On October 11, 2023, CMS published a final rule on the imposition of Civil Monetary Penalties for failure to comply with the Section 111 Mandatory Insurer Reporting requirements.  The rule’s focus and the sole reason for penalties will be untimely reporting.  Even if a Responsible Reporting Entity (RRE) reports untimely, it may only be subject to penalties if that claim is identified through a randomized quarterly audit process.

Please see a full Q&A below.  We will be sending an invitation for a special webinar on Section 111 penalties shortly!

Note, while the final rule encompasses both Group Health Plans (GHPs) and Non-Group Health Plans (NGHPs), this article is specific to NGHPs.

Under what circumstances can CMS impose penalties?

Per CMS:

. . . we have determined that we will only impose penalties where the initial report was not received in a timely manner. Penalties will not be imposed on any other basis, such as in relation to the quality of reporting. Timeliness is determined by comparing the date a record is submitted and accepted against the date CMS should have received the record. The date CMS should receive a record is determined by the effective date of coverage or the date of settlement (or settlement funding date if the funding of the settlement is delayed) plus 1 year (365 days).

CMS considers the “initial report” to be the reporting on Ongoing Responsibility for Medicals (ORM) or, if ORM was not previously reported, the reporting of Total Payment Obligation to the Claimant (TPOC), namely the settlement, judgment, award, or other payment.  Importantly, CMS expressly indicated in these comments that a failure to report ORM termination will not subject the RRE to penalties:

In the final rule, based on stakeholder concerns and submitted comments, CMS has chosen to focus its definition of noncompliance solely on those situations where an entity has failed to provide its initial report of primary payment responsibility in a timely manner. That means that untimely termination of ORM coverage records would not be considered eligible for a civil money penalty under this rule.

On the surface, even this more narrowly tailored rule could subject many claims to penalties. However, CMS is implementing a randomized audit process that will only review a small portion of the thousands of reported claims it receives. Per CMS:

CMS has determined that, given the time and resources necessary to accurately and thoroughly evaluate the accuracy of any submitted record, it would be possible to audit a total of 1,000 records per calendar year across all RRE submissions, divided evenly among each calendar quarter (250 individual beneficiary records per quarter).

• •  CMS will evaluate a proportionate number of GHP and NGHP records based on the pro-rata count of recently added records for both types of coverage over the calendar quarter under evaluation. For example, if over the calendar quarter being evaluated, CMS received 600,000 GHP records and 400,000 NGHP records for a total of 1,000,000 recently added beneficiary records, then 60 percent of the 250 records audited for that quarter would be GHP records, and 40 percent would be NGHP records.
• •  At the end of each calendar quarter, CMS will randomly select the indicated number of records and analyze each selected record to determine if it is in compliance with the reporting requirements as required by statute and defined herein.

Accordingly, to be chosen for a penalty a claim would need to both be reported untimely and identified through this randomized audit.  As CMS indicated in its comments, it expects this type of audit to pick up larger reporting entities.

How will the RRE be notified of the penalty?

Once a claim has been identified for a penalty there is an informal notice process, per CMS:

We intend to communicate with the entity informally before issuing formal notice regarding a CMP. The informal (that is, prior to formal enforcement actions) written “pre-notice” process will allow the RRE the opportunity to present mitigating evidence for CMS review prior to the imposition of a CMP. The RRE will have 30 calendar days to respond with mitigating information before the issuance of a formal written notice in accordance with 42 CFR 402.7.

Common to all such instances where informal notice will be given is the intention to give the RRE an opportunity to clarify, mitigate, or explain any errors that were the result of a technical issue or due to an error or system issue caused by CMS or its contractors. It would be impractical and counter to the spirit of the informal notice process to regulate or enumerate all circumstances in which mitigating information could be provided or what that information should convey. As such, any mitigating factors or circumstances are welcomed, and a dialogue is encouraged in an attempt to find solutions that are short of imposing a CMP. We believe it is in the best interests of all RREs to leave the informal notice process open to any reasonable submission of mitigating factors so that we are free to entertain all such documentation without strict limits on what is, or is not, acceptable.

In many circumstances, the RRE may have a reasonable explanation for the untimely reporting. Because of the 30-day timeline, RREs must be prepared to react quickly to these informal notices by investigating and responding within the required timeframe.

If the RRE fails to respond to the informal notice or CMS does not accept the explanation for why the report was untimely, then CMS will issue a formal notice.

Is there an appeals process?

Yes, per CMS:

The recipient will have the right to request a hearing with an Administrative Law Judge (ALJ) within 60 calendar days of receipt. Any party may appeal the initial decision of the ALJ to the Departmental Appeals Board (DAB) within 30 calendar days. The DAB’s decision becomes binding 60 calendar days following service of the DAB’s decision, absent petition for judicial review.

If a penalty is imposed, how will the dollar amount be calculated?  Is there a maximum penalty?

CMS has developed a tiered approach to penalties, which provides:

Because we have the statutory authority to adjust the amounts of penalties imposed on NGHP RREs, a tiered approach and cap on the total amount of penalties applicable to such RREs are being finalized in this rule. As explained previously, the statute does not permit us to extend this approach to GHP RREs. For any record selected via the random audit process described above where the NGHP RRE submitted the information more than 1 year after the date of settlement, judgment, award, or other payment (including the effective date of the assumption of ongoing payment responsibility for medical care); the daily penalty will be—

• • $250, as adjusted annually under 45 CFR part 102, for each calendar day of noncompliance, where the record was reported 1 year or more, but less than 2 years after, the required reporting date;  

• • $500, as adjusted annually under 45 CFR part 102, for each calendar day of noncompliance, where the record was reported 2 years or more, but less than 3 years after, the required reporting date; or  

• • $1,000, as adjusted annually under 45 CFR part 102, for each calendar day of noncompliance, where the record was reported 3 years or more after the required reporting date.

Additionally, the total penalty for any one instance of noncompliance by an NGHP RRE for a given record identified by CMS will be no greater than $365,000 (as adjusted annually under 45 CFR part 102).

Are there any safe harbors from penalties?

 Per CMS:

First, any untimely reporting that is the result of a technical or system issue outside of the control of the RRE, or that is the result of an error caused by CMS or one of its contractors would not be considered noncompliance for purposes of this rule.

Second, any untimely reporting by an NGHP that is the result of a failure to acquire all necessary reporting information due to a lack of cooperation by the beneficiary will not lead to a CMP provided that certain standards are met.

CMS defines a safe harbor based on good faith efforts to obtain claimant information for reporting as follows:

 If an NGHP entity fails to report timely because the NGHP entity was unable to obtain information necessary for reporting from the reportable individual, including an individual’s last name, first name, date of birth, gender, MBI, or SSN (or the last 5 digits of the SSN), and the responsible applicable plan has made and maintained records of its good faith effort to obtain this information by taking all of the following steps:

• •  The NGHP has communicated the need for this information to the individual and his or her attorney or other representative (if applicable) and requested the information from the individual and his or her attorney or other representative at least twice by mail and at least once by phone or other means of contact such as electronic mail in the absence of a response to the mailings.

• •  The NGHP certifies that it has not received a response, or has received a response in writing that the individual will not provide his or her MBI or SSN (or last 5 digits of his or her SSN).

• •  The NGHP has documented its efforts to obtain the missing information, such as the MBI or SSN (or the last 5 digits of the SSN) and the reason for the failure to collect this information.

The NGHP entity should maintain records of these good faith efforts (such as dates and types of communications with the individual) in order to be produced as mitigating evidence should CMS contemplate the imposition of a CMP. Such records must be maintained for a period of 5 years. The current OMB control number assigned to this information collection effort, as required under the Paperwork Reduction Act, is 0938-1074.

Is there a statute of limitations on penalties?

Yes, per CMS:

We agree and will apply the 5-year statute of limitations as required by 28 U.S.C. 2462. Under 28 U.S.C. 2462, we may only impose a CMP within 5 years from the date when the noncompliance occurred.

The five-year limitation begins to run as of the date the untimely report is made to CMS.

When does the rule become effective?

The rule becomes effective as of December 11, 2023.

Will the rule be retroactive?

No, per CMS:

CMPs will only be imposed on instances of noncompliance based on those settlement dates, coverage effective dates, or other operative dates that occur after the effective date of this regulation and as such, there will be no instances of inadvertent or de facto retroactivity of CMPs.

Since the rule effective date is December 11, 2023, CMS can consider penalties on untimely reported claims on or after this date.  This means that if the untimely ORM and TPOC date was December 11, 2023, or later, it may be subject to penalties.  Untimely, pre-December 11, 2023, ORM and TPOC dates will not be subject to penalties.

Additionally, CMS has indicated that penalties will not be issued until one year after the final rule’s publication, namely October 11, 2024.

How does the final rule differ from the proposed rule?

The proposed rule contained two other issues that could result in penalties.  These were RREs reporting ORM and later reporting contradictory diagnosis codes and exceeding error tolerance thresholds.  The final rule consists solely of penalties for untimely reporting.

This means that reporting errors, such as incorrect diagnosis code reporting, will not result in Section 111 reporting penalties (although it can still result in inappropriate Medicare conditional payment demands).  Further, when the RRE corrects this data, it will not be penalized for doing so.

What steps must an RRE take to avoid penalties?

Simply put, reporting of ORM and/or TPOC must be timely.  When the criteria are met for a claim to be reported, it should be reported during the next quarterly reporting period.

Suppose the RRE has difficulty obtaining identifying information to determine whether a claimant is a Medicare beneficiary. In that case, those efforts should be in accordance with the good faith effort rules described in the safe harbor section.

Tower’s Section 111 reporting platform and management dashboard provides our reporting partners the tools necessary to identify Medicare-eligible claimants.  Once eligibility is confirmed it is critical to use this information to report acceptance of ORM and/or TPOC. Tower stands ready to assist you with your questions and to provide necessary reports and overall guidance to ensure compliance.

Contact us if you are concerned that your current reporting platform may not protect you from penalties.  An audit of your current Section 111 reporting data often reveals gaps in reporting which may lead to penalties.

Tower’s Chief Compliance Officer, Dan Anders, can be reached at daniel.anders@towermsa.com.