CMS webinar discusses NGHP Section 111 civil money penalties

By Mark Popolizio, J.D., Jeremy Farquhar

January 23, 2024 / 20 min read

On January 18, 2024, the Centers for Medicare and Medicaid Services (CMS) held a webinar to discuss the agency’s recently released Section 111 civil money penalties (CMPs) final rule regarding non-group health plans (NGHPs).^[1] This was CMS’s first NGHP webinar on this issue following release of its CMPs final rule on October 11, 2023.

cms nghp section 11

As part of this webinar, CMS discussed several different CMPs items, including, but not limited to, such topics as how CMPs will be calculated, the CMPs audit process, notice/appeal, and safe harbors. In addition, CMS provided important information on how it will assess timeliness and which claims may be in scope for CMPs.

The below provides a general overview of the key items addressed by CMS on this webinar:

Determining Timeliness

As a refresher, under the final rule, CMS may impose a CMP for untimely TPOC and ORM reporting. Per 42 C.F.R. 402.1(22)(i), CMS may impose CMPs in situations where the RRE “[f]ails to report any beneficiary record within 1 year from the date of the settlement, judgment, award, or other payment, or the effective date where on-going payment responsibility for medical care has been assumed by the entity.” Id.

On the webinar, CMS reiterated, as stated in the final rule, that it will compare the date of an RRE’s successful initial report with the latter of the submitted TPOC Date or Funding Delayed Beyond TPOC Start Date (when applicable).^[2] In the event that the latter of the two aforementioned dates is more than 1 year prior to the RRE’s initial successful report, the RRE will be considered non-compliant and may be subject to a penalty.^[3]Also, CMS noted that the submitted records must be accepted by CMS as part of its process of determining compliance. Records rejected due to errors will not be considered successful timely reports. Further, CMS noted that TPOC and ORM are considered separate reporting obligations for CMP purposes.

One issue regarding timeliness involves how CMS intends to calculate timeliness of an ORM report. Specifically, the final rule, as noted above, indicates that ORM timeliness will be measured from the “effective date where [ORM] has been assumed by [the RRE].”(authors’ emphasis).^[4]However, it is noted that CMS does not presently collect the date of ORM assumption via the Section 111 reporting process. At present, CMS only collects the Date of Incident via the Section 111 process, which can be significant since often times there can be a delay between the Date of Incident and the time as of which the determination to assume ORM is established. That being the case, the outstanding question headed into the webinar involved how CMS intends to assess the date of ORM assumption to utilize it in calculating timeliness of an ORM submission, given that it does not currently collect this information.

On the webinar, CMS did not specifically address this question or reference the fact that it does not currently collect the ORM assumption date. Rather, as part of its discussion, CMS stated that it will calculate timeliness of ORM reporting by comparing the Date of Incident with the date of the RRE’s initial successful ORM submission. In this regard, CMS stated that if the Date of Incident is found to be more than one year prior to the date of the initial successful report, the RRE would be considered non-compliant and potentially subject to a penalty. However, CMS indicated that in situations where there may be a delay in an RRE’s initial report of ORM, the RRE should present mitigating evidence to CMS as part of the “informal notice” process (see below) in support of the reason(s) for the delayed report. On this point, CMS stated they would consider all mitigating evidence submitted by the RRE and, if determined to be valid, would refrain from formally assessing a CMP in such scenarios.

Penalty Calculation (Tiered Approach)

CMS confirmed that it will use a tiered structure for calculating CMPs as outlined in its final rule.^[5] In general, under the final rule, the longer the delay in successfully reporting a required coverage, the higher the penalty amount. On the webinar, CMS confirmed that the current daily CMPs amount, adjusted for inflation, is $1,428.^[6] Thus, it is important to keep in mind that CMS’s CMPs penalty amounts are subject to yearly inflation adjustments.

CMS outlined the three tiers as follows: Tier 1: Submissions greater than 1 year, but less than 2 years late, may be assessed a penalty amount of $250 ($357 based on 2024 inflation-adjusted rates) per each calendar day of non-compliance. Tier 2: Submissions greater than 2 years but less than 3 years late may be assessed a penalty amount of $500 ($714 based on 2024 inflation-adjusted rates) per each calendar day of non-compliance. Tier 3: Submissions greater than 3 years late may be assessed a penalty amount of $1,000 ($1,428 based on 2024 inflation-adjusted rates) per each calendar day of non-compliance. In addition, CMS reiterated that the maximum CMPs amount for any single instance of noncompliance is $365,000 (to be adjusted annually for inflation).

Effective Date/Application Date/Scope

Regarding final rule dates, as a refresher, the Federal Register states that final rule is “effective” on December 11, 2023 (thus, the rule is now in “effect”), while October 11, 2024 is the rule’s “applicability date.”^[7] In relation to this, CMS issued an Alert stating, in part, that “RREs are expected to be compliant with their [Section 111 reporting requirements] no later than October 10, 2024, or they may be eligible for a CMP.”^[8] CMS then released an FAQ document in early November 2023 noting, in part, that the “earliest a CMP may be imposed is October 2025.”^[9]

During the webinar, CMS reiterated the above dates and also provided some additional information. Specifically, CMS noted that October 11, 2024 (the rule’s “applicability date”) is the date the clock will begin ticking for calculating timeliness of an RRE’s submissions, while October 11, 2025 is the date when it will begin its compliance review. In addition, CMS noted that April 1, 2026 is the date that quarterly randomized audits of RRE’s coverage records submitted via the prior calendar quarter will commence.

Overall, the above helps shed some light on certain relevant dates pertaining to the final rule. However, what remained unclear heading into the webinar, based on the authors’ review of the final rule and the FAQ, was exactly which records could be in scope for penalties. The questions being: (1) Are only ORM effective dates, or TPOC dates, AFTER 12/11/23 in scope for penalties? OR (2) Are ORM effective dates, or TPOC dates, prior to 12/11/23 in scope for penalties where timeliness of reporting will only be calculated as of 12/11/23 forward?

CMS provided additional information related to these questions on the webinar. As part of this, and significantly, CMS referenced that the rule’s applicability date will be utilized in terms of assessing timeliness. In this regard, it is noted that this particular information has not been published in the Federal Register or CMS’s related CMPs publications to date.

On this point, CMS stated, that October 11, 2024, as referenced above, is the date the clock would start running in terms of calculating timeliness of submissions. In addition, and significantly, CMS indicated that only coverage record submissions with coverage effective dates or TPOC dates of October 11, 2024 or later would be in scope for penalties and, as such, the agency would not seek to assess penalties for submissions where the coverage effective dates or TPOC dates occurred prior to October 11, 2024. The information provided by CMS on this point, from the author’s perspective, was arguably the most important item pending CMS clarification heading into the webinar.

While CMS’s clarification regarding which claims are in scope for potential penalties, as noted above, will likely be viewed favorably by most observers, from a technical standpoint it is interesting to note that the information provided by CMS on this point during the webinar could be viewed as contradicting the language contained in its final rule in certain respects. In this regard, there are two interesting points for consideration.

First, as noted above, CMS will be utilizing the rule’s applicability date for assessing timeliness and scope in place of the rule’s effective date as referenced in the Federal Register. ^[10]

Second, CMS’s statements on the webinar regarding scope appears to contradict information CMS published in Part II of the final rule (Provisions of the Proposed Rule and Analysis of and Responses to Public Comments) that bases which claims may be in scope for penalties off the rule’s “effective” date through two different (and contradictory) passages For example, in one part of this section CMS states that “CMPs will only be imposed on instances of noncompliance based on those settlement dates, coverage effective dates, or other operative dates that occur after the effective date of this regulation and as such, there will be no instances of inadvertent or de facto retroactivity of CMPs.”(authors’ emphasis).^[11] While in another part of the same section, CMS states that “[t]he 1-year period to report the required information before CMPs would potentially be imposed would begin on the latter of the rule effective date or the settlement or coverage effective dates which an RRE is required to report in accordance with sections 1862(b)(7) and (b)(8) of the Act.” [authors’ emphasis].^[12]

In both these instances, CMS statements in the final rule reference the rule’s “effective” date, and not the rule’s “applicability” date as CMS discussed on the webinar, as the basis to measure timeliness. From another angle, it also interesting to note, as the authors have referenced in prior articles, that these statements in the final rule would appear to lead to different results in terms of which claims may be in scope for CMPs. For example, in looking at the first passage above, this verbiage would seem to indicate that any coverages for which settlement or coverage effective dates occur prior to the 12/11/23 effective date of the rule would not be in scope for penalties. By contrast, the second excerpt above could be read to indicate that the 1-year timely reporting window would be calculated based on the latter of the rule effective date or settlement or coverage effective dates. Thus, this could be interpreted to imply that settlement or coverage effective dates occurring prior to the rule effective date are in scope for assessment of penalties but that the clock doesn’t begin ticking in terms of timely reporting of those coverages until the rule effective date.

When the dust settles, this appears to set up an interesting situation where there may be a conflict between CMS’s oral statements made on the webinar regarding the scope question (which can be viewed as being more favorable for the industry) and the actual published verbiage in the final rule. This, in turn, raises the issue regarding what information provided by CMS controls the question, especially given that CMS issues a disclaimer at the start of its webinars (including this webinar) emphasizing that its published guidance takes precedence in situations where the information it provides during a webinar may conflict with what is stated in its published materials.

Audit Process

CMS confirmed that it will review a random selection of 250 newly and accepted records per quarter (1,000 records per year) using a pro rata selection between records received from NGHP and GHP RREs. Of note, CMS indicated (as it first noted in its recent FAQ resource) that both Section 111 records and records received outside of the Section 111 reporting process will be included as part of its random selection.^[13] On this latter point, CMS referenced, as examples, “self-reports” (coverage records created manually based on phone calls to the BCRC, written correspondence or via case reporting functionality within the MSPRP) as non-Section 111 records which may be used as part of the audit process. Also, CMS advised that while it may use its contractors to help gather data or for other administrative functions, it will be CMS that ultimately makes all substantive decisions regarding CMPs.

Safe Harbors

CMS addressed, very generally, its good faith compliance safe harbor related to an RRE’s efforts to obtain the Big 5 data points (claimant’s first name, last name, date of birth, gender, and social security number, Medicare beneficiary identifier, or health insurance claim number). Very generally, as stated in 42 CFR 402.1(c)(ii)(A), the RRE must make at least three attempts to obtain this information from “the individual and his or her attorney, or other representative, if applicable, or both” as follows: “(i) Once in writing (including electronic mail); (ii) Then at least once more by mail; and (iii) At least once more by phone or other means of contact in the absence of a response to the mailings.” 42 CFR 402.1(c)(ii)(A). Under the final rule, the RRE may cease requesting this information if they “receive a written response from the individual or their attorney or representative that clearly and unambiguously declines or refuses to provide any portion of the information specified herein …” Id. The full text of CMS’s good faith compliance “safe harbor” can be viewed here.

On the webinar, CMS discussed the above in general terms, referencing the requirement of three attempts and noting that the RRE can stop requesting this information if they receive a written response that “clearly and unambiguously” reflects that this information will not be provided. Of note, CMS did not undertake an exacting review of the regulatory language or address some specific points which have raised concerns with some RREs. For example, CMS did not comment on the regulatory language requiring the RRE to request the information from both the claimant and his or her attorney, or other representative which, from the authors’ experience, has raised concerns with some RREs about contacting a represented claimant. As another example, CMS did not make comments regarding whether the three attempt methods referenced in the regulation had to be made in a specific order, which is another question the authors have received from RREs.

On other fronts, CMS noted that it will not impose CMPs where non-compliance is beyond the RRE’s control. As an example, CMS noted the existing policy timeframes for a claimant to report an accident. CMS also noted that it will provide a minimum of 6-month advance notice of any changes to its reporting requirements or processes before it will levy CMPs against an RRE.

Notice/Appeal

CMS confirmed that it will first send RREs written “informal” notice that CMS has identified a non-compliant record. CMS clarified that this letter will be e-mailed to the RRE’s Authorized Representative with a “cc” copy sent to the RRE’s Account Manager. As part of this notice, CMS will provide information regarding the identified non-compliant record. RREs will then have 30 calendar days from receipt of the informal notice to present mitigating evidence.

If CMS intends to levy a CMP, it will send “formal” written notice to the RRE via certified mail. CMS’s formal notice will advise the RRE that the agency is imposing a CMP and reference that the RRE has the right to appeal CMS’s CMP imposition. CMS did not specifically state to whom this notice will be sent. While it would seem logical that this notice would also go to the RRE’s Authorized Representatives, with a possible copy to the Account Manager, using the physical addresses maintained in the RRE's Section 111 profile report, this information was not discussed by the CMS presenters.

Statute of Limitations

As part of the final rule CMS stated that it “will apply the 5-year statute of limitations (SOL) as required by 28 U.S.C. 2462. Under 28 U.S.C. 2462, we may only impose a CMP within 5 years from the date when the noncompliance occurred.”^[14]On the webinar, CMS confirmed that it will use the 5-year SOL under 28 U.S.C. 2462. In this regard, CMS stated that the clock begins to run when the record is actually reported, or when it obtains information that could reasonably lead to the discovery of noncompliance. On this latter point, CMS, as an example, referenced a corresponding self-report.

Other Items

In addition to the topics outlined above, CMS provided further information and/or clarification regarding a number of other topics during the question and answer portion of the session. Some of the most notable items discussed included the following:

CMS’s current compliance flag process

By way of brief background, as a long-standing part of the Section 111 reporting process, CMS has returned compliance flags in relation to what had historically been viewed as late TPOC and ORM Termination Date submissions. Prior to publication of CMS’s final rule, the timeframe within which a TPOC or an ORM Termination Date had been required to be reported to be considered a timely submission was 135 days. However, under the final rule, CMS has significantly expanded the timeframe within which a TPOC must be reported from 135 to 365 days (1 year). Also, while a compliance flag is generated in relation to ORM Termination Dates submitted more than 135 days subsequent to ORM termination, CMS’s final rule does not include penalties in relation to late ORM termination reporting. Furthermore, CMS does not currently return compliance flags in relation to untimely initial ORM reports.

Taking the above into consideration, one of the questions CMS fielded during the webinar was in relation to this current compliance flag process. Specifically, the question presented to CMS was whether the agency would be updating their compliance flag process to only generate a flag when a TPOC had been submitted more than 1 year late as opposed to 135 days, whether the ORM termination related compliance flag would be removed and whether a new flag might be introduced in reference to initial timely reports of ORM. Somewhat surprisingly, CMS indicated that it has no plans for updates to the current compliance flag process. CMS simply intends to continue generating the same TPOC and ORM termination related compliance flags using the longstanding 135 day timely submission guidelines.

Failures to successfully report coverages due to incorrect beneficiary personal identifying information

Another question fielded by CMS was in relation to scenarios where an RRE may have had incorrect personal identifying information (PII) for a claimant/beneficiary which resulted in a non-matching beneficiary response and subsequent failure to submit a required coverage report. A webinar attendee asked CMS if an RRE would be penalized if their failure to report was due to inaccurate beneficiary PII. Historically, when asked similar questions in a more general sense, CMS had typically indicated that incorrect beneficiary PII did not provide cover for an RRE if/when it may have resulted in a failure to successfully submit a required coverage report. However, when fielding this question during the webinar session, CMS suggested that, should a failure to report in such a scenario result in a coverage being identified as potentially warranting assessment of a CMP, that the RRE should provide CMS with additional details and any mitigating evidence via the informal notification process. On this point, CMS indicated that it would take the information provided into consideration.

CMS Section 111 reporting exceptions relating to global resolution scenarios

Another attendee question related to scenarios in which CMS may have agreed to grant a Section 111 reporting exception in relation to global resolution situations. Occasionally, from the authors’ experience, CMS has historically agreed to sort out more complex global resolution scenarios and associated conditional payment recovery separate and apart from the Section 111 mandatory reporting process. One of the more commonly occurring examples of such relates to a process referred to as AMP (Asbestos Malignancy Alternative Resolution Process). When a global resolution is addressed with CMS in this fashion, outside their standard defined processes, the agency has granted an exception to the Section 111 reporting process for the claims in question and their associated RREs.

The attendee’s question was whether these exceptions would continue to be honored and whether the associated RRE would be shielded from assessment of a CMP. CMS responded by indicating that the newly published CMP regulations would not impact any of these prior or future agreements/exceptions. CMS also noted that it intends to publish more specific guidance in relation to these scenarios in an upcoming NGHP User Guide update. This is notable as these agreements and exceptions granted are not something CMS has published information on in the past and, as a result, the process has often seemed quite mysterious from the perspective of many NGHP RREs. Any official publication of information regarding these types of scenarios will likely be welcomed and appreciated by many RREs and it should be quite interesting to see what any future published guidance may provide in regard to these processes in a general sense.

Future Guidance

CMS noted that it plans to issue an updated NGHP User Guide in the future and that a new CMS.gov webpage will also be developed in the future specific to the CMP process. CMS also noted that it plans to hold additional CMPs webinars.

RRE Questions/Comments for CMS

CMS directed RREs to submit questions or comments to CMS’s resource mailbox: sec11cmp@cms.hhs.gov

Questions?

Of course, do not hesitate to contact us if you have any questions. Please feel free to also review Verisk’s Section 111 CMPs resources for more information on Section 111 CMPS.

[1] As used by CMS in the Section 111 context, NGHPs include liability insurance (including self-insurance), no-fault insurance, and workers’ compensation as defined by CMS. For more information, see CMS’s NGHP Section 111 website: https://www.cms.gov/medicare/coordination-benefits-recovery/mandatory-insurer-reporting/user-guide

[2] Fed. Reg. Vol. 88, No. 195, at 70370 (October 11, 2023).

[3] 42 C.F.R. 402.1(22)(i).

[4] 42 C.F.R. 402.1(22)(i)

[5] See CMS’s discussion of its tiered penalty approach in the Final Rule at Fed. Reg. Vol. 88, No. 195, at 70370 (October 11, 2023).

[6] Fed. Reg. Vol. 88, No. 226, at 82786 (November 27, 2023).

[7] Fed. Reg. Vol. 88, No. 195, at 70363 (October 11, 2023).

[8] See, CMS’s alert.

[9] See CMS’s Section 111 CMPs FAQ document (November 2, 2023), Medicare Secondary Payer and Certain Civil Money Penalties: Frequently Asked Questions CMS’s FAQ on this point reads, in full, as follows: Q. When will CMS issue the first penalties under this rule? A. The earliest a CMP may be imposed is October 2025. The 1-year period to report the required information before CMPs would potentially be imposed would begin on the latter of the rule effective date or the settlement or coverage effective dates which an RRE is required to report in accordance with sections 1862(b)(7) and (b)(8) of the Act. There will be no “look back” period and all penalties will be prospective in nature.

[10] On this point, the final rule notes the “effective” date of the rule as December 11, 2023. Fed. Reg. Vol. 88, No. 195, at 70363 (October 11, 2023). Further, as discussed more fully in this section of the article, in Part II of the rule (Provisions of the Proposed Rule and Analysis of and Reponses to Public Comments) CMS discusses the imposition of CMPs referencing the rule’s “effective” date. Id. at 70364-70369.

[11] Fed. Reg. Vol. 88, No. 195, at 70368 (October 11, 2023).

[12] Fed. Reg. Vol. 88, No. 195, at 70368 (October 11, 2023).

[13] See our article on CMS’s FAQ resource: https://www.verisk.com/insurance/visualize/cms-releases-new-section-111-penalties-faq-resource/

[14] Fed. Reg. Vol. 88, No. 195, at 70367-68 (October 11, 2023). Regarding potential application of the five-year limitations period, CMS provides the following example in the final rule: “An explanation and example of how this 5-year statute of limitations will apply is as follows: For failure to initially report the date of settlement or effective date of coverage timely (where applicable), noncompliance occurs on every day of non-reporting after the required timeframe for reporting has elapsed. For example, if the date of settlement is January 1, 2025, then the RRE will have 1 year from that date to report the coverage before being potentially subject to a CMP (that is, January 1, 2026). If the settlement date was January 1, 2025, but the RRE did not report it to CMS until October 15, 2026, the RRE will be considered noncompliant for the period of January 2, 2026, through October 15, 2026. If CMS does not act until after October 15, 2031, then the statute of limitations has elapsed and no CMP may be imposed.” Id.