Best Practices for Cybersecurity

May 26, 2020

threatening hooded figure with the word cyber security superimposed to illustrate post on best practices for cybersecurity

Tower MSA Partners’ SVP of IT Jesse Shade offers advice to workers’ compensation companies on best practices for cybersecurity.

Did you know that personal health information (PHI) is more valuable on the black market than financial data?  This makes workers’ comp organizations very attractive targets for cyber criminals.

“Payers and other workers’ compensation organizations need to guard this sensitive data within their own enterprises. And, since these companies regularly exchange data with each other, each company needs to be just as concerned about the cybersecurity practices of its partners as its own,” says Tower’s Senior Vice President of Information Technology, Jesse Shade in this informative WorkCompWire article: Securing Data During COVID-19 and Beyond.

In last week’s article – COVID-19 Response Triggers Cybersecurity Threats to Workers’ Comp –  Jesse described the scope of the cybersecurity issue especially in the midst of COVID-19.  In this one, he outlines out best practices for cybersecurity in the form practical ways to protect PHI and other data and discusses the tools your IT department needs. He also gives you questions for your managed care organizations, MSP compliance companies and other service providers to ensure that their security practices can withstand attacks.

Cyberattacks have risen astronomically during COVID-19 and will continue long after the pandemic passes.  The IBM Cost of a Data Breach Report put the average cost of a data breach in the U.S. at $8.19 million in 2019.  In addition to the financial hit, companies risk their reputations and the trust of their clients, customers and partners. 

As Jesse says, you can’t afford to ignore cybersecurity.  

Related:

Building a Better Tower – Cybersecurity

 

Federal Court Rules on Plaintiff Refusal to Provide SSN

May 19, 2020

close up of judge's gavel with the scales of justice in the background

A federal magistrate judge got a full education in Section 111 Mandatory Insurer Reporting when a plaintiff refused to provide his Social Security Number (SSN) in a liability settlement with the State of Rhode Island.

The April 27, 2020 Rhode Island U.S. District Court decision came in the case of Genaro Ruiz vs. State of Rhode Island, et al., C.A. No. 16-507WES, April 27, 2020.  The judge held the defendant’s post-settlement effort to obtain the plaintiff’s SSN was “fully consistent with the express and implied terms of the Settlement Agreement” given the Medicare Secondary Payer Act (MSP) requirements. 

Further, the plaintiff could not use the federal Privacy Act to negate the defendant’s basis for requesting the information, again given MSP requirements.

Background

The 2007 Medicare, Medicaid and SCHIP Extension Act (MMSEA) created a requirement for non-group health plans (NGHPs), such as the defendant State of Rhode Island, to report settlements involving Medicare beneficiaries to the Centers for Medicare and Medicaid Services (CMS).  Consequently, NGHPs must determine whether a plaintiff or claimant is a Medicare beneficiary.

To verify their Medicare beneficiary status, a claimant, whether a Medicare beneficiary or not, is asked to produce certain information to the NGHP: including first and last name, date of birth, gender, SSN, Medicare number, or at least the last five digits of the SSN or Medicare number.

To ensure compliance, the statute provides for penalizing the NGHP up to $1,000 per day per claim for non-compliance. However, demonstration of good faith efforts to obtain the SSN can eliminate this penalty.  As the Court noted, CMS’s February 18, 2020 proposal described the penalties and what constituted a good faith effort.  (See Tower’s article, CMP Comments Submitted)

Rhode Island Case

The parties in the Rhode Island liability case reached a mediated settlement agreement with the following relevant components:

  • Plaintiff, who was at least 65 at the time of settlement, acknowledged that because he was a Medicare beneficiary, it was his responsibility to resolve any Medicare claim. However, the settlement negotiations did not define how defendants would obtain closure of any possible Medicare claim or lien.
  • Plaintiff never advised defendants that he would refuse to supply his SSN, or any part of it, as part of the settlement agreement. Providing the SSN would enable the State to ascertain his status as a Medicare beneficiary and to comply with the Medicare statutory reporting requirement.
  • Defendants never advised plaintiff that the submission of his SSN, or any part of it, was a precondition to their paying the settlement proceeds.

Post the settlement agreement the defendant provided the “RI Medicare Reporting Form” that requests the SSN the plaintiff attorney. Plaintiff attorney’s response was “n/a” to the SSN question.  Ultimately, the plaintiff attorney said they were refusing to provide the SSN, which caused the defendant to petition the court to intervene. 

The court held an off-the-record call with the parties that resulted in the decision that the plaintiff would either provide the SSN or an affidavit stating that he did not have an SSN. Plaintiff failed to provide either and filed a motion to enforce the settlement on the basis that the federal Privacy Act gives him an absolute right to refuse to disclose his SSN. He also made a claim for punitive damages, interest, and attorneys’ fees.  The defendant responded with a motion to enforce the agreement from the off-the-record call.

District Court Holding

The District Court held:

  • That the defendant made significant (and successful) efforts to comply fully with the letter and spirit of MMSEA. In an effort to comply, The State of Rhode Island made the requisite query using at least a five-digit iteration of Plaintiff’s SSN. (During discovery, the defendant apparently obtained the last four digits of the SSN and tried to add the fifth digit by performing a query of the multiple iterations).
  • The State’s actions fit neatly into the not-yet-established safe harbor limned by the Proposed Rule, so that any penalties and sanctions for non-compliance should not be imposed
  • The State (and the Court) appropriately relied on plaintiff’s acquiescence to the use of the information he produced in discovery to make the required report to CMS
  • There was no further need for plaintiff to disclose his SSN or any part of it as a prerequisite to receiving the settlement proceeds

Regarding the plaintiff’s claim for punitive damages, interest, and attorneys’ fees:

  • The State’s conduct in delaying payment of the settlement proceeds does not conceivably amount to “willful and wanton disregard” for plaintiff’s rights bordering on criminality.
  • The settlement agreement must be interpreted as incorporating and being subject to the MMSEA requirement of disclosure of the SSN (and, if that is not available, at least the last five digits of the SSN). It is not subject to the Privacy Act prohibition on SSN disclosure because MMSEA is a “Federal statute” requiring preferably full, but at least partial, SSN disclosure.
  • Plaintiff was contractually obliged to provide defendants with as much of the specified information as the State reasonably needed to make a CMS query about his Medicare status/ His refusal to disclose at least the fifth from the last digit of his SSN is a breach of the implied covenant of good faith and fair dealing.

Practical Implications

This is one of those cases where an uncooperative claimant appears to have hit a nerve with the Court, resulting in the Court going above and beyond to rule in favor of the defendant.  Its decision, though, shows how at least this federal court views the responsibilities of the settling parties in regard to the Section 111 Mandatory Insurer reporting requirement.

Key takeaways from the decision:

  • A defendant is allowed to request the SSN or an affidavit that the SSN will not be provided even post-settlement and such request does not constitute bad faith or a violation of the federal Privacy Act.
  • The plaintiff should either provide the full SSN (or their Medicare number), the last five digits of the SSN or Medicare number, or a statement or affidavit that the plaintiff is refusing to provide either.  CMS even provides a standard form if the plaintiff does not want to use the form provided by the defendant.

Best practice is to attempt to obtain the SSN prior to the settlement agreement. This is not only important to reporting requirements, but also to investigate Medicare conditional payments.  If the SSN or affidavit cannot be obtained prior to the settlement agreement, then the settlement agreement should include terms in which the plaintiff is required to provide such information.

If you have any questions, please contact me, Dan Anders, at (888) 331-4941 or daniel.anders@towermsa.com.

Tower’s Jesse Shade Warns of Cyberattacks During COVID-19 and Tells How to Mitigate Them

May 15, 2020

ominous figure embedded in coding to illustrate cybersecurity threats

When Tower held its cybersecurity webinar in February, presenters stressed that cyberattacks increase dramatically during a crisis. This certainly holds true for COVID-19. Attacks soared by 330% in its early weeks, according to an Atlas VPN report.

Workers’ compensation payers, third-party administrators, ancillary care providers, and MSP compliance companies pose very attractive targets – regardless of the size of the company.  

They store, manage, and transfer large volumes of protected health information (PHI), which is quite valuable to criminals.

In this WorkCompWire article, our Senior Vice President of Information Technology, Jesse Shade, explains how cyberattacks occur and describes security measures to protect networks, systems, and data.

During the work-from-home transition, experienced IT pros deployed VPNs to connect remote machines to enterprise networks and installed the latest and greatest security software.

However, if a company can buy antivirus and antimalware software off the shelf or online, so can criminals. And, they analyze these products and create ways to work-around their security  capabilities.

Threat actors can even enter a network undetected and stay there for months and learn how to circumvent its security measures. Jesse recommends proactive solutions to prevent breaches in this timely story.

CMP Comments Submitted

April 27, 2020

bullhorn illustration alerting you to avoid reporting penalties

On April 20, 2020, Tower MSA Partners responded to CMS’s request for comments on its proposed regulation for Section 111 Mandatory Insurer Reporting civil money penalties (CMPs).  Please see Tower’s Feb. 18 post on CMS’s proposal.

Tower’s comments mirrored those submitted by the National Alliance of Medicare Set-Aside Professionals (NAMSAP) of which Tower is a member.  As Co-Chair of NAMSAP’s Policy & Legislative Committee, I had the privilege of working on comments with my committee Co-Chair Annie Davidson, NAMSAP President Ciara Koba, and our fellow NAMSAP board members. Many thanks to Jill Dulich of the National Council of Self-Insurers and Doug Holmes of Strategic Services on Unemployment & Workers’ Compensation for sharing their invaluable Comment drafts.

Tower’s full comments can be found here and are summarized below:

Penalty Threshold for Failure to Report / Delayed Reporting – Part 402.1(c)(22)(i)

Per the proposed rule, subject to the good faith efforts provision, a penalty is imposed for an RRE that “fails to report any beneficiary record within 1 year from the date of settlement, judgment, award, or other payment.”  Recognizing that human and technical error will occur, we recommended CMS implement a 10% threshold for error tolerance per RRE.

The 10% would be based upon the number of Total Payment Obligation to Claimants (TPOCs) reported in a quarter (including off-cycle reporting).

Penalties Imposed for Failure to Report / Delayed Reporting – Part 402.105(b)(3)(i)

The proposal states that failure-to-report penalties will be up to $1,000 per calendar day, adjusted for inflation, for a maximum penalty of $365,000 per calendar year.

The proposal did not indicate whether CMS will use the discretion provided by the SMART Act to impose a penalty of “up to” $1,000/day. If CMS uses this discretion, then what criteria will be used to determine if the penalty should be $1/day, $500/day or $1,000/day? 

We submitted that CMS should incorporate mitigating factors, already found in the code of federal regulations. These would define CMS’s discretion in imposing penalties and provide RREs that face penalties the criteria needed to respond to potential penalties.

Additionally, we recommended that if Medicare made no conditional payment demands that no penalties should be imposed.

Data Contradicts Recovery – Part 402.1(c)(22)(ii)

The proposed rule addresses the possibility that an RRE’s response to CMS’s recovery efforts may contradict the its Section 111 reporting. A penalty would be calculated based on the number of calendar days that the entity failed to accurately report timely updates to beneficiary records. 

This means that an NGHP could face a penalty of up to an adjusted $1,000 per calendar day of “noncompliance” for each individual, for a maximum annual penalty of an adjusted $365,000 for each individual for which required information should have been submitted.

CMS is saying it will potentially penalize RREs millions of dollars for correcting their data after inconsistencies are found despite the fact that such errors cause the agency minimal monetary harm. 

We urged CMS to either withdraw this type of penalty or impose penalties that are proportional to the harm caused to Medicare as a result of the reporting contradictions.

“Safe Harbor” for Data Collection from Beneficiaries – Part 402.1(c)(22)(A)(2)

The proposed rule provides an exemption for those situations where a claimant refuses to provide their Social Security Number or Medicare Beneficiary Identifier. Yet, it mandates three attempts to obtain this information before allowing the exemption.

We requested that CMS eliminate the mandatory minimum number of communications with claimants. Instead, we asked it to simply require that the RRE make good faith efforts to secure needed reporting information.  

Informal Notice – D. Summary of Public Comments #8

CMS stated that its informal notice process will provide the RRE 30 calendar days to respond with any mitigating information prior to the issuance of a penalty notice.

We proposed that the RRE have 120 calendar days post receipt of the informal notice to respond.

Prospective Application – D. Summary of Public Comments #6

CMS advised the application of the final regulation will be prospective. However, after the regulation implementation date, much of the reported Section 111 data will be retrospective to that date.  While this will taper, corrections will occur and there is a potential for conditional payment recovery involving retrospective data.

We requested CMS better define what they mean by prospective application of the rule. 

Five Year Statute of Limitations – D. Summary of Public Comments #7

In its supporting summary, CMS takes care to outline that these penalties would be imposed within the existing CMP five-year statute of limitations. That limitations period, CMS says, is triggered when the agency identifies the non-compliant action.

We responded that CMS’s interpretation is incorrect.  The correct interpretation is that the statute of limitations starts with when the non-compliant action occurred, not when CMS identifies the non-compliance action.  In other words, if a TPOC was not reported when required in 2020, the statute of limitations would expire in 2025. 

Further, we asserted that the five-year statute of limitations is inapplicable to Section 111 penalties; instead the three-year statute of limitations found in the Medicare Secondary Payer Act applies. 

ALJ and Departmental Appeals Board Backlog Concerns – D. Summary of Public Comments #5

Under the proposed rule, CMS allows for appeals post the notice of the penalty.  However, as we have seen with appeals for conditional payment demands, it can take several years to have a hearing before an administrative law judge (ALJ). 

Our question to CMS is whether this same appeals process, along with timeframes, will be utilized for penalties appeals.  Further, we inquired as to whether CMS will be using the Treasury offset program to collect penalties.

Implementation of Final Rule

Finally, given the diversion of resources by many RREs to respond to the COVID-19 pandemic, we requested that CMS not implement a final rule until at least 1/1/2021.

If you have any questions about CMS’s proposed rule or these comments, please contact me, Dan Anders, at (888) 331-4941 or daniel.anders@towermsa.com.

Tower Premier Webinar: A Prescription for Settling Legacy Claims

April 20, 2020

Banner for webinar on A Prescription for Settling Legacy Claims

As claims age, the percentage of spend for prescription drugs increases.  Further, as claims age, the likelihood that the injured worker becomes a Medicare beneficiary as a result of age or disability increases. The result, high prescription drug costs allocated in the Medicare Set-Aside (MSA) become a barrier to settlement of these legacy claims.

Tower has addressed this barrier through clinical interventions which have resulted in the majority of Tower’s CMS-approved MSAs containing no prescription drugs.  However, there remain legacy claims with high prescription drug spend which continue to stymie settlement.

Accordingly, Tower has partnered with the leading workers’ compensation pharmacy benefit manager, myMatrixx, to add its renowned clinical pharmacy team to the effort at breaking down the remaining barriers to settlement of these legacy claims.

What then can a PBM do to help with settling legacy claims?  How does a PBM work with an MSA company to settle these claims?

Tower is pleased to host a premier webinar panel with Phil Walls, RPh, Chief Clinical Officer for myMatrixx, and Dan Anders, Esq., Chief Compliance Officer for Tower on the following topics:

  • Define and quantify legacy claims with analytics
  • Identify factors driving up Rx costs in these claims
  • Explain how data can identify opportunities for clinical intervention
  • How to work effectively with PBM and MSA provider to reduce Rx and close claims
  • Provide examples/case scenarios demonstrating successful Rx intervention and settlement in legacy claims
  • Best practices for Rx management to prevent claims from becoming legacy claims

Please plan to attend the webinar on May 20 at 2 pm ET.

Thank you,

Dan Anders

Chief Compliance Officer

Tower is Here for You

April 14, 2020

Overhead image of people working at a conference table overlaid with type reading "we are here to help"

While the COVID-19 pandemic represents a new challenge, as a company that has faced its share of hurricanes, we made a seamless transition to working remotely while continuing to serve our partner clients. As our CEO, Rita Wilson recently related, “We Are Here to Help“. While we apologize for the occasional barking dog or screaming child when you call us, you will nonetheless receive the same high level of service that you have come to expect from Tower and which we highlight below.

Expert MSP Consultation

Do I need an MSA?

Are these settlement terms appropriate?

Is a Zero MSA feasible?

How can we reduce the MSA amount?

What are my reporting obligations?

Does a Medicare Advantage plan have a lien?

As always, the Tower Team is readily available to answer these questions and address any other Medicare Secondary Payer compliance concern you encounter when resolving a claim.

Settlement-Driven Pre-MSAs and MSAs

Whether through an MSA or a Pre-MSA Triage, Tower’s clinical team continues to deliver our reports in an average 4 business days.   These reports identify MSA exposure and provide recommendations to address cost drivers and inappropriate care prior to submission of the MSA to CMS. 

Physician Follow-up

Many of you use our crack physician follow-up team that reaches out to treating physician offices to confirm when injury-related medical treatment was completed or clarify the ongoing need for treatment.  Despite some businesses closing, medical offices are either open or available by phone.  If anything, Tower has had even better success at obtaining the needed physician statements since many of these offices are seeing less patients.  This allows us to quickly obtain the necessary medical information and seek prompt CMS approval of the MSA facilitating settlement.

CMS Processes

Thus far, CMS and its various contractors, WCRC for MSA review and BCRC and CRC for Mandatory Insurer Reporting and conditional payment recovery, are responding and completing their services at turnaround times consistent with what we saw prior to the pandemic.

Social Security Verifications

All local Social Security offices have suspended responses to SSDI verification requests because of the coronavirus and Social Security has not announced when it will again respond to these requests.  We assume there will be a significant backlog since these requests are not a high priority for Social Security.  We will of course resume these verification requests when possible. 

Cybersecurity

As has been noted in many publications, the dramatic increase in employees working for home has made conditions ripe for threat actors to infiltrate systems through malware inadvertently downloaded to home laptops via local internet.  More than 2 years ago, Tower made the security of systems and our clients’ data a priority by investing in proactive measures to stop cyberattacks in their tracks.  This protection extends throughout Tower’s network and down to the individual employee working from their home.   

With 24 / 7 detection and response oversight overlaid with 2 factor authentication and managed endpoint services, our systems and data are secure.   All data exchanged between Tower’s systems and remote users is encrypted from the source and monitored through to the endpoint.  If a threat is identified at any point from laptop to server, the transmission is halted, our IT team is immediately notified and the IP address of the source is identified.  

Claim Closure Settlement Projects

Many businesses and injured workers face difficult financial challenges as a result of the pandemic’s economic impact. Tower is working with employers on claim closure settlement projects that mitigate exposure to open-ended medical claims and provide the injured worker with much-needed funds while still protecting their access to future injury-related medical.  Please contact your dedicated Tower account representative to discuss how Tower can coordinate such a project on your behalf.

Multiple Referral Methods

As a result of working from home, you may need to change your referral method.  Tower has multiple methods for making referrals:

  • Via e-mail:  referrals@towermsa.com
  • Via mail:  Tower MSA Partners, 223 NE 5th Ave., Suite 101, Delray Beach, FL 33483
  • Via web portal:  www.towermsa.com (Click refer and compete referral form)
  • Via phone:  (888) 331-4941

If making a referral by phone, e-mail or web, upon receipt, we will provide you a username and password to log in to the TowerConnect portal for secure upload of referral documents.

Note, when you log in to the TowerConnect Portal, you will be directed to enter a phone number to receive a code via SMS or phone call for verification. Additionally, you can download Duo Mobile to your phone to allow you to receive a “push” notification to easily authenticate. Your device can be registered and remembered for up to 7 days. More information is available here: https://guide.duo.com/enrollment

If there is any other way we can assist you, please do not hesitate to contact us at referrals@towermsa.com or (888) 331-4941.

Please keep safe,

The Tower Team!

Tower is Here to Help

March 24, 2020

Overhead image of people working at a conference table overlaid with type reading "we are here to help"

I hope you, your family and coworkers are safe and, like all of us, learning to adjust to a new personal and work environment in this worldwide effort to control the spread of coronavirus.  We realize that Medicare Secondary Payer compliance is not the most important matter in life right now, even for Tower which normally lives and breathes MSAs and conditional payments. 

Tower realizes that people continue to work, some remotely for the first time.  This work transition itself presents unique challenges and uncertainties let alone the changes to our personal lives.

We are here to help.  When the need arises, Tower will be there for you, promptly and securely with the care, concern and expertise we apply to every customer matter (Please see below regarding our secure referral process).

Please keep safe.

Sincerely,

Rita Wilson
Chief Executive Officer
Tower MSA Partners

Secure electronic referrals: If you previously mailed referrals or referral documentation to Tower, but cannot do so as you are now working remotely, referrals and the transmittal of documentation can be made through our TowerConnect Portal. Please contact us at (888) 331-4941 or referrals@towermsa.com and we will provide you a username and password to log in to the portal. You can also make referral here and we will send you a username and password.

Once you log in to the TowerConnect Portal, you will be directed to enter a phone number to receive a code via SMS or phone call for verification. Additionally, you can download Duo Mobile to your phone to allow you to receive a “push” notification to easily authenticate. You can register your device to allow for the Duo push. More information is available here: https://guide.duo.com/enrollment. Your device can be remembered for up to 7 days.

CMS’s Revised Consent to Release Form Becomes Mandatory April 1

March 18, 2020

illustration of Revised Consent to Release form signing

As of April 1, 2020, submissions of Workers’ Compensation Medicare Set-Asides (WCMSAs) must include CMS’s revised Consent to Release form.  The form indicates that the need and process for the WCMSA have been explained to the injured worker, and that the injured worker has approved the contents of the submission, including the allocated funds.

First announced with the release of an updated WCMSA Reference Guide on October 10, 2019 (Version 3.0), the revised consent must include the following language:

Further, I have had the Workers’ Compensation Medicare Set-Aside Arrangement need and process explained to me, and I approve of the contents of the submission.

Beneficiary Initials: ____

A copy of the revised consent to release can be found here.

Practical Implications

If the claimant is represented by an attorney, the attorney will typically explain why an MSA is needed in settlement of their WC case.  If not represented, this responsibility may fall to the adjuster or defense attorney.

CMS provides resources to assist with the MSA explanation in both the WCMSA Reference Guide and the Self-Administration Toolkit.  Additionally, for professionally administered MSAs, our partner Ametros provides general information as well as individual consultation to walk the injured worker through how the MSA will work post-settlement.

As mentioned above, the revised consent requires the claimant to approve the contents of the MSA submission.  While a review of the MSA report alone by the claimant or their attorney may be enough to obtain the beneficiary’s approval, if the injured worker requires additional documentation prior to their approval, Tower will provide it.

Finally, keep in mind, consent without the revised Consent to Release language will no longer be valid as of April 1.  Consequently, Tower may provide a revised consent form to be executed by the claimant prior to submission or resubmission of the MSA to CMS.

If you have any questions please contact Tower’s Chief Compliance Officer, Dan Anders, at (888) 331-4941 or daniel.anders@towermsa.com.

Significant Drop in Meloxicam Price Yields MSA Reductions

March 11, 2020

white prescription pills spilling out of an orange pill container - illustrating Drop in Meloxicam Pricing post

The price of the non-steroidal anti-inflammatory (NSAID) Meloxicam took a major nosedive from $2.78 per pill to $0.05 per pill for 7.5 mg and $4.25 to $0.05 for 15 mg.  Meloxicam (Brand name: Mobic) is commonly used to treat osteoarthritic pain and is frequently allocated in WC claims and MSAs.  This is the medication’s first price reduction in more than a decade.

Tower Actions

Tower will contact our clients to report any non-CMS-approved MSAs where we identify an allocation for Meloxicam and qualify for a revision.  You can also contact us immediately to determine whether a particular MSA qualifies for a reduction.  Revisions to the MSA can be done now or prior to MSA submission to CMS, if needed. 

Please contact Dan Anders at Daniel.anders@towermsa.com or (888) 331-4941 with questions.

CMS Issues Proposed Rule for Mandatory Insurer Reporting Penalties

February 18, 2020

bullhorn illustration alerting you to avoid reporting penalties

On February 18, 2020, the Centers for Medicare and Medicaid Services (CMS) issued a proposed regulation which would specify how and when CMS will calculate and impose what are called civil money penalties (CMPs) when group health plan (GHP) and non-group health plan (NGHP) responsible reporting entities (RREs) fail to meet their Section 111 Medicare Mandatory Insurer Reporting responsibilities.  NGHPs include workers’ compensation (including self-insurance) liability and no-fault insurers.

Background

Section 111 of the Medicare, Medicaid and SCHIP Extension Act of 2007 added requirements for GHPs and NHGPs to report Medicare beneficiary enrollees and claimants to Medicare on a quarterly basis.  NGHPs are specifically required to report acceptance and termination of ongoing responsibility for medical (ORM), if any, and total payment obligation to the claimant (TPOC), a settlement, judgment award or other payment. 

The statute originally called for a mandatory penalty of $1,000 per day per claimant for noncompliance with reporting.  Subsequently, the SMART Act of 2012 made CMPs discretionary for NGHPs, modifying the language to indicate that penalties of up to $1,000 per day per claimant may be imposed. The SMART Act also required CMS to issue regulations prior to imposing CMPs.

CMS’s CMP Regulation Proposal

Situations where CMS may impose penalties:

  • when RREs fail to register and report as required by MSP reporting requirements;
  • when RREs report as required, but report in a manner that exceeds error tolerances established by the Secretary of the Department of Health and Human Services (the Secretary);
  • when RREs contradict the information, the RREs have reported when CMS attempts to recover its payments from these RREs.

CMS further states,

This proposed rule would also establish CMP amounts and circumstances under which CMPs would and would not be imposed.

Failure to report at all

Should it fail to perform the required Section 111 reporting at all within one year of the date a settlement or other payment obligation was established, an NGHP would be subject to a CMP of up to $1,000 for each day of noncompliance for each individual whose information should have been reported. A maximum penalty of $365,000 per individual per year applies. 

RREs responses to conditional payment contradict the information the RREs previously reported

Entities that have performed Section 111 reporting as required, but subsequently provide information that contradicts reported information in response to MSP recovery efforts, would be subject to a CMP based on the number of days that the entity failed to appropriately report updates to beneficiary records. For NGHP entities, the penalty would be up to $1,000 per day of noncompliance, for a maximum penalty of $365,000 (365 days) per individual.

Data reported by RRE in error

If a GHP or NGHP entity has reported, and exceeds any error tolerance(s) threshold established by the Secretary in any 4 out of 8 consecutive reporting periods we propose that the initial and maximum error tolerance threshold would be 20 percent (representing errors that prevent 20

percent or more of the beneficiary records from being processed), with any reduction in that tolerance to be published for notice and comment in advance of implementation. We intend for this tolerance to be applied as an absolute percentage of the records submitted in a given reporting cycle.

CMS goes on to note that it is not just any error, but significant errors, as defined in the Section 111 User Guide, which prevent a file from being accepted. Examples include failure to provide an individual’s last name or valid date of birth, or failure to provide a matching Tax Identification Number.

For NGHPs, penalties would be similar, but on a tiered approach with an initial $250 penalty per day of noncompliance for each individual; it increases each subsequent quarter of noncompliance by $250 per day to a maximum of $1,000 per day (it is standardized to 90 days for a total of up to $90,000 per individual per reporting period).  Penalties reduce by $250 per day for each subsequent quarter of compliance.

Safe harbors from reporting penalties

Penalties will not be imposed if any of the following are true:

  • An NGHP entity reports information within one year of the date of settlement;
  • A reporting entity’s submission complies with the reporting error thresholds; or
  • If an NGHP entity is unable to obtain required reporting information from Medicare beneficiaries document their good faith efforts to obtain the information.

In regard to documenting good faith efforts, all of the following are required:

  • The NGHP has communicated the need for this information to the individual and his or her attorney or other representative and requested the information from the individual and his or her attorney or other representative at least twice by mail and at least once by phone or other means of contact such as electronic mail in the absence of a response to the mailings.
  • The NGHP certifies that it has not received a response in writing, or has received a response in writing that the individual will not provide his or her MBI or SSN (or last 5 digits of his or her SSN).
  • The NGHP has documented its records to reflect its efforts to obtain the MBI or SSN (or the last 5 digits of the SSN) and the reason for the failure to collect this information.
  • The NGHP entity should maintain records of these good faith efforts (such as dates and types of communications with the individual) in order to be produced as mitigating evidence should CMS contemplate the imposition of a CMP. Such records must be maintained for a period of 5 years.

Penalties will be prospective

CMS advised that  it “would evaluate compliance based only upon files submitted by the RRE on or after the effective date of any final rule.”

Statute of limitations

CMS “will apply the 5-year statute of limitations as required by 28 U.S.C. 2462. Under 28 U.S.C. 2462, we may only impose a CMP within 5 years from the date when the noncompliance was identified by CMS.”

Informal notice

CMS advised that it expects to communicate with the RRE on an informal basis through a “pre-notice” process that would allow the RRE the opportunity to present mitigating evidence within 30 calendar days before the imposition of the CMP.

Appeals process

Per CMS:

In broad terms, parties subject to CMP would receive formal written notice at the time penalty is proposed.  The recipient would have the right to request a hearing with an Administrative Law Judge (ALJ) within 60 calendar days of receipt. Any party may appeal the initial decision of the ALJ to the Departmental Appeals Board (DAB) within 30 calendar days. The DAB’s decision becomes binding 60 calendar days following service of the DAB’s decision, absent petition for judicial review.

Comment period

CMS has provided for a 60-day comment period to the proposed regulations with comments due by April 20, 2020.  It is expected that following CMS’s review of the comments a final rule will be issued before the end of the year.

Practical Implications

These proposed regulations make it clear that NGHPs, which have a responsibility to report under the Section 111 Mandatory Insurer Reporting provisions, must do so promptly and accurately.  Failure to meet this obligation will result in significant penalties. 

Where RREs do report and later contradict the reported information in response to a recovery demand, the penalty seems much worse than the offense.  For example, thousands of dollars in penalties could be assessed for what amounts to a conditional payment demand of $2,000.  It was thought the SMART Act changes allowing for more discretion would reduce the $1,000-per-day-per-claimant penalty under these scenarios. However, this proposal leaves little room for forgiveness of the inevitable errors which occur with reporting large amounts of data

When it comes to the data that is actually reported, CMS does allow for some forgiveness.  Penalties will only be imposed for submitting data in error over a certain threshold, currently proposed at 20%, and over a certain time, namely 4 out of 8 reporting periods. 

Significantly, CMS states that it will apply the rule prospectively meaning that it will rely upon data reported post final implementation of the rule to determine whether CMPs will be issued.  In other words, CMS is giving RREs one last chance to register and report data if they have not previously done so and for those RREs who have been reporting, to ensure the accuracy of all past ORM and TPOC reporting.

Through client education and regular communication, Tower makes certain reporting is not only timely, but is also an accurate depiction of current status, both from the standpoint of accepted and denied ICD10 codes, as well as termination of ORM through the ORM Term Date when TPOCs are submitted.  With that being said, we can report only what we receive.  As such, it is critical that claims systems provide an accurate representation and communication of the current status of each claim. 

Tower will continue to consider the implications of the proposed rules and comments in response to these rules.  You are encouraged to submit your own comments to CMS or provide comments to Tower who will in turn provide to CMS.  Please contact Dan Anders at Daniel.anders@towermsa.com or (888) 331-4941 with comments or questions.