The OIG may impose a penalty against any person (including an insurance company) who it determines—

(a) Fails to report information concerning—

(1) A payment made under an insurance policy, self-insurance, or otherwise for the benefit of a physician, dentist, or other health care practitioner in settlement of, or in satisfaction in whole or in part of, a medical malpractice claim or action or a judgment against such a physician, dentist, or other practitioner in accordance with section 421 of Public Law 99-660 (42 U.S.C. 11131) and as required by regulations at 45 CFR part 60 or

(2) An adverse action required to be reported under section 1128E, as established by section 221 of Public Law 104-191.

(b) Improperly discloses, uses, or permits access to information reported in accordance with Part B of Title IV of Public Law 99-660 (42 U.S.C. 11137) or regulations at 45 CFR part 60. (The disclosure of information reported in accordance with Part B of Title IV in response to a subpoena or a discovery request is considered an improper disclosure in violation of section 427 of Public Law 99-660. However, disclosure or release by an entity of original documents or underlying records from which the reported information is obtained or derived is not considered an improper disclosure in violation of section 427 of Public Law 99-660.)