Section 111 Penalties – Notice, Appeal, and Payment

By Mark Popolizio, J.D., Jeremy Farquhar

February 26, 2026 / 9 min read

In January, the Centers for Medicare and Medicaid Services (CMS) started its Section 111 reporting civil money penalties (CMPs) audits. Through CMS’s audit process, non-group health plan (NGHP) Responsible Reporting Entities (RREs) now face the real potential for actual monetary fines for the first time since Section 111 reporting began over a decade ago.^[1]In this regard, CMS on its recent webinar advised that liability and no-fault RREs may start to receive CMPs notices as early as March 2026, while CMS will start its workers’ compensation audits this coming July.^[2]

With CMS now poised to levy CMPs, the focus shifts to how CMS’s CMPs process will work. Key questions include: How will CMS notify RREs? What notices will CMS send to RREs? To whom will CMS send its notices? Can RREs challenge CMS? What is the CMPs payment process?

To help address these questions, the authors have prepared the below general overview as follows:

CMPs communications

To start, it is important to note that CMS will communicate with the RRE only when a potential instance of non-compliance is identified.^[3]Thus, from a practical standpoint, the RRE will only know if CMS has audited one of its files if the agency ultimately determines that CMPs may be applicable. In this regard, the old adage “no news is good news” seems applicable.

Regarding “to whom” CMS will send its CMPs notices, CMS states that “[t]he RRE’s Authorized Representative will receive all CMP correspondence, with a copy issued to the Account Manager.”^[4]CMS has emphasized that RREs “must ensure [that their] Profile Report recertification has been completed and all contact information is current to ensure that your organization does not miss any CMP-related correspondence.”^[5]Importantly, CMS advises RREs that “[f]ailure to ensure all contact information is accurate is not an acceptable defense against a CMP.”^[6]

When CMS identifies a potential instance of non-compliance, it will communicate with the RRE via a series of different notices as follows:

Notice #1: Informal Notice (intention to impose a CMP)

CMS kicks off its CMPs process by sending the RRE an “Informal Notice” as follows:

Method: On its 1/18/24 webinar, CMS stated that it planned to send the Informal Notice via e-mail, which is also reflected in the agency’s power point used during this session.^[7]However, Verisk recently received feedback directly from CMS from which we learned that CMS now plans to send these notifications via USPS mail. Of note, CMS’s CMPs web page makes no specific reference to how the Informal Notice will be sent, nor did CMS discuss the method of its planned CMPs notices transmissions on its most recent CMPs webinar held on 1/15/26.^[8]It is unknown if CMS plans to provide any further information on this point, although from the authors’ perspective a CMS update or clarification would likely be helpful for RREs. In the interim, to play it safe, it may make sense for RREs to monitor both regular mail and e-mail for potential Informal Notices.

Key Points: CMS will issue its Informal Notice when it has identified a potentially non-compliant record as part of its CMPs quarterly audit process.^[9]Importantly, a CMP is not being assessed at this point, rather, CMS notes that “the RRE’s noncompliant record is identified along with the associated information so that an RRE may investigate the record.”^[10]

RREs can submit mitigating evidence: When CMS issues an Informal Notice, it will provide the RRE with one opportunity to “submit mitigating evidence” which is a chance for the RRE to explain why a CMP should not be imposed.^[11]CMS states that “[t]he process to submit mitigating information, in an attempt to explain or defend technical or administrative issues resulting in the noncompliance is outlined in this letter.”^[12]On this point, CMS states that “[i]f an RRE believes that there were circumstances beyond its control that prevented it from reporting on time, responding to the informal notice can help reduce the amount of a CMP or even avoid a CMP altogether.”^[13]CMS also notes that it “reviews all reasonable evidence submitted timely by the RRE.”^[14]Strict timelines apply. Specifically, CMS notes that “[m]itigating evidence must be submitted to CMS within 30 days of receipt of the Informal Notice” and that no time extensions will be granted.^[15]Further, CMS notes that it “may request clarification on, or further explanation of, an RRE’s submitted evidence, but this step of the process only affords the RRE one (1) submission opportunity.”^[16]

CMS determination: If CMS determines the RRE’s submitted mitigating evidence is sufficient and supports the RRE’s defense against CMS’s intention to impose penalties, then CMS will not issue a CMP, and no additional action is required by the RRE.^[17]Of note, CMS states that “[e]ach decision regarding the mitigating evidence submitted only pertains to that specific record referenced in the Informal Notice.”^[18] On the other hand, if CMS determines that the RRE’s submitted mitigating evidence is insufficient, or that the RRE did not submit its mitigating evidence timely, then “CMS’ original finding of noncompliance will be upheld and a Proposed Determination to impose a CMP will be issued.”^[19]

Notice #2: Notice of Proposed Determination (“formal notice”)

If CMS and the RRE are unable to resolve the matter at the Informal Notice stage discussed above, then CMS moves forward by issuing a “formal” CMPs notice called the “Notice of Proposed Determination” as follows:

Method: CMS’s CMPs webpage states that this notice will be sent Certified Mail.^[20]

Key Points: CMS sends the Notice of Proposed Determination “if there is no response to the informal notice, or the RRE has not provided sufficient mitigating evidence.”^[21]This notice provides the RRE with the CMP amount that CMS intends to impose, and how to further appeal.^[22]

Appeal: RREs can appeal CMS’s Notice of Proposed Determination through an administrative appeals process. In this regard, CMS states that RREs have “the right to request a hearing as set forth under 42 CFR § 405 and in accordance with 42 CFR Part 1005 and must do so within 60 calendar days of receipt of the Notice of Proposed Determination.”^[23]CMS’s notice will outline the process by which an RRE may request a hearing with an Administrative Law Judge (ALJ).^[24]CMS notes that this request “must be filed electronically with the Departmental Appeals Board (DAB), Civil Remedies Division, using the DAB E-File System available at https://dab.efile.hhs.gov, and must be completed within the required timeframes.”^[25]From there, the RRE may appeal the ALJ’s initial decision to the DAB’s Appellate Division (the “Board”) within 30 calendar days of the ALJ decision and this must also be submitted through DAB E-File.^[26]The Board’s decision becomes binding 60 calendar days following service of the Board’s decision, absent petition for judicial review.^[27]Of note, CMS states that the “RRE will be precluded from appealing a final determination to impose a CMP, pursuant to 42 CFR § 402.9(c), if the hearing is not requested within the required timeframe.”^[28]

Notice #3 - Notice of Final Determination (CMPs payment)

CMS will issue a “Notice of Final Determination” for CMPs payment as follows:

Method: CMS’s CMPs webpage states that this notice will be sent Certified Mail.^[29]

Key Points: CMS issues the “Notice of Final Determination” in scenarios where “the RRE does not request a hearing or appeal, elects to terminate the appeals process, or otherwise exhausts all available administrative appeal rights and the CMP is upheld.” ^[30] This notice confirms that the imposition of the RRE’s CMP is final and will contain instructions regarding how the RRE should remit payment, and its due date.^[31]

Payment: As part of its January 15, 2026 webinar, CMS stated that payment is due within 60 days and CMPs payment will only be accepted electronically via Pay.gov eBill.^[32]CMS advised on the webinar that it will provide instructions on account creation and the payment process as part of its Final Determination correspondence.[33]

CMPs rates: On its January 15, 2026 webinar, CMS also noted that the monetary CMPs amount the RRE must pay will be based on the effective CMPs inflation adjusted rates at the time CMS’s initial audit occurs.^[34]On this point, CMS explained that if there is a subsequent inflationary adjustment to the CMPs rates before the RRE makes payment, the amount the RRE will pay will be based on the adjusted CMPs amount in place at the time of CMS’s initial audit, and not the subsequently increased rate.^[35]Similarly, CMS also explained that, while there would be time which would pass between the occurrence of the initial audit and when a CMP would be formally assessed, the clock will stop ticking, in terms of the daily penalty calculation, as of the date the non-compliance was identified via the initial audit.^[36]See the authors’ recent article to learn more about CMPs penalty rates and how CMS plans to levy CMPs.

Going Forward

Section 111 penalties have entered a new (and very real) phase, and it is critical that RREs understand how CMS’s CMPs process will work, including the importance of associated timelines to challenge or appeal CMS’s claim (if applicable). In this regard, CMS’s CMPs correspondence should be closely examined for all pertinent information, instructions, and timelines. It may also be a good idea to closely monitor for the receipt of CMPs related correspondence to make sure that any CMS notices are not missed. In this regard, as noted above, CMS has emphasized that RREs should make sure their Profile Reports are current and contain accurate contact information. Also, as with any new process, staying vigilant to see exactly how this all unfolds in practice can be helpful. In the big picture, while the scope of CMS’s audit process (250 records per quarter divided proportionally between NGHP and GHP) is smaller than many RREs likely envisioned, from the authors’ view, this should not lull RREs into complacency, because if an RREs “number is called,” there can be very real and significant monetary consequences.^[37]

How Verisk Can Help

For additional information regarding the above topics, as well as CMS’s Section 111 CMPs in general, please see our Section 111 FAQs resource. In the interim, please do not hesitate to contact the authors if you have any questions regarding Section 111 CMPs, or how Verisk’s Section 111 services can help you stay compliant with Section 111 reporting, including our state-of-the-art MSP Navigator tool.

[1] Very generally, under CMS’s final rule, CMS may impose CMPs if an RRE, “[f]ails to report any beneficiary record within 1 year from the date of the settlement, judgment, award, or other payment [TPOC], or the effective date where ongoing payment responsibility for medical care [ORM] has been assumed by the entity.” See, Fed. Reg. Vol. 88, No. 195, at 70372 (October 11, 2023) and 42 CFR § 402.1(22)(i). CMS notes that Section 111 “records are required to be submitted in a timely manner” and that “[c]ompliance with reporting obligations is defined by the rule as the successful submission and acceptance of the report of NGHP coverage, acceptance of ORM, or TPOC.” CMS’s NGHP Civil Money Penalties Webpage, Section: Non-Compliance. Per CMS’s CMPs webpage, “a ‘record’ is defined as any individual occurrence of a TPOC or ORM for a Medicare beneficiary that must be submitted via the Section 111 reporting process” and CMS states that “if a particular case has both an ORM and a TPOC component, this will constitute two records. CMS’s NGHP Civil Money Penalties Webpage, Section: Non-Compliance.

In terms of measuring timelines regarding TPOC reports, CMS will compare the date CMS received the RRE’s successful file submission with the TPOC Date or, if the Funding Delayed Beyond TPOC Start Date is also submitted, the Funding Delayed Beyond TPOC Start Date will be utilized to calculate timeliness as opposed to the TPOC Date. Regarding ORM, CMS will compare the date CMS received the RRE’s successful file submission with the date ORM was assumed by the RRE and, if the Date of Incident is found to be more than one year prior to the date of the initial successful report, the RRE would be considered non-compliant and potentially subject to a penalty. Fed. Reg. Vol. 88, No. 195, at 70372 (October 11, 2023) and CMS’s NGHP Section 111 CMPs Webinar (January 18, 2024). For additional information regarding how CMS measures timeliness, see the author’s recently released Section 111 FAQ (FAQs #1-3).

CMS has stated that it will apply its CMPs regulations prospectively. CMS’s Section 111 NGHP CMPs webinar (January 18, 2024) and CMS’s NGHP Civil Money Penalties Webpage, introductory paragraphs. Specifically, CMS has stated that only coverage record submissions with coverage effective dates [ORM] or TPOC dates of October 11, 2024, or later, are in scope for penalties and, as such, the agency will not seek to assess penalties for submissions where the coverage effective dates [ORM] or TPOC dates occurred prior to October 11, 2024. CMS’s Section 111 NGHP CMPs webinar (January 18, 2024) and CMS’s NGHP Section 111 CMPs Webinar (October 17, 2024).

While CMS notes that its CMPs regulations are prospective, the agency has reminded RREs that they still have a statutory requirement to make sure their reporting on older claims records is accurate and RREs could still face other potential recourses, including potential False Claims Act suits or administrative recovery. CMS states: “A note of caution: While CMPs will be issued on a prospective basis for new coverage records, accurate reporting overall is still statutorily required, in addition to being an important tool the Medicare program uses to ensure proper payment of claims. RREs who fail to meet their full reporting obligations may face other recovery actions including, but not limited to, False Claims Act suits or administrative recovery efforts.” CMS’s NGHP Civil Money Penalties Webpage, Section: Non-Compliance. See also, CMS’s NGHP Section 111 CMPs Webinar (October 17, 2024).

[2] CMS’s NGHP Section 111 CMPs Webinar (January 15, 2026).

[3]CMS’s NGHP Civil Money Penalties Webpage, Section: Letters.

[4] Id.

[5] Id.

[6] Id.

[7] CMS’s CMPs NGHP Section 111 Webinar (January 18, 2024). As noted above, in addition to CMS orally stating that it would use e-mail to transmit the Informal Notice, this information is also noted on slide 12 of CMS’s power point which states, in pertinent part, as follows: “Informal Notice to Impose a CMP … Notice (letter) e-mailed to the RRE’s Authorized Representative; Account Manager cc’d.” CMS’s CMPs NGHP Section 111 Webinar (January 18, 2024), CMS’s power point, Slide 12. To add to this potential confusion, CMS’s CMPs workflow document only references that the notice will be “mailed” with no reference to the precise transmission method, while CMS’s power point related to its 10/17/24 webinar also references the word “mailed.”

[8] See Verisk’s summary of CMS’s January 15, 2026, webinar for an outline of the actual topics CMS discussed.

[9]CMS’s NGHP Civil Money Penalties Webpage, Section: Informal Notice- Intention to Impose a Civil Money Penalty.

[10] Id.

[11]Id.

[12] Id.

[13]Id.

[14]Id.

[15]Id.

[16] Id.

[17] CMS’s NGHP Civil Money Penalties Webpage, Section: Decision Regarding Mitigating Evidence Submission.

[18] Id.

[19] Id.

[20] CMS’s NGHP Civil Money Penalties Webpage, Section: Notice of Proposed Determination to Impose a Civil Money Penalty. See also, CMS’s CMPs NGHP Section 111 Webinar (January 18, 2024), CMS’s power point, Slide 12. However, it is noted that CMS’s power point regarding its 10/17/24 webinar simply indicates that all CMPs notices “will be mailed” without any additional specificity regarding exactly how.

[21] CMS’s NGHP Civil Money Penalties Webpage, Section: Notice of Proposed Determination to Impose a Civil Money Penalty.

[22]Id.

[23] Id.

[24] Id.

[25] Id.

[26]Id.

[27] Id.

[28] Id.

[29] CMS’s NGHP Civil Money Penalties Webpage, Section: Notice of Final Determination to Impose a Civil Money Penalty.

[30] Id.

[31] Id.

[32] CMS’s NGHP Section 111 CMPs Webinar (January 15, 2026).

[33] Id.

[34] Id.

[35] Id.

[36] Id.

[37] In general, as part of the audit process, each quarter CMS will randomly select 250 records for review “across the entire universe of accepted new Section 111 records received during the specific review period, as well as records Medicare received from non-Section 111 sources such as providers or beneficiaries.” CMS’s NGHP Civil Money Penalties Webpage, Section: Review of Records to Identify Non-Compliance. The records selected for review will be proportionate to the volume of coverage records accepted in connection with the both GHP and NGHP reporting processes for the quarter in question. Id.

To help illustrate the above, CMS provides the following example in its final rule: “If over the calendar quarter being evaluated, CMS received 600,000 GHP records and 400,000 NGHP records for a total of 1,000,000 recently added beneficiary records, then 60 percent of the 250 records audited for that quarter would be GHP records, and 40 percent would be NGHP records.” Medicare Secondary Payer and Certain Civil Money Penalties, 88 Fed. Reg. 70363, 70370 (October 11, 2023).

What remains unknown is exactly how CMS will “randomly select” the records for review via their quarterly process. However, CMS did offer a notable point of clarification in response to a question during the agency’s October 17, 2024, CMPs webinar. Specifically, an attendee asked CMS “if an audited record is found to be non-compliant, does that trigger an expanded audit on that RRE?” CMS’s NGHP Section 111 CMPs Webinar (October 17, 2024). CMS responded that it would not and that “only the individual records that are randomly selected for the quarterly audit will be reviewed for compliance by CMS.” Id.

As noted, CMS will include both Section 111 and non-Section 111 records as part of its audit process. Regarding “non-section 111 records,” CMS defines these “as a TPOC and/or ORM record that has been reported via other coordination of benefits and data collection methods.” CMS’s NGHP Civil Money Penalties Webpage, Section: Review of Records to Identify Non-Compliance. In addition, CMS notes that “[f]or the purposes of CMS’s audit, any non-Section 111 records captured are those that were reported the same quarter CMS is reviewing, but from the prior year, since RREs are required to report within 1 year (365 days) of the latter of either the Settlement Date reported in ‘Field 80’ or the Funding Delayed Beyond TPOC Date reported in ‘Field 82’ AND the MSP Effective Date and ORM are selected as ‘Y.’” Id.