CMS-10662 Corrective Action Follow-up Letter

Form Approved: OMB # 0938-1390

Expiration 12/31/2025

Department of Health & Human Services

Centers for Medicare & Medicaid Services

7500 Security Boulevard, Mail Stop N1-19-21

Baltimore, Maryland 21244-1850

Corrective Action Follow-up Letter

Date of Notice: FULLDATE

CONTACTNAME

JOBTITLE

CENAME

ADDRESS1

ADDRESS2

CITY, ST ZIP

Re: Compliance Review Number XXXXX

Dear FIRSTNAME LASTNAME:

In a notice dated (month day, year), we informed you that the Department of Health and Human Services (HHS), National Standards Group (NSG) within the Centers for Medicare & Medicaid Services (CMS), opened a corrective action record based on violations discovered during the <Covered Entity Name> 20XX Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Affordable Care Act (ACA) compliance review. In that notice, we requested that <Covered Entity Name> provide a Corrective Action Plan (CAP) to address all violations that warrant corrective action by (month, day, year) and included a CAP template for your use. To date, we have not received a completed or acceptable CAP for <Covered Entity Name>.

<Covered Entity Name> must upload a completed or acceptable CAP to the ASETT Covered Entity Portal by (month day, year). Please refer to the CMS Identity Management (IDM) System and Compliance Review Covered Entity Portal Access Quick Start User Guide to review instructions for accessing the ASETT Covered Entity Portal.

Failure to provide this information as requested may warrant further action as described in 45 CFR Part 160.314.

If you have questions regarding this letter, please send an email to HIPAACompliance@cms.hhs.gov. Please include the compliance review number located at the top of this letter.

Sincerely,

Michael Cimmino

Director, National Standards Group

Office of Healthcare Experience and Interoperability

Centers for Medicare & Medicaid Services

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0938-1390 from the year of 2024 through 2025. The objective of the HIPAA Administrative Simplification information collection program is to conduct assessments and identify whether a covered entity is compliant with the HIPAA - adopted standards, and administrative simplification. The time required to complete this information collection is estimated to average less than 10 hours per response (4 forms x 60 minutes/form), including the time to review instructions, search existing data resources, gather the data needed, to review and complete the information collection. This information collection is mandatory (under 45 CFR § 160.310) If you have comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850.