CMS Holds its Third NGHP Section 111 Penalties Webinar

By Mark Popolizio, J.D., Jeremy Farquhar

January 20, 2026 / 17 min read

On January 15^th, the Centers for Medicare and Medicaid Services (CMS) held its third non-group health plan (NGHP) Section 111 civil money penalties (CMPs) webinar. As part of this hour-long event, CMS discussed several different CMPs-related items pertaining to NGHP Responsible Reporting Entities (RREs).

As part of this webinar, CMS covered much of the guidance it had previously discussed as part of its prior January 18, 2024 webinar and October 17, 2024 webinar, as well as its CMPs webpage released in October 2024.^[1]In addition, CMS provided some new information regarding its CMPs process and related items as outlined below.

CMS 3rd NCHP S111 1.26 Webinar GettyImages-2121266631

The authors attended CMS’s January 15^th webinar and provide this general, non-exhaustive, topical overview of the key points discussed by CMS as follows:

Timely Reporting

Regarding TPOC reports, CMS reiterated that an RRE’s Section 111 report is considered timely if their coverage record is reported within 365 days of the date of the settlement, judgment award or other payment (TPOC Date) or the Funding Delayed Beyond TPOC Start Date (if applicable).

Regarding ORM reports, CMS reiterated that an RRE’s Section 111 report is considered timely if their coverage record is reported within 365 days of the date ORM is assumed. As a reminder, CMS will calculate timelines of an ORM report based on the Date of Incident (DOI), or the date that the associated beneficiary became entitled to Medicare if entitlement occurred after the DOI. On this point, CMS again acknowledged that there may be scenarios in which the RRE may have not assumed ORM (for a number of potential reasons) immediately as of the DOI and stressed that, in such instances, if an RRE feels CMS has identified their report as untimely in error, then the RRE should provide CMS with mitigating evidence as part of the informal notice process outlined below. In this regard, as CMS has indicated in the past, and as discussed further below, CMS noted that if it accepts the submitted mitigating evidence as valid, then a CMP will not be imposed.

Key Dates

CMS outlined several “key dates” and provided the following information:

10/11/25 – CMS referenced this date as CMPs “enforcement date” for No-Fault and Liability records.
February 2026 – This is CMS’s anticipated completion of its first CMPs audit as part of its randomized quarterly audit process which began in January 2026. On this point, CMS stated that its first audit will consist of a random sample of 250 new, accepted records from the 4^th quarter of 2025 (after 10/11/25) divided proportionately between GHP and NGHP records. In this regard, CMS provided more specificity as to exactly when it anticipates completing its first CMPs audit following the commencement of its quarterly audit process which, as noted above, began in January 2026. (Authors Note: CMS’s CMPs webpage states CMS’s audits will include both Section 111 and non-Section 111 records as outlined more fully in the endnote to this sentence).^[2]
March 2026 – CMS noted that this is the date is the earliest mailing of an “informal notice” of a CMP if a record is deemed non-compliant. In doing so, CMS provided additional specificity on this point in relation to its randomized quarterly audit process which began in January 2026.
July 2026 – CMS referenced this date as the CMP “eligibility date” for WC records with settlements occurring on or after July 2026. CMS notes this was delayed due to the implementation of the new TPOC/WCMSA related reporting requirements which took effect in April of 2025. This is in keeping with the guidance which CMS provided via its final rule publication indicating that the agency “will not assess any CMPs associated with a specific change for a minimum of 2 reporting periods following the implementation (effective date) of that policy or procedural change.”^[3]

RRE Contacts & CMPs Mailings

CMS reiterated that RREs will be held accountable if they miss CMP correspondence due to inaccurate or outdated contact information, and that inaccurate contact information will not be an accepted excuse to avoid assessment of a penalty. CMS instructed RREs to contact their EDI rep if they need to replace or update its Account Representative (AR) or Account Manager (AM) information. Alternatively, CMS suggested that the RRE could update their AR and/or AM information via the Section 111 COBSW (Coordination of Benefits Secure Website).

CMPs Correspondence

Regarding CMP mailings, CMS reiterated that these will be sent to the AR of record, with a copy to the AM. CMS again noted that reporting agents and Account Designees will not receive CMP correspondence. In addition, CMS reiterated that it will only contact the RRE if it has identified a non-compliant record as part of its random quarterly audits. Further, CMS noted that each identified non-compliant record will be separately addressed under its own cover on official CMS and COB&R letterhead.

Rejected Records

As a part of the Q & A session CMS received a question suggesting that an RRE’s records had recently been rejected for invalid ICD codes where the codes in question were included on CMS’s current accepted ICD-10 codes listing. CMS instructed RREs that, if they feel a record had been rejected in error, for whatever reason, they should contact their assigned EDI Rep to determine the cause of the error. However, CMS also noted that the RRE is expected to resubmit a corrected record within 365 days of the MSP occurrence to avoid potential assessment of a CMP.

Common Errors

CMS referenced TIN errors and issues with ICD Codes as two of the most common errors. Regarding TIN errors, CMS noted that the common errors relate to invalid addresses and recommended that RREs use the USPS website to try and verify their TIN addresses prior to submission to hopefully avoid these types of errors. CMS instructed RREs to correct and resubmit TIN records in a timely manner. As for ICD Codes, CMS reminded RREs that at least one valid ICD code must be reported for the record to be accepted and that codes on the Section 111 excluded code listing should not be utilized. CMS referred RREs to its ICD-10 Valid and Excluded Diagnosis Code listings to appropriately determine which codes are accepted for use via the Section 111 process.

CMS’s Informal and Formal Notice

CMS outlined the CMPs notice process as follows:

Informal Notice: This advises the RRE of CMS’s intention to impose a CMP. This notice will provide the RRE with CMS’s basis for the CMP and a summary of the non-compliant record. The RRE may then submit mitigating evidence to CMS as to why they feel they should not be penalized. CMS stressed that mitigating evidence could be anything the RRE feels supports their argument. Importantly, however, CMS noted that it must receive mitigating evidence within 30 calendar days. If CMS accepts the RRE’s mitigating evidence, then a CMP will not be imposed and no additional action will be required. CMS noted that its decision not to impose a CMP pertains only to the RRE’s non-compliant record as identified in the Informal Notice.
Formal Notice: CMS will issue a formal notice, called a Notice of Proposed Determination to Impose a Civil Money Penalty (“Proposed Determination”) when (a) the RRE did not submit mitigating evidence (or it was submitted untimely) or (b) CMS deemed the RRE’s mitigating evidence as insufficient. CMS’s formal notice proposes to issue a CMP and provides RREs with instructions on how to file an appeal.

Appeal Rights

CMS noted the following regarding RRE appeal rights:

ALJ Hearing: RREs may electronically request a hearing with an Administrative Law Judge (ALJ) within 60 calendar days from the receipt of CMS’s Proposed Determination as referenced above.
DAB Appeal: RREs may appeal the ALJ’s initial decision to the Departmental Appeal Board (DAB) Appellate Division within 30 calendar days of the ALJ decision.
Judicial Review: RREs may file a petition for judicial review within 30 calendar days of the DAB decision, otherwise the DAB’s decision becomes binding.

Making CMPs Payment

CMS will issue a Notice of Final Determination (“Final Determination”) to obtain actual CMPs payment from the RRE. CMS noted that it will issue a Final Determination when the RRE (a) did not file an appeal; or (b) exhausted its appeal rights. The CMPs amount noted in the Final Determination is the final CMP amount to be paid. Payment is due within 60 days.

Regarding actual payment, CMS advised that RREs must remit payment electronically via Pay.gov eBill. CMS will provide instructions on account creation and the payment process as part of its Final Determination correspondence.

As part of the Q & A session, CMS confirmed that it will only accept CMPs payment via Pay.gov eBill pursuant to an Executive Order (Executive Order 14247) as issued last year by President Trump.^[4] Very generally, this Executive Order aims to reduce the U.S. Federal Government’s use of paper checks and transition towards electronic payments. In addition, as part of CMS’s discussion on this point, they suggested that electronic payments may also be required at some point in the future for conditional payment reimbursement. As an aside, Verisk reached out to CMS’s BCRC and CRC contractors last year regarding this order and was advised by these entities that, at that time, there were no known plans to cease accepting payments via paper checks for conditional payment reimbursement as more fully discussed in our recent article provided in the endnote to this sentence.^[5]Thus, this will be an issue to monitor going forward regarding conditional payment recovery. However, in the meantime, when it comes to CMPs payment, the RRE will need to remit payment electronically via Pay.gov eBill as noted above.

CMPs Amount to be Paid

CMS did not review current CMPs rates as part of its presentation.^[6]However, CMS noted that, in terms of the monetary CMPs amount the RRE must pay, this will be based on the effective CMPs inflation adjusted amount at the time CMS’s initial audit occurs. On this point, CMS explained that if there is a subsequent inflationary adjustment to the CMPs rates before the RRE makes payment, the amount the RRE will pay will be based on the adjusted CMPs amount in place at the time of CMS’s initial audit, and not the subsequently increased rate. Similarly, CMS also explained that, while there would be time which would pass between the occurrence of the initial audit and when a CMP would be formally assessed, the clock would stop ticking in terms of the daily penalty calculation as of the date the non-compliance was identified via the initial audit.

CMS’s “Good Faith” Compliance Safe Harbor

CMS also revisited its “good faith” compliance safe harbor regarding situations where the RRE is unable to obtain the Big 5 data points [claimant’s SSN or Medicare ID (MBI or HICN) along with first name, last name, date of birth and gender] to help determine potential Section 111 reporting obligations. For the reader’s convenience, the full regulatory text of CMS’s good faith safe harbor can be viewed here.

As part of the January 15^th webinar, CMS noted the following regarding its good faith safe harbor criteria:

RREs are required to make three (3) attempts to obtain the Big 5 data points and maintain accurate records reflecting each communication attempt. (Authors’ note: the regulatory text indicates that the RRE must maintain records as more specifically outlined in the regulation for a minimum of 5 years).^[7]
Regarding the three attempts, CMS noted the following:
- 2 attempts must be in writing, mailed or e-mailed, to the individual and their attorney.^[8]
- 1 attempt can be made via phone call, mail, or e-mail.
- The order of the attempts does not matter, only that 2 attempts were made in writing.
- The safe harbor has been satisfied if the necessary methods of communication were attempted.
If the RRE receives a written response from the individual or his/her representative clearly refusing to provide any portion of the Big 5 data, then no additional communication attempts are required.^[9]

In addition to the above, CMS reiterated that the attempts must be made to the individual and his/her attorney noting that, from its perspective, any ethical concerns about contacting a represented party are inapplicable in this context under Federal law. Related to this point, during the Q&A, CMS provided some information that RREs may find helpful. Specifically, CMS noted that in a situation where the RRE reaches out to the attorney and the attorney refuses, in writing, to provide the requested information, that written refusal is sufficient and the RRE would not need to reach out to the claimant in that scenario. However, if the attorney does not respond at all, CMS noted that it would then be necessary for the RRE to request the information from the claimant.

Other Potential Points of Interest

New RRE assumes reporting responsibilities from another RRE – calculating timeliness

During the Q & A session, an attendee asked whether the clock for calculating timeliness of reporting would be “reset” if a claim changed hands to a new RRE and was then rereported by a new RRE. In response, CMS suggested that the clock would not reset and that timeliness of reporting would still be calculated the same based on the initial date of the MSP occurrence in question.

However, in considering this response, from the authors’ perspective, it seems that this may be a point that will require further clarification from CMS. More specifically, on certain occasions, one RRE may take over responsibility for handling claims from another RRE. This could happen at any time throughout the lifespan of a claim and may often be more than a year after the initial MSP occurrence in connection with the original RRE.

When this occurs, in ORM scenarios where ORM remains open as of the time responsibility for the claim(s) changed hands, the insurer/RRE taking over responsibility for the claim(s) would be required to re-report the claim(s) at that time. In such an instance, the new RRE would not have had responsibility for the claim(s) in question at the point in time the MSP was initially established and, if that responsibility changes hands more than a year subsequent to the initial occurrence of MSP, it would seem inappropriate, from the authors’ view, for CMS to attempt to assess a penalty on the new RRE if they were to successfully report within a year from the point in time that they became responsible for the claim(s) in question. Should this occur, and the RRE provides appropriate mitigating evidence timely, it could be argued that CMS should refrain from assessing a penalty. It will be interesting to see how CMS handles these scenarios moving forward and this may be a point for seeking further CMS clarification.

CMS data regarding identified and assessed CMPs

Another question CMS received was in relation to whether the agency has plans to publish any information about CMPs which are ultimately identified and assessed. In answering this question, CMS suggested that it does eventually intend to publish some type of “rolled up” information regarding CMP assessment but that it will likely take some time before enough data is accrued to do so and there was no specific information shared about what the publication may actually entail. This may be another interesting item to watch as the CMP process moves forward.

Publication of CMS’s Presentation

CMS noted that it will post a copy of the presentation it used as part of its January 15^th webinar to its Mandatory Insurer Reporting (NGHP) What’s New webpage in the near future. Thus, the reader may want to periodically check the above webpage to obtain a copy of the presentation once posted by CMS. Readers may also consider signing up to receive email notifications regarding CMS published updates via the “Get email updates” option available at the bottom of the above webpage.

Submitting Questions to CMS

CMS directed the attendees to submit any comments or questions to: sec111cmp@cms.hhs.gov

How Verisk Can Help

If you have any questions, feel free to contact the authors. As additional resources, please see Verisk’s Section 111 CMPs FAQ Resource and Verisk’s Section 111 Audits Article.

[1] As noted, CMS held its first Section 111 CMPs webinar on January 18, 2024. See our article summary: CMS’s NGHP Section 111 penalties webinar – January 18, 2024. CMS’s second CMPs webinar was held on October 17, 2024. See our article summary: CMS’s NGHP Section 111 penalties webinar – October 17, 2024. As additional resources, CMS has posted the power points it used on these prior webinars on its Mandatory Insurer Reporting (NGHP) web page: What's New | CMS

[2] CMS’s NGHP Civil Money Penalties Webpage, Section: Review of Records to Identify Non-Compliance. On this point, CMS’s CMPs webpage states, in pertinent part, as follows: “Note: The 250 randomly selected records will include both Section 111 and non-Section 111 records. A non-Section 111 record is defined as a TPOC and/or ORM record that has been reported via other coordination of benefits and data collection methods. For the purposes of CMS’ audit, any non-Section 111 records captured are those that were reported the same quarter CMS is reviewing, but from the prior year, since RREs are required to report within 1 year (365 days) of the latter of either the Settlement Date reported in ‘Field 80’ or the Funding Delayed Beyond TPOC Date reported in ‘Field 82’ AND the MSP Effective Date and ORM are selected as ‘Y’.” Id.

See also, CMS’s NGHP Civil Money Penalties Webpage, Section: Penalty Amounts. This section states, in pertinent part: “Non-Section 111 records are also a factor in the determination of timely reporting. A non-Section 111 record that is reported and accepted but does not have a corresponding Section 111 record that was reported and accepted within 365 days as described above, will fail to meet the timeliness requirement. “ Id.

[3] Fed. Reg. Vol. 88, No. 195, at 70368 (October 11, 2023).

[4] Executive Order No. 14247, 90 FR 14001, https://www.federalregister.gov/documents/2025/03/28/2025-05522/modernizing-payments-to-and-from-americas-bank-account

[5] See Verisk’s December 2025 article: Executive Order 14247 “Modernizing Payments To and From America’s Bank Account” and Conditional Payment Reimbursement Options

[6] While CMS did not discuss current CMPs rates as part of the webinar, the authors note that the current inflation adjusted maximum daily CMPs amount is $1,474 for each day of noncompliance with respect to each claimant as contained in the Federal Register (August 8, 2024)

Applying the inflation adjusted maximum daily CMPs amount of $1,474 utilizing CMS’s “tiered” CMPs calculation approach, the current CMPs inflation adjusted rates are as follows:

Tier 1: $368.50 for each calendar day of non-compliance where the record is reported 1 year or more, but less than 2 years after, the required date.
Tier 2: $737 for each calendar day of non-compliance where the record is reported 2 years or more, but less than 3 years after, the required reporting date.
Tier 3: $1,474 (max rate) for each calendar day of non-compliance where the record is reported 3 years or more after the required reporting date.
The current total maximum penalty amount for any single instance of noncompliance is $538,010, applying the adjusted inflation rate contained in the Federal Register (August 8, 2024).

Of note, to the authors knowledge, to date CMS has not referenced the inflation adjustments to Section 111 CMPs issued in the Federal Register (August 8, 2024) update as part of its recent webinars and CMPs webpage, basing its CMPs calculations, instead, on the prior max daily penalty amount of $1,428. Thus, the CMPs amounts noted by CMS are slightly lower than the figures noted above. The authors continue to monitor the Federal Register for the next CMPs inflation adjustment.

[7] On this point, the regulation states, in pertinent part, that the RRE “[h]as documented its efforts to obtain the MBI or SSN (or the last 5 digits of the SSN). This documentation, including any written rejection correspondence, must be retained for a minimum of 5 years.” 42 CFR 402.1(c)(22)(ii)(4).

[8] Of note, while CMS referenced that these attempts must be sent “to the individual and their attorney,” the actual regulatory language references that the requests must be sent to “his or her attorney, or other representative, if applicable, or both.” 42 CFR 402.1 (c)[22][ii][4] (author’s emphasis). On this point, the regulation states, in pertinent part, that the RRE “[h]as communicated the need for this information to the individual and his or her attorney, or other representative, if applicable, or both.” 42 CFR 402.1(c)(22)(ii)(4) (author’s emphasis). Id.

[9] On this point, the regulatory text states, in pertinent part, that the RRE “[h]as not received a response or has received a written response clearly indicating that the individual refuses to provide the needed information. Should the applicable plan receive a written response from the individual or their attorney or representative that clearly and unambiguously declines or refuses to provide any portion of the information specified herein, no additional communications with the individual or their attorney or other representative are required.” 42 CFR 402.1(c)(22)(ii)(4).