2023-22282. Medicare Program; Medicare Secondary Payer and Certain Civil Money Penalties

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Final rule.

SUMMARY:

This final rule will specify how and when CMS must calculate and impose civil money penalties (CMPs) when group health plan (GHP) and non-group health plan (NGHP) responsible reporting entities (RREs) fail to meet their Medicare Secondary Payer (MSP) reporting obligations by failing to register and report as required by MSP reporting requirements. This final rule will also establish CMP amounts and circumstances under which CMPs will and will not be imposed.

DATES:

Effective date: This final rule is effective on December 11, 2023.

Applicability date: The provisions of this rule are applicable on or after October 11, 2024.

FOR FURTHER INFORMATION CONTACT:

Brian Broznowicz, (410) 786–3349.

SUPPLEMENTARY INFORMATION:

I. Background

A. Imposition of Civil Money Penalties (CMPs)—Legislative Overview

In 1981, the Congress added section 1128A to the Social Security Act (the Act) (section 2105 of Pub. L. 97–35) to authorize the Secretary of Health and Human Services (the Secretary) to impose civil money penalties (CMPs) and assessments on certain health care facilities, health care practitioners, and other suppliers for noncompliance with rules of the Medicare and Medicaid programs. CMPs and assessments provide an enforcement tool for agencies to use to ensure compliance with statutory and regulatory requirements. These CMPs and assessments may be imposed in addition to potential criminal or civil penalties.

Since 1981, the Congress has increased both the number and the types of circumstances under which the Secretary may impose CMPs. Some CMP authorities address fraud, misrepresentation, or falsification, while others address noncompliance with programmatic or regulatory requirements. The Secretary has delegated the authority for certain provisions to either the Office of Inspector General (OIG) or Centers for Medicare & Medicaid Services (CMS). (See the October 20, 1994, notice, titled “Office of Inspector General; Health Care Financing Administration; Statement of Organization, Functions, and Delegations of Authority” (58 FR 52967).) A summary of these CMP changes is discussed in this section of this final rule.

B. Medicare Secondary Payer History

In 1980, the Congress added section 1862(b) of the Act, which defined when Medicare is the secondary payer to certain primary plans. These provisions are known as the Medicare Secondary Payer (MSP) provisions of the Act.

Section 1862(b)(2)(A) of the Act prohibits Medicare from making payment if payment has been made, or can reasonably be expected to be made by any of the following primary plans:

• Group Health Plans (GHPs).
• Workers' compensation plans.
• Liability insurance (including self-insurance).
• No-fault insurance.

Medicare may make conditional payments, subject to Medicare payment rules, in situations where workers' compensation, liability insurance (including self-insurance), or no-fault insurance has not made payment or cannot be expected to make payment promptly. Any conditional payments that Medicare makes are subject to reimbursement from the primary plan. See section 1862(b)(2)(B) of the Act.

C. Legislative Provisions Regarding Mandatory Reporting Requirements

To enhance enforcement of the MSP provisions, section 111 of the Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA) (Pub. L. 110–173) added paragraphs (7) and (8) to section 1862(b) of the Act. These paragraphs established new mandatory reporting requirements regarding Medicare beneficiaries who have coverage under GHP arrangements, as well as when liability insurance (including self-insurance), no-fault insurance, or workers' compensation (collectively referred to as Non-Group Health Plans, or NGHPs) provide settlements, judgments, awards, or assume other payment responsibility for Medicare beneficiaries' care. Sections 1862(b)(7)(A) and (b)(8)(F) of the Act define those parties responsible for this reporting (collectively referred to as responsible reporting entities, or RREs). Under section 1862(b)(7)(A) of the Act, GHPs or third-party administrators are obligated to report beneficiary coverage; almost 1,000 entities are registered as GHP RREs, with 62 percent estimating between 1,000 and 100,000 individual beneficiaries to be reported annually. Under section 1862(b)(8)(F) of the Act, NGHP applicable plans are obligated to report settlements or when the entity otherwise assumes payment responsibility, and over 21,000 entities are registered as NGHP RREs, with the vast majority (88.29 percent) estimating fewer than 500 individual beneficiaries to report annually at the time of registration.

RREs are currently required to submit coverage information for Medicare beneficiaries including, but not limited to, when coverage begins or ends, or when a judgment, award, settlement, or other payment is made, on a quarterly basis through an electronic file submission process that may vary depending upon the number of beneficiary records being reported or updated. NGHP RREs who submit 500 or less claim reports per year are eligible to utilize the Coordination of Benefits Secure website (COBSW) Direct Data Entry (DDE) reporting option to add, update, or delete claim information. DDE submitters have the same responsibility and accountability as any other RRE. This coverage information primarily consists of enough identifying information to uniquely identify the Medicare beneficiary and confirm their beneficiary status, as well as information about the nature of the coverage (such as GHP or NGHP, coverage effective dates, policy limits, settlement amounts, and so forth). These section 111 of MMSEA reporting provisions did not alter any other existing statutory provisions or regulations. Further, these reporting provisions include authority for CMS to impose CMPs against entities that fail to comply with the section 111 of MMSEA reporting requirements under section 1862(b)(7) or (b)(8) of the Act, as amended by the Medicare IVIG Access and Strengthening Medicare and Repaying Taxpayers Act of 2012 (the SMART Act). These provisions also require that GHPs and NGHPs that fail to comply with these reporting requirements shall be subject to a CMP of $1,000 and up to $1,000, respectively, for each calendar day of noncompliance. Imposition of penalties related to noncompliance with section 111 of MMSEA are required to be promulgated in regulation, which is the purpose of this rule.

In 2013, Congress enacted the SMART Act, which amended section 1862(b)(8)(E) of the Act, which includes the section 111 of MMSEA reporting requirements and describes the enforcement provisions for NGHPs that fail to comply with the reporting requirements. Specifically, the SMART Act revised section 1862(b)(8)(E) of the Act to state that NGHP applicable plans that fail to comply with the reporting requirements may be subject to a civil money penalty of up to $1,000 for each calendar day of reporting noncompliance required of NGHP applicable plans under section 1862(b)(8)(E) of the Act. The SMART Act also added section 1862(b)(8)(I) of the Act, which specifically required rulemaking actions regarding the enforcement of CMP provisions under section 1862(b)(8)(E) of the Act.

We note that the SMART Act did not amend any CMP provisions for GHP arrangements that have reporting obligations under section 1862(b)(7) of the Act. Such GHP arrangements remain subject to mandatory CMPs of $1,000 per calendar day of noncompliance and per individual for whom submission of information was required. In addition, the SMART Act directed rulemaking for NGHP applicable plans regarding the imposition and non-imposition of CMPs.

We further note that the statutory language speaks to “individuals,” though there are situations described that are specifically applicable to Medicare beneficiaries; we have attempted to be consistent with the usage of this statutory terminology but use the term “beneficiary” where it is more appropriate.

D. Summary of Public Comments Received on the December 11, 2013, Advance Notice of Proposed Rulemaking (ANPRM)

As the mandatory insurer reporting requirements themselves are self-implementing, we were able to gradually implement the reporting process from 2009 through 2011. The implemented reporting process included informal communications to RREs regarding their compliance with reporting requirements, including “compliance flags” in response to records that fail to meet specified criteria and even direct outreach to RREs. However, the implementation of civil money penalties for noncompliance requires formal rulemaking. In accordance with the rulemaking directed by the SMART Act, on December 11, 2013 (78 FR 75304), we published an advance notice of proposed rulemaking (ANPRM) titled “Medicare Secondary Payer and Certain Civil Money Penalties.” The December 2013 ANPRM solicited public comment on specific practices for which CMPs may or may not be imposed for failure to comply with MSP reporting requirements for certain GHP and NGHP arrangements.

We received 34 timely pieces of correspondence in response to the December 2013 ANPRM. In section I.D. of the February 18, 2020, proposed rule, we provided an analysis of the public comments received by subject area, with a focus on the most common issues raised, and briefly discuss how we proposed to address the issues raised by commenters in response to the 2013 ANPRM. Commenters expressed many of the same concerns and raised most of the same points that were raised in response to the proposed rule, published on February 18, 2020. While the proposed rule addressed these comments, alterations to the rule, as well as an evolving stakeholder landscape, resulted in many comments to the proposed rule being resubmitted in substantially similar form and content. Specifically, many commenters requested clarity around how a CMP would be calculated, the possibility of a sliding scale or tiered approach to levying CMPs, establishing a statute of limitations, and confirming that enforcement of the rule would be prospective only. For more detailed information on our analysis of the public comments on the ANPRM, please see the February 18, 2020, proposed rule (85 FR 8795 through 8797).

II. Provisions of the Proposed Rule and the Analysis of and Responses to Public Comments

In the February 18, 2020, Federal Register (85 FR 8793), we published the proposed rule titled “Medicare Secondary Payer and Certain Civil Money Penalties.” In drafting the February 2020 proposed rule, we reviewed the public comments in response to our December 11, 2013, ANPRM (78 FR 75304), and other policy considerations. Accordingly, we proposed specific criteria for when CMPs would be imposed and proposed specific criteria for when CMPs would not be imposed, in circumstances when a GHP or an NGHP entity fails to comply (either on its own or through a reporting agent) with MSP reporting requirements specified under section 1862(b)(7) and (b)(8) of the Act. Further, we proposed to amend the amount of these CMPs, as set forth under 45 CFR 102.3 (Penalty adjustment and table).

We received 47 timely pieces of public correspondence on the February 18, 2020, proposed rule. Commenters included various group health plans and private insurance companies (non-group health plan insurers) as well as their representatives, special interest groups, and other interested individuals. Some comments addressed issues or expressed concerns that were outside the scope of this rule and were thus inappropriate to address in this venue. Of the remaining comments, there were many that expressed concern with various aspects of the proposed rule including the possible amount of CMPs, the process by which noncompliance would be discovered, and the proportionality of the possible penalties when compared to the severity of the noncompliance as well as the relative size of the entity against which a penalty was contemplated. In direct response to public comment, as well as substantial internal data analysis, CMS has revised the final rule to be responsive to the concerns of those entities that may be impacted by the rule.

A. CMP Basis and Scope in the Proposed Rule

The existing regulation at 42 CFR 402.1 describes the basis for imposition of CMPs against parties who violate the provisions of the Act. We proposed to add regulatory language under § 402.1(c), which would identify situations in which GHP and NGHP RREs would be subject to CMPs under sections 1862(b)(7) and (b)(8) of the Act. To accomplish this regulatory addition, we proposed the following regulatory revisions in § 402.1:

• Removing paragraph (c)(20), which currently refers to a provision that is no longer applicable regarding the imposition of CMPs for employers that fail to timely, and accurately report an employee's group health insurance coverage.
• Redesignating paragraph (c)(21) as paragraph (c)(20).
• Redesignating paragraphs (c)(22) through (34) as paragraphs (c)(23) through (35).
• Adding new paragraphs (c)(21) and (22), which will incorporate the new text finalized in this rule and all applicable provisions.

The existing regulation at 42 CFR 402.105(b) establishes the amounts of penalties assessed against parties who violate the provisions of the Act. We proposed to amend § 402.105(b) by revising paragraph (b)(2) and adding a new paragraph (b)(3). The proposed regulation at § 402.105(b)(2) would codify the amounts of penalties imposed against GHPs, and the proposed regulation at § 402.105(b)(3) would establish the amounts of penalties imposed against NGHPs.

In addition, we proposed to revise the regulations at 45 CFR 102.3 to establish the updated amounts for all CMPs at issue in these regulations.

Comment: Some commenters expressed concerns about the potential size of the CMPs that would be imposed and recommended developing a “sliding scale” or “tiered” CMP approach. These suggestions included scaling the amount of the CMP to be imposed based upon the intentions of the noncompliant entity, or upon whether an excess proportion of individual beneficiary records failed to be reported as required (in essence creating a safe harbor for a certain portion of records to not be reported as required), and other similar recommendations to limit the size of the CMP. Some commenters also noted the statutory discrepancy between the penalty amounts for GHP, which are $1,000 per day of noncompliance, and NGHP entities, which are up to $1,000 per day of noncompliance.

Response: We begin by noting that CMS does not have the authority to alter penalties for GHPs, as penalty amounts are stated in section 1862(b)(7) of the Act. In the proposed rule, we proposed that penalties for NGHP entities would parallel those for GHP entities. However, because CMS has the authority to adjust CMPs for NGHP entities, we are instead finalizing a tiered approach with respect to such entities, under which we will adjust penalty amounts based on the length of time that a report has been untimely. The full explanation of this approach appears in the next section of this document.

While ultimately the responsibility of the RRE, CMS is not unsympathetic to RREs in regard to those situations where a particular late submission was the result of a rare situation, system glitch, defect, or other problem that was unanticipated or out of the immediate control of the RRE. For this reason, an informal notice process will be implemented so that any RRE that receives notice that a CMP is pending against them will have an opportunity to examine their records and alert CMS to any discrepancies or mistakes that could mitigate or eliminate the potential penalty. This process is described in full detail later in this document.

Comment: Some commenters alleged that the amount of CMPs, in certain circumstances, are too high, excessive, disproportionate to the harm to the program, or unconstitutional.

Response: The amounts of the GHP CMPs are set by statute, in accordance with section 1862(b)(7)(B) of the Act, and CMS must enforce the amount as set by statute. While CMS has discretion to adjust CMPs for NGHPs under section 1862(b)(8)(E) of the Act, the statute does not authorize such discretion with respect to GHPs. In the proposed rule, we proposed that CMPs imposed against NGHPs would be aligned with those for GHP entities. However pursuant to this final rule, penalties for NGHP entities will instead be tiered based on the amount of time that a record has been late, or gone unreported, in accordance with the language of the statute which provides that penalties for NGHPs are up to $1,000 per day of noncompliance.

We originally proposed that CMPs may be levied in addition to any MSP reimbursement obligations identified using the reported information, but that CMS would not impose duplicative penalties. For example, failure to timely report the termination of coverage and then submitting the late termination in a manner that exceeds the error tolerance threshold for the fourth time in eight consecutive reporting periods, may meet the criteria for two potential CMPs with the submission of one record. However, we proposed that CMS would only impose a CMP once, and for the lesser of the two potential CMPs. This proposed limitation has been eliminated in the final rule as a result of being rendered unnecessary by the new audit methodology that will be employed.

B. CMP Imposition and Amounts in the Proposed Rule

The proposed regulations at § 402.1(c) identified circumstances where GHP and NGHP entities would be subject to CMPs for violation of sections 1862(b)(7) and (b)(8) of the Act. Following publication of the final rule, we intended to enhance monitoring of recovery process disputes and appeals that contradict reported data, as well as monitoring the reported data and performance over time to identify reporting that exceeded error tolerances. The proposed regulations at § 402.105(b) explained how we would calculate CMP amounts for GHP and NGHP entities that have reporting obligations under sections 1862(b)(7) and (b)(8) of the Act. Furthermore, proposed § 402.1(c) identified situations where GHP and NGHP RREs would not be subject to CMPs for violation of sections 1862(b)(7) and (b)(8) of the Act. The final rule will limit CMPs to only instances of noncompliance based on timely reporting, so as to greatly simplify the process by which CMPs are levied. The changes to the final rule are largely in response to stakeholder concerns raised in response to the ANPRM and proposed rule that alleged that the proposed process was confusing, punitive, and failed to serve the intended purpose of encouraging compliance and fostering collaboration with CMS. More information on this will be in the following section.

Under section 1862(b)(7) of the Act, a GHP RRE shall be subject to a CMP of $1,000 as adjusted annually under 45 CFR part 102 (currently $1,325 as of June 8, 2023; see 87 FR 15101)) for each calendar day of noncompliance for each individual for which the required information should have been submitted. Under section 1862(b)(8) of the Act, an NGHP RRE may be subject to a CMP of up to $1,000 as adjusted annually under 45 CFR part 102 (currently $1,325 as of June 8, 2023; see 87 FR 15101) for each calendar day of noncompliance with respect to each claimant. These CMPs would be in addition to any other penalties prescribed by law, and in addition to any MSP claim under section 1862(b) of the Act with respect to an individual.

1. Imposition of a CMP

In the proposed rule, CMS indicated that a penalty would be imposed if an RRE fails to report or update any GHP beneficiary record within the required timeframe (no more than 1 calendar year after GHP coverage effective date or the Medicare beneficiary's entitlement date, whichever is later). In the proposed rule, CMS proposed that the penalty be calculated on a daily basis, based on the actual number of individual beneficiaries' records that the entity submitted untimely (that is, beyond the required timeframe after the GHP MSP effective date). CMS proposed that the penalty be $1,000 (as adjusted annually under 45 CFR part 102) for each calendar day of noncompliance for each individual for which the required information should have been submitted, as counted from the day after the last day of the RRE's assigned reporting window where the information should have been submitted through the day that CMS received the information, up to a maximum penalty of $365,000 (as adjusted annually under 45 CFR part 102) per individual per year.

In the proposed rule, CMS also proposed a penalty if an RRE failed to report any NGHP beneficiary record within the required timeframe of no more than 1 year after the date of the settlement, judgment, award, or other payment (also referred to as the Total Payment Obligation to Claimant (TPOC)). CMS proposed that the penalty be calculated on a daily basis, based on the actual number of individual beneficiaries' records that the entity submitted untimely (that is, in excess of the required timeframe after the TPOC date). In the proposed rule, CMS proposed that the penalty be up to $1,000 (as adjusted annually under 45 CFR part 102) for each calendar day of noncompliance for each individual for which the required information should have been submitted, as counted from the day after the last day of the RRE's assigned reporting window where the information should have been submitted through the day that CMS received the information, up to a maximum penalty of $365,000 (as adjusted annually under 45 CFR part 102) per individual per year.

In the proposed rule, CMS also proposed that a CMP be assessed if a GHP's or NGHP's response to CMS recovery efforts contradicted the entity's section 111 of MMSEA reporting. For example, if an RRE reported and repeatedly affirmed ongoing primary payment responsibility for a given beneficiary, then responded to recovery efforts with the assertion that coverage for that beneficiary actually terminated 2 years prior to the issuance of the recovery demand letter. The penalty as proposed would have been calculated based on the number of calendar days that the entity failed to appropriately report updates to beneficiary records, as required for accurate and timely reporting under section 111 of MMSEA. In the proposed rule, for a GHP, CMS proposed that the penalty be $1,000 (as adjusted annually under 45 CFR part 102) for each calendar day of noncompliance for each individual for which the required information should have been submitted. For an NGHP, CMS proposed that the penalty be up to $1,000 (as adjusted annually under 45 CFR part 102) per calendar day of noncompliance for each individual, for a maximum annual penalty of $365,000 (as adjusted annually under 45 CFR part 102) for each individual for which the required information should have been submitted.

In the proposed rule, CMS also proposed that a penalty be assessed if a GHP or NGHP entity had reported and exceeded any error tolerance(s) threshold established by the Secretary in any 4 out of 8 consecutive reporting periods (as defined later in this section). We proposed that the initial and maximum error tolerance threshold would be 20 percent (representing errors that prevent 20 percent or more of the beneficiary records from being processed), with any reduction in that tolerance to be published for notice and comment in advance of implementation. We proposed that this tolerance would be applied as an absolute percentage of the records submitted in a given reporting cycle.

In this final rule, all other proposed avenues for receiving a CMP have been eliminated and the only method of noncompliance that would be ripe for a CMP would be untimely reporting, as fully explained in the following section.

Comment: Many commenters emphasized that this rule should not be aimed at those exhibiting “good faith efforts” or those who make an earnest attempt at reporting but may do so occasionally with error but instead be aimed at those who fail to report at all.

Response: It is not our intent to penalize RREs for honest, infrequent mistakes, but instead to only resort to penalty when an RRE fails to report or submits reports in an untimely manner. We acknowledge that the overwhelming majority of RREs report correctly and timely a majority of the time and commend those entities for working with CMS to provide accurate data. It is, therefore, CMS's shared opinion with commenters that the focus shall not be to punish and impose consequences but instead to motivate proper reporting and maintain compliance with existing statute and regulation. To that end, CMS is adopting an audit approach in this final rule whereby we will audit a randomized sample of new beneficiary records received each quarter, rather than undertaking an automated review of all records submitted, as proposed. By using this random auditing approach, CMS will be better able to monitor trends in reporting, via manual review of said records, rather than a mass, computer-based algorithm, which will allow us to discover areas that appear to be more of a challenge for RREs without resorting to penalties that may be disproportionate to the level of noncompliance exhibited or have the effect of penalizing an entity for an honest mistake or system error. RREs will also be able to avail themselves of the informal notice and dispute process to alert CMS to their “good faith efforts” to report any records that CMS has identified as being out of compliance.

Comment: Some commenters raised concerns about the imposition of CMPs related to the reporting of Ongoing Responsibility for Medicals, (ORM). Specifically, these commenters cited difficulty with proper and timely reporting and understanding how to report ORM termination correctly.

Response: In the proposed rule, CMS proposed imposing penalties for failing to accurately and timely report ORM acceptance or termination. In the final rule, based on stakeholder concerns and submitted comments, CMS has chosen to focus its definition of noncompliance solely on those situations where an entity has failed to provide its initial report of primary payment responsibility in a timely manner. That means that untimely termination of ORM coverage records would not be considered eligible for a civil money penalty under this rule. While not a part of this final rule, we also note that CMS strives to engage with stakeholders, including RREs, about the reporting process and continuous process improvement efforts particularly as they relate to ORM, and will continue to do so in the future. We invite any RREs with concerns about ORM or any other aspect of reporting to proactively use the available outreach and education tools to address their questions.

We also wish to convey that time delays caused by CMS or its contractors in the reporting process will not trigger penalties related to timeliness. RREs must adhere to all applicable timelines, but any delay encountered when following CMS's policies and procedures will not be held against the RRE (for example, time delays related to processing by CMS contractors will not trigger any penalty).

Comment: A number of commenters suggested that CMS should develop a formal appeal process to provide entities with reporting obligations a formal structure in which to appeal any notice of a pending or imposed CMP.

Response: We note that CMPs imposed in accordance with this final rule will be subject to the formal appeals process as prescribed by 42 CFR 402.19 and set forth under 42 CFR part 1005. In broad terms, parties subject to CMPs will receive formal written notice at the time penalty is proposed. The recipient will have the right to request a hearing with an Administrative Law Judge (ALJ) within 60 calendar days of receipt. Any party may appeal the initial decision of the ALJ to the Departmental Appeals Board (DAB) within 30 calendar days. The DAB's decision becomes binding 60 calendar days following service of the DAB's decision, absent petition for judicial review.

Comment: Some commenters stressed the possibility of delays and uncertainty regarding their appeals due to backlogs at various stages of the administrative appeals process, and some suggested that CMS utilize a different appeals process.

Response: We affirm that CMS is bound by the appeal process as prescribed in 42 CFR 402.19 and set forth under 42 CFR part 1005.

Comment: Many commenters requested that CMS explain how it will provide notice to entities regarding pending or imposed CMPs and how much information will be included.

Response: We intend to communicate with the entity informally before issuing formal notice regarding a CMP. The informal (that is, prior to formal enforcement actions) written “pre-notice” process will allow the RRE the opportunity to present mitigating evidence for CMS review prior to the imposition of a CMP. The RRE will have 30 calendar days to respond with mitigating information before the issuance of a formal written notice in accordance with 42 CFR 402.7.

Common to all such instances where informal notice will be given is the intention to give the RRE an opportunity to clarify, mitigate, or explain any errors that were the result of a technical issue or due to an error or system issue caused by CMS or its contractors. It would be impractical and counter to the spirit of the informal notice process to regulate or enumerate all circumstances in which mitigating information could be provided or what that information should convey. As such, any mitigating factors or circumstances are welcomed, and a dialogue is encouraged in an attempt to find solutions that are short of imposing a CMP. We believe it is in the best interests of all RREs to leave the informal notice process open to any reasonable submission of mitigating factors so that we are free to entertain all such documentation without strict limits on what is, or is not, acceptable.

Once we determine that a CMP will be imposed (after the informal notice period) we will provide formal notice to the entity in writing in accordance with 42 CFR 402.7, which will contain information on the event that has triggered the proposed imposition of a CMP, the amount of the proposed CMP, and next steps for the entity, including a right to a hearing in accordance with 42 CFR 402.19 and part 1005.

Comment: Commenters suggested that CMS should not impose CMPs in situations where required information has already been reported to another agency or entity, such as the Department of Labor, or in situations where multiple entities have obligations to report the same information to CMS and one entity has already reported.

Response: Sections 1862(b)(7) and (b)(8) of the Act imposed certain unique requirements on specific entities to report data to CMS for the purposes of identifying those situations where another party has primary payment responsibility. These reporting requirements were imposed under the Act, regardless of whether another agency or entity requires the same or similar data (and such data must also be reported to CMS in the manner and form specified by the Secretary). The current Office of Management and Budget (OMB) control number assigned to this information collection effort, as required under the Paperwork Reduction Act, is 0938–1074.

Commenters provided examples of data submitted to other agencies that they believe are similar, but the data are not used for a comparable purpose to the data that is reported to CMS. Consequently, this data is neither in the same format that CMS systems require, nor is it the complete set of data that CMS needs for the proper coordination of benefits. Therefore, any attempt to create a data-sharing agreement that would render reporting to CMS truly duplicative would require that other agencies update their data collection efforts to align with CMS, despite the fact that those agencies may have no need for that data. Not only would that impose additional costs to the federal government to accommodate a relatively small number of entities, it would also undermine efforts under this rule to verify the accuracy or timeliness of the reporting. Therefore, it is impractical to attempt to promulgate such data sharing agreements and all RREs must continue to perform reporting as required by the Act.

Comment: Commenters suggested that CMS not impose CMPs when CMS has been able to coordinate benefits correctly or CMS has otherwise been able to recover any conditional payments made due to untimely or inaccurate reporting.

Response: The obligations to report under sections 1862(b)(7) and (b)(8) of the Act are separate and distinct from any other obligation with respect to MSP, including reimbursement. Providing accurate information in response to recovery efforts does not satisfy those obligations and the fact that we may be able to eventually correctly coordinate benefits and retain the right to pursue recovery does not negate the reporting obligations established under sections 1862(b)(7) and (b)(8) of the Act.

Comment: Most commenters requested a statute of limitations on the imposition of CMPs.

Response: We agree and will apply the 5-year statute of limitations as required by 28 U.S.C. 2462. Under 28 U.S.C. 2462, we may only impose a CMP within 5 years from the date when the noncompliance occurred.

Comment: Many commenters suggested that the statute of limitations should be 3 years.

Response: Under 28 U.S.C. 2462, the applicable statute of limitations is 5 years. Although section 1862(b)(2)(B)(iii) of the Act establishes a 3-year statute of limitations for certain actions, that provision applies only to legal actions CMS may utilize for the recovery of MSP debts. While recovery of conditional payments (overpayments) and the imposition of CMPs may appear, on their face, to be similar actions, they are unique and serve separate, distinct purposes and the statute of limitations applicable to the former does not also apply to the latter. An explanation and example of how this 5-year statute of limitations will apply is as follows: For failure to initially report the date of settlement or effective date of coverage timely (where applicable), noncompliance occurs on every day of non-reporting after the required timeframe for reporting has elapsed. For example, if the date of settlement is January 1, 2025, then the RRE will have 1 year from that date to report the coverage before being potentially subject to a CMP (that is, January 1, 2026). If the settlement date was January 1, 2025, but the RRE did not report it to CMS until October 15, 2026, the RRE will be considered noncompliant for the period of January 2, 2026, through October 15, 2026. If CMS does not act until after October 15, 2031, then the statute of limitations has elapsed and no CMP may be imposed.

Comment: Many commenters suggested that the rule should be enforced prospectively only.

Response: We concur and will evaluate compliance based only upon files submitted by the RRE on or after the effective date of the final rule. CMPs will only be imposed on instances of noncompliance based on those settlement dates, coverage effective dates, or other operative dates that occur after the effective date of this regulation and as such, there will be no instances of inadvertent or de facto retroactivity of CMPs. The 1-year period to report the required information before CMPs would potentially be imposed would begin on the latter of the rule effective date or the settlement or coverage effective dates which an RRE is required to report in accordance with sections 1862(b)(7) and (b)(8) of the Act.

Comment: Commenters suggested that CMS refrain from imposing CMPs where NGHPs with reporting obligations under section 1862(b)(8) of the Act make “good faith efforts” to obtain required information from individuals who are unwilling or unable to provide it. Some “good faith efforts” suggested included the following: (1) CMS could accept documentation signed by the individual stating that he or she is either not a Medicare beneficiary, or will not provide the NGHP entity with his or her Social Security Number (SSN) (full SSN or last 5 digits); and (2) CMS could accept a judicial order establishing that the individual is not required to provide his or her Medicare Beneficiary Identifier (MBI) or SSN to the NGHP entity.

Response: We note that concerns about “good faith efforts” were received from the NGHP industry and not the GHP industry during both rounds of comments, which we believe is reflective of the fundamental differences between the two industries and the relationships between those plans and the individuals in question. Our understanding is that NGHP applicable plans may at times be in an adversarial relationship with the reportable individual, whereas the reportable individual is typically the client of a GHP. To this end we understand the concern regarding privacy law or consumer protection statute violations, as were mentioned by some commenters.

In response to these comments, we stress that CMPs will not be imposed against NGHP entities where those entities have made good faith efforts, as outlined in this final rule, to obtain necessary reporting information. NGHP entities must document their efforts to obtain this reporting information and retain this documentation, as we retain the right to audit such documentation. In response to comments, we are finalizing a revised version of our proposal regarding how NGHPs may avoid being subject to CMPs where they have made sufficient efforts to obtain the necessary information. The revisions we are finalizing address commenter concerns regarding the type and number of communication attempts an RRE must perform, as well as documentation of express refusal by an individual or their attorney or representative to provide the requested information as a way to satisfy the obligation to attempt to collect that information.

Comment: Many commenters continued to suggest that CMS should specify a series of “safe harbors” that would preclude the assessment of a CMP.

Response: In this section, we outline two such safe harbors but acknowledge that other situations may exist where it is inappropriate to penalize an entity for noncompliance. We welcome RREs to use the informal or formal appeal process if there are other situations that the RRE believes makes it inappropriate to receive a CMP.

First, any untimely reporting that is the result of a technical or system issue outside of the control of the RRE, or that is the result of an error caused by CMS or one of its contractors would not be considered noncompliance for purposes of this rule. See a more thorough explanation in “Amount of CMPs”.

Second, any untimely reporting by an NGHP that is the result of a failure to acquire all necessary reporting information due to a lack of cooperation by the beneficiary will not lead to a CMP provided that certain standards are met. This situation is addressed in greater detail in section III.D. of this final rule and § 402.1(c)(22)(ii)(A) as finalized.

Comment: Commenters suggested that CMS consider suspending the imposition of CMPs where changes to mandatory reporting procedures require RREs to make significant revisions to the systems used to prepare the data for reporting.

Response: We will continue to provide a minimum of 6 months' (180 calendar days) notice prior to any changes in procedure, including systems alterations or changes to the required data elements, associated with section 111 of MMSEA required reporting to allow reporting entities adequate time to react. We will not assess any CMPs associated with a specific change for a minimum of 2 reporting periods following the implementation (effective date) of that policy or procedural change. As provided in § 402.1(c)(21)(ii)(A) and (c)(22)(ii)(C) as finalized, in the event we are unable to provide a minimum of 6 months' notice prior to implementing any reporting process changes (such as the addition of a new required data element), we will not impose any CMPs associated with that specific reporting process change for a minimum of 1 year after that change becomes effective. CMPs associated with any unchanged aspects of reporting may still be imposed during this time.

2. Overall Response to Comments

We solicited comments on our proposed approaches to imposing and not imposing CMPs, including our proposed methods of calculating CMP amounts. Our proposed approach to imposing CMPs was developed with the intention of giving entities meaningful opportunities to resolve most reporting issues, without the immediate risk that a CMP would be imposed. After consideration of the public comments we received, we have made a number of important revisions in this final rule.

As described in the proposed rule and earlier in this final rule, the amount of CMPs for GHPs is established in section 1862(b)(7)(B) of the Act, and, except for those situations and criteria described in this final rule, CMS does not have the authority to adjust the amount of the CMP levied on a GHP entity. In the case of NGHPs, where CMS is permitted discretion in the amount of the CMP, we are finalizing a tiered approach based upon the length of time for which a submission was untimely to better align the penalty to the severity of the noncompliance. In the case of GHPs, the statutory language at section 1862(b)(7)(B) of the Act does not allow this level of discretion, and CMS is therefore unable to adjust the amount of GHP-related CMPs.

The submission of information or documentation that serves to mitigate the noncompliance, or explain a technical error, will be considered on a case-by-case basis in an effort to prevent the imposition of a CMP at all.

Based on the comments we received, we have determined that we will only impose penalties where the initial report was not received in a timely manner. Penalties will not be imposed on any other basis, such as in relation to the quality of reporting. Timeliness is determined by comparing the date a record is submitted and accepted against the date CMS should have received the record. The date CMS should receive a record is determined by the effective date of coverage or the date of settlement (or settlement funding date if the funding of the settlement is delayed) plus 1 year (365 days). For every day a record is submitted that is past the date that CMS should have received the information, a penalty of up to $1,000 per day for NGHP RREs or $1,000 per day, in the case of GHP RREs, will be imposed.

No CMP will be imposed until at least 1 year (365 days) after the later of: (1) the applicability date of this final rule; or (2) the coverage effective date, or settlement date, an RRE is required to report. This is a minor change from the proposed rule which seeks to clarify that RREs will have at least 1 year from the rule applicability date before any CMP is contemplated. The date that information was submitted by the RRE will determine timeliness. Any delay that is the result of technical or administrative issues on the part of CMS or its contractors will not be held against the RRE for purposes of calculating whether reporting was timely.

In the proposed rule, we proposed that we would not impose a CMP in the following situations, where all of the applicable conditions are met:

• If an RRE reports any GHP beneficiary record that is reported on a quarterly submission timeframe within the required timeframe (not to exceed 1 year after the GHP effective date), or any NGHP beneficiary record that is submitted within the required timeframe (not to exceed 1 year after the settlement date or ORM effective date).
• If an RRE complies with any settlement reporting thresholds or any other reporting exclusions published in CMS's MMSEA Section 111 User Guides or otherwise established by CMS. Note that these thresholds are not defined in the regulatory text as they include operational thresholds that are currently subject to change on an annual basis per section 1862(b)(9)(B) of the Act as well as other operational thresholds for reporting that CMS elects to impose, such as the current $5,000 threshold for Health Reimbursement Arrangements, which are communicated to RREs through the MMSEA Section 111 User Guides. Our ability to implement such thresholds and operational exclusions, whether as statutorily mandated or to be responsive to stakeholder or litigation needs, is not altered by this regulation.

• If an NGHP entity fails to report timely because the NGHP entity was unable to obtain information necessary for reporting from the reportable individual, including an individual's last name, first name, date of birth, gender, MBI, or SSN (or the last 5 digits of the SSN), and the responsible applicable plan has made and maintained records of its good faith effort to obtain this information by taking all of the following steps:

++ The NGHP has communicated the need for this information to the individual and his or her attorney or other representative (if applicable) and requested the information from the individual and his or her attorney or other representative at least twice by mail and at least once by phone or other means of contact such as electronic mail in the absence of a response to the mailings.

++ The NGHP certifies that it has not received a response, or has received a response in writing that the individual will not provide his or her MBI or SSN (or last 5 digits of his or her SSN).

++ The NGHP has documented its efforts to obtain the missing information, such as the MBI or SSN (or the last 5 digits of the SSN) and the reason for the failure to collect this information.

The NGHP entity should maintain records of these good faith efforts (such as dates and types of communications with the individual) in order to be produced as mitigating evidence should CMS contemplate the imposition of a CMP. Such records must be maintained for a period of 5 years. The current OMB control number assigned to this information collection effort, as required under the Paperwork Reduction Act, is 0938–1074.

III. Provisions of the Final Regulations

The final rule incorporates some of the provisions of the proposed rule and also revises some of the provisions as proposed. Additionally, the final rule clarifies how the identification of noncompliance will occur, which was not discussed in the proposed rule. Those provisions of this final rule that differ from the proposed rule are as follows:

A. Removal of Any Basis Other Than Timeliness as a Reason for Imposing a CMP

The only basis for the imposition of a CMP will be untimely reporting of required information. The final rule removes all references in the proposed rule to “contradictory reporting” or “exceeding error tolerance” as a reason to impose a CMP. Specifically, any references to an applicable plan providing contradictory reporting, and any CMPs imposed as a result, that were proposed in 42 CFR 402.1(c)(21) and (c)(22), 402.105(b)(2) and (b)(3), or elsewhere, are removed and are not being finalized. As such, the following sections of the proposed regulations text have been removed and are not being finalized:

• Sections 402.1(c)(21)(ii) and (iii).
• Sections 402.1 (c)(22)(ii) and (iii).
• Sections 402.105(b)(2)(ii) and (iii).
• Sections 402.105(b)(3)(ii) and (iii).

B. Audit Methodology for Analyzing Records

To identify potential instances of noncompliance, rather than imposing CMPs based upon automated monitoring of all RRE submissions as contemplated in the proposed rule, we will utilize the following process to audit a randomized sample of recently added beneficiary records:

• CMS has determined that, given the time and resources necessary to accurately and thoroughly evaluate the accuracy of any submitted record, it would be possible to audit a total of 1,000 records per calendar year across all RRE submissions, divided evenly among each calendar quarter (250 individual beneficiary records per quarter).

• CMS will evaluate a proportionate number of GHP and NGHP records based on the pro-rata count of recently added records for both types of coverage over the calendar quarter under evaluation. For example, if over the calendar quarter being evaluated, CMS received 600,000 GHP records and 400,000 NGHP records for a total of 1,000,000 recently added beneficiary records, then 60 percent of the 250 records audited for that quarter would be GHP records, and 40 percent would be NGHP records.

• At the end of each calendar quarter, CMS will randomly select the indicated number of records and analyze each selected record to determine if it is in compliance with the reporting requirements as required by statute and defined herein.
• Noncompliance is defined as any time CMS identifies a new beneficiary record that was not reported to CMS timely. Timeliness is defined as reporting to CMS within 1 year of the date GHP coverage became effective, the date a settlement, judgment, award, or other payment determination was made (or the funding of a settlement, judgment, award, or other payment, if delayed), or the date when an entity's Ongoing Responsibility for Medicals (ORM) became effective. Failure to report timely prevents CMS from promptly and accurately determining the proper primary payer and taking the appropriate actions.
• For GHP entities, for any selected record that is more than 1 year (365 calendar days) late, a penalty of $1,000 per day (as adjusted) of noncompliance will be imposed as indicated herein.
• For NGHP entities, for any selected record determined to be noncompliant, a tiered approach to penalties will be implemented as described in detail in section III.C. of this final rule.
• To calculate the penalty imposed against an RRE, CMS will multiply the number of audited records found to be noncompliant by the number of days that each record was late (in excess of 365 days). The product will then be multiplied by the appropriate penalty amount, as described previously and below.

C. Tiered Approach for NGHP RREs

Because we have the statutory authority to adjust the amounts of penalties imposed on NGHP RREs, a tiered approach and cap on the total amount of penalties applicable to such RREs are being finalized in this rule. As explained previously, the statute does not permit us to extend this approach to GHP RREs. For any record selected via the random audit process described above where the NGHP RRE submitted the information more than 1 year after the date of settlement, judgment, award, or other payment (including the effective date of the assumption of ongoing payment responsibility for medical care); the daily penalty will be—

• $250, as adjusted annually under 45 CFR part 102, for each calendar day of noncompliance, where the record was reported 1 year or more, but less than 2 years after, the required reporting date;
• $500, as adjusted annually under 45 CFR part 102, for each calendar day of noncompliance, where the record was reported 2 years or more, but less than 3 years after, the required reporting date; or
• $1,000, as adjusted annually under 45 CFR part 102, for each calendar day of noncompliance, where the record was reported 3 years or more after the required reporting date.

Additionally, the total penalty for any one instance of noncompliance by an NGHP RRE for a given record identified by CMS will be no greater than $365,000 (as adjusted annually under 45 CFR part 102).

While we emphasize that all RREs are obligated to comply with their reporting obligations, CMS's approach to enforcement, where a randomized sample of records will be reviewed closely (as opposed to an automated review of all records), means that smaller entities are inherently much less likely to have their records audited for compliance. We also encourage entities that are smaller and less experienced with Medicare's coordination of benefits processes to take advantage of the resources and support available to ensure compliance.

D. Clarification of Good Faith Efforts To Obtain Identifying Information

A key change for the final rule is the expansion of the circumstances under which an NGHP entity may avoid CMPs for noncompliance caused by failure to obtain identifying information from an individual despite a good faith effort to do so.

In the proposed rule, we proposed providing NGHPs with the ability to document “good faith” efforts to obtain identifying information of reportable individuals. In the final rule, we are expanding this exemption. Specifically, as proposed in the proposed rule, NGHPs must make a total of three attempts to obtain the required information. At least two attempts to obtain the required information from the individual and his or her attorney must be by mail or electronic mail, but the final rule permits that the third attempt may be via telephone, electronic mail, or some other reasonable method.

Further, the final rule permits that, should an individual or their attorney or representative clearly and unambiguously decline to provide the information requested, no further attempts by the RRE to obtain the required information would be required. This documented refusal to provide the required information must be maintained for a minimum of 5 years, in accordance with the other requirements of this section of the rule.

We understand that NGHP RREs are concerned that attempts to obtain beneficiary information, particularly when in an adversarial relationship with the beneficiary, may be construed as running afoul of certain state and local privacy and anti-harassment laws. If the intent and purpose of the RRE's communications with beneficiaries was solely to comply with federal requirements, we believe any privacy or anti-harassment law would be preempted by the reporting requirements set forth in the Act.

All other parameters related to obtaining identifying information, including records retention requirements, are being finalized as proposed.

IV. Collection of Information Requirements

This document does not impose any new information collection requirements, that is, reporting, recordkeeping, or third-party disclosure requirements. The associated information collection requirements imposed under mandatory insurer reporting are already approved under OMB control number 0938–1074. Consequently, there is no need for review by the Office of Management and Budget under the authority of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.). We did not receive comments on the previous statement and therefore are finalizing the language without modification.

V. Regulatory Impact Statement

We have examined the impact of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993) and Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011) as amended by the Executive Order on Modernizing Regulatory Review on April 6, 2023), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96–354), section 1102(b) of the Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104– 4), Executive Order 13132 on Federalism (August 4, 1999), and the Congressional Review Act (CRA) (5 U.S.C. 804(2)).

Executive Orders 12866 and 13563, as amended by the Executive Order on Modernizing Regulatory Review on April 6, 2023, direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A Regulatory Impact Analysis (RIA) must be prepared for major rules with economically significant effects ($200 million or more in any 1 year). Modelling of potential penalties likely to be imposed under this rule demonstrates that this rule does not reach the economic threshold and thus is not considered a major rule.

Based on CMS workload and resource availability, the sampling methodology explained herein would result in a fixed number of submitted records to be audited each calendar quarter to determine compliance and potential penalty. At present, and absent a notice-and-comment period to alter such limit, CMS will audit up to 1,000 records each year, or up to 250 each calendar quarter. CMS has utilized the methodology as described in previous sections, in conjunction with utilizing data from the preceding calendar year regarding RRE reporting habits and volume, to determine the anticipated penalties that would be levied if no other changes in behavior were observed. Although we note that CMS believes that publication of the rule will have the intended effect of incentivizing increased compliance with reporting requirements in an effort to avoid a CMP, we have analyzed the existing data with no adjustments for subjective analysis. Assuming the rule had been in effect and CMPs could have been imposed based upon reporting behavior for calendar year 2022, the maximum penalties imposed would have been $86.4 million for GHP entities and $42.4 million for NGHP entities, for a total annual CMP amount of $128.8 million, which is below the $200 million threshold to be considered an economically significant rule. We also note that reporting behavior in this period may be skewed towards more untimely reporting, potentially reflecting efforts to come into compliance in advance of this rule becoming effective. Consequently, we believe this is a worst-case scenario and do not expect to collect CMPs totaling $200 million or more in any given year, nor do we expect this rule to have any other economic effects that meet or exceed that threshold.

The RFA requires agencies to analyze options for regulatory relief of small entities. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of $7.0 million to $35.5 million in any 1 year. Individuals and States are not included in the definition of a small entity. We consider a rule to have a significant impact on a substantial number of small entities if it has at least a 3 percent impact of revenue on at least 5 percent of small entities. Affected entities with reporting responsibilities have been required to comply with sections 1862(b)(7) and (b)(8) of the Act since these provisions were added to the Act in 2007. This rule is intended to define how CMPs would be imposed as a consequence of noncompliance with these statutory obligations, and thus does not present any additional burden beyond the review of the rule. As discussed later in this section, the total cost impact of reviewing this rule by all 20,855 actively reporting RREs, regardless of size, is estimated to be $7,699,249, or $369.18 per entity. As the provisions and regulations, the violation of which will result in a CMP under this regulation, are already in place, no additional costs to comply with this regulation should be realized by any RRE. This regulation merely enumerates when and how CMPs will be levied but does not impose any additional rules or requirements on any RRE that does not already, at present, exist. This falls below the standard definition of “significance” of 3 or more of small entity revenue. As a result, we have determined, and the Secretary certifies, that this rule would not have a significant economic impact on a substantial number of small entities.

In addition, section 1102(b) of the Act requires us to prepare an RIA if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 for the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area for Medicare payment regulations and has fewer than 100 beds. We are not preparing an analysis for section 1102(b) of the Act because we have determined, and the Secretary certifies, that this rule would not have a significant impact on the operations of a substantial number of small rural hospitals.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2023, the threshold is approximately $177 million. This rule will have no consequential effect on state, local, or tribal governments or on the private sector. Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. Since this final rule does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.

We used the current number of actively reporting GHP RREs (1,039) and NGHP RREs (19,816) to determine the total number of impacted entities (20,855). We recognize that this is a slight overestimate, as a single corporate parent may have multiple associated RREs. We welcome any comments on the approach in estimating the number of entities which will review this rule.

Using the May 2022 wage information from the U.S. Department of Labor Bureau of Labor Statistics for medical and health service managers (Code 11–9111), we estimate that the cost of reviewing this rule is $123.06 per hour, based on doubling the mean hourly wage of $61.53 to include overhead and fringe benefits (see https://www.bls.gov/​oes/​current/​oes119111.htm). We assume that one individual associated with each of the 20,855 impacted entities will read the rule. Assuming an average reading speed, we estimate that it would take approximately 3 hours for the staff to review this rule. For each entity that reviews the rule, the estimated cost is $369.18 (3 hours × $123.06). Therefore, we estimate that the total cost of reviewing this rule is $7,699,249 ($369.18 × 20,855).

We did not receive additional comments on the regulatory impact statement section through the public comment period.

In accordance with the provisions of Executive Order 12866, this rule was reviewed by the Office of Management and Budget.

Chiquita Brooks-LaSure, Administrator of the Centers for Medicare & Medicaid Services, approved this document on September 28, 2023.

List of Subjects

42 CFR Part 402

• Assessments
• Civil money penalties
• Exclusions

45 CFR Part 102

• Administrative practice and procedure
• Penalties

For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services proposes to amend 42 CFR chapter IV as set forth below:

PART 402—CIVIL MONEY PENALTIES, ASSESSMENTS, AND EXCLUSIONS

1. The authority citation for part 402 is revised to read as follows:

Authority: 42 U.S.C. 1302 and 1395hh.

2. Section 402.1 is amended—

a. In paragraph (c) introductory text by removing the reference “(c)(34) of this section” and adding in its place the reference “(c)(35) of this section”;

b. By removing paragraph (c)(20);

c. By redesignating paragraph (c)(21) as paragraph (c)(20);

d. By redesignating paragraphs (c)(22) through (34) as paragraphs (c)(23) through (35); and

e. Adding new paragraphs (c)(21) and (22).

The additions read as follows:

§ 402.1

Basis and scope.

* * * * *

(c) * * *

(21) Section 1862(b)(7)(B)—Except for the situation described in paragraphs (c)(21)(ii)(A) and (B) of this section, any entity that has a reporting obligation under section 1862(b)(7) of the Act (“reporting entity”) that—

(i) Fails to report any beneficiary record within 1 year of the last acceptable reporting date, defined as 365 days from the GHP coverage effective date or the Medicare beneficiary's entitlement date, whichever is later.

(ii) A civil money penalty (CMP) is not imposed if—

(A) The incident of noncompliance is associated with a specific reporting policy or procedural change on the part of CMS that has been effective for less than 6 months following the implementation of that policy or procedural change (or for 1 year, should CMS be unable to provide a minimum of 6 months' notice prior to implementing such changes).

(B) The entity complies with any reporting thresholds or any other reporting exclusions.

(22) Section 1862(b)(8)(E)—Except for the situations described in paragraph (c)(22)(ii)(A), (B) and (C) of this section, any applicable plan that has a reporting obligation under section 1862(b)(8) of the Act (“applicable plan”), that—

(i) Fails to report any beneficiary record within 1 year from the date of the settlement, judgment, award, or other payment, or the effective date where ongoing payment responsibility for medical care has been assumed by the entity.

(ii) A CMP is not imposed in the following situations:

(A) An NGHP applicable plan fails to report required information as a result of the applicable plan's inability to obtain an individual's last name, first name, date of birth, gender, Medicare Beneficiary Identifier (MBI), Social Security Number (SSN), or the last 5 digits of the SSN, and the applicable plan has made a good faith effort to obtain this information by meeting the following:

( 1) Has communicated the need for this information to the individual and his or her attorney, or other representative, if applicable, or both.

( 2) Has requested the information from the individual and his or her attorney, or other representative (if applicable), at least three times—

( i) Once in writing (including electronic mail);

( ii) Then at least once more by mail; and

( iii) At least once more by phone or other means of contact in the absence of a response to the mailings.

( 3) Has not received a response or has received a written response clearly indicating that the individual refuses to provide the needed information. Should the applicable plan receive a written response from the individual or their attorney or representative that clearly and unambiguously declines or refuses to provide any portion of the information specified herein, no additional communications with the individual or their attorney or other representative are required.

( 4) Has documented its efforts to obtain the MBI or SSN (or the last 5 digits of the SSN). This documentation, including any written rejection correspondence, must be retained for a minimum of 5 years.

(B) An NGHP applicable plan complies with any reporting thresholds or any other reporting exclusions.

(C) The incident of noncompliance is associated with a specific reporting policy or procedural change on the part of CMS that has been effective for less than 6 months following the implementation of that policy or procedural change (or for 12 months, should CMS be unable to provide a minimum of 6 months' notice prior to implementing such changes).

* * * * *

3. Section 402.105 is amended by revising paragraph (b)(2) and adding paragraph (b)(3) to read as follows:

§ 402.105

Amount of penalty.

* * * * *

(b) * * * *

(2) For entities with reporting obligations under section 1862(b)(7) of the Act (“reporting entity”), if a reporting entity fails to report any beneficiary record within the specified period from the latter of the GHP coverage effective date or the Medicare beneficiary's entitlement date. The penalty is—

(i) Calculated on a daily basis, based on the number of recently added beneficiary records reviewed where CMS identifies that the entity submitted the required information more than 1 year after the GHP coverage effective date for the individual; and

(ii) $1,000 as adjusted annually under 45 CFR part 102 for each calendar day starting the day after 1 year (365 days) from the first instance of noncompliance, as defined in paragraph (b)(2)(i) of this section.

(3) For entities with reporting obligations under section 1862(b)(8) of the Act (“applicable plan”) as follows:

(i) If an applicable plan fails to report any NGHP beneficiary record within the specified period from the date of the settlement, judgment, award, or other payment (including the effective date of the assumption of ongoing payment responsibility for medical care). The penalty is—

(A) Calculated on a daily basis, based on the number of recently added beneficiary records reviewed where CMS identifies that the entity submitted the required information more than 1 year after the date of settlement, judgment, award, or other payment (including the effective date of the assumption of ongoing payment responsibility for medical care);

(B) $250 (as adjusted annually under 45 CFR part 102) for each calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of this section for each individual for which the required information should have been submitted, but was reported more than 1 year but less than 2 years after the required reporting date;

(C) $500 (as adjusted annually under 45 CFR part 102) for each calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of this section for each individual for which the required information should have been submitted, but was reported 2 years or more, but less than 3 years, after the required reporting date; and

(D) $1,000 (as adjusted annually under 45 CFR part 102), for each calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of this section for each individual for which the required information should have been submitted, but was reported 3 years or more after the required reporting date.

(ii) The maximum penalty that may be imposed for noncompliance associated with any one individual for which the required information should have been submitted is $365,000 (as adjusted annually under 45 CFR part 102).

* * * * *

For the reasons specified in the preamble, the Department of Health and Human Services amends 45 CFR part 102 as specified below:

PART 102—ADJUSTMENT OF CIVIL MONETARY PENALTIES FOR INFLATION

4. The authority for part 102 continues to read as follows:

Authority: Pub. L. 101–410, Sec. 701 of Pub. L. 114–74, 31 U.S.C. 3801–3812.

5. Section 102.3 is amended in table 1 by adding references for U.S.C. 1395y(b)(6)(B), 1395y(b)(7)(B)(i), and 1395y(b)(8)(E)(i) in numerical order to read as follows:

§ 102.3

Penalty adjustment and table.

* * * * *

Table 1 to § 102.3—Civil Monetary Penalty Authorities Administered by HHS Agencies and Penalty Amounts

U.S.C. sections	CFR 1	HHS agency	Description 2	Date of last statutorily established penalty figure 3	2021 maximum adjusted penalty ($)	2022 maximum adjusted penalty 4 ($)
*         *         *         *         *         *         *
42 U.S.C.:
*         *         *         *         *         *         *
1395y(b)(6)(B)	42 CFR 402.1(c)(20), 402.105(a)	CMS	Penalty for any entity that knowingly, willfully, and repeatedly fails to complete a claim form relating to the availability of other health benefits in accordance with statute or provides inaccurate information relating to such on the claim form	2021	3,484	3,701
1395y(b)(7)(B)(i)	42 CFR 402.1(c)(21), 402.105(a)	CMS	Penalty for any entity serving as insurer, third party administrator, or fiduciary for a group health plan that fails to provide information that identifies situations where the group health plan is or was a primary plan to Medicare to the HHS Secretary	2021	1,247	1,325
*         *         *         *         *         *         *
1395y(b)(8)(E)(i)	42 CFR 402.1(c)(22), 402.105(a)(E)	CMS	Penalty for any entity serving as insurer, third party administrator, or fiduciary for a non-group health plan that fails to provide information that identifies situations where the group health plan is or was a primary plan to Medicare to the HHS Secretary	2021	1,247	1,325
*         *         *         *         *         *         *
1  Some HHS components have not promulgated regulations regarding their civil monetary penalty-specific statutory authorities.
2  The description is not intended to be a comprehensive explanation of the underlying violation; the statute and corresponding regulation, if applicable, should be consulted.
3  Statutory or Inflation Act Adjustment.
4  The cost of living multiplier for 2018, based on the CPI–U for the month of October 2017, not seasonally adjusted, is 1.02041, as indicated in OMB Memorandum M–18–03, “Implementation of Penalty Inflation Adjustments for 2018, Pursuant to the Federal Civil Penalties Adjustment Act Improvements Act of 2015” (December 15, 2017).
5  The cost of living multiplier for 2020, based on the Consumer Price Index for all Urban Consumers (CPI–U) for the month of October 2019, not seasonally adjusted, is 1.01764, as indicated in OMB Memorandum M–20–05, “Implementation of Penalty Inflation Adjustments for 2019, Pursuant to the Federal Civil Penalties Adjustment Act Improvements Act of 2015” (December 16, 2019).

Dated: October 3, 2023.

Xavier Becerra,

Secretary, Department of Health and Human Services.