29 C.F.R. § 2590.716-8
(2) Definitions. Unless otherwise stated, the definitions in § 2590.716-3 of this part apply to this section. Additionally, for purposes of this section, the following definitions apply:
(ii) Breach means the acquisition, access, use, or disclosure of individually identifiable health information (IIHI) in a manner not permitted under paragraph (e)(2)(v) of this section that compromises the security or privacy of the IIHI.
(A) Breach excludes:
(1) Any unintentional acquisition, access, or use of IIHI by personnel, a contractor, or a subcontractor of a certified IDR entity that is acting under the authority of that certified IDR entity, if the acquisition, access, or use was made in good faith and within the scope of that authority and that does not result in further use or disclosure in a manner not permitted under paragraph (e)(2)(v) of this section.
(2) Any inadvertent disclosure by a person who is authorized to access IIHI at a certified IDR entity to another person authorized to access IIHI at the same certified IDR entity, and the information received as a result of the disclosure is not further used or disclosed in a manner not permitted under paragraph (e)(2)(v) of this section.
(3) A disclosure of IIHI in which a certified IDR entity has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.
(B) Except as provided in paragraph (a)(2)(ii)(A) of this section, access, use, or disclosure of IIHI in a manner not permitted under paragraph (e)(2)(v) of this section is presumed to be a breach unless the certified IDR entity demonstrates that there is a low probability that the security or privacy of the IIHI has been compromised based on a risk assessment encompassing at least the following factors:
(1) The nature and extent of the IIHI involved, including the types of identifiers and the likelihood of re-identification;
(2) The unauthorized person who used the IIHI or to whom the disclosure was made;
(3) Whether the IIHI was actually acquired or viewed; and
(4) The extent to which the risk to the IIHI has been mitigated.
(iv) Conflict of interest means, with respect to a party to a payment determination, or certified IDR entity, a material relationship, status, or condition of the party, or certified IDR entity that impacts the ability of the certified IDR entity to make an unbiased and impartial payment determination. For purposes of this section, a conflict of interest exists when a certified IDR entity is:
(vii) Individually identifiable health information (IIHI) means any information, including demographic data, that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
(xi) Qualified IDR item or service means an item or service:
(B) Manner. The open negotiation notice must be provided, using the standard form developed by the Secretary, in writing within 30 business days beginning on the day the provider, facility, or provider of air ambulance services receives an initial payment or a notice of denial of payment from the plan or issuer regarding the item or service. The day on which the open negotiation notice is first sent by a party is the date the 30-business-day open negotiation period begins. This notice may be provided to the other party electronically (such as by email) if the following two conditions are satisfied—
(1) The party sending the open negotiation notice has a good faith belief that the electronic method is readily accessible by the other party; and
(2) The notice is provided in paper form free of charge upon request.
(iii) Notice of IDR initiation—(A) Content. The notice of IDR initiation must include:
(1) Information sufficient to identify the qualified IDR items or services under dispute (and whether the qualified IDR items or services are designated as batched items and services as described in paragraph (c)(3) of this section), including the date(s) and location the item or service was furnished, the type of item or service (such as whether the qualified IDR item or service is an emergency service as defined in 26 CFR 54.9816-4T(c)(2)(i), § 2590.716-4(c)(2)(i), or 45 CFR 149.110(c)(2)(i), as applicable, an emergency service as defined in 26 CFR 54.9816-4T(c)(2)(ii), § 2590.716-4(c)(2)(ii), or 45 CFR 149.110(c)(2)(ii), as applicable, or a nonemergency service; and whether any service is a professional service or facility-based service), corresponding service codes, place of service code, the amount of cost sharing allowed, and the amount of the initial payment made for the qualified IDR item or service, if applicable;
(2) Names of the parties involved and contact information, including name, email address, phone number, and mailing address;
(3) State where the qualified IDR item or service was furnished;
(4) Commencement date of the open negotiation period under paragraph (b)(1) of this section;
(5) Preferred certified IDR entity;
(6) An attestation that the items and services under dispute are qualified IDR items or services;
(7) Qualifying payment amount;
(8) Information about the qualifying payment amount as described in § 2590.716-6(d); and
(9) General information describing the Federal IDR process as specified by the Secretary.
(B) Manner. The initiating party must provide written notice of IDR initiation to the other party. The initiating party may satisfy this requirement by furnishing the notice of IDR initiation to the other party electronically (such as by email) if the following two conditions are satisfied -
(1) The initiating party has a good faith belief that the electronic method is readily accessible by the other party; and
(2) The notice is provided in paper form free of charge upon request.
(ii) Requirements for selected certified IDR entity. The certified IDR entity selected must be an IDR entity certified under paragraph (e) of this section, that:
(iii) Notice of certified IDR entity selection. Upon the selection of a certified IDR entity, in accordance with paragraph (c)(1)(i) of this section, the plan or issuer or the provider or emergency facility that submitted the notice of IDR initiation under paragraph (b)(2) of this section must notify the Secretary of the selection as soon as reasonably practicable, but no later than 1 business day after such selection, through the Federal IDR portal. In addition, if the non-initiating party believes that the Federal IDR process is not applicable, the non-initiating party must also provide information regarding the Federal IDR process's inapplicability through the Federal IDR portal by the same date that the notice of certified IDR entity selection must be submitted.
(A) Content. If the parties have agreed on the selection of a certified IDR entity or the party in receipt of the notice of IDR initiation has not objected to the other party's selection, the notice of the certified IDR entity selection must include the following information:
(1) Name of the certified IDR entity;
(2) The certified IDR entity number; and
(3) Attestation by both parties, or by the initiating party if the non-initiating party fails to object to the selection of the certified IDR entity, that the selected certified IDR entity meets the requirements of paragraph (c)(1)(ii) of this section.
(3) Treatment of batched items and services—(i) In general. Batched items and services may be submitted and considered jointly as part of one payment determination by a certified IDR entity only if the batched items and services meet the requirements of this paragraph (c)(3)(i). Batched items and services submitted and considered jointly as part of one payment determination under this paragraph (c)(3)(i) are treated as a batched determination and subject to the fee for batched determinations under this section.
(4) Payment determination for a qualified IDR item or service—(i) Submission of offers. Not later than 10 business days after the selection of the certified IDR entity, the plan or issuer and the provider, facility, or provider of air ambulance services:
(A) Must each submit to the certified IDR entity:
(1) An offer of an out-of-network rate expressed as both a dollar amount and the corresponding percentage of the qualifying payment amount represented by that dollar amount;
(2) Information requested by the certified IDR entity relating to the offer.
(3) The following additional information, as applicable—
(i) For providers and facilities, information on the size of the provider's practice or of the facility (if applicable). Specifically, a group of providers must specify whether the providers' practice has fewer than 20 employees, 20 to 50 employees, 51 to 100 employees, 101 to 500 employees, or more than 500 employees. For facilities, the facility must specify whether the facility has 50 or fewer employees, 51 to 100 employees, 101 to 500 employees, or more than 500 employees;
(ii) For providers and facilities, information on the practice specialty or type, respectively (if applicable);
(iii) For plans and issuers, information on the coverage area of the plan or issuer, the relevant geographic region for purposes of the qualifying payment amount, whether the coverage is fully-insured or partially or fully self-insured; and
(iv) The qualifying payment amount for the applicable year for the same or similar item or service as the qualified IDR item or service.
(ii) Payment determination and notification. Not later than 30 business days after the selection of the certified IDR entity, the certified IDR entity must:
(iii) Considerations in determination. In determining which offer to select:
(B) The certified IDR entity must then consider information submitted by a party that relates to the following circumstances:
(1) The level of training, experience, and quality and outcomes measurements of the provider or facility that furnished the qualified IDR item or service (such as those endorsed by the consensus-based entity authorized in section 1890 of the Social Security Act).
(2) The market share held by the provider or facility or that of the plan or issuer in the geographic region in which the qualified IDR item or service was provided.
(3) The acuity of the participant or beneficiary receiving the qualified IDR item or service, or the complexity of furnishing the qualified IDR item or service to the participant or beneficiary.
(4) The teaching status, case mix, and scope of services of the facility that furnished the qualified IDR item or service, if applicable.
(5) Demonstration of good faith efforts (or lack thereof) made by the provider or facility or the plan or issuer to enter into network agreements with each other, and, if applicable, contracted rates between the provider or facility, as applicable, and the plan or issuer, as applicable, during the previous 4 plan years.
(iv) Examples. The rules of paragraph (c)(4)(iii) of this section are illustrated in the following paragraphs. Each example assumes that the Federal IDR process applies for purposes of determining the out-of-network rate, that both parties have submitted the information parties are required to submit as part of the Federal IDR process, and that the submitted information does not include information on factors described in paragraph (c)(4)(v) of this section:
(A) Example 1—(1) Facts. A level 1 trauma center that is a nonparticipating emergency facility and an issuer are parties to a payment determination in the Federal IDR process. The facility submits an offer that is higher than the qualifying payment amount. The facility also submits additional written information showing that the scope of services available at the facility was critical to the delivery of care for the qualified IDR item or service provided, given the particular patient's acuity. This information is determined to be credible by the certified IDR entity. Further, the facility submits additional information showing the contracted rates used to calculate the qualifying payment amount for the qualified IDR item or service were based on a level of service that is typical in cases in which the services are delivered by a facility that is not a level 1 trauma center and that does not have the capability to provide the scope of services provided by a level 1 trauma center. This information is also determined to be credible by the certified IDR entity. The issuer submits an offer equal to the qualifying payment amount. No additional information is submitted by either party. The certified IDR entity determines that all the information submitted by the nonparticipating emergency facility relates to the offer for the payment amount for the qualified IDR item or service that is the subject of the payment determination.
(2) Conclusion. In this paragraph (c)(4)(iv)(A) (Example 1), the certified IDR entity must consider the qualifying payment amount. The certified IDR entity then must consider the additional information submitted by the nonparticipating emergency facility, provided the information relates to circumstances described in paragraphs (c)(4)(iii)(B) through (D) of this section and relates to the offer for the payment amount for the qualified IDR item or service that is the subject of the payment determination. If the certified IDR entity determines that it is appropriate to give weight to the additional credible information submitted by the nonparticipating emergency facility and that the additional credible information submitted by the facility demonstrates that the facility's offer best represents the value of the qualified IDR item or service, the certified IDR entity should select the facility's offer.
(B) Example 2—(1) Facts. A nonparticipating provider and an issuer are parties to a payment determination in the Federal IDR process. The provider submits an offer that is higher than the qualifying payment amount. The provider also submits additional written information regarding the level of training and experience the provider possesses. This information is determined to be credible by the certified IDR entity, but the certified IDR entity finds that the information does not demonstrate that the provider's level of training and experience relates to the offer for the payment amount for the qualified IDR item or service that is the subject of the payment determination (for example, the information does not show that the provider's level of training and experience was necessary for providing the qualified IDR service that is the subject of the payment determination to the particular patient, or that the training or experience made an impact on the care that was provided). The nonparticipating provider does not submit any additional information. The issuer submits an offer equal to the qualifying payment amount, with no additional information.
(2) Conclusion. In this paragraph (c)(4)(iv)(B) (Example 2), the certified IDR entity must consider the qualifying payment amount. The certified IDR entity must then consider the additional information submitted by the nonparticipating provider, provided the information relates to circumstances described in paragraphs (c)(4)(iii)(B) through (D) of this section and relates to the offer for the payment amount for the qualified IDR item or service that is the subject of the payment determination. In addition, the certified IDR entity should not give weight to information to the extent it is already accounted for by the qualifying payment amount or other credible information under paragraphs (c)(4)(iii)(B) through (D) of this section. If the certified IDR entity determines that the additional information submitted by the provider is credible but does not relate to the offer for the payment amount for the qualified IDR service that is the subject of the payment determination, and determines that the issuer's offer best represents the value of the qualified IDR service, in the absence of any other credible information that relates to either party's offer, the certified IDR entity should select the issuer's offer.
(C) Example 3—(1) Facts. A nonparticipating provider and an issuer are parties to a payment determination in the Federal IDR process involving an emergency department visit for the evaluation and management of a patient. The provider submits an offer that is higher than the qualifying payment amount. The provider also submits additional written information showing that the acuity of the patient's condition and complexity of the qualified IDR service furnished required the taking of a comprehensive history, a comprehensive examination, and medical decision making of high complexity. This information is determined to be credible by the certified IDR entity. The issuer submits an offer equal to the qualifying payment amount for CPT code 99285, which is the CPT code for an emergency department visit for the evaluation and management of a patient requiring a comprehensive history, a comprehensive examination, and medical decision making of high complexity. The issuer also submits additional written information showing that this CPT code accounts for the acuity of the patient's condition. This information is determined to be credible by the certified IDR entity. The certified IDR entity determines that the information provided by the provider and issuer relates to the offer for the payment amount for the qualified IDR service that is the subject of the payment determination. Neither party submits any additional information.
(2) Conclusion. In this paragraph (c)(4)(iv)(C) (Example 3), the certified IDR entity must consider the qualifying payment amount. The certified IDR entity then must consider the additional information submitted by the parties, but the certified IDR entity should not give weight to information to the extent it is already accounted for by the qualifying payment amount or other credible information under paragraphs (c)(4)(iii)(B) through (D) of this section. If the certified IDR entity determines the additional information on the acuity of the patient and complexity of the service is already accounted for in the calculation of the qualifying payment amount, the certified IDR entity should not give weight to the additional information provided by the provider. If the certified IDR entity determines that the issuer's offer best represents the value of the qualified IDR service, the certified IDR entity should select the issuer's offer.
(D) Example 4—(1) Facts. A nonparticipating emergency facility and an issuer are parties to a payment determination in the Federal IDR process. Although the facility is not participating in the issuer's network during the relevant plan year, it was a participating facility in the issuer's network in the previous 4 plan years. The issuer submits an offer that is higher than the qualifying payment amount and that is equal to the facility's contracted rate (adjusted for inflation) for the previous year with the issuer for the qualified IDR service. The issuer also submits additional written information showing that the contracted rates between the facility and the issuer during the previous 4 plan years were higher than the qualifying payment amount submitted by the issuer, and that these prior contracted rates account for the case mix and scope of services typically furnished at the nonparticipating facility. The certified IDR entity determines this information is credible and that it relates to the offer submitted by the issuer for the payment amount for the qualified IDR service that is the subject of the payment determination. The facility submits an offer that is higher than both the qualifying payment amount and the contracted rate (adjusted for inflation) for the previous year with the issuer for the qualified IDR service. The facility also submits additional written information, with the intent to show that the case mix and scope of services available at the facility were integral to the service provided. The certified IDR entity determines this information is credible and that it relates to the offer submitted by the facility for the payment amount for the qualified IDR service that is the subject of the payment determination. Neither party submits any additional information.
(2) Conclusion. In this paragraph (c)(4)(iv)(D) (Example 4), the certified IDR entity must consider the qualifying payment amount. The certified IDR entity then must consider the additional information submitted by the parties, but should not give weight to information to the extent it is already accounted for by the qualifying payment amount or other credible information under paragraphs (c)(4)(iii)(B) through (D) of this section. If the certified IDR entity determines that the information submitted by the facility regarding the case mix and scope of services available at the facility includes information that is also accounted for in the information the issuer submitted regarding prior contracted rates, then the certified IDR entity should give weight to that information only once. The certified IDR entity also should not give weight to the same information provided by the nonparticipating emergency facility in relation to any other factor. If the certified IDR entity determines that the issuer's offer best represents the value of the qualified IDR service, the certified IDR entity should select the issuer's offer.
(E) Example 5—(1) Facts. A nonparticipating provider and an issuer are parties to a payment determination in the Federal IDR process regarding a qualified IDR service for which the issuer downcoded the service code that the provider billed. The issuer submits an offer equal to the qualifying payment amount (which was calculated using the downcoded service code). The issuer also submits additional written information that includes the documentation disclosed to the nonparticipating provider under § 2590.716-6(d)(1)(ii) at the time of the initial payment (which describes why the service code was downcoded). The certified IDR entity determines this information is credible and that it relates to the offer for the payment amount for the qualified IDR service that is the subject of the payment determination. The provider submits an offer equal to the amount that would have been the qualifying payment amount had the service code not been downcoded. The provider also submits additional written information that includes the documentation disclosed to the nonparticipating provider under § 2590.716-6(d)(1)(ii) at the time of the initial payment. Further, the provider submits additional written information that explains why the billed service code was more appropriate than the downcoded service code, as evidence that the provider's offer, which is equal to the amount the qualifying payment amount would have been for the service code that the provider billed, best represents the value of the service furnished, given its complexity. The certified IDR entity determines this information to be credible and that it relates to the offer for the payment amount for the qualified IDR service that is the subject of the payment determination. Neither party submits any additional information.
(2) Conclusion. In this paragraph (c)(4)(iv)(E) (Example 5), the certified IDR entity must consider the qualifying payment amount, which is based on the downcoded service code. The certified IDR entity then must consider whether to give weight to additional information submitted by the parties. If the certified IDR entity determines that the additional credible information submitted by the provider demonstrates that the nonparticipating provider's offer, which is equal to the qualifying payment amount for the service code that the provider billed, best represents the value of the qualified IDR service, the certified IDR entity should select the nonparticipating provider's offer.
(v) Prohibition on consideration of certain factors. In determining which offer to select, the certified IDR entity must not consider:
(vi) Written decision.
(vii) Effects of determination—(A) Binding. A determination made by a certified IDR entity under paragraph (c)(4)(ii) of this section:
(1) Is binding upon the parties, in the absence of fraud or evidence of intentional misrepresentation of material facts presented to the certified IDR entity regarding the claim; and
(2) Is not subject to judicial review, except in a case described in any of paragraphs (1) through (4) of section 10(a) of title 9, United States Code.
(2) Administrative fee.
(3) Severability.
(e) Certification of IDR entity—(1) In general. In order to be selected under paragraph (c)(1) of this section—
(2) Requirements. An IDR entity must provide written documentation to the Secretary through the Federal IDR portal that demonstrates that the IDR entity satisfies the following standards to be a certified IDR entity under this paragraph (e):
(v) Have a process to maintain the confidentiality of IIHI obtained in the course of conducting determinations. A certified IDR entity's responsibility to comply with these confidentiality requirements shall survive revocation of the IDR entity's certification for any reason, and IDR entities must comply with the record retention and disposal requirements described in this section. Under this process, once certified, the certified IDR entity must comply with the following requirements:
(A) Privacy. The certified IDR entity may create, collect, handle, disclose, transmit, access, maintain, store, and/or use IIHI, only to perform:
(1) The certified IDR entity's required duties described in this section; and
(2) Functions related to carrying out additional obligations as may be required under applicable Federal or State laws or regulations.
(B) Security. (1) The certified IDR entity must ensure the confidentiality of all IIHI it creates, obtains, maintains, stores, and transmits;
(2) The certified IDR entity must protect against any reasonably anticipated threats or hazards to the security of this information;
(3) The certified IDR entity must ensure that IIHI is securely destroyed or disposed of in an appropriate and reasonable manner 6 years from either the date of its creation or the first date on which the certified IDR entity had access to it, whichever is earlier;
(4) The certified IDR entity must implement policies and procedures to prevent, detect, contain, and correct security violations in the event of a breach of IIHI;
(C) Breach notification. The certified IDR entity must, following the discovery of a breach of unsecured IIHI, notify of the breach the provider, facility, or provider of air ambulance services; the plan and issuer; the Secretary, jointly with the Secretary of the Treasury and the Secretary of Health and Human Services; and each individual whose unsecured IIHI has been, or is reasonably believed to have been, subject to the breach, to the extent possible.
(1) Breaches treated as discovered. For purposes of this paragraph (e)(2)(v)(C), a breach shall be treated as discovered by a certified IDR entity as of the first day on which the breach is known to the certified IDR entity or, by exercising reasonable diligence, would have been known to the certified IDR entity. A certified IDR entity shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of the certified IDR entity;
(2) Timing of notification. A certified IDR entity must provide the notification required by this paragraph (e)(2)(v)(C) without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
(3) Content of notification. The notification required by this paragraph (e)(2)(v)(C) must include, to the extent possible:
(i) The identification of each individual whose unsecured IIHI has been, or is reasonably believed by the certified IDR entity to have been, subject to the breach;
(ii) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, to the extent known;
(iii) A description of the types of unsecured IIHI that were involved in the breach (for example whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
(iv) A brief description of what the certified IDR entity involved is doing to investigate the breach, to mitigate harm to the affected parties, and to protect against any further breaches; and
(v) Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free telephone number, email address, website, or postal address.
(4) Method for providing notification. A certified IDR entity must submit the notification required by this paragraph (e)(2)(v)(C) in written form (in clear and understandable language) either on paper or electronically through the Federal IDR portal or electronic mail.
(vii) Provide, no more frequently than once per calendar year, a fixed fee for single determinations and a separate fixed fee for batched determinations, as well as an additional fixed tiered fee for batched determinations, if applicable, within the upper and lower limits for each, as established by the Secretary in notice and comment rulemaking. The certified IDR entity fee ranges established by the Secretary in rulemaking will remain in effect until changed by notice and comment rulemaking. The certified IDR entity may not charge a fee outside the limits set forth in rulemaking unless the certified IDR entity or IDR entity seeking certification receives advance written approval from the Secretary to charge a fixed fee beyond the upper or lower limits by following the process described in paragraph (e)(2)(vii)(A) of this section. A certified IDR entity may also seek advance written approval from the Secretary to update its fees one additional time per calendar year by meeting the requirements described in paragraph (e)(2)(vii)(A). The Secretary will approve a request to charge a fixed fee beyond the upper or lower limits for fees as set forth in rulemaking, or to update the fixed fee during the calendar year if, in their discretion, they determine the information submitted by a certified IDR entity or IDR entity seeking certification demonstrates that the proposed change to the certified IDR entity fee would ensure the financial viability of the certified IDR entity or IDR entity seeking certification and would not impose on parties an undue barrier to accessing the Federal IDR process.
(A) In order for the certified IDR entity or IDR entity seeking certification to receive the Secretary's written approval to charge a fixed fee beyond the upper or lower limits for fees as set forth in rulemaking or to update the fixed fee during the calendar year, the certified IDR entity or IDR entity seeking certification must submit to the Secretary, in the form and manner specified by the Secretary:
(1) The fixed fee the certified IDR entity or IDR entity seeking certification believes is appropriate for the certified IDR entity or IDR entity seeking certification to charge;
(2) A description of the circumstances that require the alternative fixed fee, or that require a change to the fixed fee during the calendar year, as applicable; and
(3) A detailed description that reasonably explains how the alternative fixed fee or the change to the fixed fee during the calendar year, as applicable, will be used to mitigate the effects of those circumstances.
(3) Conflict-of-interest standards. In addition to the general standards set forth in paragraph (e)(2)(iv) of this section, an IDR entity must provide written documentation that the IDR entity satisfies the standards to be a certified IDR entity under this paragraph (e)(3).
(ii) Content of petition. The individual, provider, facility, provider of air ambulance services, plan, or issuer seeking denial or revocation of certification must submit a written petition using the standard form issued by the Secretary including the following information:
(iii) Process.
(6) Denial of IDR entity certification or revocation of certified IDR entity certification—(i) Denial of IDR entity certification. The Secretary, jointly with the Secretary of the Treasury and the Secretary of Health and Human Services, may deny the certification of an IDR entity under paragraph (e)(1) of this section if, during the process of certification, including as a result of a petition described in paragraph (e)(5) of this section, the Secretary determines the following:
(ii) Revocation of certification of a certified IDR entity. The Secretary, jointly with the Secretary of the Treasury and the Secretary of Health and Human Services, may revoke the certification of a certified IDR entity under paragraph (e)(1) of this section if, as a result of an audit, a petition described in paragraph (e)(5) of this section, or otherwise, the Secretary determines the following:
(f) Reporting of information relating to the Federal IDR process—(1) Reporting of information. Within 30 business days of the close of each month, for qualified IDR items and services furnished on or after January 1, 2022, each certified IDR entity must, in a form and manner specified by the Secretary, report:
(v) With respect to each notice of IDR initiation under paragraph (b)(2) of this section for which such a determination was made, the following information:
(g) Extension of time periods for extenuating circumstances—(1) General. The time periods specified in this section (other than the time for payment, if applicable, under paragraph (c)(4)(ix) of this section) may be extended in extenuating circumstances at the Secretary's discretion if:
[86 FR 56112, Oct. 7, 2021, as amended at 87 FR 52649, Aug. 26, 2022; 88 FR 88524, Dec. 21, 2023]