150.343—Notice of proposed penalty.
If CMS proposes to assess a penalty in accordance with this part, it delivers to the responsible entity, or sends to that entity by certified mail, return receipt requested, written notice of its intent to assess a penalty. The notice includes the following:
(a)
A description of the HIPAA requirements that CMS has determined that the responsible entity violated.
(b)
A description of any complaint or other information upon which CMS based its determination, including the basis for determining the number of affected individuals and the number of days for which the violations occurred.
(d)
Any circumstances described in §§ 150.317 through 150.323 that were considered when determining the amount of the proposed penalty.
(f)
A statement that failure to request a hearing within 30 days permits the assessment of the proposed penalty without right of appeal in accordance with § 150.347.