§ 155.285 Bases and process for imposing civil penalties for provision of false or fraudulent information to an Exchange or improper use or disclosure of information.

(a) Grounds for imposing civil money penalties. (1) HHS may impose civil money penalties on any person, as defined in paragraph (a)(2) of this section, if, based on credible evidence, HHS reasonably determines that a person has engaged in one or more of the following actions:

(i) Failure to provide correct information under section 1411(b) of the Affordable Care Act where such failure is attributable to negligence or disregard of any rules or regulations of the Secretary with negligence and disregard defined as they are in section 6662 of the Internal Revenue Code of 1986:

(A) “Negligence” includes any failure to make a reasonable attempt to provide accurate, complete, and comprehensive information; and

(B) “Disregard” includes any careless, reckless, or intentional disregard for any rules or regulations of the Secretary.

(ii) Knowing and willful provision of false or fraudulent information required under section 1411(b) of the Affordable Care Act, where knowing and willful means the intentional provision of information that the person knows to be false or fraudulent; or

(iii) Knowing and willful use or disclosure of information in violation of section 1411(g) of the Affordable Care Act, where knowing and willful means the intentional use or disclosure of information in violation of section 1411(g). Such violations would include, but not be limited to, the following:

(A) Any use or disclosure performed which violates relevant privacy and security standards established by the Exchange pursuant to § 155.260;

(B) Any other use or disclosure which has not been determined by the Secretary to be in compliance with section 1411(g)(2)(A) of the Affordable Care Act pursuant to § 155.260(a); and

(C) Any other use or disclosure which is not necessary to carry out a function described in a contract with a non-Exchange entity executed pursuant to § 155.260(b)(2).

(2) For purposes of this section, the term “person” is defined to include, but is not limited to, all individuals; corporations; Exchanges; Medicaid and CHIP agencies; other entities gaining access to personally identifiable information submitted to an Exchange to carry out additional functions which the Secretary has determined ensure the efficient operation of the Exchange pursuant to § 155.260(a)(1); and non-Exchange entities as defined in § 155.260(b) which includes agents, brokers, Web-brokers, QHP issuers, Navigators, non-Navigator assistance personnel, certified application counselors, in-person assistors, and other third party contractors.