N.Y. Comp. Codes R. & Regs. tit. 1, § 400.6 – Penalties.

(a) Notice of preliminary determination of non-compliance. Whenever it is determined that a covered provider may not be in compliance with the requirements of section 400.2 or 400.3 of this Part and has not obtained a waiver, the provider shall be notified in writing of the basis for that determination. Such notice shall provide the covered provider with an opportunity and a procedure to submit additional or clarifying information within 30 calendar days of the provider’s receipt of such notice to demonstrate compliance with this Part. Failure to submit additional or clarifying information within the required time period shall result in the determination of non-compliance becoming final.
(b) Corrective action period. If the determination of non-compliance becomes final as set forth in subdivision (a) of this section or if the department or its designee determines, after reviewing and considering any information submitted by the covered provider, that such provider is not in compliance with the requirements of section 400.2 or 400.3 of this Part, the provider shall receive notice of such determination and a notice to cure. Such notice shall allow the covered provider a period of not less than six months to correct the violation(s) identified (the corrective action period) prior to additional enforcement action or penalties being imposed, and shall require that the covered provider submit within 30 calendar days a corrective action plan (CAP) for approval by the department or its designee.
(c) Corrective action plan. Within 30 calendar days of receipt of the covered provider’s CAP, the department or its designee shall either approve such CAP or request clarification or alterations. The covered provider shall make such alterations to the CAP as may be reasonably required by the department or its designee. Once the CAP has been approved and the covered provider notified, and unless otherwise provided in the approved CAP, the covered provider shall have six months to complete the CAP and comply with this Part.
(d) Failure to cure. At the conclusion of the period for implementation of an approved CAP, the department or its designee may request information from the covered provider to determine whether the CAP has been fully and properly completed. If it has been so completed, the matter shall be considered closed and no further action on the part of the department or the provider shall be required. If the department or its designee determines that the CAP has not been fully and properly implemented within the designated corrective action period, the department or its designee shall provide written notice to the provider and may take one or more of the following actions, taking into account the seriousness of the violations, the nature of the provider’s services, and the provider’s efforts to correct the violations, if any:
1. (1) At its sole discretion, modify the CAP and/or extend the time for the provider to complete implementation.
2. (2) Issue a final determination of non-compliance, together with a notice of the sanctions which the department seeks to impose. Such sanctions may include:
  1. (i) redirection of State funds or State-authorized payments to be used to provide program services, where possible and consistent with Federal and State laws;
  2. (ii) suspension, modification, limitation, or revocation of the provider’s license(s) to operate program(s) for the delivery of program services;
  3. (iii) suspension, modification or termination of contracts or other agreements with the covered provider; and
  4. (iv) any other lawful actions or penalties deemed appropriate by the department or its designee.
(e) Opportunity for appeal. Within 30 calendar days of receipt of a final determination of noncompliance and notice of proposed sanctions, a covered provider may request an administrative appeal by submitting a written request to the name and address set forth in the notice. The request must include a detailed explanation of the legal and factual bases for the provider’s challenge to the determination and all documentation in support of the provider’s position. If a request for an administrative appeal is not made within the required 30 calendar days, the determination of noncompliance shall become final and the proposed sanction shall be imposed. Unless the department seeks to impose a sanction for which an administrative hearing is otherwise required by statute or regulation, the covered provider’s appeal shall be limited to an administrative review of the record. Following the review, the covered provider shall be provided with a final written determination setting forth the findings of fact and conclusions of law that support the determination. If the provider is found to be non-compliant, the proposed sanction may be imposed forthwith.