT Module(s) shall update the information required by § 170.523(k)(1)(i), after the ONC-ACB has verified that the certification criterion or criteria to which the Health IT Module(s) was previously certified have not been revised and that no new certification criteria are applicable to the Health IT Module(s).

Remote certification means the use of methods, including the use of web-based tools or secured electronic transmissions, that do not require an ONC-ACB to be physically present at the development or deployment site to conduct certification.

[76 FR 1325, Dec. 7, 2011, as amended at 77 FR 54291, Sept. 4, 2012; 81 FR 72464, Oct. 19, 2016; 85 FR 25950, May 1, 2020; 89 FR 101809, Dec. 16, 2024]

§§ 170.503-170.504 [Reserved]

§ 170.505 Correspondence.

(a) Correspondence and communication with ONC or the National Coordinator shall be conducted by email, unless otherwise necessary or specified.

(1) Consideration for providing notice beyond email, such as by regular, express, or certified mail, will be based on, but not limited to, whether: The party requests use of correspondence beyond email; the party has responded via email to our communications; we have sufficient information from the party to ensure appropriate delivery of any other method of notice; and the matter involves an alleged violation within ONC's purview under § 170.580 that indicates a serious violation under the ONC Health IT Certification Program with potential consequences of suspension, certification termination, or a certification ban.

(2) The official date of receipt of any email between ONC or the National Coordinator and an applicant for ONC-ACB status, an applicant for ONC-ATL status, an ONC-ACB, an ONC-ATL, health IT developer, or a party to any proceeding under this subpart is the date on which the email was sent.

(b) In circumstances where it is necessary for an applicant for ONC-ACB status, an applicant for ONC-ATL status, an ONC-ACB, an ONC-ATL, health IT developer, or a party to any proceeding under this subpart to correspond or communicate with ONC or the National Coordinator by regular, express, or certified mail, the official date of receipt for all parties will be the date of the delivery confirmation to the address on record.

[85 FR 25950, May 1, 2020]

§ 170.510 Authorization scope for ONC-ACB status.

Applicants for ONC-ACB status may seek authorization from the National Coordinator to perform the following types of certification:

(a) Health IT Module certification; and/or

(b) Certification of other types of health IT for which the Secretary has adopted certification criteria under subpart C of this part.

[76 FR 1325, Dec. 7, 2011, as amended at 81 FR 72464, Oct. 19, 2016; 85 FR 25950, May 1, 2020]

§ 170.511 Authorization scope for ONC-ATL status.

Applicants may seek authorization from the National Coordinator to perform the testing of Health IT Modules to a portion of a certification criterion, one certification criterion, or many or all certification criteria adopted by the Secretary under subpart C of this part.

[89 FR 101809, Dec. 16, 2024]

§ 170.520 Application.

(a) ONC-ACB application. Applicants must include the following information in an application for ONC-ACB status and submit it to the National Coordinator for the application to be considered complete.

(1) The type of authorization sought pursuant to § 170.510. For authorization to perform Health IT Module certification, applicants must indicate the specific type(s) of Health IT Module(s) they seek authorization to certify. If qualified, applicants will only be granted authorization to certify the type(s) of Health IT Module(s) for which they seek authorization.

(2) General identifying, information including:

(i) Name, address, city, state, zip code, and Web site of applicant; and

(ii) Designation of an authorized representative, including name, title, phone number, and email address of the person who will serve as the applicant's point of contact.

(3) Documentation that confirms that the applicant has been accredited to ISO/IEC 17065 (for availability, see § 170.599), with an appropriate scope, by any accreditation body that is a signatory to the Multilateral Recognition Arrangement (MLA) with the International Accreditation Forum (IAF).

(4) An agreement, properly executed by the applicant's authorized representative, that it will adhere to the Principles of Proper Conduct for ONC-ACBs.

(b) ONC-ATL application. Applicants must include the following information in an application for ONC-ATL status and submit it to the National Coordinator for the application to be considered complete.

(1) The authorization scope sought pursuant to § 170.511.

(2) General identifying, information including:

(i) Name, address, city, state, zip code, and Web site of applicant; and

(ii) Designation of an authorized representative, including name, title, phone number, and email address of the person who will serve as the applicant's point of contact.

(3) Documentation that confirms that the applicant has been accredited by NVLAP to the ONC Health IT Certification Program, including to ISO/IEC 17025 (incorporated by reference, see § 170.599).

(4) An agreement, properly executed by the applicant's authorized representative, that it will adhere to the Principles of Proper Conduct for ONC-ATLs.

[81 FR 72464, Oct. 19, 2016, as amended at 85 FR 25950, May 1, 2020]

§ 170.523 Principles of proper conduct for ONC-ACBs.

Link to an amendment published at 91 FR 67997, Oct. 28, 2026.

An ONC-ACB shall:

(a) Accreditation. Maintain its accreditation in good standing to ISO/IEC 17065 (incorporated by reference in § 170.599).

(b) Mandatory training. Attend all mandatory ONC training and program update sessions;

(c) Training program. Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to certify health IT;

(d) Reporting. Report to ONC within 15 days any changes that materially affect its:

(1) Legal, commercial, organizational, or ownership status;

(2) Organization and management including key certification personnel;

(3) Policies or procedures;

(4) Location;

(5) Personnel, facilities, working environment or other resources;

(6) ONC authorized representative (point of contact); or

(7) Other such matters that may otherwise materially affect its ability to certify health IT.

(e) Onsite observation. Allow ONC, or its authorized agent(s), to periodically observe on site (unannounced or scheduled), during normal business hours, any certifications performed to demonstrate compliance with the requirements of the ONC Health IT Certification Program;

(f) Certified product listing. Provide the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC), no less frequently than weekly, a current list of Health IT Modules that have been certified that includes, at a minimum:

(1) For the ONC Certification Criteria for Health IT:

(i) The Health IT Module developer name; product name; product version; developer Web site, physical address, email, phone number, and contact name;

(ii) The ONC-ACB Web site, physical address, email, phone number, and contact name, contact function/title;

(iii) The ATL Web site, physical address, email, phone number, and contact name, contact function/title;

(iv) Location and means by which the testing was conducted (e.g., remotely with health IT developer at its headquarters location);

(v) The date(s) the Health IT Module was tested;

(vi) The date the Health IT Module was certified;

(vii) The unique certification number or other specific product identification;

(viii) The certification criterion or criteria to which the Health IT Module has been certified, including the test procedure and test data versions used, test tool version used, and whether any test data was altered (i.e., a yes/no) and for what purpose;

(ix) The way in which each privacy and security criterion was addressed for the purposes of certification;

(x) The standard or mapping used to meet the quality management system certification criterion;

(xi) The standard(s) or lack thereof used to meet the accessibility-centered design certification criterion;

(xii) Where applicable, the hyperlink to access an application programming interface (API)'s documentation and terms of use;

(xiii) Where applicable, which certification criteria were gap certified;

(xiv) Where applicable, if a certification issued was a result of an inherited certified status request;

(xv) Where applicable, the clinical quality measures to which the Health IT Module has been certified;

(xvi) Where applicable, any additional software a Health IT Module relied upon to demonstrate its compliance with a certification criterion or criteria adopted by the Secretary;

(xvii) Where applicable, the standard(s) used to meet a certification criterion where more than one is permitted;

(xviii) Where applicable, any optional capabilities within a certification criterion to which the Health IT Module was tested and certified;

(xix) Where applicable, and for each applicable certification criterion, all of the information required to be submitted by Health IT Module developers to meet the safety-enhanced design certification criterion. Each user-centered design element required to be reported must be at a granular level (e.g., task success/failure));

(xx) A hyperlink to the disclosures required by § 170.523(k)(1) for the Health IT Module;

(xxi) Where applicable, summary information of the intervention risk management practices listed in § 170.315(b)(11)(vi) is submitted by the health IT developer via publicly accessible hyperlink that allows any person to access the summary information directly without any preconditions or additional steps.

(xxii) When applicable, for each instance in which a Health IT Module failed to conform to its certification and for which corrective action was instituted under § 170.556 (provided no provider or practice site is identified):

(A) The specific certification requirements to which the technology failed to conform, as determined by the ONC-ACB;

(B) A summary of the deficiency or deficiencies identified by the ONC-ACB as the basis for its determination of non-conformity;

(C) When available, the health IT developer's explanation of the deficiency or deficiencies;

(D) The dates surveillance was initiated and completed;

(E) The results of randomized surveillance, including pass rate for each criterion in instances where the Health IT Module is evaluated at more than one location;

(F) The number of sites that were used in randomized surveillance;

(G) The date of the ONC-ACB's determination of non-conformity;

(H) The date on which the ONC-ACB approved a corrective action plan;

(I) The date corrective action began (effective date of approved corrective action plan);

(J) The date by which corrective action must be completed (as specified by the approved corrective action plan);

(K) The date corrective action was completed; and

(L) A description of the resolution of the non-conformity or non-conformities.

(2) [Reserved]

(g) Records retention. (1) Retain all records related to the certification of Health IT Modules to the ONC Certification Criteria for Health IT beginning with the codification of those certification criteria in the Code of Federal Regulations through a minimum of 3 years after the end of calendar year that included the effective date of the removal of those certification criteria from the Code of Federal Regulations; and

(2) Make the records available to HHS upon request during the retention period described in paragraph (g)(1) of this section;

(h) Certification decision. Only certify Health IT Modules that have been:

(1) Tested, using test tools and test procedures approved by the National Coordinator, by an:

(i) ONC-ATL;

(ii) ONC-ATL, National Voluntary Laboratory Accreditation Program-accredited testing laboratory under the ONC Health IT Certification Program, and/or an ONC-ATCB for the purposes of performing gap certification; or

(2) Evaluated by it for compliance with a conformance method approved by the National Coordinator.

(i) Surveillance. Conduct surveillance of certified health IT in accordance with its accreditation, § 170.556, and the following requirements:

(1) Submit an annual surveillance plan to the National Coordinator.

(2) Report, at a minimum, on a quarterly basis to the National Coordinator the results of its surveillance, including surveillance results that identify:

(i) The names of health IT developers;

(ii) Names of products and versions;

(iii) Certification criteria and ONC Health IT Certification Program requirements surveilled;

(iv) The type of surveillance (i.e., reactive or randomized);

(v) The dates surveillance was initiated and completed; and

(vi) As applicable, the number of sites that were used in randomized surveillance.

(3) Annually submit a summative report of surveillance results to the National Coordinator.

(j) Refunds. Promptly refund any and all fees received for:

(1) Requests for certification that are withdrawn while its operations are suspended by the National Coordinator;

(2) Certifications that will not be completed as a result of its conduct; and

(3) Previous certifications that it performed if its conduct necessitates the recertification of Health IT Module(s).

(k) Disclosures. Ensure adherence to the following requirements when issuing any certification and during surveillance of Health IT Modules the ONC-ACB has certified.

(1) Mandatory Disclosures. A health IT developer must conspicuously include the following on its website and in all marketing materials, communications statements, and other assertions related to the Health IT Module's certification:

(i) The disclaimer “This Health IT Module is compliant with the ONC Certification Criteria for Health IT and has been certified by an ONC-ACB in accordance with the applicable certification criteria adopted by the Secretary of Health and Human Services. This certification does not represent an endorsement by the U.S. Department of Health and Human Services.”

(ii) For a Health IT Module certified to the ONC Certification Criteria for Health IT, the information specified by paragraphs (f)(1)(i), (vi) through (viii), (xv), and (xvi) of this section as applicable for the specific Health IT Module.

(iii) In plain language, a detailed description of all known material information concerning additional types of costs or fees that a user may be required to pay to implement or use the Health IT Module's capabilities, whether to meet provisions of HHS programs requiring the use of certified health IT or to achieve any other use within the scope of the health IT's certification. The additional types of costs or fees required to be disclosed include but are not limited to costs or fees (whether fixed, recurring, transaction-based, or otherwise) imposed by a health IT developer (or any third party from whom the developer purchases, licenses, or obtains any technology, products, or services in connection with its certified health IT) to purchase, license, implement, maintain, upgrade, use, or otherwise enable and support the use of capabilities to which health IT is certified; or in connection with any data generated in the course of using any capability to which health IT is certified.

(iv) The types of information required to be disclosed under paragraph (k)(iii) of this section include but are not limited to:

(A) Additional types of costs or fees (whether fixed, recurring, transaction-based, or otherwise) imposed by a health IT developer (or any third-party from whom the developer purchases, licenses, or obtains any technology, products, or services in connection with its certified health IT) to purchase, license, implement, maintain, upgrade, use, or otherwise enable and support the use of capabilities to which health IT is certified; or in connection with any data generated in the course of using any capability to which health IT is certified.

(B)-(C) [Reserved]

(v) Health IT self-developers are excluded from the requirements of paragraph (k)(1)(iii) of this section.

(2)-(3) [Reserved]

(4) A certification issued to a Health IT Module based solely on the applicable certification criteria adopted by the ONC Health IT Certification Program must be separate and distinct from any other certification(s) based on other criteria or requirements.

(l) Certification and Design Mark. Display the ONC Certified health IT Certification and Design Mark on all certifications issued under the ONC Health IT Certification Program in a manner that complies with the Criteria and Terms of Use for the ONC Certified health IT Certification and Design Mark, and ensure that use of the mark by health IT developers whose products are certified under the ONC Health IT Certification Program is compliant with the Criteria and Terms of Use for the ONC Certified health IT Certification and Design Mark.

(m) Adaptations and updates. On a quarterly basis each calendar year, obtain a record of:

(1) All adaptations of certified Health IT Modules;

(2) All updates made to certified Health IT Modules affecting the capabilities in certification criteria to which the “safety-enhanced design” criteria apply;

(3) All uses cases for § 170.315(d)(13);

(4) All updates made to certified Health IT Modules in compliance with § 170.405(b)(3); and

(5) All updates to certified Health IT Modules and all certifications of Health IT Modules issued including voluntary use of newer standards versions per § 170.405(b)(8) or (9). Record of these updates may be obtained by aggregation of ONC-ACB documentation of certification activity.

(n) Complaints reporting. Submit a list of complaints received to the National Coordinator on a quarterly basis each calendar year that includes the number of complaints received, the nature/substance of each complaint, and the type of complainant for each complaint.

(o) Scope reduction. Be prohibited from reducing the scope of a Health IT Module's certification when it is under surveillance or under a corrective action plan.

(p) Real world testing. (1) Review and confirm that applicable health IT developers submit real world testing plans in accordance with § 170.405(b)(1).

(2) Review and confirm that applicable health IT developers submit real world testing results in accordance with § 170.405(b)(2).

(3) Submit real world testing plans by December 15 of each calendar year and results by March 15 of each calendar year to ONC for public availability.

(q) Attestations. Review and submit health IT developer Conditions and Maintenance of Certification requirements attestations made in accordance with § 170.406 to ONC for public availability.

(r) Test results from ONC-ATLs. Accept test results from any ONC-ATL that is:

(1) In good standing under the ONC Health IT Certification Program, and

(2) Compliant with its ISO/IEC 17025 accreditation requirements as required by 170.524(a).

(s) Information for direct review. Report to ONC, no later than a week after becoming aware of, any information that could inform whether ONC should exercise direct review under § 170.580(a).

(t) Health IT Module voluntary standards and implementation specifications updates notices. Ensure health IT developers opting to take advantage of the flexibility for voluntary updates of standards and implementation specifications in certified Health IT Modules per § 170.405(b)(8) provide timely advance written notice to the ONC-ACB and all affected customers.

(1) Maintain a record of the date of issuance and the content of developers' § 170.405(b)(8) notices; and

(2) Timely post content or make publicly accessible via the CHPL each § 170.405(b)(8) notice received, publicly on the CHPL attributed to the certified Health IT Module(s) to which it applies.

(u) Insights. Confirm that developers of certified health IT submit responses for Insights Conditions and Maintenance of Certification requirements in accordance with § 170.407.

[76 FR 1325, Dec. 7, 2011, as amended at 76 FR 72642, Nov. 25, 2011; 77 FR 54291, Sept. 4, 2012; 79 FR 54479, Sept. 11, 2014; 80 FR 62755, Oct. 16, 2015; 80 FR 76872, Dec. 11, 2015; 81 FR 72465, Oct. 19, 2016; 85 FR 25950, May 1, 2020; 85 FR 70084, Nov. 4, 2020; 89 FR 1435, Jan. 9, 2024; 89 FR 101809, Dec. 16, 2024]

§ 170.524 Principles of proper conduct for ONC-ATLs.

An ONC-ATL shall:

(a) Accreditation. Maintain its NVLAP accreditation for the ONC Health IT Certification Program, including accreditation to ISO/IEC 17025 (incorporated by reference, see § 170.599);

(b) Mandatory training. Attend all mandatory ONC training and program update sessions;

(c) Training program. Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test health IT;

(d) Reporting. Report to ONC within 15 days any changes that materially affect its:

(1) Legal, commercial, organizational, or ownership status;

(2) Organization and management including key testing personnel;

(3) Policies or procedures;

(4) Location;

(5) Personnel, facilities, working environment or other resources;

(6) ONC authorized representative (point of contact); or

(7) Other such matters that may otherwise materially affect its ability to test health IT.

(e) Onsite observation. Allow ONC, or its authorized agent(s), to periodically observe on site (unannounced or scheduled), during normal business hours, any testing performed pursuant to the ONC Health IT Certification Program;

(f) Records retention. (1) Retain all records related to the testing of Health IT Modules to the ONC Certification Criteria for Health IT beginning with the codification of those certification criteria in the Code of Federal Regulations through a minimum of three years after the end of calendar year that included the effective date of the removal of those certification criteria from the Code of Federal Regulations; and

(2) Make the records available to HHS upon request during the retention period described in paragraph (f)(1) of this section;

(g) Approved testing methods. Only test health IT using test tools and test procedures approved by the National Coordinator; and

(h) Refunds. Promptly refund any and all fees received for:

(1) Requests for testing that are withdrawn while its operations are suspended by the National Coordinator;

(2) Testing that will not be completed as a result of its conduct; and

(3) Previous testing that it performed if its conduct necessitates the retesting of Health IT Modules.

[81 FR 72465, Oct. 19, 2016, as amended at 85 FR 25951, May 1, 2020; 89 FR 1435, Jan. 9, 2024]

§ 170.525 Application submission.

(a) An applicant for ONC-ACB or ONC-ATL status must submit its application either electronically via email (or Web site submission if available), or by regular or express mail.

(b) An application for ONC-ACB or ONC-ATL status may be submitted to the National Coordinator at any time.

[81 FR 72465, Oct. 19, 2016]

§ 170.530 Review of application.

(a) Method of review and review timeframe. (1) Applications will be reviewed in the order they are received.

(2) The National Coordinator is permitted up to 30 days from receipt to review an application that is submitted for the first time.

(b) Application deficiencies. (1) If the National Coordinator identifies an area in an application that requires the applicant to clarify a statement or correct an error or omission, the National Coordinator may contact the applicant to make such clarification or correction without issuing a deficiency notice. If the National Coordinator has not received the requested information after five days, the National Coordinator may issue a deficiency notice to the applicant.

(2) If the National Coordinator determines that deficiencies in the application exist, the National Coordinator will issue a deficiency notice to the applicant and return the application. The deficiency notice will identify the areas of the application that require additional information or correction.

(c) Revised application. (1) An applicant is permitted to submit a revised application in response to a deficiency notice. An applicant may request from the National Coordinator an extension for good cause of the 15-day period provided in paragraph (c)(2) of this section to submit a revised application.

(2) In order for an applicant to continue to be considered for ONC-ACB or ONC-ATL status, the applicant's revised application must address the specified deficiencies and be received by the National Coordinator within 15 days of the applicant's receipt of the deficiency notice, unless the National Coordinator grants an applicant's request for an extension of the 15-day period based on a finding of good cause. If a good cause extension is granted, then the revised application must be received by the end of the extension period.

(3) The National Coordinator is permitted up to 15 days to review a revised application once it has been received and may request clarification of statements and the correction of errors or omissions in a revised application during this time period.

(4) If the National Coordinator determines that a revised application still contains deficiencies, the applicant will be issued a denial notice indicating that the applicant cannot reapply for ONC-ACB or ONC-ATL status for a period of six months from the date of the denial notice. An applicant may request reconsideration of this decision in accordance with § 170.535.

(d) Satisfactory application. (1) An application will be deemed satisfactory if it meets all the application requirements, as determined by the National Coordinator.

(2) The National Coordinator will notify the applicant's authorized representative of its satisfactory application and its successful achievement of ONC-ACB or ONC-ATL status.

(3) Once notified by the National Coordinator of its successful achievement of ONC-ACB or ONC-ATL status, the applicant may represent itself as an ONC-ACB or ONC-ATL (as applicable) and begin certifying or testing (as applicable) health information technology consistent with its authorization.

[76 FR 1325, Dec. 7, 2011, as amended at 81 FR 72465, Oct. 19, 2016]

§ 170.535 ONC-ACB and ONC-ATL application reconsideration.

(a) Basis for reconsideration request. An applicant may request that the National Coordinator reconsider a denial notice only if the applicant can demonstrate that clear, factual errors were made in the review of its application and that the errors' correction could lead to the applicant obtaining ONC-ACB or ONC-ATL status.

(b) Submission requirement. An applicant is required to submit, within 15 days of receipt of a denial notice, a written statement to the National Coordinator contesting the decision to deny its application and explaining with sufficient documentation what factual error(s) it believes can account for the denial. If the National Coordinator does not receive the applicant's reconsideration request within the specified timeframe, its reconsideration request may be rejected.

(c) Reconsideration request review. If the National Coordinator receives a timely reconsideration request, the National Coordinator is permitted up to 15 days from the date of receipt to review the information submitted by the applicant and issue a decision.

(d) Decision. (1) If the National Coordinator determines that clear, factual errors were made during the review of the application and that correction of the errors would remove all identified deficiencies, the applicant's authorized representative will be notified of the National Coordinator's determination and the applicant's successful achievement of ONC-ACB or ONC-ATL status.

(2) If, after reviewing an applicant's reconsideration request, the National Coordinator determines that the applicant did not identify factual errors or that the correction of the factual errors would not remove all identified deficiencies in the application, the National Coordinator may reject the applicant's reconsideration request.

(3) Final decision. A reconsideration decision issued by the National Coordinator is final and not subject to further review.

[76 FR 1325, Dec. 7, 2011, as amended at 81 FR 72466, Oct. 19, 2016]

§ 170.540 ONC-ACB and ONC-ATL status.

(a) Acknowledgement and publication. The National Coordinator will acknowledge and make publicly available the names of ONC-ACBs and ONC-ATLs, including the date each was authorized and the type(s) of certification or scope of testing, respectively, each has been authorized to perform.

(b) Representation. Each ONC-ACB or ONC-ATL must prominently and unambiguously identify the scope of its authorization on its Web site and in all marketing and communications statements (written and oral) pertaining to its activities under the ONC Health IT Certification Program.

(c) Renewal. An ONC-ACB or ONC-ATL is required to renew its status every three years. An ONC-ACB or ONC-ATL is required to submit a renewal request, containing any updates to the information requested in § 170.520, to the National Coordinator 60 days prior to the expiration of its status.

(d) Expiration. An ONC-ACB's or ONC-ATL's status will expire three years from the date it was granted by the National Coordinator unless it is renewed in accordance with paragraph (c) of this section.

[81 FR 72466, Oct. 19, 2016]

§ 170.545 [Reserved]

§ 170.550 Health IT Module certification.

Link to an amendment published at 91 FR 67997, Oct. 28, 2026.

(a) Certification scope. When certifying Health IT Module(s), an ONC-ACB must certify in accordance with the applicable certification criteria adopted by the Secretary at subpart C of this part.

(b) Health IT product scope options. An ONC-ACB must provide the option for an Health IT Module(s) to be certified solely to the applicable certification criteria adopted by the Secretary at subpart C of this part.

(c) Gap certification. An ONC-ACB may provide the option for and perform gap certification of previously certified Health IT Module(s).

(d) Upgrades and enhancements. An ONC-ACB may provide an updated certification to a previously certified Health IT Module(s).

(e) Standards updates. ONC-ACBs must provide an option for certification of Health IT Modules consistent with § 171.405(b)(7) or (8) to any one or more of the criteria referenced in § 170.405(a) based on newer versions of standards included in the criteria which have been approved by the National Coordinator for use in certification.

(f) [Reserved]

(g) Health IT Module dependent criteria. When certifying a Health IT Module to the ONC Certification Criteria for Health IT, an ONC-ACB must certify the Health IT Module in accordance with the certification criteria at:

(1) Section 170.315(g)(3) if the Health IT Module is presented for certification to one or more listed certification criteria in § 170.315(g)(3);

(2) Section 170.315(g)(4);

(3) Section 170.315(g)(5); and

(4) Section 170.315(g)(6) if the Health IT Module is presented for certification with C-CDA creation capabilities within its scope. If the scope of certification sought includes multiple certification criteria that require C-CDA creation, § 170.315(g)(6) need only be tested in association with one of those certification criteria and would not be expected or required to be tested for each. If the scope of certification sought includes multiple certification criteria that require C-CDA creation, § 170.315(g)(6) need only be tested in association with one of those certification criteria and would not be expected or required to be tested for each so long as all applicable C-CDA document templates have been evaluated as part of § 170.315(g)(6) for the scope of the certification sought.

(5) Section 170.315(b)(10) when a health IT developer presents a Health IT Module for certification that can store electronic health information at the time of certification by the product, of which the Health IT Module is a part.

(6) Section 170.315(b)(4) if the Health IT Module is presented for certification to the certification criteria in § 170.315(b)(3).

(h) Privacy and security certification framework—(1) General rule. When certifying a Health IT Module to the ONC Certification Criteria for Health IT, an ONC-ACB can only issue a certification to a Health IT Module if the privacy and security certification criteria in paragraphs (h)(3)(i) through (ix) of this section have also been met (and are included within the scope of the certification).

(2) Testing. In order to be issued a certification, a Health IT Module would only need to be tested once to each applicable privacy and security criterion in paragraphs (h)(3)(i) through (ix) of this section so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification, except for the following:

(i) A Health IT Module presented for certification to § 170.315(e)(1) must be separately tested to § 170.315(d)(9); and

(ii) A Health IT Module presented for certification to § 170.315(e)(2) must be separately tested to § 170.315(d)(9).

(3) Applicability. (i) Section 170.315(a)(1) through (3), (5), (12), (14), and (15) are also certified to the certification criteria specified in § 170.315(d)(1) through (7), (d)(12), and (13).

(ii) Section 170.315(a)(4), (10), and (13) and, on and after January 1, 2028, (b)(11), are also certified to the certification criteria specified in § 170.315(d)(1) through (3), (5) through (7), and (12), and, for the time period up to and including December 31, 2027, (d)(13).

(iii) Section 170.315(b)(1) through (3) and (6) through (9) are also certified to the certification criteria specified in § 170.315(d)(1) through (3) and (d)(5) through (8), (12), and (13);

(iv) Section 170.315(c) is also certified to the certification criteria specified in § 170.315(d)(1), (d)(2)(i)(A), (B), (d)(2)(ii) through (v), (d)(3), (5), (12), and (13);

(v) Section 170.315(e)(1) is also certified to the certification criteria specified in § 170.315(d)(1) through (3), (5), (7), (9), (12), and (13);

(vi) Section 170.315(e)(2) and (3) is also certified to the certification criteria specified in § 170.315(d)(1), (d)(2)(i)(A) and (B), (d)(2)(ii) through (v), (d)(3), (5), (9), (12), and (13);

(vii) Section 170.315(f) is also certified to the certification criteria specified in § 170.315(d)(1) through (3), (7), (12), and (13);

(viii) Section 170.315(g)(7) through (10) is also certified to the certification criteria specified in § 170.315(d)(1), (9), (12), and (13); and (d)(2)(i)(A) and (B), (d)(2)(ii) through (v), or (d)(10);

(ix) Section 170.315(h) is also certified to the certification criteria specified in § 170.315(d)(1), (d)(2)(i)(A) and (B), (d)(2)(ii) through (v), (d)(3), (12), and (13); and

(4) Methods to demonstrate compliance with each privacy and security criterion. One of the following methods must be used to meet each applicable privacy and security criterion listed in paragraph (h)(3) of this section:

(i) Directly, by demonstrating a technical capability to satisfy the applicable certification criterion or certification criteria; or

(ii) Demonstrate, through system documentation sufficiently detailed to enable integration, that the Health IT Module has implemented service interfaces for each applicable privacy and security certification criterion that enable the Health IT Module to access external services necessary to meet the privacy and security certification criterion.

(i) [Reserved]

(j) Direct Project transport method. An ONC-ACB can only issue a certification to a Health IT Module for § 170.315(h)(1) if the Health IT Module's certification also includes § 170.315(b)(1).

(k) Inherited certified status. An ONC-ACB must accept requests for a newer version of a previously certified Health IT Module(s) to inherit the certified status of the previously certified Health IT Module(s) without requiring the newer version to be recertified.

(1) Before granting certified status to a newer version of a previously certified Health IT Module(s), an ONC-ACB must review an attestation submitted by the developer(s) of the Health IT Module(s) to determine whether any change in the newer version has adversely affected the Health IT Module(s)' capabilities for which certification criteria have been adopted.

(2) An ONC-ACB may grant certified status to a newer version of a previously certified Health IT Module(s) if it determines that the capabilities for which certification criteria have been adopted have not been adversely affected.

(l) Conditions of certification attestations. Ensure that the health IT developer of the Health IT Module has met its responsibilities under subpart D of this part.

[76 FR 1325, Dec. 7, 2011, as amended at 77 FR 54291, Sept. 4, 2012; 79 FR 54480, Sept. 11, 2014; 80 FR 62757, Oct. 16, 2015; 85 FR 25952, May 1, 2020; 85 FR 70085, Nov. 4, 2020; 89 FR 1435, Jan. 9, 2024; 89 FR 8549, Feb. 8, 2024; 89 FR 101810, Dec. 16, 2024; 90 FR 37211, Aug. 4, 2025]

§ 170.553 [Reserved]

§ 170.555 Certification to newer versions of certain standards.

Link to an amendment published at 91 FR 67998, Oct. 28, 2026.

(a) ONC-ACBs may certify Health IT Module(s) to a newer version of certain identified minimum standards specified at subpart B of this part, unless the Secretary prohibits the use of a newer version for certification.

(b) Applicability of a newer version of a minimum standard. (1) ONC-ACBs are not required to certify Health IT Module(s) according to newer versions of standards adopted and named in subpart B of this part, unless:

(i) The National Coordinator approves a newer version for use in certification and a health IT developer voluntarily elects to seek certification of its health IT in accordance with § 170.405(b)(9) or update its certified health IT to the newer version in accordance with § 170.405(b)(8); or

(ii) The new version is incorporated by reference in § 170.299.

(2) A certified Complete EHR or certified Health IT Module may be upgraded to comply with newer versions of standards identified as minimum standards in subpart B of this part without adversely affecting its certification status, unless the Secretary prohibits the use of a newer version for certification.

[77 FR 54291, Sept. 4, 2012, as amended at 85 FR 25952, May 1, 2020]

§ 170.556 In-the-field surveillance and maintenance of certification for Health IT.

(a) In-the-field surveillance. Consistent with its accreditation under 170.523(a) to ISO/IEC 17065 and the requirements of this subpart, an ONC-ACB must initiate surveillance “in the field” as necessary to assess whether a certified Health IT Module continues to conform to the requirements in subparts A, B, C and E of this part once the certified Health IT Module has been implemented and is in use in a production environment.

(1) Production environment. An ONC-ACB's assessment of a certified capability in the field must be based on the use of the capability in a production environment, which means a live environment in which the capability has been implemented and is in use.

(2) Production data. An ONC-ACB's assessment of a certified capability in the field must be based on the use of the capability with production data unless the use of test data is specifically approved by the National Coordinator.

(b) Reactive surveillance. An ONC-ACB must initiate surveillance (including, as necessary, in-the-field surveillance required by paragraph (a) of this section) whenever it becomes aware of facts or circumstances that would cause a reasonable person to question a certified Health IT Module's continued conformity to the requirements of its certification.

(1) Review of required disclosures. When an ONC-ACB performs reactive surveillance under this paragraph, it must verify that the requirements of § 170.523(k)(1) have been followed as applicable to the issued certification.

(2) [Reserved]

(c) Randomized surveillance. During each calendar year surveillance period, an ONC-ACB may conduct in-the-field surveillance for certain randomly selected Health IT Modules to which it has issued a certification.

(1) Scope. When an ONC-ACB selects a certified Health IT Module for randomized surveillance under this paragraph, its evaluation of the certified Health IT Module must include all certification criteria prioritized by the National Coordinator that are part of the scope of the certification issued to the Health IT Module.

(2) [Reserved]

(3) Selection method. An ONC-ACB must randomly select (subject to appropriate weighting and sampling considerations) and certified Health IT Modules for surveillance under this paragraph.

(4) Number and types of locations for in-the-field surveillance. For each certified Health IT Module selected for randomized surveillance under this paragraph, an ONC-ACB must:

(i) Evaluate the certified Health IT Module's capabilities at one or more locations where the certified Health IT Module is implemented and in use in the field.

(ii) Ensure that the locations are selected at random (subject to appropriate weighting and sampling considerations) from among all locations where the certified Health IT Module is implemented and in use in the field.

(d) Corrective action plan and procedures. (1) When an ONC-ACB determines, through surveillance under this section or otherwise, that a Health IT Module does not conform to the requirements of its certification, the ONC-ACB must notify the developer of its findings and require the developer to submit a proposed corrective action plan for the applicable certification criterion, certification criteria, or certification requirement.

(2) The ONC-ACB shall provide direction to the developer as to the required elements of the corrective action plan.

(3) The ONC-ACB shall verify the required elements of the corrective action plan, consistent with its accreditation and any elements specified by the National Coordinator. At a minimum, any corrective action plan submitted by a developer to an ONC-ACB must include:

(i) A description of the identified non-conformities or deficiencies;

(ii) An assessment of how widespread or isolated the identified non-conformities or deficiencies may be across all of the developer's customers and users of the certified Health IT Module;

(iii) How the developer will address the identified non-conformities or deficiencies, both at the locations under which surveillance occurred and for all other potentially affected customers and users;

(iv) How the developer will ensure that all affected and potentially affected customers and users are alerted to the identified non-conformities or deficiencies, including a detailed description of how the developer will assess the scope and impact of the problem, including identifying all potentially affected customers; how the developer will promptly ensure that all potentially affected customers are notified of the problem and plan for resolution; how and when the developer will resolve issues for individual affected customers; and how the developer will ensure that all issues are in fact resolved.

(v) The timeframe under which corrective action will be completed.

(vi) An attestation by the developer that it has completed all elements of the approved corrective action plan.

(4) When the ONC-ACB receives a proposed corrective action plan (or a revised proposed corrective action plan), the ONC-ACB shall either approve the corrective action plan or, if the plan does not adequately address the elements described by paragraph (d)(3) of this section and other elements required by the ONC-ACB, instruct the developer to submit a revised proposed corrective action plan.

(5) Suspension. Consistent with its accreditation to ISO/IEC 17065 and procedures for suspending a certification, an ONC-ACB shall initiate suspension procedures for a Health IT Module:

(i) 30 days after notifying the developer of a non-conformity pursuant to paragraph (d)(1) of this section, if the developer has not submitted a proposed corrective action plan;

(ii) 90 days after notifying the developer of a non-conformity pursuant to paragraph (d)(1) of this section, if the ONC-ACB cannot approve a corrective action plan because the developer has not submitted a revised proposed corrective action plan in accordance with paragraph (d)(4) of this section; and

(iii) Immediately, if the developer has not completed the corrective actions specified by an approved corrective action plan within the time specified therein.

(6) Withdrawal. If a or certified Health IT Module's certification has been suspended, an ONC-ACB is permitted to initiate certification withdrawal procedures for the Health IT Module (consistent with its accreditation to ISO/IEC 17065 and procedures for withdrawing a certification) when the health IT developer has not completed the actions necessary to reinstate the suspended certification.

(e) Reporting of surveillance results requirements—(1) Rolling submission of in-the-field surveillance results. The results of in-the-field surveillance under this section must be submitted to the National Coordinator, at a minimum, on a quarterly basis in accordance with § 170.523(i)(2).

(2) Confidentiality of locations evaluated. The contents of an ONC-ACB's surveillance results submitted to the National Coordinator must not include any information that would identify any user or location that participated in or was subject to surveillance.

(3) Reporting of corrective action plans. When a corrective action plan is initiated for a Health IT Module, an ONC-ACB must report the Health IT Module and associated product and corrective action information to the National Coordinator in accordance with § 170.523(f)(1)(xxii) or (f)(2)(xi), as applicable.

(f) Relationship to other surveillance requirements. Nothing in this section shall be construed to limit or constrain an ONC-ACB's duty or ability to perform surveillance, including in-the-field surveillance, or to suspend or terminate the certification, of any certified Health IT Module as required or permitted by this subpart and the ONC-ACB's accreditation to ISO/IEC 17065.

[80 FR 62758, Oct. 16, 2015, as amended at 80 FR 76872, Dec. 11, 2015; 81 FR 72466, Oct. 19, 2016; 85 FR 25952, May 1, 2020]

§ 170.557 Authorized testing and certification methods.

(a) ONC-ATL applicability. An ONC-ATL must provide remote testing for both development and deployment sites.

(b) ONC-ACB applicability. An ONC-ACB must provide remote certification for both development and deployment sites.

[81 FR 72466, Oct. 19, 2016]

§ 170.560 Good standing as an ONC-ACB or ONC-ATL.

(a) ONC-ACB good standing. An ONC-ACB must maintain good standing by:

(1) Adhering to the Principles of Proper Conduct for ONC-ACBs;

(2) Refraining from engaging in other types of inappropriate behavior, including an ONC-ACB misrepresenting the scope of its authorization, as well as an ONC-ACB certifying Health IT Module(s) for which it does not have authorization; and

(3) Following all other applicable federal and state laws.

(b) ONC-ATL good standing. An ONC-ATL must maintain good standing by:

(1) Adhering to the Principles of Proper Conduct for ONC-ATLs;

(2) Refraining from engaging in other types of inappropriate behavior, including an ONC-ATL misrepresenting the scope of its authorization, as well as an ONC-ATL testing health IT for which it does not have authorization; and

(3) Following all other applicable federal and state laws.

[81 FR 72466, Oct. 19, 2016; 85 FR 25953, May 1, 2020]

§ 170.565 Revocation of ONC-ACB or ONC-ATL status.

(a) Type-1 violations. The National Coordinator may revoke an ONC-ATL or ONC-ACB's status for committing a Type-1 violation. Type-1 violations include violations of law or ONC Health IT Certification Program policies that threaten or significantly undermine the integrity of the ONC Health IT Certification Program. These violations include, but are not limited to: False, fraudulent, or abusive activities that affect the ONC Health IT Certification Program, a program administered by HHS or any program administered by the federal government.

(b) Type-2 violations. The National Coordinator may revoke an ONC-ATL or ONC-ACB's status for failing to timely or adequately correct a Type-2 violation. Type-2 violations constitute noncompliance with § 170.560.

(1) Noncompliance notification. If the National Coordinator obtains reliable evidence that an ONC-ATL or ONC-ACB may no longer be in compliance with § 170.560, the National Coordinator will issue a noncompliance notification with reasons for the notification to the ONC-ATL or ONC-ACB requesting that the ONC-ATL or ONC-ACB respond to the alleged violation and correct the violation, if applicable.

(2) Opportunity to become compliant. After receipt of a noncompliance notification, an ONC-ATL or ONC-ACB is permitted up to 30 days to submit a written response and accompanying documentation that demonstrates that no violation occurred or that the alleged violation has been corrected.

(i) If the ONC-ATL or ONC-ACB submits a response, the National Coordinator is permitted up to 30 days from the time the response is received to evaluate the response and reach a decision. The National Coordinator may, if necessary, request additional information from the ONC-ATL or ONC-ACB during this time period.

(ii) If the National Coordinator determines that no violation occurred or that the violation has been sufficiently corrected, the National Coordinator will issue a memo to the ONC-ATL or ONC-ACB confirming this determination.

(iii) If the National Coordinator determines that the ONC-ATL or ONC-ACB failed to demonstrate that no violation occurred or to correct the area(s) of non-compliance identified under paragraph (b)(1) of this section within 30 days of receipt of the noncompliance notification, then the National Coordinator may propose to revoke the ONC-ATL or ONC-ACB's status.

(c) Proposed revocation. (1) The National Coordinator may propose to revoke an ONC-ATL or ONC-ACB's status if the National Coordinator has reliable evidence that the ONC-ATL or ONC-ACB has committed a Type-1 violation; or

(2) The National Coordinator may propose to revoke an ONC-ATL or ONC-ACB's status if, after the ONC-ATL or ONC-ACB has been notified of a Type-2 violation, the ONC-ATL or ONC-ACB fails to:

(i) Rebut the finding of a violation with sufficient evidence showing that the violation did not occur or that the violation has been corrected; or

(ii) Submit to the National Coordinator a written response to the noncompliance notification within the specified timeframe under paragraph (b)(2) of this section.

(d) Suspension of an ONC-ATL or ONC-ACB's operations. (1) The National Coordinator may suspend the operations of an ONC-ATL or ONC-ACB under the ONC Health IT Certification Program based on reliable evidence indicating that:

(i) Applicable to both ONC-ACBs and ONC-ATLs. The ONC-ATL or ONC-ACB committed a Type-1 or Type-2 violation;

(ii) Applicable to ONC-ACBs. The continued certification of Health IT Modules by the ONC-ACB could have an adverse impact on the health or safety of patients.

(iii) Applicable to ONC-ATLs. The continued testing of Health IT Modules by the ONC-ATL could have an adverse impact on the health or safety of patients.

(2) If the National Coordinator determines that the conditions of paragraph (d)(1) of this section have been met, an ONC-ATL or ONC-ACB will be issued a notice of proposed suspension.

(3) Upon receipt of a notice of proposed suspension, an ONC-ATL or ONC-ACB will be permitted up to 3 days to submit a written response to the National Coordinator explaining why its operations should not be suspended.

(4) The National Coordinator is permitted up to 5 days from receipt of an ONC-ATL or ONC-ACB's written response to a notice of proposed suspension to review the response and make a determination.

(5) The National Coordinator may make one of the following determinations in response to the ONC-ATL or ONC-ACB's written response or if the ONC-ATL or ONC-ACB fails to submit a written response within the timeframe specified in paragraph (d)(3) of this section:

(i) Rescind the proposed suspension; or

(ii) Suspend the ONC-ATL or ONC-ACB's operations until it has adequately corrected a Type-2 violation; or

(iii) Propose revocation in accordance with paragraph (c) of this section and suspend the ONC-ATL or ONC-ACB's operations for the duration of the revocation process.

(6) A suspension will become effective upon an ONC-ATL or ONC-ACB's receipt of a notice of suspension.

(e) Opportunity to respond to a proposed revocation notice. (1) An ONC-ATL or ONC-ACB may respond to a proposed revocation notice, but must do so within 10 days of receiving the proposed revocation notice and include appropriate documentation explaining in writing why its status should not be revoked.

(2) Upon receipt of an ONC-ATL or ONC-ACB's response to a proposed revocation notice, the National Coordinator is permitted up to 30 days to review the information submitted by the ONC-ACB or ONC-ATL and reach a decision.

(f) Good standing determination. If the National Coordinator determines that an ONC-ATL or ONC-ACB's status should not be revoked, the National Coordinator will notify the ONC-ATL or ONC-ACB's authorized representative in writing of this determination.

(g) Revocation. (1) The National Coordinator may revoke an ONC-ATL or ONC-ACB's status if:

(i) A determination is made that revocation is appropriate after considering the information provided by the ONC-ATL or ONC-ACB in response to the proposed revocation notice; or

(ii) The ONC-ATL or ONC-ACB does not respond to a proposed revocation notice within the specified timeframe in paragraph (e)(1) of this section.

(2) A decision to revoke an ONC-ATL or ONC-ACB's status is final and not subject to further review unless the National Coordinator chooses to reconsider the revocation.

(h) Extent and duration of revocation—(1) Effectuation. The revocation of an ONC-ATL or ONC-ACB is effective as soon as the ONC-ATL or ONC-ACB receives the revocation notice.

(2) ONC-ACB provisions. (i) A certification body that has had its ONC-ACB status revoked is prohibited from accepting new requests for certification and must cease its current certification operations under the ONC Health IT Certification Program.

(ii) A certification body that has had its ONC-ACB status revoked for a Type-1 violation is not permitted to reapply for ONC-ACB status under the ONC Health IT Certification Program for a period of 1 year.

(iii) The failure of a certification body that has had its ONC-ACB status revoked to promptly refund any and all fees for certifications of Health IT Module(s) not completed will be considered a violation of the Principles of Proper Conduct for ONC-ACBs and will be taken into account by the National Coordinator if the certification body reapplies for ONC-ACB status under the ONC Health IT Certification Program.

(3) ONC-ATL provisions. (i) A testing lab that has had its ONC-ATL status revoked is prohibited from accepting new requests for testing and must cease its current testing operations under the ONC Health IT Certification Program.

(ii) A testing lab that has had its ONC-ATL status revoked for a Type-1 violation is not permitted to reapply for ONC-ATL status under the ONC Health IT Certification Program for a period of 1 year.

(iii) The failure of a testing lab that has had its ONC-ATL status revoked to promptly refund any and all fees for testing of health IT not completed will be considered a violation of the Principles of Proper Conduct for ONC-ATLs and will be taken into account by the National Coordinator if the testing lab reapplies for ONC-ATL status under the ONC Health IT Certification Program.

[81 FR 72466, Oct. 19, 2016, as amended at 85 FR 25953, May 1, 2020]

§ 170.570 Effect of revocation on the certifications issued to Complete EHRs and EHR Module(s).

Link to an amendment published at 91 FR 67998, Oct. 28, 2026.

(a) The certified status of Health IT Module(s) certified by an ONC-ACB or tested by an ONC-ATL that had its status revoked will remain intact unless a Type-1 violation was committed by the ONC-ACB and/or ONC-ATL that calls into question the legitimacy of the certifications issued.

(b) If the National Coordinator determines that a Type-1 violation was committed by an ONC-ACB and/or ONC-ATL that called into question the legitimacy of certifications issued to health IT, then the National Coordinator would:

(1) Review the facts surrounding the revocation of the ONC-ACB's or ONC-ATL's status; and

(2) Publish a notice on ONC's Web site if the National Coordinator believes that the Health IT Module(s) certifications were based on unreliable testing and/or certification.

(c) If the National Coordinator determines that Health IT Module(s) certifications were based on unreliable testing and/or certification, the certification status of affected Health IT Module(s) would only remain intact for 120 days after the National Coordinator publishes the notice.

(1) The certification status of affected Health IT Module(s) can only be maintained after the 120-day timeframe by being re-tested by an ONC-ATL in good standing, as necessary, and re-certified by an ONC-ACB in good standing.

(2) The National Coordinator may extend the time that the certification status of affected Health IT Module(s) remains intact as necessary for the proper retesting and recertification of the affected health IT.

[81 FR 72467, Oct. 19, 2016, as amended at 85 FR 25953, May 1, 2020]

§ 170.575 [Reserved]

§ 170.580 ONC review of certified health IT.

(a) Direct review—(1) Purpose. ONC may directly review certified health IT or a health IT developer's actions or practices to determine whether either conform to the requirements of the ONC Health IT Certification Program.

(2) Circumstances that may trigger review—(i) Certified health IT causing or contributing to unsafe conditions. ONC may initiate direct review under this section if it has a reasonable belief that certified health IT may not conform to the requirements of the Program because the certified health IT may be causing or contributing to conditions that present a serious risk to public health or safety, taking into consideration—

(A) The potential nature, severity, and extent of the suspected conditions;

(B) The need for an immediate or coordinated governmental response; and

(C) If applicable, information that calls into question the validity of the health IT's certification or maintenance thereof under the Program.

(ii) Impediments to ONC-ACB oversight of certified health IT. ONC may initiate direct review under this section if it has a reasonable belief that certified health IT may not conform to requirements of the Program and the suspected non-conformity presents issues that—

(A) May require access to confidential or other information that is not available to an ONC-ACB;

(B) May require concurrent or overlapping review by two or more ONC-ACBs; or

(C) May exceed an ONC-ACB's resources or expertise.

(iii) Noncompliance with a Condition and Maintenance of Certification requirement. ONC may initiate direct review under this section if it has a reasonable belief that a health IT developer has not complied with a Condition or Maintenance of Certification requirement under subpart D of this part.

(3) Relationship to ONC-ACBs and ONC-ATLs. (i) ONC's review of certified health IT or a health IT developer's actions or practices is independent of, and may be in addition to, any surveillance of certified health IT conducted by an ONC-ACB.

(ii) ONC may assert exclusive review of certified health IT as to any matters under review by ONC and any similar matters under surveillance by an ONC-ACB.

(iii) ONC's determination on matters under its review is controlling and supersedes any determination by an ONC-ACB on the same matters.

(iv) An ONC-ACB and ONC-ATL shall provide ONC with any available information that ONC deems relevant to its review of certified health IT or a health IT developer's actions or practices.

(v) ONC may end all or any part of its review of certified health IT or a health IT developer's actions or practices under this section at any time and refer the applicable part of the review to the relevant ONC-ACB(s) if ONC determines that doing so would serve the effective administration or oversight of the ONC Health IT Certification Program.

(4) Coordination with the Office of Inspector General. (i) ONC may coordinate its review of a claim of information blocking with the Office of Inspector General or defer to the Office of Inspector General to lead a review of a claim of information blocking.

(ii) ONC may rely on Office of Inspector General findings to form the basis of a direct review action.

(b) Notice—(1) Notice of potential non-conformity—(i) Circumstances that may trigger notice of potential non-conformity. At any time during its review of certified health IT or a health IT developer's actions or practices under paragraph (a) of this section, ONC may send a notice of potential non-conformity if it has a reasonable belief that certified health IT or a health IT developer's actions or practices may not conform to the requirements of the ONC Health IT Certification Program.

(ii) Health IT developer response. (A) The health IT developer must respond to the notice of potential non-conformity by:

(1) Cooperating with ONC and/or a third party acting on behalf of ONC;

(2) Providing ONC and/or a third party acting on behalf of ONC access, including in accordance with paragraph (b)(3) of this section, to the certified health IT under review;

(3) Providing ONC with a written explanation and all supporting documentation addressing the potential non-conformity within 30 days, or within the adjusted timeframe set in accordance with paragraph (b)(1)(ii)(B) of this section.

(B) ONC may adjust the 30-day timeframe specified in paragraph (b)(1)(ii)(A)(3) of this section to be shorter or longer based on factors including, but not limited to:

(1) The type of certified health IT and certification in question;

(2) The type of potential non-conformity to be corrected;

(3) The time required to correct the potential non-conformity; and

(4) Issues of public health or safety.

(iii) ONC determination. After receiving the health IT developer's written explanation and supporting documentation as required by paragraph (b)(1)(ii)(A)(3) of this section, ONC shall do one of the following:

(A) Issue a written determination ending its review.

(B) Request additional information and continue its review in accordance with a new timeframe ONC establishes under (b)(1)(ii)(A)(3) and (b)(1)(ii)(B) of this section.

(C) Substantiate a non-conformity and issue a notice of non-conformity.

(D) Issue a notice of proposed termination if the health IT is under review in accordance with paragraph (a)(2)(i) or (ii) of this section.

(2) Notice of non-conformity—(i) Circumstances that may trigger notice of non-conformity. At any time during its review of certified health IT or a health IT developer's actions or practices under paragraph (a) of this section, ONC may send a notice of non-conformity to the health IT developer if it determines that certified health IT or a health IT developer's actions or practices does not conform to the requirements of the ONC Health IT Certification Program.

(ii) Health IT developer response. (A) The health IT developer must respond to the notice of non-conformity by:

(1) Cooperating with ONC and/or a third party acting on behalf of ONC;

(2) Providing ONC and/or a third party acting on behalf of ONC access, including in accordance with paragraph (b)(3) of this section, to the certified health IT under review;

(3) Providing ONC with a written explanation and all supporting documentation addressing the non-conformity within 30 days, or within the adjusted timeframe set in accordance with paragraph (b)(1)(ii)(B) of this section; and

(4) Providing a proposed corrective action plan consistent with paragraph (c) of this section.

(B) ONC may adjust the 30-day timeframe specified in paragraph (b)(2)(ii)(A)(3) of this section to be shorter or longer based on factors including, but not limited to:

(1) The type of certified health IT and certification in question;

(2) The type of non-conformity to be corrected;

(3) The time required to correct the non-conformity; and

(4) Issues of public health or safety.

(iii) ONC determination. After receiving the health IT developer's response provided in accordance with paragraph (b)(2)(ii) of this section, ONC shall either issue a written determination ending its review or continue with its review under the provisions of this section.

(3) Records access. In response to a notice of potential non-conformity or notice of non-conformity, a health IT developer shall make available to ONC and for sharing within HHS, with other federal departments, agencies, and offices, and with appropriate entities including, but not limited to, third-parties acting on behalf of ONC:

(i) All records related to the development, testing, certification, implementation, maintenance and use of its certified health IT;

(ii) Any complaint records related to the certified health IT;

(iii) All records related to the Condition(s) and Maintenance of Certification requirements, including marketing and distribution records, communications, and contracts; and

(iv) Any other relevant information.

(c) Corrective action plan and procedures—(1) Applicability. If ONC determines that certified health IT or a health IT developer's action or practice does not conform to requirements of the ONC Health IT Certification Program, ONC shall notify the health IT developer of its determination and require the health IT developer to submit a proposed corrective action plan.

(2) ONC shall provide direction to the health IT developer as to the required elements of the corrective action plan, which shall include such required elements as ONC determines necessary to comprehensively and expeditiously resolve the identified non-conformity(ies). The corrective action plan shall, in all cases, at a minimum include the following required elements:

(i) An assessment and description of the nature, severity, and extent of the non-conformity;

(ii) Identification of all potentially affected customers;

(iii) A detailed description of how the health IT developer will promptly ensure that all potentially affected customers are notified of the non-conformity and plan for resolution;

(iv) A detailed description of how and when the health IT developer will resolve the identified non-conformity and all issues, both at the locations where the non-conformity was identified and for all affected customers;

(v) A detailed description of how the health IT developer will ensure that the identified non-conformity and all issues are resolved;

(vi) A detailed description of the supporting documentation that will be provided to demonstrate that the identified non-conformity and all issues are resolved; and

(vii) The timeframe under which all elements of the corrective action plan will be completed.

(viii) An explanation of, and agreement to execute, the steps that will be prevent the non-conformity from re-occurring.

(3) When ONC receives a proposed corrective action plan (or a revised proposed corrective action plan), it shall either approve the proposed corrective action plan or, if the plan does not adequately address all required elements, instruct the health IT developer to submit a revised proposed corrective action plan within a specified period of time.

(4) The health IT developer is responsible for ensuring that a proposed corrective action plan submitted in accordance with paragraph (b)(2)(ii)(A)(4) of this section or a revised corrective action plan submitted in accordance with paragraph (c)(3) of this section adequately addresses all required elements as determined by ONC no later than 90 days after the health IT developer's receipt of a notice of non-conformity.

(5) Health IT developers may request extensions for the submittal and/or completion of corrective action plans. In order to make these requests, health IT developers must submit a written statement to ONC that explains and justifies the extension request. ONC will evaluate each request individually and will make decisions on a case-by-case basis.

(6) Upon fulfilling all of its obligations under the corrective action plan, the health IT developer must submit an attestation to ONC, which serve as a binding official statement by the health IT developer that it has fulfilled all of its obligations under the corrective action plan.

(7) ONC may reinstitute a corrective action plan if it later determines that a health IT developer has not fulfilled all of its obligations under the corrective action plan as attested in accordance with paragraph (c)(6) of this section.

(d) Suspension. (1) ONC may suspend the certification of a Health IT Module at any time if ONC has a reasonable belief that the certified health IT may present a serious risk to public health or safety.

(2) When ONC decides to suspend a certification, ONC will notify the health IT developer of its determination through a notice of suspension.

(i) The notice of suspension will include, but may not be limited to:

(A) An explanation for the suspension;

(B) Information supporting the determination;

(C) The consequences of suspension for the health IT developer and the Health IT Module under the ONC Health IT Certification Program; and

(D) Instructions for appealing the suspension.

(ii) A suspension of a certification will become effective upon the date specified in the notice of suspension.

(3) The health IT developer must notify all potentially affected customers of the identified non-conformity(ies) and suspension of certification in a timely manner.

(4) When a certification is suspended, the health IT developer must cease and desist from any marketing, licensing, and sale of the suspended Health IT Module as “certified” under the ONC Health IT Certification Program from that point forward until such time ONC cancels the suspension in accordance with paragraph (d)(6) of this section.

(5) The certification of any health IT produced by a health IT developer that has the certification of one of its Health IT Modules suspended under the Program is prohibited, unless ONC cancels a suspension in accordance with paragraph (d)(6) of this section.

(6) ONC may cancel a suspension at any time if ONC no longer has a reasonable belief that the certified health IT presents a serious risk to public health or safety.

(e) Proposed termination—(1) Applicability. Excluding situations of noncompliance with a Condition or Maintenance of Certification requirement under subpart D of this part, ONC may propose to terminate a certification issued to a Health IT Module if:

(i) The health IT developer fails to timely respond to any communication from ONC, including, but not limited to:

(A) Fact-finding;

(B) A notice of potential non-conformity within the timeframe established in accordance with paragraph (b)(1)(ii)(A)(3) of this section;

(C) A notice of non-conformity within the timeframe established in accordance with paragraph (b)(2)(ii)(A)(3) of this section; or

(D) A notice of suspension.

(ii) The information or access provided by the health IT developer in response to any ONC communication, including, but not limited to: Fact-finding, a notice of potential non-conformity, or a notice of non-conformity is insufficient or incomplete;

(iii) The health IT developer fails to cooperate with ONC and/or a third party acting on behalf of ONC;

(iv) The health IT developer fails to timely submit in writing a proposed corrective action plan;

(v) The health IT developer fails to timely submit a corrective action plan that adequately addresses the elements required by ONC as described in paragraph (c) of this section;

(vi) The health IT developer does not fulfill its obligations under the corrective action plan developed in accordance with paragraph (c) of this section; or

(vii) ONC concludes that a certified health IT's non-conformity(ies) cannot be cured.

(2) When ONC decides to propose to terminate a certification, ONC will notify the health IT developer of the proposed termination through a notice of proposed termination.

(i) The notice of proposed termination will include, but may not be limited to:

(A) An explanation for the proposed termination;

(B) Information supporting the proposed termination; and

(C) Instructions for responding to the proposed termination.

(3) The health IT developer may respond to a notice of proposed termination, but must do so within 10 days of receiving the notice of proposed termination and must include appropriate documentation explaining in writing why its certification should not be terminated.

(4) Upon receipt of the health IT developer's written response to a notice of proposed termination, ONC has up to 30 days to review the information submitted by the health IT developer and make a determination. ONC may extend this timeframe if the complexity of the case requires additional time for ONC review. ONC will, as applicable:

(i) Notify the health IT developer in writing that it has ceased all or part of its review of the health IT developer's certified health IT.

(ii) Notify the health IT developer in writing of its intent to continue all or part of its review of the certified health IT under the provisions of this section.

(iii) Proceed to terminate the certification of the health IT under review consistent with paragraph (f) of this section.

(f) Termination—(1) Applicability. The National Coordinator may terminate a certification if:

(i) A determination is made that termination is appropriate after considering the information provided by the health IT developer in response to the proposed termination notice;

(ii) The health IT developer does not respond in writing to a proposed termination notice within the timeframe specified in paragraph (e)(3) of this section; or

(iii) A determination is made that the health IT developer is noncompliant with a Condition or Maintenance of Certification requirement under subpart D of this part or for the following circumstances when ONC exercises direct review under paragraph (a)(2)(iii) of this section:

(A) The health IT developer fails to timely respond to any communication from ONC, including, but not limited to:

(1) Fact-finding;

(2) A notice of potential non-conformity within the timeframe established in accordance with paragraph (b)(1)(ii)(A)(3) of this section; or

(3) A notice of non-conformity within the timeframe established in accordance with paragraph (b)(2)(ii)(A)(3) of this section.

(B) The information or access provided by the health IT developer in response to any ONC communication, including, but not limited to: Fact-finding, a notice of potential non-conformity, or a notice of non-conformity is insufficient or incomplete;

(C) The health IT developer fails to cooperate with ONC and/or a third party acting on behalf of ONC;

(D) The health IT developer fails to timely submit in writing a proposed corrective action plan;

(E) The health IT developer fails to timely submit a corrective action plan that adequately addresses the elements required by ONC as described in paragraph (c) of this section;

(F) The health IT developer does not fulfill its obligations under the corrective action plan developed in accordance with paragraph (c) of this section; or

(G) ONC concludes that the non-conformity(ies) cannot be cured.

(2) When ONC decides to terminate a certification, ONC will notify the health IT developer of its determination through a notice of termination.

(i) The notice of termination will include, but may not be limited to:

(A) An explanation for the termination;

(B) Information supporting the determination;

(C) The consequences of termination for the health IT developer and the Health IT Module under the ONC Health IT Certification Program; and

(D) Instructions for appealing the termination.

(ii) A termination of a certification will become effective after the following applicable occurrence:

(A) The expiration of the 10-day period for filing a statement of intent to appeal in paragraph (g)(3)(i) of this section if the health IT developer does not file a statement of intent to appeal.

(B) The expiration of the 30-day period for filing an appeal in paragraph (g)(3)(ii) of this section if the health IT developer files a statement of intent to appeal, but does not file a timely appeal.

(C) A final determination to terminate the certification per paragraph (g)(7) of this section if a health IT developer files an appeal.

(3) The health IT developer must notify all potentially affected customers of the identified non-conformity(ies) and termination of certification in a timely manner.

(4) ONC may rescind a termination determination before the termination becomes effective if ONC determines that termination is no longer appropriate.

(g) Appeal—(1) Basis for appeal. A health IT developer may appeal an ONC determination to suspend or terminate a certification issued to a Health IT Module and/or an ONC determination to issue a certification ban under § 170.581(a)(2) if the health IT developer asserts:

(i) ONC incorrectly applied ONC Health IT Certification Program requirements for a:

(A) Suspension;

(B) Termination; or

(C) Certification ban under § 170.581(a)(2).

(ii) ONC's determination was not sufficiently supported by the information provided by ONC with its determination.

(2) Method and place for filing an appeal. A statement of intent to appeal followed by a request for appeal must be submitted to ONC in writing by an authorized representative of the health IT developer subject to the determination being appealed. The statement of intent to appeal and request for appeal must be filed in accordance with the requirements specified in the notice of:

(i) Termination;

(ii) Suspension; or

(iii) Certification ban under § 170.581(a)(2).

(3) Time for filing a request for appeal. (i) A statement of intent to appeal must be filed within 10 days of a health IT developer's receipt of the notice of:

(A) Suspension;

(B) Termination; or

(C) Certification ban under § 170.581(a)(2).

(ii) An appeal, including all supporting documentation, must be filed within 30 days of the filing of the intent to appeal.

(4) Effect of appeal. (i) A request for appeal stays the termination of a certification issued to a Health IT Module, but the Health IT Module is prohibited from being marketed, licensed, or sold as “certified” during the stay.

(ii) A request for appeal does not stay the suspension of a Health IT Module.

(iii) A request for appeal stays a certification ban issued under § 170.581(a)(2).

(5) Appointment of a hearing officer. The National Coordinator will assign the case to a hearing officer to adjudicate the appeal on his or her behalf.

(i) The hearing officer may not review an appeal in which he or she participated in the initial suspension, termination, or certification ban determination or has a conflict of interest in the pending matter.

(ii) The hearing officer must be trained in a nationally recognized ethics code that articulates nationally recognized standards of conduct for hearing officers/officials.

(6) Adjudication. (i) The hearing officer may make a determination based on:

(A) The written record, which includes the:

(1) ONC determination and supporting information;

(2) Information provided by the health IT developer with the appeal filed in accordance with paragraphs (g)(1) through (3) of this section; and

(3) Information ONC provides in accordance with paragraph (g)(6)(v) of this section; or

(B) All the information provided in accordance with paragraph (g)(6)(i)(A) and any additional information from a hearing conducted in-person, via telephone, or otherwise.

(ii) The hearing officer will have the discretion to conduct a hearing if he/she:

(A) Requires clarification by either party regarding the written record under paragraph (g)(6)(i)(A) of this section;

(B) Requires either party to answer questions regarding the written record under paragraph (g)(6)(i)(A) of this section; or

(C) Otherwise determines a hearing is necessary.

(iii) The hearing officer will neither receive witness testimony nor accept any new information beyond what was provided in accordance with paragraph (g)(6)(i) of this section.

(iv) The default process will be a determination in accordance with paragraph (g)(6)(i)(A) of this section.

(v) ONC will have an opportunity to provide the hearing officer with a written statement and supporting documentation on its behalf that clarifies, as necessary, its determination to suspend or terminate the certification or issue a certification ban.

(7) Determination by the hearing officer. (i) The hearing officer will issue a written determination to the health IT developer within 30 days of receipt of the appeal or within a timeframe agreed to by the health IT developer and ONC and approved by the hearing officer, unless ONC cancels the suspension or rescinds the termination determination.

(ii) The National Coordinator's determination on appeal, as issued by the hearing officer, is final and not subject to further review.

[81 FR 72468, Oct. 19, 2016, as amended at 85 FR 25953, May 1, 2020]

§ 170.581 Certification ban.

(a) Circumstances that may trigger a certification ban. The certification of any of a health IT developer's health IT is prohibited when:

(1) The certification of one or more of the health IT developer's Health IT Modules is:

(i) Terminated by ONC under the ONC Health IT Certification Program;

(ii) Withdrawn from the ONC Health IT Certification Program by an ONC-ACB because the health IT developer requested it to be withdrawn (for reasons other than to comply with Program requirements) when the health IT developer's health IT was the subject of a potential non-conformity or non-conformity as determined by ONC;

(iii) Withdrawn by an ONC-ACB because of a non-conformity with any of the certification criteria adopted by the Secretary under subpart C of this part;

(iv) Withdrawn by an ONC-ACB because the health IT developer requested it to be withdrawn (for reasons other than to comply with Program requirements) when the health IT developer's health IT was the subject of surveillance for a certification criterion or criteria adopted by the Secretary under subpart C of this part, including notice of pending surveillance; or

(2) ONC determines a certification ban is appropriate per its review under § 170.580(a)(2)(iii).

(b) Notice of certification ban. When ONC decides to issue a certification ban to a health IT developer, ONC will notify the health IT developer of the certification ban through a notice of certification ban. The notice of certification ban will include, but may not be limited to:

(1) An explanation of the certification ban;

(2) Information supporting the certification ban;

(3) Instructions for appealing the certification ban if banned in accordance with paragraph (a)(2) of this section; and

(4) Instructions for requesting reinstatement into the ONC Health IT Certification Program, which would lift the certification ban.

(c) Effective date of certification ban. (1) A certification ban will be effective immediately if banned under paragraph (a)(1) of this section.

(2) For certification bans issued under paragraph (a)(2) of this section, the ban will be effective immediately after the following applicable occurrence:

(i) The expiration of the 10-day period for filing a statement of intent to appeal in § 170.580(g)(3)(i) if the health IT developer does not file a statement of intent to appeal.

(ii) The expiration of the 30-day period for filing an appeal in § 170.580(g)(3)(ii) if the health IT developer files a statement of intent to appeal, but does not file a timely appeal.

(iii) A final determination to issue a certification ban per § 170.580(g)(7) if a health IT developer files an appeal timely.

(d) Reinstatement. The certification of a health IT developer's health IT subject to the prohibition in paragraph (a) of this section may commence once the following conditions are met.

(1) A health IT developer must request ONC's permission in writing to participate in the ONC Health IT Certification Program.

(2) The request must demonstrate that the customers affected by the certificate termination, certificate withdrawal, or noncompliance with a Condition or Maintenance of Certification requirement have been provided appropriate remediation.

(3) For noncompliance with a Condition or Maintenance of Certification requirement, the noncompliance must be resolved.

(4) ONC is satisfied with the health IT developer's demonstration under paragraph (d)(2) of this section that all affected customers have been provided with appropriate remediation and grants reinstatement into the ONC Health IT Certification Program.

[85 FR 25954, May 1, 2020]

§ 170.599 Incorporation by reference.

(a) Certain material is incorporated by reference into this subpart with the approval of the Director of the Federal Register under 5 U.S.C. 552(a) and 1 CFR part 51. To enforce any edition other than that specified in this section, the Department of Health and Human Services must publish a document in the Federal Register and the material must be available to the public. All approved material is available for inspection at U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, 330 C Street SW., Washington, DC 20201, call ahead to arrange for inspection at 202-690-7151, and is available from the source listed below. It is also available for inspection at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call 202-741-6030 or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html.

(b) International Organization for Standardization, Case postale 56, CH·1211, Geneve 20, Switzerland, telephone +41-22-749-01-11, http://www.iso.org.

(1) ISO/IEC GUIDE 65:1996—General Requirements for Bodies Operating Product Certification Systems (First Edition), 1996, “ISO/IEC Guide 65,” IBR approved for § 170.503.

(2) ISO/IEC 17011:2004 Conformity Assessment—General Requirements for Accreditation Bodies Accrediting Conformity Assessment Bodies (Corrected Version), February 15, 2005, “ISO/IEC 17011,” IBR approved for § 170.503.

(3) ISO/IEC 17025:2005(E)—General requirements for the competence of testing and calibration laboratories (Second Edition), 2005-05-15, “ISO/IEC 17025,” IBR approved for §§ 170.520(b) and 170.524(a).

(4) ISO/IEC 17025:2017(E)—General requirements for the competence of testing and calibration laboratories (Third Edition), 2017-11, “ISO/IEC 17025,” IBR approved for §§ 170.520(b), and 170.524(a).

(5) ISO/IEC 17065:2012(E)—Conformity assessment—Requirements for bodies certifying products, processes and services (First Edition), 2012, “ISO/IEC 17065,” IBR approved for §§ 170.503 and 170.523(a).

[81 FR 72471, Oct. 19, 2016, as amended at 85 FR 25955, May 1, 2020]

§ 171.100 Statutory basis and purpose.

(a) Basis. This part implements section 3022 of the Public Health Service Act, 42 U.S.C. 300jj-52.

(b) Purpose. The purpose of this part is to establish exceptions for reasonable and necessary activities that do not constitute information blocking as defined by section 3022(a)(1) of the Public Health Service Act, 42 U.S.C. 300jj-52.

§ 171.101 Applicability.

(a) This part applies to health care providers, health IT developers of certified health IT, health information exchanges, and health information networks, as those terms are defined in § 171.102.

(b) Health care providers, health IT developers of certified health IT, health information exchanges, and health information networks are subject to this part on and after April 5, 2021.

(c) If any provision of this part is held to be invalid or unenforceable facially, or as applied to any person, plaintiff, or circumstance, it shall be construed to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which case the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances.

[85 FR 25955, May 1, 2020, as amended at 85 FR 70085, Nov. 4, 2020; 89 FR 101810, Dec. 16, 2024]

§ 171.102 Definitions.

For purposes of this part:

Access means the ability or means necessary to make electronic health information available for exchange or use.

Actor means a health care provider, health IT developer of certified health IT, health information network or health information exchange.

API Information Source is defined as it is in § 170.404(c).

API User is defined as it is in § 170.404(c).

Appropriate agency means a government agency that has established disincentives for health care providers that the Office of Inspector General (OIG) determines have committed information blocking.

Business associate is defined as it is in 45 CFR 160.103.

Certified API Developer is defined as it is in § 170.404(c).

Certified API technology is defined as it is in § 170.404(c).

Disincentive means a condition specified in § 171.1001(a) that is imposed by an appropriate agency on a health care provider that OIG determines has committed information blocking for the purpose of deterring information blocking practices.

Electronic health information (EHI) means electronic protected health information as defined in 45 CFR 160.103 to the extent that it would be included in a designated record set as defined in 45 CFR 164.501, regardless of whether the group of records are used or maintained by or for a covered entity as defined in 45 CFR 160.103, but EHI shall not include:

(1) Psychotherapy notes as defined in 45 CFR 164.501; or

(2) Information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding.

Exchange means the ability for electronic health information to be transmitted between and among different technologies, systems, platforms, or networks.

Fee means any present or future obligation to pay money or provide any other thing of value.

Health care provider has the same meaning as “health care provider” in 42 U.S.C. 300jj.

Health information network or health information exchange means an individual or entity that determines, controls, or has the discretion to administer any requirement, policy, or agreement that permits, enables, or requires the use of any technology or services for access, exchange, or use of electronic health information:

(1) Among more than two unaffiliated individuals or entities (other than the individual or entity to which this definition might apply) that are enabled to exchange with each other; and

(2) That is for a treatment, payment, or health care operations purpose, as such terms are defined in 45 CFR 164.501 regardless of whether such individuals or entities are subject to the requirements of 45 CFR parts 160 and 164.

Health IT developer of certified health IT means an individual or entity, other than a health care provider that self-develops health IT that is not offered to others, that develops or offers health information technology (as that term is defined in 42 U.S.C. 300jj(5)), and which has, at the time it engages in a practice that is the subject of an information blocking claim, one or more Health IT Modules certified under a program for the voluntary certification of health information technology that is kept or recognized by the National Coordinator pursuant to 42 U.S.C. 300jj-11(c)(5) (ONC Health IT Certification Program).

Information blocking is defined as it is in § 171.103.

Interfere with or interference means to prevent, materially discourage, or otherwise inhibit.

Interoperability element means hardware, software, integrated technologies or related licenses, technical information, privileges, rights, intellectual property, upgrades, or services that:

(1) May be necessary to access, exchange, or use electronic health information; and

(2) Is/Are controlled by the actor, which includes the ability to confer all rights and authorizations necessary to use the element to enable the access, exchange, or use of electronic health information.

Offer health information technology or offer health IT means to hold out for sale, resale, license, or relicense or to sell, resell, license, relicense, or otherwise provide or supply health information technology (as that term is defined in 42 U.S.C. 300jj(5) and where such health information technology includes one or more Health IT Modules certified under the ONC Health IT Certification Program) for deployment by or for other individual(s) or entity(ies) under any arrangement except an arrangement consistent with subparagraph (3)(iii), below. Activities and arrangements described in subparagraphs (1) through (3) are considered to be excluded from what it means to offer health IT.

(1) Donation and subsidized supply arrangements are not considered offerings when an individual or entity donates, gives, or otherwise makes available funding to subsidize or fully cover the costs of a health care provider's acquisition, augmentation, or upkeep of health IT, provided such individual or entity offers and makes such subsidy without condition(s) limiting the interoperability or use of the technology to access, exchange or use electronic health information for any lawful purpose.

(2) Implementation and use activities conducted by an individual or entity as follows:

(i) Issuing user accounts or login credentials to the individual's or entity's employees in the course of their employment or contractors within the scope of their contract in order for such employees or contractors to: use, operate, implement, configure, test, maintain, update or upgrade, or to give or receive training on, the individual's or entity's health IT system(s) or specific application(s) within such system(s).

(ii) Implementing, operating, or otherwise making available production instances of application programming interface (API) technology that supports access, exchange, and use of electronic health information that the individual or entity has in its possession, custody, control, or ability to query or transmit from or across a health information network or health information exchange.

(iii) Implementing, operating, and making available production instances of online portals for patients, clinicians or other health care providers, or public health entities to access, exchange, and use electronic health information that the individual or entity has in its possession, custody, control, or ability to query or transmit from or across a health information network or health information exchange.

(iv) Issuing login credentials or user accounts for the individual's or entity's production, development, or testing environments to public health authorities, or such authorities' employees or contractors, as a means of accomplishing or facilitating access, exchange, and use of electronic health information for public health purposes including but not limited to syndromic surveillance.

(v) Issuing login credentials or user accounts for independent healthcare professionals who furnish services in a healthcare facility to use the facility's electronic health record or other health IT system(s) in: furnishing, documenting, and accurately billing for care furnished in the facility; participating in clinical education or improvement activities conducted by or in the healthcare facility; or receiving training in use of the healthcare facility's health IT system(s).

(3) Consulting and legal services arrangements as follows:

(i) Legal services furnished by outside counsel—when furnishing legal services to a client in any matter or matters pertaining to the client's seeking, assessing, selecting, or resolving disputes over contracts or other arrangements by which the client obtains use of certified health IT. Outside counsel also does not offer health IT when facilitating limited access or use of a client's health IT by independent expert witnesses engaged by the outside counsel, opposing parties' counsel and experts, and special masters and court personnel, as appropriate to legal discovery.

(ii) Health IT consultant assistance with selection, implementation, and use of health IT —furnished to a health IT customer or user to help the customer do (or to do on behalf of a customer) any or all of the following with respect to any health IT product that the consultant does not sell or resell, license or relicense, or otherwise supply to the customer under any arrangement on a commercial basis or otherwise:

(A) Define the business needs of the customer or user or evaluate health IT product(s) against such business needs, or both;

(B) Negotiate for the purchase, lease, license, or other arrangement under which the health IT product(s) will be used; or

(C) Oversee or carry out configuration, implementation, or operation of health IT product(s).

(iii) Comprehensive and predominantly non-health IT administrative or operations management services—when an individual or entity furnishes a health care provider with administrative or operational management consultant services and the consultant acts as the agent of the provider or otherwise acts on behalf of the provider in dealings with one or more health IT developer(s) or vendor(s), or managing the day-to-day operations and administrative duties for the health IT, or both. To be consistent with this subparagraph, such services must be furnished as part of a comprehensive array of predominantly non-health IT administrative and operational functions that would otherwise be executed by the health care provider.

Permissible purpose means a purpose for which a person is authorized, permitted, or required to access, exchange, or use electronic health information under applicable law.

Person is defined as it is in 45 CFR 160.103.

Practice means an act or omission by an actor.

Reproductive health care means health care, as defined in 45 CFR 160.103, that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This definition shall not be construed to set forth a standard of care for or regulate what constitutes clinically appropriate reproductive health care.

Use means the ability for electronic health information, once accessed or exchanged, to be understood and acted upon.

[85 FR 25955, May 1, 2020, as amended at 89 FR 1435, Jan. 9, 2024; 89 FR 54717, July 1, 2024; 89 FR 102564, Dec. 17, 2024]

§ 171.103 Information blocking.

(a) Information blocking means a practice that except as required by law or covered by an exception set forth in subparts B, C, or D of this part, is likely to interfere with access, exchange, or use of electronic health information; and

(b) If conducted by:

(1) A health IT developer of certified health IT, health information network or health information exchange, such developer, network or exchange knows, or should know, that such practice is likely to interfere with access, exchange, or use of electronic health information; or

(2) A health care provider, such provider knows that such practice is unreasonable and is likely to interfere with access, exchange, or use of electronic health information.

[89 FR 1436, Jan. 9, 2024]

§ 171.200 Availability and effect of exceptions.

A practice shall not be treated as information blocking if the actor satisfies an exception to the information blocking provision as set forth in this subpart B by meeting all applicable requirements and conditions of the exception at all relevant times.

§ 171.201 Preventing harm exception—when will an actor's practice that is likely to interfere with the access, exchange, or use of electronic health information in order to prevent harm not be considered information blocking?

An actor's practice that is likely to interfere with the access, exchange, or use of electronic health information in order to prevent harm will not be considered information blocking when the practice meets the conditions in paragraphs (a) and (b) of this section, satisfies at least one condition from each of paragraphs (c), (d), and (f) of this section, and also meets the condition in paragraph (e) of this section when applicable.

(a) Reasonable belief. The actor engaging in the practice must hold a reasonable belief that the practice will substantially reduce a risk of harm to a patient or another natural person that would otherwise arise from the access, exchange, or use of electronic health information affected by the practice. For purposes of this section, “patient” means a natural person who is the subject of the electronic health information affected by the practice.

(b) Practice breadth. The practice must be no broader than necessary to substantially reduce the risk of harm that the practice is implemented to reduce.

(c) Type of risk. The risk of harm must:

(1) Be determined on an individualized basis in the exercise of professional judgment by a licensed health care professional who has a current or prior clinician-patient relationship with the patient whose electronic health information is affected by the determination; or

(2) Arise from data that is known or reasonably suspected to be misidentified or mismatched, corrupt due to technical failure, or erroneous for another reason.

(d) Type of harm. The type of harm must be one that could serve as grounds for a covered entity (as defined in § 160.103 of this title) to deny access (as the term “access” is used in part 164 of this title) to an individual's protected health information under:

(1) Section 164.524(a)(3)(iii) of this title where the practice is likely to, or in fact does, interfere with access, exchange, or use (as these terms are defined in § 171.102) of the patient's electronic health information by their legal representative (including but not limited to personal representatives recognized pursuant to 45 CFR 164.502) and the practice is implemented pursuant to an individualized determination of risk of harm consistent with paragraph (c)(1) of this section;

(2) Section 164.524(a)(3)(ii) of this title where the practice is likely to, or in fact does, interfere with the patient's or their legal representative's access to, use or exchange (as these terms are defined in § 171.102) of information that references another natural person and the practice is implemented pursuant to an individualized determination of risk of harm consistent with paragraph (c)(1) of this section;

(3) Section 164.524(a)(3)(i) of this title where the practice is likely to, or in fact does, interfere with the patient's access, exchange, or use (as these terms are defined in § 171.102) of their own electronic health information, regardless of whether the risk of harm that the practice is implemented to substantially reduce is consistent with paragraph (c)(1) or (2) of this section; or

(4) Section 164.524(a)(3)(i) of this title where the practice is likely to, or in fact does, interfere with a legally permissible access, exchange, or use (as these terms are defined in § 171.102) of electronic health information not described in paragraph (d)(1), (2), or (3) of this section, and regardless of whether the risk of harm the practice is implemented to substantially reduce is consistent with paragraph (c)(1) or (2) of this section.

(e) Patient right to request review of individualized determination of risk of harm. Where the risk of harm is consistent with paragraph (c)(1) of this section, the actor must implement the practice in a manner consistent with any rights the individual patient whose electronic health information is affected may have under § 164.524(a)(4) of this title, or any Federal, State, or tribal law, to have the determination reviewed and potentially reversed.

(f) Practice implemented based on an organizational policy or a determination specific to the facts and circumstances. The practice must be consistent with an organizational policy that meets paragraph (f)(1) of this section or, in the absence of an organizational policy applicable to the practice or to its use in particular circumstances, the practice must be based on a determination that meets paragraph (f)(2) of this section.

(1) An organizational policy must:

(i) Be in writing;

(ii) Be based on relevant clinical, technical, and other appropriate expertise;

(iii) Be implemented in a consistent and non-discriminatory manner; and

(iv) Conform each practice to the conditions in paragraphs (a) and (b) of this section, as well as the conditions in paragraphs (c) through (e) of this section that are applicable to the practice and its use.

(2) A determination must:

(i) Be based on facts and circumstances known or reasonably believed by the actor at the time the determination was made and while the practice remains in use; and

(ii) Be based on expertise relevant to implementing the practice consistent with the conditions in paragraphs (a) and (b) of this section, as well as the conditions in paragraphs (c) through (e) of this section that are applicable to the practice and its use in particular circumstances.

§ 171.202 Privacy exception—When will an actor's practice of not fulfilling a request to access, exchange, or use electronic health information in order to protect an individual's privacy not be considered information blocking?

An actor's practice of not fulfilling a request to access, exchange, or use electronic health information in order to protect an individual's privacy will not be considered information blocking when the practice meets all of the requirements of at least one of the sub-exceptions in paragraphs (b) through (e) of this section.

(a) Definitions in this section. (1) The term HIPAA Privacy Rule as used in this section means 45 CFR parts 160 and 164.

(2) The term individual as used in this section means one or more of the following—

(i) An individual as defined by 45 CFR 160.103.

(ii) Any other natural person who is the subject of the electronic health information being accessed, exchanged, or used.

(iii) A person who legally acts on behalf of a person described in paragraph (a)(2)(i) of this section in making decisions related to health care as a personal representative, in accordance with 45 CFR 164.502(g).

(iv) A person who is a legal representative of and can make health care decisions on behalf of any person described in paragraph (a)(2)(i) or (ii) of this section.

(v) An executor, administrator, or other person having authority to act on behalf of a deceased person described in paragraph (a)(2)(i) or (ii) of this section or the individual's estate under State or other law.

(b) Sub-exception—precondition not satisfied. To qualify for the exception on the basis that State or Federal law requires one or more preconditions for providing access, exchange, or use of electronic health information that have not been satisfied, the following requirements must be met—

(1) The actor's practice is tailored to the applicable precondition not satisfied, is implemented in a consistent and non-discriminatory manner, and either:

(i) Conforms to the actor's organizational policies and procedures that:

(A) Are in writing;

(B) Specify the criteria to be used by the actor to determine when the precondition would be satisfied and, as applicable, the steps that the actor will take to satisfy the precondition; and

(C) Are implemented by the actor, including by providing training on the policies and procedures; or

(ii) Are documented by the actor, on a case-by-case basis, identifying the criteria used by the actor to determine when the precondition would be satisfied, any criteria that were not met, and the reason why the criteria were not met.

(2) If the precondition relies on the provision of a consent or authorization from an individual and the actor has received a version of such a consent or authorization that does not satisfy all elements of the precondition required under applicable law, the actor must:

(i) Use reasonable efforts within its control to provide the individual with a consent or authorization form that satisfies all required elements of the precondition or provide other reasonable assistance to the individual to satisfy all required elements of the precondition; and

(ii) Not improperly encourage or induce the individual to withhold the consent or authorization.

(3) For purposes of determining whether the actor's privacy policies and procedures and actions satisfy the requirements of paragraphs (b)(1)(i) and (b)(2) above when the actor's operations are subject to multiple laws which have inconsistent preconditions, they shall be deemed to satisfy the requirements of the paragraphs if the actor has adopted uniform privacy policies and procedures to address the more restrictive preconditions.

(c) Sub-exception—health IT developer of certified health IT not covered by HIPAA. If the actor is a health IT developer of certified health IT that is not required to comply with the HIPAA Privacy Rule, when engaging in a practice that promotes the privacy interests of an individual, the actor's organizational privacy policies must have been disclosed to the individuals and entities that use the actor's product or service before they agreed to use them, and must implement the practice according to a process described in the organizational privacy policies. The actor's organizational privacy policies must:

(1) Comply with State and Federal laws, as applicable;

(2) Be tailored to the specific privacy risk or interest being addressed; and

(3) Be implemented in a consistent and non-discriminatory manner.

(d) Sub-exception—denial of an individual's request for their electronic health information consistent with 45 CFR 164.524(a)(1) and (2). If an individual requests electronic health information under the right of access provision under 45 CFR 164.524(a)(1) from an actor that must comply with 45 CFR 164.524(a)(1), the actor's practice must be consistent with 45 CFR 164.524(a)(2).

(e) Sub-exception—individual's request not to share EHI. An actor may elect not to provide access, exchange, or use of an individual's electronic health information if the following requirements are met—

(1) The individual requests that the actor not provide such access, exchange, or use of electronic health information without any improper encouragement or inducement of the request by the actor;

(2) The actor documents the request within a reasonable time period;

(3) The actor's practice is implemented in a consistent and non-discriminatory manner; and

(4) An actor may terminate an individual's request for a restriction to not provide such access, exchange, or use of the individual's electronic health information only if:

(i) The individual agrees to the termination in writing or requests the termination in writing;

(ii) The individual orally agrees to the termination and the oral agreement is documented by the actor; or

(iii) The actor informs the individual that it is terminating its agreement to not provide such access, exchange, or use of the individual's electronic health information except that such termination is:

(A) Not effective to the extent prohibited by applicable Federal or State law; and

(B) Only applicable to electronic health information created or received after the actor has so informed the individual of the termination.

[85 FR 25955, May 1, 2020, as amended at 89 FR 102564, Dec. 17, 2024]

§ 171.203 Security exception—When will an actor's practice that is likely to interfere with the access, exchange, or use of electronic health information in order to protect the security of electronic health information not be considered information blocking?

An actor's practice that is likely to interfere with the access, exchange, or use of electronic health information in order to protect the security of electronic health information will not be considered information blocking when the practice meets the conditions in paragraphs (a), (b), and (c) of this section, and in addition meets either the condition in paragraph (d) of this section or the condition in paragraph (e) of this section.

(a) The practice must be directly related to safeguarding the confidentiality, integrity, and availability of electronic health information.

(b) The practice must be tailored to the specific security risk being addressed.

(c) The practice must be implemented in a consistent and non-discriminatory manner.

(d) If the practice implements an organizational security policy, the policy must—

(1) Be in writing;

(2) Have been prepared on the basis of, and be directly responsive to, security risks identified and assessed by or on behalf of the actor;

(3) Align with one or more applicable consensus-based standards or best practice guidance; and

(4) Provide objective timeframes and other parameters for identifying, responding to, and addressing security incidents.

(e) If the practice does not implement an organizational security policy, the actor must have made a determination in each case, based on the particularized facts and circumstances, that:

(1) The practice is necessary to mitigate the security risk to electronic health information; and

(2) There are no reasonable and appropriate alternatives to the practice that address the security risk that are less likely to interfere with access, exchange or use of electronic health information.

[85 FR 25955, May 1, 2020, as amended at 85 FR 70085, Nov. 4, 2020]

§ 171.204 Infeasibility exception—When will an actor's practice of not fulfilling a request to access, exchange, or use electronic health information due to the infeasibility of the request not be considered information blocking?

An actor's practice of not fulfilling a request to access, exchange, or use electronic health information due to the infeasibility of the request will not be considered information blocking when the practice meets one of the conditions in paragraph (a) of this section and meets the requirements in paragraph (b) of this section.

(a) Conditions—(1) Uncontrollable events. The actor cannot fulfill the request for access, exchange, or use of electronic health information because of a natural or human-made disaster, public health emergency, public safety incident, war, terrorist attack, civil insurrection, strike or other labor unrest, telecommunication or internet service interruption, or act of military, civil or regulatory authority that in fact negatively impacts the actor's ability to fulfill the request.

(2) Segmentation. The actor cannot fulfill the request for access, exchange, or use of electronic health information because the actor cannot unambiguously segment the requested electronic health information from electronic health information that:

(i) Is not permitted by applicable law to be made available; or

(ii) May be withheld in accordance with 45 CFR 171.201, 171.202, or 171.206 of this part.

(3) Third party seeking modification use. The request is to enable use of EHI in order to modify EHI provided that the request for such use is not from a health care provider requesting such use from an actor that is its business associate.

(4) Manner exception exhausted. The actor is unable to fulfill a request for access, exchange, or use of electronic health information because paragraphs (a)(4)(i), (ii), and (iii) of this section are all true; and the actor complied with paragraph (a)(4)(iv) of this section.

(i) The actor could not reach agreement with a requestor in accordance with § 171.301(a) or was technically unable to fulfill a request for electronic health information in the manner requested.

(ii) The actor offered at least two alternative manners in accordance with § 171.301(b), one of which must use either technology certified to standard(s) adopted in part 170 (§ 171.301(b)(1)(i)) or published content and transport standards consistent with § 171.301(b)(1)(ii).

(iii) The actor does not provide the same access, exchange, or use of the requested electronic health information to a substantial number of individuals or entities that are similarly situated to the requester.

(iv) In determining whether a requestor is similarly situated under paragraph (a)(4)(iii), an actor shall not discriminate based on:

(A) Whether the requestor is an individual as defined in § 171.202(a)(2)

(B) The health care provider type and size; and

(C) Whether the requestor is a competitor of the actor or whether providing such access, exchange, or use, would facilitate competition with the actor.

(5) Infeasible under the circumstances. (i) The actor demonstrates, prior to responding to the request pursuant to paragraph (b) of this section, through a contemporaneous written record or other documentation, its consistent and non-discriminatory consideration of the following factors that led to its determination that complying with the request would be infeasible under the circumstances:

(A) The type of electronic health information and the purposes for which it may be needed;

(B) The cost to the actor of complying with the request in the manner requested;

(C) The financial and technical resources available to the actor;

(D) Whether the actor's practice is non-discriminatory and the actor provides the same access, exchange, or use of electronic health information to its companies or to its customers, suppliers, partners, and other persons with whom it has a business relationship;

(E) Whether the actor owns or has control over a predominant technology, platform, health information exchange, or health information network through which electronic health information is accessed or exchanged; and

(F) Why the actor was unable to provide access, exchange, or use of electronic health information consistent with the exception in § 171.301.

(ii) In determining whether the circumstances were infeasible under paragraph (a)(3)(i) of this section, it shall not be considered whether the manner requested would have:

(A) Facilitated competition with the actor; or

(B) Prevented the actor from charging a fee or resulted in a reduced fee.

(b) Responding to requests. If an actor does not fulfill a request for access, exchange, or use of electronic health information for any of the reasons provided in paragraph (a) of this section, the actor must, within ten business days of receipt of the request, provide to the requestor in writing the reason(s) why the request is infeasible.

[85 FR 25955, May 1, 2020, as amended at 89 FR 1436, Jan. 9, 2024; 89 FR 102564, Dec. 17, 2024]

§ 171.205 Health IT performance exception—When will an actor's practice that is implemented to maintain or improve health IT performance and that is likely to interfere with the access, exchange, or use of electronic health information not be considered information blocking?

An actor's practice that is implemented to maintain or improve health IT performance and that is likely to interfere with the access, exchange, or use of electronic health information will not be considered information blocking when the practice meets a condition in paragraph (a), (b), (c), or (d) of this section, as applicable to the particular practice and the reason for its implementation.

(a) Maintenance and improvements to health IT. When an actor implements a practice that makes health IT under that actor's control temporarily unavailable, or temporarily degrades the performance of health IT, in order to perform maintenance or improvements to the health IT, the actor's practice must be—

(1) Implemented for a period of time no longer than necessary to complete the maintenance or improvements for which the health IT was made unavailable or the health IT's performance degraded;

(2) Implemented in a consistent and non-discriminatory manner; and

(3) If the unavailability or degradation is initiated by a health IT developer of certified health IT, health information exchange, or health information network:

(i) Planned. Consistent with existing service level agreements between the individual or entity to whom the health IT developer of certified health IT, health information exchange, or health information network supplied the health IT; or

(ii) Unplanned. Consistent with existing service level agreements between the individual or entity; or agreed to by the individual or entity to whom the health IT developer of certified health IT, health information exchange, or health information network supplied the health IT.

(b) Assured level of performance. An actor may take action against a third-party application that is negatively impacting the health IT's performance, provided that the practice is—

(1) For a period of time no longer than necessary to resolve any negative impacts;

(2) Implemented in a consistent and non-discriminatory manner; and

(3) Consistent with existing service level agreements, where applicable.

(c) Practices that prevent harm. If the unavailability of health IT for maintenance or improvements is initiated by an actor in response to a risk of harm to a patient or another person, the actor does not need to satisfy the requirements of this section, but must comply with all requirements of § 171.201 at all relevant times to qualify for an exception.

(d) Security-related practices. If the unavailability of health IT for maintenance or improvements is initiated by an actor in response to a security risk to electronic health information, the actor does not need to satisfy the requirements of this section, but must comply with all requirements of § 171.203 at all relevant times to qualify for an exception.

§ 171.206 Protecting Care Access—When will an actor's practice that is likely to interfere with the access, exchange, or use of electronic health information in order to reduce potential exposure to legal action not be considered information blocking?

An actor's practice that is implemented to reduce potential exposure to legal action will not be considered information blocking when the practice satisfies the condition in paragraph (a) of this section and also satisfies the requirements of at least one of the conditions in paragraphs (b) or (c) of this section.

(a) Threshold condition. To satisfy this condition, a practice must meet each of the following requirements:

(1) Belief. The practice is undertaken based on the actor's good faith belief that:

(i) Persons seeking, obtaining, providing, or facilitating reproductive health care are at risk of being potentially exposed to legal action that could arise as a consequence of particular access, exchange, or use of specific electronic health information; and

(ii) Specific practices likely to interfere with such access, exchange, or use of such electronic health information could reduce that risk.

(2) Tailoring. The practice is no broader than necessary to reduce the risk of potential exposure to legal action that the actor in good faith believes could arise from the particular access, exchange, or use of the specific electronic health information.

(3) Implementation. The practice is implemented either consistent with an organizational policy that meets paragraph (a)(3)(i) of this section or pursuant to a case-by-case determination that meets paragraph (a)(3)(ii) of this section.

(i) An organizational policy must:

(A) Be in writing;

(B) Be based on relevant clinical, technical, and other appropriate expertise;

(C) Identify the connection or relationship between the interference with particular access, exchange, or use of specific electronic health information and the risk of potential exposure to legal action that the actor believes the interference could reduce;

(D) Be implemented in a consistent and non-discriminatory manner; and

(E) Conform to the requirements in paragraphs (a)(1) and (2) of this section and to the requirements of at least one of the conditions in paragraphs (b) or (c) of this section that are applicable to the prohibition of the access, exchange, or use of the electronic health information.

(ii) A case-by-case determination:

(A) Is made by the actor in the absence of an organizational policy applicable to the particular situation;

(B) Is based on facts and circumstances known to, or believed in good faith by, the actor at the time of the determination;

(C) Conforms to the conditions in paragraphs (a)(1) and (2) of this section; and

(D) Is documented either before or contemporaneous with engaging in any practice based on the determination. Documentation of the determination must identify the connection or relationship between the interference with particular access, exchange, or use of specific electronic health information and the risk of potential exposure to legal action.

(4) Another actor's reliance on good faith belief. For purposes of this section, an actor who is a business associate of, or otherwise maintains EHI on behalf of, another actor may rely on the good faith belief consistent with paragraph (a)(1) of the section and organizational policy or case-by-case determinations consistent with paragraph (a)(3) of this section of the actor on whose behalf relevant EHI is maintained.

(b) Patient protection condition. When implemented for the purpose of reducing the patient's risk of potential exposure to legal action, the practice must:

(1) Affect only the access, exchange, or use of specific electronic health information the actor in good faith believes could expose the patient to legal action because the electronic health information shows, or would carry a substantial risk of supporting a reasonable inference, that the patient:

(i) Obtained reproductive health care;

(ii) Inquired about or expressed an interest in seeking reproductive health care; or

(iii) Has any health condition(s) or history for which reproductive health care is often sought, obtained, or medically indicated.

(2) Be subject to nullification by an explicit request or directive from the patient that the access, exchange, or use of the specific electronic health information occur despite the risk(s) to the patient that the actor has identified.

(3) For purposes of paragraph (b)(1) and (2) of this section, “patient” means the natural person who is the subject of the electronic health information or another natural person referenced in, or identifiable from, the EHI as a person who has sought or obtained reproductive health care.

(c) Care access condition. When implemented for the purpose of reducing the risk of potential exposure to legal action for one or more licensed health care professionals, other health care providers, or other persons involved in providing or facilitating reproductive health care that is lawful under the circumstances in which such health care is provided, the practice must affect only access, exchange, or use of specific electronic health information that the actor believes could expose a care provider(s) and facilitator(s) to legal action because the information shows, or would carry a substantial risk of supporting a reasonable inference, that they provide or facilitate, or have provided or have facilitated, reproductive health care.

(d) Presumption. For purposes of determining whether an actor's practice meets paragraph (b)(1)(i) or (c) of this section, care provided by someone other than the actor is presumed to have been lawful unless the actor has actual knowledge that the care was not lawful under the circumstances in which such care is provided.

(e) Definition of legal action. As used in this section, legal action means any one or more of the following—

(1) A criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care;

(2) A civil or criminal action brought in a court to impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; or

(3) An administrative action or proceeding against any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care.

[89 FR 102564, Dec. 17, 2024]

§ 171.300 Availability and effect of exceptions.

A practice shall not be treated as information blocking if the actor satisfies an exception to the information blocking provision as set forth in this subpart C by meeting all applicable requirements and conditions of the exception at all relevant times.

§ 171.301 Manner exception—When will an actor's practice of limiting the manner in which it fulfills a request to access, exchange, or use electronic health information not be considered information blocking?

An actor's practice of limiting the manner in which it fulfills a request to access, exchange, or use electronic health information will not be considered information blocking when the practice follows the conditions of this section.

(a) Manner requested. (1) An actor must fulfill a request for electronic health information in any manner requested, unless the actor is technically unable to fulfill the request or cannot reach agreeable terms with the requestor to fulfill the request in the manner requested.

(2) If an actor fulfills a request for electronic health information in any manner requested:

(i) Any fees charged by the actor in relation to fulfilling the request are not required to satisfy the exception in § 171.302; and

(ii) Any license of interoperability elements granted by the actor in relation to fulfilling the request is not required to satisfy the exception in § 171.303.

(b) Alternative manner. If an actor does not fulfill a request for electronic health information in any manner requested because it is technically unable to fulfill the request or cannot reach agreeable terms with the requestor to fulfill the request in the manner requested, the actor must fulfill the request in an alternative manner, as follows:

(1) The actor must fulfill the request without unnecessary delay in the following order of priority, starting with paragraph (b)(1)(i) of this section and only proceeding to the next consecutive paragraph if the actor is technically unable to fulfill the request in the manner identified in a paragraph.

(i) Using technology certified to standard(s) adopted in part 170 that is specified by the requestor.

(ii) Using content and transport standards specified by the requestor and published by:

(A) The Federal Government; or

(B) A standards developing organization accredited by the American National Standards Institute.

(iii) Using an alternative machine-readable format, including the means to interpret the electronic health information, agreed upon with the requestor.

(2) Any fees charged by the actor in relation to fulfilling the request are required to satisfy the exception in § 171.302.

(3) Any license of interoperability elements granted by the actor in relation to fulfilling the request is required to satisfy the exception in § 171.303.

[89 FR 1437, Jan. 9, 2024]

§ 171.302 Fees exception—When will an actor's practice of charging fees for accessing, exchanging, or using electronic health information not be considered information blocking?

An actor's practice of charging fees, including fees that result in a reasonable profit margin, for accessing, exchanging, or using electronic health information will not be considered information blocking when the practice meets the conditions in paragraph (a) of this section, does not include any of the excluded fees in paragraph (b) of this section, and, as applicable, meets the condition in paragraph (c) of this section.

(a) Basis for fees condition. (1) The fees an actor charges must be—

(i) Based on objective and verifiable criteria that are uniformly applied for all similarly situated classes of persons or entities and requests;

(ii) Reasonably related to the actor's costs of providing the type of access, exchange, or use of electronic health information to, or at the request of, the person or entity to whom the fee is charged;

(iii) Reasonably allocated among all similarly situated persons or entities to whom the technology or service is supplied, or for whom the technology is supported; and

(iv) Based on costs not otherwise recovered for the same instance of service to a provider and third party.

(2) The fees an actor charges must not be based on—

(i) Whether the requestor or other person is a competitor, potential competitor, or will be using the electronic health information in a way that facilitates competition with the actor;

(ii) Sales, profit, revenue, or other value that the requestor or other persons derive or may derive from the access, exchange, or use of the electronic health information;

(iii) Costs the actor incurred due to the health IT being designed or implemented in a non-standard way, unless the requestor agreed to the fee associated with the non-standard design or implementation to access, exchange, or use the electronic health information;

(iv) Costs associated with intangible assets other than the actual development or acquisition costs of such assets;

(v) Opportunity costs unrelated to the access, exchange, or use of electronic health information; or

(vi) Any costs that led to the creation of intellectual property, if the actor charged a royalty for that intellectual property pursuant to § 171.303 and that royalty included the development costs for the creation of the intellectual property.

(b) Excluded fees condition. This exception does not apply to—

(1) A fee prohibited by 45 CFR 164.524(c)(4);

(2) A fee based in any part on the electronic access of an individual's EHI by the individual, their personal representative, or another person or entity designated by the individual;

(3) A fee to perform an export of electronic health information via the capability of health IT certified to § 170.315(b)(10) of this subchapter for the purposes of switching health IT or to provide patients their electronic health information; and

(4) A fee to export or convert data from an EHR technology that was not agreed to in writing at the time the technology was acquired.

(c) Compliance with the Conditions of Certification condition. Notwithstanding any other provision of this exception, if the actor is a health IT developer subject to the Conditions of Certification in § 170.402(a)(4), § 170.404, or both of this subchapter, the actor must comply with all requirements of such conditions for all practices and at all relevant times.

(d) Definition of Electronic access. The following definition applies to this section:

Electronic access means an internet-based method that makes electronic health information available at the time the electronic health information is requested and where no manual effort is required to fulfill the request.

§ 171.303 Licensing exception—When will an actor's practice to license interoperability elements in order for electronic health information to be accessed, exchanged, or used not be considered information blocking?

An actor's practice to license interoperability elements for electronic health information to be accessed, exchanged, or used will not be considered information blocking when the practice meets all of the following conditions.

(a) Negotiating a license conditions. Upon receiving a request to license an interoperability element for the access, exchange, or use of electronic health information, the actor must—

(1) Begin license negotiations with the requestor within 10 business days from receipt of the request; and

(2) Negotiate a license with the requestor, subject to the licensing conditions in paragraph (b) of this section, within 30 business days from receipt of the request.

(b) Licensing conditions. The license provided for the interoperability element(s) needed to access, exchange, or use electronic health information must meet the following conditions:

(1) Scope of rights. The license must provide all rights necessary to:

(i) Enable the access, exchange, or use of electronic health information; and

(ii) Achieve the intended access, exchange, or use of electronic health information via the interoperability element(s).

(2) Reasonable royalty. If the actor charges a royalty for the use of the interoperability elements described in paragraph (a) of this section, the royalty must be reasonable and comply with the following requirements:

(i) The royalty must be nondiscriminatory, consistent with paragraph (b)(3) of this section.

(ii) The royalty must be based solely on the independent value of the actor's technology to the licensee's products, not on any strategic value stemming from the actor's control over essential means of accessing, exchanging, or using electronic health information.

(iii) If the actor has licensed the interoperability element through a standards developing organization in accordance with such organization's policies regarding the licensing of standards-essential technologies on terms consistent with those in this exception, the actor may charge a royalty that is consistent with such policies.

(iv) An actor may not charge a royalty for intellectual property if the actor recovered any development costs pursuant to § 171.302 that led to the creation of the intellectual property.

(3) Non-discriminatory terms. The terms (including royalty terms) on which the actor licenses and otherwise provides the interoperability elements must be non-discriminatory and comply with the following requirements:

(i) The terms must be based on objective and verifiable criteria that are uniformly applied for all similarly situated classes of persons and requests.

(ii) The terms must not be based in any part on—

(A) Whether the requestor or other person is a competitor, potential competitor, or will be using electronic health information obtained via the interoperability elements in a way that facilitates competition with the actor; or

(B) The revenue or other value the requestor may derive from access, exchange, or use of electronic health information obtained via the interoperability elements.

(4) Collateral terms. The actor must not require the licensee or its agents or contractors to do, or to agree to do, any of the following—

(i) Not compete with the actor in any product, service, or market.

(ii) Deal exclusively with the actor in any product, service, or market.

(iii) Obtain additional licenses, products, or services that are not related to or can be unbundled from the requested interoperability elements.

(iv) License, grant, assign, or transfer to the actor any intellectual property of the licensee.

(v) Pay a fee of any kind whatsoever, except as described in paragraph (b)(2) of this section, unless the practice meets the requirements of the exception in § 171.302.

(5) Non-disclosure agreement. The actor may require a reasonable non-disclosure agreement that is no broader than necessary to prevent unauthorized disclosure of the actor's trade secrets, provided—

(i) The agreement states with particularity all information the actor claims as trade secrets; and

(ii) Such information meets the definition of a trade secret under applicable law.

(c) Additional conditions relating to the provision of interoperability elements. The actor must not engage in any practice that has any of the following purposes or effects.

(1) Impeding the efficient use of the interoperability elements to access, exchange, or use electronic health information for any permissible purpose.

(2) Impeding the efficient development, distribution, deployment, or use of an interoperable product or service for which there is actual or potential demand.

(3) Degrading the performance or interoperability of the licensee's products or services, unless necessary to improve the actor's technology and after affording the licensee a reasonable opportunity to update its technology to maintain interoperability.

[85 FR 25955, May 1, 2020, as amended at 85 FR 70085, Nov. 4, 2020]

§ 171.400 Availability and effect of exceptions.

A practice shall not be treated as information blocking if the actor satisfies an exception to the information blocking provision as set forth in this subpart D by meeting all applicable requirements and conditions of the exception at all relevant times.

§ 171.401 Definitions.

Common Agreement has the meaning given to it in 45 CFR 172.102.

Framework Agreement has the meaning given to it in 45 CFR 172.102.

Participant has the meaning given to it in 45 CFR 172.102.

Qualified Health Information Network or QHIN has the meaning given to it in 45 CFR 172.102.

Subparticipant has the meaning given to it in 45 CFR 172.102.

[89 FR 101810, Dec. 16, 2024]

§ 171.402 [Reserved]

§ 171.403 TEFCA manner exception—When will an actor's practice of limiting the manner in which it fulfills a request to access, exchange, or use electronic health information to only via TEFCA not be considered information blocking?

An actor's practice of limiting the manner in which it fulfills a request for access, exchange, or use of electronic health information to only via TEFCA will not be considered information blocking when the practice follows the conditions specified in paragraphs (a) through (d) of this section.

(a) Mutually part of TEFCA. The actor and requestor are both part of TEFCA.

(b) Requestor capability. The requestor is capable of such access, exchange, or use of the requested electronic health information from the actor via TEFCA.

(c) Limitation. The request for access, exchange, or use of EHI is not via the standards adopted in 45 CFR 170.215, including version(s) of those standards approved pursuant to 45 CFR 170.405(b)(8).

(d) Fees and licensing. (1) Any fees charged by the actor in relation to fulfilling the request are required to satisfy the exception in § 171.302; and

(2) Any license of interoperability elements granted by the actor in relation to fulfilling the request is required to satisfy the exception in § 171.303.

§ 171.1000 Scope.

This subpart sets forth disincentives that an appropriate agency may impose on a health care provider that OIG determines has committed information blocking, and certain procedures related to those disincentives.

§ 171.1001 Disincentives.

(a) Centers for Medicare & Medicaid Services may apply the following disincentives:

(1) An eligible hospital or critical access hospital (CAH) as defined in 42 CFR 495.4 is not a meaningful electronic health record (EHR) user as also defined in 42 CFR 495.4.

(2) A Merit-based Incentive Payment System (MIPS) eligible clinician as defined in 42 CFR 414.1305, who is also a health care provider as defined in § 171.102, is not a meaningful EHR user for MIPS as defined in 42 CFR 414.1305.

(3) Accountable care organizations (ACOs) who are health care providers as defined in § 171.102, ACO participants, and ACO providers/suppliers will be removed from, or denied approval to participate, in the Medicare Shared Savings Program as defined in 42 CFR part 425 for at least 1 year.

(b) [Reserved]

§ 171.1002 Notice of disincentive.

Following referral of a determination of information blocking by OIG, an appropriate agency that imposes a disincentive or disincentives specified in § 171.1001 shall send a notice to the health care provider subject to the disincentive or disincentives, via usual methods of communication for the program or payment system under which the disincentive is applied, that includes:

(a) A description of the practice or practices that formed the basis for the determination of information blocking referred by OIG;

(b) The basis for the application of the disincentive or disincentives being imposed;

(c) The effect of each disincentive; and

(d) Any other information necessary for a health care provider to understand how each disincentive will be implemented.

§ 171.1100 Scope.

This subpart sets forth the information that will be posted on the Office of the National Coordinator for Health Information Technology's (ONC) public website about actors that have been determined by the HHS Office of Inspector General to have committed information blocking.

§ 171.1101 Posting of information for actors found to have committed information blocking.

(a) Health care providers. (1) ONC will post on its public website the following information about health care providers that have been subject to a disincentive in § 171.1001(a) for information blocking:

(i) Health care provider name;

(ii) Business address;

(iii) The practice, as the term is defined in § 171.102 and referenced in § 171.103, found to have been information blocking, including when the practice occurred;

(iv) Disincentive(s) applied; and

(v) Where to find any additional information about the determination of information blocking that is publicly available via HHS or, where applicable, another part of the U.S. Government.

(2) The information specified in paragraph (a)(1) of this section will not be posted prior to a disincentive being imposed or the completion of any administrative appeals process pursued by the health care provider, and will not include information about a disincentive that has not been applied.

(3) Posting of the information specified in paragraph (a)(1) of this section will be conducted in accordance with existing rights to review information that may be associated with a disincentive specified in § 171.1001.

(b) Health IT developers of certified health IT and health information networks or health information exchanges. (1) ONC will post on its public website the following information, to the extent applicable, about health information networks/health information exchanges and health IT developers of certified health IT (actors) that have been determined by the HHS Office of Inspector General to have committed information blocking:

(i) Type of actor;

(ii) Actor's legal name, including any alternative or additional trade name(s) under which the actor operates;

(iii) The practice, as the term is defined in § 171.102 and referenced in § 171.103, found to have been information blocking or alleged to be information blocking in the situation specified in paragraph (b)(2)(i) of this section, and including when the practice occurred; and

(iv) Where to find any additional information about the determination (or resolution of information blocking as specified in paragraph (b)(2)(i) of this section) of information blocking that is publicly available via HHS or, where applicable, another part of the U.S. Government.

(2) The information specified in paragraph (b)(1) of this section will not be posted until one of the following occurs:

(i) OIG enters into a resolution of civil money penalty (CMP) liability; or

(ii) A CMP imposed under subpart N of 42 CFR part 1003 has become final consistent with the procedures in subpart O of 42 CFR part 1003.

§ 172.100 Basis, purpose, and scope.

(a) Basis and authority. The provisions of this part implement section 3001(c)(9) of the Public Health Service Act.

(b) Purpose. The purpose of this part is to:

(1) Ensure full network-to-network exchange of health information; and

(2) Establish a voluntary process for a Qualified Health Information Network TM (QHIN TM) to attest to adoption of the Trusted Exchange Framework and Common Agreement TM (TEFCA TM).

(c) Scope. This part addresses:

(1) Minimum qualifications needed for a health information network to be Designated as a QHIN capable of trusted exchange under TEFCA.

(2) Procedures governing QHIN Onboarding and Designation, suspension, termination, and further administrative review.

(3) Attestation submission requirements for a QHIN to attest to its adoption of TEFCA.

(4) ASTP/ONC attestation acceptance and removal processes for publication of attesting QHINs in the QHIN Attestation Directory.

§ 172.101 Applicability.

(a) This part applies to Applicant QHINS, QHINs, terminated QHINs, and the Recognized Coordinating Entity.

(b) If any provision of this part is held to be invalid or unenforceable facially, or as applied to any person, plaintiff, or circumstance, it shall be construed to give maximum effect to the provision permitted by law, unless such holding shall be one of utter invalidity or unenforceability, in which case the provision shall be severable from this part and shall not affect the remainder thereof or the application of the provision to other persons not similarly situated or to other dissimilar circumstances.

§ 172.102 Definitions.

Link to an amendment published at 91 FR 67998, Oct. 28, 2026.

For purposes of this part, the following definitions apply:

Applicable Law. All Federal, State, local, or Tribal laws and regulations then in effect and applicable to the subject matter in this part. For the avoidance of doubt, Federal agencies are subject only to Federal law.

Applicant QHIN. Any organization with a pending QHIN application before the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC).

Business Associate Agreement (BAA). A contract, agreement, or other arrangement that satisfies the implementation specifications described within 45 CFR parts 160 and subparts A, C, and E of 45 CFR part 164, as applicable.

Business day or business days. Monday through Friday, except the legal public holidays specified in 5 U.S.C. 6103 and any day declared to be a holiday by Federal statute or Executive order.

Common Agreement. The most recent version of the agreement referenced in section 3001(c)(9) of the Public Service Health Act as published in the Federal Register.

Confidential Information. Any information that is designated as Confidential Information by the person or entity that discloses it, or that a reasonable person would understand to be of a confidential nature and is disclosed to another person or entity pursuant to TEFCA Exchange. For the avoidance of doubt, “Confidential Information” does not include electronic protected health information (ePHI). Notwithstanding any label to the contrary, “Confidential Information” does not include any information that:

(1) Is or becomes known publicly through no fault of the recipient; or

(2) Is learned by the recipient from a third party that the recipient reasonably believes is entitled to disclose it without restriction; or

(3) Is already known to the recipient before receipt from the discloser, as shown by the recipient's written records; or

(4) Is independently developed by recipient without the use of or reference to the discloser's Confidential Information, as shown by the recipient's written records, and was not subject to confidentiality restrictions prior to receipt of such information from the discloser; or

(5) Must be disclosed under operation of law, provided that, to the extent permitted by Applicable Law, the recipient gives the discloser reasonable notice to allow the discloser to object to such redisclosure, and such redisclosure is made to the minimum extent necessary to comply with Applicable Law.

Connectivity Services. The technical services provided by a QHIN, Participant, or Subparticipant to its Participants and Subparticipants that facilitate TEFCA Exchange and are consistent with the technical requirements of the TEFCA framework.

Covered Entity. Has the meaning assigned to such term at 45 CFR 160.103.

Designated Network. The health information network that a QHIN uses to offer and provide Designated Network Services.

Designated Network Services. The Connectivity Services and/or Governance Services.

Designation (including its correlative meanings “Designate,” “Designated,” and “Designating”). The written determination that an Applicant QHIN has satisfied all requirements and is now a QHIN.

Disclosure (including its correlative meanings “Disclose,” “Disclosed,” and “Disclosing”). The release, transfer, provision of access to, or divulging in any manner of TEFCA Information (TI) outside the entity holding the information.

Electronic Protected Health Information (ePHI). Has the meaning assigned to such term at 45 CFR 160.103.

Exchange Purpose(s) or XP(s). The reason, as authorized by a Framework Agreement, including the applicable standard operating procedure(s) (SOP(s)), for a transmission, Query, Use, Disclosure, or Response transacted through TEFCA Exchange.

Exchange Purpose Code or XP Code. A code that identifies the Exchange Purpose being used for TEFCA Exchange.

Foreign Control. A non-U.S. Person(s) or non-U.S. Entity(ies) having the direct or indirect power, whether or not exercised, to direct or decide matters materially affecting the Applicant's ability to function as a QHIN in a manner that presents a national security risk.

Framework Agreement(s). With respect to QHINs, the Common Agreement; and with respect to a Participant or Subparticipant, the Participant/Subparticipant Terms of Participation (ToP).

Governance Services. The governance functions described in applicable SOP(s), which are performed by a QHIN's Designated Network Governance Body for its Participants and Subparticipants to facilitate TEFCA Exchange in compliance with the then-applicable requirements of the Framework Agreements.

Health information network or HIN. The meaning assigned to it in 45 CFR 171.102.

Individual has the meaning assigned to such term at 45 CFR 171.202(a)(2).

HIPAA. The Health Insurance Portability and Accountability Act of 1996.

HIPAA Privacy Rule. The regulations set forth in 45 CFR part 160 and subparts A and E of 45 CFR part 164.

HIPAA Rules. The regulations set forth at 45 CFR parts 160, 162, and 164.

HIPAA Security Rule. The regulations set forth in 45 CFR part 160 and subparts A and C of 45 CFR part 164.

Individual. Has the meaning assigned to such term at 45 CFR 171.202(a)(2).

Individual Access Services (IAS). The services provided to an Individual by a QHIN, Participant, or Subparticipant that has a direct contractual relationship with such Individual in which the QHIN, Participant or Subparticipant, as applicable, agrees to satisfy that Individual's ability to access, inspect, or obtain a copy of that Individual's Required Information using TEFCA Exchange.

Individually Identifiable Information. Refers to information that identifies an Individual or with respect to which there is a reasonable basis to believe that the information could be used to identify an Individual.

Node. A technical system that is controlled directly or indirectly by a QHIN, Participant, or Subparticipant and that is listed in the RCE Directory Service.

Non-U.S. Entity. Any entity that is not a U.S. Entity.

Non-U.S. Person. Any Individual who is not a U.S. Qualified Person.

Onboarding. The process a prospective QHIN must undergo to become a QHIN and become operational in the production environment.

Organized Health Care Arrangement. Has the meaning assigned to such term at 45 CFR 160.103.

Participant. A U.S. Entity that has entered into the Participant/Subparticipant Terms of Participation in a legally binding contract with a QHIN to use the QHIN's Designated Network Services to participate in TEFCA Exchange in compliance with the Participant/Subparticipant Terms of Participation.

Participant/Subparticipant Terms of Participation (ToP). The requirements to which QHINs must contractually obligate their Participants to agree; to which QHINs must contractually obligate their Participants to contractually obligate their Subparticipants and Subparticipants of the Subparticipants to agree, in order to participate in TEFCA Exchange including the QHIN Technical Framework (QTF), all applicable SOPs, and all other attachments, exhibits, and artifacts incorporated therein by reference.

Qualified Health Information Network® or QHIN TM. A Health Information Network that has been so Designated.

Query(s) (including its correlative uses/tenses “Queried” and “Querying”). The act of asking for information through TEFCA Exchange.

Recognized Coordinating Entity® (RCE®). The entity selected by ASTP/ONC that enters into the Common Agreement with QHINs in order to impose, at a minimum, the requirements of the Common Agreement, including the SOPs and the QTF, on the QHINs and administer such requirements on an ongoing basis. The RCE is a Party to the Common Agreement.

Required Information. The Electronic Health Information, as defined in 45 CFR 171.102, that is:

(1) Maintained in a Responding Node by any QHIN, Participant, or Subparticipant prior to or during the term of the applicable Framework Agreement; and

(2) Relevant for a required XP Code.

Responding Node. A Node through which the QHIN, Participant, or Subparticipant Responds to a received transaction for TEFCA Exchange.

Response(s) (including its correlative uses/tenses “Responds,” “Responded” and “Responding”). The act of providing the information that is the subject of a Query or otherwise transmitting a message in response to a Query through TEFCA Exchange.

Subparticipant: a U.S. Entity that has entered into the Participant/Subparticipant Terms of Participation in a legally binding contract with a Participant or another Subparticipant to use the Participant's or Subparticipant's Connectivity Services to participate in TEFCA Exchange in compliance with the Participant/Subparticipant Terms of Participation.

TEFCA Dispute Resolution Process. An informal, non-binding process under TEFCA through which QHINs can meet, confer, and seek to amicably resolve disputes.

TEFCA Exchange. The transaction of information between Nodes using an XP Code.

TEFCA Information or TI. Any information that is transacted through TEFCA Exchange except to the extent that such information is received by a QHIN, Participant, or Subparticipant that is a Covered Entity, Business Associate, or non-HIPAA entity that is exempt from compliance with the Privacy section of the applicable Framework Agreement and is incorporated into such recipient's system of record, at which point the information is no longer TEFCA Information with respect to such recipient and is governed by the HIPAA Rules and other Applicable Law.

TEFCA Security Incident. (1) An unauthorized acquisition, access, Disclosure, or Use of unencrypted TEFCA Information using TEFCA Exchange, except any of the following:

(i) Any unintentional acquisition, access, Use, or Disclosure of TEFCA Information by a Workforce Member or person acting under the authority of a QHIN, Participant, or Subparticipant, if such acquisition, access, Use, or Disclosure:

(A) Was made in good faith;

(B) Was made by a person acting within their scope of authority;

(C) Was made to another Workforce Member or person acting under the authority of any QHIN, Participant, or Subparticipant; and

(D) Does not result in further acquisition, access, Use, or Disclosure in a manner not permitted under Applicable Law and the Framework Agreements.

(ii) A Disclosure of TI where a QHIN, Participant, or Subparticipant has a good faith belief that an unauthorized person to whom the Disclosure was made would not reasonably have been able to retain such information.

(iii) A Disclosure of TI that has been de-identified in accordance with the standard at 45 CFR 164.514.

(2) Other security events that adversely affect a QHIN's, Participant's, or Subparticipant's participation in TEFCA Exchange.

Threat Condition. (1) A breach of a material provision of a Framework Agreement that has not been cured within fifteen (15) calendar days of receiving notice of the material breach (or such other period of time to which the Parties have agreed), which notice shall include such specific information about the breach that the RCE has available at the time of the notice; or

(2) A TEFCA Security Incident; or

(3) An event that the RCE, a QHIN, its Participant, or their Subparticipant has reason to believe will disrupt normal TEFCA Exchange, either due to actual compromise of, or the need to mitigate demonstrated vulnerabilities in systems or data, of the QHIN, Participant, or Subparticipant, as applicable, or could be replicated in the systems, networks, applications, or data of another QHIN, Participant, or Subparticipant; or

(4) Any event that could pose a risk to the interests of national security as directed by an agency of the United States government.

Trusted Exchange Framework. The most recent version of the framework referenced in section 3001(c)(9) of the Public Service Health Act published in the Federal Register.

U.S. Entity/Entities. Any corporation, limited liability company, partnership, or other legal entity that meets all of the following requirements:

(1) The entity is organized under the laws of a state or commonwealth of the United States or the Federal law of the United States and is subject to the jurisdiction of the United States and the state or commonwealth under which it was formed;

(2) The entity's principal place of business, as determined under Federal common law, is in the United States; and

(3) None of the entity's directors, officers, or executives, and none of the owners with a five percent (5%) or greater interest in the entity, are listed on the Specially Designated Nationals and Blocked Persons List published by the United States Department of the Treasury's Office of Foreign Asset Control or on the United States Department of Health and Human Services, Office of Inspector General's List of Excluded Individuals/Entities.

U.S. Qualified Person. Those individuals who are U.S. nationals and citizens at birth as defined in 8 U.S.C. 1401, U.S. nationals but not citizens of the United States at birth as defined in 8 U.S.C. 1408, lawful permanent residents of the United States as defined in Immigration and Nationality Act, and non-immigrant aliens who are hired by a U.S. Entity as an employee in a specialty occupation pursuant to an H-1B Visa.

Use(s) (including correlative uses/tenses, such as “Uses,” “Used,” and “Using”). With respect to TI, means the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

§ 172.103 Responsibilities ASTP/ONC may delegate to the RCE.

(a) ASTP/ONC may delegate to the RCE the TEFCA implementation responsibilities specified in the following sections:

(1) Any section(s) of subpart C of this part;

(2) Any section(s) of subpart D of this part;

(3) Section 172.501; and

(4) Section 172.503.

(b) Notwithstanding any delegation, any authority exercised by the RCE under this section is subject to review under subpart F of this part and to any requirement in this part that the RCE receive ASTP/ONC's prior authorization before taking a specific action.

§ 172.200 Applicability.

This subpart establishes Designation qualifications.

(a) Applicant QHIN. An Applicant QHIN must meet all requirements in § 172.201 to be Designated. An Applicant QHIN that proposes to offer Individual Access Services must also meet all requirements in § 172.202 to be Designated.

(b) QHIN. A QHIN must continue to meet all requirements in § 172.201 to maintain its Designation. A QHIN that offers Individual Access Services must also continue to meet all requirements in § 172.202 to maintain its Designation.

(c) Performance of TEFCA Exchange. The Designation qualifications in §§ 172.201 and 172.202 describe certain requirements for Designation.

§ 172.201 QHIN Designation requirements.

(a) Ownership requirements. An entity must:

(1) Be a U.S. Entity;

(2) Not be under Foreign Control.

(b) Exchange requirements. An entity must, beginning at the time of application, either directly or through the experience of its parent entity:

(1) Be capable of exchanging information among more than two unaffiliated organizations;

(2) Be capable of exchanging all Required Information;

(3) Be exchanging information for at least one Exchange Purpose authorized under TEFCA;

(4) Be capable of receiving and responding to transactions from other QHINs for all Exchange Purposes authorized under TEFCA; and

(5) Be capable of initiating transactions for the Exchange Purposes authorized under TEFCA that such entity will permit its Participants and Subparticipants to use through TEFCA Exchange.

(c) Designated Network Services requirements. An entity must:

(1) Maintain the organizational infrastructure and legal authority to operate and govern its Designated Network;

(2) Maintain adequate written policies and procedures to support meaningful TEFCA Exchange and fulfill all responsibilities of a QHIN in this part;

(3) Maintain a Designated Network that can support a transaction volume that keeps pace with the demands of network users;

(4) Maintain the capacity to support secure technical connectivity and data exchange with other QHINs;

(5) Maintain an enforceable dispute resolution policy governing Participants in the Designated Network that permits Participants to reasonably, timely, and fairly adjudicate disputes that arise between each other, the QHIN, or other QHINs;

(6) Maintain an enforceable change management policy consistent with the responsibilities of a QHIN;

(7) Maintain a representative and participatory group or groups with the authority to approve processes for governing the Designated Network;

(8) Maintain privacy and security policies that permit the entity to support TEFCA Exchange;

(9) Maintain data breach response and management policies that support meaningful TEFCA Exchange; and

(10) Maintain adequate financial and personnel resources to support all its responsibilities as a QHIN, including sufficient financial reserves or insurance-based cybersecurity coverage, or a combination of both.

§ 172.202 QHINs that offer Individual Access Services.

The following requirements apply to QHINs that offer Individual Access Services:

(a) A QHIN must obtain express consent from any individual before providing Individual Access Services.

(b) A QHIN must make publicly available a privacy and security notice that meets minimum TEFCA standards.

(c) A QHIN, that is the IAS provider for an Individual, must delete the individual's Individually Identifiable Information maintained by the QHIN upon request by the individual except as prohibited by Applicable Law or where such information is contained in audit logs.

(d) A QHIN must permit any Individual to export in a computable format all of the Individual's Individually Identifiable Information maintained by the QHIN as an Individual Access Services provider.

(e) All Individually Identifiable Information the QHIN maintains must satisfy the following criteria:

(1) All Individually Identifiable Information must be encrypted.

(2) Without unreasonable delay and in no case later than sixty (60) calendar days following discovery of the unauthorized acquisition, access, Disclosure, or Use of Individually Identifiable Information, the QHIN must notify in plain language each Individual whose Individually Identifiable Information has been or is reasonably believed to have been affected by unauthorized acquisition, access, Disclosure, or Use involving the QHIN.

(3) A QHIN must have an agreement with a qualified, independent third-party credential service provider and must verify, through the credential service provider, the identities of Individuals seeking Individual Access Services prior to the Individuals' first use of such services and upon expiration of their credentials.

§ 172.300 Applicability.

This subpart establishes, as to QHINs, the application, review, Onboarding, withdrawal, and redetermination processes for Designation.

§ 172.301 Submission of QHIN application.

An entity seeking to be Designated as a QHIN must submit all of the following information in a manner specified by ASTP/ONC:

(a) Completed QHIN application, with supporting documentation, in a form specified by ASTP/ONC; and

(b) A signed copy of the Common Agreement.

§ 172.302 Review of QHIN application.

(a) ASTP/ONC (or an RCE) will review a QHIN application to determine if the Applicant QHIN has completed all parts of the application and provided the necessary supporting documentation. If the QHIN application is not complete, the applicant will be notified in writing of the missing information within thirty (30) calendar days of receipt of the application. This timeframe may be extended by providing written notice to the Applicant QHIN.

(b) Once the QHIN application is complete, ASTP/ONC (or an RCE) will review the application to determine whether the Applicant QHIN satisfies the requirements for Designation set forth in § 172.201 and, if the Applicant QHIN proposes to provide IAS, the requirements set forth in § 172.202. ASTP/ONC (or an RCE) will complete its review within sixty (60) calendar days of the Applicant QHIN being provided with written notice that its application is complete. This timeframe may be extended by providing written notice to the Applicant QHIN.

(c) Additional information may be requested from the Applicant QHIN while ASTP/ONC (or an RCE) is reviewing the application. The timeframe for responding to the request and the manner to submit additional information will be provided to the applicant and may be extended on written notice to the Applicant QHIN.

(d) Failure to respond to a request within the proposed timeframe or in the manner specified is a basis for a QHIN Application to be deemed withdrawn, as set forth in § 172.305(c). In such situations, the Applicant QHIN will be provided with written notice that the application has been deemed withdrawn.

(e) If, following submission of the application, any information submitted by the Applicant QHIN becomes untrue or materially changes, the Applicant QHIN must notify ASTP/ONC (or an RCE) in the manner specified by ASTP/ONC (or an RCE) of such changes in writing within five (5) business days of the submitted material becoming untrue or materially changing.

§ 172.303 QHIN approval and Onboarding.

(a) An Applicant QHIN has the burden of demonstrating its compliance with all qualifications for Designation in § 172.201 and, if the Applicant QHIN proposes to provide IAS, the qualifications in § 172.202.

(b) If ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) determines that an Applicant QHIN meets the requirements for Designation set forth in § 172.201, and if the Applicant QHIN proposes to provide IAS, the qualifications set forth in § 172.202, then ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will notify the applicant in writing that its application has been approved, and the Applicant QHIN may proceed with Onboarding.

(c) An approved Applicant QHIN must submit a signed version of the Common Agreement within a timeframe set by ASTP/ONC (or an RCE).

(d) An approved Applicant QHIN must complete the Onboarding process, including any tests required to ensure the Applicant QHIN's network can connect to those of other QHINs and other Applicant QHINs, within twelve (12) months of approval of its QHIN application, unless that timeframe is extended in ASTP/ONC's (or an RCE's) sole discretion by up to twelve (12) months.

§ 172.304 QHIN Designation.

(a) If all requirements of the Onboarding process specified in § 172.303 have been satisfied:

(1) The Common Agreement will be countersigned; and

(2) The Applicant QHIN will be provided with a written determination indicating that the applicant has been Designated as a QHIN, along with a copy of the countersigned Common Agreement.

(b) Within thirty (30) calendar days of receiving its Designation, each QHIN must demonstrate in a manner specified by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange.

(c) If a QHIN is unable to complete the requirement in paragraph (b) of this section within the thirty (30)-day period provided, the QHIN must provide ASTP/ONC (or an RCE) with a written explanation of why the QHIN has been unable to complete a successful transaction with all other in-production QHINs within the allotted time and include a detailed plan and timeline for completion of a successful transaction with all other in-production QHINs. ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will review and either approve or reject the QHIN's plan based on the reasonableness of the explanation and the specific facts and circumstances, within five (5) business days of receipt. If the QHIN fails to provide its plan or the plan is rejected, ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) will rescind its approval of the application, rescind the QHIN Designation, and deny the application. Within thirty (30) calendar days of end of the term of the plan, each QHIN must demonstrate in a manner specified by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) that it has completed a successful transaction with all other in-production QHINs according to standards and procedures for TEFCA Exchange.

(d) A QHIN Designation will become final sixty (60) days after a Designated QHIN has submitted its documentation that it has completed a successful transaction with all other in-production QHINs.

§ 172.305 Withdrawal of QHIN application.

(a) An Applicant QHIN may voluntarily withdraw its QHIN application by providing written notice in a manner specified by ASTP/ONC (or an RCE).

(b) An Applicant QHIN may withdraw its QHIN application at any point prior to Designation.

(c) Upon written notice to the Applicant QHIN, a QHIN application may be deemed withdrawn by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) as a result of the Applicant QHIN's failure to respond to requests for information from ASTP/ONC (or an RCE).

§ 172.306 Denial of QHIN application.

If an Applicant QHIN's application is denied, the Applicant QHIN will be provided with written notice that includes the basis for the denial.

§ 172.307 Re-application.

(a) Subject to paragraphs (b) through (d) of this section, applications may be resubmitted by Applicant QHINs by complying with the provisions of § 172.301 in the event that an application is denied or withdrawn.

(b) The Applicant QHIN may reapply at any time after it has voluntarily withdrawn its application as specified in § 172.305(a).

(c) If ASTP/ONC (or an RCE) deems a QHIN application to be withdrawn as a result of the Applicant QHIN's failure to respond to requests for information, then the Applicant QHIN may reapply by submitting a new QHIN application no sooner than six (6) months after the date on which its previous application was submitted. The Applicant QHIN must respond to the prior request for information and must include an explanation as to why no response was previously provided within the required timeframe.

(d) If ASTP/ONC (or an RCE) denies a QHIN application, the Applicant QHIN may reapply by submitting a new application consistent with the requirements in § 172.301 no sooner than six (6) months after the date shown on the written notice of denial. The application must specifically address the deficiencies that constituted the basis for denying the Applicant QHIN's previous application.

§ 172.400 Applicability.

This subpart describes suspension responsibilities, notice requirements for suspension, and the effect of suspension.

§ 172.401 QHIN suspensions.

(a) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) may suspend a QHIN after determining that the QHIN is responsible for a Threat Condition.

(b) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) may direct the QHIN to suspend that Participant's or Subparticipant's authority to engage in TEFCA Exchange on determining that one of a QHIN's Participants or Subparticipants has done something or failed to do something that resulted in a Threat Condition.

(c) ASTP/ONC (or an RCE) will make a reasonable effort to notify a QHIN in writing in advance of an intent to suspend the QHIN or to provide direction to the QHIN to suspend one of the QHIN's Participants or Subparticipants, and to give the QHIN an opportunity to respond. Such notice will identify the Threat Condition giving rise to such suspension.

(d) ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) shall lift a suspension of the QHIN, or provide direction to the QHIN to lift the suspension of one of the QHIN's Participants or Subparticipants, once the Threat Condition is resolved.

§ 172.402 Selective suspension of exchange between QHINs.

(a) A QHIN may, in good faith and to the extent permitted by Applicable Law, suspend TEFCA Exchange with another QHIN because of reasonable concerns related to the privacy and security of information that is exchanged.

(b) If a QHIN decides to suspend TEFCA Exchange with another QHIN, it is required to promptly notify, in writing, ASTP/ONC (or an RCE) and the QHIN with which it is suspending exchange of its decision and the reason(s) for making the decision.

(c) If a QHIN suspends TEFCA Exchange with another QHIN under paragraph (a) of this section, it must, within thirty (30) calendar days, initiate the TEFCA Dispute Resolution Process in order to resolve the issues that led to the decision to suspend, or the QHIN may end its suspension and resume TEFCA Exchange with the other QHIN within thirty (30) calendar days of suspending TEFCA Exchange with the QHIN.

(d) Provided that a QHIN suspends TEFCA Exchange with another QHIN in accordance with this section and in accordance with Applicable Law, such suspension will not be deemed a violation of the Common Agreement.

§ 172.500 Applicability.

This subpart establishes QHIN termination responsibilities, notice requirements for termination, and the effect of termination.

§ 172.501 QHIN self-termination.

A QHIN may terminate its own Designation at any time without cause by providing ninety (90) calendar days prior written notice.

§ 172.502 QHIN termination.

A QHIN's Designation will be terminated with immediate effect by ASTP/ONC (or, with ASTP/ONC's prior authorization, an RCE) giving written notice of termination to the QHIN if the QHIN:

(a) Fails to comply with any of the regulations of this part and fails to remedy such material breach within thirty (30) calendar days after receiving written notice of such failure; provided, however, that if a QHIN is diligently working to remedy its material breach at the end of this thirty- (30-) day period, then ASTP/ONC (or an RCE) must provide the QHIN with up to another thirty (30) calendar days to remedy its material breach; or

(b) A QHIN breaches a material provision of the Common Agreement where such breach is not capable of remedy.

§ 172.503 Termination by mutual agreement.

A QHIN's Designation may be terminated at any time and for any reason by mutual, written agreement between the QHIN and ASTP/ONC (or an RCE).

§ 172.600 Applicability.

This subpart establishes processes for review of RCE or ASTP/ONC actions, including QHIN appeal rights and the process for filing an appeal.

§ 172.601 ASTP/ONC review.

(a) ASTP/ONC may, in its sole discretion, review all or any part of any RCE determination, policy, or action. If ASTP/ONC reviews an RCE determination that required ASTP/ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on its review of that determination.

(b) ASTP/ONC may, in its sole discretion and on notice to affected QHINs or Applicant QHINs, stay any RCE determination, policy, or other action pending ASTP/ONC review. If ASTP/ONC stays an RCE determination that required ASTP/ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on whether it should stay that determination.

(c) ASTP/ONC may, in its sole discretion and on written notice, request that a QHIN, Applicant QHIN, or the RCE provide ASTP/ONC additional information regarding any RCE determination, policy, or other action.

(d) On completion of its review, ASTP/ONC may affirm, modify, or reverse the determination, policy, or other action under review. ASTP/ONC will provide notice to affected QHINs or Applicant QHINs that includes the basis for ASTP/ONC's decision.

(e) ASTP/ONC will provide written notice under this section to affected QHINs or Applicant QHINs in the same manner as the original RCE determination, policy, or other action under review.

(f) ASTP/ONC will issue a decision under this section within a timeframe agreed to by the affected Applicant QHIN or QHIN, as applicable, the RCE, and ASTP/ONC. ASTP/ONC may, at its sole discretion, extend the timeframe for a decision as circumstances necessitate.

§ 172.602 Basis for appeal by QHIN or Applicant QHIN.

(a) An Applicant QHIN or QHIN may appeal the following decisions to ASTP/ONC or a hearing officer, as appropriate:

(1) Applicant QHIN. An Applicant QHIN may appeal a denial of its QHIN application.

(2) QHIN. A QHIN may appeal:

(i) A decision to suspend the QHIN or to instruct the QHIN to suspend its Participant or Subparticipant.

(ii) A decision to terminate the QHIN's Common Agreement.

(b) [Reserved]

§ 172.603 Method and timing for filing an appeal.

(a) To initiate an appeal, an authorized representative of the Applicant QHIN or QHIN must submit electronically, in writing to ASTP/ONC, a notice of appeal that includes the date of the notice of appeal, the date of the decision being appealed, the Applicant QHIN or QHIN that is appealing, and the decision being appealed within fifteen (15) calendar days of the Applicant QHIN's or QHIN's receipt of the notice of:

(1) Denial of a QHIN application;

(2) Suspension or instruction to suspend its Participant or Subparticipant; or

(3) Termination. With regard to an appeal of a termination, the 15-calendar day timeframe may be extended by ASTP/ONC up to another fifteen (15) calendar days if the QHIN has been granted an extension for completing its remedy under § 172.502(a).

(b) An authorized representative of an Applicant QHIN or QHIN must submit electronically to ASTP/ONC, within thirty (30) calendar days of filing the intent to appeal, the following:

(1) A statement of the basis for appeal, including a description of the facts supporting the appeal with citations to documentation submitted by the QHIN or Applicant QHIN; and

(2) Any documentation the QHIN would like considered during the appeal.

(c) The Applicant QHIN or QHIN filing the appeal may not submit on appeal any evidence that it did not submit prior to the appeal except evidence permitted by the hearing officer under § 172.606.

§ 172.604 Effect of appeal on suspension and termination.

An appeal does not stay the suspension or termination, unless otherwise ordered by ASTP/ONC or the hearing officer assigned under § 172.605(b).

§ 172.605 Assignment of a hearing officer.

(a) On receipt of an appeal under § 172.603, ASTP/ONC may exercise its authority under § 172.601 to review an RCE determination being appealed. If ASTP/ONC exercises its authority under § 172.601 to review an RCE determination that required ONC's prior authorization under this part, no ASTP/ONC officer, employee, or agent who was engaged with helping to evaluate or decide the prior authorization, or a prior authorization involving the same party(s) or underlying facts, may participate in deciding or advising ASTP/ONC on its review of that determination. An appealing QHIN or Applicant QHIN that is not satisfied with ASTP/ONC's subsequent determination may appeal that determination to a hearing officer by filing a new notice of appeal and other appeal documents that comply with § 172.603.

(b) If ASTP/ONC declines review under paragraph (a) of this section, or if ASTP/ONC made the determination under review, ASTP/ONC will arrange for assignment of the case to a hearing officer to adjudicate the appeal.

(c) The hearing officer must be an officer appointed by the Secretary of Health and Human Services.

(d) The hearing officer may not be responsible to, or subject to the supervision or direction of, personnel engaged in the performance of investigative or prosecutorial functions for ASTP/ONC, nor may any officer, employee, or agent of ASTP/ONC engaged in investigative or prosecutorial functions in connection with any adjudication, in that adjudication or one that is factually related, participate or advise in the decision of the hearing officer, except as a counsel to ASTP/ONC or as a witness.

§ 172.606 Adjudication.

(a) The hearing officer will decide issues of law and fact de novo and will apply a preponderance of the evidence standard when deciding appeals.

(b) In making a determination, the hearing officer may consider:

(1) The written record, which includes:

(i) The RCE's or ASTP/ONC's determination and supporting information; and

(ii) Appeal materials submitted by the Applicant QHIN or QHIN under § 172.603.

(2) Any information from a hearing conducted in-person, via telephone, or otherwise. The hearing officer has sole discretion to conduct a hearing:

(i) To require either party to clarify the written record under paragraph (b)(1) of this section; or

(ii) If the hearing officer otherwise determines a hearing is necessary.

(c) The hearing officer will neither receive witness testimony nor accept any new information beyond what was provided in accordance with paragraph (b) of this section, except for good cause shown by the party seeking to submit new information.

§ 172.607 Determination by the hearing officer.

(a) The hearing officer will issue a written determination within a timeframe agreed to by the affected Applicant QHIN or QHIN, as applicable, and ASTP/ONC and approved by the hearing officer. The hearing officer may, at their sole discretion, extend the timeframe for a written determination as circumstances necessitate.

(b) The hearing officer's determination on appeal is the final decision of HHS unless within ten (10) business days, the Secretary, in the Secretary's sole discretion, chooses to review the determination. ASTP/ONC will notify the appealing party if the Secretary chooses to review the determination and will provide notice of the Secretary's final determination.

§ 172.700 Applicability.

This subpart applies to QHINs.

§ 172.701 Attestation submission and acceptance.

(a) Applicability. This subpart establishes:

(1) The attestation submission requirements for QHINs.

(2) The review and acceptance processes that ASTP/ONC will follow for TEFCA attestations.

(b) Submission of QHIN attestation. (1) In order to be listed in the QHIN Attestation Directory described in § 172.702, a QHIN must submit all of the following information to ASTP/ONC:

(i) Attestation affirming its adoption of the Common Agreement and Trusted Exchange Framework.

(ii) General identifying information, including:

(A) Name, address, city, state, zip code, and a hyperlink to its website.

(B) Designation of an authorized representative, including the representative's name, title, phone number, and email address.

(iii) Documentation confirming its Designation as a QHIN.

(2) A QHIN must provide ASTP/ONC with written notice of any changes to its identifying information provided in accordance with this paragraph (b) within thirty (30) business days of the change(s) to its identifying information.

(c) Submission method. A QHIN must electronically submit its attestation and documentation either via an email address identified by ASTP/ONC or via a submission on the ASTP/ONC website, if available.

(d) Review and acceptance. (1) Within thirty (30) business days, ASTP/ONC will either accept or reject an attestation submission.

(2) ASTP/ONC will accept an attestation if it determines that the QHIN has satisfied the requirements of paragraphs (b) and (c) of this section. ASTP/ONC will provide written notice to the applicable QHIN's authorized representative that the attestation has been accepted.

(3) ASTP/ONC will reject an attestation if it determines that the requirements of paragraph (b) or (c) of this section, or both, have not been satisfied.

(4) ASTP/ONC will provide written notice to the QHIN's authorized representative of the determination along with the basis for the determination.

(5) An ASTP/ONC determination under this section is final agency action and not subject to further administrative review, except the Secretary may choose to review the determination as provided in § 172.607(b). However, a QHIN may, at any time, resubmit an attestation in accordance with paragraphs (b) and (c) of this section.

§ 172.702 QHIN Attestation Directory.

(a) Applicability. This subpart establishes processes for publishing a directory on the ASTP/ONC website of QHINs that voluntarily elect to adopt the Common Agreement and Trusted Exchange Framework and attest to such adoption.

(b) Publication. (1) Within fifteen (15) calendar days of notifying a QHIN that its QHIN submission has been accepted, ASTP/ONC will publish, at a minimum, the QHIN's name in the QHIN Attestation Directory on the ASTP/ONC website.

(2) ASTP/ONC will identify within the QHIN Attestation Directory those QHINs that are suspended under the Common Agreement.

(c) Removal from the QHIN Attestation Directory. (1) A QHIN whose Common Agreement has been terminated no longer qualifies to be included in the QHIN Attestation Directory as it is no longer considered a QHIN and will be removed from the QHIN Attestation Directory.

(2) Upon termination of a QHIN's Common Agreement, ASTP/ONC (or an RCE) will send a written a statement of intent to remove the QHIN from the QHIN Attestation Directory to the authorized representative of the QHIN.

(3) Any written statement given under paragraph (c)(2) of this section shall consist of the following, as appropriate:

(i) The name of the terminated QHIN and the name and contact information of the authorized representative of the QHIN.

(ii) A short statement setting forth findings of fact with respect to any violation of the Common Agreement or other basis for the QHIN's termination under the Common Agreement and justifying the termination on the basis of those findings of facts.

(iii) Other materials as ASTP/ONC (or the RCE) may deem relevant.

(d) Duration. A QHIN that is removed from the QHIN Attestation Directory will remain removed until a new attestation is accepted by ASTP/ONC in accordance with the processes specified in this subpart.

(e) Final agency action. An ASTP/ONC determination under this section is final agency action and not subject to further administrative review, except the Secretary may choose to review the determination as provided in § 172.607(b).

§ 180.10 Basis and scope.

This part implements section 2718(e) of the Public Health Service (PHS) Act, which requires each hospital operating within the United States, for each year, to establish, update, and make public a list of the hospital's standard charges for items and services provided by the hospital, including for diagnosis-related groups (DRGs) established under section 1886(d)(4) of the Social Security Act. This part also implements section 2718(b)(3) of the PHS Act, to the extent that section authorizes CMS to promulgate regulations for enforcing section 2718(e). This part also implements section 1102(a) of the Social Security Act, which authorizes the Secretary to make and publish rules and regulations, not inconsistent with that Act, as may be necessary to the efficient administration of the functions for which the Secretary is charged under that Act.

§ 180.20 Definitions.

The following definitions apply to this part, unless specified otherwise:

Ancillary service means an item or service a hospital customarily provides as part of or in conjunction with a shoppable primary service.

Chargemaster (Charge Description Master or CDM) means the list of all individual items and services maintained by a hospital for which the hospital has established a charge.

CMS template means a CSV format or JSON schema that CMS makes available for purposes of compliance with § 180.40(a).

De-identified maximum negotiated charge means the highest charge that a hospital has negotiated with all third party payers for an item or service.

De-identified minimum negotiated charge means the lowest charge that a hospital has negotiated with all third party payers for an item or service.

Discounted cash price means the charge that applies to an individual who pays cash (or cash equivalent) for a hospital item or service.

Encode means to convert hospital standard charge information into a machine-readable format that complies with § 180.50(c)(2).

Estimated allowed amount means the average dollar amount that the hospital has historically received from a third party payer for an item or service.

Gross charge means the charge for an individual item or service that is reflected on a hospital's chargemaster, absent any discounts.

Hospital means an institution in any State in which State or applicable local law provides for the licensing of hospitals, that is licensed as a hospital pursuant to such law or is approved, by the agency of such State or locality responsible for licensing hospitals, as meeting the standards established for such licensing. For purposes of this definition, a State includes each of the several States, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, American Samoa, and the Northern Mariana Islands.

Items and services means all items and services, including individual items and services and service packages, that could be provided by a hospital to a patient in connection with an inpatient admission or an outpatient department visit for which the hospital has established a standard charge. Examples include, but are not limited to, the following:

(1) Supplies and procedures.

(2) Room and board.

(3) Use of the facility and other items (generally described as facility fees).

(4) Services of employed physicians and non-physician practitioners (generally reflected as professional charges).

(5) Any other items or services for which a hospital has established a standard charge.

Machine-readable file means a single digital file that is in a machine-readable format.

Machine-readable format means a digital representation of data or information in a file that can be imported or read into a computer system for further processing.

Payer-specific negotiated charge means the charge that a hospital has negotiated with a third party payer for an item or service.

Median allowed amount means the median of the total allowed amounts the hospital has historically received from a third party payer for an item or service for a time period no less than 12 months and no longer than 15 months prior to posting the machine-readable file. Should the calculated median fall between two observed allowed amounts, the median allowed amount is the next highest observed value.

Ninetieth (90th) percentile allowed amount means the 90th percentile of the total allowed amounts the hospital has historically received from a third party payer for an item or service for a time period no less than 12 months and no longer than 15 months prior to posting the machine-readable file. Should the calculated percentile fall between two observed allowed amounts, the 90th percentile allowed amount is the next highest observed value.

Service package means an aggregation of individual items and services into a single service with a single charge.

Shoppable service means a service that can be scheduled by a healthcare consumer in advance.

Standard charge means the regular rate established by the hospital for an item or service provided to a specific group of paying patients. This includes all of the following as defined under this section:

(1) Gross charge.

(2) Payer-specific negotiated charge.

(3) De-identified minimum negotiated charge.

(4) De-identified maximum negotiated charge.

(5) Discounted cash price.

State forensic hospital means a public psychiatric hospital that provides treatment for individuals who are in the custody of penal authorities.

Tenth (10th) percentile allowed amount means the 10th percentile of the total allowed amounts the hospital has historically received from a third party payer for an item or service for a time period no less than 12 months and no longer than 15 months prior to posting the machine-readable file. Should the calculated percentile fall between two observed allowed amounts, the 10th percentile allowed amount is the next highest observed value.

Third party payer means an entity that is, by statute, contract, or agreement, legally responsible for payment of a claim for a healthcare item or service.

[84 FR 65602, Nov. 27, 2019, as amended at 86 FR 63998, Nov. 16, 2021; 88 FR 82184, Nov. 22, 2023; 90 FR 54087, Nov. 25, 2025]

§ 180.30 Applicability.

(a) General applicability. Except as provided in paragraph (b) of this section, the requirements of this part apply to hospitals as defined at § 180.20.

(b) Exception. Federal and State hospitals are deemed by CMS to be in compliance with the requirements of this part including but not limited to:

(1) Federally owned hospital facilities, including facilities operated by the U.S. Department of Veterans Affairs and Military Treatment Facilities operated by the U.S. Department of Defense.

(2) Hospitals operated by an Indian Health Program as defined in section 4(12) of the Indian Health Care Improvement Act.

(3) State forensic hospitals that provide treatment exclusively to individuals who are in the custody of penal authorities.

(c) Online availability. Unless otherwise stated, hospital charge information must be made public electronically via the internet.

[84 FR 65602, Nov. 27, 2019, as amended at 86 FR 63998, Nov. 16, 2021]

§ 180.40 General requirements.

A hospital must make public the following:

(a) A machine-readable file containing a list of all standard charges for all items and services as provided in § 180.50.

(b) A consumer-friendly list of standard charges for a limited set of shoppable services as provided in § 180.60.

§ 180.50 Requirements for making public hospital standard charges for all items and services.

(a) General rules. (1) A hospital must establish, update, and make public a list of all standard charges for all items and services online in the form and manner specified in this section.

(2) Each hospital location operating under a single hospital license (or approval) that has a different set of standard charges than the other location(s) operating under the same hospital license (or approval) must separately make public the standard charges applicable to that location.

(3) Each hospital must:

(i) Beginning January 1, 2024 through December 31, 2025, make a good faith effort to ensure that the standard charge information encoded in the machine-readable file is true, accurate, and complete as of the date indicated in the machine-readable file.

(ii) Beginning January 1, 2024 through December 31, 2025, affirm in its machine-readable file that, to the best of its knowledge and belief, the hospital has included all applicable standard charge information in accordance with the requirements of this section, and that the information encoded is true, accurate, and complete as of the date indicated in the machine-readable file.

(iii) Beginning January 1, 2026, attest in its machine-readable file the following: To the best of its knowledge and belief, this hospital has included all applicable standard charge information in accordance with the requirements of 45 CFR 180.50, and the information encoded is true, accurate, and complete as of the date in the file. This hospital has included all payer-specific negotiated charges in dollars that can be expressed as a dollar amount. For payer-specific negotiated charges that cannot be expressed as a dollar amount in the machine-readable file or not knowable in advance, the hospital attests that the payer-specific negotiated charge is based on a contractual algorithm, percentage or formula that precludes the provision of a dollar amount and has provided all necessary information available to the hospital for the public to be able to derive the dollar amount, including, but not limited to, the specific fee schedule or components referenced in such percentage, algorithm or formula.

(iv) Beginning January 1, 2026, encode the name of the hospital chief executive officer, president, or senior official designated to oversee the encoding of true, accurate, and complete data as directed in in paragraph (a)(3)(iii) of this section.

(b) Required data elements. (1) Prior to July 1, 2024, a hospital must include all of the following corresponding data elements in its list of standard charges, as applicable:

(i) Description of each item or service provided by the hospital.

(ii) Gross charge that applies to each individual item or service when provided in, as applicable, the hospital inpatient setting and outpatient department setting.

(iii) Payer-specific negotiated charge that applies to each item or service when provided in, as applicable, the hospital inpatient setting and outpatient department setting. Each payer-specific negotiated charge must be clearly associated with the name of the third party payer and plan.

(iv) De-identified minimum negotiated charge that applies to each item or service when provided in, as applicable, the hospital inpatient setting and outpatient department setting.

(v) De-identified maximum negotiated charge that applies to each item or service when provided in, as applicable, the hospital inpatient setting and outpatient department setting.

(vi) Discounted cash price that applies to each item or service when provided in, as applicable, the hospital inpatient setting and outpatient department setting.

(vii) Any code used by the hospital for purposes of accounting or billing for the item or service, including, but not limited to, the Current Procedural Terminology (CPT) code, the Healthcare Common Procedure Coding System (HCPCS) code, the Diagnosis Related Group (DRG), the National Drug Code (NDC), or other common payer identifier.

(2) Unless otherwise specified in this paragraph (b)(2), beginning July 1, 2024, each hospital must encode in its machine-readable file all standard charge information, as applicable, for each of the following required data elements:

(i) General data elements, including:

(A) Hospital name, license number, location name(s) and address(es) under the single hospital license to which the list of standard charges applies, and beginning January 1, 2026, Type 2 (organizational) National Provider Identifier(s) (NPI). Location name(s) and address(es) must include, at minimum, all inpatient facilities and stand-alone emergency departments; and

(B) The version number of the CMS template and the date of most recent update to the standard charge information in the machine-readable file.

(ii) Each type of standard charge as defined at § 180.20 (gross charge, discounted cash price, payer-specific negotiated charge, de-identified minimum negotiated charge, and de-identified maximum negotiated charge) and, for payer-specific negotiated charges, the following additional data elements:

(A) Payer and plan names; plan(s) may be indicated as categories (such as “all PPO plans”) when the established payer-specific negotiated charges are applicable to each plan in the indicated category;

(B) Method used to establish the standard charge; and

(C) Whether the standard charge indicated should be interpreted by the user as a dollar amount, or if the standard charge is based on a percentage or algorithm. If the standard charge is based on a percentage or algorithm, the machine-readable file (MRF) must also describe the percentage or algorithm that determines the dollar amount for the item or service, and

(1) Beginning January 1, 2025 through December 31, 2025, calculate and encode an estimated allowed amount in dollars for that item or service; and

(2) Beginning January 1, 2026, calculate and encode the tenth (10th) percentile allowed amount, the median allowed amount, and the ninetieth (90th) percentile allowed amount in dollars for that item or service. Hospitals must also calculate and encode the total number of allowed amount remittances that were used to calculate the 10th percentile allowed amount, median allowed amount, and 90th percentile allowed amount.

(iii) A description of the item or service that corresponds to the standard charge established by the hospital, including:

(A) A general description of the item or service;

(B) Whether the item or service is provided in connection with an inpatient admission or an outpatient department visit; and

(C) Beginning January 1, 2025, for drugs, the drug unit and type of measurement.

(iv) Coding information, including:

(A) Any code(s) used by the hospital for purposes of accounting or billing for the item or service;

(B) Corresponding code type(s). Such code types may include, but are not limited to, the CPT code, the HCPCS code, the DRG, the NDC, Revenue Center Codes (RCC), or other common payer identifier; and

(C) Beginning January 1, 2025, any modifier(s) that may change the standard charge that corresponds to a hospital item or service, including a description of the modifier and how it changes the standard charge.

(c) Format. (1) Prior to July 1, 2024, the information described in paragraph (b)(1) of this section must be published in a single digital file that is in a machine-readable format.

(2) Beginning July 1, 2024, the hospital's machine-readable file must conform to a CMS template layout, data specifications, and data dictionary for purposes of making public the standard charge information required under paragraph (b)(2) of this section.

(d) Location and accessibility. (1) A hospital must select a publicly available website for purposes of making public the standard charge information required under paragraph (b) of this section.

(2) The standard charge information must be displayed in a prominent manner and clearly identified with the hospital location with which the standard charge information is associated.

(3) The hospital must ensure that the standard charge information is easily accessible, without barriers, including but not limited to ensuring the information is accessible:

(i) Free of charge;

(ii) Without having to establish a user account or password;

(iii) Without having to submit personal identifying information (PII); and

(iv) To automated searches and direct file downloads through a link posted on a publicly available website.

(4) The machine-readable file and standard charge information contained in that machine-readable file must be digitally searchable.

(5) The machine-readable file must use the following naming convention specified by CMS, specifically: <ein>_<hospital-name>_standardcharges. [json|csv].

(6) Beginning January 1, 2024, the hospital must ensure that the public website it selects to host its machine-readable file establishes and maintains, in the form and manner specified by CMS:

(i) A .txt file in the root folder that includes:

(A) The hospital location name that corresponds to the machine-readable file;

(B) The source page URL that hosts the machine-readable file;

(C) A direct link to the machine-readable file (the machine-readable file URL); and

(D) Hospital point of contact information.

(ii) A link in the footer on its website, including but not limited to the homepage, that is labeled “Price Transparency” and links directly to the publicly available web page that hosts the link to the machine-readable file.

(e) Frequency of updates. The hospital must update the standard charge information described in paragraph (b) of this section at least once annually.

[84 FR 65602, Nov. 27, 2019, as amended at 86 FR 63998, Nov. 16, 2021; 88 FR 82184, Nov. 22, 2023; 90 FR 54087, Nov. 25, 2025]

§ 180.60 Requirements for displaying shoppable services in a consumer-friendly manner.

(a) General rules. (1) A hospital must make public the standard charges identified in paragraphs (b)(3) through (6) of this section, for as many of the 70 CMS-specified shoppable services that are provided by the hospital, and as many additional hospital-selected shoppable services as is necessary for a combined total of at least 300 shoppable services.

(i) In selecting a shoppable service for purposes of this section, a hospital must consider the rate at which it provides and bills for that shoppable service.

(ii) If a hospital does not provide 300 shoppable services, the hospital must make public the information specified in paragraph (b) of this section for as many shoppable services as it provides.

(2) A hospital is deemed by CMS to meet the requirements of this section if the hospital maintains an internet-based price estimator tool which meets the following requirements.

(i) Provides estimates for as many of the 70 CMS-specified shoppable services that are provided by the hospital, and as many additional hospital-selected shoppable services as is necessary for a combined total of at least 300 shoppable services.

(ii) Allows healthcare consumers to, at the time they use the tool, obtain an estimate of the amount they will be obligated to pay the hospital for the shoppable service.

(iii) Is prominently displayed on the hospital's website and accessible to the public without charge and without having to register or establish a user account or password.

(b) Required data elements. A hospital must include, as applicable, all of the following corresponding data elements when displaying its standard charges (identified in paragraphs (b)(3) through (6) of this section) for its list of shoppable services selected under paragraph (a)(1) of this section:

(1) A plain-language description of each shoppable service.

(2) An indicator when one or more of the CMS-specified shoppable services are not offered by the hospital.

(3) The payer-specific negotiated charge that applies to each shoppable service (and to each ancillary service, as applicable). Each list of payer-specific negotiated charges must be clearly associated with the name of the third party payer and plan.

(4) The discounted cash price that applies to each shoppable service (and corresponding ancillary services, as applicable). If the hospital does not offer a discounted cash price for one or more shoppable services (or corresponding ancillary services), the hospital must list its undiscounted gross charge for the shoppable service (and corresponding ancillary services, as applicable).

(5) The de-identified minimum negotiated charge that applies to each shoppable service (and to each corresponding ancillary service, as applicable).

(6) The de-identified maximum negotiated charge that applies to each shoppable service (and to each corresponding ancillary service, as applicable).

(7) The location at which the shoppable service is provided, including whether the standard charges identified in paragraphs (b)(3) through (6) of this section for the shoppable service apply at that location to the provision of that shoppable service in the inpatient setting, the outpatient department setting, or both.

(8) Any primary code used by the hospital for purposes of accounting or billing for the shoppable service, including, as applicable, the Current Procedural Terminology (CPT) code, the Healthcare Common Procedure Coding System (HCPCS) code, the Diagnosis Related Group (DRG), or other common service billing code.

(c) Format. A hospital has discretion to choose a format for making public the information described in paragraph (b) of this section online.

(d) Location and accessibility of online data. (1) A hospital must select an appropriate publicly available internet location for purposes of making public the information described in paragraph (b) of this section.

(2) The information must be displayed in a prominent manner that identifies the hospital location with which the information is associated.

(3) The shoppable services information must be easily accessible, without barriers, including but not limited to ensuring the information is:

(i) Free of charge.

(ii) Accessible without having to register or establish a user account or password.

(iii) Accessible without having to submit personal identifying information (PII).

(iv) Searchable by service description, billing code, and payer.

(e) Frequency. The hospital must update the standard charge information described in paragraph (b) of this section at least once annually. The hospital must clearly indicate the date that the information was most recently updated.

§ 180.70 Monitoring and enforcement.

(a) Monitoring and assessment. (1) CMS evaluates whether a hospital has complied with the requirements under §§ 180.40, 180.50, and 180.60.

(2) CMS may use methods to monitor and assess hospital compliance with the requirements under this part, including, but not limited to, the following, as appropriate:

(i) CMS' evaluation of complaints made by individuals or entities to CMS.

(ii) CMS review of individuals' or entities' analysis of noncompliance.

(iii) CMS audit and comprehensive review.

(iv) Requiring submission of certification by an authorized hospital official as to the accuracy and completeness of the standard charge information in the machine-readable file.

(v) Requiring submission of additional documentation as may be necessary to make a determination of hospital compliance.

(b) Actions to address hospital noncompliance. If CMS concludes that the hospital is noncompliant with one or more of the requirements of § 180.40, § 180.50, or § 180.60, CMS may take any of the following actions, which generally, but not necessarily, will occur in the following order:

(1) Provide a written warning notice to the hospital of the specific violation(s). CMS will require that a hospital submit an acknowledgement of receipt of the warning notice in the form and manner, and by the deadline, specified in the notice of violation issued by CMS to the hospital.

(2) Request a corrective action plan from the hospital if its noncompliance constitutes a material violation of one or more requirements, according to § 180.80.

(3) Impose a civil monetary penalty on the hospital and publicize the penalty on a CMS website according to § 180.90 if the hospital fails to respond to CMS' request to submit a corrective action plan or comply with the requirements of a corrective action plan.

(c) Actions to address noncompliance of hospitals in health systems. In the event CMS takes an action to address hospital noncompliance (as specified in paragraph (b) of this section) and the hospital is determined by CMS to be part of a health system, CMS may notify health system leadership of the action and may work with health system leadership to address similar deficiencies for hospitals across the health system.

(d) Publicizing assessments, compliance actions, and outcomes. CMS may publicize on its website information related to the following:

(1) CMS' assessment of a hospital's compliance.

(2) Any compliance action taken against a hospital, the status of such compliance action, or the outcome of such compliance action.

(3) Notifications sent to health system leadership.

[84 FR 65602, Nov. 27, 2019, as amended at 88 FR 82185, Nov. 22, 2023]

§ 180.80 Corrective action plans.

(a) Material violations requiring a corrective action plan. CMS determines if a hospital's noncompliance with the requirements of this part constitutes material violation(s) requiring a corrective action plan. A material violation may include, but is not limited to, the following:

(1) A hospital's failure to make public its standard charges required by § 180.40.

(2) A hospital's failure to make public its standard charges in the form and manner required under §§ 180.50 and 180.60.

(b) Notice of violation. CMS may request that a hospital submit a corrective action plan, specified in a notice of violation issued by CMS to a hospital.

(c) Compliance with corrective action plan requests and corrective actions. (1) A hospital required to submit a corrective action plan must do so, in the form and manner, and by the deadline, specified in the notice of violation issued by CMS to the hospital and must comply with the requirements of the corrective action plan.

(2) A hospital's corrective action plan must specify elements including, but not limited to:

(i) The corrective actions or processes the hospital will take to address the deficiency or deficiencies identified by CMS.

(ii) The timeframe by which the hospital will complete the corrective action.

(3) A corrective action plan is subject to CMS review and approval.

(4) After CMS' review and approval of a hospital's corrective action plan, CMS may monitor and evaluate the hospital's compliance with the corrective actions.

(d) Noncompliance with corrective action plan requests and requirements. (1) A hospital's failure to respond to CMS' request to submit a corrective action plan includes failure to submit a corrective action plan in the form, manner, or by the deadline, specified in a notice of violation issued by CMS to the hospital.

(2) A hospital's failure to comply with the requirements of a corrective action plan includes failure to correct violation(s) within the specified timeframes.

§ 180.90 Civil monetary penalties.

(a) Basis for imposing civil monetary penalties. CMS may impose a civil monetary penalty on a hospital identified as noncompliant according to § 180.70, and that fails to respond to CMS' request to submit a corrective action plan or comply with the requirements of a corrective action plan as described in § 180.80(d).

(b) Notice of imposition of a civil monetary penalty. (1) If CMS imposes a penalty in accordance with this part, CMS provides a written notice of imposition of a civil monetary penalty to the hospital via certified mail or another form of traceable carrier.

(2) This notice to the hospital may include, but is not limited to, the following:

(i) The basis for the hospital's noncompliance, including, but not limited to, the following:

(A) CMS' determination as to which requirement(s) the hospital has violated.

(B) The hospital's failure to respond to CMS' request to submit a corrective action plan or comply with the requirements of a corrective action plan, as described in § 180.80(d).

(ii) CMS' determination as to the effective date for the violation(s). This date is the latest date of the following:

(A) The first day the hospital is required to meet the requirements of this part.

(B) If a hospital previously met the requirements of this part but did not update the information annually as required, the date 12 months after the date of the last annual update specified in information posted by the hospital.

(C) A date determined by CMS, such as one resulting from monitoring and assessment activities specified in § 180.70, or development of a corrective action plan as specified in § 180.80.

(iii) The amount of the penalty as of the date of the notice.

(iv) A statement that a civil monetary penalty may continue to be imposed for continuing violation(s).

(v) Payment instructions.

(vi) Intent to publicize the hospital's noncompliance and CMS' determination to impose a civil monetary penalty on the hospital for noncompliance with the requirements of this part by posting the notice of imposition of a civil monetary penalty on a CMS website.

(vii) A statement of the hospital's right to a hearing according to subpart D of this part.

(viii) A statement that the hospital's failure to request a hearing within 30 calendar days of the issuance of the notice permits the imposition of the penalty, and any subsequent penalties pursuant to continuing violations, without right of appeal in accordance with § 180.110.

(3) If the civil monetary penalty is upheld, in part, by a final and binding decision according to subpart D of this part, CMS will issue a modified notice of imposition of a civil monetary penalty, to conform to the adjudicated finding.

(c) Amount of the civil monetary penalty. (1) CMS may impose a civil monetary penalty upon a hospital for a violation of each requirement of this part.

(2) CMS determines the daily dollar amount for a civil monetary penalty for which a hospital may be subject as follows:

(i) For each day during Calendar Year 2021 that a hospital is determined by CMS to be out of compliance, the maximum daily dollar amount for a civil monetary penalty to which the hospital may be subject is $300. Even if the hospital is in violation of multiple discrete requirements of this part, the maximum total sum that a single hospital may be assessed per day is $300.

(ii) Beginning January 1, 2022, for each day a hospital is determined by CMS to be out of compliance:

(A) For a hospital with a number of beds equal to or less than 30, the maximum daily dollar civil monetary penalty amount to which it may be subject is $300, even if the hospital is in violation of multiple discrete requirements of this part.

(B) For a hospital with at least 31 and up to and including 550 beds, the maximum daily dollar civil monetary penalty amount to which it may be subject is the number of beds times $10, even if the hospital is in violation of multiple discrete requirements of this part.

(C) For a hospital with a number of beds greater than 550, the maximum daily dollar civil monetary penalty amount to which it may be subject is $5,500, even if the hospital is in violation of multiple discrete requirements of this part.

(D)(1) CMS will use the most recently available, finalized Medicare hospital cost report to determine the number of beds for a Medicare-enrolled hospital, for purposes of determining the maximum daily dollar civil monetary penalty amount under paragraph (c)(2) of this section.

(2) If the number of beds for the hospital cannot be determined according to paragraph (c)(2)(ii)(D)(1) of this section, CMS will request that the hospital provide documentation of its number of beds, in a form and manner and by the deadline prescribed by CMS in a written notice provided to the hospital. Should the hospital fail to provide CMS with this documentation in the prescribed form and manner, and by the specified deadline, CMS will impose on the hospital the maximum daily dollar civil monetary penalty amount according to paragraph (c)(2)(ii)(C) of this section.

(3) The amount of the civil monetary penalty will be adjusted annually using the multiplier determined by OMB for annually adjusting civil monetary penalty amounts under part 102 of this title.

(4) Except as provided in this paragraph, the amount of a civil monetary penalty is reduced by 35 percent if the hospital submits a written notice to CMS requesting to waive its right to a hearing under § 180.100 within 30-calendar days of the date of the notice of imposition of the civil monetary penalty. A hospital that receives a 35 percent reduction in a civil monetary penalty under this paragraph is not eligible to receive a 35 percent reduction for any subsequent civil monetary penalties imposed pursuant to continuing violations according to § 180.90(f) and also waives its right to appeal under § 180.100 any subsequent civil monetary penalties imposed for such continuing violations. A hospital is not eligible to request that CMS reduce the amount of a civil monetary penalty by 35 percent in accordance with this paragraph if—

(i) The hospital does not request to waive its right to a hearing in accordance with this paragraph; or

(ii) CMS imposed the CMP because the hospital failed to make public an MRF as required at § 180.40(a) or failed to make public a consumer-friendly list of standard charges as required at § 180.40(b).

(d) Timing of payment of civil monetary penalty. (1) A hospital that does not meet the criteria to receive a reduction to the civil monetary penalty that had been imposed upon it as set forth in paragraph (c)(4) of this section must pay the civil monetary penalty in full within 60 calendar days after the date of the notice of imposition of a civil monetary penalty from CMS under paragraph (b) of this section.

(2) A hospital that meets the criteria to receive a reduction to the civil monetary penalty that had been imposed upon it as set forth in paragraph (c)(4) of this section must pay the civil monetary penalty, as reduced in accordance with paragraph (c)(4) of this section, within 60 calendar days after the date of the notice of imposition of a civil monetary penalty from CMS under paragraph (b) of this section.

(3) In the event a hospital requests a hearing, pursuant to subpart D of this part, the hospital must pay the amount in full within 60 calendar days after the date of a final and binding decision, according to subpart D of this part, to uphold, in whole or in part, the civil monetary penalty.

(4) If the 60th calendar day described in paragraphs (d)(1) and (2) of this section is a weekend or a Federal holiday, then the timeframe is extended until the end of the next business day.

(e) Posting of notice. (1) CMS will post the notice of imposition of a civil monetary penalty described in paragraphs (b) and (f) of this section on a CMS website.

(2) In the event that a hospital elects to request a hearing, pursuant to subpart D of this part:

(i) CMS will indicate in its posting, under paragraph (e)(1) of this section, that the civil monetary penalty is under review.

(ii) If the civil monetary penalty is upheld, in whole, by a final and binding decision according to subpart D of this part, CMS will maintain the posting of the notice of imposition of a civil monetary penalty on a CMS website.

(iii) If the civil monetary penalty is upheld, in part, by a final and binding decision according to subpart D of this part, CMS will issue a modified notice of imposition of a civil monetary penalty according to paragraph (b)(3) of this section, to conform to the adjudicated finding. CMS will make this modified notice public on a CMS website.

(iv) If the civil monetary penalty is overturned in full by a final and binding decision according to subpart D of this part, CMS will remove the notice of imposition of a civil monetary penalty from a CMS website.

(f) Continuing violations. CMS may issue subsequent notice(s) of imposition of a civil monetary penalty, according to paragraph (b) of this section, that result from the same instance(s) of noncompliance.

[84 FR 65602, Nov. 27, 2019, as amended at 86 FR 63998, Nov. 16, 2021; 88 FR 82185, Nov. 22, 2023; 90 FR 54088, Nov. 25, 2025]

§ 180.100 Appeal of penalty.

(a) A hospital upon which CMS has imposed a penalty under this part may appeal that penalty in accordance with subpart D of part 150 of this title, except as specified in paragraph (b) of this section.

(b) For purposes of applying subpart D of part 150 of this title to appeals of civil monetary penalties under this part:

(1) Civil money penalty means a civil monetary penalty according to § 180.90.

(2) Respondent means a hospital that received a notice of imposition of a civil monetary penalty according to § 180.90(b).

(3) References to a notice of assessment or proposed assessment, or notice of proposed determination of civil monetary penalties, are considered to be references to the notice of imposition of a civil monetary penalty specified in § 180.90(b).

(4) Under § 150.417(b) of this title, in deciding whether the amount of a civil money penalty is reasonable, the ALJ may only consider evidence of record relating to the following:

(i) The hospital's posting(s) of its standard charges, if available.

(ii) Material the hospital timely previously submitted to CMS (including with respect to corrective actions and corrective action plans).

(iii) Material CMS used to monitor and assess the hospital's compliance according to § 180.70(a)(2).

(5) The ALJ's consideration of evidence of acts other than those at issue in the instant case under § 150.445(g) of this title does not apply.

§ 180.110 Failure to request a hearing.

(a) If a hospital does not request a hearing within 30 calendar days of the issuance of the notice of imposition of a civil monetary penalty described in § 180.90(b), CMS may impose the civil monetary penalty indicated in such notice and may impose additional penalties pursuant to continuing violations according to § 180.90(f) without right of appeal in accordance with this part.

(1) If the 30th calendar day described in this paragraph (a) is a weekend or a Federal holiday, then the timeframe is extended until the end of the next business day.

(2) [Reserved]

(b) The hospital has no right to appeal a penalty with respect to which it has not requested a hearing in accordance with § 150.405 of this title, unless the hospital can show good cause, as determined at § 150.405(b) of this title, for failing to timely exercise its right to a hearing.

§ 182.10 Basis and scope.

This part implements section 3202(b)(1) of the Coronavirus Aid, Relief, and Economic Security Act (Pub. L. 116-136, March 27, 2020) (CARES Act), which requires that during the emergency period declared under section 319 of the PHS Act (42 U.S.C. 247d), providers of diagnostic tests for COVID-19 make public the cash price for such tests on a public internet website of such provider. This part also implements section 3202(b)(2) of the CARES Act, which authorizes the Secretary to impose a civil monetary penalty (CMP) on any provider of a diagnostic test for COVID-19 that does not comply with section 3202(b)(1) of the CARES Act and that has not completed a corrective action plan to comply with that section, in an amount that does not exceed $300 per day that the violation is ongoing.

§ 182.20 Definitions.

The following definitions and abbreviated terms apply to this part:

Cash price means the charge that applies to an individual who pays cash (or cash equivalent) for a COVID-19 diagnostic test.

COVID-19 for purposes of this part is the abbreviated term for the virus called SARS-CoV-2 and the disease it causes, called coronavirus disease 2019.

Diagnostic test for COVID-19 (“COVID-19 diagnostic test”) means a COVID-19 in vitro diagnostic test described in section 6001 of the Families First Coronavirus Response Act (Pub. L. 116-127, March 18, 2020), as amended by section 3201 of the CARES Act (Pub. L. 116-136, March 27, 2020).

Provider of a diagnostic test for COVID-19 (“provider”) means any facility that performs one or more COVID-19 diagnostic tests.

§ 182.30 Applicability.

(a) General applicability. The requirements of this part apply to each provider of a diagnostic test for COVID-19 as defined at § 182.20.

(b) Duration of requirements. The requirements of this part are applicable during the public health emergency (PHE) determined to exist nationwide as of January 27, 2020, by the Secretary of Health and Human Services pursuant to section 319 of the PHS Act on January 31, 2020, as a result of confirmed cases of COVID-19, including any subsequent renewals.

§ 182.40 Requirements for making public cash prices for a diagnostic test for COVID-19.

(a) General rules. (1) Except as provided under paragraph (b) of this section, a provider of a COVID-19 diagnostic test must make public the information described in paragraph (c) of this section electronically via the internet.

(2) The information described in paragraph (c) of this section, or a link to such information, must appear in a conspicuous location on a searchable homepage of the provider's website.

(3) The information described in paragraph (c) of this section must be displayed in a manner that is easily accessible, without barriers, and ensures that the information is accessible:

(i) Free of charge;

(ii) Without having to establish a user account or password; and

(iii) Without having to submit personal identifiable information (PII).

(4) The provider must include all of the following terms on its homepage:

(i) The provider's name;

(ii) The term “price”;

(iii) The term “cost”;

(iv) The term “test”;

(v) The term “COVID”; and

(vi) The term “coronavirus”.

(b) Exception. A provider of a COVID-19 diagnostic test that does not have its own website must make public the information described in paragraph (c) of this section:

(1) In writing, within two business days upon request; and

(2) On a sign posted prominently at the location where the provider offers a COVID-19 diagnostic test, if such location is accessible to the public.

(c) Required information. For purposes of paragraphs (a) and (b) of this section, the provider must make public the following information:

(1) A plain-language description of each COVID-19 diagnostic test that is offered by the provider;

(2) The billing code used for each COVID-19 diagnostic test;

(3) The provider's cash price for each such COVID-19 diagnostic test; and

(4) Any additional information as may be necessary for the public to have certainty of the cash price that applies to each COVID-19 diagnostic test.

§ 182.50 Monitoring and enforcement.

(a) Monitoring. (1) CMS may evaluate whether a provider has complied with the requirements under § 182.40.

(2) CMS may use methods to monitor and assess provider compliance with the requirements under this part, including, but not limited to, the following, as appropriate:

(i) CMS' evaluation of complaints made to CMS.

(ii) CMS review of an individual's or entity's analysis of noncompliance as stated in the complaint.

(iii) CMS review of providers' websites.

(b) Actions to address provider noncompliance. If CMS concludes that the provider is noncompliant with one or more of the requirements of § 182.40, CMS may take any of the following actions:

(1) Provide a written warning notice to the provider of the specific violation(s).

(2) Request that the provider submit and comply with a corrective action plan under § 182.60.

(3) Impose a civil monetary penalty on the provider if the provider fails to respond to CMS' request to submit a corrective action plan or to comply with the requirements of a corrective action plan approved by CMS.

§ 182.60 Corrective action plans.

(a) Violations requiring a corrective action plan. If CMS determines a provider's noncompliance with the requirements of this part continues after a warning notice, a corrective action plan may be required. A violation may include, but is not limited to, the following:

(1) A provider's failure to make public its cash price information required by § 182.40.

(2) A provider's failure to make public its cash price information in the form and manner required under § 182.40.

(b) Notice of violation. CMS may request that a provider submit and comply with a corrective action plan, specified in a notice of violation issued by CMS to a provider.

(c) Compliance with corrective action plan requests and corrective actions. (1) A provider required to submit a corrective action plan must do so, in the form and manner, and by the deadline, specified in the notice of violation issued by CMS to the provider, and must comply with the requirements of the corrective action plan approved by CMS.

(2) A provider's corrective action plan must specify elements including, but not limited to:

(i) The corrective actions or processes the provider will take to address the deficiency or deficiencies identified by CMS.

(ii) The timeframe by which the provider will complete the corrective action.

(3) A corrective action plan is subject to CMS review and approval.

(4) After CMS' review and approval of a provider's corrective action plan, CMS may monitor and evaluate the provider's compliance with the corrective actions specified in the corrective action plan.

(d) Noncompliance with corrective action plan requests and requirements. (1) A provider's failure to respond to CMS' request to submit a corrective action plan includes failure to submit a corrective action plan in the form, manner, or by the deadline, specified in a notice of violation issued by CMS to the provider.

(2) A provider's failure to comply with the requirements of a corrective action plan includes failure to correct violation(s) within the specified timeframes.

§ 182.70 Civil monetary penalties.

(a) Basis for imposing civil monetary penalties. CMS may impose a civil monetary penalty on a provider identified by CMS as noncompliant according to § 182.50, and that fails to respond to CMS' request to submit a corrective action plan or to comply with the requirements of a corrective action plan approved by CMS as described in § 182.60(d).

(b) Notice of imposition of a civil monetary penalty. (1) If CMS imposes a penalty in accordance with this part, CMS will provide a written notice of imposition of a civil monetary penalty to the provider via certified mail or another form of traceable carrier.

(2) This notice to the provider may include, but is not limited to, the following:

(i) The basis for the provider's noncompliance, including, but not limited to, the following:

(A) CMS' determination as to which requirement(s) the provider has violated.

(B) The provider's failure to respond to CMS' request to submit a corrective action plan or comply with the requirements of a corrective action plan, as described in § 182.60(d).

(ii) CMS' determination as to the effective date for the violation(s). This date is the latest date of the following:

(A) The first day the provider is required to meet the requirements of this part.

(B) A date determined by CMS, such as one resulting from monitoring activities specified in § 182.50, or development of a corrective action plan as specified in § 182.60.

(iii) The amount of the penalty as of the date of the notice.

(iv) A statement that a civil monetary penalty may continue to be imposed for continuing violation(s).

(v) Payment instructions.

(vi) A statement of the provider's right to a hearing according to subpart D of this part.

(vii) A statement that the provider's failure to request a hearing within 30 calendar days of the issuance of the notice permits the imposition of the penalty, and any subsequent penalties pursuant to continuing violations, without right of appeal in accordance with § 182.90.

(3) If the civil monetary penalty is upheld, in part, by a final and binding decision according to subpart D of this part, CMS will issue a modified notice of imposition of a civil monetary penalty, to conform to the adjudicated finding.

(c) Amount of the civil monetary penalty. (1) CMS may impose a civil monetary penalty upon a provider for a violation of each requirement of this part.

(2) The maximum daily dollar amount for a civil monetary penalty to which a provider may be subject is $300. Even if the provider is in violation of multiple discrete requirements of this part, the maximum total sum that a single provider may be assessed per day is $300.

(3) The maximum daily amount of the civil monetary penalty will be adjusted annually using the multiplier determined by the Office of Management and Budget for annually adjusting civil monetary penalty amounts under part 102 of this title.

(d) Timing of payment of civil monetary penalty. (1) A provider must pay the civil monetary penalty in full within 60 calendar days after the date of the notice of imposition of a civil monetary penalty from CMS under paragraph (b) of this section.

(2) In the event a provider requests a hearing, pursuant to subpart D of this part, the provider must pay the amount in full within 60 calendar days after the date of a final and binding decision, according to subpart D of this part, to uphold, in whole or in part, the civil monetary penalty.

(3) If the 60th calendar day described in paragraphs (d)(1) and (2) of this section is a weekend or a Federal holiday, then the timeframe is extended until the end of the next business day.

(4) In the event a civil money penalty is not paid in full within 60 days, CMS will follow the collections activities set forth in 45 CFR part 30.

(e) Continuing violations. CMS may issue subsequent notice(s) of imposition of a civil monetary penalty, according to paragraph (b) of this section, that result from the same instance(s) of noncompliance.

§ 182.80 Appeal of penalty.

(a) A provider upon which CMS has imposed a penalty under this part may appeal that penalty in accordance with subpart D of part 150 of this title, except as specified in paragraph (b) of this section.

(b) For purposes of applying subpart D of part 150 of this title to appeals of civil monetary penalties under this part:

(1) “Respondent” means a provider, as defined in § 182.20 that received a notice of imposition of a civil monetary penalty according to § 182.70(b).

(2) In deciding whether the amount of a civil money penalty is reasonable, the administrative law judge (ALJ) may only consider evidence of record relating to the following:

(i) The provider's posting(s) of its cash price information, if available.

(ii) Material the provider timely previously submitted to CMS (including with respect to corrective actions and corrective action plans).

(iii) Material CMS used to monitor and assess the provider's compliance according to § 182.70(a)(2).

(3) The ALJ's consideration of evidence of acts other than those at issue in the instant case under § 150.445(g) of this title does not apply.

§ 182.90 Failure to request a hearing.

(a) If a provider does not request a hearing within 30 calendar days of the issuance of the notice of imposition of a civil monetary penalty described in § 182.70(b), CMS may impose the civil monetary penalty indicated in such notice without right of appeal in accordance with this part.

(1) If the 30th calendar day described paragraph (a) of this section is a weekend or a Federal holiday, then the timeframe is extended until the end of the next business day.

(2) [Reserved]

(b) The provider has no right to appeal a penalty with respect to which it has not requested a hearing in accordance with § 150.405 of this title, unless the provider can show good cause, as determined at § 150.405(b) of this title, for failing to timely exercise its right to a hearing.

§ 184.10 Basis and scope.

(a) Basis. (1) This part implements section 1150A, Pharmacy Benefit Managers Transparency Requirements, of title XI of the Social Security Act.

(2) [Reserved]

(b) Scope. This part establishes standards for Pharmacy Benefit Managers that administer prescription drug benefits for health insurance issuers that offer Qualified Health Plans with respect to the offering of such plans.

§ 184.20 Definitions.

The following definitions apply to this part, unless the context indicates otherwise:

Health insurance issuer has the meaning given to the term in § 144.103 of this subtitle.

Plan year has the meaning given to the term in § 156.20 of this subchapter.

Qualified health plan has the meaning given to the term in § 156.20 of this subchapter.

Qualified health plan issuer has the meaning given to the term in § 156.20 of this subchapter.

§ 184.50 Prescription drug distribution and cost reporting by pharmacy benefit managers.

(a) General requirement. In a form, manner, and at such times specified by HHS, any entity that provides pharmacy benefits management services on behalf of a qualified health plan (QHP) issuer must provide to HHS the following information:

(1) The percentage of all prescriptions that were provided under the QHP through retail pharmacies compared to mail order pharmacies, and the percentage of prescriptions for which a generic drug was available and dispensed compared to all drugs dispensed;

(2) The aggregate amount, and the type of rebates, discounts or price concessions (excluding bona fide service fees) that the pharmacy benefits manager (PBM) negotiates that are attributable to patient utilization under the QHP, and the aggregate amount of the rebates, discounts, or price concessions that are passed through to the QHP issuer, and the total number of prescriptions that were dispensed.

(i) Bona fide service fees means fees paid by a manufacturer to an entity that represent fair market value for a bona fide, itemized service actually performed on behalf of the manufacturer that the manufacturer would otherwise perform (or contract for) in the absence of the service arrangement, and that are not passed on in whole or in part to a client or customer of an entity, whether or not the entity takes title to the drug.

(ii) [Reserved]

(3) The aggregate amount of the difference between the amount the QHP issuer pays its contracted PBM and the amounts that the PBM pays retail pharmacies, and mail order pharmacies, and the total number of prescriptions that were dispensed.

(b) Limitations on disclosure. Information disclosed by a PBM under this section shall not be disclosed by HHS or by a QHP receiving the information, except that HHS may disclose the information in a form which does not disclose the identity of a specific PBM, QHP, or prices charged for drugs, for the following purposes:

(1) As HHS determines to be necessary to carry out section 1150A or part D of title XVIII of the Act;

(2) To permit the Comptroller General to review the information provided;

(3) To permit the Director of the Congressional Budget Office to review the information provided; or

(4) To States to carry out section 1311 of the Affordable Care Act.

(c) Penalties. A PBM that fails to report the information described in paragraph (a) of this section to HHS on a timely basis or knowingly provides false information will be subject to the provisions of section 1927(b)(3)(C) of the Act.

§§ 201.0-201.1 [Reserved]

§ 201.2 General.

The State plan is a comprehensive statement submitted by the State agency describing the nature and scope of its program and giving assurance that it will be administered in conformity with the specific requirements stipulated in the pertinent title of the Act, the regulations in subtitle A and this chapter of this title, and other applicable official issuances of the Department. The State plan contains all information necessary for the Administration to determine whether the plan can be approved, as a basis for Federal financial participation in the State program.

[35 FR 12180, July 29, 1970, as amended at 53 FR 36578, Sept. 21, 1988]

§§ 201.3-201.7 [Reserved]

§§ 201.10-201.15 [Reserved]

§ 201.66 Repayment of Federal funds by installments.

(a) Basic conditions. When a State has been reimbursed Federal funds for expenditures claimed under titles I, IV-A, X, XIV, XVI (AABD) which are later determined to be unallowable for Federal financial participation, the State may make repayment of such Federal funds in installments provided:

(1) The amount of the repayment exceeds 2 1/2 percent of the estimated annual State share for the program in which the unallowable expenditure occurred as set forth in paragraph (b) of this section; and

(2) The State has notified the Regional Administrator in writing of its intent to make installment repayments. Such notice must be given prior to the time repayment of the total was otherwise due.

(b) Criteria governing installment repayments. (1) The number of quarters over which the repayment of the total unallowable expenditures will be made will be determined by the percentage the total of such repayment is of the estimated State share of the annual expenditures for the specific program against which the recovery is made, as follows:

Total repayment amount as percentage of State share of annual expenditures for the specific program | Number of quarters to make repayment

2.5 pct. or less | 1

Greater than 2.5, but not greater than 5 | 2

Greater than 5, but not greater than 7.5 | 3

Greater than 7.5, but not greater than 10 | 4

Greater than 10, but not greater than 15 | 5

Greater than 15, but not greater than 20 | 6

Greater than 20 but not greater than 25 | 7

Greater than 25, but not greater than 30 | 8

Greater than 30, but not greater than 47.5 | 9

Greater than 47.5, but not greater than 65 | 10

Greater than 65, but not greater than 82.5 | 11

Greater than 82.5, but not greater than 100 | 12

The quarterly repayment amounts for each of the quarters in the repayment schedule shall not be less than the following percentages of the estimated State share of the annual expenditures for the program against which the recovery is made.

For each of the following quarters | Repayment installment may not be less than these percentages

1 to 4 | 2.5

5 to 8 | 5.0

9 to 12 | 17.5

If the State chooses to repay amounts representing higher percentages during the early quarters, any corresponding reduction in required minimum percentages would be applied first to the last scheduled payment, then to the next to the last payment, and so forth as necessary.

(2) The latest State Agency Statement of Financial Plan for AFDC submitted by the State shall be used to estimate the State's share of annual expenditures for the specific program in which the unallowable expenditures occurred. That estimated share shall be the sum of the State's share of the estimates (as shown on the latest State Agency Statement of Financial Plan for AFDC) for four quarters, beginning with the quarter in which the first installment is to be paid.

(3) In the case of a program terminated by law or by the State, the actual State share—rather than the estimate—shall be used for determining whether the amount of the repayment exceeds 2 1/2% of the annual State share for the program. The annual State share in these cases will be determined using payments computable for Federal funding as reported for the program by the State on its Quarterly Statement of Expenditures reports submitted for the last four quarters preceding the date on which the program was terminated.

(4) Repayment shall be accomplished through adjustment in the quarterly grants over the period covered by the repayment schedule.

(5) The amount of the repayment for purpose of paragraphs (a) and (b) of this section may not include any amount previously approved for installment repayment.

(6) The repayment schedule may be extended beyond 12 quarterly installments if the total repayment amount exceeds 100% of the estimated State share of annual expenditures. In these circumstances, the criteria in paragraphs (b) (1) and (2) or (3) of this section, as appropriate, shall be followed for repayment of the amount equal to 100% of the annual State share. The remaining amount of the repayment shall be in quarterly amounts not less than those for the 9th through 12th quarters.

(7) The amount of a retroactive claim to be paid a State will be offset against any amounts to be, or already being, repaid by the State in installments, under the same title of the Social Security Act. Under this provision the State may choose to:

(i) Suspend payments until the retroactive claim due the State has, in fact, been offset; or

(ii) Continue payments until the reduced amount of its debt (remaining after the offset), has been paid in full. This second option would result in a shorter payment period. A retroactive claim for the purpose of this regulation is a claim applicable to any period ending 12 months or more prior to the beginning of the quarter in which the payment is to be made by the Administration.

[42 FR 28884, June 6, 1977, as amended at 47 FR 7669, Feb. 22, 1982; 52 FR 273, Jan. 5, 1987; 53 FR 36579, Sept. 21, 1988]

§ 201.67 [Reserved]

§ 201.70 [Reserved]

§ 205.5 [Reserved]

§ 205.10 [Reserved]

§ 205.25 [Reserved]

§ 205.30 [Reserved]

§ 205.32 [Reserved]

§§ 205.35-205.38 [Reserved]

§ 205.44-205.45 [Reserved]

§ 205.50 Safeguarding information for the financial assistance programs.

(a) State plan requirements. A State plan for financial assistance under title IV-A of the Social Security Act, must provide that:

(1) Pursuant to State statute which imposes legal sanctions:

(i) The use or disclosure of information concerning applicants and recipients will be limited to purposes directly connected with:

(A) The administration of the plan of the State approved under title IV-A, the plan or program of the State under title IV-B, IV-D, IV-E, or IV-F or under title I, X, XIV, XVI (AABD), XIX, XX, or the Supplemental Security Income (SSI) program established by title XVI. Such purposes include establishing eligibility, determining the amount of assistance, and providing services for applicants and recipients.

(B) Any investigation, prosecution, or criminal or civil proceeding conducted in connection with the administration of any such plans or programs.

(C) The administration of any other Federal or federally assisted program which provides assistance, in cash or in kind, or services, directly to individuals on the basis of need.

(D) The verification to the Employment Security Agency, or other certifying agency that an individual has been an AFDC recipient for at least 90 days or is a WIN or WIN Demonstration participant pursuant to Pub. L. 97-34, the Economic Recovery Tax Act of 1981.

(E) Any audit or similar activity, e.g., review of expenditure reports or financial review, conducted in connection with the administration of any such plan or program by any governmental entity which is authorized by law to conduct such audit or activity.

(F) The administration of a State unemployment compensation program.

(G) The reporting to the appropriate agency or official of information on known or suspected instances of physical or mental injury, sexual abuse or exploitation, or negligent treatment or maltreatment of a child receiving aid under circumstances which indicate that the child's health or welfare is threatened.

(ii) The State agency has authority to implement and enforce the provisions for safeguarding information about applicants and recipients:

(iii) Disclosure of any information that identifies by name or address any applicant or recipient to any Federal, State, or local committee or legislative body other than in connection with any activity under paragraph (a)(1)(i)(E) of this section is prohibited.

(iv) Publication of lists or names of applicants and recipients will be prohibited. Exception. In respect to a State plan for financial assistance under title I, IVA, X, XIV, or XVI (AABD) of the Social Security Act, an exception to this restriction may be made by reason of the enactment or enforcement of State legislation, prescribing any conditions under which public access may be had to records of the disbursement of funds or payments under such titles within the State, if such legislation prohibits the use of any list or names obtained through such access to such records for commercial or political purposes.

(v) The State or local agency responsible for the administration of the State plan has authority to disclose the current address of a recipient to a State or local law enforcement officer at his or her request. Such information is disclosed only to law enforcement officers who provide the name and Social Security number of the recipient and satisfactorily demonstrate that:

(A) The recipient is a fugitive felon (as defined by the State);

(B) The location or apprehension of such felon is within the law officer's official duties; and

(C) The request is made in the proper exercise of those duties.

(2) The agency will have clearly defined criteria which govern the types of information that are safeguarded and the conditions under which such information may be released or used. Under this requirement:

(i) Types of information to be safeguarded include but are not limited to:

(A) The names and addresses of applicants and recipients and amounts of assistance provided (unless excepted under paragraph (a)(1)(iv) of this section);

(B) Information related to the social and economic conditions or circumstances of a particular individual including information obtained from any agency pursuant to § 205.55; information obtained from the Internal Revenue Service (IRS) and the Social Security Administration (SSA) must be safeguarded in accordance with procedures set forth by those agencies;

(C) Agency evaluation of information about a particular individual;

(D) Medical data, including diagnosis and past history of disease or disability, concerning a particular individual.

(ii) The release or use of information concerning individuals applying for or receiving financial assistance is restricted to persons or agency representatives who are subject to standards of confidentiality which are comparable to those of the agency administering the financial assistance programs.

(iii) Except in the case of information requested pursuant to §§ 205.55 and 205.56, or in the case of an emergency situation when the individual's prior consent for the release of information cannot be obtained, the family or individual is informed whenever possible of a request for information from an outside source, and permission is obtained to meet the request. In an emergency situation when the individual's consent for the release of information cannot be obtained, the individual will be notified immediately.

(iv) In the event of the issuance of a subpoena for the case record or for any agency representative to testify concerning an applicant or recipient, the court's attention is called, through proper channels to the statutory provisions and the policies or rules and regulations against disclosure of information.

(v) The same policies are applied to requests for information from a governmental authority, the courts, or a law enforcement officer (except as provided for under paragraph (a)(1)(v) with respect to fugitive felons) as from any other outside source.

(3)(i) The agency will publicize provisions governing the confidential nature of information about applicants and recipients, including the legal sanctions imposed for improper disclosure and use, and will make these provisions available to applicants and recipients and to other persons and agencies to whom information is disclosed.

(ii) All information obtained pursuant to the income and eligibility verification requirements at §§ 205.55 and 205.56 will be stored and processed so that no unauthorized personnel can acquire or retrieve the information by any means.

(iii) All persons with access to information obtained pursuant to the income and eligibility verification requirements under §§ 205.55 and 205.56 will be advised of the circumstances under which access is permitted and the sanctions imposed for illegal use or disclosure of the information.

(4) All materials sent or distributed to applicants, recipients, or medical vendors, including material enclosed in envelopes containing checks, will be limited to those which are directly related to the administration of the program and will not have political implications except to the extent required to implement the National Voter Registration Act of 1993 (NVRA), Pub. L. 103-31. Under this requirement:

(i) Specifically excluded from mailing or distribution are materials such as “holiday” greetings, general public announcements, alien registration notices, and partisan voting information.

(ii) Not prohibited from such mailing or distribution are materials in the immediate interest of the health and welfare of applicants and recipients, such as announcements of free medical examinations, availability of surplus food, and consumer protection information;

(iii) Only the names of persons directly connected with the administration of the program are contained in material sent or distributed to applicants, recipients, and vendors, and such persons are identified only in their official capacity with the State or local agency.

(iv) Under NVRA, the agency must distribute voter information and registration materials as specified in NVRA.

(b) Voluntary voter registration activities. For States that are exempt from the requirements of NVRA, voter registration may be a voluntary activity so long as the provisions of section 7(a)(5) of NVRA are observed.

(c) State plan requirements for programs of financial assistance in Puerto Rico, the Virgin Islands, and Guam. A State plan under title I, X, XIV, or XVI (AABD) of the Social Security Act must meet all the requirements of paragraph (a) of this section, with the exception of paragraphs (a)(1)(i) (D) and (E), of this section, and also provide for disclosure of information concerning applicants and recipients for use by public officials who require such information in connection with their official duties. Under this requirement, such information shall be available only to public officials who certify in writing that:

(1) They are public officials as defined by State or Federal law of general applicability; and

(2) The information to be disclosed and used is required in connection with their official duties.

[45 FR 56684, Aug. 25, 1980, as amended at 47 FR 46506, Oct. 19, 1982; 49 FR 35599, Sept. 10, 1984; 51 FR 7214, Feb. 28, 1986; 51 FR 9203, Mar. 18, 1986; 54 FR 42243, Oct. 13, 1989; 57 FR 30157, July 8, 1992; 58 FR 49220, Sept. 22, 1993; 59 FR 26142, May 19, 1994; 61 FR 58143, Nov. 13, 1996]

§ 205.51 Income and eligibility verification requirements.

(a) A State plan under title I, IV-A, X, XIV or XVI (AABD) of the Social Security Act must provide that there be an Income and Eligibility Verification System in the State. Income and Eligibility Verification System (IEVS) means a system through which the State agency:

(1) Co-ordinates data exchanges with other Federally-assisted benefit programs covered by section 1137(b) of the Act;

(2) Requests and uses income and benefit information as specified in section 1137(a)(2) of the Act and §§ 205.55 and 205.56; and

(3) Adheres to standardized formats and procedures in exchanging information with the other programs and agencies and in providing such information as may be useful to assist Federal, State and local agencies in the administration of the child support program and the Social Security Administration in the administration of the title II and title XVI (SSI) programs. The State agency (UC) information from the State Wage Information Collection Agency, described in paragraph (b) of this section; from the agency administering the State's unemployment compensation program (UC) under section 3304 of the Internal Revenue Code; from agencies in other States cited in § 205.55(a)(5), as set forth by the Secretary; from SSA, as set forth by the Commissioner of Social Security; and from IRS, as set forth by the Commissioner of Internal Revenue.

(b) A State plan under title I, IV-A, X, XIV or XVI (AABD) of the Social Security Act must provide that, as part of its Income and Eligibility Verification System, there be a State Wage Information Collection Agency in the State. State Wage Information Collection Agency (SWICA) means the State agency receiving quarterly wage reports from employers in the State (which may be the agency administering the State's unemployment compensation program), or an alternative system which has been determined by the Secretary of Labor, in consultation with the Secretary of Agriculture and the Secretary of Health and Human Services, to be as effective and timely in providing employment related income and eligibility information.

(c) Wage information maintained by a SWICA which receives quarterly wage reports from employers but does not use these reports for computation of employment compensation shall:

(1) Contain the social security number, first and last name and middle initial, wages earned for the period of the report, and an identifier of the employer (such as name and address) for each employee;

(2) Include all employers covered by the State's UC law and require such employers to report wage information (as specified above) for each employee within 30 days from the end of each calendar quarter;

(3) Accumulate earnings reported by employers for periods no longer than calendar quarters;

(4) Be machine readable; i.e., maintained in a fashion that permits automated processing; and

(5) Be available to other agencies in the State, to agencies in other States, and to Social Security Administration for establishing or verifying eligibility and benefit amounts under titles II and XVI of the Social Security Act, pursuant to agreements as required in § 205.58.

(d) A State shall obtain prior written approval from the Department, where appropriate, in accordance with 45 CFR 95.611, for any new developmental costs for automatic data processing equipment and services incurred in meeting IEVS requirements.

[51 FR 7214, Feb. 28, 1986]

§ 205.52 Furnishing of social security numbers.

The State plan under title I, IV-A, X, XIV, or CVI (AABD) of the Social Security Act must provide that:

(a) As a condition of eligibility, each applicant for or recipient of aid will be required:

(1) To furnish to the State or local agency a social security account number, hereinafter referred to as the SSN (or numbers, if more than one has been issued); and

(2) If he cannot furnish a SSN (either because such SSN has not been issued or is not known), to apply for such number through procedures adopted by the State or local agency with the Social Security Administration. If such procedures are not in effect, the applicant or recipient shall apply directly for such number, submit verification of such application, and provide the number upon its receipt.

(b) The State or local agency will assist the applicant or recipient in making applications for SSNs and will comply with the procedures and requirements established by the Social Security Administration for application, issuance, and verification of social security account numbers.

(c) The State or local agency will not deny, delay, or discontinue assistance pending the issuance or verfication of such numbers if the applicant or recipient has complied with the requirements of paragraph (a) of this section.

(d) The State or local agency will use such account numbers, in addition to any other means of identification it may determine to employ, in the administration of the plan.

(e) “Applicant” and “recipient” include for the purposes of this section the individuals seeking or receiving assistance and any other individual whose needs are considered in determining the amount of assistance.

(f) The State or local agency shall notify the applicant or recipient that the furnishing of the SSN is a condition of eligibility for assistance required by section 1137 of the Social Security Act and that the SSN will be utilized in the administration of the program.

(g) The State agency will submit all unverified social security numbers to the Social Security Administration (SSA) for verification. The State agency may accept as verified a social security number provided directly to the State agency by SSA or by another Federal or federally-assisted benefit program which has received the number from SSA or has submitted it to SSA for verification.

[51 FR 7217, Feb. 28, 1986]

§ 205.55 Requirements for requesting and furnishing eligibility and income information.

A State plan under title I, IV-A, X, XIV, or XVI (AABD) of the Social Security Act must provide that:

(a) Except as provided in paragraph (b), the State agency will request through the IEVS:

(1) Wage information from the SWICA for all applicants at the first opportunity following receipt of the application and for all recipients on a quarterly basis.

(2) Unemployment compensation information from the agency administering the State's unemployment compensation program under section 3304 of the Internal Revenue Code of 1954 and section 303 of the Act as follows:

(i) For applicants at the first opportunity following receipt of the application and in each of the first three months in which the individual is receiving aid, unless the individual is found to be receiving unemployment compensation, in which case the information will be requested until benefits are exhausted; and

(ii) In each of the first three months following any recipient-reported loss of employment, unless the individual is found to be receiving unemployment compensation, in which case the information will be requested until the benefits are exhausted.

(3) All available information maintained by the Social Security Administration for all applicants at the first opportunity following receipt of the application in the manner set forth by the Commissioner of Social Security. The State agency will also request such information for all recipients as of the effective date of this provision for whom such information has not previously been requested.

(4) Unearned income information from the Internal Revenue Service available under section 6103 (l)(7)(B) of the Internal Revenue Code of 1954, for all applicants at the first opportunity following receipt of the application for all recipients on a yearly basis. The request shall be made at the time and in the manner set forth by the Commissioner of Internal Revenue.

(5) As necessary, any income or other information affecting eligibility available from agencies in the State or other States administering:

(i) An AFDC program (in another State) under title IV-A of the Social Security Act;

(ii) A Medicaid program under title XIX of the Social Security Act;

(iii) An unemployment compensation program (in another State) under section 3304 of the Internal Revenue Code of 1954;

(iv) A Food Stamp program under the Food Stamp Act of 1977, as amended;

(v) Any State program administered under plan approved under title I, X, XIV, or XVI (AABD) of the Social Security Act; and

(vi) A SWICA (in another State).

(b)(1) With respect to individuals who cannot furnish an SSN at application, information specified in paragraph (a) will be requested at the first opportunity provided by each source after the State agency is provided with the SSN.

(2) For the purposes of this section, applicants and recipients shall also include any other individuals whose income or resources are considered in determining the amount of assistance, if the State agency has obtained the SSN of such individuals.

(c) The State agency must furnish, when requested, income, eligibility and benefit information to:

(1) Agencies in the State or other States administering the programs cited in paragraph (a)(5) of this section, in accordance with specific agreements as described in § 205.58;

(2) The agency in the State or other States administering a program under title IV-D of the Social Security Act; and

(3) The Social Security Administration for purposes of establishing or verifying eligibility or benefit amounts under title II and XVI (SSI) of the Social Security Act.

(d) The Secretary may, based upon application from a State, permit a State to obtain and use income and eligibility information from an alternate source or sources in order to meet any requirement of paragraph (a) of this section. The State agency must demonstrate to the Secretary that the alternate source or sources is as timely, complete and useful for verifying eligibility and benefit amounts. The Secretary will consult with the Secretary of Agriculture and the Secretary of Labor prior to approval of a request. The State must continue to meet the requirements of this section unless the Secretary has approved the request.

(e) The State agency must, upon request, reimburse another agency for reasonable costs incurred in furnishing income and eligibility information as prescribed in this section, including new developmental costs associated with furnishing such information, in accordance with specific agreements as described in § 205.58.

[51 FR 7215, Feb. 28, 1986]

§ 205.56 Requirements governing the use of income and eligibility information.

A State plan under title I, IV-A, X, XIV, or XVI (AABD) of the Social Security Act must provide that:

(a) The State agency will use the information obtained under § 205.55, in conjunction with other information, for:

(1) Determining individuals' eligibility for assistance under the State plan and determining the amount of assistance. States wishing to exclude categories of information items from follow-up must submit for the Secretary's approval a follow-up plan describing the categories of information items which it proposes to exclude. For each category, the State must provide a reasonable justification that follow-up is not cost-effective. A formal cost-benefit analysis is not required. A State may exclude information items from the following data sources without written justification if followed up previously from another source: Unemployment compensation information received from the Internal Revenue Service, and earnings information received from the Social Security Administration. Information items in these categories which are not duplicative, but provide new leads, may not be excluded without written justification. A State may submit a follow-up plan or alter its plan at any time by notifying the Secretary and submitting the necessary justification. The Secretary will approve or disapprove categories of information items to be excluded under the plan within 60 days of its submission. Those categories approved by the Secretary will constitute an approved State follow-up plan for IEVS. For those information items not excluded from follow-up,

(i) The State agency shall review and compare the information obtained from each data exchange against information contained in the case record to determine whether it affects the applicant's or the recipient's eligibility or the amount of assistance.

(ii) The State agency shall verify that the information is accurate and applicable to case circumstances either through the applicant or recipient or through a third party, if such verification is determined appropriate based on agency experience or is required under paragraph (b) of this section.

(iii) For applicants, if the information is received during the application period, the State agency shall use such information, to the extent possible, in making the eligibility determination.

(iv) For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if:

(A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and

(B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession.

(v) The State agency shall use appropriate procedures to monitor the timeliness requirements specified in this subparagraph;

(2) Investigations to determine whether recipients received assistance under the State plan to which they were not entitled; and

(3) Criminal or civil prosecutions based on receipt of assistance under the State plan to which recipients were not entitled.

(b)(1) State agencies shall not take any adverse action to terminate, deny, suspend or reduce benefits to an applicant or recipient, based on information produced by a Federal computer matching program that is subject to the requirements in the Computer Matching and Privacy Protection Act (CMPPA) unless (i) The information has been independently verified in accordance with the independent verification requirements set out in the State agency's written agreement as required by § 205.58 or (ii) The independent verification requirement has been waived by the Department's Data Integrity Board.

(2) The CMPPA defines a matching program as any computerized comparison of (i) Two or more automated systems of records or a system of records with non-Federal records for the purpose of (A) Establishing or verifying the eligibility of, or continuing compliance with statutory and regulatory requirements by, applicants for, recipients or beneficiaries of, participants in, or providers of services with respect to, cash or in-kind assistance or payments under Federal benefit programs, or (B) Recouping payments or delinquent debts under such Federal benefit programs, or (ii) Two or more automated Federal personnel or payroll system of records or a system of Federal personnel or payroll record with non-Federal records.

(c) If the agency intends to reduce, suspend, terminate or deny benefits as a result of the actions taken pursuant to this section, the agency must provide notice and the opportunity for a fair hearing in accordance with § 205.10(a).

[51 FR 7215, Feb. 28, 1986, as amended at 53 FR 52712, Dec. 29, 1988; 57 FR 53859, Nov. 13, 1992]

§ 205.57 Maintenance of a machine readable file; requests for income and eligibility information.

A State plan under title I, IV—A, X, XIV, or XVI (AABD) of the Social Security Act must provide that:

(a) The State agency will maintain a file which is machine readable, i.e., which is maintained in a fashion that permits automated processing, and which contains the first and last name and verified social security number of each person applying for or receiving assistance under the plan.

(b) The State agency will use this file to exchange data with other agencies pursuant to § 205.55.

[51 FR 7216, Feb. 28, 1986]

§ 205.58 Income and eligibility information; specific agreements required between the State agency and the agency supplying the information.

(a) A State plan under title I, IV-A, X, XIV, or XVI (AABD) of the Social Security Act must provide that, in carrying out the requirements of §§ 205.55 and 205.56, the State agency will enter into specific written agreements as described in paragraph (b) of this section with those agencies providing income and eligibility information. Agreements with Federal agencies are subject to the approval by the appropriate Federal Data Integrity Boards. The agreements will contain the procedure to be used in requesting and providing information.

(b) These agreements will include, but need not be limited to, the following:

(1) Purpose of the request;

(2) Identification of all agency officials, by position with authority to request information;

(3) Methods and timing of the requests for information, including the machine readable format to be used, the period of time needed to furnish the requested information and the basis for establishing this period. Agreements with the SWICA and the agency administering the Unemployment Compensation program in the State must provide that the State agency shall obtain information no less frequently than twice monthly;

(4) The type of information and reporting periods for which information will be provided and the verification methodologies to be used;

(5) Safeguards limiting release or redisclosure as required by Federal or State law or regulation, including the requirements of § 205.50 and as may be required by guidelines issued by the Secretary; and

(6) Reimbursement, if any, for the costs of furnishing the information requested by the State agency, including new developmental costs associated with furnishing such information.

[51 FR 7216, Feb. 28, 1986, as amended at 57 FR 53860, Nov. 13, 1992]

§ 205.60 Reports and maintenance of records.

A State plan under title I, IV—A, X, XIV, or XVI (AABD) of the Social Security Act must provide that:

(a) The State agency will maintain or supervise the maintenance of records necessary for the proper and efficient operation of the plan, including records regarding applications, determination of eligibility, the provision of financial assistance, and the use of any information obtained under § 205.55, with respect to individual applications denied, recipients whose benefits have been terminated, recipients whose benefits have been modified, and the dollar value of these denials, terminations and modifications. Under this requirement, the agency will keep individual records which contain pertinent facts about each applicant and recipient. The records will include information concerning the date of application and the date and basis of its disposition; facts essential to the determination of initial and continuing eligibility (including the individual's social security number, need for, and provision of financial assistance); and the basis for discontinuing assistance.

(b) The agency shall report as the Secretary prescribes for the purpose of determining compliance with the requirements of §§ 205.55 and 205.56 and for evaluating the effectiveness of the Income and Eligibility Verification System.

[51 FR 7216, Feb. 28, 1986]

§ 205.70 [Reserved]

§§ 205.100-205.101 [Reserved]

§ 205.120 [Reserved]

§ 205.130 [Reserved]

§ 205.150 [Reserved]

§ 205.160 [Reserved]

§ 205.170 [Reserved]

§ 205.190 [Reserved]

§ 206.10 Application, determination of eligibility and furnishing of assistance.

(a) State plan requirements. A State plan under title I, IV-A, X, XIV, or XVI(AABD), of that Social Security Act shall provide that:

(1) Each individual wishing to do so shall have the opportunity to apply for assistance under the plan without delay. Under this requirement:

(i) Each individual may apply under whichever of the State plan plans he chooses;

(ii) The agency shall require a written application, signed under a penalty of perjury, on a form prescribed by the State agency, from the applicant himself, or his authorized representative, or, where the applicant is incompetent or incapacitated, someone acting responsibly for him. When an individual is required to be included in an existing assistance unit pursuant to paragraph (a)(1)(vii), such individual will be considered to be included in the application, as of the date he is required to be included in the assistance unit;

(iii) An applicant may be assisted, if he so desires, by an individual(s) of his choice (who need not be a lawyer) in the various aspects of the application process and the redetermination of eligibility and may be accompanied by such individual(s) in contacts with the agency and when so accompanied may also be represented by them.

(iv)-(v) [Reserved]

(vi) Every recipient in a State which provides a supplemental payment under § 233.27 of this chapter shall have an opportunity to request that payment without delay.

(vii) For AFDC only, in order for the family to be eligible, an application with respect to a dependent child must also include, if living in the same household and otherwise eligible for assistance:

(A) Any natural or adoptive parent, or stepparent (in the case of States with laws of general applicability); and

(B) Any blood-related or adoptive brother or sister; Exception: needs and income of disqualified alien siblings, pursuant to § 233.50(c), are not considered in determining the eligibility and payment of an otherwise eligible dependent child.

(2)(i) Applicants shall be informed about the eligibility requirements and their rights and obligations under the program. Under this requirement individuals are given information in written form, and orally as appropriate, about coverage, conditions of eligibility, scope of the program, and related services available, and the rights and responsibilities of applicants for and recipients of assistance. Specifically developed bulletins or pamphlets explaining the rules regarding eligibility and appeals in simple, understandable terms are publicized and available in quantity.

(ii) Procedures shall be adopted which are designed to assure that recipients make timely and accurate reports of any change in circumstances which may affect their eligibility or the amount of assistance.

(iii) All applicants for and recipients of assistance shall be notified in writing at the time of application and on redetermination that eligibility and income information will be regularly requested from agencies specified in § 205.55 and will be used to aid in determining their eligibility for assistance.

(3) A decision shall be made promptly on applications, pursuant to reasonable State-established time standards not in excess of:

(i) 45 days for OAA, AFDC, AB, AABD (for aged and blind); and

(ii) 60 days for APTD, AABD (for disabled). Under this requirement, the applicant is informed of the agency's time standard in acting on applications which covers the time from date of application under the State plan to the date that the assistance check, or notification of denial of assistance or change of award is mailed to the applicant or recipient. The State's time standards apply except in unusual circumstances (e.g., where the agency cannot reach a decision because of failure or delay on the part of the applicant or an examining physician, or because of some administrative or other emergency that could not be controlled by the agency), in which instances the case record shows the cause for the delay. The agency's standards of promptness for acting on applications or redetermining eligibility shall not be used as a waiting period before granting aid, or as a basis for denial of an application or for terminating assistance.

(4) Adequate notice shall be sent to applicants and recipients to indicate that assistance has been authorized (including the amount of financial assistance) or that it has been denied or terminated. Under this requirement, adequate notice means a written notice that contains a statement of the action taken, and the reasons for and specific regulations supporting such action, and an explanation of the individual's right to request a hearing.

(5)(i) Financial assistance and medical care and services included in the plan shall be furnished promptly to eligible individuals without any delay attributable to the agency's administrative process, and shall be continued regularly to all eligible individuals until they are found to be ineligible. Under this requirement there must be arrangements to assist applicants and recipients in obtaining medical care and services in emergency situations on a 24-hour basis, 7 days a week.

(ii) Assistance will not be denied, delayed, or discontinued pending receipt of income or other information requested under § 205.55, if other evidence establishes the individual's eligibility for assistance.

(6) Assistance shall begin as specified in the State plan, which:

(i) For financial assistance.

(A) Must be no later than:

(1) The date of authorization of payment, or

(2) Thirty days in OAA, AFDC, AB, and AABD (as to the aged and blind), and 60 days in APTD and AABD (as to the disabled), from the date of receipt of a signed and completed application form, whichever is earlier: Provided, That the individuals then met all the eligibility conditions, and

(B) For purposes of Federal financial participation in OAA, AB, APTD, and AABD, may be as early as the first of the month in which an application has been received and the individual meets all the eligibility conditions; and

(C) In AFDC, for purposes of Federal financial participation, may be as early as the date of application provided that the assistance unit meets all the eligibility conditions; and

(D) In AFDC, States that pay for the month of application must prorate the payment for that month by multiplying the amount payable if payment were made for the entire month including special needs in accordance with § 233.34 by the ratio of the days in the month including and following the date of application (or, at State option, the date of authorization of payment) to the total number of days in such month. The State plan may provide for using a standard 30-day month to determine the prorated amount.

(7) In cases of proposed action to terminate, discontinue, suspend or reduce assistance, the agency shall give timely and adequate notice. Such notice shall comply with the provisions of § 205.10 of this chapter.

(8) Each decision regarding eligibility or ineligibility will be supported by facts in the applicant's or recipient's case record. Under this requirement each application is disposed of by a finding of eligibility or ineligibility unless:

(i) The applicant voluntarily withdraws his application, and there is an entry in the case record that a notice has been sent to confirm the applicant's notification to the agency that he does not desire to pursue his application; or

(ii) There is an entry in the case record that the application has been disposed of because the applicant died or could not be located.

(9) Where an individual has been determined to be eligible, eligibility will be reconsidered or redetermined:

(i) When required on the basis of information the agency has obtained previously about anticipated changes in the individual's situation;

(ii) Promptly, after a report is obtained which indicates changes in the individual's circumstances that may affect the amount of assistance to which he is entitled or may make him ineligible; and

(iii) Periodically, within agency established time standards, but not less frequently than every 12 months in OAA, AB, APTD, and AABD, on eligibility factors subject to change. For recipients of AFDC, all factors of eligibility will be redetermined at least every 6 months except in the case of monthly reporting cases or cases covered by an approved error-prone profiling system as specified in paragraph (a)(9)(iv) of this section. Under the AFDC program, at least one face-to-face redetermination must be conducted in each case once in every 12 months.

(iv) In accordance with paragraph (a)(9)(iii) of this section, under an alternative redetermination plan based on error-prone profiling, which has been approved by the Secretary, and includes:

(A) A description of the statistical methodology used to develop the error-prone profile system upon which the redetermination schedule is based;

(B) The criteria to be used to vary the scope of review and to assign different types of cases; and

(C) A detailed outline of the evaluation system, including provisions for necessary changes in the error-prone output, such as types of cases, types of errors, frequencies of redeterminations and corrective action.

(10) Standards and methods for determination of eligibility shall be consistent with the objectives of the programs, and will respect the rights of individuals under the United States Constitution, the Social Security Act, title VI of the Civil Rights Act of 1964, and all other relevant provisions of Federal and State laws.

(11) [Reserved]

(12) The State agency shall establish and maintain methods by which it shall be kept currently informed about local agencies' adherence to the State plan provisions and to the State agency's procedural requirements for determining eligibility, and it shall take corrective action when necessary.

(b) Definitions. For purposes of this section:

(1) Applicant is a person who has, directly, or through his authorized representative, or where incompetent or incapacitated, through someone acting responsibly for him, made application for public assistance from the agency administering the program, and whose application has not been terminated.

(2) Application is the action by which an individual indicates in writing to the agency administering public assistance (on a form prescribed by the State agency) his desire to receive assistance. The relative with whom a child is living or will live ordinarily makes application for the child for AFDC. An application is distinguished from an inquiry, which is simply a request for information about eligibility requirements for public assistance. Such inquiry may be followed by an application. When an individual is required to be included in an existing assistance unit pursuant to paragraph (a)(1)(vii), such individual will be considered to be included in the application, as of the date he is required to be included in the assistance unit.

(3) Date of Application is the date on which the action described in paragraph (b)(2) of this section occurs.

(4) Redetermination is a review of factors affecting AFDC eligibility and payment amount; e.g. continued absence, income (including child and spousal support), etc.

(5) Assistance Unit is the group of individuals whose income, resources and needs are considered as a unit for purposes of determining eligibility and the amount of payment.

[48 FR 28407, June 21, 1983, as amended at 49 FR 35599, Sept. 10, 1984; 51 FR 7217, Feb. 28, 1986; 51 FR 9203, Mar. 18, 1986; 52 FR 48689, Dec. 24, 1987; 53 FR 30433, Aug. 12, 1988; 57 FR 30157, July 8, 1992]

§§ 211.1-211.2 [Reserved]

§ 211.3 Certificates.

The following certificates are necessary to establish that an individual is an eligible person:

(a) Certificates as to nationality. A certificate issued by an authorized official of the Department of State, stating that the individual is a national of the United States.

(b) Certificate as to mental condition. Either (1) a certificate obtained or transmitted by an authorized official of the Department of State that the individual has been legally adjudged insane in a named foreign country; or (2) a certificate of an appropriate authority or person stating that at the time of such certification the individual was in a named foreign country and was in need of care and treatment in a mental hospital. A statement shall, if possible, be incorporated into or attached to the certificate furnished under this paragraph setting forth all available medical and other pertinent information concerning the individual.

(c) Appropriate authority or person. For the purpose of paragraph (b)(2) of this section a medical officer of the Public Health Service or of another agency of the United States, or a medical practitioner legally authorized to provide care or treatment of mentally ill persons in the foreign country, is an “appropriate authority or person,” and shall be so identified in his execution of the certificate. If such a medical officer or practitioner is unavailable, an authorized official of the Department of State may serve as an “appropriate authority or person,” and shall, in the execution of the certificate, identify himself as serving as such person due to the unavailability of a suitable medical officer or practitioner.

§§ 211.4-211.5 [Reserved]

§ 211.6 Reception; temporary care, treatment, and assistance.

(a) Reception. The agency will meet the eligible person at the port of entry or debarkation, will arrange for appropriate medical examination, and will plan with him, in cooperation with his legal guardian, or, in the absence of such a guardian, with other interested persons, if any, for needed temporary care and treatment.

(b) Temporary care, treatment, and assistance. The agency will provide for temporary care, treatment, and assistance, as reasonably required for the health and welfare of the eligible person. Such care, treatment, and assistance may be provided in the form of hospitalization and other medical and remedial care (including services of necessary attendants), food and lodging, money, payments, transportation, or other goods and services. The agency will utilize the Public Health Service General Hospital nearest to the port of entry or debarkation or any other suitable public or private hospital, in providing hospitalization and medical care, including diagnostic service as needed, pending other appropriate arrangements for serving the eligible person.

§§ 211.7-211.15 [Reserved]

§ 213.1 Scope of rules.

(a) The rules of procedure in this part govern the practice for hearings afforded by the Department to States pursuant to § 201.4 or § 201.6 (a) or (b) of this chapter, and the practice relating to decisions upon such hearings. These rules may also be applied to hearings afforded by the Department to States in other Federal-State programs for which Federal administrative responsibility has been delegated to the Service.

(b) Nothing in this part is intended to preclude or limit negotiations between the Department and the State, whether before, during, or after the hearing to resolve the issues which are, or otherwise would be, considered at the hearing. Such negotiations and resolution of issues are not part of the hearing, and are not governed by the rules in this part, except as expressly provided herein.

§ 213.2 Records to be public.

All pleadings, correspondence, exhibits, transcripts of testimony, exceptions, briefs, decisions, and other documents filed in the docket in any proceeding may be inspected and copied in the office of the FSA Hearing Clerk. Inquiries may be made at the Central Information Center, Department of Health and Human Services, 330 Independence Avenue SW., Washington, DC 20201.

[36 FR 1454, Jan. 29, 1971, as amended at 53 FR 36580, Sept. 21, 1988]

§ 213.3 Use of gender and number.

As used in this part, words importing the singular number may extend and be applied to several persons or things, and vice versa. Words importing the masculine gender may be applied to females or organizations.

§ 213.4 Suspension of rules.

Upon notice to all parties, the Administrator or the presiding officer, with respect to matters pending before him and within his jurisdiction, may modify or waive any rule in this part upon determination that no party will be unduly prejudiced and the ends of justice will thereby be served.

§ 213.5 Filing and service of papers.

(a) All papers in the proceedings shall be filed with the FSA Hearing Clerk, in an original and two copies. Originals only of exhibits and transcripts of testimony need be filed.

(b) All papers in the proceedings shall be served on all parties by personal delivery or by mail. Service on the party's designated attorney will be deemed service upon the party.

[36 FR 1454, Jan. 29, 1971, as amended at 53 FR 36580, Sept. 21, 1988]

§ 213.11 Notice of hearing or opportunity for hearing.

Proceedings are commenced by mailing a notice of hearing or opportunity for hearing from the Administrator to the State. The notice shall state the time and place for the hearing, and the issues which will be considered, and shall be published in the Federal Register.

§ 213.12 Time of hearing.

The hearing shall be scheduled not less than 30 days nor more than 60 days after the date notice of the hearing is furnished to the State.

§ 213.13 Place.

The hearing shall be held in the city in which the regional office of the Department is located or in such other place as is fixed by the Administrator in light of the circumstances of the case, with due regard for the convenience and necessity of the parties or their representatives.

§ 213.14 Issues at hearing.

(a) The Administrator may, prior to a hearing under § 201.6 (a) or (b) of this chapter, notify the State in writing of additional issues which will be considered at the hearing, and such notice shall be published in the Federal Register. If such notice is furnished to the State less than 20 days before the date of the hearing, the State or any other party, at its request, shall be granted a postponement of the hearing to a date 20 days after such notice was furnished, or such later date as may be agreed to by the Administrator.

(b) If, as a result of negotiations between the Department and the State, the submittal of a plan amendment, a change in the State program, or other actions by the State, any issue is resolved in whole or in part, but new or modified issues are presented, as specified by the Administrator, the hearing shall proceed on such new or modified issues.

(c)(1) If at any time, whether prior to, during, or after the hearing, the Administrator finds that the State has come into compliance with Federal requirements on any issue, in whole or in part, he shall remove such issue from the proceedings in whole or in part, as may be appropriate. If all issues are removed, he shall terminate the hearing.

(2) Prior to the removal of any issue from the hearing, in whole or in part, the Administrator shall provide all parties other than the Department and the State (see § 213.15(b)) with the statement of his intention, and the reasons therefor, and a copy of the proposed State plan provision on which the State and he have settled, and the parties shall have opportunity to submit in writing within 15 days, for the Administrator's consideration and for the record, their views as to, or any information bearing upon, the merits of the proposed plan provision and the merits of the Administrator's reasons for removing the issue from the hearing.

(d) The issues considered at the hearing shall be limited to those issues of which the State is notified as provided in § 213.11 and paragraph (a) of this section, and new or modified issues described in paragraph (b) of this section, and shall not include issues or parts of issues removed from the proceedings pursuant to paragraph (c) of this section.

§ 213.15 Request to participate in hearing.

(a) The Department and the State are parties to the hearing without making a specific request to participate.

(b)(1) Other individuals or groups may be recognized as parties, if the issues to be considered at the hearing have caused them injury and their interest is within the zone of interests to be protected by the governing Federal statute.

(2) Any individual or group wishing to participate as a party shall file a petition with the FSA Hearing Clerk within 15 days after notice of the hearing has been published in the Federal Register, and shall serve a copy on each party of record at that time, in accordance with § 213.5(b). Such petition shall concisely state (i) petitioner's interest in the proceeding, (ii) who will appear for petitioner, (iii) the issues on which petitioner wishes to participate, and (iv) whether petitioner intends to present witnesses.

(3) Any party may, within 5 days of receipt of such petition, file comments thereon.

(4) The presiding officer shall promptly determine whether each petitioner has the requisite interest in the proceedings and shall permit or deny participation accordingly. Where petitions to participate as parties are made by individuals or groups with common interests, the presiding officer may request all such petitioners to designate a single representative, or he may recognize one or more of such petitioners to represent all such petitioners. The presiding officer shall give each petitioner written notice of the decision on his petition, and if the petition is denied, he shall briefly state the grounds for denial.

(c)(1) Any interested person or organization wishing to participate as amicus curiae shall file a petition with the FSA Hearing Clerk before the commencement of the hearing. Such petition shall concisely state (i) the petitioner's interest in the hearing, (ii) who will represent the petitioner, and (iii) the issues on which petitioner intends to present argument. The presiding officer may grant the petition if he finds that the petitioner has a legitimate interest in the proceedings, that such participation will not unduly delay the outcome and may contribute materially to the proper disposition of the issues. An amicus curiae is not a party but may participate as provided in this paragraph.

(2) An amicus curiae may present a brief oral statement at the hearing, at the point in the proceedings specified by the presiding officer. He may submit a written statement of position to the presiding officer prior to the beginning of a hearing, and shall serve a copy on each party. He may also submit a brief or written statement at such time as the parties submit briefs, and shall serve a copy on each party.

[36 FR 1454, Jan. 29, 1971, as amended at 53 FR 36580, Sept. 21, 1988]

§ 213.21 Who presides.

(a) The presiding officer at a hearing shall be the Administrator or his designee.

(b) The designation of the presiding officer shall be in writing. A copy of the designation shall be served on all parties.

[39 FR 40850, Nov. 21, 1974]

§ 213.22 Authority of presiding officer.

(a) The presiding officer shall have the duty to conduct a fair hearing, to avoid delay, maintain order, and make a record of the proceedings. He shall have all powers necessary to accomplish these ends, including, but not limited to, the power to:

(1) Change the date, time, and place of the hearing, upon due notice to the parties. This includes the power to continue the hearing in whole or in part. In hearings pursuant to section 1116(a)(2) of the Social Security Act (see § 201.4 of this chapter), changes of time are subject to the requirements of the statute.

(2) Hold conferences to settle or simplify the issues in a proceeding, or to consider other matters that may aid in the expeditious disposition of the proceeding.

(3) Regulate participation of parties and amici curiae and require parties and amici curiae to state their position with respect to the various issues in the proceeding.

(4) Administer oaths and affirmations.

(5) Rule on motions and other procedural items on matters pending before him including issuance of protective orders or other relief to a party against whom discovery is sought.

(6) Regulate the course of the hearing and conduct of counsel therein.

(7) Examine witnesses.

(8) Receive, rule on, exclude or limit evidence or discovery.

(9) Fix the time for filing motions, petitions, briefs, or other items in matters pending before him.

(10) If the presiding officer is the Administrator, make a final decision.

(11) If the presiding officer is a hearing examiner, certify the entire record including his recommended findings and proposed decision to the Administrator.

(12) Take any action authorized by the rules in this part or in conformance with the provisions of 5 U.S.C. 551 through 559.

(b) The presiding officer does not have authority to compel by subpoena the production of witnesses, papers, or other evidence.

(c) If the presiding officer is a hearing examiner, his authority pertains to the issues of compliance by a State with Federal requirements which are to be considered at the hearing, and does not extend to the question of whether, in case of any noncompliance, Federal payments will not be made in respect to the entire State plan or will be limited to categories under or parts of the State plan affected by such noncompliance.

[40 FR 50272, Oct. 29, 1975]

§ 213.23 Rights of parties.

All parties may:

(a) Appear by counsel or other authorized representative, in all hearing proceedings.

(b) Participate in any prehearing conference held by the presiding officer.

(c) Agree to stipulations as to facts which will be made a part of the record.

(d) Make opening statements at the hearing.

(e) Present relevant evidence on the issues at the hearing.

(f) Present witnesses who then must be available for cross-examination by all other parties.

(g) Present oral arguments at the hearing.

(h) Submit written briefs, proposed findings of fact, and proposed conclusions of law, after the hearing.

§ 213.23a Discovery.

The Department and any party named in the notice issued pursuant to § 213.11 shall have the right to conduct discovery (including depositions) against opposing parties. Rules 26-37 of the Federal Rules of Civil Procedures shall apply to such proceedings; there will be no fixed rule on priority of discovery. Upon written motion, the Presiding Officer shall promptly rule upon any objection to such discovery action initiated pursuant to this section. The Presiding Officer shall also have the power to grant a protective order or relief to any party against whom discovery is sought and to restrict or control discovery so as to prevent undue delay in the conduct of the hearing. Upon the failure of any party to make discovery, the Presiding Officer may, in his discretion, issue any order and impose any sanction (other than contempt orders) authorized by Rule 37 of the Federal Rules of Civil Procedure.

[40 FR 50272, Oct. 29, 1975]

§ 213.24 Evidentiary purpose.

The hearing is directed to receiving factual evidence and expert opinion testimony related to the issues in the proceeding. Argument will not be received in evidence; rather it should be presented in statements, memoranda, or briefs, as determined by the presiding officer. Brief opening statements, which shall be limited to statement of the party's position and what he intends to prove, may be made at hearings.

§ 213.25 Evidence.

(a) Testimony. Testimony shall be given orally under oath or affirmation by witnesses at the hearing. Witnesses shall be available at the hearing for cross-examination by all parties.

(b) Stipulations and exhibits. Two or more parties may agree to stipulations of fact. Such stipulations, or any exhibit proposed by any party, shall be exchanged at the prehearing conference or otherwise prior to the hearing if the presiding officer so requires.

(c) Rules of evidence. Technical rules of evidence shall not apply to hearings conducted pursuant to this part, but rules or principles designed to assure production of the most credible evidence available and to subject testimony to test by cross-examination shall be applied where reasonably necessary by the presiding officer. A witness may be cross-examined on any matter material to the proceeding without regard to the scope of his direct examination. The presiding officer may exclude irrelevant, immaterial, or unduly repetitious evidence. All documents and other evidence offered or taken for the record shall be open to examination by the parties and opportunity shall be given to refute facts and arguments advanced on either side of the issues.

§ 213.26 Exclusion from hearing for misconduct.

Disrespectful, disorderly, or contumacious language or contemptuous conduct, refusal to comply with directions, or continued use of dilatory tactics by any person at the hearing before a presiding officer shall constitute grounds for immediate exclusion of such person from the hearing by the presiding officer.

§ 213.27 Unsponsored written material.

Letters expressing views or urging action and other unsponsored written material regarding matters in issue in a hearing will be placed in the correspondence section of the docket of the proceeding. These data are not deemed part of the evidence or record in the hearing.

§ 213.28 Official transcript.

The Department will designate the official reporter for all hearings. The official transcripts of testimony taken, together with any stipulations, exhibits, briefs, or memoranda of law filed therewith shall be filed with the Department. Transcripts of testimony in hearings may be obtained from the official reporter by the parties and the public at rates not to exceed the maximum rates fixed by the contract between the Department and the reporter. Upon notice to all parties, the presiding officer may authorize corrections to the transcript which involve matters of substance.

§ 213.29 Record for decision.

The transcript of testimony, exhibits, and all papers and requests filed in the proceedings, except the correspondence section of the docket, including rulings and any recommended or initial decision shall constitute the exclusive record for decision.

§ 213.31 Posthearing briefs.

The presiding officer shall fix the time for filing posthearings briefs, which may contain proposed findings of fact and conclusions of law, and, if permitted, reply briefs.

§ 213.32 Decisions following hearing.

(a) If the Administrator is the presiding officer, he shall, when the time for submission of posthearing briefs has expired, issue his decision within 60 days.

(b)(1) If a hearing examiner is the presiding officer, he shall, when the time for submission of posthearing briefs has expired, certify the entire record, including his recommended findings and proposed decision, to the Administrator. The Administrator shall serve a copy of the recommended findings and proposed decision upon all parties, and amici, if any.

(2) Any party may, within 20 days, file with the Administrator exceptions to the recommended findings and proposed decision and a supporting brief or statement.

(3) The Administrator shall thereupon review the recommended decision and, within 60 days of its issuance, issue his own decision.

(c) If the Administrator concludes that a State plan does not comply with Federal requirements, he shall also, in the case of a hearing pursuant to § 201.6(a) of this chapter, specify whether further payments will not be made to the State or whether, in the exercise of his discretion, payments will be limited to categories under or parts of the State plan not affected by such noncompliance. The Administrator may ask the parties for recommendations or briefs or may hold conferences of the parties on this question.

(d) The decision of the Administrator under this section shall be the final decision of the Secretary and shall constitute “final agency action” within the meaning of 5 U.S.C. 704 and a “final determination” within the meaning of section 1116(a)(3) of the Act and § 201.7 of this chapter. The Administrator's decision shall be promptly served on all parties, and amici, if any.

[36 FR 1454, Jan. 29, 1971, as amended at 36 FR 21520, Nov. 10, 1971]

§ 213.33 Effective date of Administrator's decision.

If, in the case of a hearing pursuant to § 201.6(a) of this chapter, the Administrator concludes that a State plan does not comply with Federal requirements, his decision that further payments will not be made to the State, or payments will be limited to categories under or parts of the State plan not affected, shall specify the effective date for the withholding of Federal funds. The effective date shall not be earlier than the date of the Administrator's decision and shall not be later than the first day of the next calendar quarter. The provisions of this section may not be waived pursuant to § 213.4.

§ 233.10 General provisions regarding coverage and eligibility.

(a) State plan requirements. A State plan under title I, IV—A, X, XIV, or XVI, of the Social Security Act must:

(1) Specify the groups of individuals, based on reasonable classifications, that will be included in the program, and all the conditions of eligibility that must be met by the individuals in the groups. The groups selected for inclusion in the plan and the eligibility conditions imposed must not exclude individuals or groups on an arbitrary or unreasonable basis, and must not result in inequitable treatment of individuals or groups in the light of the provisions and purposes of the public assistance titles of the Social Security Act. Under this requirement:

(i) A State shall impose each condition of eligibility required by the Social Security Act; and

(ii) A State may:

(A) Provide more limited public assistance coverage than that provided by the Act only where the Social Security Act or its legislative history authorizes more limited coverage;

(B) Impose conditions upon applicants for and recipients of public assistance which, if not satisfied, result in the denial or termination of public assistance, if such conditions assist the State in the efficient administration of its public assistance programs, or further an independent State welfare policy, and are not inconsistent with the provisions and purposes of the Social Security Act.

(iii) There must be clarity as to what groups are included in the plan, and which are within, and which are outside, the scope of Federal financial participation.

(iv) Eligibility conditions must be applied on a consistent and equitable basis throughout the State.

(v) A plan under title XVI must have the same eligibility conditions and other requirements for the aged, blind, and disabled, except as otherwise specifically required or permitted by the Act.

(vi) Eligibility conditions or agency procedures or methods must not preclude the opportunity for an individual to apply and obtain a determination of eligibility or ineligibility.

(vii) Methods of determining eligibility must be consistent with the objective of assisting all eligible persons to qualify.

(2) Provide that the State agency will establish methods for identifying the expenditures for assistance for any groups included in the plan for whom Federal financial participation in assistance may not be claimed.

(3) In addition, a State plan under title IV-A, X, XIV, or XVI of the Act, must: Provided that no aid or assistance will be provided under the plan to an individual with respect to a period for which he is receiving aid or assistance under a State plan approved under any other of such titles or under title I of the Act.

(b) Federal financial participation. (1) The provisions which govern Federal financial participation in assistance payments are set forth in the Social Security Act, throughout this chapter, and in other policy issuances of the Secretary. Where indicated, State plan provisions are prerequisite to Federal financial participation with respect to the applicable group and payments. State plan provisions on need, the amount of assistance, and eligibility determine the limits of Federal financial participation. Federal financial participation is excluded from assistance payments in which the State refuses to participate because of the failure of a local authority to apply such State plan provisions.

(2) The following is a summary statement regarding the groups for whom Federal financial participation is available. (More detailed information is given elsewhere.)

(i) OAA—for needy individuals under the plan who are 65 years of age or older.

(ii) AFDC—for:

(a) Needy children under the plan who are:

(1) Under the age of 18, or age 18 if a full-time student in a secondary school, or in the equivalent level of vocational or technical training, and reasonably expected to complete the program before reaching age 19;

(2) Deprived of parental support or care by reason of the death, continued absence from the home, or physical or mental incapacity of a parent, or unemployment of a principal earner, and

(3) Living in the home of a parent or of certain relatives specified in the Act.

(b) The parent(s) of a dependent child, a caretaker relative (other than a parent) of a dependent child, and, in certain situations, a parent's spouse.

(iii) AB—for needy individual's under the plan who are blind.

(iv) APTD—for needy individuals under the plan who are 18 years of age or older and permanently and totally disabled.

(v) AABD—for needy individuals under the plan who are aged, blind, or 18 years of age or older and permanently and totally disabled.

(3) Federal financial participation is available in assistance payments made for the entire month in accordance with the State plan if the individual was eligible for a portion of the month, provided that the individual was eligible on the date that the payment was made; except that where it has been determined that the State agency had previously denied assistance to which the individual was entitled, Federal financial participation will be provided in any corrective payment regardless of whether the individual is eligible on the date that the corrective payment is made.

(4) Federal financial participation is available in assistance payments which are continued in accordance with the State plan, for a temporary period during which the effects of an eligibility condition are being overcome, e.g., blindness in AB, disability in APTD, physical or mental incapacity, continued absence of a parent, or unemployment of a principal earner in AFDC.

(5) Where changed circumstances or a hearing decision makes the individual ineligible for any assistance, or eligible for a smaller amount of assistance than was actually paid, Federal financial participation is available in excess payments to such individuals, for not more than one month following the month in which the circumstances changed or the hearing decision was rendered. Federal financial participation is available where assistance is required to be continued unadjusted because a hearing has been requested.

[36 FR 3866, Feb. 27, 1971, as amended at 38 FR 8744, Apr. 6, 1973; 39 FR 26912, July 24, 1974; 40 FR 32958, Aug. 5, 1975; 47 FR 5674, Feb. 5, 1982; 47 FR 47828, Oct. 28, 1982; 51 FR 9204, Mar. 18, 1986; 57 FR 30158, July 8, 1992]

§ 233.20 Need and amount of assistance.

(a) Requirements for State Plans. A State Plan for OAA, AFDC, AB, APTD or AABD must, as specified below:

(1) General. (i) Provide that the determination of need and amount of assistance for all applicants and recipients will be made on an objective and equitable basis and all types of income will be taken into consideration in the same way except where otherwise specifically authorized by Federal statute and

(ii) Provide that the needs, income, and resources of individuals receiving SSI benefits under title XVI, individuals with respect to whom Federal foster care payments are made, individuals with respect to whom State or local foster care payments are made, individuals with respect to whom Federal adoption assistance payments are made, or individuals with respect to whom State or local adoption assistance payments are made, for the period for which such benefits or payments are received, shall not be included in determining the need and the amount of the assistance payment of an AFDC assistance unit; except that the needs, income, and resources of an individual with respect to whom Federal adoption assistance payments are made, or individuals with respect to whom State or local adoption assistance payments are made are included in determining the need and the amount of the assistance payment for an AFDC assistance unit of which the individual would otherwise be regarded as a member where the amount of the assistance payment that the unit would receive would not be reduced by including the needs, income, and resources of such individual. Under this requirement, “individuals receiving SSI benefits under title XVI” include individuals receiving mandatory or optional State supplementary payments under section 1616(a) of the Social Security Act or under section 212 of Public Law 93-66, and “individuals with respect to whom Federal foster care payments are made” means a child with respect to whom Federal foster care maintenance payments under section 472(b) and defined in section 475(4)(A) of title IV-E of the Social Security Act are made, and a child whose costs in a foster family home or child care institution are covered by the Federal foster care maintenance payments made with respect to his or her minor parent under sections 472(h) and 475(4)(B) of title IV-E. “Individuals with respect to whom Federal adoption assistance payments are made” means a child who receives payments made under an approved title IV-E plan based on an adoption assistance agreement between the State and the adoptive parents of a child with special needs, pursuant to sections 473 and 475(3) of the Social Security Act.

(iii) For AFDC, when an individual who is required to be included in the assistance unit pursuant to § 206.10(a)(1)(vii) is also required to be included in another assistance unit, those assistance units must be consolidated, and treated as one assistance unit for purposes of determining eligibility and the amount of payment.

(iv) For AFDC, when a State learns of an individual who is required to be included in the assistance unit after the date he or she is required to be included in the unit, the State must redetermine the assistance unit's eligibility and payment amount, including the need, income, and resources of the individual. This redetermination must be retroactive to the date that the individual was required to be in the assistance unit either through birth/adoption or by becoming a member of the household. Any resulting overpayment must be recovered or corrective payment made pursuant to § 233.20(a)(13).

(v) In determining need and the amount of payment for AFDC, all income and resources of an individual required to be in the assistance unit, but subject to sanction under § 250.34 or because of an intentional program violation under the optional fraud control program implementing section 416 of the Social Security Act, are considered available to the assistance unit to the same extent that they would be if the person were not subject to a sanction. However, the needs of the sanctioned individual(s) are not considered. In accord with § 250.34(c), if a parent in an AFDC-UP case is sanctioned pursuant to § 233.100(a)(5), the needs of the second parent are not taken into account in determining the family's need for assistance and the amount of the assistance payment unless the second parent is participating in the JOBS program. An individual required to be in an assistance unit pursuant to § 206.10(a)(1)(vii) but who fails to cooperate in meeting a condition of his or her eligibility for assistance is a sanctioned individual whose needs, income, and resources are treated in the manner described above.

(2) Standards of assistance. (i) Specify a statewide standard, expressed in money amounts, to be used in determining (a) the need of applicants and recipients and (b) the amount of the assistance payment.

(ii) In the AFDC plan, provide that by July 1, 1969, the State's standard of assistance for the AFDC program will have been adjusted to reflect fully changes in living costs since such standards were established, and any maximums that the State imposes on the amount of aid paid to families will have been proportionately adjusted. In such adjustment a consolidation of the standard (i.e., combining of items) may not result in a reduction in the content of the standard. In the event the State is not able to meet need in full under the adjusted standard, the State may make ratable reductions in accordance with paragraph (a)(3)(viii) of this section. Nevertheless, if a State maintains a system of dollar maximums these maximums must be proportionately adjusted in relation to the updated standards.

(iii) Provide that the standard will be uniformly applied throughout the State except as provided under § 239.54.

(iv) Include the method used in determining need and the amount of the assistance payment. For AFDC, the method must provide for rounding down to the next lower whole dollar when the result of determining the standard of need or the payment amount is not a whole dollar. Proration under § 206.10(a)(6)(i)(D) to determine the amount of payment for the month of application must occur before rounding to determine the payment amount for that month.

(v) If the State IV-A agency includes special need items in its standard:

(A) Describe those that will be recognized and the circumstances under which they will be included, and

(B) Provide that they will be considered for all applicants and recipients requiring them; except that:

(1) Under AFDC, work expenses and child care (or care of incapacitated adults living in the same home and receiving AFDC) resulting from employment or participation in either a CWEP or an employment search program cannot be special needs, and

(2) In a State which has a JOBS program under part 250, child care, transportation, work-related expenses, other work-related supportive services, and the costs of education (including tuition, books, and fees) resulting from participation in JOBS (including participation pursuant to §§ 250.46, 250.47, and 250.48) or any other education or training activity cannot be special needs.

(vi) If the State chooses to establish the need of the individual on a basis that recognizes, as essential to his well-being, the presence in the home of other needy individuals, (A) specify the persons whose needs will be included in the individual's need, and (B) provide that the decision as to whether any individual will be recognized as essential to the recipient's well-being shall rest with the recipient.

(vii) [Reserved]

(viii) Provide that the money amount of any need item included in the standard will not be prorated or otherwise reduced solely because of the presence in the household of a non-legally responsible individual; and the agency will not assume any contribution from such individual for the support of the assistance unit except as provided in paragraphs (a)(3)(xiv) and (a)(5) of this section and § 233.51 of this part.

(ix) For AFDC, provide that a State shall consider utility payments made in lieu of any direct rental payment to a landlord or public housing agency to be shelter costs for applicants or recipients living in housing assisted under the U.S. Housing Act of 1937, as amended, and section 236 of the National Housing Act. The amount considered as a shelter payment shall not exceed the total amount the applicant or recipient is expected to contribute for the cost of housing as determined by HUD. Utility payments means only those payments made directly to a utility company or supplier which are for gas, electricity, water, heating fuel, sewerage systems, and trash and garbage collection. Utility payments are made “in lieu of any direct rental payment to a landlord or public housing agency” when, and only when, the AFDC family pays its entire required contribution at HUD's direction to one or more utility companies and does not make any direct payment to the landlord or the public housing agency. Housing covered by “the U.S. Housing Act of 1937, as amended, and section 236 of the National Housing Act” means Department of Housing and Urban Development assisted housing which includes Indian and public housing, section 8 new and existing rental housing, and section 236 rental housing.

(3) Income and resources. (i)(A) OAA, AB, APTD, AABD, Specify the amount and types of real and personal property, including liquid assets, that may be reserved, i.e., retained to meet the current and future needs while assistance is received on a continuing basis. In addition to the home, personal effects, automobile and income producing property allowed by the agency, the amount of real and personal property, including liquid assets, that can be reserved for each individual recipient shall not be in excess of two thousand dollars. Policies may allow reasonable proportions of income from businesses or farms to be used to increase capital assets, so that income may be increased; and (B) in AFDC—The amount of real and personal property that can be reserved for each assistance unit shall not be in excess of one thousand dollars equity value (or such lesser amount as the State specifies in its State plan) excluding only:

(1) The home which is the usual residence of the assistance unit;

(2) One automobile, up to $1,500 of equity value or such lower limit as the State may specify in the State plan; (any excess equity value must be applied towards the general resource limit specified in the State plan);

(3) One burial plot (as defined in the State plan) for each member of the assistance unit;

(4) Bona fide funeral agreements (as defined and within limits specified in the State plan) up to a total of $1,500 in equity value or such lower limit as the State may specify in the State plan for each member of the assistance unit (any excess equity value must be applied towards the general resource limit specified in the State plan). This provision addresses only formal agreements for funeral and burial expenses such as burial contracts, burial trusts or other funeral arrangements (generally with licensed funeral directors) and does not apply to other assets (e.g., passbook bank accounts, simple set-aside of savings, and cash surrender value of life insurance policies);

(5) Real property for a period of six consecutive months (or, at the option of the State, nine consecutive months) which the family is making a good faith effort (as defined in the State plan) to sell, subject to the following provisions. The family must sign an agreement to dispose of the property and to repay the amount of aid received during such period that would not have been paid had the property been sold at the beginning of such period, but not to exceed the amount of the net proceeds of the sale. The family has five working days from the date it realizes cash from the sale of the excess real property to repay the overpayment; failure to make repayment within this period results in the cash being considered to be an available resource. If the family becomes ineligible for AFDC for any other reason during the conditional payment period while making a good faith effort to sell the property, or fails to sell the property by the end of the period despite such a good faith effort, then the amount of the overpayment attributable to the real property will not be determined and recovery will not be begun until the property is, in fact, sold. However, if the property was intentionally sold at less than fair market value so that a good faith effort to sell it was not made, or if it is otherwise determined that a good faith effort to sell the property is not being made, the overpayment amount shall be computed using the fair market value determined at the beginning of the period. For applicants, the conditional payment period begins with the first payment month for which all otherwise applicable eligibility conditions are met and payment is authorized. For recipients who acquire property while receiving assistance, the period begins with the payment month in which the recipient receives the property; and

(6) At State option, basic maintenance items essential to day-to-day living such as clothes, furniture and other similarly essential items of limited value.

(ii) Provide that in determining need and the amount of the assistance payment, after all policies governing the reserves and allowances and disregard or setting aside of income and resources referred to in this section have been uniformly applied:

(A) In determining need, all remaining income and resources shall be considered in relation to the State's need standard;

(B) In determining financial eligibility and the amount of the assistance payment all remaining income (except unemployment compensation received by an unemployed principal earner) and, except for AFDC, all resources may be considered in relation to either the State's need standard or the State's payment standard. Unemployment compensation received by an unemployed principal earner shall be considered only by subtracting it from the amount of the assistance payment after the payment has been determined under the State's payment method;

(C) States may have policies which provide for allocating an individual's income for his or her own support if the individual is not applying for or receiving assistance; for the support of other individuals living in the same household but not receiving assistance; and for the support of other individuals living in another household. Such other individuals are those who are or could be claimed by the individual as dependents for determining Federal personal income tax liability, or those he or she is legally obligated to support. No income may be allocated to meet the needs of an individual who has been sanctioned under § 224.51, § 232.11(a)(2), § 232.12(d), § 238.22 or § 240.22 or who is required to be included in the assistance unit and has failed to cooperate. The amount allocated for the individual and the other individuals who are living in the home must not exceed the State's need standard amount for a family group of the same composition. The amount allocated for individuals not living in the home must not exceed the amount actually paid.

(D) Income after application of disregards, except as provided in paragraph (a)(3)(xiii) of this section, and resources available for current use shall be considered. To the extent not inconsistent with any other provision of this chapter, income and resources are considered available both when actually available and when the applicant or recipient has a legal interest in a liquidated sum and has the legal ability to make such sum available for support and maintenance.

(E) For AFDC, income tax refunds, but such payments shall be considered as resources; and

(F) When the AFDC assistance unit's income, after applying applicable disregards, exceeds the State need standard for the family because of receipt of nonrecurring earned or unearned lump sum income (including for AFDC, title II and other retroactive monthly benefits, and payments in the nature of a windfall, e.g., inheritances or lottery winnings, personal injury and worker compensation awards, to the extent it is not earmarked and used for the purpose for which it is paid, i.e., monies for back medical bills resulting from accidents or injury, funeral and burial costs, replacement or repair of resources, etc.), the family will be ineligible for aid for the full number of months derived by dividing the sum of the lump sum income and other income by the monthly need standard for a family of that size. Any income remaining from this calculation is income in the first month following the period of ineligibility. The period of ineligibility shall begin with the month of receipt of the nonrecurring income or, at State option, as late as the corresponding payment month. For purposes of applying the lump sum provision, family includes all persons whose needs are taken into account in determining eligibility and the amount of the assistance payment, and includes solely for determining the income and resources of a family an individual who must be in a family pursuant to § 206.10(a)(1)(vii) but who does not meet a condition of his or her eligibility due to a failure to cooperate or is required by law to have his or her needs excluded from an assistance unit's AFDC grant calculation due to the failure to perform some action. A State may shorten the remaining period of ineligibility when: the standard of need increases and the amount the family would have received also changes (e.g., situations involving additions to the family unit during the period of ineligibility of persons who are otherwise eligible for assistance); the lump sum income or a portion thereof becomes unavailable to the family for a reason beyond the control of the family; or the family incurs and pays for medical expenses. If the State chooses to shorten the period of ineligibility, the State plan shall:

(1) Identify which of the above situations are included;

(2) In the case of situations involving an increase in the need standard and changes in the amount that should have been paid to the family, specify the types of circumstances which will be included;

(3) In the case of situations involving the unavailability of the lump sum income, include a definition of unavailability, and specify what reasons will be considered beyond the control of the family; and

(4) In the case of situations involving the payment of medical expenses, specify the types of medical expenses the State will allow to be offset against the lump sum income.

For purposes of this paragraph (a)(3): Automobile means a passenger car or other motor vehicle used to provide transportation of persons or goods. (In AFDC, in appropriate geographic areas, one alternate primary mode of transportation may be substituted for the automobile); Equity value means fair market value minus encumbrances (legal debts); Fair market value means the price an item of a particular make, model, size, material or condition will sell for on the open market in the geographic area involved (If a motor vehicle is especially equipped with apparatus for the handicapped, the apparatus shall not increase the value of the vehicle); Liquid assets are those properties in the form of cash or other financial instruments which are convertible to cash and include savings accounts, checking accounts, stocks, bonds, mutual fund shares, promissory notes, mortgages, cash value of insurance policies, and similar properties; Need standard means the money value assigned by the State to the basic and special needs it recognizes as essential for applicants and recipients; Payment standard means the amount from which non-exempt income is subtracted.

(iii) States may prorate income received by individuals employed on a contractual basis over the period of the contract or may prorate intermittent income received quarterly, semiannually, or yearly over the period covered by the income. In OAA, AB, APTD and AABD, they may use the prorated amount to determine need under § 233.23 and the amount of the assistance payment under §§ 233.24 and 233.25. In AFDC, they may use the prorated amount to determine need under § 233.33 and the amount of the assistance payment under §§ 233.34 and 233.35.

(iv) Provide that in determining the availability of income and resources, the following will not be included as income:

(A) Except for AFDC, income equal to expenses reasonably attributable to the earning of income (including earnings from public service employment);

(B) Grants, such as scholarships, obtained and used under conditions that preclude their use for current living costs;

(C) Home produce of an applicant or recipient, utilized by him and his household for their own consumption;

(D) For AFDC, any amounts paid by a State IV-A agency from State-only funds to meet needs of children receiving AFDC, if the payments are made under a statutorily-established State program which has been continuously in effect since before January 1, 1979;

(E) For AFDC, income tax refunds, but such payments shall be considered as resources; and

(F) At State option, small nonrecurring gifts, such as those for Christmas, birthdays and graduations, not to exceed $30 per recipient in any quarter; and

(G) For AFDC, the amount paid to the family by the IV-A agency under § 232.20(d) or, in a State that treats direct support payments as income under § 233.20(a)(3)(v)(B), the first $50 received by the assistance unit which represents a current monthly support obligation or a voluntary support payment. In no case shall the total amount disregarded exceed $50 per month per assistance unit.

(v) Provide that agency policies will assure that:

(A) In determining eligibility for an assistance payment, support payments assigned under § 232.11 of this chapter will be treated in accordance with §§ 232.20 and 232.21 of this chapter; and

(B) In determining the amount of an assistance payment, assigned support payments retained in violation of § 232.12(b)(4) of this chapter, will be counted as income to meet need unless the approved IV-A State plan provides that such support payments are subject to IV-D recovery under §§ 302.31(a)(3) and 303.80 of this title or unless such payments are sufficient to render the family ineligible as provided at § 232.20 of this chapter.

(vi)(A) In family groups living together, income of the spouse is considered available for his spouse and income of a parent is considered available for children under 21, except as provided in paragraphs (a)(3)(xiv) and (a)(3)(xviii) of this section for AFDC. If an individual is a spouse or parent who is a recipient of SSI benefits under title XVI, an individual with respect to whom Federal foster care payments are made, an individual with respect to whom State or local foster care payments are made, an individual with respect to whom Federal adoption assistance payments are made, or an individual with respect to whom State or local adoption assistance payments are made, then, for the period for which such benefits or payments are received, his or her income and resources shall not be counted as income and resources available to the AFDC unit except that a child receiving adoption assistance payments will not be excluded if such exclusion would cause the AFDC benefits of the assistance unit of which the child would otherwise be considered a member to be reduced. For purposes of this exception, “a recipient of SSI benefits under title XVI” includes a spouse or parent receiving mandatory or optional State supplementary payments under section 1616(a) of the Social Security Act or under section 212 of Public Law 93-66 and an “individual with respect to whom Federal foster care payments are made” means a child with respect to whom Federal foster care maintenance payments are made under section 472(b) and defined in section 475(4)(A) of the Act, and a child whose costs in a foster family home or child-care institution are covered by the foster care maintenance payments made with respect to his or her minor parent under sections 472(h) and 475(4)(B) of the Act. “Individuals with respect to whom Federal adoption assistance payments are made” means a child who receives payments made under an approved title IV-E plan based on an adoption assistance agreement between the State and the adoptive parents of a child with special needs, pursuant to sections 473 and 475(3) of the Social Security Act.

(B) Income of an alien parent, who is disqualified pursuant to § 233.50(c) is considered available to the otherwise eligible child by applying the stepparent deeming formula at 45 CFR 233.20(a)(3)(xiv).

(vii) If the State agency establishes policy under which assistance from other agencies and organizations will not be deducted in determining the amount of assistance to be paid, provide that no duplication shall exist between such other assistance and that provided by the public assistance agency. In such complementary program relationships, nonduplication shall be assured by provision that such aid will be considered in relation to: (a) The different purpose for which the other agency grants aid such as vocational rehabilitation; (b) the provision of goods and services that are not included in the statewide standard of the public assistance agency, e.g., a private agency might provide money for special training for a child or for medical care when the public assistance agency does not carry this responsibility; or housing and urban development payments might be provided to cover moving expenses that are not included in the assistance standard; or (c) the fact that public assistance funds are insufficient to meet the total amount of money determined to be needed in accordance with the statewide standard. In such instances, grants by other agencies in an amount sufficient to make it possible for the individual to have the amount of money determined to be needed, in accordance with the public assistance agency standard, will not constitute duplication.

(viii) Provide that: (A) Payment will be based on the determination of the amount of assistance needed; (B) if full individual payments are precluded by maximums or insufficient funds, adjustments will be made by methods applied uniformly statewide; (C) in the case of AFDC no payment of aid shall be made to an assistance unit in any month in which the amount of aid prior to any adjustments is determined to be less than $10; and (D) an individual who is denied aid because of the limitation specified in (C) of this section, or because the payment amount is determined to be zero as a result of rounding the payment amount as required by § 233.20(a)(2)(iv), shall be deemed a recipient of aid for all other purposes except participation in the Community Work Experience Program.

(ix) Provide that the agency will establish and carry out policies with reference to applicants' and recipients' potential sources of income that can be developed to a state of availability.

(x) Provide that the income and resources of individuals receiving SSI benefits under title XVI, individuals with respect to whom Federal foster care payments are made, individuals with respect to whom State or local foster care payments are made, individuals with respect to whom Federal adoption assistance payments are made, or individuals with respect to whom State or local adoption assistance payments are made, for the period for which such benefits or payments are received, shall not be counted as income and resources of an assistance unit applying for or receiving assistance under title IV-A; except that a child receiving adoption assistance payments will not be excluded if such exclusion would cause the AFDC benefits of the assistance unit of which the child would otherwise be considered a member to be reduced. Under this requirement, “individuals receiving SSI benefits under title XVI” include individuals receiving mandatory or optional State supplementary payments under section 1616(a) of the Social Security Act or under section 212 of Public Law 93-66 and, “individuals with respect to whom Federal foster care payments are made” means a child with respect to whom Federal foster care maintenance payments are made under section 472(b) and defined in section 475(4)(A) of the Act, and a child whose costs in a foster family home or child-care institution are covered by foster care maintenance payments made with respect to his or her minor parent under sections 472(h) and 475(4)(B) of the Act. “Individuals with respect to whom Federal adoption assistance payments are made” means a child who receives payments made under an approved title IV-E plan based on an adoption assistance agreement between the State and the adoptive parents of a child with special needs, pursuant to sections 473 and 475(3) of the Social Security Act.

(xi) In the case of AFDC if the State chooses to count the value of the food stamp coupons as income, provide that the State plan shall:

(A) Identify the amount for food included in its need and payment standards for an assistance unit of the same size and composition. (States which have a flat grant system must estimate the amount based on historical data or some other justifiable procedure.); and

(B) Specify the amount of such food stamp coupons that it will count as income. Under this requirement, the amount of food stamp coupons which a State may count as income may not exceed the amount for food established in its payment standard for an assistance unit of the same size and composition.

(xii) In the case of AFDC if the State chooses to count the value of the governmental rent or housing subsidies as income, provide that the State plan shall:

(A) Identify the amount for shelter included in its need and payment standards for an assistance unit of the same size and composition. (States which have a flat grant system must estimate this amount based on historical data or some other justifiable procedure.); and

(B) Specify the amount of such housing assistance that it will count as income. Under this requirement, the amount of such rent or housing subsidies which a State may count as income may not exceed the amount for shelter established in its payment standard for assistance unit of the same size and composition.

(xiii) Under the AFDC plan, provide that no assistance unit is eligible for aid in any month in which the unit's income (other than the assistance payment) exceeds 185 percent of the State's need standard (including special needs) for a family of the same composition (including special needs), without application of the disregards in paragraph (a)(11)(i) (except to the extent provided for under paragraph (a)(3)(xix)), paragraph (a)(11)(ii) and paragraph (a)(11)(viii) of this section.

(xiv) For AFDC, in States that do not have laws of general applicability holding the stepparent legally responsible to the same extent as the natural or adoptive parent, the State agency shall count as income to the assistance unit the income of the stepparent (i.e., one who is married, under State law, to the child's parent) of an AFDC child who is living in the household with the child after applying the following disregards (exception: if the stepparent is included in the assistance unit, the disregard under paragraph (a)(11) (i) and (ii) of this section apply instead:

(A) The first $90 of the gross earned income of the stepparent;

(B) An additional amount for the support of the stepparent and any other individuals who are living in the home, but whose needs are not taken into account in making the AFDC eligibility determinations except for sanctioned individuals or individuals who are required to be included in the assistance unit but have failed to cooperate and are or could be claimed by the stepparent as dependents for purposes of determining his or her Federal personal income tax liability. This disregarded amount shall equal the State's need standard amount for a family group of the same composition as the stepparent and those other individuals described in the preceding sentence;

(C) Amounts actually paid by the stepparent to individuals not living in the home but who are or could be claimed by him or her as dependents for purposes of determining his or her Federal personal income tax liability; and

(D) Payments by such stepparent of alimony or child support with respect to individuals not living in the household.

(xv) For AFDC, provide for the consideration of the income and resources of an alien's sponsor who is an individual as provided in § 233.51.

(xvi) For AFDC, provide that in considering the availability of income and resources, support and maintenance assistance (including home energy assistance) will be taken into account in accordance with § 233.53.

(xvii) In the case of AFDC, if the State chooses to disregard monthly income of any dependent child when the income is derived from participation in a program under the JTPA, provide that the State plan shall:

(A) Identify from which programs under the JTPA, income will be disregarded;

(B) In the case of earned income, specify what amount will be disregarded, and the length of time the disregard will be applicable (up to six months per calendar year); and

(C) In the case of unearned income, specify what amount will be disregarded, and the length of time per calendar year the disregard will be applicable if any such limit is chosen.

(xviii) For AFDC, in the case of a dependent child whose parent is a minor under the age of 18 (without regard to school attendance), the State shall count as income to the assistance unit the income, after appropriate disregards, of such minor's own parent(s) living in the same household as the minor and dependent child. The disregards to be applied are the same as are applied to the income of a stepparent pursuant to paragraph (a)(3)(xiv) of this section. However, in applying the disregards, each employed parent will receive the benefit of the work expense disregard in paragraph (a)(3)(xiv)(A) of this section.

(xix) In the case of AFDC, if the State chooses to disregard monthly earned income of dependent children who are full-time students in the determination of whether the family's income exceeds the limit under § 233.20(a)(3)(xiii) of this section, provide that the State plan shall specify what amounts will be disregarded and the length of time the disregard will be applicable (up to six months per calendar year) except that earned income derived from participation in a program under the JTPA may only be disregarded under this paragraph, paragraph (a)(3)(xvii) or a combination of both paragraphs for a total of 6 months per calendar year.

(xx) In the case of AFDC, if the State chooses to disregard in the determination of eligibility the monthly earned income of dependent children applying for AFDC who are full-time students, provide that the State plan shall:

(A) Specify the amount that will be disregarded, and

(B) Provide that the disregard shall only apply to the extent that the earned income is also disregarded pursuant to paragraph (a)(3)(xix) of this section.

(xxi) Provide that the principal of a bona fide loan will not be counted as income or resources in the determination of eligibility and the amount of assistance. Interest earned on a loan is counted as unearned income in the month received and as resources thereafter and purchases made with a loan are counted as resources. For purposes of this paragraph, a loan is considered bona fide when it meets objective and reasonable criteria included in the State plan.

(4) Disregard of income in OAA, AFDC, AB, APTD, OR AABD. (i) For all programs except AFDC. If the State chooses to disregard income from all sources before applying other provisions for disregarding or setting aside income, specify the amount that is first to be disregarded, but not more than $7.50 per month, of any income of an individual, child or relative claiming assistance. All income must be included such as social security or other benefits, earnings, contributions from relatives, or other income the individual may have.

(ii) Provide that in determining eligibility for public assistance and the amount of the assistance payment, the following will be disregarded as income and resources:

(a) In OAA, AB, APTD, and AABD, the value of the coupon allotment under the Food Stamp Act of 1964 in excess of the amount paid for the coupons;

(b) The value of the U.S. Department of Agriculture donated foods (surplus commodities);

(c) Any payment received under title II of the Uniform Relocation Assistance and Real Property Acquisition Policies Act of 1970;

(d) Grants or loans to any undergraduate student for educational purposes made or insured under any programs administered by the Secretary of Education except the programs under the Carl D. Perkins Vocational and Applied Technology Education Act (20 U.S.C. 2301 et seq.). Student financial assistance provided under the Carl D. Perkins Vocational and Applied Technology Education Act will be disregarded in accordance with paragraph (a)(4)(ii)(t) of this section.

(e) Any funds distributed per capita to or held in trust for members of any Indian tribe under Public Law 92-254 or Pub. L. 94-540;

(f) Any benefits received under title VII, Nutrition Program for the Elderly, of the Older Americans Act of 1965, as amended;

(g) Payments for supporting services or reimbursement of out-of-pocket expenses made to individual volunteers serving as foster grandparents, senior health aides, or senior companions, and to persons serving in the Service Corps of Retired Executives (SCORE) and Active Corps of Executives (ACE) and any other programs under titles II and III, pursuant to section 418 of Pub. L. 93-113;

(h) Payments to applicants or recipients participating in the Volunteers in Service to America (VISTA) Program, except that this disregard will not be applied when the Director of ACTION determines that the value of all such payments, adjusted to reflect the number of hours such volunteers are serving, is equivalent to or greater than the minimum wage then in effect under the Fair Labor Standards Act of 1938, or the minimum wage under the laws of the States where the volunteers are serving, whichever is greater. (Section 404(g) of Pub. L. 93-113, as amended by section 9 of Pub. L. 96-143);

(i) The value of supplemental food assistance received under the Child Nutrition Act of 1966 as amended, and the special food service program for children under the National School Lunch Act, as amended (Pub. L. 92-433 and Pub. L. 93-150);

(j) [Reserved]

(k) Pursuant to section 15 of Public Law 100-241, any of the following distributions made to a household, an individual Native, or a descendant of a Native by a Native Corporation established pursuant to the Alaska Native Claims Settlement Act (ANCSA) (Pub. L. 92-203, as amended):

(1) Cash distributions (including cash dividends on stock from a Native Corporation) received by an individual are never counted as income or resources to the extent that such cash does not, in the aggregate, exceed $2,000 in a year. Cash which, in the aggregate, is in excess of $2,000 in a year is not subject to the income and resources disregards in this paragraph (a)(4)(ii)(k)(1);

(2) Stock (including stock issued or distributed by a Native Corporation as a dividend or distribution on stock);

(3) A partnership interest;

(4) Land or an interest in land (including land or an interest in land received from a Native Corporation as a dividend or distribution on stock); and

(5) An interest in a settlement trust.

(l) Benefits paid to eligible households under the Low Income Home Energy Assistance Act of 1981 pursuant to section 2605(f) of Pub. L. 97-35;

(m) Effective October 17, 1975, pursuant to section 6 of Pub. L. 94-114 (89 Stat. 577, 25 U.S.C. 459e) receipts distributed to members of certain Indian tribes which are referred to in section 5 of Pub. L. 94-114 (89 Stat. 577, 25 U.S.C. 459d).

(n) Pursuant to section 7 of Public Law 93-134, as amended by section 4 of Public Law 97-458, Indian judgment funds that are held in trust by the Secretary of the Interior (including interest and investment income accrued while such funds are so held in trust), or distributed per capita to a household or member of an Indian tribe pursuant to a plan prepared by the Secretary of the Interior and not disapproved by a joint resolution of the Congress, and initial purchases made with such funds. This disregard does not apply to proceeds from the sale of initial purchases, subsequent purchases made with funds derived from the sale or conversion of the initial purchases, or to funds or initial purchases which are inherited or transferred.

(o) Pursuant to section 2 of Public Law 98-64, all funds held in trust by the Secretary of the Interior for an Indian tribe (including interest and investment income accrued while such funds are so held in trust) and distributed per capita to a household or member of an Indian tribe, and initial purchases made with such funds. This disregard does not apply to proceeds from the sale of initial purchases, subsequent purchases made with funds derived from the sale or conversion of initial purchases, or to funds or initial purchases which are inherited or transferred.

(p) Any student financial assistance provided under programs in title IV of the Higher Education Act of 1965, as amended, and under Bureau of Indian Affairs education assistance programs.

(q) For AFDC, any payments made as restitution to an individual under title I of Public Law 100-383 (the Civil Liberties Act of 1988) or under title II of Public Law 100-383 (the Aleutian and Pribilof Islands Restitution Act).

(r) Any Federal major disaster and emergency assistance provided under the Disaster Relief Act of 1974, as amended by Public Law 100-707 (the Disaster Relief and Emergency Assistance Amendments of 1988) and comparable disaster assistance provided by States, local governments and disaster assistance organizations.

(s) Any payments made pursuant to the settlement in the In Re Agent Orange Product liability litigation, M.D.L. No. 381 (E.D.N.Y.).

(t) Student financial assistance made available for the attendance costs defined in this paragraph under programs in the Carl D. Perkins Vocational and Applied Technology Education Act (20 U.S.C. 2301 et seq.). Attendance costs are: tuition and fees normally assessed a student carrying the same academic workload as determined by the institution, and including costs for rental or purchase of any equipment, materials, or supplies required of all students in the same course of study; and an allowance for books, supplies, transportation, dependent care and miscellaneous personal expenses for a student attending the institution on at least a half-time basis, as determined by the institution.

(u) For AFDC, any payments made pursuant to section 6(h)(2) of Public Law 101-426, the Radiation Exposure Compensation Act.

(iii) Provide that income and resources which are disregarded or set aside under this part will not be taken into consideration in determining the need of any other individual for assistance.

(iv) For AFDC, any amounts determined to have been paid by a State from State-only funds to supplement or otherwise increase the amount of aid paid to an assistance unit as computed under § 233.35 for a month in recognition of current or anticipated needs of the assistance unit for that same month shall not be counted as income—to the extent that the total of the State supplemental payment, the AFDC payment and actual income (i.e., the amount of income received during the payment month after subtracting from gross income the $75 work expense disregard (to recognize mandatory payroll deductions, transportation costs, and other work expenses), child care and other applicable disregards) received in that month are not in excess of what the State would have paid for that month to an assistance unit of the same size and composition with no income—in computing the assistance payment under § 233.35 for the corresponding payment month.

(5) Proration of shelter, utilities, and similar needs in AFDC. (i) Provide that the State agency may prorate allowances in the need and payment standards for shelter, utilities, and similar needs when the AFDC assistance unit lives together with other individuals as a household; except that, the State shall not prorate with respect to any person receiving SSI to whom the statutory one-third reduction (section 1612(a)(2)(A)(i) of the Act) is applied, or prorate when a bona fide landlord-tenant relationship exists. If the State chooses to prorate under this paragraph, it must prorate both the need standard and payment standard.

(ii) If the State agency elects to prorate allowances for shelter, utilities, and similar needs the State plan must:

(A) Indicate which allowances will be prorated, and describe the procedure which will be used to prorate the allowances;

(B) Provide that the allowances will be prorated on a reasonable basis; and

(C) Specify the circumstances under which proration will occur, including a description of which individuals are considered to be living with an AFDC assistance unit as a household.

(6) Disregard of earned income; definition. Provide that for purposes of disregarding earned income the agency policies will include:

(i) A definition of earned income in accordance with the provisions of paragraphs (a)(6) (iii) through (ix) of this section; and

(ii) Provision for disregarding earned income for the period during which it is earned, rather than when it is paid, in cases of lump-sum payment for services rendered over a period of more than 1 month.

(iii) The term earned income encompasses income in cash or in kind earned by an individual through the receipt of wages, salary, commissions, or profit from activities in which he is engaged as a self-employed individual or as an employee. For AFDC, earned income means gross earned income prior to any deductions for taxes or for any other purposes, except as provided in paragraph (a)(6)(v). Such earned income may be derived from his own employment, such as a business enterprise, or farming; or derived from wages or salary received as an employee. It includes earnings over a period of time for which settlement is made at one given time, as in the instance of sale of farm crops, livestock, or poultry. For OAA, AB, APTD and AABD only, in considering income from farm operation, the option available for reporting under OASDI, namely the cash receipts and disbursements method, i.e., a record of actual gross, of expenses, and of net, is an individual determination and is acceptable also for these assistance programs.

(iv) With reference to commissions, wages, or salary, the term earned income means the total amount, irrespective of personal expenses, such as income-tax deductions, lunches, and transportation to and from work, and irrespective of expenses of employment which are not personal, such as the cost of tools, materials, special uniforms, or transportation to call on customers.

(v)(A) For OAA, AB, APTD, and AABD, with respect to self-employment, the term earned income means the total profit from business enterprise, farming, etc., resulting from a comparison of the gross income received with the business expenses, i.e., total cost of the production of the income. Personal expenses, such as income-tax payments, lunches, and transportation to and from work, are not classified as business expenses.

(B) For AFDC, with respect to self-employment the term earned income means the total profit from business enterprise, farming, etc., resulting from a comparison of the gross receipts with the business expenses, i.e., expenses directly related to producing the goods or services and without which the goods or services could not be produced. However, items such as depreciation, personal business and entertainment expenses, personal transportation, purchase of capital equipment and payments on the principal of loans for capital assets or durable goods are not business expenses.

(vi) The definition shall exclude the following from earned income: Returns from capital investment with respect to which the individual is not himself actively engaged, as in a business (for example, under most circumstances, dividends and interest would be excluded from earned income); benefits (not in the nature of wages, salary, or profit) accruing as compensation, or reward for service, or as compensation for lack of employment (for example, pensions and benefits, such as United Mine Workers' benefits or veterans' benefits).

(vii) With regard to the degree of activity, earned income is income produced as a result of the performance of services by a recipient; in other words, income which the individual earns by his own efforts, including managerial responsibilities, would be properly classified as earned income, such as management of capital investment in real estate. Conversely, for example, in the instance of capital investment wherein the individual carries no specific responsibility, such as where rental properties are in the hands of rental agencies and the check is forwarded to the recipient, the income would not be classified as earned income.

(viii) Reserves accumulated from earnings are given no different treatment than reserves accumulated from any other sources.

(7) Disregard of earned income; method. (i) Provide that for other than AFDC, the following method will be used for disregarding earned income: The applicable amounts of earned income to be disregarded will be deducted from the gross amount of earned income, and all work expenses, personal and non-personal, will then be deducted. Only the net amount remaining will be applied in determining need and the amount of the assistance payment.

(ii) In applying the $30 and one-third disregard under paragraph (a)(11)(i)(D) of this section to an applicant for AFDC, there will be a preliminary step to determine whether the assistance unit is eligible without applying the disregard to the individual's earned income, by comparing the applicant's gross earned income (less the disregards in paragraphs (a)(11)(i) (A), (B) and (C)) and all of the assistance unit's other income to the State need standard. This preliminary step does not apply if the individual has received AFDC in one of the four months prior to the month of application.

(8) Disregard of earned income applicable only to OAA, APTD, or AABD. If the State chooses to disregard earned income, specify the amount to be disregarded of the first $80 per month of income that is earned by an aged or disabled individual claiming OAA, APTD, or AABD, who is not blind, but not more than $20 per month plus one-half of the next $60 of such earned income.

(9) Disregard of income and resources applicable only to APTD or AABD. If the State chooses to disregard income (which may be additional to the income disregarded under paragraph (a)(8) of this section) or resources for a disabled individual to achieve the fulfillment of a plan of self-support, provide that the amounts of additional income and resources will not exceed those found necessary for the period during which the individual is actually undergoing vocational rehabilitation, and specify the period, not in excess of 36 months, for which such amounts are to be disregarded.

(10) Disregard of income and resources applicable only to AB or AABD. Provide that, in determining the need of individuals who are blind, (i) the first $85 per month of earned income of the individual plus one-half of earned income in excess of $85 per month will be disregarded; and (ii) if the individual has a plan for achieving self-support, such additional income and resources as are necessary to fulfill such plan will be disregarded for a period not in excess of 12 months. Such additional income and resources may be disregarded for an additional period not in excess of 24 months (for a total of 36 months), as specified in the State plan.

(11) Disregard of income and resources applicable only to AFDC. (i) For purposes of eligibility determination, the State must disregard from the monthly earned income, i.e., earned income as defined in § 233.20(a)(6)(iii), of each individual whose needs are included in the eligibility determination:

(A) Disregard all of the monthly earned income of each child receiving AFDC if the child is a full-time student or is a part-time student who is not a full-time employee. A student is one who is attending a school, college, or university or a course of vocational or technical training designed to fit him or her for gainful employment and includes a participant in the Job Corps program under the Job Training Partnership Act (JTPA).

(B) The first $90.

(C) Where appropriate, an amount equal to $30 plus one-third of the earned income not already disregarded under paragraphs (a)(11)(i), (a)(11)(v) and (a)(11)(vi) of this section of an individual who received assistance in one of the four prior months.

(D) An amount equal to the actual cost for the care of each dependent child or incapacitated adult living in the same home and receiving AFDC, but not to exceed $175 for each dependent child who is at least age two or each incapacitated adult, and not to exceed $200 for each dependent child who is under age two. For individuals not engaged in full-time employment or not employed throughout the month, the $175 and $200 disregard limits may be applied, or the State agency may establish disregard limits less than $175 and $200.

(E) Where appropriate, $30 of the earned income not already disregarded under paragraphs (a)(11) (i), (v), and (vi) of this section, in the case of an individual who reapplies for assistance within the eight-month period that he/she is eligible for the $30 disregard.

(ii) For purposes of benefit calculation for individuals found eligible under paragraph (a)(11)(i) of this section, the following disregards must be made by the State:

(A) Disregard all of the monthly earned income of each child receiving AFDC if the child is a full-time student or is a part-time student who is not a full-time employee. A student is one who is attending a school, college, or university or a course of vocational or technical training designed to fit him or her for gainful employment and includes a participant in the Job Corps program under the Job Training Partnership Act (JTPA).

(B) Disregard from any other individual's earned income the amounts specified in paragraphs (a)(11)(i)(B) and (a)(11)(i)(D) of this section, and $30 plus one-third of the individual's earned income not already disregarded under paragraphs (a)(11)(ii) and (a)(11)(v) of this section. However, the State may not provide the one-third portion of the disregard to an individual after the fourth consecutive month (any month for which the unit loses the $30 plus one-third disregard because of a provision in paragraph (a)(11)(iii) of this section, shall be considered as one of these months) it has been applied to the individual's earned income and may not apply the $30 disregard after the eighth month following the fourth consecutive month (regardless of whether the $30 disregard was actually applied in those months) unless twelve consecutive months have passed during which the individual is not a recipient of AFDC. If income from a recurring source resulted in suspension or termination due to an extra paycheck, the month of ineligibility does not interrupt the accumulation of consecutive months of the $30 plus one-third disregard, nor does it count as one of the consecutive months.

(iii) The applicable earned income disregards in paragraphs (i) (B) and (C) and (ii)(B) of this paragraph do not apply to the earned income of the individual for the month in which one of the following conditions apply to him:

(A) An individual terminated his employment or reduced his earned income without good cause (as specified in the State plan) within the period of 30 days preceding such month;

(B) An individual refused without good cause (as specified in the State plan) within the period of 30 days preceding such month to accept employment in which he is able to engage which is offered through the public employment offices of the State, or is otherwise offered by an employer if the offer of such employer is determined by the State or local agency administering the State plan, after notification by him, to be a bona fide offer of employment;

(C) An individual failed without good cause (as specified in the State plan) to make a timely report (as defined in § 233.37(c)) of that income; or

(D) The individual voluntarily requests assistance to be terminated for the primary purpose of avoiding receiving the $30 and one-third disregard for four consecutive months.

(iv) [Reserved]

(v) The treatment of earned income and expenses under JOBS is as follows:

(A) For earned income from regular employment or on-the-job training, as described at § 250.61, the disregards in paragraphs (a)(11)(i) and (a)(11)(ii)(B) shall apply.

(B) For earned income from a job under the work supplementation component, as described at § 250.62, the disregards in paragraphs (a)(11)(i) and (a)(11)(ii)(B) shall apply unless the State IV-A agency in its State JOBS plan, has elected to provide otherwise under § 250.62(j) and § 250.62(k).

(C) For all activities under JOBS and self-initiated education and training in non-JOBS areas, advance payment or reimbursement to the individual for child care, transportation, work-related expenses, or work-related supportive services is disregarded.

(D) Payment or reimbursement of child care pursuant to part 255 for employed individuals who are not JOBS participants and one-time work-related expenses for individuals who are not JOBS participants pursuant to part 255 are disregarded.

(vi) At State option, disregard all or part of the monthly income of any dependent child applying for or receiving AFDC when the income is derived from a program carried out under the Job Training Partnership Act of 1982, except that in respect to earned income such disregard may not exceed six months per calendar year.

(vii) At State option, disregard all or part of the monthly earned income of any dependent child applying for AFDC, if the child is a full-time student, and that income has been disregarded for purposes of paragraph (a)(3)(xiii) of this section.

(viii) Disregard as income the amount of any earned income tax credit payments received by an applicant or recipient. Disregard as resources, in the month of receipt and the following month, the amount of any earned income tax credit payments received by an applicant or recipient. “Earned income tax credit payments” include: Any advance earned income tax credit payment made to a family by an employer and any earned income tax credit payment made as a refund of Federal income taxes.

(12) Recoupment of overpayments and correction of underpayments for programs other than AFDC. Specify uniform Statewide policies for:

(i) Recoupment of overpayments of assistance, including certain overpayments resulting from assistance paid pending hearing decisions.

(A) The State may not recoup any overpayment previously made to a recipient:

(1) Unless the recipient has income or resources exclusive of the current assistance payment currently available in the amount by which the agency proposes to reduce payments: except that,

(2) Where such overpayments were occassioned or caused by the recipient's willful withholding of information concerning his income, resources or other circumstances which may affect the amount of payment, the State may recoup prior overpayments from current assistance grants irrespective of current income or resources.

(B) Withholding of information which is subject to the provisions of paragraph (a)(12)(i)(A)(2) of this section includes the following:

(1) Willful misstatements (either oral or written) made by a recipient in response to oral or written questions from the State agency concerning the recipient's income, resources or other circumstances which may affect the amount of payment. Such misstatements may include understatements of amounts of income or resources and omission of an entire category of income or resources;

(2) A willful failure by the recipient to report changes in income, resources or other circumstances which may affect the amount of payment, if the State agency has clearly notified the recipient of an obligation to report such changes. The recipient shall be given such notification periodically at times (not less frequently than semi-annually) and by methods which the State agency determines will effectively bring such reporting requirements to the recipient's attention:

(3) A willfull failure by the recipient (i) to report receipt of a payment which the recipient knew represented an erroneous overpayment, or (ii) to notify the State agency of receipt of a check which exceeded the prior check by at least the amount which the State agency had previously notified the recipient (pursuant to the provisions of paragraph (a)(12)(i)(A)(4) of this section) might represent an overpayment and constitute a sum to which the recipient would not be entitled. In making a determination pursuant to this paragraph (a)(12)(i)(B)(3), all relevant circumstances including the amount by which the erroneous payment exceeded the previous payment shall be considered.

(C) Each periodic notification under paragraph (a)(12)(i)(B)(2) of this section shall:

(1) Include a reminder that it is the recipient's continuing obligation to furnish to the State agency accurate and timely information concerning changes in income, resources, or other circumstances which may affect the amount of payment, within a reasonable specified period after such change. The recipient may also be notified that a failure to so notify the State agency within the designated time period may constitute a willful withholding of such information and permit the State agency to recover any overpayment occasioned or caused by the willful withholding;

(2) Specifically and comprehensibly in simple phraseology indicate the type of information to be disclosed by the recipient. Examples shall be furnished of the most frequent types of newly acquired income or resources (e.g., inheritance, wages from a part-time job);

(3) Require that, if there is any doubt whether a particular change in circumstances constitutes such reportable information, the recipient contact the State agency or a designated representative thereof within a reasonable specified period of time after such change in circumstances;

(4) If the State plan provides for recoupment in the circumstances described in paragraph (a)(12)(i)(B)(3)(ii) of this section, notify the recipient that if the check received exceeds the prior check by a specified amount (which amount may not be less than that which a reasonable man should have known was erroneous), this increased check may constitute a sum to which the recipient is not entitled. In such instances, the notification may require that the recipient notify the State agency or a designated representative thereof prior to the negotiation of such check, so that corrective action may be taken; the State agency shall respond to such notification within 24 hours. The recipient may also be notified that a failure to so notify the State agency within the designated time period may constitute a willful withholding of such information and permit the State agency to recover such overpayment.

(D) The State agency shall require periodic formal acknowledgement by recipients (on a form utilized for this purpose) that the reporting obligations of this paragraph had been brought to the recipient's attention and that they were understood.

(E) Any recoupment of overpayments made under circumstances other than those specified in paragraph (a)(12)(i)(B) of this section shall be limited to overpayments made during the 12 months preceding the month in which the overpayment was discovered.

(F) Any recoupment of overpayments permitted by paragraph (a)(12)(i)(A)(2) of this section may be made from available income and resources (including disregarded, set-aside or reserved items) or from current assistance payment or from both. If recoupments are made from current assistance payments, the State shall, on a case-by-case basis, limit the proportion of such payments that may be deducted in each case, so as not to cause undue hardship to recipients.

(G) The plan may provide for recoupment in all situations specified herein, or only in certain of the circumstances specified herein, and for waiver of the overpayment where the cost of collection would exceed the amount of the overpayment.

(H) Election by the State not to recoup overpayments shall not waive the provisions of §§ 205.40, and 205.41, or any other quality control requirement.

(ii) Prompt correction of underpayments to current recipients, resulting from administrative error where the State plan provides for recoupment of overpayments. Under this requirement:

(a) Retroactive corrective payment shall be made only for the 12 months preceding the month in which the underpayment is discovered;

(b) For purposes of determining continued eligibility and amount of assistance, such retroactive corrective payments shall not be considered as income or as a resource in the month paid nor in the next following month; and

(c) No retroactive payment need be made where the administrative cost would exceed the amount of the payment.

(13) Recovery of overpayments and correction of underpayments for AFDC. (i) Specify uniform Statewide policies for recovery of overpayments of assistance, including overpayments resulting from assistance paid pending hearing decisions. Overpayment means a financial assistance payment received by or for an assistance unit for the payment month which exceeds the amount for which that unit was eligible. (The agency may deny assistance for the corresponding payment month rather than recover if the assistance unit was ineligible for the budget month, the State becomes aware of the ineligibility when the monthly report is submitted, the recipient accurately reported the budget month's income and other circumstances, and the assistance unit will be eligible for the following payment month.)

(A) The State must take all reasonable steps necessary to promptly correct any overpayment, except that, as set forth in the plan, a State may waive any overpayment which occurred because receipt of an earned income tax credit payment by a family during the period January 1, 1990, to December 31, 1990, caused ineligibility under the 185 percent gross income limitation in paragraph (a)(3)(xiii) of this section.

(1) Any recovery of an overpayment to a current assistance unit, including a current assistance unit or recipient whose overpayment occurred during a prior period of eligibility, must be recovered through repayment (in part or in full) by the individual responsible for the overpayment or recovering the overpayment by reducing the amount of any aid payable to the assistance unit of which he or she is a member, or both.

(2) If recovery is made from the grant, such recovery shall result in the assistance unit retaining, for any payment month, from the combined aid, income and liquid resources, (without application of section 402(a)(8) of the Act) not less than 90 percent of the amount payable under the State plan to a family of the same composition with no other income. Where a State chooses to recover at a rate less than the maximum, it must recover promptly.

(B) The State shall recover an overpayment from (1) the assistance unit which was overpaid, or (2) any assistance unit of which a member of the overpaid assistance unit has subsequently become a member, or (3) any individual members of the overpaid assistance unit whether or not currently a recipient. If the State recovers from individuals who are no longer recipients, or from recipients who refuse to repay the overpayment from their income and resources, recovery shall be made by appropriate action under State law against the income or resources of those individuals.

(C) If through recovery, the amount payable to the assistance unit is reduced to zero, members of the assistance unit are still considered recipients of AFDC.

(D) In cases which have both an underpayment and an overpayment, the State may offset one against the other in correcting the payment.

(E) Prompt recovery of an overpayment: A State must take one of the following three actions by the end of the quarter following the quarter in which the overpayment is first identified:

(1) Recover the overpayment, (2) initiate action to locate and/or recover the overpayment from a former recipient, or (3) execute a monthly recovery agreement from a current recipient's grant or income/resources.

(ii) Specify uniform Statewide policies for prompt correction of any underpayments to current recipients and those who would be a current recipient if the error causing the underpayment had not occurred. Underpayment means a financial assistance payment received by or for an assistance unit for the payment month which is less than the amount for which the assistance unit was eligible, or failure by the State to issue a financial assistance payment for the payment month to an eligible assistance unit if such payment should have been issued. Under this requirement, for purposes of determining continued eligibility and amount of assistance, such retroactive corrective payments shall not be considered as income, or as a resource in the month paid nor in the next following month.

(iii) Paragraph (a)(13) of this section is effective for incorrect payments which are identified subsequent to September 30, 1981.

(iv) In locating former recipients who have outstanding overpayments the State should use appropriate data sources such as State unemployment insurance files, State Department of Revenue information from tax returns, State automobile registration, Bendex, and other files relating to current or former recipients.

(v) The State must maintain information on the individual and total number and amount of overpayments identified and their disposition for current and former recipients.

(vi) The State may elect not to attempt recovery of an overpayment from an individual no longer receiving aid where the overpayment amount is less than $35. Where the overpayment amount owed by an individual no longer receiving aid is $35 or more, the State can determine when it is no longer cost-effective to continue overpayment recovery efforts, provided it has made reasonable efforts to recover the overpayment from the individual. Reasonable efforts must include notification of the amount of and reason for the overpayment and that repayment is required. States must also maintain information regarding uncollected overpayments as provided under paragraph (a)(13)(v) of this section, to enable the State to recover those overpayments if the individual subsequently becomes a recipient. In cases involving fraud, States must make every effort to recover the overpayment, regardless of the amount.

(14) For Medicaid eligibility only, beginning October 1, 1998, pursuant to section 402(a)(37) of the Act, an assistance unit will be deemed to be receiving AFDC, but only for the purposes of this paragraph, for a period of nine months after the last month the family actually received aid if the loss of AFDC eligibility was solely because a member of the unit was no longer eligible due to the 4 and 12 month time limitations to have the $30 and one-third or the $30 disregard in paragraph (a)(11)(ii)(B) applied to his or her earned income. At State option, an additional period of Medicaid coverage for up to six months may be provided when the assistance unit would be eligible during such additional period to receive AFDC if the $30 and one-third or the $30 disregards were applied to the assistance unit's earned income.

(15) For Medicaid eligibility only, pursuant to section 406(h) of the Act:

(i) Each dependent child and each relative with whom such a child is living (including the eligible spouse of such relative pursuant to section 237.50(b) of this chapter) who becomes ineligible for AFDC wholly or partly because of the initiation of or an increase in the amount of a child or spousal support collection under title IV-D will be deemed to be receiving AFDC, but only for purposes of this paragraph (a)(15), for a period of four consecutive calendar months beginning with the first month of AFDC ineligibility. To be eligible for extended Medicaid coverage pursuant to this paragraph (a)(15), each dependent child and relative must meet the following conditions:

(A) The individual must have become ineligible for AFDC on or after August 16, 1984; and

(B) The individual must have received AFDC in at least three of the six months immediately preceding the month in which the individual becomes ineligible for AFDC; and

(C) The individual must have become ineligible for AFDC wholly or partly as a result of the initiation of or an increase in the amount of a child or spousal support collection under title IV-D.

(ii)(A) Except as provided in paragraph (a)(15)(ii)(B) of this section, individuals who are eligible for extended Medicaid lose this coverage if they move to another State during the 4-month period. However, if they move back to and reestablish residence in the State in which they have extended coverage, they are eligible for any of the months remaining in the 4-month period in which they are residents of the State.

(B) If a State has chosen in its State plan to provide Medicaid to non-residents, the State may continue to provide the 4-month extended benefits to individuals who have moved to another State.

(iii) For purposes of paragraph (i) of this section:

(A) The new collection or increased collection of child or spousal support results in the termination of AFDC eligibility when it actively causes or contributes to the termination. This occurs when:

(1) The change in support collection in and of itself is sufficient to cause ineligibility. This rule applies even if the support collection must be added to other, stable income. It also applies even if other independent factors, alone or in combination with each other, might simultaneously cause ineligibility; or

(2) The change in support contributes to ineligibility but does not by itself cause ineligibility. Ineligibility must result when the change in support is combined with other changes in income or changes in other circumstances and the other changes in income or circumstances cannot alone or in combination result in termination without the change in support.

(B) In cases of increases in the amounts of both the support collections and earned income, eligibility under this section does not preclude eligibility under paragraph (a)(14) of this section or section 1925 of the Social Security Act (which was added by section 303(a) of the Family Support Act of 1988 (42 U.S.C. 139r-6)). Extended periods result from both an increase in the amount of the support collection and from an increase in earned income must run concurrently.

(b) Federal financial participation; General. (1) Federal participation will be available in financial assistance payments made on the basis that (after application of policies governing the allowable reserve, disregard or setting aside of income and resources), all income of the needy individual, together with the assistance payment, do not exceed the State's defined standard of assistance, and available resources of the needy individuals do not exceed the limits under the State plan.

(2) Federal participation is available within the maximums specified in the Federal law, when the payments do not exceed the amount determined to be needed under the statewide standard, and are made in accordance with the State method for determining the amount of the payments, as specified in § 233.31 for AFDC and in §§ 233.24 and 233.25 for OAA, AB, APTD, and AABD.

(3) Federal participation is available in financial assistance payments made on the basis of the need of the individual. This basis may include consideration of needy persons living in the same home with the recipient when such other persons are within the State's policy as essential to his well-being. Persons living in the home who are “essential to the well-being of the recipient,” as specified in the State plan, will govern as the basis for Federal participation (see Guides and Recommendations). When the State includes persons living outside the home or persons not in need, Federal participation is not available for that portion of financial assistance payments attributable to such persons, and the State's claims must, therefore, identify the amounts of any such nonmatchable payments.

(4) For all assistance programs except AFDC, Federal participation is available for supplemental payments in the retrospective budgeting system.

(c) Federal financial participation in vendor payments for home repairs. With respect to expenditures made after December 31, 1967, expenditures to a maximum of $500 are subject to Federal financial participation at 50 percent for repairing the home owned by an individual who is receiving aid or assistance (other than Medical Assistance for the Aged) under a State plan for OAA, AFDC, AB, APTD, or AABD if:

(1) Prior to making the expenditures the agency determined that: (i) The home is so defective that continued occupancy is unwarranted; (ii) unless repairs are made the recipient would need to move to rental quarters; and (iii) the rental cost of quarters for the recipient (including the spouse living with him in such home and any other individual whose needs were considered in determining the recipient's need) would exceed (over a period of 2 years) the repair costs needed to make such home habitable together with other costs attributable to continued occupancy of such home.

(2) No expenditures for repair of such home were made previously pursuant to a determination as described in paragraph (c)(1) of this section. This does not preclude more than one payment made at the time repairs are made pursuant to the determination, e.g., separate payments to the roofer, the electrician, and the plumber.

(3) Expenditures for home repairs are authorized in writing by a responsible agency person, records show the eligible person in whose behalf the home repair expenditure was made, and there is sufficient evidence that the home repair was performed.

[34 FR 1394, Jan. 29, 1969]

Editorial Note:For Federal Register citations affecting § 233.20, see the List of CFR Sections Affected, which appears in the Finding Aids section of the printed volume and at www.govinfo.gov.

Effective Date Note:At 47 FR 5678, Feb. 5, 1982, § 233.20(a)(13)(v) was added. This paragraph contains information collection and recordkeeping requirements and will not become effective until approval has been given by the Office of Management and Budget.

§§ 233.21-233.29 [Reserved]

§§ 233.31-233.40 [Reserved]

§§ 233.50-233.53 [Reserved]

§ 233.60 [Reserved]

§ 233.70 [Reserved]

§ 233.80 [Reserved]

§ 233.90 Factors specific to AFDC.

(a) State plan requirements. A State plan under title IV-A of the Social Security Act shall provide that:

(1) The determination whether a child has been deprived of parental support or care by reason of the death, continued absence from the home, or physical or mental incapacity of a parent, or (if the State plan includes such cases) the unemployment of his or her parent who is the principal earner will be made only in relation to the child's natural or adoptive parent, or in relation to the child's stepparent who is married, under State law, to the child's natural or adoptive parent and is legally obligated to support the child under State law of general applicability which requires stepparents to support stepchildren to the same extent that natural or adoptive parents are required to support their children. Under this requirement, the inclusion in the family, or the presence in the home, of a “substitute parent” or “man-in-the-house” or any individual other than one described in this paragraph is not an acceptable basis for a finding of ineligibility or for assuming the availability of income by the State; and

(2) Where it has reason to believe that a child receiving aid is in an unsuitable environment because of known or suspected instances of physical or mental injury, sexual abuse or exploitation, or negligent treatment or maltreatment of such child, under circumstances which indicate the child's health or welfare is threatened, the State or local agency will:

(i) Bring such condition to the attention of a court, law-enforcement agency, or other appropriate agency in the State, providing whatever data it has with respect to the situation;

(ii) In reporting such conditions, use the same criteria as are used in the State for all other parents and children; and

(iii) Cooperate with the court or other agency in planning and implementing action in the best interest of the child.

(b) Conditions for plan approval. (1) A child may not be denied AFDC either initially or subsequently “because of the conditions of the home in which the child resides”, or because the home is considered “unsuitable”, unless “provision is otherwise made pursuant to a State statute for adequate care and assistance with respect to such child”. (Section 404(b) of the Social Security Act.)

(2) An otherwise eligible child who is under the age of 18 years may not be denied AFDC, regardless of whether she attends school (unless she is required to participate in the JOBS program pursuant to § 250.30 and she is assigned to educational activities) or makes satisfactory grades.

(3) A state may elect to include in its AFDC program children age 18 who are full-time students in a secondary school, or in the equivalent level of vocational or technical training, and who may reasonably be expected to complete the program before reaching age 19.

(4)(i) A child may not be denied AFDC either initially or subsequently because a parent or other caretaker relative fails to cooperate with the child support agency in performing any of the activities needed to:

(A) Establish the paternity of a child born out of wedlock; or

(B) Obtain support from a person having a legal duty to support the child.

(ii) Any parent or caretaker relative who fails to so cooperate shall be treated in accordance with § 232.12 of this chapter.

(5) [Reserved]

(6) An otherwise eligible child may not be denied AFDC if a parent is mentally or physically incapacitated as defined in paragraph (c)(1)(iv) of this section.

(c) Federal financial participation. (1) Federal financial participation under title IV-A of the Social Security Act in payments with respect to a “dependent child,” as defined in section 406(a) of the Act, is available within the following interpretations:

(i) Needy child deprived by reason of. The phrase “needy child * * * deprived * * * by reason of” requires that both need and deprivation of parental support or care exist in the individual case. The phrase encompasses the situation of any child who is in need and otherwise eligible, and whose parent—father or mother—either has died, has a physical or mental incapacity, or is continually absent from the home. This interpretation is equally applicable whether the parent was the chief bread winner or devoted himself or herself primarily to the care of the child, and whether or not the parents were married to each other. The determination whether a child has been deprived of parental support or care is made in relation to the child's natural parent or, as appropriate, the adoptive parent or stepparent described in paragraph (a) of this section.

(ii) Death of a parent. If either parent of a child is deceased, the child is deprived of parental support or care, and may, if he is in need and otherwise eligible, be included within the scope of the program.

(iii) Continued absence of the parent from the home. Continued absence of the parent from the home constitutes the reason for deprivation of parental support or care when the parent is out of the home, the nature of the absence is such as either to interrupt or to terminate the parent's functioning as a provider of maintenance, physical care, or guidance for the child, and the known or indefinite duration of the absence precludes counting on the parent's performance of the function of planning for the present support or care of the child. If these conditions exist, the parent may be absent for any reason, and may have left only recently or some time previously; except that a parent whose absence is occasioned solely by reason of the performance of active duty in the uniformed services of the United States (as defined in section 101(3) of Title 37, United States code) is not considered absent from the home. A parent who is a convicted offender but is permitted to live at home while serving a court-imposed sentence by performing unpaid public work or unpaid community service during the workday is considered absent from the home.

(iv) “Physical or mental incapacity”. “Physical or mental incapacity” of a parent shall be deemed to exist when one parent has a physical or mental defect, illness, or impairment. The incapacity shall be supported by competent medical testimony and must be of such a debilitating nature as to reduce substantially or eliminate the parent's ability to support or care for the otherwise eligible child and be expected to last for a period of at least 30 days. In making the determination of ability to support, the agency shall take into account the limited employment opportunities of handicapped individuals.

A finding of eligibility for OASDI or SSI benefits, based on disability or blindness is acceptable proof of incapacity for AFDC purposes.

(v) “Living with [a specified relative] in a place of residence maintained * * * as his * * * own home”. (A) A child may be considered to meet the requirement of living with one of the relatives specified in the Act if his home is with a parent or a person in one of the following groups:

(1) Any blood relative, including those of half-blood, and including first cousins, nephews, or nieces, and persons of preceding generations as denoted by prefixes of grand, great, or great-great.

(2) Stepfather, stepmother, stepbrother, and stepsister.

(3) Person who legally adopt a child or his parent as well as the natural and other legally adopted children of such persons, and other relatives of the adoptive parents in accordance with State law.

(4) Spouses of any persons named in the above groups even after the marriage is terminated by death or divorce.

(B) A home is the family setting maintained or in process of being established, as evidenced by assumption and continuation of responsibility for day to day care of the child by the relative with whom the child is living. A home exists so long as the relative exercises responsibility for the care and control of the child, even though either the child or the relative is temporarily absent from the customary family setting. Within this interpretation, the child is considered to be “living with” his relative even though:

(1) He is under the jurisdiction of the court (e.g., receiving probation services or protective supervision); or

(2) Legal custody is held by an agency that does not have physical possession of the child.

(2) Federal financial participation is available in:

(i) Initial payments made on behalf of a child who goes to live with a relative specified in section 406(a)(1) of the Social Security Act within 30 days of the receipt of the first payment, provided payments are not made for concurrent period for the same child in the home of another relative or as foster care under title IV-E;

(ii) Payments made for the entire month in the course of which a child leaves the home of a specified relative, provided payments are not made for a concurrent period for the same child in the home of another relative or as foster care under title IV-E; and

(iii) Payments made to persons acting for relatives specified in section 406(a)(1) of the Act in emergency situations that deprive the child of the care of the relative through whom he has been receiving aid, for a temporary period necessary to make and carry out plans for the child's continuing care and support.

(iv) At State option, (A) payments with respect to a pregnant woman with no other children receiving assistance, and additionally, at State option, (B) payments for the purpose of meeting special needs occasioned by or resulting from pregnancy both for the pregnant woman with no other children as well as for the pregnant woman receiving AFDC. However, for both paragraphs (c)(2)(iv) (A) and (B) of this section it must be medically verified that the child is expected to be born in the month such payments are made or within the three-month period following such month of payment, and who, if such child had been born and was living with her in the month of payment, would be eligible for aid to families with dependent children. Federal financial participation is not available to meet the needs of the unborn child. (Refer to Medicaid regulations at 42 CFR 435.115 for Medicaid coverage of pregnant women.)

(3) Federal financial participation (at the 50 percent rate) is available in any expenses incurred in establishing eligibility for AFDC, including expenses incident to obtaining necessary information to determine the existence of incapacity of a parent or pregnancy of a mother.

[36 FR 3868, Feb. 27, 1971, as amended at 39 FR 34038, Sept. 23, 1974; 40 FR 27156, June 26, 1975; 44 FR 12424, Mar. 7, 1979; 47 FR 5681, Feb. 5, 1982; 47 FR 41114, Sept. 17, 1982; 48 FR 28409, June 21, 1983; 51 FR 9206, Mar. 18, 1986; 52 FR 28824, Aug. 4, 1987; 54 FR 42243, Oct. 13, 1989; 58 FR 49218, Sept. 22, 1993; 59 FR 26142, May 19, 1994]

§§ 233.100-233.101 [Reserved]

§§ 233.106-233.107 [Reserved]

§ 233.110 [Reserved]

§ 233.145 [Reserved]

§ 260.10 [Reserved]

§ 260.20 What is the purpose of the TANF program?

The TANF program has the following four purposes:

(a) Provide assistance to needy families so that children may be cared for in their own homes or in the homes of relatives;

(b) End the dependence of needy parents on government benefits by promoting job preparation, work, and marriage;

(c) Prevent and reduce the incidence of out-of-wedlock pregnancies and establish annual numerical goals for preventing and reducing the incidence of these pregnancies; and

(d) Encourage the formation and maintenance of two-parent families.

§ 260.30 What definitions apply under the TANF regulations?

The following definitions apply under parts 260 through 265 of this chapter:

ACF means the Administration for Children and Families.

Act means Social Security Act, unless otherwise specified.

Adjusted State Family Assistance Grant, or adjusted SFAG, means the SFAG amount, minus any reductions for Tribal Family Assistance Grants paid to Tribal grantees on behalf of Indian families residing in the State and any transfers to the Social Services Block Grant or the Child Care and Development Block Grant.

Administrative costs has the meaning specified at § 263.0(b) of this chapter.

Adult means an individual who is not a “minor child,” as defined elsewhere in this section.

AFDC means Aid to Families with Dependent Children.

Aid to Families with Dependent Children means the welfare program in effect under title IV-A of prior law.

Assistance has the meaning specified at § 260.31.

Basic MOE means the expenditure of State funds that must be made in order to meet the MOE requirement at section 409(a)(7) of the Act.

Cash assistance, when provided to participants in the Welfare-to-Work program (WtW), has the meaning specified at § 260.32.

CCDBG means the Child Care and Development Block Grant Act of 1990, as amended, 42 U.S.C. 9858 et seq.

CCDF means the Child Care and Development Fund, or those child care programs and services funded either under section 418(a) of the Act or CCDBG.

Commingled State TANF expenditures means expenditures of State funds that are made within the TANF program and commingled with Federal TANF funds.

Contingency fund means Federal TANF funds available under section 403(b) of the Act, and contingency funds means the Federal monies made available to States under that section. Neither term includes any State funds expended pursuant to section 403(b).

Contingency fund MOE means the MOE expenditures that a State must make in order to meet the MOE requirements at sections 403(b)(6) and 409(a)(10) of the Act and subpart B of part 264 of this chapter and retain contingency funds made available to the State. The only expenditures that qualify for Contingency Fund MOE are State TANF expenditures.

Control group is a term relevant to continuation of a “waiver” and has the meaning specified at § 260.71.

Countable State expenditures has the meaning specified at § 264.0 of this chapter.

Discretionary fund of the CCDF refers to child care funds appropriated under the CCDBG.

EA means Emergency Assistance.

Eligible State means a State that, during the 27-month period ending with the close of the first quarter of the fiscal year, has submitted a TANF plan that we have determined is complete.

Emergency assistance means the program option available to States under sections 403(a)(5) and 406(e) of prior law to provide short-term assistance to needy families with children.

Expenditure means any amount of Federal TANF or State MOE funds that a State expends, spends, pays out, or disburses consistent with the requirements of parts 260 through 265 of this chapter. It may include expenditures on the refundable portions of State or local tax credits, if they are consistent with the provisions at § 260.33. It does not include any amounts that merely represent avoided costs or foregone revenue. Avoided costs include such items as contractor penalty payments for poor performance and purchase price discounts, rebates, and credits that a State receives. Foregone revenue includes State tax provisions—such as waivers, deductions, exemptions, or nonrefundable tax credits—that reduce a State's tax revenue.

Experimental group is a term relevant to continuation of a “waiver” and has the meaning specified at § 260.71.

FAG has the meaning specified at § 264.0(b) of this chapter.

Family Violence Option (or FVO) has the meaning specified at § 260.51.

FAMIS means the automated statewide management information system under sections 402(a)(30), 402(e), and 403 of prior law.

Federal expenditures means expenditures by a State of Federal TANF funds.

Federal TANF funds means all funds provided to the State under section 403 of the Act except WtW funds awarded under section 403(a)(5), including the SFAG, any bonuses, supplemental grants, or contingency funds.

Federally recognized good cause domestic violence waiver has the meaning specified at § 260.51.

Fiscal year means the 12-month period beginning on October 1 of the preceding calendar year and ending on September 30.

FY means fiscal year.

Good cause domestic violence waiver has the meaning specified at § 260.51.

Governor means the Chief Executive Officer of the State. It thus includes the Governor of each of the 50 States and the Territories and the Mayor of the District of Columbia.

IEVS means the Income and Eligibility Verification System operated pursuant to the provisions in section 1137 of the Act.

Inconsistent is a term relevant to continuation of a “waiver” and has the meaning specified at § 260.71.

Indian, Indian Tribe and Tribal Organization have the meaning given such terms by section 4 of the Indian Self-Determination and Education Assistance Act (25 U.S.C. 450b), except that the term “Indian tribe” means, with respect to the State of Alaska, only the Metlakatla Indian Community of the Annette Islands Reserve and the following Alaska Native regional nonprofit corporations:

(1) Arctic Slope Native Association;

(2) Kawerak, Inc.;

(3) Maniilaq Association;

(4) Association of Village Council Presidents;

(5) Tanana Chiefs Council;

(6) Cook Inlet Tribal Council;

(7) Bristol Bay Native Association;

(8) Aleutian and Pribilof Island Association;

(9) Chugachmuit;

(10) Tlingit Haida Central Council;

(11) Kodiak Area Native Association; and

(12) Copper River Native Association.

Individual Development Account, or IDA, has the meaning specified at § 263.20 of this chapter.

Job Opportunities and Basic Skills Training Program means the program under title IV-F of prior law to provide education, training and employment services to welfare recipients.

JOBS means the Job Opportunities and Basic Skills Training Program.

Minor child means an individual who:

(1) Has not attained 18 years of age; or

(2) Has not attained 19 years of age and is a full-time student in a secondary school (or in the equivalent level of vocational or technical training).

MOE means maintenance-of-effort.

Needy State is a term that pertains to the provisions on the Contingency Fund and the penalty for failure to meet participation rates. It means, for a month, a State where:

(1)(i) The average rate of total unemployment (seasonally adjusted) for the most recent 3-month period for which data are published for all States equals or exceeds 6.5 percent; and

(ii) The average rate of total unemployment (seasonally adjusted) for such 3-month period equals or exceeds 110 percent of the average rate for either (or both) of the corresponding 3-month periods in the two preceding calendar years; or

(2) The Secretary of Agriculture has determined that the average number of individuals participating in the Food Stamp program in the State has grown at least 10 percent in the most recent 3-month period for which data are available.

Noncustodial parent means a parent of a minor child who:

(1) Lives in the State; and

(2) Does not live in the same household as the minor child.

Prior law means the provisions of title IV-A and IV-F of the Act in effect as of August 21, 1996. They include provisions related to Aid to Families with Dependent Children (or AFDC), Emergency Assistance (or EA), Job Opportunities and Basic Skills Training (or JOBS), and FAMIS.

PRWORA means the Personal Responsibility and Work Opportunity Reconciliation Act of 1996, or Pub. L. 104-193, 42 U.S.C. 1305 note.

Qualified Aliens has the meaning prescribed under section 431 of PRWORA, as amended, 8 U.S.C. 1641.

Qualified State Expenditures means the total amount of State funds expended during the fiscal year that count for basic MOE purposes. It includes expenditures, under any State program, for any of the following with respect to eligible families:

(1) Cash assistance;

(2) Child care assistance;

(3) Educational activities designed to increase self-sufficiency, job training, and work, excluding any expenditure for public education in the State except expenditures involving the provision of services or assistance of an eligible family that is not generally available to persons who are not members of an eligible family;

(4) Any other use of funds allowable under subpart A of part 263 of this chapter; and

(5) Administrative costs in connection with the matters described in paragraphs (1), (2), (3) and (4) of this definition, but only to the extent that such costs do not exceed 15 percent of the total amount of qualified State expenditures for the fiscal year.

Secretary means Secretary of the Department of Health and Human Services or any other Department official duly authorized to act on the Secretary's behalf.

Segregated State TANF expenditures means expenditures of State funds within the TANF program that are not commingled with Federal TANF funds.

Separate State program, or SSP, means a program operated outside of TANF in which the expenditures of State funds may count for basic MOE purposes.

SFAG means State family assistance grant, as defined in this section.

SFAG payable means the SFAG amount, reduced, as appropriate, for any Tribal Family Assistance Grants made on behalf of Indian families residing in the State and any penalties imposed on a State under this chapter.

Single audit means an audit or supplementary review conducted under the authority of the Single Audit Act at 31 U.S.C. chapter 75.

Social Services Block Grant means the social services program operated under title XX of the Act, pursuant to 42 U.S.C. 1397.

SSBG means the Social Services Block Grant.

State means the 50 States of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the United States Virgin Islands, Guam, and American Samoa, unless otherwise specified.

State agency means the agency that the Governor certifies as the administering and supervising agency for the TANF program, pursuant to section 402(a)(4) of the Act.

State family assistance grant means the amount of the basic block grant allocated to each eligible State under the formula at section 403(a)(1) of the Act.

State MOE expenditures means the expenditure of State funds that may count for purposes of the basic MOE requirements at section 409(a)(7) of the Act and the Contingency Fund MOE requirements at sections 403(b)(4) and 409(a)(10) of the Act.

State TANF expenditures means the expenditure of State funds within the TANF program.

TANF means The Temporary Assistance for Needy Families Program.

TANF program means a State program of family assistance operated by an eligible State under its State TANF plan.

Territories means the Commonwealth of Puerto Rico, the United States Virgin Islands, Guam, and American Samoa.

Title IV-A refers to the title and part of the Act that now includes TANF, but previously included AFDC and EA. For the purpose of the TANF program regulations, this term does not include child care programs authorized and funded under section 418 of the Act, or their predecessors, unless we specify otherwise.

Tribal family assistance grant means a grant paid to a Tribe that has an approved Tribal family assistance plan under section 412(a)(1) of the Act.

Tribal grantee means a Tribe that receives Federal TANF funds to operate a Tribal TANF program under section 412(a) of the Act.

Tribal TANF program means a TANF program developed by an eligible Tribe, Tribal organization, or consortium and approved by us under section 412 of the Act.

Tribe means Indian Tribe or Tribal organization, as defined elsewhere in this section. The definition may include Tribal consortia (i.e., groups of federally recognized Tribes or Alaska Native entities that have banded together in a formal arrangement to develop and administer a Tribal TANF program).

Victim of domestic violence has the meaning specified at § 260.51.

Waiver, when used in subpart C of this part, has the meaning specified at § 260.71.

We (and any other first person plural pronouns) means the Secretary of Health and Human Services or any of the following individuals or organizations acting in an official capacity on the Secretary's behalf: the Assistant Secretary for Children and Families, the Regional Administrators for Children and Families, the Department of Health and Human Services, and the Administration for Children and Families.

Welfare-to-Work means the new program for funding work activities at section 403(a)(5) of the Act.

WtW means Welfare-to-Work.

WtW cash assistance has the meaning specified at § 260.32.

[64 FR 17878, Apr. 12, 1999; 64 FR 40291, July 26, 1999]

§ 260.31 What does the term “assistance” mean?

(a)(1) The term “assistance” includes cash, payments, vouchers, and other forms of benefits designed to meet a family's ongoing basic needs (i.e., for food, clothing, shelter, utilities, household goods, personal care items, and general incidental expenses).

(2) It includes such benefits even when they are:

(i) Provided in the form of payments by a TANF agency, or other agency on its behalf, to individual recipients; and

(ii) Conditioned on participation in work experience or community service (or any other work activity under § 261.30 of this chapter).

(3) Except where excluded under paragraph (b) of this section, it also includes supportive services such as transportation and child care provided to families who are not employed.

(b) It excludes:

(1) Nonrecurrent, short-term benefits that:

(i) Are designed to deal with a specific crisis situation or episode of need;

(ii) Are not intended to meet recurrent or ongoing needs; and

(iii) Will not extend beyond four months.

(2) Work subsidies (i.e., payments to employers or third parties to help cover the costs of employee wages, benefits, supervision, and training);

(3) Supportive services such as child care and transportation provided to families who are employed;

(4) Refundable earned income tax credits;

(5) Contributions to, and distributions from, Individual Development Accounts;

(6) Services such as counseling, case management, peer support, child care information and referral, transitional services, job retention, job advancement, and other employment-related services that do not provide basic income support; and

(7) Transportation benefits provided under a Job Access or Reverse Commute project, pursuant to section 404(k) of the Act, to an individual who is not otherwise receiving assistance.

(c) The definition of the term assistance specified in paragraphs (a) and (b) of this section:

(1) Does not apply to the use of the term assistance at part 263, subpart A, or at part 264, subpart B, of this chapter; and

(2) Does not preclude a State from providing other types of benefits and services in support of the TANF goal at § 260.20(a).

§ 260.32 [Reserved]

§ 260.33 When are expenditures on State or local tax credits allowable expenditures for TANF-related purposes?

(a) To be an allowable expenditure for TANF-related purposes, any tax credit program must be reasonably calculated to accomplish one of the purposes of the TANF program, as specified at § 260.20.

(b)(1) In addition, pursuant to the definition of expenditure at § 260.30, we would only consider the refundable portion of a State or local tax credit to be an allowable expenditure.

(2) Under a State Earned Income Tax Credit (EITC) program, the refundable portion that may count as an expenditure is the amount that exceeds a family's State income tax liability prior to application of the EITC. (The family's tax liability is the amount owed prior to any adjustments for credits or payments.) In other words, we would count only the portion of a State EITC that the State refunds to a family and that is above the amount of EITC used as credit towards the family's State income tax liability.

(3) For other refundable (and allowable) State and local tax credits, such as refundable dependent care credits, the refundable portion that would count as an expenditure is the amount of the credit that exceeds the taxpayer's tax liability prior to the application of the credit. (The taxpayer's liability is the amount owed prior to any adjustments for credits or payments.) In other words, we would count only the portion of the credit that the State refunds to the taxpayer and that is above the amount of the credit applied against the taxpayer's tax bill.

§ 260.34 When do the Charitable Choice provisions of TANF apply?

(a) These Charitable Choice provisions apply whenever a State or local government uses Federal TANF funds or expends State and local funds used to meet maintenance-of-effort (MOE) requirements of the TANF program to directly procure services and benefits from non-governmental organizations, or provides TANF beneficiaries with certificates, vouchers, or other forms of indirect disbursement redeemable from such organizations. For purposes of this section:

(1) Direct funding or funds provided directly means that the government or an intermediate organization with the same duties as a governmental entity under this part selects the provider and purchases the needed services straight from the provider (e.g., via a contract or cooperative agreement).

(2) Indirect funding or funds provided indirectly means placing the choice of service provider in the hands of the beneficiary, and then paying for the cost of that service through a voucher, certificate, or other similar means of payment.

(b)(1) Religious organizations are eligible, on the same basis as any other organization, to participate in TANF as long as their Federal TANF or State MOE funded services are provided consistent with the Establishment Clause and the Free Exercise Clause of the First Amendment to the United States Constitution.

(2) Neither the Federal government nor a State or local government in its use of Federal TANF or State MOE funds shall, in the selection of service providers, discriminate for or against an organization that applies to provide, or provides TANF services or benefits on the basis of the organization's religious character or affiliation.

(c) No Federal TANF or State MOE funds provided directly to participating organizations may be expended for inherently religious activities, such as worship, religious instruction, or proselytization. If an organization conducts such activities, it must offer them separately, in time or location, from the programs or services for which it receives direct Federal TANF or State MOE funds under this part, and participation must be voluntary for the beneficiaries of those programs or services.

(d) A religious organization that participates in the TANF program will retain its independence from Federal, State, and local governments and may continue to carry out its mission, including the definition, practice and expression of its religious beliefs, provided that it does not expend Federal TANF or State MOE funds that it receives directly to support any inherently religious activities, such as worship, religious instruction, or proselytization. Among other things, faith-based organizations may use space in their facilities to provide TANF-funded services without removing religious art, icons, scriptures, or other symbols. In addition, a Federal TANF or State MOE funded religious organization retains the authority over its internal governance, and it may retain religious terms in its organization's name, select its board members on a religious basis, and include religious references in its organization's mission statements and other governing documents.

(e) The participation of a religious organization in, or its receipt of funds from, a TANF program does not affect that organization's exemption provided under 42 U.S.C. 2000e-1 regarding employment practices.

(f) A religious organization that receives Federal TANF or State MOE funds shall not, in providing program services or benefits, discriminate against a TANF applicant or recipient on the basis of religion, a religious belief, a refusal to hold a religious belief, or a refusal to actively participate in a religious practice.

(g)(1) If an otherwise eligible TANF applicant or recipient objects to the religious character of a TANF service provider, the recipient is entitled to receive services from an alternative provider to which the individual has no religious objection. In such cases, the State or local agency must refer the individual to an alternative provider of services within a reasonable period of time, as defined by the State or local agency. That alternative provider must be reasonably accessible and have the capacity to provide comparable services to the individual. Such services shall have a value that is not less than the value of the services that the individual would have received from the program participant to which the individual had such objection, as defined by the State or local agency.

(2) The alternative provider need not be a secular organization. It must simply be a provider to which the recipient has no religious objection. States may adopt reasonable definitions of the terms “reasonably accessible,” “a reasonable period of time,” “comparable,” “capacity,” and “ value that is not less than.” We expect States to apply these terms in a fair and consistent manner.

(3) The appropriate State or local governments that administer Federal TANF or State MOE funded programs shall ensure that notice of their right to alternative services is provided to applicants or recipients. The notice must clearly articulate the recipient's right to a referral and to services that reasonably meet the timeliness, capacity, accessibility, and equivalency requirements discussed above.

(h) Religious organizations that receive Federal TANF and State MOE funds are subject to the same regulations as other non-governmental organizations to account, in accordance with generally accepted auditing/accounting principles, for the use of such funds. Religious organizations may keep Federal TANF and State MOE funds they receive for services segregated in a separate account from non-governmental funds. If religious organizations choose to segregate their funds in this manner, only the Federal TANF and State MOE funds are subject to audit by the government under the program.

(i) This section applies whenever a State or local organization uses Federal TANF or State MOE funds to procure services and benefits from non-governmental organizations, or redeems certificates, vouchers, or other forms of disbursement from them whether with Federal funds, or State and local funds claimed to meet the MOE requirements of section 409(a)(7) of the Social Security Act. Subject to the requirements of paragraph (j), when State or local funds are used to meet the TANF MOE requirements, the provisions apply irrespective of whether the State or local funds are commingled with Federal funds, segregated, or expended in separate State programs.

(j) Preemption. Nothing in this section shall be construed to preempt any provision of a State constitution, or State statute that prohibits or restricts the expenditure of segregated or separate State funds in or by religious organizations.

(k) If a non-governmental intermediate organization, acting under a contract or other agreement with a State or local government, is given the authority under the contract or agreement to select non-governmental organizations to provide Federal TANF or MOE funded services, the intermediate organization must ensure that there is compliance with the Charitable Choice statutory provisions and these regulations. The intermediate organization retains all other rights of a non-governmental organization under the Charitable Choice statute and regulations.

(l) Any party which seeks to enforce its right under this section may assert a civil action for injunctive relief exclusively in an appropriate State court against the entity or agency that allegedly commits such violation.

[68 FR 56465, Sept. 30, 2003]

§ 260.35 What other Federal laws apply to TANF?

(a) Under section 408(d) of the Act, the following provisions of law apply to any program or activity funded with Federal TANF funds:

(1) The Age Discrimination Act of 1975;

(2) Section 504 of the Rehabilitation Act of 1973;

(3) The Americans with Disabilities Act of 1990; and

(4) Title VI of the Civil Rights Act of 1964.

(b) The limitation on Federal regulatory and enforcement authority at section 417 of the Act does not limit the effect of other Federal laws, including Federal employment laws (such as the Fair Labor Standards Act (FLSA), the Occupational Safety and Health Act (OSHA) and unemployment insurance (UI)) and nondiscrimination laws. These laws apply to TANF beneficiaries in the same manner as they apply to other workers.

§ 260.40 When are these provisions in effect?

(a) In determining whether a State is subject to a penalty under parts 261 through 265 of this chapter, we will not apply the regulatory provisions in parts 260 through 265 of this chapter retroactively. We will judge State actions that occurred prior to the effective date of these rules and expenditures of funds received prior to the effective date only against a reasonable interpretation of the statutory provisions in title IV-A of the Act.

(b) The effective date of these rules is October 1, 1999.

§ 260.50 [Reserved]

§ 260.51 What definitions apply to this subpart?

Family Violence Option (or FVO) means the provision at section 402(a)(7) of the Act under which a State certifies in its State plan if it has elected the option to implement comprehensive strategies for identifying and serving victims of domestic violence.

Federally recognized good cause domestic violence waiver means a good cause domestic violence waiver that meets the requirements at §§ 260.52(c) and 260.55.

Good cause domestic violence waiver means a waiver of one or more program requirements granted by a State to a victim of domestic violence under the FVO, as described at § 260.52(c).

Victim of domestic violence means an individual who is battered or subject to extreme cruelty under the definition at section 408(a)(7)(C)(iii) of the Act.

§ 260.52 [Reserved]

§ 260.54 Do States have flexibility to grant good cause domestic violence waivers?

(a) Yes; States have broad flexibility to grant these waivers to victims of domestic violence. For example, they may determine which program requirements to waive and decide how long each waiver might be necessary.

(b) However, if a State wants us to take the waivers that it grants into account in deciding if it has reasonable cause for failing to meet its work participation rates or comply with the five-year limit on Federal assistance, has achieved compliance or made significant progress towards achieving compliance with such requirements during a corrective compliance period, or qualifies for a reduction in its work penalty under § 261.51 of this chapter, the waivers must be federally recognized good cause domestic violence waivers, within the meaning of §§ 260.52(c) and 260.55, and the State must submit the information specified at § 265.9(b)(5) of this chapter on its strategies and procedures for serving victims of domestic violence and the number of waivers granted.

§ 260.55 What are the additional requirements for Federal recognition of good cause domestic violence waivers?

To be federally recognized, good cause domestic violence waivers must:

(a) Identify the specific program requirements that are being waived;

(b) Be granted appropriately based on need, as determined by an individualized assessment by a person trained in domestic violence and redeterminations no less often than every six months;

(c) Be accompanied by an appropriate services plan that:

(1) Is developed by a person trained in domestic violence;

(2) Reflects the individualized assessment and any revisions indicated by the redetermination; and

(3) To the extent consistent with § 260.52(c), is designed to lead to work.

§ 260.58 What penalty relief is available to a State whose failure to meet the work participation rates is attributable to providing federally recognized good cause domestic violence waivers?

(a)(1) We will determine that a State has reasonable cause if its failure to meet the work participation rates was attributable to federally recognized good cause domestic violence waivers granted to victims of domestic violence.

(2) To receive reasonable cause under the provisions of § 262.5(b) of this chapter, the State must provide evidence that it achieved the applicable rates, except with respect to any individuals who received a federally recognized good cause domestic violence waiver of work participation requirements. In other words, it must demonstrate that it met the applicable rates when such waiver cases are removed from the calculations at §§ 261.22(b) and 261.24(b) of this chapter.

(b)(1) We will reduce a State's penalty based on the degree of noncompliance to the extent that its failure to meet the work participation rates was attributable to federally recognized good cause domestic violence waivers.

(2) To receive a reduction based on degree of noncompliance under the provisions of § 261.51 of this chapter, a State granting federally recognized good cause domestic violence waivers of work participation requirements must demonstrate that it achieved participation rates above the threshold at § 261.51(b)(3) of this chapter, when such waiver cases are removed from the calculations at §§ 261.22(b) and 261.24(b) of this chapter.

(c) We may take federally recognized good cause domestic violence waivers of work requirements into consideration in deciding whether a State has achieved compliance or made significant progress towards achieving compliance in meeting the work participation rates during a corrective compliance period.

(d) To receive the penalty relief specified in paragraphs (a), (b), and (c) of this section, the State must submit the information specified at § 265.9(b)(5) of this chapter.

§ 260.59 What penalty relief is available to a State that failed to comply with the five-year limit on Federal assistance because it provided federally recognized good cause domestic violence waivers?

(a)(1) We will determine that a State has reasonable cause if it failed to comply with the five-year limit on Federal assistance because of federally recognized good cause domestic violence waivers granted to victims of domestic violence.

(2) More specifically, to receive reasonable cause under the provisions at § 264.3(b) of this chapter, a State must demonstrate that:

(i) It granted federally recognized good cause domestic violence waivers to extend time limits based on the need for continued assistance due to current or past domestic violence or the risk of further domestic violence; and

(ii) When individuals and their families are excluded from the calculation, the percentage of families receiving federally funded assistance for more than 60 months did not exceed 20 percent of the total.

(b) We may take federally recognized good cause domestic violence waivers to extend time limits into consideration in deciding whether a State has achieved compliance or made significant progress towards achieving compliance in meeting the five-year limit on Federal assistance during a corrective compliance period.

(c) To receive the penalty relief specified in paragraphs (a) and (b) of this section, the State must submit the information specified at § 265.9(b)(5) of this chapter.

[64 FR 17878, Apr. 12, 1999]

§§ 260.70-260.76 [Reserved]

§ 261.1 [Reserved]

§ 261.2 What definitions apply to this part?

(a) The general TANF definitions at §§ 260.30 through 260.33 of this chapter apply to this part.

(b) Unsubsidized employment means full-or part-time employment in the public or private sector that is not subsidized by TANF or any other public program.

(c) Subsidized private sector employment means employment in the private sector for which the employer receives a subsidy from TANF or other public funds to offset some or all of the wages and costs of employing an individual.

(d) Subsidized public sector employment means employment in the public sector for which the employer receives a subsidy from TANF or other public funds to offset some or all of the wages and costs of employing an individual.

(e) Work experience (including work associated with the refurbishing of publicly assisted housing) if sufficient private sector employment is not available means a work activity, performed in return for welfare, that provides an individual with an opportunity to acquire the general skills, knowledge, and work habits necessary to obtain employment. The purpose of work experience is to improve the employability of those who cannot find unsubsidized full-time employment. This activity must be supervised by an employer, work site sponsor, or other responsible party on an ongoing basis no less frequently than once in each day in which the individual is scheduled to participate.

(f) On-the-job training means training in the public or private sector that is given to a paid employee while he or she is engaged in productive work and that provides knowledge and skills essential to the full and adequate performance of the job.

(g) Job search and job readiness assistance means the act of seeking or obtaining employment, preparation to seek or obtain employment, including life skills training, and substance abuse treatment, mental health treatment, or rehabilitation activities. Such treatment or therapy must be determined to be necessary and documented by a qualified medical, substance abuse, or mental health professional. Job search and job readiness assistance activities must be supervised by the TANF agency or other responsible party on an ongoing basis no less frequently than once each day in which the individual is scheduled to participate.

(h) Community service programs mean structured programs and embedded activities in which individuals perform work for the direct benefit of the community under the auspices of public or nonprofit organizations. Community service programs must be limited to projects that serve a useful community purpose in fields such as health, social service, environmental protection, education, urban and rural redevelopment, welfare, recreation, public facilities, public safety, and child care. Community service programs are designed to improve the employability of individuals not otherwise able to obtain unsubsidized full-time employment, and must be supervised on an ongoing basis no less frequently than once each day in which the individual is scheduled to participate. A State agency shall take into account, to the extent possible, the prior training, experience, and skills of a recipient in making appropriate community service assignments.

(i) Vocational educational training (not to exceed 12 months with respect to any individual) means organized educational programs that are directly related to the preparation of individuals for employment in current or emerging occupations. Vocational educational training must be supervised on an ongoing basis no less frequently than once each day in which the individual is scheduled to participate.

(j) Job skills training directly related to employment means training or education for job skills required by an employer to provide an individual with the ability to obtain employment or to advance or adapt to the changing demands of the workplace. Job skills training directly related to employment must be supervised on an ongoing basis no less frequently than once each day in which the individual is scheduled to participate.

(k) Education directly related to employment, in the case of a recipient who has not received a high school diploma or a certificate of high school equivalency means education related to a specific occupation, job, or job offer. Education directly related to employment must be supervised on an ongoing basis no less frequently than once each day in which the work-eligible individual is scheduled to participate.

(l) Satisfactory attendance at secondary school or in a course of study leading to a certificate of general equivalence, in the case of a recipient who has not completed secondary school or received such a certificate means regular attendance, in accordance with the requirements of the secondary school or course of study, at a secondary school or in a course of study leading to a certificate of general equivalence, in the case of a work-eligible individual who has not completed secondary school or received such a certificate. This activity must be supervised on an ongoing basis no less frequently than once each day in which the individual is scheduled to participate.

(m) Providing child care services to an individual who is participating in a community service program means providing child care to enable another TANF or SSP recipient to participate in a community service program. This is an unpaid activity and must be a structured program designed to improve the employability of individuals who participate in this activity. This activity must be supervised on an ongoing basis no less frequently than once each day in which the individual is scheduled to participate.

(n)(1) Work-eligible individual means an adult (or minor child head-of-household) receiving assistance under TANF or a separate State program or a non-recipient parent living with a child receiving such assistance unless the parent is:

(i) A minor parent and not the head-of-household;

(ii) A non-citizen who is ineligible to receive assistance due to his or her immigration status; or

(iii) At State option on a case-by-case basis, a recipient of Supplemental Security Income (SSI) benefits or Aid to the Aged, Blind or Disabled in the Territories.

(2) The term also excludes:

(i) A parent providing care for a disabled family member living in the home, provided that there is medical documentation to support the need for the parent to remain in the home to care for the disabled family member;

(ii) At State option on a case-by-case basis, a parent who is a recipient of Social Security Disability Insurance (SSDI) benefits; and

(iii) An individual in a family receiving MOE-funded assistance under an approved Tribal TANF program, unless the State includes the Tribal family in calculating work participation rates, as permitted under § 261.25.

[73 FR 6821, Feb. 5, 2008]

§ 261.10-261.16 [Reserved]

§ 261.20 How will we hold a State accountable for achieving the work objectives of TANF?

(a) Each State must meet two separate work participation rates in FY 2006 and thereafter, one—the two-parent rate based on how well it succeeds in helping work-eligible individuals in two-parent families find work activities described at § 261.30, the other—the overall rate based on how well it succeeds in finding those activities for work-eligible individuals in all the families that it serves.

(b) Each State must submit data, as specified at § 265.3 of this chapter, that allows us to measure its success in requiring work-eligible individuals to participate in work activities.

(c) If the data show that a State met both participation rates in a fiscal year, then the percentage of historic State expenditures that it must expend under TANF, pursuant to § 263.1 of this chapter, decreases from 80 percent to 75 percent for that fiscal year. This is also known as the State's TANF “maintenance-of-effort” (MOE) requirement.

(d) If the data show that a State did not meet a minimum work participation rate for a fiscal year, a State could be subject to a financial penalty.

(e) Before we impose a penalty, a State will have the opportunity to claim reasonable cause or enter into a corrective compliance plan, pursuant to §§ 262.5 and 262.6 of this chapter.

§ 261.21 [Reserved]

§ 261.22 How will we determine a State's overall work rate?

(a)(1) The overall participation rate for a fiscal year is the average of the State's overall participation rates for each month in the fiscal year.

(2) The rate applies to families with a work-eligible individual.

(b) We determine a State's overall participation rate for a month as follows:

(1) The number of TANF and SSP-MOE families that include a work-eligible individual who meets the requirements set forth in § 261.31 for the month (i.e., the numerator), divided by,

(2) The number of TANF and SSP-MOE families that include a work-eligible individual, minus the number of such families that are subject to a penalty for refusing to work in that month (i.e., the denominator). However, if a family with a work-eligible individual has been penalized for refusal to participate in work activities for more than three of the last 12 months, we will not exclude it from the participation rate calculation.

(3) At State option, we will include in the participation rate calculation families with a work-eligible individual that have been penalized for refusing to work no more than three of the last 12 months.

(c)(1) A State has the option of not requiring a single custodial parent caring for a child under age one to engage in work.

(2) At State option, we will disregard a family with such a parent from the participation rate calculation for a maximum of 12 months.

(d)(1) If a family receives assistance for only part of a month, we will count it as a month of participation if a work-eligible individual is engaged in work for the minimum average number of hours in each full week that the family receives assistance in that month.

(2) If a State pays benefits retroactively (i.e., for the period between application and approval of benefits), it has the option to consider the family to be receiving assistance during the period of retroactivity.

§ 261.23 [Reserved]

§ 261.24 How will we determine a State's two-parent work rate?

(a)(1) The two-parent participation rate for a fiscal year is the average of the State's two-parent participation rates for each month in the fiscal year.

(2) The rate applies to two-parent families with two work-eligible individuals. However, if one of the parents is a work-eligible individual with a disability, we will not consider the family to be a two-parent family; i.e., we will not include such a family in either the numerator or denominator of the two-parent rate.

(b) We determine a State's two-parent participation rate for the month as follows:

(1) The number of two-parent TANF and SSP-MOE families in which both parents are work-eligible individuals and together they meet the requirements set forth in § 261.32 for the month (i.e., the numerator), divided by,

(2) The number of two-parent TANF and SSP-MOE families in which both parents are work-eligible individuals during the month, minus the number of such two-parent families that are subject to a penalty for refusing to work in that month (the denominator). However, if a family with a work-eligible individual has been penalized for more than three months of the last 12 months, we will not exclude it from the participation rate calculation.

(3) At State option, we will include in the participation rate calculation families with a work-eligible individual that have been penalized for refusing to work no more than three of the last 12 months.

(c) For purposes of the calculation in paragraph (b) of this section, a two-parent family includes, at a minimum, all families with two natural or adoptive parents (of the same minor child) who are work-eligible individuals and living in the home, unless both are minors and neither is a head-of-household.

(d)(1) If the family receives assistance for only part of a month, we will count it as a month of participation if a work-eligible individual in the family (or both work-eligible individuals, if they are both required to work) is engaged in work for the minimum average number of hours in each full week that the family receives assistance in that month.

(2) If a State pays benefits retroactively (i.e., for the period between application and approval of benefits), it has the option to consider the family to be receiving assistance during the period of retroactivity.

§ 261.25 Do we count Tribal families in calculating the work participation rate?

At State option, we will include families with a work-eligible individual that are receiving assistance under an approved Tribal family assistance plan or under a Tribal work program in calculating the State's participation rates under §§ 261.22 and 261.24.

§ 261.30 [Reserved]

§ 261.31 How many hours must a work-eligible individual participate for the family to count in the numerator of the overall rate?

(a) Subject to paragraph (d) of this section, a family with a work-eligible individual counts as engaged in work for a month for the overall rate if:

(1) He or she participates in work activities during the month for at least a minimum average of 30 hours per week; and

(2) At least 20 of the above hours per week come from participation in the activities listed in paragraph (b) of this section.

(b) The following nine activities count toward the first 20 hours of participation: unsubsidized employment; subsidized private-sector employment; subsidized public-sector employment; work experience; on-the-job training; job search and job readiness assistance; community service programs; vocational educational training; and providing child care services to an individual who is participating in a community service program.

(c) Above 20 hours per week, the following three activities may also count as participation: job skills training directly related to employment; education directly related to employment; and satisfactory attendance at secondary school or in a course of study leading to a certificate of general equivalence.

(d)(1) We will deem a work-eligible individual who participates in a work experience or community service program for the maximum number of hours per month that a State may require by dividing the combined monthly TANF or SSP-MOE grant and food stamp allotment by the higher of the Federal or State minimum wage to have participated for an average of 20 hours per week for the month in that activity.

(2) This policy is limited to States that have adopted a Simplified Food Stamp Program option that permits a State to count the value of food stamps in determining the maximum core hours of participation permitted by the FLSA.

(3) In order for Puerto Rico, which does not have a traditional Food Stamp Program, to deem core hours, it must include the value of food assistance benefits provided through the Nutrition Assistance Program in the same manner as a State must include food stamp benefits under subsection (d)(1).

[73 FR 6823, Feb. 5, 2008]

§ 261.32 How many hours must work-eligible individuals participate for the family to count in the numerator of the two-parent rate?

(a) Subject to paragraph (d) of this section, a family with two work-eligible parents counts as engaged in work for the month for the two-parent rate if:

(1) Work-eligible parents in the family are participating in work activities for a combined average of at least 35 hours per week during the month, and

(2) At least 30 of the 35 hours per week come from participation in the activities listed in paragraph (b) of this section.

(b) The following nine activities count for the first 30 hours of participation: unsubsidized employment; subsidized private-sector employment; subsidized public-sector employment; work experience; on-the-job training; job search and job readiness assistance; community service programs; vocational educational training; and providing child care services to an individual who is participating in a community service program.

(c) Above 30 hours per week, the following three activities may also count for participation: job skills training directly related to employment; education directly related to employment; and satisfactory attendance at secondary school or in a course of study leading to a certificate of general equivalence.

(d)(1) We will deem a family with two work-eligible parents in which one or both participates in a work experience or community service program for the maximum number of hours per month that a State may require by dividing the combined monthly TANF or SSP-MOE grant and food stamp allotment by the higher of the Federal or State minimum wage to have participated for an average of 30 hours per week for the month in that activity.

(2) This policy is limited to States that have adopted a Simplified Food Stamp Program option that permits a State to count the value of food stamps in determining the maximum core hours of participation permitted by the FLSA.

(3) In order for Puerto Rico, which does not have a traditional Food Stamp Program, to deem core hours, it must include the value of food assistance benefits provided through the Nutrition Assistance Program in the same manner as a State must include food stamp benefits under paragraph (d)(1) of this section.

(e)(1) Subject to paragraph (f) of this section, if the family receives federally funded child care assistance and an adult in the family does not have a disability or is not caring for a child with a disability, then the work-eligible individuals must be participating in work activities for an average of at least 55 hours per week to count as a two-parent family engaged in work for the month.

(2) At least 50 of the 55 hours per week must come from participation in the activities listed in paragraph (b) of this section.

(3) Above 50 hours per week, the three activities listed in paragraph (c) of this section may also count as participation.

(f)(1) We will deem a family with two work-eligible parents in which one or both participates in a work experience or community service program for the maximum number of hours per month that a State may require by dividing the combined monthly TANF or SSP-MOE grant and food stamp allotment by the higher of the Federal or State minimum wage to have participated for an average of 50 hours per week for the month in that activity.

(2) This policy is limited to States that have adopted a Simplified Food Stamp Program option that permits a State to count the value of food stamps in determining the maximum core hours of participation permitted by the FLSA.

(3) In order for Puerto Rico, which does not have a traditional Food Stamp Program, to deem core hours, it must include the value of food assistance benefits provided through the Nutrition Assistance Program in the same manner as a State must include food stamp benefits under paragraph (d)(1) of this section.

[73 FR 6823, Feb. 5, 2008]

§ 261.33 [Reserved]

§ 261.34 Are there any limitations in counting job search and job readiness assistance toward the participation rates?

Yes. There are four limitations concerning job search and job readiness assistance.

(a) Except as provided in paragraph (b) of this section, an individual's participation in job search and job readiness assistance counts for a maximum of six weeks in the preceding 12-month period.

(b) If the State's total unemployment rate is at least 50 percent greater than the United States' total unemployment rate or if the State meets the definition of a “needy State”, specified at § 260.30 of this chapter, then an individual's participation in job search and job readiness assistance counts for a maximum of 12 weeks in that 12-month period.

(c) For purposes of paragraphs (a) and (b) of this section, a week equals 20 hours for a work-eligible individual who is a single custodial parent with a child under six years of age and equals 30 hours for all other work-eligible individuals.

(d) An individual's participation in job search and job readiness assistance does not count for a week that immediately follows four consecutive weeks in which the State reports any hours of such participation in the preceding 12-month period. For purposes of this paragraph a week means seven consecutive days.

(e) Not more than once for any individual in the preceding 12-month period, a State may count three or four days of job search and job readiness assistance during a week as a full week of participation. We calculate a full week of participation based on the average daily hours of participation for three or four days and will prorate participation at that level for the remaining one or two days to determine the total hours for a five-day week. Any prorated hours of participation must be included in the calculation of total hours permitted under the limitation in this section.

[73 FR 6824, Feb. 5, 2008]

§§ 261.35-261.36 [Reserved]

§ 261.40 Is there a way for a State to reduce the work participation rates?

(a)(1) If the average monthly number of cases receiving assistance, including assistance under a separate State program (as provided at § 261.42(b)), in a State in the preceding fiscal year was lower than the average monthly number of cases that received assistance, including assistance under a separate State program in that State in FY 2005, the minimum overall participation rate the State must meet for the fiscal year (as provided at § 261.21) decreases by the number of percentage points the prior-year caseload fell in comparison to the FY 2005 caseload.

(2) The minimum two-parent participation rate the State must meet for the fiscal year (as provided at § 261.23) decreases, at State option, by either:

(i) The number of percentage points the prior-year two-parent caseload, including two-parent cases receiving assistance under a separate State program (as provided at § 261.42(b)), fell in comparison to the FY 2005 two-parent caseload, including two-parent cases receiving assistance under a separate State program; or

(ii) The number of percentage points the prior-year overall caseload, including assistance under a separate State program (as provided at § 261.42(b)), fell in comparison to the FY 2005 overall caseload, including cases receiving assistance under a separate State program.

(3) For the credit calculation, we will refer to the fiscal year that precedes the fiscal year to which the credit applies as the “comparison year.”

(b)(1) The calculations in paragraph (a) of this section must disregard caseload reductions due to requirements of Federal law and to changes that a State has made in its eligibility criteria in comparison to its criteria in effect in FY 2005.

(2) At State option, the calculation may offset the disregard of caseload reductions in paragraph (b)(1) of this section by changes in eligibility criteria that increase caseloads.

(c)(1) To establish the caseload base for FY 2005 and to determine the comparison-year caseload, we will use the combined TANF and Separate State Program caseload figures reported on the Form ACF-199, TANF Data Report, and Form ACF-209, SSP-MOE Data Report, respectively.

(2) To qualify for a caseload reduction, a State must have reported monthly caseload information, including cases in separate State programs, for FY 2005 and the comparison year for cases receiving assistance as defined at § 261.43.

(d)(1) A State may correct erroneous data or submit accurate data to adjust program data or to include unduplicated cases within the fiscal year.

(2) We will adjust both the FY 2005 baseline and the comparison-year caseload information, as appropriate, based on these State submissions.

(e) We refer to the number of percentage points by which a caseload falls, disregarding the cases described in paragraph (b) of this section, as a caseload reduction credit.

§ 261.41 How will we determine the caseload reduction credit?

(a)(1) We will determine the overall and two-parent caseload reduction credits that apply to each State based on the information and estimates reported to us by the State on eligibility policy changes using application denials, case closures, or other administrative data sources and analyses.

(2) We will accept the information and estimates provided by a State, unless they are implausible based on the criteria listed in paragraph (d) of this section.

(3) We may conduct on-site reviews and inspect administrative records on applications, case closures, or other administrative data sources to validate the accuracy of the State estimates.

(b) In order to receive a caseload reduction credit, a State must submit a Caseload Reduction Report to us containing the following information:

(1) A listing of, and implementation dates for, all State and Federal eligibility changes, as defined at § 261.42, made by the State since the beginning of FY 2006;

(2) A numerical estimate of the positive or negative average monthly impact on the comparison-year caseload of each eligibility change (based, as appropriate, on application denials, case closures or other analyses);

(3) An overall estimate of the total net positive or negative impact on the applicable caseload as a result of all such eligibility changes;

(4) An estimate of the State's caseload reduction credit;

(5) A description of the methodology and the supporting data that a State used to calculate its caseload reduction estimates; and

(6) A certification that it has provided the public an appropriate opportunity to comment on the estimates and methodology, considered their comments, and incorporated all net reductions resulting from Federal and State eligibility changes.

(c)(1) A State requesting a caseload reduction credit for the overall participation rate must base its estimates of the impact of eligibility changes on decreases in its comparison-year overall caseload compared to the FY 2005 overall caseload baseline established in accordance with § 261.40(d).

(2) A State requesting a caseload reduction credit for its two-parent rate must base its estimates of the impact of eligibility changes on decreases in either:

(i) Its two-parent caseload compared to the FY 2005 base-year two-parent caseload baseline established in accordance with § 261.40(d); or

(ii) Its overall caseload compared to the FY 2005 base-year overall caseload baseline established in accordance with § 261.40(d).

(d)(1) For each State, we will assess the adequacy of information and estimates using the following criteria: Its methodology; Its estimates of impact compared to other States; the quality of its data; and the completeness and adequacy of its documentation.

(2) If we request additional information to develop or validate estimates, the State may negotiate an appropriate deadline or provide the information within 30 days of the date of our request.

(3) The State must provide sufficient data to document the information submitted under paragraph (b) of this section.

(e) We will not calculate a caseload reduction credit unless the State reports case-record data on individuals and families served by any separate State program, as required under § 265.3(d) of this chapter.

(f) A State may only apply to the participation rate a caseload reduction credit that we have calculated. If a State disagrees with the caseload reduction credit, it may appeal the decision as an adverse action in accordance with § 262.7 of this chapter.

§ 261.42 Which reductions count in determining the caseload reduction credit?

(a)(1) A State's caseload reduction credit must not include caseload decreases due to Federal requirements or State changes in eligibility rules since FY 2005 that directly affect a family's eligibility for assistance. These include, but are not limited to, more stringent income and resource limitations, time limits, full family sanctions, and other new requirements that deny families assistance when an individual does not comply with work requirements, cooperate with child support, or fulfill other behavioral requirements.

(2) At State option, a State's caseload reduction credit may include caseload increases due to Federal requirements or State changes in eligibility rules since FY 2005 if used to offset caseload decreases in paragraph (a)(1) of this section.

(3) A State may not receive a caseload reduction credit that exceeds the actual caseload decline between FY 2005 and the comparison year.

(4) A State may count the reductions attributable to enforcement mechanisms or procedural requirements that are used to enforce existing eligibility criteria (e.g., fingerprinting or other verification techniques) to the extent that such mechanisms or requirements identify or deter families otherwise ineligible under existing rules.

(b) A State must include cases receiving assistance in separate State programs as part of its FY 2005 caseload and comparison-year caseload. However, if a State provides documentation that separate State program cases overlap with or duplicate cases in the TANF caseload, we will exclude them from the caseload count.

§ 261.43 What is the definition of a “case receiving assistance” in calculating the caseload reduction credit?

(a) The caseload reduction credit is based on decreases in caseloads receiving TANF- or SSP-MOE-funded assistance (other than those excluded pursuant to § 261.42).

(b)(1) A State that is investing State MOE funds in excess of the required 80 percent or 75 percent basic MOE amount need only include the pro rata share of caseloads receiving assistance that is required to meet basic MOE requirements.

(2) For purposes of paragraph (b)(1) of this section, a State may exclude from the overall caseload reduction credit calculation the number of cases funded with excess MOE. This number is calculated by dividing annual excess MOE expenditures on assistance by the average monthly expenditures on assistance per case for the fiscal year,

(i) Where annual excess MOE expenditures on assistance equal total annual MOE expenditures minus the percentage of historic State expenditures specified in paragraph (v) of this section, multiplied by the percentage that annual expenditures on assistance (both Federal and State) represent of all annual expenditures, and

(ii) Where the average monthly assistance expenditures per case for the fiscal year equal the sum of annual TANF and SSP-MOE assistance expenditures (both Federal and State) divided by the average monthly sum of TANF and SSP-MOE caseloads for the fiscal year.

(iii) If the excess MOE calculation is for a separate two-parent caseload reduction credit, we multiply the number of cases funded with excess MOE by the average monthly percentage of two-parent cases in the State's total (TANF plus SSP-MOE) average monthly caseload.

(iv) All financial data must agree with data reported on the TANF Financial Report (form ACF-196) and all caseload data must agree with data reported on the TANF Data and SSP-MOE Data Reports (forms ACF-199 and ACF-209).

(v) The State must use 80 percent of historic expenditures when calculating excess MOE; however if it has met the work participation requirements for the year, it may use 75 percent of historic expenditures.

§ 261.44 When must a State report the required data on the caseload reduction credit?

A State must report the necessary documentation on caseload reductions for the preceding fiscal year by December 31.

§ 261.50 What happens if a State fails to meet the participation rates?

(a) If we determine that a State did not achieve one of the required minimum work participation rates, we must reduce the SFAG payable to the State.

(b)(1) If there was no penalty for the preceding fiscal year, the base penalty for the current fiscal year is five percent of the adjusted SFAG.

(2) For each consecutive year that the State is subject to a penalty under this part, we will increase the amount of the base penalty by two percentage points over the previous year's penalty. However, the penalty can never exceed 21 percent of the State's adjusted SFAG.

(c) We impose a penalty by reducing the SFAG payable for the fiscal year that immediately follows our final determination that a State is subject to a penalty and our final determination of the penalty amount.

(d) In accordance with the procedures specified at § 262.4 of this chapter, a State may dispute our determination that it is subject to a penalty.

§ 261.51 Under what circumstances will we reduce the amount of the penalty below the maximum?

(a) We will reduce the amount of the penalty based on the degree of the State's noncompliance.

(1) If the State fails only the two-parent participation rate specified at § 261.23, reduced by any applicable caseload reduction credit, its maximum penalty will be a percentage of the penalty specified at § 261.50. This percentage will equal the percentage of two-parent cases in the State's total caseload.

(2) If the State fails the overall participation rate specified at § 261.21, reduced by any applicable caseload reduction credit, or both rates, its maximum penalty will be the penalty specified at § 261.50.

(b)(1) In order to receive a reduction of the penalty amounts determined under paragraphs (a)(1) or (a)(2) of this section:

(i) The State must achieve participation rates equal to a threshold level defined as 50 percent of the applicable minimum participation rate at § 261.21 or § 261.23, minus any caseload reduction credit determined pursuant to subpart D of this part; and

(ii) The adjustment factor for changes in the number of individuals engaged in work, described in paragraph (b)(4) of this section, must be greater than zero.

(2) If the State meets the requirements of paragraph (b)(1) of this section, we will base its reduction on the severity of the failure. For this purpose, we will calculate the severity of the State's failure based on:

(i) The degree to which it missed the target rate;

(ii) An adjustment factor that accounts for changes in the number of individuals who are engaged in work in the State since the prior year; and

(iii) The number of consecutive years in which the State failed to meet the participation rates and the number of rates missed.

(3) We will determine the degree to which the State missed the target rate using the ratio of the following two factors:

(i) The difference between the participation rate achieved by the State and the 50-percent threshold level (adjusted for any caseload reduction credit determined pursuant to subpart D of this part); and

(ii) The difference between the minimum applicable participation rate and the threshold level (both adjusted for any caseload reduction credit determined pursuant to subpart D of this part).

(4) We will calculate the adjustment factor for changes in the number of individuals engaged in work using the following formula:

(i) The average monthly number of individuals engaged in work in the penalty year minus the average monthly number of individuals engaged in work in the prior year, divided by,

(ii) The product of 0.15 and the average monthly number of individuals engaged in work in the prior year.

(5) Subject to paragraph (c) of this section, if the State fails only the two-parent participation rate specified at § 261.23, and qualifies for a penalty reduction under paragraph (b)(1) of this section, its penalty reduction will be the product of:

(i) The amount determined in paragraph (a)(1) of this section;

(ii) The ratio described in paragraph (b)(3) of this section computed with respect to two-parent families; and

(iii) The adjustment factor described in paragraph (b)(4) of this section computed with respect to two-parent families.

(6) Subject to paragraph (c) of this section, if the State fails the overall participation rate specified at § 261.21, or both rates, and qualifies for a penalty reduction under paragraph (b)(1) of this section, its penalty reduction will be the product of:

(i) The amount determined in paragraph (a)(2) of this section;

(ii) The ratio described in paragraph (b)(3) of this section computed with respect to all families; and

(iii) The adjustment factor described in paragraph (b)(4) of this section.

(7) Pursuant to § 260.58 of this chapter, we will adjust the calculations in this section to exclude cases for which a State has granted federally recognized good cause domestic violence waivers.

(c)(1) If the State was not subject to a penalty the prior year, the State will receive:

(i) The full applicable penalty reduction described in paragraph (b)(5) or (b)(6) of this section if it failed only one participation rate; or

(ii) 50 percent of the penalty reduction described in paragraph (b)(6) of this section if it failed both participation rates.

(2) If the penalty year is the second successive year in which the State is subject to a penalty, the State will receive:

(i) 50 percent of the applicable penalty reduction described in paragraph (b)(5) or (b)(6) of this section if it failed only one participation rate; or

(ii) 25 percent of the penalty reduction described in paragraph (b)(6) of this section if it failed both participation rates.

(3) If the penalty year is the third or greater successive year in which the State is subject to a penalty, the State will not receive a penalty reduction described in paragraph (b)(5) or (b)(6) of this section.

(d)(1) We may reduce the penalty if the State failed to achieve a participation rate because:

(i) It meets the definition of a needy State, specified at § 260.30 of this chapter; or,

(ii) Noncompliance is due to extraordinary circumstances such as a natural disaster, regional recession, or substantial caseload increase.

(2) In determining noncompliance under paragraph (d)(1)(ii) of this section, we will consider such objective evidence of extraordinary circumstances as the State chooses to submit.

§ 261.52 Is there a way to waive the State's penalty for failing to achieve either of the participation rates?

(a) We will not impose a penalty under this part if we determine that the State has reasonable cause for its failure.

(b) In addition to the general reasonable cause criteria specified at § 262.5 of this chapter, a State may also submit a request for a reasonable cause exemption from the requirement to meet the minimum participation rate in two specific case situations.

(1) We will determine that a State has reasonable cause if it demonstrates that failure to meet the work participation rates is attributable to its provision of federally recognized good cause domestic violence waivers (i.e., it provides evidence that it achieved the applicable work rates when individuals receiving federally recognized good cause domestic violence waivers of work requirements, in accordance with the provisions at §§ 260.54(b) and 260.55 of this chapter, are removed from the calculations in §§ 261.22(b) and 261.24(b)).

(2) We will determine that a State has reasonable cause if it demonstrates that its failure to meet the work participation rates is attributable to its provision of assistance to refugees in federally approved alternative projects under section 412(e)(7) of the Immigration and Nationality Act (8 U.S.C. 1522(e)(7)).

(c) In accordance with the procedures specified at § 262.4 of this chapter, a State may dispute our determination that it is subject to a penalty.

§ 261.53 May a State correct the problem before incurring a penalty?

(a) Yes. A State may enter into a corrective compliance plan to remedy a problem that caused its failure to meet a participation rate, as specified at § 262.6 of this chapter.

(b) To qualify for a penalty reduction under § 262.6(j)(1) of this chapter, based on significant progress towards correcting a violation, a State must reduce the difference between the participation rate it achieved in the year for which it is subject to a penalty and the rate applicable during the penalty year (adjusted for any caseload reduction credit determined pursuant to subpart D of this part) by at least 50 percent.

§ 261.54 [Reserved]

§ 261.55 Under what circumstances will we reduce the amount of the penalty for not properly imposing penalties on individuals?

(a) We will reduce the amount of the penalty based on the degree of the State's noncompliance.

(b) In determining the size of any reduction, we will consider objective evidence of:

(1) Whether the State has established a control mechanism to ensure that the grants of individuals are appropriately reduced for refusing to engage in required work; and

(2) The percentage of cases for which the grants have not been appropriately reduced.

§ 261.56 What happens if a parent cannot obtain needed child care?

(a)(1) If the individual is a single custodial parent caring for a child under age six, the State may not reduce or terminate assistance based on the parent's refusal to engage in required work if he or she demonstrates an inability to obtain needed child care for one or more of the following reasons:

(i) Appropriate child care within a reasonable distance from the home or work site is unavailable;

(ii) Informal child care by a relative or under other arrangements is unavailable or unsuitable; or

(iii) Appropriate and affordable formal child care arrangements are unavailable.

(2) Refusal to work when an acceptable form of child care is available is not protected from sanctioning.

(b)(1) The State will determine when the individual has demonstrated that he or she cannot find child care, in accordance with criteria established by the State.

(2) These criteria must:

(i) Address the procedures that the State uses to determine if the parent has a demonstrated inability to obtain needed child care;

(ii) Include definitions of the terms “appropriate child care,” “reasonable distance,” “unsuitability of informal care,” and “affordable child care arrangements”; and

(iii) Be submitted to us.

(c) The TANF agency must inform parents about:

(1) The penalty exception to the TANF work requirement, including the criteria and applicable definitions for determining whether an individual has demonstrated an inability to obtain needed child care;

(2) The State's process or procedures (including definitions) for determining a family's inability to obtain needed child care, and any other requirements or procedures, such as fair hearings, associated with this provision; and

(3) The fact that the exception does not extend the time limit for receiving Federal assistance.

[64 FR 17884, Apr. 12, 1999; 64 FR 40291, July 26, 1999]

§ 261.57 What happens if a State sanctions a single parent of a child under six who cannot get needed child care?

(a) If we determine that a State has not complied with the requirements of § 261.56, we will reduce the SFAG payable to the State by no more than five percent for the immediately succeeding fiscal year unless the State demonstrates to our satisfaction that it had reasonable cause or it achieves compliance under a corrective compliance plan pursuant to §§ 262.5 and 262.6 of this chapter.

(b) We will impose the maximum penalty if:

(1) The State does not have a statewide process in place to inform parents about the exception to the work requirement and enable them to demonstrate that they have been unable to obtain child care; or

(2) There is a pattern of substantiated complaints from parents or organizations verifying that a State has reduced or terminated assistance in violation of this requirement.

(c) We may impose a reduced penalty if the State demonstrates that the violations were isolated or that they affected a minimal number of families.

§ 261.60 What hours of participation may a State report for a work-eligible individual?

(a) A State must report the actual hours that an individual participates in an activity, subject to the qualifications in paragraphs (b) and (c) of this section and § 261.61(c). It is not sufficient to report the hours an individual is scheduled to participate in an activity.

(b) For the purposes of calculating the work participation rates for a month, actual hours may include the hours for which an individual was paid, including paid holidays and sick leave. For participation in unpaid work activities, it may include excused absences for hours missed due to a maximum of 10 holidays in the preceding 12-month period and up to 80 hours of additional excused absences in the preceding 12-month period, no more than 16 of which may occur in a month, for each work-eligible individual. Each State must designate the days that it wishes to count as holidays for those in unpaid activities in its Work Verification Plan. It may designate no more than 10 such days. In order to count an excused absence as actual hours of participation, the individual must have been scheduled to participate in a countable work activity for the period of the absence that the State reports as participation. A State must describe its excused absence policies and definitions as part of its Work Verification Plan, specified at § 261.62.

(c) For unsubsidized employment, subsidized employment, and OJT, a State may report projected actual hours of employment participation for up to six months based on current, documented actual hours of work. Any time a State receives information that the client's actual hours of work have changed, or no later than the end of any six-month period, the State must re-verify the client's current actual average hours of work, and may report these projected actual hours of participation for another six-month period.

(d) A State may not count more hours toward the participation rate for a self-employed individual than the number derived by dividing the individual's self-employment income (gross income less business expenses) by the Federal minimum wage. A State may propose an alternative method of determining self-employment hours as part of its Work Verification Plan.

(e) A State may count supervised homework time and up to one hour of unsupervised homework time for each hour of class time. Total homework time counted for participation cannot exceed the hours required or advised by a particular educational program.

§ 261.61 How must a State document a work-eligible individual's hours of participation?

(a) A State must support each individual's hours of participation through documentation in the case file. In accordance with § 261.62, a State must describe in its Work Verification Plan the documentation it uses to verify hours of participation in each activity.

(b) For an employed individual, the documentation may consist of, but is not limited to pay stubs, employer reports, or time and attendance records substantiating hours of participation. A State may presume that an employed individual participated for the total number of hours for which that individual was paid.

(c) The State must document all hours of participation in an activity; however, if a State is reporting projected hours of actual employment in accordance with § 261.60(c), it need only document the hours on which it bases the projection.

(d) For an individual who is self-employed, the documentation must comport with standards set forth in the State's approved Work Verification Plan. Self-reporting by a participant without additional verification is not sufficient documentation.

(e) For an individual who is not employed, the documentation for substantiating hours of participation may consist of, but is not limited to, time sheets, service provider attendance records, or school attendance records. For homework time, the State must also document the homework or study expectations of the educational program.

§ 261.62 What must a State do to verify the accuracy of its work participation information?

(a) To ensure accuracy in the reporting of work activities by work-eligible individuals on the TANF Data Report and, if applicable, the SSP-MOE Data Report, each State must:

(1) Establish and employ procedures for determining whether its work activities may count for participation rate purposes;

(2) Establish and employ procedures for determining how to count and verify reported hours of work;

(3) Establish and employ procedures for identifying who is a work-eligible individual;

(4) Establish and employ internal controls to ensure compliance with the procedures; and

(5) Submit to the Secretary for approval the State's Work Verification Plan in accordance with paragraph (b) of this section.

(b) A State's Work Verification Plan must include the following:

(1) For each countable work activity:

(i) A description demonstrating how the activity meets the relevant definition at § 261.2;

(ii) A description of how the State determines the number of countable hours of participation; and

(iii) A description of the documentation it uses to monitor participation and ensure that the actual hours of participation are reported;

(2) A description of the State's procedures for identifying all work-eligible individuals, as defined at § 261.2;

(3) A description of how the State ensures that, for each work-eligible individual, it:

(i) Accurately inputs data into the State's automated data processing system;

(ii) Properly tracks the hours though the automated data processing system; and

(iii) Accurately reports the hours to the Department;

(4) A description of the procedures for ensuring it does not transmit to the Department a work-eligible individual's hours of participation in an activity that does not meet a Federal definition of a countable work activity; and

(5) A description of the internal controls that the State has implemented to ensure a consistent measurement of the work participation rates, including the quality assurance processes and sampling specifications it uses to monitor adherence to the established work verification procedures by State staff, local staff, and contractors.

(c) We will review a State's Work Verification Plan for completeness and approve it if we believe that it will result in accurate reporting of work participation information.

§ 261.63 When is a State's Work Verification Plan due?

(a) Each State must submit its interim Work Verification Plan for validating work activities reported in the TANF Data Report and, if applicable, the SSP-MOE Data Report no later than September 30, 2006.

(b) If HHS requires changes, a State must submit them within 60 days of receipt of our notice and include all necessary changes as part of a final approved Work Verification Plan no later than September 30, 2007.

(c) If a State modifies its verification procedures for TANF or SSP-MOE work activities or its internal controls for ensuring a consistent measurement of the work participation rate, the State must submit for approval an amended Work Verification Plan by the end of the quarter in which the State modifies the procedures or internal controls.

§ 261.64 How will we determine whether a State's work verification procedures ensure an accurate work participation measurement?

(a) We will determine that a State has met the requirement to establish work verification procedures if it submitted an interim Work Verification Plan by September 30, 2006 and a complete Work Verification Plan that we approved by September 30, 2007.

(b) A “complete” Work Verification Plan means that:

(1) The plan includes all the information required by § 261.62(b); and

(2) The State certifies that the plan includes all the information required by § 261.62(b) and that it accurately reflects the procedures under which the State is operating.

(c) For conduct occurring after October 1, 2007, we will use 2 CFR part 200, subpart F in conjunction with other reviews, audits, and data sources, as appropriate, to assess the accuracy of the data filed by States for use in calculating the work participation rates.

[73 FR 6826, Feb. 5, 2008, as amended at 81 FR 3020, Jan. 20, 2016; 89 FR 80071, Oct. 2, 2024]

§ 261.65 Under what circumstances will we impose a work verification penalty?

(a) We will take action to impose a penalty under § 262.1(a)(15) of this chapter if:

(1) The requirements under § 261.64(a) and (b) have not been met; or

(2) We determine that the State has not maintained adequate documentation, verification, or internal control procedures to ensure the accuracy of the data used in calculating the work participation rates.

(b) If a State fails to submit an interim or complete Work Verification Plan by the due dates in § 261.64(a), we will reduce the SFAG payable for the immediately succeeding fiscal year by five percent of the adjusted SFAG.

(c) If a State fails to maintain adequate internal controls to ensure a consistent measurement of work participation, we will reduce the adjusted SFAG by the following percentages for a fiscal year:

(1) One percent for the first year;

(2) Two percent for second year;

(3) Three percent for the third year;

(4) Four percent for the fourth year; and,

(5) Five percent for the fifth and subsequent years.

(d) If a State complies with the requirements in this subpart for two consecutive years, then any penalty imposed for subsequent failures will begin anew, as described in paragraph (c) of this section.

(e) If we take action to impose a penalty under § 261.64(b) or (c), we will reduce the SFAG payable for the immediately succeeding fiscal year.

§ 261.70 [Reserved]

§ 261.80 [Reserved]

§§ 262.0-262.1 [Reserved]

§ 262.2 When do the TANF penalty provisions apply?

(a) A State will be subject to the penalties specified in § 262.1(a)(1), (2), (7), (8), (9), (10), (11), (12), (13), and (14) for conduct occurring on and after the first day the State operates the TANF program.

(b) A State will be subject to the penalties specified in § 262.1(a)(3), (4), (5), and (6) for conduct occurring on and after July 1, 1997, or the date that is six months after the first day the State operates the TANF program, whichever is later.

(c) For the time period prior to October 1, 1999, we will assess State conduct as specified in § 260.40(b) of this chapter.

(d) The penalty specified in § 262.1(a)(15) takes effect on October 1, 2006, for failure to establish work participation verification procedures and on October 1, 2007, for failure to comply with those procedures.

(e) In accordance with § 264.61(a) and (b) of this chapter, the penalty specified in § 262.1(a)(16) will be imposed for FY 2014 and each succeeding fiscal year.

[64 FR 17890, Apr. 12, 1999, as amended at 71 FR 37480, June 29, 2006; 81 FR 2105, Jan. 15, 2016]

§ 262.3 How will we determine if a State is subject to a penalty?

(a)(1) We will use the single audit under 2 CFR part 200, subpart F, in conjunction with other reviews, audits, and data sources, as appropriate, to determine if a State is subject to a penalty for misusing Federal TANF funds (§ 263.10 of this chapter), intentionally misusing Federal TANF funds (§ 263.12 of this chapter), failing to participate in IEVS (§ 264.10 of this chapter), failing to comply with paternity establishment and child support requirements (§ 264.31 of this chapter), failing to maintain assistance to an adult single custodial parent who cannot obtain child care for a child under 6 (§ 261.57 of this chapter), failing to reduce assistance to a recipient who refuses without good cause to work (§ 261.54 of this chapter), and after October 1, 2007 failing to comply with work participation verification procedures (§ 261.64 of this chapter).

(2) We will also use the single audit as a secondary method of determining if a State is subject to other penalties if an audit detects lack of compliance in other penalty areas.

(b)(1) We will use the TANF Data Report required under part 265 of this chapter to determine if a State failed to meet participation rates (§§ 261.21 and 261.23 of this chapter) or failed to comply with the five-year limit on Federal assistance (§ 264.1 of this chapter).

(2) Data in these reports are subject to our verification in accordance with § 265.7 of this chapter.

(c)(1) We will use the TANF Financial Report (or, as applicable, the Territorial Financial Report) as the primary method for determining if a State has failed to meet the basic MOE requirement (§ 263.8 of this chapter), meet the Contingency Fund MOE requirement (§ 264.76 of this chapter), or replace SFAG reductions with State-only funds (§ 264.50 of this chapter).

(2) Data in these reports are subject to our verification in accordance with § 265.7 of this chapter.

(d) We will determine that a State is subject to the specific penalties for failure to perform if we find information in the reports under paragraphs (b) and (c) of this section to be insufficient to show compliance or if we determine that the State has not adequately documented actions verifying that it has met the participation rates or the time limits.

(e) To determine if a State has met its MOE requirements, we will also use the supplemental information in the annual report required in accordance with § 265.9(c) of this chapter.

(f) States must maintain records in accordance with 2 CFR 200.334 through 200.338.

(g) To determine if a State is subject to a penalty under § 262.1(a)(16), we will use the information provided in annual state reports at § 265.9(b)(10) of this chapter, in accordance with Section 409(a)(16) of the Social Security Act.

[64 FR 17890, Apr. 12, 1999, as amended at 71 FR 37481, June 29, 2006; 81 FR 2105, Jan. 15, 2016; 81 FR 3020, Jan. 20, 2016; 89 FR 80071, Oct. 2, 2024]

§ 262.4 What happens if we determine that a State is subject to a penalty?

(a) If we determine that a State is subject to a penalty, we will notify the State agency in writing, specifying which penalty we will impose and the reasons for the penalty. This notice will:

(1) Specify the penalty provision at issue, including the penalty amount;

(2) Specify the source of information and the reasons for our decision;

(3) Invite the State to present its arguments if it believes that the information or method that we used were in error or were insufficient or that its actions, in the absence of Federal regulations, were based on a reasonable interpretation of the statute; and

(4) Explain how and when the State may submit a reasonable cause justification under § 262.5 and/or corrective compliance plan under § 262.6.

(b) Within 60 days of when it receives our notification, the State may submit a written response that:

(1) Demonstrates that our determination is incorrect because our information or the method that we used in determining the violation or the amount of the penalty was in error or was insufficient, or that the State acted, in the absence of Federal rules, on a reasonable interpretation of the statute;

(2) Demonstrates that the State had reasonable cause for failing to meet the requirement(s); and/or

(3) Provides a corrective compliance plan, pursuant to § 262.6.

(c) If we find that we determined the penalty erroneously, or that the State has adequately demonstrated that it had reasonable cause for failing to meet one or more requirements, we will not impose the penalty.

(d) Reasonable cause and corrective compliance plans are not available for failing to repay a Federal loan; meet the basic MOE requirement; meet the Contingency Fund MOE requirement; expend additional State funds to replace adjusted SFAG reductions due to the imposition of one or more penalties listed in § 262.1; or maintain 80 percent, or 75 percent, as appropriate, basic MOE during a year in which the State receives a Welfare-to-Work grant.

(e)(1) If we request additional information from a State that we need to determine reasonable cause, the State must ordinarily provide such information within 30 days.

(2) Under unusual circumstances, we may give the State an extension of the time to respond to our request.

(f)(1)(i) We will notify the State in writing of our findings with respect to reasonable cause generally within 60 days of the date when we receive its response to our penalty notice (in accordance with paragraph (b) of this section).

(ii) If the finding is negative and the State has not yet submitted a corrective compliance plan, it may do so in response to this notice in accordance with § 262.6.

(2) We will notify the State of our decision regarding its corrective compliance plan in accordance with the provisions of § 262.6(g).

(g) We will impose a penalty in accord with the provisions in § 262.1(c) after we make our final decision and the appellate process is completed, if applicable. If there is an appellate decision upholding the penalty, we will take the penalty and charge interest back to the date that we formally notified the Governor of the adverse action pursuant to § 262.7(a)(1).

§ 262.5 Under what general circumstances will we determine that a State has reasonable cause?

(a) We will not impose a penalty against a State if we determine that the State had reasonable cause for its failure. The general factors a State may use to claim reasonable cause include:

(1) Natural disasters and other calamities (e.g., hurricanes, earthquakes, fire) whose disruptive impact was so significant as to cause the State's failure;

(2) Formally issued Federal guidance that provided incorrect information resulting in the State's failure; or

(3) Isolated problems of minimal impact that are not indicative of a systemic problem.

(b)(1) We will grant reasonable cause to a State that:

(i) Clearly demonstrates that its failure to submit complete, accurate, and timely data, as required at § 265.8 of this chapter, for one or both of the first two quarters of FY 2000, is attributable, in significant part, to its need to divert critical system resources to Year 2000 compliance activities; and

(ii) Submits complete and accurate data for the first two quarters of FY 2000 by September 30, 2000.

(2) A State may also use the additional factors for claiming reasonable cause for failure to comply with the five-year limit on Federal assistance or the minimum participation rates, as specified at §§ 261.52 and 264.3 and subpart B of part 260 of this chapter.

(c) In determining reasonable cause, we will consider the efforts the State made to meet the requirement, as well as the duration and severity of the circumstances that led to the State's failure to achieve the requirement.

(d)(1) The burden of proof rests with the State to fully explain the circumstances and events that constitute reasonable cause for its failure to meet a requirement.

(2) The State must provide us with sufficient relevant information and documentation to substantiate its claim of reasonable cause.

[64 FR 17890, Apr. 12, 1999; 64 FR 40291, July 26, 1999]

§ 262.6 What happens if a State does not demonstrate reasonable cause?

(a) A State may accept the penalty or enter into a corrective compliance plan that will correct or discontinue the violation in order to avoid the penalty if:

(1) A State does not claim reasonable cause; or

(2) We find that the State does not have reasonable cause.

(b) A State that does not claim reasonable cause will have 60 days from receipt of our notice described in § 262.4(a) to submit its corrective compliance plan.

(c) A State that unsuccessfully claimed reasonable cause will have 60 days from the date that it received our second notice, described in § 262.4(f), to submit its corrective compliance plan.

(d) The corrective compliance plan must include:

(1) A complete analysis of why the State did not meet the requirements;

(2) A detailed description of how the State will correct or discontinue, as appropriate, the violation in a timely manner;

(3) The time period in which the violation will be corrected or discontinued;

(4) The milestones, including interim process and outcome goals, that the State will achieve to assure it comes into compliance within the specified time period; and

(5) A certification by the Governor that the State is committed to correcting or discontinuing the violation, in accordance with the plan.

(e) The corrective compliance plan must correct or discontinue the violation within the following time frames:

(1) For a penalty under § 262.1(a)(4), (a)(9), or (a)(15), by the end of the first fiscal year ending at least six months after our receipt of the corrective compliance plan; and

(2) For the remaining penalties, by a date the State proposes that reflects the minimum period necessary to achieve compliance.

(f) During the 60-day period following our receipt of the State's corrective compliance plan, we may request additional information and consult with the State on modifications to the plan including in the case of a penalty under § 262.1(a)(15), modifications to the State's work verification procedures and Work Verification Plan.

(g) We will accept or reject the State's corrective compliance plan, in writing, within 60 days of our receipt of the plan, although a corrective compliance plan is deemed to be accepted if we take no action during the 60-day period following our receipt of the plan.

(h) If a State does not submit an acceptable corrective compliance plan on time, we will assess the penalty immediately.

(i) We will not impose a penalty against a State with respect to any violation covered by a corrective compliance plan that we accept if the State completely corrects or discontinues, as appropriate, the violation within the period covered by the plan.

(j) Under limited circumstances, we may reduce the penalty if the State fails to completely correct or discontinue the violation pursuant to its corrective compliance plan and in a timely manner. To receive a reduced penalty, the State must demonstrate that it met one or both of the following conditions:

(1) Although it did not achieve full compliance, the State made significant progress towards correcting or discontinuing the violation; or

(2) The State's failure to comply fully was attributable to either a natural disaster or regional recession.

[64 FR 17890, Apr. 12, 1999, as amended at 71 FR 37481, June 29, 2006]

§ 262.7 How can a State appeal our decision to take a penalty?

(a)(1) We will formally notify the Governor and the State agency of an adverse action (i.e., the reduction in the SFAG) within five days after we determine that a State is subject to a penalty under parts 261 through 265 of this chapter.

(2) Such notice will include the factual and legal basis for taking the penalty in sufficient detail for the State to be able to respond in an appeal.

(b)(1) The State may file an appeal of the action, in whole or in part, with the HHS Departmental Appeals Board (the Board) within 60 days after the date it receives notice of the adverse action. The State must submit its brief and supporting documents when it files its appeal.

(2) The State must send a copy of the appeal, and any supplemental filings, to the Office of the General Counsel, Children, Families and Aging Division, Room 411-D, 200 Independence Avenue, SW., Washington, DC 20201.

(c) We will submit our reply brief and supporting documentation within 45 days of the receipt of the State's submission under paragraph (b) of this section.

(d) The State may submit a reply and any supporting documentation within 21 days of its receipt of our reply under paragraph (c) of this section.

(e) The appeal to the Board must follow the provisions of the rules under this section and those at §§ 16.2, 16.9, 16.10, and 16.13-16.22 of this title, to the extent that they are consistent with this section.

(f) The Board will consider an appeal filed by a State on the basis of the documentation and briefs submitted, along with any additional information the Board may require to support a final decision. Such information may include a hearing if the Board determines that it is necessary. In deciding whether to uphold an adverse action or any portion of such action, the Board will conduct a thorough review of the issues.

(g)(1) A State may obtain judicial review of a final decision by the Board by filing an action within 90 days after the date of such decision. It should file this action with the district court of the United States in the judicial district where the State agency is located or in the United States District Court for the District of Columbia.

(2) The district court will review the final decision of the Board on the record established in the administrative proceeding, in accordance with the standards of review prescribed by 5 U.S.C. 706(2). The court will base its review on the documents and supporting data submitted to the Board.

§ 263.0 What definitions apply to this part?

(a) Except as noted in § 263.2(d), the general TANF definitions at §§ 260.30 through 260.33 of this chapter apply to this part.

(b) The term “administrative costs” means costs necessary for the proper administration of the TANF program or separate State programs.

(1) It excludes direct costs of providing program services.

(i) For example, it excludes costs of providing diversion benefits and services, providing program information to clients, screening and assessments, development of employability plans, work activities, post-employment services, work supports, and case management. It also excludes costs for contracts devoted entirely to such activities.

(ii) It excludes the salaries and benefits costs for staff providing program services and the direct administrative costs associated with providing the services, such as the costs for supplies, equipment, travel, postage, utilities, rental of office space and maintenance of office space.

(2) It includes costs for general administration and coordination of these programs, including contract costs and all indirect (or overhead) costs. Examples of administrative costs include:

(i) Salaries and benefits of staff performing administrative and coordination functions;

(ii) Activities related to eligibility determinations;

(iii) Preparation of program plans, budgets, and schedules;

(iv) Monitoring of programs and projects;

(v) Fraud and abuse units;

(vi) Procurement activities;

(vii) Public relations;

(viii) Services related to accounting, litigation, audits, management of property, payroll, and personnel;

(ix) Costs for the goods and services required for administration of the program such as the costs for supplies, equipment, travel, postage, utilities, and rental of office space and maintenance of office space, provided that such costs are not excluded as a direct administrative cost for providing program services under paragraph (b)(1) of this section;

(x) Travel costs incurred for official business and not excluded as a direct administrative cost for providing program services under paragraph (b)(1) of this section;

(xi) Management information systems not related to the tracking and monitoring of TANF requirements (e.g., for a personnel and payroll system for State staff); and

(xii) Preparing reports and other documents.

§ 263.1 [Reserved]

§ 263.2 What kinds of State expenditures count toward meeting a State's basic MOE expenditure requirement?

(a) Expenditures of State funds in TANF or separate State programs may count if they are made for the following types of benefits or services:

(1) Cash assistance, including the State's share of the assigned child support collection that is distributed to the family, and disregarded in determining eligibility for, and amount of the TANF assistance payment;

(2) Child care assistance (see § 263.3);

(3) Education activities designed to increase self-sufficiency, job training, and work (see § 263.4);

(4) Any other use of funds allowable under section 404(a)(1) of the Act including:

(i) Nonmedical treatment services for alcohol and drug abuse and some medical treatment services (provided that the State has not commingled its MOE funds with Federal TANF funds to pay for the services), if consistent with the goals at § 260.20 of this chapter; and

(ii) Pro-family healthy marriage and responsible fatherhood activities enumerated in part IV-A of the Act, sections 403(a)(2)(A)(iii) and 403(a)(2)(C)(ii) that are consistent with the goals at § 260.20(c) or (d) of this chapter, but do not constitute “assistance” as defined in § 260.31(a) of this chapter; and

(5)(i) Administrative costs for activities listed in paragraphs (a)(1) through (a)(4) of this section, not to exceed 15 percent of the total amount of countable expenditures for the fiscal year.

(ii) Costs for information technology and computerization needed for tracking or monitoring required by or under part IV-A of the Act do not count towards the limit in paragraph (5)(i) of this section, even if they fall within the definition of “administrative costs.”

(A) This exclusion covers the costs for salaries and benefits of staff who develop, maintain, support, or operate the portions of information technology or computer systems used for tracking and monitoring.

(B) It also covers the costs of contracts for the development, maintenance, support, or operation of those portions of information technology or computer systems used for tracking or monitoring.

(b) With the exception of paragraph (a)(4)(ii) of this section, the benefits or services listed under paragraph (a) of this section count only if they have been provided to or on behalf of eligible families. An “eligible family” as defined by the State, must:

(1) Be comprised of citizens or non-citizens who:

(i) Are eligible for TANF assistance;

(ii) Would be eligible for TANF assistance, but for the time limit on the receipt of federally funded assistance; or

(iii) Are lawfully present in the United States and would be eligible for assistance, but for the application of title IV of PRWORA;

(2) Include a child living with a custodial parent or other adult caretaker relative (or consist of a pregnant individual); and

(3) Be financially eligible according to the appropriate income and resource (when applicable) standards established by the State and contained in its TANF plan.

(c) Benefits or services listed under paragraph (a) of this section provided to a family that meets the criteria under paragraphs (b)(1) through (b)(3) of this section, but who became ineligible solely due to the time limitation given under § 264.1 of this chapter, may also count.

(d) Expenditures for the benefits or services listed under paragraph (a) of this section count whether or not the benefit or service meets the definition of assistance under § 260.31 of this chapter. Further, families that meet the criteria in paragraphs (b)(2) and (b)(3) of this section are considered to be eligible for TANF assistance for the purposes of paragraph (b)(1)(i) of this section.

(e) Expenditures for benefits or services listed under paragraph (a) of this section may include allowable costs borne by others in the State (e.g., local government), including cash donations from non-Federal third parties (e.g., a non-profit organization) and the value of third party in-kind contributions if:

(1) The expenditure is verifiable and meets all applicable requirements in 2 CFR 200.1 and 200.306;

(2) There is an agreement between the State and the other party allowing the State to count the expenditure toward its MOE requirement; and,

(3) The State counts a cash donation only when it is actually spent.

(f)(1) The expenditures for benefits or services in State-funded programs listed under paragraph (a) of this section count only if they also meet the requirements of § 263.5.

(2) Expenditures that fall within the prohibitions in § 263.6 do not count.

(g) State funds used to meet the Healthy Marriage Promotion and Responsible Fatherhood Grant match requirement may count to meet the MOE requirement in § 263.1, provided the expenditure also meets all the other MOE requirements in this subpart.

[73 FR 6827, Feb. 5, 2008, as amended at 81 FR 3020, Jan. 20, 2016; 89 FR 80071, Oct. 2, 2024]

§ 263.3 [Reserved]

§ 263.4 When do educational expenditures count?

(a) Expenditures for educational activities or services count if:

(1) They are provided to eligible families (as defined in § 263.2(b)) to increase self-sufficiency, job training, and work; and

(2) They are not generally available to other residents of the State without cost and without regard to their income.

(b) Expenditures on behalf of eligible families for educational services or activities provided through the public education system do not count unless they meet the requirements under paragraph (a) of this section.

§ 263.5 When do expenditures in State-funded programs count?

(a) If a current State or local program also operated in FY 1995, and expenditures in this program would have been previously authorized and allowable under the former AFDC, JOBS, Emergency Assistance, Child Care for AFDC recipients, At-Risk Child Care, or Transitional Child Care programs, then current fiscal year expenditures in this program count in their entirety, provided that the State has met all requirements under § 263.2.

(b) If a current State or local program also operated in FY 1995, and expenditures in this program would not have been previously authorized and allowable under the former AFDC, JOBS, Emergency Assistance, Child Care for AFDC recipients, At-Risk Child Care, or Transitional Child care programs, then countable expenditures are limited to:

(1) The amount by which total current fiscal year expenditures for or on behalf of eligible families, as defined in § 263.2(b), exceed total State expenditures in this program during FY 1995; or, if applicable,

(2) The amount by which total current fiscal year expenditures for pro-family activities under § 263.2(a)(4)(ii) exceed total State expenditures in this program during FY 1995.

[64 FR 17893, Apr. 12, 1999, as amended at 73 FR 6828, Feb. 5, 2008]

§ 263.6 What kinds of expenditures do not count?

The following kinds of expenditures do not count:

(a) Expenditures of funds that originated with the Federal government;

(b) State expenditures under the Medicaid program under title XIX of the Act;

(c) Expenditures that a State makes as a condition of receiving Federal funds under another program that is not in Part IV-A of the Act, except as provided in § 263.3;

(d) Expenditures that a State made in a prior fiscal year;

(e) Expenditures that a State uses to match Federal Welfare-to-Work funds provided under section 403(a)(5) of the Act; and

(f) Expenditures that a State makes in the TANF program to replace the reductions in the SFAG as a result of penalties, pursuant to § 264.50 of this chapter.

[71 FR 37481, June 29, 2006]

§§ 263.8-1263.9 [Reserved]

§ 263.10 What actions would we take against a State if it uses Federal TANF funds in violation of the Act?

(a) If a State misuses its Federal TANF funds, we will reduce the SFAG payable for the immediately succeeding fiscal year quarter by the amount misused.

(b) If the State fails to demonstrate that the misuse was not intentional, we will further reduce the SFAG payable for the immediately succeeding fiscal year quarter in an amount equal to five percent of the adjusted SFAG.

(c) The reasonable cause and corrective compliance provisions of §§ 262.4 through 262.6 of this chapter apply to the penalties specified in paragraphs (a) and (b) of this section.

§ 263.11 What uses of Federal TANF funds are improper?

(a) States may use Federal TANF funds for expenditures:

(1) That are reasonably calculated to accomplish the purposes of TANF, as specified at § 260.20 of this chapter; or

(2) For which the State was authorized to use IV-A or IV-F funds under prior law, as in effect on September 30, 1995 (or, at the option of the State, August 21, 1996).

(b) We will consider use of funds in violation of paragraph (a) of this section, sections 404 and 408 and other provisions of the Act, section 115(a)(1) of PRWORA, or 2 CFR parts 200 and 300 to be misuse of funds.

[64 FR 17893, Apr. 12, 1999, as amended at 81 FR 3020, Jan. 20, 2016; 89 FR 80071, Oct. 2, 2024]

§ 263.12 How will we determine if a State intentionally misused Federal TANF funds?

(a) The State must show, to our satisfaction, that it used these funds for purposes that a reasonable person would consider to be within the purposes of the TANF program (as specified at § 260.20 of this chapter) and consistent with the provisions listed in § 263.11.

(b) We may determine that a State misused funds intentionally if there is supporting documentation, such as Federal guidance or policy instructions, precluding the use of Federal TANF funds for such purpose.

(c) We may also determine that a State intentionally misused funds if the State continues to use the funds in the same or similarly improper manner after receiving notification that we had determined such use to be improper.

§ 263.13 Is there a limit on the amount of Federal TANF funds that a State may spend on administrative costs?

(a)(i) Yes, a State may not spend more than 15 percent of the amount that it receives as its adjusted SFAG, or under other provisions of section 403 of the Act, on “administrative costs,” as defined at § 263.0(b).

(ii) Any violation of the limitation in paragraph (a)(i) of this section will constitute a misuse of funds under § 263.11(b).

(b) Expenditures on the information technology and computerization needed for tracking and monitoring required by or under part IV-A of the Act do not count towards the limit specified in paragraph (a) of this section.

(1) This exclusion covers the costs for salaries and benefits of staff who develop, maintain, support or operate the portions of information technology or computer systems used for tracking and monitoring.

(2) It also covers the costs of contracts for development, maintenance. support, or operation of those portions of information technology or computer systems used for tracking or monitoring.

§ 263.14 What methodology shall States use to allocate TANF costs?

States shall use a benefiting program cost allocation methodology consistent with the general requirements of 2 CFR parts 200 and 300, subpart E to allocate TANF costs.

[73 FR 42721, July 23, 2008, as amended at 81 FR 3020, Jan. 20, 2016; 89 FR 80071, Oct. 2, 2024]

§§ 263.20-263.22 [Reserved]

§ 263.23 How does a State prevent a recipient from using the IDA account for unqualified purposes?

To prevent recipients from using the IDA account improperly, States may do the following:

(a) Count withdrawals as earned income in the month of withdrawal (unless already counted as income);

(b) Count withdrawals as resources in determining eligibility; or

(c) Take such other steps as the State has established in its State plan or written State policies to deter inappropriate use.

§ 264.0 [Reserved]

§ 264.1 What restrictions apply to the length of time Federal TANF assistance may be provided?

(a)(1) Subject to the exceptions in this section, no State may use any of its Federal TANF funds to provide assistance (as defined in § 260.31 of this chapter) to a family that includes an adult head-of-household or a spouse of the head-of-household who has received Federal assistance for a total of five years (i.e., 60 cumulative months, whether or not consecutive).

(2) The provision in paragraph (a)(1) of this section also applies to a family that includes a pregnant minor head-of-household, minor parent head-of-household, or spouse of such a head-of-household who has received Federal assistance for a total of five years.

(3) Notwithstanding the provisions of paragraphs (a)(1) and (a)(2) of this section, a State may provide assistance under WtW, pursuant to section 403(a)(5) of the Act, to a family that is ineligible for TANF solely because it has reached the five-year time limit.

(b)(1) States must not count toward the five-year limit:

(i) Any month of receipt of assistance by an individual who is not the head-of-household or married to the head-of-household;

(ii) Any month of receipt of assistance by an adult while living in Indian country (as defined in section 1151 of title 18, United States Code) or a Native Alaskan Village where at least 50 percent of the adults were not employed; and

(iii) Any month for which an individual receives only noncash assistance provided under WtW, pursuant to section 403(a)(5) of the Act.

(2) Only months of assistance that are paid for with Federal TANF funds (in whole or in part) count towards the five-year time limit.

(c) States have the option to extend assistance paid for by Federal TANF funds beyond the five-year limit for up to 20 percent of the average monthly number of families receiving assistance during the fiscal year or the immediately preceding fiscal year, whichever the State elects. States are permitted to extend assistance to families only on the basis of:

(1) Hardship, as defined by the State; or

(2) The fact that the family includes someone who has been battered, or subject to extreme cruelty based on the fact that the individual has been subjected to:

(i) Physical acts that resulted in, or threatened to result in, physical injury to the individual;

(ii) Sexual abuse;

(iii) Sexual activity involving a dependent child;

(iv) Being forced as the caretaker relative of a dependent child to engage in nonconsensual sexual acts or activities;

(v) Threats of, or attempts at, physical or sexual abuse;

(vi) Mental abuse; or

(vii) Neglect or deprivation of medical care.

(d) If a State opts to extend assistance to part of its caseload as permitted under paragraph (c) of this section, it would grant such an extension to a specific family once a head-of-household or spouse of a head-of-household in the family has received 60 cumulative months of assistance.

(e) To determine whether a State has failed to comply with the five-year limit on Federal assistance established in paragraph (c) of this section for a fiscal year, we would divide the average monthly number of families with a head-of-household or a spouse of a head-of-household who has received assistance for more than 60 cumulative months by the average monthly number of all families that received assistance during that fiscal year or during the immediately preceding fiscal year.

(f) If the five-year limit is inconsistent with a State's waiver granted under section 1115 of the Act, we will determine State compliance with the Federal time limit in accordance with the provisions of subpart C of part 260.

§ 264.2 [Reserved]

§ 264.3 How can a State avoid a penalty for failure to comply with the five-year limit?

(a) We will not impose the penalty if the State demonstrates to our satisfaction that it had reasonable cause for failing to comply with the five-year limit on Federal assistance or it achieves compliance under a corrective compliance plan, pursuant to §§ 262.5 and 262.6 of this chapter.

(b) In addition, we will determine a State has reasonable cause if it demonstrates that it failed to comply with the five-year limit on Federal assistance because of federally recognized good cause domestic violence waivers provided to victims of domestic violence in accordance with provisions of subpart B of part 260.

[64 FR 17896, Apr. 12, 1999; 64 FR 40292, July 26, 1999]

§ 264.10 Must States do computer matching of data records under IEVS to verify recipient information?

(a) Pursuant to section 1137 of the Act and subject to paragraph (a)(2) of that section, States must meet the requirements of IEVS and request the following information from the Internal Revenue Service (IRS), the State Wage Information Collections Agency (SWICA), the Social Security Administration (SSA), and the Immigration and Naturalization Service (INS):

(1) IRS unearned income;

(2) SWICA employer quarterly reports of income and unemployment insurance benefit payments;

(3) IRS earned income maintained by SSA; and

(4) Immigration status information maintained by the INS.

(b) The requirements at §§ 205.51 through 205.60 of this chapter also apply to the TANF IEVS requirement.

[64 FR 17896, Apr. 12, 1999; 64 FR 40292, July 26, 1999]

§ 264.11 How much is the penalty for not participating in IEVS?

If we determine that the State has not complied with the requirements of § 264.10, we will reduce the SFAG payable for the immediately succeeding fiscal year by two percent of the adjusted SFAG unless the State demonstrates to our satisfaction that it had reasonable cause or achieved compliance under a corrective compliance plan pursuant to §§ 262.5 and 262.6 of this chapter.

§ 264.30 What procedures exist to ensure cooperation with the child support enforcement requirements?

(a)(1) The State agency must refer all appropriate individuals in the family of a child, for whom paternity has not been established or for whom a child support order needs to be established, modified or enforced, to the child support enforcement agency (i.e., the IV-D agency).

(2) Referred individuals must cooperate in establishing paternity and in establishing, modifying, or enforcing a support order with respect to the child.

(b) If the IV-D agency determines that an individual is not cooperating, and the individual does not qualify for a good cause or other exception established by the State agency responsible for making good cause determinations in accordance with section 454(29) of the Act or for a good cause domestic violence waiver granted in accordance with § 260.52 of this chapter, then the IV-D agency must notify the IV-A agency promptly.

(c) The IV-A agency must then take appropriate action by:

(1) Deducting from the assistance that would otherwise be provided to the family of the individual an amount equal to not less than 25 percent of the amount of such assistance; or

(2) Denying the family any assistance under the program.

§ 264.31 What happens if a State does not comply with the IV-D sanction requirement?

(a)(1) If we find that, for a fiscal year, the State IV-A agency did not enforce the penalties against recipients required under § 264.30(c), we will reduce the SFAG payable for the next fiscal year by one percent of the adjusted SFAG.

(2) Upon a finding for a second fiscal year, we will reduce the SFAG by two percent of the adjusted SFAG for the following year.

(3) A third or subsequent finding will result in the maximum penalty of five percent.

(b) We will not impose a penalty if:

(1) The State demonstrates to our satisfaction that it had reasonable cause pursuant to § 262.5 of this chapter; or

(2) The State achieves compliance under a corrective compliance plan pursuant to § 262.6 of this chapter.

§ 264.40 [Reserved]

§ 264.50 What happens if, in a fiscal year, a State does not expend, with its own funds, an amount equal to the reduction to the adjusted SFAG resulting from a penalty?

(a)(1) When we withhold Federal TANF funds from a State during a fiscal year because of other penalty actions listed at § 262.1 of this chapter, the State must replace these Federal TANF funds with State funds during the subsequent fiscal year.

(2) If the State fails to replace funds during the subsequent year, then we will assess an additional penalty of no more than two percent of the adjusted SFAG during the year that follows the subsequent year.

(b) A State must expend such replacement funds under its TANF program, not under “separate State programs.”

(c) We will assess a penalty of no more than two percent of the adjusted SFAG plus the amount equal to the difference between the amount the State was required to expend and the amount it actually expended in the fiscal year.

(1) We will assess the maximum penalty amount if the State made no additional expenditures to compensate for the reductions to its adjusted SFAG resulting from penalties.

(2) We will reduce the percentage portion of the penalty if the State has expended some of the amount required. In such case, we will calculate the applicable percentage portion of the penalty by multiplying the percentage of the required expenditures that the State failed to make in the fiscal year by two percent.

(d) The reasonable cause and corrective compliance plan provisions at §§ 262.5 and 262.6 of this chapter do not apply to this penalty.

§§ 264.60-264.61 [Reserved]

§§ 264.70-264.71 [Reserved]

§ 264.72 What requirements are imposed on a State if it receives contingency funds?

(a)(1) A State must meet a Contingency Fund MOE level of 100 percent of historic State expenditures for FY 1994.

(2) A State must exceed the Contingency Fund MOE level to keep any of the contingency funds that it received. It may be able to retain a portion of the amount of contingency funds that match countable State expenditures, as defined in § 264.0, that are in excess of the State's Contingency Fund MOE level, after the overall adjustment required by section 403(b)(6)(C) of the Act.

(b) A State must complete an annual reconciliation, in accordance with § 264.73, in order to determine how much, if any, of the contingency funds that it received in a fiscal year it may retain.

(c) If required to remit funds under the annual reconciliation, a State must remit all (or a portion) of the funds paid to it for a fiscal year within one year after it has failed to meet either the Food Stamp trigger or the Unemployment trigger, as defined in § 264.0, for three consecutive months.

(d) A State must expend contingency funds in the fiscal year in which they are awarded.

(e) A State may not transfer contingency funds to the Discretionary Fund of the CCDF or the SSBG.

(f) A State must follow the restrictions and prohibitions in effect for Federal TANF funds, including the provisions of § 263.11 of this chapter, in its use of contingency funds.

§ 264.73 What is an annual reconciliation?

(a) The annual reconciliation involves the calculation, for a fiscal year, of:

(1) The amount of a State's qualifying expenditures;

(2) The amount by which a State's countable State expenditures, as defined in § 264.0, exceed the State's required Contingency Fund MOE level; and

(3) The amount of contingency funds that the State may retain or must remit.

(b) If a State exceeded its required Contingency Fund MOE level, it may be able to retain some or all of the contingency funds that it received.

(c) A State determines the amount of contingency funds that it may retain by performing the following calculations:

(1) From the lesser of the following two amounts:

(i) The amount of contingency funds paid to it during the fiscal year; or

(ii) Its countable State expenditures, as defined in § 264.0, minus its required Contingency Fund MOE level, multiplied by:

(A) The State's Federal Medical Assistance Percentage (FMAP) applicable for the fiscal year for which funds were awarded; and

(B) 1/12 times the number of months during the fiscal year for which the State received contingency funds.

(2) Subtract the State's proportionate remittance (as reported to the State by ACF) for the overall adjustment of the Contingency Fund for that fiscal year required by section 403(b)(6)(C) of the Act.

§ 264.74 How will we determine the Contingency Fund MOE level for the annual reconciliation?

(a)(1) The Contingency Fund MOE level includes the State's share of expenditures for AFDC benefit payments, administration, and FAMIS; EA; and the JOBS program for FY 1994.

(2) We will use the same data sources and date, i.e., April 28, 1995, that we used to determine the basic MOE levels for FY 1994. We will exclude the State's share of expenditures from the former IV-A child care programs (AFDC/JOBS, Transitional and At-Risk child care) in the calculation.

(b) We will reduce a State's Contingency Fund MOE level by the same percentage that we reduce the basic MOE level for any fiscal year in which we reduce the State's annual SFAG allocation to provide funding to Tribal grantees operating a Tribal TANF program.

§ 264.75 For the annual reconciliation, what are qualifying State expenditures?

(a) Qualifying State expenditures are expenditures of State funds made in the State TANF program, with respect to eligible families, for the following:

(1) Cash assistance, including assigned child support collected by the State, distributed to the family, and disregarded in determining eligibility for, and amount of the TANF assistance payment;

(2) Educational activities designed to increase self-sufficiency, job training, and work, excluding any expenditure for public education in the State except expenditures involving the provision of services or assistance to an eligible family that are not generally available to persons who are not members of an eligible family;

(3) Any other services allowable under section 404(a)(1) of the Act and consistent with the goals at § 260.20 of this chapter; and

(4) Administrative costs in connection with the provision of the benefits and services listed in paragraphs (a)(1) through (a)(3) of this section, but only to the extent that such costs are consistent with the 15-percent limitation at § 263.2(a)(5) of this chapter.

(b) Qualifying State expenditures do not include:

(1) Child care expenditures; and

(2) Expenditures made under separate State programs.

§ 264.76 What action will we take if a State fails to remit funds after failing to meet its required Contingency Fund MOE level?

(a) If, for a fiscal year in which it receives contingency funds, a State fails to meet its required Contingency Fund MOE level, we will penalize the State by reducing the SFAG payable for the next fiscal year by the amount of contingency funds not remitted.

(b) A State may appeal this decision, as provided in § 262.7 of this chapter.

(c) The reasonable cause exceptions and corrective compliance regulations at §§ 262.5 and 262.6 of this chapter do not apply to this penalty.

§ 264.77 How will we determine if a State met its Contingency Fund expenditure requirements?

(a) States receiving contingency funds for a fiscal year must complete the quarterly TANF Financial Report. As part of the fourth quarter's report, a State must complete its annual reconciliation.

(b) The TANF Financial Report and State reporting on expenditures are subject to our review.

§ 264.80 If a Territory receives Matching Grant funds, what funds must it expend?

(a) If a Territory receives Matching Grant funds under section 1108(b) of the Act, it must:

(1) Contribute 25 percent of the expenditures funded under the Matching Grant for title IV-A or title IV-E expenditures;

(2) Expend 100 percent of the amount of historic expenditures for FY 1995 for the AFDC program (including administrative costs and FAMIS), the EA program, and the JOBS program; and

(3) Expend 100 percent of the amount of the Family Assistance Grant annual allocation using Federal TANF, title IV-E funds and/or Territory-only funds, without regard to any penalties applied in accordance with section 409 of the Act.

(b) Territories may not use the same Territorial expenditures to satisfy the requirements of paragraphs (a)(1), (a)(2) and (a)(3) of this section.

§ 264.81 What expenditures qualify for Territories to meet the Matching Grant MOE requirement?

To meet the Matching Grant MOE requirements, Territories may count:

(a) Territorial expenditures made in accordance with §§ 263.2, 263.3, 263.4, and 263.6 of this chapter that are commingled with Federal TANF funds or made under a segregated TANF program; and

(b) Territorial expenditures made pursuant to the regulations at 45 CFR parts 1355 and 1356 for the Foster Care and Adoption Assistance programs and section 477 of the Act for the Independent Living program.

§ 264.82 What expenditures qualify for meeting the Matching Grant FAG amount requirement?

To meet the Matching Grant FAG amount requirement, Territories may count:

(a) Expenditures made with Federal TANF funds pursuant to § 263.11 of this chapter;

(b) Expenditures made in accordance with §§ 263.2, 263.3, 263.4, and 263.6 of this chapter that are commingled with Federal TANF funds or made under a segregated TANF program;

(c) Amounts transferred from TANF funds pursuant to section 404(d) of the Act; and

(d) The Federal and Territorial shares of expenditures made pursuant to the regulations at 45 CFR parts 1355 and 1356 for the Foster Care and Adoption Assistance programs and section 477 of the Act for the Independent Living program.

§ 264.83 [Reserved]

§ 264.84 What will we do if a Territory fails to meet the Matching Grant funding requirements at § 264.80?

If a Territory does not meet the requirements at either or both of § 264.80(a)(2) and (a)(3), we will disallow all Matching Grant funds received for the fiscal year.

§ 264.85 [Reserved]

§ 265.1 What does this part cover?

(a) This part explains how we will collect the information required by section 411(a) of the Act (data collection and reporting); the information required to implement section 407 of the Act (work participation requirements), as authorized by section 411(a)(1)(A)(xii); the information required to implement section 409 (penalties), section 403 (grants to States), section 405 (administrative provisions), section 411(b) (report to Congress), and section 411(f) (reporting performance indicators); and the data necessary to carry out our financial management and oversight responsibilities.

(b) This part describes the information in the quarterly and annual reports that each State must file, as follows:

(1) The case record information (disaggregated and aggregated) on individuals and families in the quarterly TANF Data Report;

(2) The expenditure data in the quarterly TANF Financial Report (or, as applicable, the Territorial Financial Report);

(3) The definitions and other information on the State's TANF and MOE programs that must be filed annually;

(4) The definitions and other information necessary for the Work Outcomes of TANF Exiters Report; and

(5) The definitions and other information necessary for the Secondary School Diploma or its Recognized Equivalent Attainment Rate.

(c) If a State claims MOE expenditures under a separate State program(s), this part describes the case record information (disaggregated and aggregated) on individuals and families in the quarterly SSP-MOE Data Report that each State must file.

(d) This part describes when reports are due, how we will determine if reporting requirements have been met, and how we will apply the statutory penalty for failure to file a timely report. It also specifies electronic filing and sampling requirements.

[64 FR 17900, Apr. 12, 1999, as amended at 71 FR 37482, June 29, 2006; 89 FR 53876, June 28, 2024]

§ 265.2 What definitions apply to this part?

(a) Except as provided in paragraphs (b) through (e) of this section, the general TANF definitions at §§ 260.30 through 260.33 and the definitions of a work-eligible individual and the work activities in § 261.2 of this chapter apply to this part.

(b) For data collection and reporting purposes only, family means:

(1) All individuals receiving assistance as part of a family under the State's TANF or separate State program (including noncustodial parents, where required under § 265.5(g)); and

(2) The following additional persons living in the household, if not included under paragraph (b)(1) of this section:

(i) Parent(s) or caretaker relative(s) of any minor child receiving assistance;

(ii) Minor siblings of any child receiving assistance; and

(iii) Any person whose income or resources would be counted in determining the family's eligibility for or amount of assistance.

(c) For purposes of the Work Outcomes of TANF Exiters Report and the Secondary School Diploma or its Recognized Equivalent Attainment Rate, exit is the date that a family with a work-eligible individual ceases to receive assistance (as defined in § 260.31) from the TANF program. The last day of assistance cannot be determined until 90 days have elapsed since the participant last received assistance.

(d) For purposes of the Work Outcomes of TANF Exiters Report, unsubsidized employment means full- or part-time employment in the private or public sector after exiting the TANF program.

(e) For purposes of the Secondary School Diploma or its Recognized Equivalent Attainment Rate:

(1) A secondary school diploma is a “regular high school diploma” as that term is defined in 21 U.S.C. 7801(43), the Elementary and Secondary Education Act of 1965 (ESEA), as amended by the Every Student Succeeds Act (ESSA).

(2) A recognized equivalent to a secondary school diploma is a certification recognized by a State that signifies that a student has completed the State's requirements for a high school education.

[71 FR 37482, June 29, 2006, as amended at 89 FR 53876, June 28, 2024]

§ 265.3 What reports must the State file on a quarterly basis?

(a) Quarterly reports. (1) Each State must collect on a monthly basis, and file on a quarterly basis, the data specified in the TANF Data Report, the TANF Financial Report (or, as applicable, the Territorial Financial Report), and the Work Outcomes of TANF Exiters Report.

(2) Each State that claims MOE expenditures for a separate State program(s) must collect on a monthly basis, and file on a quarterly basis, the data specified in the SSP-MOE Data Report.

(b) TANF Data Report. The TANF Data Report consists of four sections. Two sections contain disaggregated data elements and two sections contain aggregated data elements.

(1) Disaggregated Data on Families Receiving TANF Assistance—Section one. Each State must file disaggregated information on families receiving TANF assistance. This section specifies identifying and demographic data such as the individual's Social Security Number and information such as the amount of assistance received, educational level, employment status, work participation activities, citizenship status, and earned and unearned income. The data must be provided for both adults and children.

(2) Disaggregated Data on Families No Longer Receiving TANF Assistance—Section two. Each State must file disaggregated information on families no longer receiving TANF assistance. This section specifies the reasons for case closure and data similar to the data required in section one.

(3) Aggregated Data—Section three. Each State must file aggregated information on families receiving, applying for, and no longer receiving TANF assistance. This section of the TANF Data Report requires aggregate figures in such areas as: The number of applications received and their disposition; the number of recipient families, adult recipients, and child recipients; the number of births and out-of-wedlock births for families receiving TANF assistance; the number of noncustodial parents participating in work activities; and the number of closed cases.

(4) Aggregated Caseload Data by Stratum—Section four. Each State that opts to use a stratified sample to report the quarterly TANF disaggregated data must file the monthly caseload data by stratum for each month in the quarter.

(c) The TANF Financial Report (or Territorial Financial Report). (1) Each State must file quarterly expenditure data on the State's use of Federal TANF funds, State TANF expenditures, and State expenditures of MOE funds in separate State programs.

(2) If a State is expending Federal TANF funds received in prior fiscal years, it must file a separate quarterly TANF Financial Report (or, as applicable, Territorial Financial Report) for each fiscal year that provides information on the expenditures of that year's TANF funds.

(3) Territories must report their expenditure and other fiscal data on the Territorial Financial Report, as provided at § 264.85 of this chapter, in lieu of the TANF Financial Report.

(d) SSP-MOE Data Report. The SSP-MOE Data Report consists of four sections. Two sections contain disaggregated data elements and two sections contain aggregated data elements.

(1) Disaggregated Data on Families Receiving SSP-MOE Assistance—Section one. Each State that claims MOE expenditures for a separate State program(s) must file disaggregated information on families receiving SSP-MOE assistance. This section specifies identifying and demographic data such as the individual's Social Security Number, the amount of assistance received, educational level, employment status, work participation activities, citizenship status, and earned and unearned income. The data must be provided for both adults and children.

(2) Disaggregated Data on Families No Longer Receiving SSP-MOE Assistance—Section two. Each State that claims MOE expenditures for a separate State program(s) must file disaggregated information on families no longer receiving SSP-MOE assistance. This section specifies the reasons for case closure and data similar to the data required in section one.

(3) Aggregated Data—Section three. Each State that claims MOE expenditures for a separate State program(s) must file aggregated information on families receiving and no longer receiving SSP-MOE assistance. This section of the SSP-MOE Data Report requires aggregate figures in such areas as: The number of recipient families, adult recipients, and child recipients; the total amount of assistance for families receiving SSP-MOE assistance; the number of non-custodial parents participating in work activities; and the number of closed cases.

(4) Aggregated Caseload Data by Stratum—Section four. Each State that claims MOE expenditures for a separate State program(s) and that opts to use a stratified sample to report the SSP-MOE quarterly disaggregated data must file the monthly caseload by stratum for each month in the quarter.

(e) Optional data elements. A State has the option not to report on some data elements for some individuals in the TANF Data Report and the SSP-MOE Data Report, as specified in the instructions to these reports.

(f) Non-custodial parents. A State must report information on a non-custodial parent (as defined in § 260.30 of this chapter) if the non-custodial parent:

(1) Is receiving assistance as defined in § 260.31 of this chapter;

(2) Is participating in work activities as defined in section 407(d) of the Act; or

(3) Has been designated by the State as a member of a family receiving assistance.

(g) Work Outcomes of TANF Exiters Report. Each State must file the Social Security numbers of all work-eligible individuals, as defined in § 261.2(n), who have exited the program, as defined in § 265.2(b). This information will be used for calculating the following Work Outcomes performance indicators:

(1) Employment Rate—2nd Quarter After Exit: the percentage of individuals who were work-eligible individuals as of the time of exit from the program, who are employed during the second quarter after the exit;

(2) Employment Retention Rate—4th Quarter After Exit: the percentage of individuals who were work-eligible individuals as of the time of exit from the program who were employed in the second quarter after the exit, who are also employed during the fourth quarter after the exit; and

(3) Median Earnings—2nd Quarter After Exit: the median earnings of individuals who were work-eligible individuals as of the time of exit from the program, who are employed during the second quarter after the exit.

[71 FR 37482, June 29, 2006, as amended at 89 FR 53876, June 28, 2024]

§ 265.4 When are quarterly reports due?

(a) Each State must file the TANF Data Report and the TANF Financial Report (or, as applicable, the Territorial Financial Report) within 45 days following the end of the quarter or be subject to a penalty.

(b) Each State that claims MOE expenditures for a separate State program(s) must file the SSP-MOE Data Report within 45 days following the end of the quarter or be subject to a penalty.

(c) A State that fails to submit the reports within 45 days will be subject to a penalty unless the State files complete and accurate reports before the end of the fiscal quarter that immediately succeeds the quarter for which the reports were required to be submitted.

(d) Each State must file the Work Outcomes of TANF Exiters Report within 45 days following the end of the quarter.

[71 FR 37483, June 29, 2006, as amended at 89 FR 53877, June 28, 2024]

§ 265.5 May States use sampling?

(a) Each State may report the disaggregated data in the TANF Data Report and the SSP-MOE Data Report on all recipient families or on a sample of families selected through the use of a scientifically acceptable sampling method that we have approved. States may use sampling to generate certain aggregated data elements as identified in the instructions to the reports.

(b) “Scientifically acceptable sampling method” means:

(1) A probability sampling method in which every sampling unit in the population has a known, non-zero chance to be included in the sample; and

(2) Our sample size requirements are met.

(c) In reporting data based on sampling, the State must follow the specifications and procedures in the TANF Sampling Manual.

(d) States may not use sampling to report expenditure data, data included in the Work Outcomes of TANF Exiters Report, or data included in the Secondary School Diploma or its Recognized Equivalent Attainment Rate.

[64 FR 17900, Apr. 12, 1999, as amended at 89 FR 53877, June 28, 2024]

§ 265.6 [Reserved]

§ 265.7 How will we determine if the State is meeting the quarterly reporting requirements?

(a) Each State's quarterly reports (the TANF Data Report, the TANF Financial Report (or Territorial Financial Report), the SSP-MOE Data Report, and the Work Outcomes of TANF Exiters Report) must be complete and accurate and filed by the due date.

(b) For a disaggregated data report, “a complete and accurate report” means that:

(1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems, and include correction of the quarterly data by the end of the fiscal year reporting period;

(2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so);

(3) The State reports data for all required elements (i.e., no data are missing);

(4)(i) The State provides data on all families; or

(ii) If the State opts to use sampling, the State reports data on all families selected in a sample that meets the specification and procedures in the TANF Sampling Manual (except for families listed in error); and

(5) Where estimates are necessary (e.g., some types of assistance may require cost estimates), the State uses reasonable methods to develop these estimates.

(c) For an aggregated data report, “a complete and accurate report” means that:

(1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems;

(2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so);

(3) The State reports data on all applicable elements; and

(4) Monthly totals are unduplicated counts for all families (e.g., the number of families and the number of out-of-wedlock births are unduplicated counts).

(d) For the TANF Financial Report (or, as applicable, the Territorial Financial Report), “a complete and accurate report” means that:

(1) The reported data accurately reflect information available to the State in case records, financial records, and automated data systems;

(2) The data are free from computational errors and are internally consistent (e.g., items that should add to totals do so);

(3) The State reports data on all applicable elements; and

(4) All expenditures have been made in accordance with2 CFR 200.302(a).

(e) For the Work Outcomes of TANF Exiters Report, “complete and accurate report” means that:

(1) The reported data accurately reflect information available to the State in case records, and automated data systems;

(2) The State reports data on all applicable elements (i.e., no data are missing); and

(3) The State reports universe data on all work eligible individuals who exited TANF in a particular quarter.

(f) We will review the data filed in the quarterly reports to determine if they meet these standards. In addition, we will use audits and reviews to verify the accuracy of the data filed by the States.

(g) States must maintain records to adequately support any report, in accordance with 2 CFR 200.334 through 200.338.

[64 FR 17900, Apr. 12, 1999, as amended at 73 FR 6828, Feb. 5, 2008; 81 FR 3020, Jan. 20, 2016; 89 FR 53877, June 28, 2024; 89 FR 80071, Oct. 2, 2024]

§ 265.8 Under what circumstances will we take action to impose a reporting penalty for failure to submit quarterly and annual reports?

(a) We will take action to impose a reporting penalty under § 262.1(a)(3) of this chapter if:

(1) A State fails to file the quarterly TANF Data Report, the quarterly TANF Financial Report (or, as applicable, the Territorial Financial Report), or the quarterly SSP-MOE Data Report (if applicable) within 45 days of the end of the quarter;

(2) The disaggregated data in the TANF Data Report or the SSP-MOE Data Report are not accurate or a report does not include all the data required by section 411(a) of the Act (other than section 411(a)(1)(A)(xii) of the Act) or the nine additional elements necessary to carry out the data collection system requirements, including the social security number;

(3) The aggregated data elements in the TANF Data Report or the SSP-MOE Data Report required by section 411(a) of the Act are not accurate and the report does not include the data elements necessary to carry out the data collection system requirements and to verify and validate the disaggregated data;

(4) The TANF Financial Report (or, as applicable, the Territorial Financial Report) does not contain complete and accurate information on total expenditures and expenditures on administrative costs and transitional services; or

(5) The annual report under § 265.9 does not contain the description of transitional services provided by a State to families no longer receiving assistance due to employment.

(b) If we determine that a State meets one or more of the conditions set forth in paragraph (a) of this section, we will notify the State that we intend to reduce the SFAG payable for the immediately succeeding fiscal year.

(c) We will not impose the penalty at § 262.1(a)(3) of this chapter if the State files the complete and accurate quarterly report or the annual report before the end of the fiscal quarter that immediately succeeds the fiscal quarter for which the reports were required.

(d) If the State does not file all reports as provided under paragraph (a) of this section by the end of the immediately succeeding fiscal quarter, the penalty provisions of §§ 262.4 through 262.6 of this chapter will apply.

(e) Subject to paragraphs (a) through (c) of this section and §§ 262.4 through 262.6 of this chapter, for each quarter for which a State fails to meet the reporting requirements, we will reduce the SFAG payable by an amount equal to four percent of the adjusted SFAG (or a lesser amount if the State achieves substantial compliance under a corrective compliance plan).

[71 FR 37483, June 29, 2006]

§ 265.9 What information must the State file annually?

(a) Each State must file an annual report containing information on the TANF program and the State's MOE program(s) for that year. The report may be filed as:

(1) An addendum to the fourth quarter TANF Data Report; or

(2) A separate annual report.

(b) Each State must provide the following information on the TANF program:

(1) The State's definition of each work activity;

(2) A description of the transitional services provided to families no longer receiving assistance due to employment;

(3) A description of how a State will reduce the amount of assistance payable to a family when an individual refuses to engage in work without good cause pursuant to § 261.14 of this chapter;

(4) The average monthly number of payments for child care services made by the State through the use of disregards, by the following types of child care providers:

(i) Licensed/regulated in-home child care;

(ii) Licensed/regulated family child care;

(iii) Licensed/regulated group home child care;

(iv) Licensed/regulated center-based child care;

(v) Legally operating (i.e., no license category available in State or locality) in-home child care provided by a nonrelative;

(vi) Legally operating (i.e., no license category available in State or locality) in-home child care provided by a relative;

(vii) Legally operating (i.e., no license category available in State or locality) family child care provided by a nonrelative;

(viii) Legally operating (i.e., no license category available in State or locality) family child care provided by a relative;