the text of Section 8 of the NAIC Model.

(vi) Premiums charged (in terms of dollars and in percentage of standard risk rate) and other cost-sharing mechanisms, such as co-pays and deductibles, imposed on enrollees (both eligible individuals (as defined in § 148.103) and non-eligible individuals if a distinction is made).

(vii) How the standard risk rate for the State is calculated and when it was last calculated.

(viii) Revenue sources for the qualified high risk pool, including current funding mechanisms and, if different, future funding mechanisms. Provide current projections of future income.

(ix) Copies of all governing authorities of the pool, including statutes, regulations and plan of operation.

(2) Accounting of risk pool losses. Provide a detailed accounting of claims paid, administrative expenses, and premiums collected for the fiscal year for which the grant is being requested. Indicate the timing of the fiscal year upon which the accounting is based. Provide the methodology of projecting losses and expenses, and include current projections of future operating losses (this information is needed to judge compliance with the requirements in § 148.310(d)).

(3) Contact person. Identify the name, position title, address, e-mail address, and telephone number of the person to contact for further information and questions.

(b) Standard form application kit―(1) Forms. (1) The following standard forms must be completed with an original signature and enclosed as part of the application package:

SF-424 Application for Federal Assistance SF-424A Budget Information

(c) Submission of application package. (1) Applicants are required to submit an original and two copies of the application. Submissions by facsimile (fax) transmissions will not be accepted.

(2) Applications mailed through the U.S. Postal Service or a commercial delivery service will be considered "on time" if received by the close of business on the closing date, or postmarked (first class mail) by the date specified in the paragraph (d) of this section. If express, certified, or registered mail is used, the applicant should obtain a legible dated mailing receipt from the U.S. Postal Service. Private metered postmarks are not acceptable as proof of timely mailings.

(d) Application deadlines-(1) Deadline for States to submit an application for losses incurred in their fiscal year 2002. States must submit an application to us by no later than September 30, 2003.

(2) Deadline for States to submit an application for losses incurred in their fiscal year 2003. States must submit an application to us by no later than June 30, 2004.

(3) Deadline for States to submit an application for losses incurred in their fiscal year 2004. States must submit an application to us by no later than June 30, 2005.

(e) Where to submit an application. All initial applications and supplemental applications must be submitted to:

Centers for Medicare & Medicaid Services, Acquisition and Grants Group. Mail Stop C2-21-15, 7500 Security Boulevard, Baltimore, MD 21244-1850, Attn: Nicole Nichol

son.

[68 FR 23414, May 2, 2003, as amended at 69 FR 15701, Mar. 26, 2004]

§ 148.318 Grant application review.

(a) Executive Order 12372. This grant program is not listed by the Secretary under §100.3 of this title, and therefore the grant program is not subject to review by States under part 100 of this title, which implements Executive Order 12372, "Intergovernmental Review of Federal Programs" (see part 100 of this title).

(b) Review team. A team consisting of staff from CMS and the Department of Health and Human Services will review all applications. The team will meet as

necessary on an ongoing basis as applications are received.

(c) Eligibility criteria. To be eligible for a grant, a State must submit sufficient documentation that its high risk pool meets the eligibility requirements described in §148.310. A State must include sufficient documentation of the losses incurred in the operation of the qualified high risk pool in the period for when it is applying.

(d) Review criteria. If the review team determines that a State meets the eligibility requirements described in § 148.310, the review team will use the following additional criteria in reviewing the applications:

(1) Documentation of expenses incurred during operation of the qualified high risk pool. The losses and expenses incurred in the operation of a State's pool are sufficiently documented.

(2) Funding mechanism. The State has outlined funding sources, such as assessments and State general revenues, which can cover the projected costs and are reasonably designed to ensure continued funding of losses a State incurs in connection with the operation of the qualified high risk pool after fiscal year 2004.

$148.320 Grant awards.

(a) Notification and award letter. (1) Each State applicant will be notified in writing of CMS's decision on its application.

(2) If the State applicant is awarded a grant, the award letter will contain the following terms and conditions:

(i) All funds awarded to the grantee under this program must be used exclusively for the operation of a qualified high risk pool that meets the eligibility requirements for this program.

(ii) The grantee must keep sufficient records of the grant expenditures for audit purposes (see part 92 of this title).

(iii) The grantee may be required to submit quarterly progress and financial reports under part 92 of this title. (b) Grantees letter of acceptance. Grantees must submit a letter of acceptance to CMS' Acquisition and Grants Group within 30 days of the date of the award agreeing to the terms and conditions of the award letter.

Subpart A-General Provisions

§ 150.101 Basis and scope.

(a) Basis. CMS's enforcement authority under sections 2722 and 2761 of the PHS Act and its rulemaking authority under section 2792 of the PHS Act provide the basis for issuing regulations under this part 150.

(b) Scope-(1) Enforcement with respect to group heath plans. The provisions of title XXVII of the PHS Act that apply to group health plans that are non-Federal governmental plans are enforced by CMS using the procedures described in § 150.301 et seq.

The definitions that appear in part 144 of this subchapter apply to this part 150, unless stated otherwise. As used in this part:

Amendment, endorsement, or rider means a document that modifies or changes the terms or benefits of an individual policy, group policy, or certificate of insurance.

Application means a signed statement of facts by a potential insured that an issuer uses as a basis for its decision whether, and on what basis to insure an individual, or to issue a certificate of insurance, or that a non-Federal governmental health plan uses as a basis for a decision whether to enroll an individual under the plan.

Certificate of insurance means the document issued to a person or entity covered under an insurance policy issued to a group health plan or an association or trust that summarizes the benefits and principal provisions of the policy.

Complaint means any expression. written or oral, indicating a potential denial of any right or protection contained in HIPAA requirements (whether ultimately justified or not) by an individual, a personal representative or other entity acting on behalf of an individual, or any entity that believes such a right is being or has been denied an individual.

Group health insurance policy or group policy means the legal document or contract issued by an issuer to a plan sponsor with respect to a group health plan (including a plan that is a non

Federal governmental plan) that contains the conditions and terms of the insurance that covers the group.

HIPAA requirements means the requirements of title XXVII of the PHS Act and its implementing regulations in parts 146 and 148 of this subchapter.

Individual health insurance policy or individual policy means the legal document or contract issued by the issuer to an individual that contains the conditions and terms of the insurance. Any association or trust arrangement that is not a group health plan as defined in §144.103 of this subchapter or does not provide coverage in connection with one or more group health plans is individual coverage subject to the requirements of part 148 of this subchapter. The term "individual health insurance policy" includes a policy that is

(1) Issued to an association that makes coverage available to individuals other than in connection with one or more group health plans; or

(2) Administered, or placed in a trust, and is not sold in connection with a group health plan subject to the provisions of part 146 of this subchapter.

Plan document means the legal document that provides the terms of the plan to individuals covered under a group health plan, such as a non-Federal governmental health plan.

State law means all laws, decisions, rules, regulations, or other State action having the effect of law, of any State as defined in §144.103 of this subchapter. A law of the United States applicable to the District of Columbia is treated as a State law rather than a law of the United States.

CMS enforces HIPAA requirements to the extent warranted (as determined by CMS) in any of the following circumstances:

(a) Notification by State. A State notifies CMS that it has not enacted legislation to enforce or that it is not otherwise enforcing HIPAA requirements.

(b) Determination by CMS. If CMS receives or obtains information that a State may not be substantially enforcing HIPAA requirements, it may initiate the process described in this subchapter to determine whether the State is failing to substantially enforce these requirements.

(c) Special rule for guaranteed availability in the individual market. If a State has notified CMS that it is implementing an acceptable alternative mechanism in accordance with §148.128 of this subchapter instead of complying with the guaranteed availability requirements of §148.120, CMS's determination focuses on the following:

(1) Whether the State's mechanism meets the requirements for an acceptable alternative mechanism.

(2) Whether the State is implementing the acceptable alternative mechanism.

(d) Consequence of a State not implementing an alternative mechanism. If a State is not implementing an acceptable alternative mechanism, CMS determines whether the State is substantially enforcing the requirements of §§ 148.101 through 148.126 and §148.170 of this subchapter.

§ 150.205 Sources of information triggering an investigation of State enforcement.

Information that may trigger an investigation of State enforcement includes, but is not limited to, any of the following:

(a) A complaint received by CMS.

(b) Information learned during informal contact between CMS and State officials.

(c) A report in the news media.

(d) Information from the governors and commissioners of insurance of the various States regarding the status of their enforcement of HIPAA requirements.

(e) Information obtained during periodic review of State health care legislation. CMS may review State health care and insurance legislation and regulations to determine whether they

are:

(1) Consistent with HIPAA requirements.

(2) Not pre-empted as provided in § 146.143 (relating to group market provisions) and §148.120 (relating to individual market requirements) on the basis that they prevent the application of a HIPAA requirement.

(f) Any other information that indicates a possible failure to substantially enforce.

§ 150.207 Procedure for determining that a State fails to substantially enforce HIPAA requirements.

Sections 150.209 through 150.219 describe the procedures CMS follows to determine whether a State is substantially enforcing HIPAA requirements.

§ 150.209 Verification of exhaustion of remedies and contact with State officials.

If CMS receives a complaint or other information indicating that a State is failing to enforce HIPAA requirements, CMS assesses whether the affected individual or entity has made reasonable efforts to exhaust available State remedies. As part of its assessment, CMS may contact State officials regarding the questions raised.

§ 150.211 Notice to the State.

If CMS is satisfied that there is a reasonable question whether there has been a failure to substantially enforce HIPAA requirements, CMS sends, in writing, the notice described in §150.213 of this part, to the following State officials:

(a) The governor or chief executive officer of the State.

(b) The insurance commissioner or chief insurance regulatory official.

(c) If the alleged failure involves HMOS, the official responsible for regulating HMOs if different from the official listed in paragraph (b) of this section.

§ 150.213 Form and content of notice.

The notice provided to the State is in writing and does the following:

(a) Identifies the HIPAA requirement or requirements that have allegedly not been substantially enforced.

(b) Describes the factual basis for the allegation of a failure or failures to enforce HIPAA requirements.

(c) Explains that the consequence of a State's failure to substantially enforce HIPAA requirements is that CMS enforces them.

(d) Advises the State that it has 30 days from the date of the notice to respond, unless the time for response is extended as described in § 150.215 of this subpart. The State's response should include any information that the State wishes CMS to consider in making the preliminary determination described in § 150.217.

§ 150.215 Extension for good cause.

CMS may extend, for good cause, the time the State has for responding to the notice described in §150.213 of this subpart. Examples of good cause include an agreement between CMS and the State that there should be a public hearing on the State's enforcement, or evidence that the State is undertaking expedited enforcement activities.

§ 150.217 Preliminary determination.

If, at the end of the 30-day period (and any extension), the State has not established to CMS's satisfaction that it is substantially enforcing the HIPAA requirements described in the notice. CMS takes the following actions:

(a) Consults with the appropriate State officials identified in §150.211 (or their designees).

(b) Notifies the State of CMS's preliminary determination that the State has failed to substantially enforce the requirements and that the failure is continuing.

(c) Permits the State a reasonable opportunity to show evidence of substantial enforcement.

$150.219 Final determination.

If, after providing notice and a reasonable opportunity for the State to show that it has corrected any failure to substantially enforce, CMS finds