A letter from the U.S. Department of Health and Human Services is a formal notice that almost always requires you to do something specific by a deadline printed on the page. HHS is not one office. It runs Medicare and Medicaid, enforces HIPAA, oversees Marketplace subsidies, investigates healthcare fraud, and handles refugee resettlement, among other programs. So the first job when an HHS letter lands in your mailbox is figuring out which sub-agency sent it, because that determines what’s at stake, how long you have, and what you need to send back.
Figure Out Which Agency Sent It
Check three places on the page: the letterhead or logo at the top, the return address, and the signature block at the bottom. Those tell you whether the sender is the Centers for Medicare & Medicaid Services (CMS), the Office for Civil Rights (OCR), the Office of Inspector General (OIG), the Food and Drug Administration, the Administration for Children and Families, or another division.
Getting this right matters because the legal framework, the deadline, and the consequences are completely different from one office to the next. An OCR letter about a HIPAA complaint has nothing in common with a CMS letter about your Marketplace coverage or an OIG letter proposing to exclude a provider from federal healthcare programs. If you still can’t tell after checking those three spots, use the phone number and mailing address on the notice to reach the right office.
Is the Letter Real
Scammers impersonate HHS and OIG officials routinely, by mail, phone, email, and social media. The OIG warns that fraudsters often claim you owe a debt, need to verify medical claims, or are eligible for government grant money, all as pretexts to pull out personal information or payment.1Office of Inspector General. Consumer Alerts Red flags include requests for your Social Security or bank account number, instructions to send a check or wire transfer to cover a “processing fee,” and callers who read off a name and fake employee ID before asking for personal details.2Office of Inspector General. Alert: Fraudsters Impersonate Government Officials
A real HHS letter references a specific case number, program, or regulatory matter. It will not demand immediate payment by gift card or wire transfer. If a letter looks suspicious, don’t dial the number printed on it. Look up the agency’s official contact information independently. For certain letters from the Office of Refugee Resettlement, HHS offers an online tool where you can enter the tracking number to confirm the letter is genuine. To report suspected fraud, call the HHS OIG Hotline at 1-800-HHS-TIPS.
Letters About HIPAA From the Office for Civil Rights
If the letter came from OCR, it almost certainly involves the Health Insurance Portability and Accountability Act. OCR enforces the HIPAA Privacy and Security Rules,3U.S. Department of Health and Human Services. HIPAA Compliance and Enforcement and its letters go to covered entities like health plans and providers, plus their business associates. The trigger is usually a patient complaint or a reported data breach.
An OCR investigation letter asks for specific documentation showing how you comply with 45 CFR Part 164.4eCFR. 45 CFR Part 164 – Security and Privacy That can mean privacy policies, breach notification procedures, employee training records, risk assessments, or documentation tied to a specific patient’s request for their records. OCR uses your response to decide whether a violation occurred, so a vague or incomplete answer is treated the same as no answer.
When OCR confirms a violation, cases often close through a resolution agreement rather than a penalty hearing. A resolution agreement typically requires a lump-sum payment within 15 days plus a corrective action plan that spells out what you have to fix and how you must report progress.5U.S. Department of Health and Human Services. Resolution Agreement Falling behind on the corrective plan reopens the door to civil monetary penalties, and HHS publishes these agreements publicly.
If a case doesn’t resolve by agreement, OCR can impose civil monetary penalties on a four-tier scale tied to the level of culpability, with annual caps that reach $2,190,294 for the most serious tier under the 2026 inflation adjustment.6Federal Register. Annual Civil Monetary Penalties Inflation Adjustment HHS sets the actual amount by weighing factors like the number of people affected, the duration of the violation, harm caused, and your compliance history.7eCFR. 45 CFR 160.408 – Factors Considered in Determining the Amount of a Civil Money Penalty The worst cases can be referred to the Department of Justice for criminal prosecution under 42 USC 1320d-6.8GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
Letters About Marketplace Coverage and Subsidies
CMS letters about Affordable Care Act coverage tend to fall into two buckets: eligibility determinations and verification requests. Eligibility notices tell you whether you qualify for a Qualified Health Plan and for Advance Payments of the Premium Tax Credit (APTC), which lowers your monthly premiums.9Internal Revenue Service. The Premium Tax Credit – The Basics
Verification requests arrive when something on your application doesn’t match federal data from the IRS or immigration records. The letter names the inconsistency and lists the documents you need to send: pay stubs, tax returns, immigration papers, or similar. You generally have at least 90 days from the date of your eligibility notice to resolve most issues, and 95 days for citizenship or immigration matters.10HealthCare.gov. Required Documents and Deadlines Miss the window and you can lose the tax credit entirely or have your coverage terminated.
Separately, everyone who received APTC will get Form 1095-A from the Marketplace. Use it to complete IRS Form 8962, which reconciles the advance payments you actually received against the credit you were entitled to based on your final income.11Internal Revenue Service. Health Insurance Marketplace Statements Skipping reconciliation has real teeth. The IRS auto-rejects e-filed returns that should include Form 8962 but don’t, and failing to file and reconcile can make you and everyone in your tax household ineligible for APTC and income-based cost-sharing reductions in future plan years.12Centers for Medicare & Medicaid Services. Taxes, Exemptions, Reconciling APTC, and Failure to File
Letters About Medicare
Medicare beneficiaries receive CMS letters for enrollment confirmations, coverage decisions, benefit changes, and Medicare Summary Notices. The ones most likely to demand action are coverage determination notices, which tell you whether Medicare will pay for a specific service, treatment, or piece of equipment.
If you disagree, the first step is requesting a redetermination from the Medicare Administrative Contractor that processed the claim. You have 120 days from the date on your Medicare Summary Notice or initial determination letter to file that request. Redetermination is a fresh review of the same claim and the fastest level of the five-tier Medicare appeals process; unfavorable results can be escalated from there.
Letters From the OIG
OIG letters are among the most serious HHS communications and mostly target healthcare providers, suppliers, and organizations participating in Medicare and Medicaid. The two main types are civil monetary penalty notices and exclusion letters.
The OIG can propose civil penalties for false or fraudulent claims, Anti-Kickback Statute violations, Stark Law self-referral billing, and EMTALA stabilization failures, among other prohibited conduct.13U.S. Department of Health and Human Services Office of Inspector General. Types of Civil Monetary Penalties and Affirmative Exclusions A penalty notice is a proposed determination, not a final bill, but treat it as a legal proceeding from the day it arrives.
An exclusion letter is arguably the most damaging action the OIG can take against a provider. Once excluded, you cannot receive federal healthcare program payment for any items or services you furnish, order, or prescribe, and any organization that knowingly employs you can face its own civil monetary penalties.14U.S. Department of Health and Human Services Office of Inspector General. Exclusions You have 60 days from receiving an exclusion notice to request a hearing before an Administrative Law Judge.
IRS Letter 226-J for Employers
Employers with 50 or more full-time equivalent employees may receive IRS Letter 226-J proposing an Employer Shared Responsibility Payment. It means the IRS believes your organization either failed to offer minimum essential coverage to enough full-time employees or offered coverage that was unaffordable, and that at least one employee got a premium tax credit on the Marketplace as a result.15Internal Revenue Service. Understanding Your Letter 226-J
Letter 226-J is a proposal, not a final assessment. The IRS calculates the proposed amount using your Forms 1094-C and 1095-C and your employees’ individual returns. You respond on Form 14764, indicating whether you agree or disagree, and if you disagree you provide a detailed explanation and flag errors on the attached Form 14765 employee listing. The response deadline is on the letter and is generally 30 days. The IRS then sends a Letter 227 with its final determination and appeal information.15Internal Revenue Service. Understanding Your Letter 226-J
How to Respond
Every HHS letter carries procedural instructions, and following them exactly is not optional. The specifics vary, but the approach doesn’t.
Start with the deadline. That’s the single most important line in the letter. The numbers are all over the map: Marketplace verification requests allow 90 days, HIPAA civil monetary penalty hearings must be requested within 90 days of receipt,16eCFR. 45 CFR 160.504 OIG exclusion hearings require a written request within 60 days, and Letter 226-J responses are typically due in 30. Missing the deadline almost always means losing the right to contest what the letter proposes.
Direct your response to the specific contact person or office named in the letter, and put the case, complaint, or tracking number on every page you send back. Use the response method the agency specifies. If the letter points to a secure online portal, don’t mail paper instead. If it calls for physical mail, send certified with return receipt so you have proof of delivery and a timestamp.
Answer every item the letter raises, not just the ones you’re comfortable with. For OCR investigations, that means producing the specific policies, training logs, or risk assessments requested. For Marketplace verification, submit every document listed. A partial response gets the same treatment as no response: an adverse decision built on whatever the agency already has.
What Happens If You Don’t Respond
The consequences depend on the sender, and none of them are good.
Ignoring an OCR HIPAA investigation shifts the case posture sharply. What might have closed with voluntary corrective action becomes a formal finding of noncompliance, with civil monetary penalties potentially reaching over $2 million a year for the most serious violations.6Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Criminal referral to the DOJ stays on the table for intentional misconduct.8GovInfo. 42 USC 1320d-6 – Wrongful Disclosure of Individually Identifiable Health Information
Missing a Marketplace verification deadline means the Marketplace will redo your eligibility using only the data it already has, which typically wipes out the premium tax credit and jumps your monthly premium immediately, or terminates coverage outright.10HealthCare.gov. Required Documents and Deadlines
Failing to request an OIG exclusion hearing within 60 days lets the exclusion stand. You can no longer bill federal healthcare programs, and employers hiring you into a healthcare role face their own penalties.14U.S. Department of Health and Human Services Office of Inspector General. Exclusions If you let a Letter 226-J deadline pass, the IRS treats the proposed employer shared responsibility payment as accepted.
How to Appeal
Most HHS decisions can be challenged, but each program runs its own appeals track.
Marketplace Eligibility
If you disagree with a Marketplace eligibility determination about coverage, tax credit amount, or cost-sharing reduction, file the Marketplace Appeal Request Form within 90 days of the date on your eligibility notice. You can submit it after 90 days, but you’ll need to explain the delay, and acceptance isn’t guaranteed. The Marketplace Appeals Center is reachable at 1-855-231-1751, Monday through Friday, 7:00 a.m. to 8:30 p.m. Eastern Time.
HIPAA Penalties
An entity that receives a notice of proposed civil monetary penalty from OCR can request a hearing before an Administrative Law Judge. The request must be in writing, signed by the respondent or their attorney, and sent by certified mail to the address in the notice within 90 days of receipt.16eCFR. 45 CFR 160.504 For counting those 90 days, regulations presume you received the notice five days after it was dated unless you can show otherwise. An unfavorable ALJ decision can be escalated to the HHS Departmental Appeals Board.17U.S. Department of Health and Human Services. Guidelines – Appellate Review of Decisions of Administrative Law Judges Relating to Imposition of Civil Money Penalties
When to Bring in a Lawyer
Some HHS letters, like Marketplace verification requests or routine Medicare notices, you can handle yourself by gathering documents and hitting the deadline. Others don’t work that way. Any OIG letter, any OCR HIPAA investigation letter, and any IRS Letter 226-J carries enough financial exposure that responding without a healthcare compliance attorney or tax professional is a serious gamble. The cost of counsel is almost always smaller than the penalty for getting the response wrong.