On January 15, 2026, CMS held a webinar on Civil Money Penalties (CMPs) for Non-Group Health Plan (NGHP) Section 111 Reporting. This was CMS’s final update before the first audits and penalty notices in the first quarter of 2026. Given that penalties can be substantial and impact an organization’s compliance record, understanding these requirements and deadlines is essential for all Responsible Reporting Entities (RREs).

CMS provides a full explanation of its CMP policy on its website here.

Quick Reference: Critical Dates

• February 2026: First CMS audits begin
• March 2026: First penalty notices expected
• July 2026: Workers’ compensation penalty assessments begin

Audits

CMS will conduct its first audits in February 2026. The audit will randomly select 250 records from all accepted Section 111 records and non-Section 111 records obtained through CMS’s coordination of benefits and data collection methods. The 250 records will proportionally represent both NGHP and Group Health Plan (GHP) records from the prior quarter.

For the February 2026 audit, CMS will evaluate records accepted between October 11, 2025, and December 31, 2025. CMS will look forOngoing Responsibility for Meedicals (ORM) assumptions or Total Payment Obligation to the Claimant (TPOC)(TPOC) reported more than 365 days after the reportable event. This applies to ORM assumptions and TPOC dates of October 11, 2024, or later.

What Triggers Penalties

Penalties are assessed when RREs fail to report required information within mandated timeframes. Specifically, CMS looks for:

• ORM assumptions reported more than 365 days after the reportable event
• TPOCs reported more than 365 days after the reportable event

Special Consideration for Workers’ Compensation

As a result of the implementation of WCMSA reporting in April 2025, CMS announced that it will not assess penalties for late-reported workers’ compensation TPOCs until July 2026, with a lookback period to July 2025 instead of October 11, 2024. This grace period allows RREs to adjust to the new WCMSA reporting requirements.

Safe Harbor Protection

CMS provides a safe harbor when an RRE cannot report a TPOC because the claimant failed to provide information necessary to identify them as a Medicare beneficiary (such as their Social Security number).

Requirements to qualify for safe harbor:

1. Make two attempts to obtain the information from both the beneficiary and their attorney by mail or email
2. Make one additional attempt to either the beneficiary or their attorney by phone, mail, or email
3. Document all attempts with dates, methods, and responses
4. If either the claimant or their attorney provides a written refusal to cooperate, no further attempts are needed

Important notes:

• Federal law does not prohibit the RRE from contacting the claimant directly, even when the claimant is represented by an attorney
• Contact must be made with both the attorney and the claimant until one of them either provides the information or provides a written refusal

All documentation of these attempts must be retained and provided to CMS if a penalty arises.

Acceptable documentation includes copies of emails, certified mail receipts, phone logs with dates and summaries of conversations, and written refusals.

Penalty Notice Process

Informal Notice

CMS expects the first penalty notices to be sent in March 2026. These informal notices will be mailed to the RRE’s Authorized Representative, with a copy to the Account Manager. Importantly, the reporting agent (such as Tower or other third-party administrators) will not be copied on the notice.

Action required:

Given the importance of receiving these notices, RREs should immediately verify that their Profile Report contains up-to-date contact information for both the Authorized Representative and Account Manager.

Upon receipt of an informal notice, the RRE has 30 days to provide a response, including a reasonable explanation as to why either the TPOC report or the ORM assumption report was untimely.

Possible defenses include:

• The claimant refused to provide their Social Security number (safe harbor applies)
• Delayed acceptance of a claim due to litigation or investigation
• Administrative errors with documented corrective measures
• Technical issues with CMS submission systems

If CMS accepts the explanation, there will be no further action.

WC Reporting Penalties

As a result of the implementation of WCMSA reporting in April 2025, CMS announced that it will not assess penalties for late-reported workers’ compensation TPOCs until July 2026, with a lookback period to July 2025 instead of October 11, 2024.

Formal Notice

If CMS does not accept the explanation or there is no response to their informal notice, a formal notice, called a Notice of Proposed Determination to Impose a Civil Money Penalty, will be mailed to the Authorized Representative and copied to the Account Manager for the RRE.

Appeals Process

The appeals process provides multiple levels of review:

Level 1 – Administrative Law Judge (ALJ): The RRE has 60 days from receipt of the Proposed Determination to appeal to an ALJ.

Level 2 – Departmental Appeals Board: If the ALJ’s decision is unfavorable, the RRE has 30 days to file an appeal with the Departmental Appeals Board Appellate Division.

Level 3 – Federal Court: If the Departmental Appeals Board appeal results in an unfavorable decision, the RRE has 60 days to petition for judicial review in federal court.

Payment

Once the appeals process has concluded, or if no appeal is filed, a Notice of Final Determination will be sent to the RRE. The RRE has 60 days from receipt to make payment electronically through pay.gov.

Best Practices and Final Thoughts

The timeliness and accuracy of Section 111 reporting will mitigate and, ideally, eliminate any possibility of a penalty. To protect your organization:

Proactive measures:

• Implement robust processes to capture Medicare beneficiary information at first contact
• Establish clear procedures for the three-attempt safe harbor requirement with documentation templates
• Maintain detailed records of all attempts to obtain beneficiary information
• Review and update your CMS Profile Report contact information immediately
• Develop internal timelines that build in buffer time before the 365-day reporting deadline

If you receive a penalty notice:

• Respond immediately within the 30-day window
• Coordinate with your Section 111 reporting agent, if applicable, to identify all possible defenses
• Gather all documentation supporting your explanation

Please contact Tower’s Chief Compliance Officer, Dan Anders, at daniel.anders@towermsa.com with any questions.