The OIG may impose a penalty against any person (including an insurance company) who it determines—

(a) Fails to report information concerning—

(1) A payment made under an insurance policy, self-insurance, or otherwise for the benefit of a physician, dentist, or other health care practitioner in settlement of, or in satisfaction in whole or in part of, a medical malpractice claim or action or a judgment against such a physician, dentist, or other practitioner in accordance with section 421 of Public Law 99-660 (42 U.S.C. 11131) and as required by regulations at 45 CFR part 60 or

(2) An adverse action required to be reported under section 1128E, as established by section 221 of Public Law 104-191.

(b) Improperly discloses, uses, or permits access to information reported in accordance with Part B of Title IV of Public Law 99-660 (42 U.S.C. 11137) or regulations at 45 CFR part 60. (The disclosure of information reported in accordance with Part B of Title IV in response to a subpoena or a discovery request is considered an improper disclosure in violation of section 427 of Public Law 99-660. However, disclosure or release by an entity of original documents or underlying records from which the reported information is obtained or derived is not considered an improper disclosure in violation of section 427 of Public Law 99-660.)

The OIG may impose a penalty of not more than—

(a) $11,000 for each payment for which there was a failure to report required information in accordance with § 1003.800(a)(1) or for each improper disclosure, use, or access to information in accordance with a determination under § 1003.800(b); and

(b) $25,000 against a health plan for each failure to report information on an adverse action required to be reported in accordance with section 1128E of the Act and § 1003.800(a)(2).

In determining the amount of any penalty in accordance with this subpart, the OIG will consider the factors listed in § 1003.140.