On October 11, 2023, CMS published a final rule (the Final Rule) regarding how and when CMS will impose civil monetary penalties (CMPs) for Medicare secondary payers (MSPs) that untimely report required information. The Final Rule applies to both group health plan (GHP) and non-group health plan (NGHP) responsible reporting entities (RREs). The CMPs for late reporting for both GHP and NGHP RREs is calculated on a daily basis for each calendar day of noncompliance in excess of a year for each individual for which the required information was required to be submitted, with a maximum penalty of $365,000. The Final Rule outlines two specific safe harbors that would preclude the assessment of CMPs. RREs that are not compliant with their MSP reporting obligations are subject to CMPs beginning October 10, 2024, when the Final Rule becomes effective.

Background

In 1980, Congress added Section 1862(b) to the Social Security Act (the Act), which defines when Medicare is the secondary payer to certain primary plans. The MSP provisions of the Act prohibit Medicare from making payment if payment has been made, or can reasonably be expected to be made, from GHPs or workers’ compensation plans, liability insurance (including self-insurance), or no-fault insurance (collectively, NGHPs). Medicare can make conditional payments for NGHPs, subject to reimbursement from the primary plans.

In 2007, Congress enhanced enforcement of the MSP provisions by enactment of Section 111 of the Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA), which established new mandatory reporting requirements regarding Medicare beneficiaries who have coverage under GHP arrangements, as well as when NGHPs provide settlements, judgments awards, or assume rother payment responsibility for Medicare beneficiaries’ care. Today, almost 1,000 entities are registered as GHP RREs, with the majority estimating in excess of 1,000 individual Medicare beneficiaries to be reported annually, and over 21,000 entities are registered as NGHP RREs, with almost all of them estimating fewer than 500 individual Medicare beneficiaries to report annually upon initial registration. RREs are required to electronically submit coverage information for Medicare beneficiaries on a quarterly basis, including reporting of when coverage begins or ends and when a judgment award, settlement, or other payment is made.

Following the passage of the Medicare IVIG Access and Strengthening Medicare and Repaying Taxpayers Act of 2012 (the SMART Act), the MSP reporting provisions were amended to provide that GHPs and NGHPs that fail to comply with the MSP reporting requirements are subject to CMPs. For GHPs, which tend to be larger, the penalty amount is $1,000 for each calendar day of non-compliance, but for NGHPs, which tend to be smaller, the penalty amount is up to $1,000 for each calendar day of non-compliance. The SMART Act also included a revision to make clear that CMS had discretion with regards to the imposition of CMPs as to NGHPs.

In December 2013, CMS published an advance notice of proposed rulemaking to solicit comments on the practices for which CMS may impose CMPs under the MSP rules. Then, in February 2020, CMS published its proposed rule (the Proposed Rule) for the imposition of CMPs related to MSP reporting.

The Final Rule

Civil Monetary Penalties. In response to comments, under the Final Rule, unlike under the Proposed Rule, the only basis for imposing CMPs will be untimely reporting of required information. Contradictory reporting or reporting containing excessive errors is not a sufficient basis for imposing CMPs. Rather, CMPs for GHPs and NGHPs are as follows:

• For GHPs, the CMP is calculated as “$1,000 as adjusted annually under 45 CFR part 102 for each calendar day starting the day after 1 year (365 days) from the first instance of noncompliance, as defined in paragraph (b)(2)(i) of this section,” based on the number of beneficiaries whose records were reported late.

• For NGHPs, the CMP is calculated in tiers, with the penalty amount for each calendar day of noncompliance being $250 for late reporting in excess of one year but less than two years, $500 for late reporting in excess of two years but less than three years, and $1,000 for late reporting in excess of three years. The foregoing amounts are all subject to adjustment annually under 45 CFR part 2.

• The maximum penalty per individual is $365,000.

Random Audits. To motivate proper reporting and maintain compliance with existing statutes and regulations, CMS is adopting an audit approach whereby CMS will audit a randomized sample of 250 new beneficiary records received each quarter, rather than undertaking an automated review of all records submitted, as previously proposed. The audited records will be split between GHP and NGHP records in accordance with the pre-rate count of recently added records for both types of coverage over the calendar quarter under evaluation.

Safe Harbors. The Final Rule contains two express “safe harbors” for when a CMP will not be imposed:

• CMS will not impose a CMP when an RRE fails to report required information as a result of an inability to obtain “to obtain an individual’s last name, first name, date of birth, gender, Medicare Beneficiary Identifier (MBI), Social Security Number (SSN), or the last 5 digits of the SSN” and the RRE has requested the information in question from the individual at least three times.

• CMS will not impose a CMP when “[t]he incident of noncompliance is associated with a specific reporting policy or procedural change on the part of CMS that has been effective for less than 6 months following the implementation of that policy or procedural change (or for 1 year, should CMS be unable to provide a minimum of 6 months’ notice prior to implementing such changes).”

Statute of Limitations. Lastly, in response to comments, CMS affirmed that a five-year statute of limitations applies from the date when the alleged noncompliance occurred, as required by 28 U.S.C. § 2462.

The Final Rule is available here.