Are Non-Reporting Penalties on the Horizon? 

The Medicare Secondary Payer (MSP) law requires that "Responsible Reporting Entities" (RREs) notify the Centers for Medicare and Medicaid Services (CMS) when a Medicare beneficiary (or soon-to-be beneficiary) is injured. Failure by an RRE to notify CMS of such an injured person may result in significant “civil monetary penalties” (CMPs), according to federal law. CMS has announced that it will begin developing rules around enforcing this CMP provision in late 2019. The announcement raises several questions that are of concern to insurers of any sized company (including self-insured companies).

Why is CMS focused on this issue now?

In a nutshell, the proposed rule would create and clarify reporting standards for insurers to follow so they do not trigger an inquiry or subsequent CMP related to their RRE reporting activities. The Medicare Access and CHIP Reauthorization Act of 2015 repealed duplicative MSP reporting requirements but opened up to public discussion what might the potential criteria be for enforcing non-compliance with the remaining reporting requirements. One such requirement is that of reporting to CMS when a Medicare beneficiary (or soon to be beneficiary) is injured and needs medical care because of those injuries.

There is no current legislation that details when non-compliance with this reporting rule should trigger a CMP, nor are there standards that clarify what insurers can do to prevent being subject to such a fine. (The statute does, however, clarify that provisions (e) and (k) of §1128a (42 U.S.C. 1320a-7a) of the Social Security Laws apply to these CMPs the same way they apply to Social Security non-compliances. Those provisions detail how to appeal if such a penalty is assessed (at paragraph (e)) and authorizes the Secretary to proceed to federal courtif it learns that a company might become subject to a CMP (at paragraph (k).)

Enforcing the rule provides CMS with two benefits:

1) It will comply with the MSP law.

Being a secondary payer, Medicare resources cannot be touched until those of the primary payer are exhausted. CMS has an affirmative legal duty to avoid paying for injuries that are covered by a primary healthcare insurer and the statute gives it the authority to know when its participants are receiving that support from their primary insurance resource. By mandating notice in every applicable case, CMS can monitor all of its injured participants and plan appropriately for providing benefits when the primary benefits run out. Without advance notice, that oversight and planning can't happen.

2) It may increase its revenues

Ostensibly, every unreported case could become a future Medicare case requiring access to Medicare dollars. Without notice of the extent of earlier medical care, a subsequent claim to CMS could trigger an expensive investigation into whether those primary benefits were properly utilized in every case.

From the carrier's perspective, and while there is no statistical data about how many unreported cases exist, any insuring company may have relevant cases going back years, and therefore may have hundreds of eligible claimants on their books. Each one of those claimant's cases might trigger a monetary penalty of up to $1,000 per day of non-compliance and applying such a fine to even just a few cases in any one company could raise millions of dollars which the federal agency could use to provide even more care for its enrollees.

Who will be affected?

The statute itself applies to insurers that provide medical coverage to their insureds, including companies that are self-insured. In statutory language, a “Responsible Reporting Entity” is any "applicable plan" offered by any liability insurance company, no-fault insurance company or workers’ compensation insurance carrier (42 U.S.C. 1395y(b)(8)).

  • Insurers that issue these types of plans must register with CMS as an RRE and report to CMS when they become aware of an injured person within their plan who is also a Medicare beneficiary (or soon-to-be beneficiary.)
  • Their report must include the identity of the injured person and any other information that assists the CMS secretary in determining eligibility and coordination of benefits (42 U.S.C. 1395y9b)(7)(B)).
  • Failure to file the notification can result in a "civil money penalty" of $1,000 for each day of non-compliance for each individual about whom a report should have been filed (42 U.S.C. §1395y(b)(7)(B)(i)).

Why would an insurer not report?

Despite the rule that every eligible case must be reported, not all insurers are dedicated to pursuing that mandate. Some companies may not be aware of their insured’s Medicare eligibility, so they don’t know about Medicare and MSP requirements. In some cases where Medicare eligibility is a factor, the injuries will, in all likelihood, heal well within the scope of the primary carrier's obligation, so Medicare resources will never be needed. In other cases, insufficient internal resources or 'operator error' may have inadvertently missed the requirement to make a notification in any given situation. In all likelihood, most if not all insurance carriers probably have at least some percentage of cases that should have been reported to CMS but were not.

What should insurers do now?

In anticipation that the enforcement procedure becomes clearer, there are two steps every insurer should take now to avoid as much as possible being fined for non-compliance with this reporting rule:

1) Begin an assessment of all cases to determine if any are or may be subject to the CMP rule. Insurers with thousands of open cases will find this task burdensome; however, that investment of time to set records straight will be well worth it when weighed against the cost of the potential but avoided CMPs.

2) Contribute to the conversation about what the new reporting standards should or could be. The proposed rule would seek public comment on the criteria and practices applicable to CMPs assessed under the MSP. At the moment, that rule is silent about the CMP specifics, such as how companies can avoid the penalties for past failures, or when the $1,000/day period should begin. Although it states the  CMP is applicable for “each day of non-compliance,” when does ‘non-compliance’ begin? Would it be back-dated to the time of injury? What if the injured person became Medicare-eligible after medical treatment had begun?

Other questions also come to mind: Should the CMP value have a cap? Would that cap change depending on the size of the insuring company? How might CMS pursue their CMP opportunity? (Paragraph 1128(k) suggests that a federal lawsuit might be the method by which CMS can enforce its fining provision although there are, at present, no standards or rules established that detail how CMS might go after those penalties.)

The recent notice of rulemaking indicates that CMS is intending to tighten its oversight of injury cases when potential Medicare recipients are involved. RREs who have been lax about their reporting processes or haven't updated or audited them recently may be facing significant CMPs if they have on their books multiple unreported Medicare beneficiaries receiving medical benefits because of accidental or work-related injuries.