Blog

The Takeaway

To avoid civil money penalties, Medicare Secondary Payers should report claims data to CMS in a timely, accurate, and complete manner. Recommended best practices to ensure that happens include establishing an overall claims resolution process that incorporates these steps:

• identifying claimants that are Medicare beneficiaries
• seeking necessary reporting information
• documenting unsuccessful efforts to obtain this information
• establishing the infrastructure to submit reports by their deadlines
• auditing claims before the initial one-year reporting window closes

Introduction

The Centers for Medicare & Medicaid Services (CMS) recently released its long-awaited regulations on civil money penalties (CMP) that will be imposed when entities fail to meet their reporting obligations. The Final Rule comes after significant deliberation and feedback from interested parties.

This article discusses the provisions of the Final Rule, CMS’ extensive analysis describing its thought process behind the requirements, and best practices for compliance. The focus is on the aspects of the Final Rule that apply to Non-Group Health Plans (NGHPs). These include liability insurance (including self-insurance), no-fault insurance, and workers compensation plans. (Aspects applicable to Group Health Plans (GHPs) are outside the scope of this article.)

Background

Since 2007, entities have been required to report settlements, judgments, awards, or other payments that resolve personal injury claims with Medicare beneficiaries. This requirement was implemented to support the Medicare Secondary Payer (MSP) statute first enacted in 1981 and to facilitate reimbursement of Medicare when appropriate. The Medicare, Medicaid, and S-CHIP Extension Act (MMSEA) of 2007 also imposed significant mandatory money penalties for failing to report when required. The SMART Act of 2012 made these penalties discretionary for NGHPs and required CMS to promulgate rules detailing when the penalties would be imposed for not reporting. Stakeholders have waited years for a Final Rule from CMS.

CMS published an Advanced Notice of Proposed Rulemaking in 2013 and a Proposed Rule (entitled Medicare Secondary Payer and Certain Civil Money Penalties) in February 2020. Each of these steps prompted considerable discussion. In October 2023, CMS issued its much-anticipated Final Rule pertaining to Medicare Secondary Payer reporting penalties.

The Final Rule

The Final Rule specifies how and when CMS must determine and impose CMPs when Responsible Reporting Entities (RREs) fail to meet their MSP reporting obligations. It also establishes CMP amounts and the circumstances under which CMPs will not be imposed.

CMS will impose CMPs on RREs when they fail to timely report certain settlements, judgments, awards, or other payments to a Medicare beneficiary. A beneficiary record will be considered timely reported when CMS receives it: (1) within one year of the date of settlement or payment or (2) within one year of the effective date when an RRE assumes ongoing payment responsibility for medical care.

However, untimely reporting itself does not necessarily mean a CMP will be imposed. Rather than an automated review of all records submitted, CMS will review 250 randomly selected beneficiary records every quarter. Those records will be comprised of a pro-rata number of GHP and NGHP records. A CMP will only be imposed if an audited record is found to be noncompliant with its reporting obligations.

Safe Harbors from Penalties

Several safe harbors may preclude the imposition of a CMP—even where an entity is audited and found to be noncompliant. These include:

• any untimely reporting caused by either a technical or system issue or an error by CMS or its contractors
• any untimely reporting by an NGHP when its failure to acquire the necessary reporting information was a result of a lack of cooperation by the beneficiary. (To verify its good faith efforts to obtain the information, an NGHP must document three attempts to obtain the necessary reporting information, at least two of which must be by mail or electronic mail. However, if a beneficiary affirmatively refuses in writing to provide the necessary reporting information, no further attempts are required.)
• if a reporting entity complies with any settlement reporting thresholds or any other reporting exclusions published in CMS’s MMSEA Section 111 User Guide or otherwise established by CMS

The Process and the Penalties

Before CMS issues a formal notice regarding a CMP, it will communicate with the reporting entity regarding any untimely reporting. This informal “pre-notice” process allows the reporting entity an opportunity to clarify, explain, or offer mitigating information regarding the timing of its report. CMS has indicated its intent to “find solutions that are short of imposing a CMP,” and as such it does not enumerate what kind of mitigating information may be presented during the pre-notice period. Rather, CMS is “open to any reasonable submission of mitigating factors.”

If informal pre-notice discussions do not resolve the issue, CMS may send a formal notice of a CMP. A reporting entity can then request a hearing before an administrative law judge within 60 days of its receipt of the formal notice to present arguments why a CMP should not be imposed. After that, reporting entities also have further appeal rights.

A GHP will incur a mandatory CMP of $1,000 per day* for each day of noncompliance. On the other hand, CMS will use a tiered approach to determine the CMP for an NGHP.

* All penalty amounts will be adjusted annually for inflation.

The Final Rule was effective December 11, 2023, which was 60 days after it was published. However, no CMPs will be imposed until at least October 11, 2024, one year after the Rule was published. The Final Rule is prospective in nature; therefore, no CMP will be imposed on an entity for prior noncompliance. There is a five-year statute of limitations for CMS to impose CMPs beginning on the first date of noncompliance.

Differences Between the Final Rule and the 2020 Proposal

CMS’ Final Rule deviates from its 2020 proposed rule in several significant ways. First, the Final Rule eliminated two CMP-triggering events. CMS will not establish an “error tolerance” and will not issue a CMP for an excessive number of errors in an entity’s reports. Also, CMS will not impose a penalty when an entity provides information during the recovery process that is contradictory to what it originally reported. The only CMP trigger established in the Final Rule is untimely reporting, defined as being beyond one year after the obligation to report.

The Final Rule expands the concept of “good faith” attempts to comply with reporting obligations. A party must make three attempts to obtain the claimant’s personal identifier information necessary to report to CMS. The first two attempts must be either by mail or electronic mail, and the third attempt may be by telephone, electronic mail, or another reasonable method. The Final Rule relieves a party of the obligation to continue to seek the information if the claimant clearly states in writing its refusal to provide the requested information. The Final Rule expands the circumstances under which this safe harbor is available to an entity when it can’t obtain the required information.

Furthermore, the Final Rule clarifies when the five-year statute of limitations for issuing a CMP begins. Under the proposed rule, the statute of limitations period would have begun when CMS identified the reporting noncompliance. The Final Rule, however, states that the five-year statute of limitations period begins when the non-compliance occurred. That means the statute period is based on the deadline when the report was due. This clarification provides much needed certainty for reporting entities that contest CMPs.

Lastly, the tiered approach to the amounts of the CMP is a break from the proposed rule. CMS initially intended to match the amount of the discretionary penalties imposed on NGHPs to the amount of the mandatory penalties imposed on GHPs. However, CMS ultimately chose to exercise the discretion given to it in the SMART Act by imposing graduated penalties based on the length of time an NGHP was non-compliant. This approach is another indication that CMS is intent on adhering to its stated goal with the Final Rule: “to motivate proper reporting and maintain compliance with existing statute and regulation” rather than to “punish and impose consequences.”

Best Practices

CMS stressed that the Final Rule will only be applied prospectively. To this end, CMS will only evaluate compliance of claims reported on or after the effective date of the Rule: December 11, 2023. It also states that the one-year period to report claims will begin on the later of the Rule’s effective date or the date the entity is required to report. This means that for reportable claims resolved before the effective date of the Final Rule, the one-year reporting window began on December 11, 2023. It is recommended that these claims be audited before their one-year reporting window closes to ensure that they either have been or will be timely reported.

It is also recommended that entities review their overall claim resolution process to ensure mechanisms are in place to perform the necessary steps to report when required. These steps include:

• identifying claimants that are Medicare beneficiaries
• seeking the necessary reporting information
• documenting unsuccessful efforts to obtain this information
• establishing the infrastructure to submit reports by their deadline

Conclusion

The Final Rule (which is available on the Federal Register) is the culmination of efforts by CMS and many other stakeholders that spans more than a decade. The certainty provided will greatly benefit efforts to comply with the MSP reporting requirements. It provides bright lines that were previously lacking for those involved.