Medicare Program; Medicare Secondary Payer and Certain Civil Money Penalties

Citation88 FR 70363
Published date11 October 2023
Record Number2023-22282
CourtCenters For Medicare & Medicaid Services
SectionRules and Regulations
Federal Register, Volume 88 Issue 195 (Wednesday, October 11, 2023)
[Federal Register Volume 88, Number 195 (Wednesday, October 11, 2023)]
                [Rules and Regulations]
                [Pages 70363-70373]
                From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
                [FR Doc No: 2023-22282]
                -----------------------------------------------------------------------
                DEPARTMENT OF HEALTH AND HUMAN SERVICES
                Centers for Medicare & Medicaid Services
                42 CFR Part 402
                45 CFR Part 102
                [CMS-6061-F]
                RIN 0938-AT86
                Medicare Program; Medicare Secondary Payer and Certain Civil
                Money Penalties
                AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.
                ACTION: Final rule.
                -----------------------------------------------------------------------
                SUMMARY: This final rule will specify how and when CMS must calculate
                and impose civil money penalties (CMPs) when group health plan (GHP)
                and non-group health plan (NGHP) responsible reporting entities (RREs)
                fail to meet their Medicare Secondary Payer (MSP) reporting obligations
                by failing to register and report as required by MSP reporting
                requirements. This final rule will also establish CMP amounts and
                circumstances under which CMPs will and will not be imposed.
                DATES:
                 Effective date: This final rule is effective on December 11, 2023.
                 Applicability date: The provisions of this rule are applicable on
                or after October 11, 2024.
                FOR FURTHER INFORMATION CONTACT: Brian Broznowicz, (410) 786-3349.
                SUPPLEMENTARY INFORMATION:
                I. Background
                A. Imposition of Civil Money Penalties (CMPs)--Legislative Overview
                 In 1981, the Congress added section 1128A to the Social Security
                Act (the Act) (section 2105 of Pub. L. 97-35) to authorize the
                Secretary of Health and Human Services (the Secretary) to impose civil
                money penalties (CMPs) and assessments on certain health care
                facilities, health care practitioners, and other suppliers for
                noncompliance with rules of the Medicare and Medicaid programs. CMPs
                and assessments provide an enforcement tool for agencies to use to
                ensure compliance with statutory and regulatory requirements. These
                CMPs and assessments may be imposed in addition to potential criminal
                or civil penalties.
                 Since 1981, the Congress has increased both the number and the
                types of circumstances under which the Secretary may impose CMPs. Some
                CMP authorities address fraud, misrepresentation, or falsification,
                while others address noncompliance with programmatic or regulatory
                requirements. The Secretary has delegated the authority for certain
                provisions to either the Office of Inspector General (OIG) or Centers
                for Medicare & Medicaid Services (CMS). (See the October 20, 1994,
                notice, titled ``Office of Inspector General; Health Care Financing
                Administration; Statement of Organization, Functions, and Delegations
                of Authority'' (58 FR 52967).) A summary of these CMP changes is
                discussed in this section of this final rule.
                B. Medicare Secondary Payer History
                 In 1980, the Congress added section 1862(b) of the Act, which
                defined when Medicare is the secondary payer to certain primary plans.
                These provisions are known as the Medicare Secondary Payer (MSP)
                provisions of the Act.
                 Section 1862(b)(2)(A) of the Act prohibits Medicare from making
                payment if payment has been made, or can reasonably be expected to be
                made by any of the following primary plans:
                 Group Health Plans (GHPs).
                 Workers' compensation plans.
                 Liability insurance (including self-insurance).
                 No-fault insurance.
                 Medicare may make conditional payments, subject to Medicare payment
                rules, in situations where workers' compensation, liability insurance
                (including self-insurance), or no-fault insurance has not made payment
                or cannot be expected to make payment promptly. Any conditional
                payments that Medicare makes are subject to reimbursement from the
                primary plan. See section 1862(b)(2)(B) of the Act.
                C. Legislative Provisions Regarding Mandatory Reporting Requirements
                 To enhance enforcement of the MSP provisions, section 111 of the
                Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA) (Pub. L.
                110-173) added paragraphs (7) and (8) to section 1862(b) of the Act.
                These paragraphs established new mandatory reporting requirements
                regarding Medicare beneficiaries who have coverage under GHP
                arrangements, as well as when liability insurance (including self-
                insurance), no-fault insurance, or workers' compensation (collectively
                referred to as Non-Group Health Plans, or NGHPs) provide settlements,
                judgments, awards, or assume other payment responsibility for Medicare
                beneficiaries' care. Sections 1862(b)(7)(A) and (b)(8)(F) of the Act
                define those parties responsible for this
                [[Page 70364]]
                reporting (collectively referred to as responsible reporting entities,
                or RREs). Under section 1862(b)(7)(A) of the Act, GHPs or third-party
                administrators are obligated to report beneficiary coverage; almost
                1,000 entities are registered as GHP RREs, with 62 percent estimating
                between 1,000 and 100,000 individual beneficiaries to be reported
                annually. Under section 1862(b)(8)(F) of the Act, NGHP applicable plans
                are obligated to report settlements or when the entity otherwise
                assumes payment responsibility, and over 21,000 entities are registered
                as NGHP RREs, with the vast majority (88.29 percent) estimating fewer
                than 500 individual beneficiaries to report annually at the time of
                registration.
                 RREs are currently required to submit coverage information for
                Medicare beneficiaries including, but not limited to, when coverage
                begins or ends, or when a judgment, award, settlement, or other payment
                is made, on a quarterly basis through an electronic file submission
                process that may vary depending upon the number of beneficiary records
                being reported or updated. NGHP RREs who submit 500 or less claim
                reports per year are eligible to utilize the Coordination of Benefits
                Secure website (COBSW) Direct Data Entry (DDE) reporting option to add,
                update, or delete claim information. DDE submitters have the same
                responsibility and accountability as any other RRE. This coverage
                information primarily consists of enough identifying information to
                uniquely identify the Medicare beneficiary and confirm their
                beneficiary status, as well as information about the nature of the
                coverage (such as GHP or NGHP, coverage effective dates, policy limits,
                settlement amounts, and so forth). These section 111 of MMSEA reporting
                provisions did not alter any other existing statutory provisions or
                regulations. Further, these reporting provisions include authority for
                CMS to impose CMPs against entities that fail to comply with the
                section 111 of MMSEA reporting requirements under section 1862(b)(7) or
                (b)(8) of the Act, as amended by the Medicare IVIG Access and
                Strengthening Medicare and Repaying Taxpayers Act of 2012 (the SMART
                Act). These provisions also require that GHPs and NGHPs that fail to
                comply with these reporting requirements shall be subject to a CMP of
                $1,000 and up to $1,000, respectively, for each calendar day of
                noncompliance. Imposition of penalties related to noncompliance with
                section 111 of MMSEA are required to be promulgated in regulation,
                which is the purpose of this rule.
                 In 2013, Congress enacted the SMART Act, which amended section
                1862(b)(8)(E) of the Act, which includes the section 111 of MMSEA
                reporting requirements and describes the enforcement provisions for
                NGHPs that fail to comply with the reporting requirements.
                Specifically, the SMART Act revised section 1862(b)(8)(E) of the Act to
                state that NGHP applicable plans that fail to comply with the reporting
                requirements may be subject to a civil money penalty of up to $1,000
                for each calendar day of reporting noncompliance required of NGHP
                applicable plans under section 1862(b)(8)(E) of the Act. The SMART Act
                also added section 1862(b)(8)(I) of the Act, which specifically
                required rulemaking actions regarding the enforcement of CMP provisions
                under section 1862(b)(8)(E) of the Act.
                 We note that the SMART Act did not amend any CMP provisions for GHP
                arrangements that have reporting obligations under section 1862(b)(7)
                of the Act. Such GHP arrangements remain subject to mandatory CMPs of
                $1,000 per calendar day of noncompliance and per individual for whom
                submission of information was required. In addition, the SMART Act
                directed rulemaking for NGHP applicable plans regarding the imposition
                and non-imposition of CMPs.
                 We further note that the statutory language speaks to
                ``individuals,'' though there are situations described that are
                specifically applicable to Medicare beneficiaries; we have attempted to
                be consistent with the usage of this statutory terminology but use the
                term ``beneficiary'' where it is more appropriate.
                D. Summary of Public Comments Received on the December 11, 2013,
                Advance Notice of Proposed Rulemaking (ANPRM)
                 As the mandatory insurer reporting requirements themselves are
                self-implementing, we were able to gradually implement the reporting
                process from 2009 through 2011. The implemented reporting process
                included informal communications to RREs regarding their compliance
                with reporting requirements, including ``compliance flags'' in response
                to records that fail to meet specified criteria and even direct
                outreach to RREs. However, the implementation of civil money penalties
                for noncompliance requires formal rulemaking. In accordance with the
                rulemaking directed by the SMART Act, on December 11, 2013 (78 FR
                75304), we published an advance notice of proposed rulemaking (ANPRM)
                titled ``Medicare Secondary Payer and Certain Civil Money Penalties.''
                The December 2013 ANPRM solicited public comment on specific practices
                for which CMPs may or may not be imposed for failure to comply with MSP
                reporting requirements for certain GHP and NGHP arrangements.
                 We received 34 timely pieces of correspondence in response to the
                December 2013 ANPRM. In section I.D. of the February 18, 2020, proposed
                rule, we provided an analysis of the public comments received by
                subject area, with a focus on the most common issues raised, and
                briefly discuss how we proposed to address the issues raised by
                commenters in response to the 2013 ANPRM. Commenters expressed many of
                the same concerns and raised most of the same points that were raised
                in response to the proposed rule, published on February 18, 2020. While
                the proposed rule addressed these comments, alterations to the rule, as
                well as an evolving stakeholder landscape, resulted in many comments to
                the proposed rule being resubmitted in substantially similar form and
                content. Specifically, many commenters requested clarity around how a
                CMP would be calculated, the possibility of a sliding scale or tiered
                approach to levying CMPs, establishing a statute of limitations, and
                confirming that enforcement of the rule would be prospective only. For
                more detailed information on our analysis of the public comments on the
                ANPRM, please see the February 18, 2020, proposed rule (85 FR 8795
                through 8797).
                II. Provisions of the Proposed Rule and the Analysis of and Responses
                to Public Comments
                 In the February 18, 2020, Federal Register (85 FR 8793), we
                published the proposed rule titled ``Medicare Secondary Payer and
                Certain Civil Money Penalties.'' In drafting the February 2020 proposed
                rule, we reviewed the public comments in response to our December 11,
                2013, ANPRM (78 FR 75304), and other policy considerations.
                Accordingly, we proposed specific criteria for when CMPs would be
                imposed and proposed specific criteria for when CMPs would not be
                imposed, in circumstances when a GHP or an NGHP entity fails to comply
                (either on its own or through a reporting agent) with MSP reporting
                requirements specified under section 1862(b)(7) and (b)(8) of the Act.
                Further, we proposed to amend the amount of these CMPs, as set forth
                under 45 CFR 102.3 (Penalty adjustment and table).
                [[Page 70365]]
                 We received 47 timely pieces of public correspondence on the
                February 18, 2020, proposed rule. Commenters included various group
                health plans and private insurance companies (non-group health plan
                insurers) as well as their representatives, special interest groups,
                and other interested individuals. Some comments addressed issues or
                expressed concerns that were outside the scope of this rule and were
                thus inappropriate to address in this venue. Of the remaining comments,
                there were many that expressed concern with various aspects of the
                proposed rule including the possible amount of CMPs, the process by
                which noncompliance would be discovered, and the proportionality of the
                possible penalties when compared to the severity of the noncompliance
                as well as the relative size of the entity against which a penalty was
                contemplated. In direct response to public comment, as well as
                substantial internal data analysis, CMS has revised the final rule to
                be responsive to the concerns of those entities that may be impacted by
                the rule.
                A. CMP Basis and Scope in the Proposed Rule
                 The existing regulation at 42 CFR 402.1 describes the basis for
                imposition of CMPs against parties who violate the provisions of the
                Act. We proposed to add regulatory language under Sec. 402.1(c), which
                would identify situations in which GHP and NGHP RREs would be subject
                to CMPs under sections 1862(b)(7) and (b)(8) of the Act. To accomplish
                this regulatory addition, we proposed the following regulatory
                revisions in Sec. 402.1:
                 Removing paragraph (c)(20), which currently refers to a
                provision that is no longer applicable regarding the imposition of CMPs
                for employers that fail to timely, and accurately report an employee's
                group health insurance coverage.
                 Redesignating paragraph (c)(21) as paragraph (c)(20).
                 Redesignating paragraphs (c)(22) through (34) as
                paragraphs (c)(23) through (35).
                 Adding new paragraphs (c)(21) and (22), which will
                incorporate the new text finalized in this rule and all applicable
                provisions.
                 The existing regulation at 42 CFR 402.105(b) establishes the
                amounts of penalties assessed against parties who violate the
                provisions of the Act. We proposed to amend Sec. 402.105(b) by
                revising paragraph (b)(2) and adding a new paragraph (b)(3). The
                proposed regulation at Sec. 402.105(b)(2) would codify the amounts of
                penalties imposed against GHPs, and the proposed regulation at Sec.
                402.105(b)(3) would establish the amounts of penalties imposed against
                NGHPs.
                 In addition, we proposed to revise the regulations at 45 CFR 102.3
                to establish the updated amounts for all CMPs at issue in these
                regulations.
                 Comment: Some commenters expressed concerns about the potential
                size of the CMPs that would be imposed and recommended developing a
                ``sliding scale'' or ``tiered'' CMP approach. These suggestions
                included scaling the amount of the CMP to be imposed based upon the
                intentions of the noncompliant entity, or upon whether an excess
                proportion of individual beneficiary records failed to be reported as
                required (in essence creating a safe harbor for a certain portion of
                records to not be reported as required), and other similar
                recommendations to limit the size of the CMP. Some commenters also
                noted the statutory discrepancy between the penalty amounts for GHP,
                which are $1,000 per day of noncompliance, and NGHP entities, which are
                up to $1,000 per day of noncompliance.
                 Response: We begin by noting that CMS does not have the authority
                to alter penalties for GHPs, as penalty amounts are stated in section
                1862(b)(7) of the Act. In the proposed rule, we proposed that penalties
                for NGHP entities would parallel those for GHP entities. However,
                because CMS has the authority to adjust CMPs for NGHP entities, we are
                instead finalizing a tiered approach with respect to such entities,
                under which we will adjust penalty amounts based on the length of time
                that a report has been untimely. The full explanation of this approach
                appears in the next section of this document.
                 While ultimately the responsibility of the RRE, CMS is not
                unsympathetic to RREs in regard to those situations where a particular
                late submission was the result of a rare situation, system glitch,
                defect, or other problem that was unanticipated or out of the immediate
                control of the RRE. For this reason, an informal notice process will be
                implemented so that any RRE that receives notice that a CMP is pending
                against them will have an opportunity to examine their records and
                alert CMS to any discrepancies or mistakes that could mitigate or
                eliminate the potential penalty. This process is described in full
                detail later in this document.
                 Comment: Some commenters alleged that the amount of CMPs, in
                certain circumstances, are too high, excessive, disproportionate to the
                harm to the program, or unconstitutional.
                 Response: The amounts of the GHP CMPs are set by statute, in
                accordance with section 1862(b)(7)(B) of the Act, and CMS must enforce
                the amount as set by statute. While CMS has discretion to adjust CMPs
                for NGHPs under section 1862(b)(8)(E) of the Act, the statute does not
                authorize such discretion with respect to GHPs. In the proposed rule,
                we proposed that CMPs imposed against NGHPs would be aligned with those
                for GHP entities. However pursuant to this final rule, penalties for
                NGHP entities will instead be tiered based on the amount of time that a
                record has been late, or gone unreported, in accordance with the
                language of the statute which provides that penalties for NGHPs are up
                to $1,000 per day of noncompliance.
                 We originally proposed that CMPs may be levied in addition to any
                MSP reimbursement obligations identified using the reported
                information, but that CMS would not impose duplicative penalties. For
                example, failure to timely report the termination of coverage and then
                submitting the late termination in a manner that exceeds the error
                tolerance threshold for the fourth time in eight consecutive reporting
                periods, may meet the criteria for two potential CMPs with the
                submission of one record. However, we proposed that CMS would only
                impose a CMP once, and for the lesser of the two potential CMPs. This
                proposed limitation has been eliminated in the final rule as a result
                of being rendered unnecessary by the new audit methodology that will be
                employed.
                B. CMP Imposition and Amounts in the Proposed Rule
                 The proposed regulations at Sec. 402.1(c) identified circumstances
                where GHP and NGHP entities would be subject to CMPs for violation of
                sections 1862(b)(7) and (b)(8) of the Act. Following publication of the
                final rule, we intended to enhance monitoring of recovery process
                disputes and appeals that contradict reported data, as well as
                monitoring the reported data and performance over time to identify
                reporting that exceeded error tolerances. The proposed regulations at
                Sec. 402.105(b) explained how we would calculate CMP amounts for GHP
                and NGHP entities that have reporting obligations under sections
                1862(b)(7) and (b)(8) of the Act. Furthermore, proposed Sec. 402.1(c)
                identified situations where GHP and NGHP RREs would not be subject to
                CMPs for violation of sections 1862(b)(7) and (b)(8) of the Act. The
                final rule will limit CMPs to only instances of noncompliance based on
                timely reporting, so as to greatly simplify the process by which CMPs
                are
                [[Page 70366]]
                levied. The changes to the final rule are largely in response to
                stakeholder concerns raised in response to the ANPRM and proposed rule
                that alleged that the proposed process was confusing, punitive, and
                failed to serve the intended purpose of encouraging compliance and
                fostering collaboration with CMS. More information on this will be in
                the following section.
                 Under section 1862(b)(7) of the Act, a GHP RRE shall be subject to
                a CMP of $1,000 as adjusted annually under 45 CFR part 102 (currently
                $1,325 as of June 8, 2023; see 87 FR 15101)) for each calendar day of
                noncompliance for each individual for which the required information
                should have been submitted. Under section 1862(b)(8) of the Act, an
                NGHP RRE may be subject to a CMP of up to $1,000 as adjusted annually
                under 45 CFR part 102 (currently $1,325 as of June 8, 2023; see 87 FR
                15101) for each calendar day of noncompliance with respect to each
                claimant. These CMPs would be in addition to any other penalties
                prescribed by law, and in addition to any MSP claim under section
                1862(b) of the Act with respect to an individual.
                1. Imposition of a CMP
                 In the proposed rule, CMS indicated that a penalty would be imposed
                if an RRE fails to report or update any GHP beneficiary record within
                the required timeframe (no more than 1 calendar year after GHP coverage
                effective date or the Medicare beneficiary's entitlement date,
                whichever is later). In the proposed rule, CMS proposed that the
                penalty be calculated on a daily basis, based on the actual number of
                individual beneficiaries' records that the entity submitted untimely
                (that is, beyond the required timeframe after the GHP MSP effective
                date). CMS proposed that the penalty be $1,000 (as adjusted annually
                under 45 CFR part 102) for each calendar day of noncompliance for each
                individual for which the required information should have been
                submitted, as counted from the day after the last day of the RRE's
                assigned reporting window where the information should have been
                submitted through the day that CMS received the information, up to a
                maximum penalty of $365,000 (as adjusted annually under 45 CFR part
                102) per individual per year.
                 In the proposed rule, CMS also proposed a penalty if an RRE failed
                to report any NGHP beneficiary record within the required timeframe of
                no more than 1 year after the date of the settlement, judgment, award,
                or other payment (also referred to as the Total Payment Obligation to
                Claimant (TPOC)). CMS proposed that the penalty be calculated on a
                daily basis, based on the actual number of individual beneficiaries'
                records that the entity submitted untimely (that is, in excess of the
                required timeframe after the TPOC date). In the proposed rule, CMS
                proposed that the penalty be up to $1,000 (as adjusted annually under
                45 CFR part 102) for each calendar day of noncompliance for each
                individual for which the required information should have been
                submitted, as counted from the day after the last day of the RRE's
                assigned reporting window where the information should have been
                submitted through the day that CMS received the information, up to a
                maximum penalty of $365,000 (as adjusted annually under 45 CFR part
                102) per individual per year.
                 In the proposed rule, CMS also proposed that a CMP be assessed if a
                GHP's or NGHP's response to CMS recovery efforts contradicted the
                entity's section 111 of MMSEA reporting. For example, if an RRE
                reported and repeatedly affirmed ongoing primary payment responsibility
                for a given beneficiary, then responded to recovery efforts with the
                assertion that coverage for that beneficiary actually terminated 2
                years prior to the issuance of the recovery demand letter. The penalty
                as proposed would have been calculated based on the number of calendar
                days that the entity failed to appropriately report updates to
                beneficiary records, as required for accurate and timely reporting
                under section 111 of MMSEA. In the proposed rule, for a GHP, CMS
                proposed that the penalty be $1,000 (as adjusted annually under 45 CFR
                part 102) for each calendar day of noncompliance for each individual
                for which the required information should have been submitted. For an
                NGHP, CMS proposed that the penalty be up to $1,000 (as adjusted
                annually under 45 CFR part 102) per calendar day of noncompliance for
                each individual, for a maximum annual penalty of $365,000 (as adjusted
                annually under 45 CFR part 102) for each individual for which the
                required information should have been submitted.
                 In the proposed rule, CMS also proposed that a penalty be assessed
                if a GHP or NGHP entity had reported and exceeded any error
                tolerance(s) threshold established by the Secretary in any 4 out of 8
                consecutive reporting periods (as defined later in this section). We
                proposed that the initial and maximum error tolerance threshold would
                be 20 percent (representing errors that prevent 20 percent or more of
                the beneficiary records from being processed), with any reduction in
                that tolerance to be published for notice and comment in advance of
                implementation. We proposed that this tolerance would be applied as an
                absolute percentage of the records submitted in a given reporting
                cycle.
                 In this final rule, all other proposed avenues for receiving a CMP
                have been eliminated and the only method of noncompliance that would be
                ripe for a CMP would be untimely reporting, as fully explained in the
                following section.
                 Comment: Many commenters emphasized that this rule should not be
                aimed at those exhibiting ``good faith efforts'' or those who make an
                earnest attempt at reporting but may do so occasionally with error but
                instead be aimed at those who fail to report at all.
                 Response: It is not our intent to penalize RREs for honest,
                infrequent mistakes, but instead to only resort to penalty when an RRE
                fails to report or submits reports in an untimely manner. We
                acknowledge that the overwhelming majority of RREs report correctly and
                timely a majority of the time and commend those entities for working
                with CMS to provide accurate data. It is, therefore, CMS's shared
                opinion with commenters that the focus shall not be to punish and
                impose consequences but instead to motivate proper reporting and
                maintain compliance with existing statute and regulation. To that end,
                CMS is adopting an audit approach in this final rule whereby we will
                audit a randomized sample of new beneficiary records received each
                quarter, rather than undertaking an automated review of all records
                submitted, as proposed. By using this random auditing approach, CMS
                will be better able to monitor trends in reporting, via manual review
                of said records, rather than a mass, computer-based algorithm, which
                will allow us to discover areas that appear to be more of a challenge
                for RREs without resorting to penalties that may be disproportionate to
                the level of noncompliance exhibited or have the effect of penalizing
                an entity for an honest mistake or system error. RREs will also be able
                to avail themselves of the informal notice and dispute process to alert
                CMS to their ``good faith efforts'' to report any records that CMS has
                identified as being out of compliance.
                 Comment: Some commenters raised concerns about the imposition of
                CMPs related to the reporting of Ongoing Responsibility for Medicals,
                (ORM). Specifically, these commenters cited difficulty with proper and
                timely reporting and understanding how to report ORM termination
                correctly.
                 Response: In the proposed rule, CMS proposed imposing penalties for
                failing to accurately and timely report ORM
                [[Page 70367]]
                acceptance or termination. In the final rule, based on stakeholder
                concerns and submitted comments, CMS has chosen to focus its definition
                of noncompliance solely on those situations where an entity has failed
                to provide its initial report of primary payment responsibility in a
                timely manner. That means that untimely termination of ORM coverage
                records would not be considered eligible for a civil money penalty
                under this rule. While not a part of this final rule, we also note that
                CMS strives to engage with stakeholders, including RREs, about the
                reporting process and continuous process improvement efforts
                particularly as they relate to ORM, and will continue to do so in the
                future. We invite any RREs with concerns about ORM or any other aspect
                of reporting to proactively use the available outreach and education
                tools to address their questions.
                 We also wish to convey that time delays caused by CMS or its
                contractors in the reporting process will not trigger penalties related
                to timeliness. RREs must adhere to all applicable timelines, but any
                delay encountered when following CMS's policies and procedures will not
                be held against the RRE (for example, time delays related to processing
                by CMS contractors will not trigger any penalty).
                 Comment: A number of commenters suggested that CMS should develop a
                formal appeal process to provide entities with reporting obligations a
                formal structure in which to appeal any notice of a pending or imposed
                CMP.
                 Response: We note that CMPs imposed in accordance with this final
                rule will be subject to the formal appeals process as prescribed by 42
                CFR 402.19 and set forth under 42 CFR part 1005. In broad terms,
                parties subject to CMPs will receive formal written notice at the time
                penalty is proposed. The recipient will have the right to request a
                hearing with an Administrative Law Judge (ALJ) within 60 calendar days
                of receipt. Any party may appeal the initial decision of the ALJ to the
                Departmental Appeals Board (DAB) within 30 calendar days. The DAB's
                decision becomes binding 60 calendar days following service of the
                DAB's decision, absent petition for judicial review.
                 Comment: Some commenters stressed the possibility of delays and
                uncertainty regarding their appeals due to backlogs at various stages
                of the administrative appeals process, and some suggested that CMS
                utilize a different appeals process.
                 Response: We affirm that CMS is bound by the appeal process as
                prescribed in 42 CFR 402.19 and set forth under 42 CFR part 1005.
                 Comment: Many commenters requested that CMS explain how it will
                provide notice to entities regarding pending or imposed CMPs and how
                much information will be included.
                 Response: We intend to communicate with the entity informally
                before issuing formal notice regarding a CMP. The informal (that is,
                prior to formal enforcement actions) written ``pre-notice'' process
                will allow the RRE the opportunity to present mitigating evidence for
                CMS review prior to the imposition of a CMP. The RRE will have 30
                calendar days to respond with mitigating information before the
                issuance of a formal written notice in accordance with 42 CFR 402.7.
                 Common to all such instances where informal notice will be given is
                the intention to give the RRE an opportunity to clarify, mitigate, or
                explain any errors that were the result of a technical issue or due to
                an error or system issue caused by CMS or its contractors. It would be
                impractical and counter to the spirit of the informal notice process to
                regulate or enumerate all circumstances in which mitigating information
                could be provided or what that information should convey. As such, any
                mitigating factors or circumstances are welcomed, and a dialogue is
                encouraged in an attempt to find solutions that are short of imposing a
                CMP. We believe it is in the best interests of all RREs to leave the
                informal notice process open to any reasonable submission of mitigating
                factors so that we are free to entertain all such documentation without
                strict limits on what is, or is not, acceptable.
                 Once we determine that a CMP will be imposed (after the informal
                notice period) we will provide formal notice to the entity in writing
                in accordance with 42 CFR 402.7, which will contain information on the
                event that has triggered the proposed imposition of a CMP, the amount
                of the proposed CMP, and next steps for the entity, including a right
                to a hearing in accordance with 42 CFR 402.19 and part 1005.
                 Comment: Commenters suggested that CMS should not impose CMPs in
                situations where required information has already been reported to
                another agency or entity, such as the Department of Labor, or in
                situations where multiple entities have obligations to report the same
                information to CMS and one entity has already reported.
                 Response: Sections 1862(b)(7) and (b)(8) of the Act imposed certain
                unique requirements on specific entities to report data to CMS for the
                purposes of identifying those situations where another party has
                primary payment responsibility. These reporting requirements were
                imposed under the Act, regardless of whether another agency or entity
                requires the same or similar data (and such data must also be reported
                to CMS in the manner and form specified by the Secretary). The current
                Office of Management and Budget (OMB) control number assigned to this
                information collection effort, as required under the Paperwork
                Reduction Act, is 0938-1074.
                 Commenters provided examples of data submitted to other agencies
                that they believe are similar, but the data are not used for a
                comparable purpose to the data that is reported to CMS. Consequently,
                this data is neither in the same format that CMS systems require, nor
                is it the complete set of data that CMS needs for the proper
                coordination of benefits. Therefore, any attempt to create a data-
                sharing agreement that would render reporting to CMS truly duplicative
                would require that other agencies update their data collection efforts
                to align with CMS, despite the fact that those agencies may have no
                need for that data. Not only would that impose additional costs to the
                federal government to accommodate a relatively small number of
                entities, it would also undermine efforts under this rule to verify the
                accuracy or timeliness of the reporting. Therefore, it is impractical
                to attempt to promulgate such data sharing agreements and all RREs must
                continue to perform reporting as required by the Act.
                 Comment: Commenters suggested that CMS not impose CMPs when CMS has
                been able to coordinate benefits correctly or CMS has otherwise been
                able to recover any conditional payments made due to untimely or
                inaccurate reporting.
                 Response: The obligations to report under sections 1862(b)(7) and
                (b)(8) of the Act are separate and distinct from any other obligation
                with respect to MSP, including reimbursement. Providing accurate
                information in response to recovery efforts does not satisfy those
                obligations and the fact that we may be able to eventually correctly
                coordinate benefits and retain the right to pursue recovery does not
                negate the reporting obligations established under sections 1862(b)(7)
                and (b)(8) of the Act.
                 Comment: Most commenters requested a statute of limitations on the
                imposition of CMPs.
                 Response: We agree and will apply the 5-year statute of limitations
                as required by 28 U.S.C. 2462. Under 28 U.S.C. 2462, we may only impose
                a CMP within 5 years from the date when the noncompliance occurred.
                [[Page 70368]]
                 Comment: Many commenters suggested that the statute of limitations
                should be 3 years.
                 Response: Under 28 U.S.C. 2462, the applicable statute of
                limitations is 5 years. Although section 1862(b)(2)(B)(iii) of the Act
                establishes a 3-year statute of limitations for certain actions, that
                provision applies only to legal actions CMS may utilize for the
                recovery of MSP debts. While recovery of conditional payments
                (overpayments) and the imposition of CMPs may appear, on their face, to
                be similar actions, they are unique and serve separate, distinct
                purposes and the statute of limitations applicable to the former does
                not also apply to the latter. An explanation and example of how this 5-
                year statute of limitations will apply is as follows: For failure to
                initially report the date of settlement or effective date of coverage
                timely (where applicable), noncompliance occurs on every day of non-
                reporting after the required timeframe for reporting has elapsed. For
                example, if the date of settlement is January 1, 2025, then the RRE
                will have 1 year from that date to report the coverage before being
                potentially subject to a CMP (that is, January 1, 2026). If the
                settlement date was January 1, 2025, but the RRE did not report it to
                CMS until October 15, 2026, the RRE will be considered noncompliant for
                the period of January 2, 2026, through October 15, 2026. If CMS does
                not act until after October 15, 2031, then the statute of limitations
                has elapsed and no CMP may be imposed.
                 Comment: Many commenters suggested that the rule should be enforced
                prospectively only.
                 Response: We concur and will evaluate compliance based only upon
                files submitted by the RRE on or after the effective date of the final
                rule. CMPs will only be imposed on instances of noncompliance based on
                those settlement dates, coverage effective dates, or other operative
                dates that occur after the effective date of this regulation and as
                such, there will be no instances of inadvertent or de facto
                retroactivity of CMPs. The 1-year period to report the required
                information before CMPs would potentially be imposed would begin on the
                latter of the rule effective date or the settlement or coverage
                effective dates which an RRE is required to report in accordance with
                sections 1862(b)(7) and (b)(8) of the Act.
                 Comment: Commenters suggested that CMS refrain from imposing CMPs
                where NGHPs with reporting obligations under section 1862(b)(8) of the
                Act make ``good faith efforts'' to obtain required information from
                individuals who are unwilling or unable to provide it. Some ``good
                faith efforts'' suggested included the following: (1) CMS could accept
                documentation signed by the individual stating that he or she is either
                not a Medicare beneficiary, or will not provide the NGHP entity with
                his or her Social Security Number (SSN) (full SSN or last 5 digits);
                and (2) CMS could accept a judicial order establishing that the
                individual is not required to provide his or her Medicare Beneficiary
                Identifier (MBI) or SSN to the NGHP entity.
                 Response: We note that concerns about ``good faith efforts'' were
                received from the NGHP industry and not the GHP industry during both
                rounds of comments, which we believe is reflective of the fundamental
                differences between the two industries and the relationships between
                those plans and the individuals in question. Our understanding is that
                NGHP applicable plans may at times be in an adversarial relationship
                with the reportable individual, whereas the reportable individual is
                typically the client of a GHP. To this end we understand the concern
                regarding privacy law or consumer protection statute violations, as
                were mentioned by some commenters.
                 In response to these comments, we stress that CMPs will not be
                imposed against NGHP entities where those entities have made good faith
                efforts, as outlined in this final rule, to obtain necessary reporting
                information. NGHP entities must document their efforts to obtain this
                reporting information and retain this documentation, as we retain the
                right to audit such documentation. In response to comments, we are
                finalizing a revised version of our proposal regarding how NGHPs may
                avoid being subject to CMPs where they have made sufficient efforts to
                obtain the necessary information. The revisions we are finalizing
                address commenter concerns regarding the type and number of
                communication attempts an RRE must perform, as well as documentation of
                express refusal by an individual or their attorney or representative to
                provide the requested information as a way to satisfy the obligation to
                attempt to collect that information.
                 Comment: Many commenters continued to suggest that CMS should
                specify a series of ``safe harbors'' that would preclude the assessment
                of a CMP.
                 Response: In this section, we outline two such safe harbors but
                acknowledge that other situations may exist where it is inappropriate
                to penalize an entity for noncompliance. We welcome RREs to use the
                informal or formal appeal process if there are other situations that
                the RRE believes makes it inappropriate to receive a CMP.
                 First, any untimely reporting that is the result of a technical or
                system issue outside of the control of the RRE, or that is the result
                of an error caused by CMS or one of its contractors would not be
                considered noncompliance for purposes of this rule. See a more thorough
                explanation in ``Amount of CMPs''.
                 Second, any untimely reporting by an NGHP that is the result of a
                failure to acquire all necessary reporting information due to a lack of
                cooperation by the beneficiary will not lead to a CMP provided that
                certain standards are met. This situation is addressed in greater
                detail in section III.D. of this final rule and Sec.
                402.1(c)(22)(ii)(A) as finalized.
                 Comment: Commenters suggested that CMS consider suspending the
                imposition of CMPs where changes to mandatory reporting procedures
                require RREs to make significant revisions to the systems used to
                prepare the data for reporting.
                 Response: We will continue to provide a minimum of 6 months' (180
                calendar days) notice prior to any changes in procedure, including
                systems alterations or changes to the required data elements,
                associated with section 111 of MMSEA required reporting to allow
                reporting entities adequate time to react. We will not assess any CMPs
                associated with a specific change for a minimum of 2 reporting periods
                following the implementation (effective date) of that policy or
                procedural change. As provided in Sec. 402.1(c)(21)(ii)(A) and
                (c)(22)(ii)(C) as finalized, in the event we are unable to provide a
                minimum of 6 months' notice prior to implementing any reporting process
                changes (such as the addition of a new required data element), we will
                not impose any CMPs associated with that specific reporting process
                change for a minimum of 1 year after that change becomes effective.
                CMPs associated with any unchanged aspects of reporting may still be
                imposed during this time.
                2. Overall Response to Comments
                 We solicited comments on our proposed approaches to imposing and
                not imposing CMPs, including our proposed methods of calculating CMP
                amounts. Our proposed approach to imposing CMPs was developed with the
                intention of giving entities meaningful opportunities to resolve most
                reporting issues, without the immediate risk that a CMP would be
                imposed. After consideration of the public comments we received, we
                have made a number of important revisions in this final rule.
                [[Page 70369]]
                 As described in the proposed rule and earlier in this final rule,
                the amount of CMPs for GHPs is established in section 1862(b)(7)(B) of
                the Act, and, except for those situations and criteria described in
                this final rule, CMS does not have the authority to adjust the amount
                of the CMP levied on a GHP entity. In the case of NGHPs, where CMS is
                permitted discretion in the amount of the CMP, we are finalizing a
                tiered approach based upon the length of time for which a submission
                was untimely to better align the penalty to the severity of the
                noncompliance. In the case of GHPs, the statutory language at section
                1862(b)(7)(B) of the Act does not allow this level of discretion, and
                CMS is therefore unable to adjust the amount of GHP-related CMPs.
                 The submission of information or documentation that serves to
                mitigate the noncompliance, or explain a technical error, will be
                considered on a case-by-case basis in an effort to prevent the
                imposition of a CMP at all.
                 Based on the comments we received, we have determined that we will
                only impose penalties where the initial report was not received in a
                timely manner. Penalties will not be imposed on any other basis, such
                as in relation to the quality of reporting. Timeliness is determined by
                comparing the date a record is submitted and accepted against the date
                CMS should have received the record. The date CMS should receive a
                record is determined by the effective date of coverage or the date of
                settlement (or settlement funding date if the funding of the settlement
                is delayed) plus 1 year (365 days). For every day a record is submitted
                that is past the date that CMS should have received the information, a
                penalty of up to $1,000 per day for NGHP RREs or $1,000 per day, in the
                case of GHP RREs, will be imposed.
                 No CMP will be imposed until at least 1 year (365 days) after the
                later of: (1) the applicability date of this final rule; or (2) the
                coverage effective date, or settlement date, an RRE is required to
                report. This is a minor change from the proposed rule which seeks to
                clarify that RREs will have at least 1 year from the rule applicability
                date before any CMP is contemplated. The date that information was
                submitted by the RRE will determine timeliness. Any delay that is the
                result of technical or administrative issues on the part of CMS or its
                contractors will not be held against the RRE for purposes of
                calculating whether reporting was timely.
                 In the proposed rule, we proposed that we would not impose a CMP in
                the following situations, where all of the applicable conditions are
                met:
                 If an RRE reports any GHP beneficiary record that is
                reported on a quarterly submission timeframe within the required
                timeframe (not to exceed 1 year after the GHP effective date), or any
                NGHP beneficiary record that is submitted within the required timeframe
                (not to exceed 1 year after the settlement date or ORM effective date).
                 If an RRE complies with any settlement reporting
                thresholds or any other reporting exclusions published in CMS's MMSEA
                Section 111 User Guides or otherwise established by CMS. Note that
                these thresholds are not defined in the regulatory text as they include
                operational thresholds that are currently subject to change on an
                annual basis per section 1862(b)(9)(B) of the Act as well as other
                operational thresholds for reporting that CMS elects to impose, such as
                the current $5,000 threshold for Health Reimbursement Arrangements,
                which are communicated to RREs through the MMSEA Section 111 User
                Guides. Our ability to implement such thresholds and operational
                exclusions, whether as statutorily mandated or to be responsive to
                stakeholder or litigation needs, is not altered by this regulation.
                 If an NGHP entity fails to report timely because the NGHP
                entity was unable to obtain information necessary for reporting from
                the reportable individual, including an individual's last name, first
                name, date of birth, gender, MBI, or SSN (or the last 5 digits of the
                SSN), and the responsible applicable plan has made and maintained
                records of its good faith effort to obtain this information by taking
                all of the following steps:
                 ++ The NGHP has communicated the need for this information to the
                individual and his or her attorney or other representative (if
                applicable) and requested the information from the individual and his
                or her attorney or other representative at least twice by mail and at
                least once by phone or other means of contact such as electronic mail
                in the absence of a response to the mailings.
                 ++ The NGHP certifies that it has not received a response, or has
                received a response in writing that the individual will not provide his
                or her MBI or SSN (or last 5 digits of his or her SSN).
                 ++ The NGHP has documented its efforts to obtain the missing
                information, such as the MBI or SSN (or the last 5 digits of the SSN)
                and the reason for the failure to collect this information.
                 The NGHP entity should maintain records of these good faith efforts
                (such as dates and types of communications with the individual) in
                order to be produced as mitigating evidence should CMS contemplate the
                imposition of a CMP. Such records must be maintained for a period of 5
                years. The current OMB control number assigned to this information
                collection effort, as required under the Paperwork Reduction Act, is
                0938-1074.
                III. Provisions of the Final Regulations
                 The final rule incorporates some of the provisions of the proposed
                rule and also revises some of the provisions as proposed. Additionally,
                the final rule clarifies how the identification of noncompliance will
                occur, which was not discussed in the proposed rule. Those provisions
                of this final rule that differ from the proposed rule are as follows:
                A. Removal of Any Basis Other Than Timeliness as a Reason for Imposing
                a CMP
                 The only basis for the imposition of a CMP will be untimely
                reporting of required information. The final rule removes all
                references in the proposed rule to ``contradictory reporting'' or
                ``exceeding error tolerance'' as a reason to impose a CMP.
                Specifically, any references to an applicable plan providing
                contradictory reporting, and any CMPs imposed as a result, that were
                proposed in 42 CFR 402.1(c)(21) and (c)(22), 402.105(b)(2) and (b)(3),
                or elsewhere, are removed and are not being finalized. As such, the
                following sections of the proposed regulations text have been removed
                and are not being finalized:
                 Sections 402.1(c)(21)(ii) and (iii).
                 Sections 402.1 (c)(22)(ii) and (iii).
                 Sections 402.105(b)(2)(ii) and (iii).
                 Sections 402.105(b)(3)(ii) and (iii).
                B. Audit Methodology for Analyzing Records
                 To identify potential instances of noncompliance, rather than
                imposing CMPs based upon automated monitoring of all RRE submissions as
                contemplated in the proposed rule, we will utilize the following
                process to audit a randomized sample of recently added beneficiary
                records:
                 CMS has determined that, given the time and resources
                necessary to accurately and thoroughly evaluate the accuracy of any
                submitted record, it would be possible to audit a total of 1,000
                records per calendar year across all RRE submissions, divided evenly
                among each calendar quarter (250 individual beneficiary records per
                quarter).
                 CMS will evaluate a proportionate number of GHP and NGHP
                records
                [[Page 70370]]
                based on the pro-rata count of recently added records for both types of
                coverage over the calendar quarter under evaluation. For example, if
                over the calendar quarter being evaluated, CMS received 600,000 GHP
                records and 400,000 NGHP records for a total of 1,000,000 recently
                added beneficiary records, then 60 percent of the 250 records audited
                for that quarter would be GHP records, and 40 percent would be NGHP
                records.
                 At the end of each calendar quarter, CMS will randomly
                select the indicated number of records and analyze each selected record
                to determine if it is in compliance with the reporting requirements as
                required by statute and defined herein.
                 Noncompliance is defined as any time CMS identifies a new
                beneficiary record that was not reported to CMS timely. Timeliness is
                defined as reporting to CMS within 1 year of the date GHP coverage
                became effective, the date a settlement, judgment, award, or other
                payment determination was made (or the funding of a settlement,
                judgment, award, or other payment, if delayed), or the date when an
                entity's Ongoing Responsibility for Medicals (ORM) became effective.
                Failure to report timely prevents CMS from promptly and accurately
                determining the proper primary payer and taking the appropriate
                actions.
                 For GHP entities, for any selected record that is more
                than 1 year (365 calendar days) late, a penalty of $1,000 per day (as
                adjusted) of noncompliance will be imposed as indicated herein.
                 For NGHP entities, for any selected record determined to
                be noncompliant, a tiered approach to penalties will be implemented as
                described in detail in section III.C. of this final rule.
                 To calculate the penalty imposed against an RRE, CMS will
                multiply the number of audited records found to be noncompliant by the
                number of days that each record was late (in excess of 365 days). The
                product will then be multiplied by the appropriate penalty amount, as
                described previously and below.
                C. Tiered Approach for NGHP RREs
                 Because we have the statutory authority to adjust the amounts of
                penalties imposed on NGHP RREs, a tiered approach and cap on the total
                amount of penalties applicable to such RREs are being finalized in this
                rule. As explained previously, the statute does not permit us to extend
                this approach to GHP RREs. For any record selected via the random audit
                process described above where the NGHP RRE submitted the information
                more than 1 year after the date of settlement, judgment, award, or
                other payment (including the effective date of the assumption of
                ongoing payment responsibility for medical care); the daily penalty
                will be--
                 $250, as adjusted annually under 45 CFR part 102, for each
                calendar day of noncompliance, where the record was reported 1 year or
                more, but less than 2 years after, the required reporting date;
                 $500, as adjusted annually under 45 CFR part 102, for each
                calendar day of noncompliance, where the record was reported 2 years or
                more, but less than 3 years after, the required reporting date; or
                 $1,000, as adjusted annually under 45 CFR part 102, for
                each calendar day of noncompliance, where the record was reported 3
                years or more after the required reporting date.
                 Additionally, the total penalty for any one instance of
                noncompliance by an NGHP RRE for a given record identified by CMS will
                be no greater than $365,000 (as adjusted annually under 45 CFR part
                102).
                 While we emphasize that all RREs are obligated to comply with their
                reporting obligations, CMS's approach to enforcement, where a
                randomized sample of records will be reviewed closely (as opposed to an
                automated review of all records), means that smaller entities are
                inherently much less likely to have their records audited for
                compliance. We also encourage entities that are smaller and less
                experienced with Medicare's coordination of benefits processes to take
                advantage of the resources and support available to ensure compliance.
                D. Clarification of Good Faith Efforts To Obtain Identifying
                Information
                 A key change for the final rule is the expansion of the
                circumstances under which an NGHP entity may avoid CMPs for
                noncompliance caused by failure to obtain identifying information from
                an individual despite a good faith effort to do so.
                 In the proposed rule, we proposed providing NGHPs with the ability
                to document ``good faith'' efforts to obtain identifying information of
                reportable individuals. In the final rule, we are expanding this
                exemption. Specifically, as proposed in the proposed rule, NGHPs must
                make a total of three attempts to obtain the required information. At
                least two attempts to obtain the required information from the
                individual and his or her attorney must be by mail or electronic mail,
                but the final rule permits that the third attempt may be via telephone,
                electronic mail, or some other reasonable method.
                 Further, the final rule permits that, should an individual or their
                attorney or representative clearly and unambiguously decline to provide
                the information requested, no further attempts by the RRE to obtain the
                required information would be required. This documented refusal to
                provide the required information must be maintained for a minimum of 5
                years, in accordance with the other requirements of this section of the
                rule.
                 We understand that NGHP RREs are concerned that attempts to obtain
                beneficiary information, particularly when in an adversarial
                relationship with the beneficiary, may be construed as running afoul of
                certain state and local privacy and anti-harassment laws. If the intent
                and purpose of the RRE's communications with beneficiaries was solely
                to comply with federal requirements, we believe any privacy or anti-
                harassment law would be preempted by the reporting requirements set
                forth in the Act.
                 All other parameters related to obtaining identifying information,
                including records retention requirements, are being finalized as
                proposed.
                IV. Collection of Information Requirements
                 This document does not impose any new information collection
                requirements, that is, reporting, recordkeeping, or third-party
                disclosure requirements. The associated information collection
                requirements imposed under mandatory insurer reporting are already
                approved under OMB control number 0938-1074. Consequently, there is no
                need for review by the Office of Management and Budget under the
                authority of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et
                seq.). We did not receive comments on the previous statement and
                therefore are finalizing the language without modification.
                V. Regulatory Impact Statement
                 We have examined the impact of this rule as required by Executive
                Order 12866 on Regulatory Planning and Review (September 30, 1993) and
                Executive Order 13563 on Improving Regulation and Regulatory Review
                (January 18, 2011) as amended by the Executive Order on Modernizing
                Regulatory Review on April 6, 2023), the Regulatory Flexibility Act
                (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act,
                section 202 of the Unfunded Mandates Reform Act of 1995 (March 22,
                1995; Pub. L. 104-
                [[Page 70371]]
                4), Executive Order 13132 on Federalism (August 4, 1999), and the
                Congressional Review Act (CRA) (5 U.S.C. 804(2)).
                 Executive Orders 12866 and 13563, as amended by the Executive Order
                on Modernizing Regulatory Review on April 6, 2023, direct agencies to
                assess all costs and benefits of available regulatory alternatives and,
                if regulation is necessary, to select regulatory approaches that
                maximize net benefits (including potential economic, environmental,
                public health and safety effects, distributive impacts, and equity). A
                Regulatory Impact Analysis (RIA) must be prepared for major rules with
                economically significant effects ($200 million or more in any 1 year).
                Modelling of potential penalties likely to be imposed under this rule
                demonstrates that this rule does not reach the economic threshold and
                thus is not considered a major rule.
                 Based on CMS workload and resource availability, the sampling
                methodology explained herein would result in a fixed number of
                submitted records to be audited each calendar quarter to determine
                compliance and potential penalty. At present, and absent a notice-and-
                comment period to alter such limit, CMS will audit up to 1,000 records
                each year, or up to 250 each calendar quarter. CMS has utilized the
                methodology as described in previous sections, in conjunction with
                utilizing data from the preceding calendar year regarding RRE reporting
                habits and volume, to determine the anticipated penalties that would be
                levied if no other changes in behavior were observed. Although we note
                that CMS believes that publication of the rule will have the intended
                effect of incentivizing increased compliance with reporting
                requirements in an effort to avoid a CMP, we have analyzed the existing
                data with no adjustments for subjective analysis. Assuming the rule had
                been in effect and CMPs could have been imposed based upon reporting
                behavior for calendar year 2022, the maximum penalties imposed would
                have been $86.4 million for GHP entities and $42.4 million for NGHP
                entities, for a total annual CMP amount of $128.8 million, which is
                below the $200 million threshold to be considered an economically
                significant rule. We also note that reporting behavior in this period
                may be skewed towards more untimely reporting, potentially reflecting
                efforts to come into compliance in advance of this rule becoming
                effective. Consequently, we believe this is a worst-case scenario and
                do not expect to collect CMPs totaling $200 million or more in any
                given year, nor do we expect this rule to have any other economic
                effects that meet or exceed that threshold.
                 The RFA requires agencies to analyze options for regulatory relief
                of small entities. For purposes of the RFA, small entities include
                small businesses, nonprofit organizations, and small governmental
                jurisdictions. Most hospitals and most other providers and suppliers
                are small entities, either by nonprofit status or by having revenues of
                $7.0 million to $35.5 million in any 1 year. Individuals and States are
                not included in the definition of a small entity. We consider a rule to
                have a significant impact on a substantial number of small entities if
                it has at least a 3 percent impact of revenue on at least 5 percent of
                small entities. Affected entities with reporting responsibilities have
                been required to comply with sections 1862(b)(7) and (b)(8) of the Act
                since these provisions were added to the Act in 2007. This rule is
                intended to define how CMPs would be imposed as a consequence of
                noncompliance with these statutory obligations, and thus does not
                present any additional burden beyond the review of the rule. As
                discussed later in this section, the total cost impact of reviewing
                this rule by all 20,855 actively reporting RREs, regardless of size, is
                estimated to be $7,699,249, or $369.18 per entity. As the provisions
                and regulations, the violation of which will result in a CMP under this
                regulation, are already in place, no additional costs to comply with
                this regulation should be realized by any RRE. This regulation merely
                enumerates when and how CMPs will be levied but does not impose any
                additional rules or requirements on any RRE that does not already, at
                present, exist. This falls below the standard definition of
                ``significance'' of 3 or more of small entity revenue. As a result, we
                have determined, and the Secretary certifies, that this rule would not
                have a significant economic impact on a substantial number of small
                entities.
                 In addition, section 1102(b) of the Act requires us to prepare an
                RIA if a rule may have a significant impact on the operations of a
                substantial number of small rural hospitals. This analysis must conform
                to the provisions of section 604 for the RFA. For purposes of section
                1102(b) of the Act, we define a small rural hospital as a hospital that
                is located outside of a Metropolitan Statistical Area for Medicare
                payment regulations and has fewer than 100 beds. We are not preparing
                an analysis for section 1102(b) of the Act because we have determined,
                and the Secretary certifies, that this rule would not have a
                significant impact on the operations of a substantial number of small
                rural hospitals.
                 Section 202 of the Unfunded Mandates Reform Act of 1995 also
                requires that agencies assess anticipated costs and benefits before
                issuing any rule whose mandates require spending in any 1 year of $100
                million in 1995 dollars, updated annually for inflation. In 2023, the
                threshold is approximately $177 million. This rule will have no
                consequential effect on state, local, or tribal governments or on the
                private sector. Executive Order 13132 establishes certain requirements
                that an agency must meet when it promulgates a proposed rule (and
                subsequent final rule) that imposes substantial direct requirement
                costs on state and local governments, preempts state law, or otherwise
                has Federalism implications. Since this final rule does not impose any
                costs on state or local governments, the requirements of Executive
                Order 13132 are not applicable.
                 We used the current number of actively reporting GHP RREs (1,039)
                and NGHP RREs (19,816) to determine the total number of impacted
                entities (20,855). We recognize that this is a slight overestimate, as
                a single corporate parent may have multiple associated RREs. We welcome
                any comments on the approach in estimating the number of entities which
                will review this rule.
                 Using the May 2022 wage information from the U.S. Department of
                Labor Bureau of Labor Statistics for medical and health service
                managers (Code 11-9111), we estimate that the cost of reviewing this
                rule is $123.06 per hour, based on doubling the mean hourly wage of
                $61.53 to include overhead and fringe benefits (see https://www.bls.gov/oes/current/oes119111.htm). We assume that one individual
                associated with each of the 20,855 impacted entities will read the
                rule. Assuming an average reading speed, we estimate that it would take
                approximately 3 hours for the staff to review this rule. For each
                entity that reviews the rule, the estimated cost is $369.18 (3 hours x
                $123.06). Therefore, we estimate that the total cost of reviewing this
                rule is $7,699,249 ($369.18 x 20,855).
                 We did not receive additional comments on the regulatory impact
                statement section through the public comment period.
                 In accordance with the provisions of Executive Order 12866, this
                rule was reviewed by the Office of Management and Budget.
                 Chiquita Brooks-LaSure, Administrator of the Centers for Medicare &
                Medicaid Services, approved this document on September 28, 2023.
                [[Page 70372]]
                List of Subjects
                42 CFR Part 402
                 Assessments, Civil money penalties, Exclusions.
                45 CFR Part 102
                 Administrative practice and procedure, Penalties.
                 For the reasons set forth in the preamble, the Centers for Medicare
                & Medicaid Services proposes to amend 42 CFR chapter IV as set forth
                below:
                PART 402--CIVIL MONEY PENALTIES, ASSESSMENTS, AND EXCLUSIONS
                0
                1. The authority citation for part 402 is revised to read as follows:
                 Authority: 42 U.S.C. 1302 and 1395hh.
                0
                2. Section 402.1 is amended--
                0
                a. In paragraph (c) introductory text by removing the reference
                ``(c)(34) of this section'' and adding in its place the reference
                ``(c)(35) of this section'';
                0
                b. By removing paragraph (c)(20);
                0
                c. By redesignating paragraph (c)(21) as paragraph (c)(20);
                0
                d. By redesignating paragraphs (c)(22) through (34) as paragraphs
                (c)(23) through (35); and
                0
                e. Adding new paragraphs (c)(21) and (22).
                 The additions read as follows:
                Sec. 402.1 Basis and scope.
                * * * * *
                 (c) * * *
                 (21) Section 1862(b)(7)(B)--Except for the situation described in
                paragraphs (c)(21)(ii)(A) and (B) of this section, any entity that has
                a reporting obligation under section 1862(b)(7) of the Act (``reporting
                entity'') that--
                 (i) Fails to report any beneficiary record within 1 year of the
                last acceptable reporting date, defined as 365 days from the GHP
                coverage effective date or the Medicare beneficiary's entitlement date,
                whichever is later.
                 (ii) A civil money penalty (CMP) is not imposed if--
                 (A) The incident of noncompliance is associated with a specific
                reporting policy or procedural change on the part of CMS that has been
                effective for less than 6 months following the implementation of that
                policy or procedural change (or for 1 year, should CMS be unable to
                provide a minimum of 6 months' notice prior to implementing such
                changes).
                 (B) The entity complies with any reporting thresholds or any other
                reporting exclusions.
                 (22) Section 1862(b)(8)(E)--Except for the situations described in
                paragraph (c)(22)(ii)(A), (B) and (C) of this section, any applicable
                plan that has a reporting obligation under section 1862(b)(8) of the
                Act (``applicable plan''), that--
                 (i) Fails to report any beneficiary record within 1 year from the
                date of the settlement, judgment, award, or other payment, or the
                effective date where ongoing payment responsibility for medical care
                has been assumed by the entity.
                 (ii) A CMP is not imposed in the following situations:
                 (A) An NGHP applicable plan fails to report required information as
                a result of the applicable plan's inability to obtain an individual's
                last name, first name, date of birth, gender, Medicare Beneficiary
                Identifier (MBI), Social Security Number (SSN), or the last 5 digits of
                the SSN, and the applicable plan has made a good faith effort to obtain
                this information by meeting the following:
                 (1) Has communicated the need for this information to the
                individual and his or her attorney, or other representative, if
                applicable, or both.
                 (2) Has requested the information from the individual and his or
                her attorney, or other representative (if applicable), at least three
                times--
                 (i) Once in writing (including electronic mail);
                 (ii) Then at least once more by mail; and
                 (iii) At least once more by phone or other means of contact in the
                absence of a response to the mailings.
                 (3) Has not received a response or has received a written response
                clearly indicating that the individual refuses to provide the needed
                information. Should the applicable plan receive a written response from
                the individual or their attorney or representative that clearly and
                unambiguously declines or refuses to provide any portion of the
                information specified herein, no additional communications with the
                individual or their attorney or other representative are required.
                 (4) Has documented its efforts to obtain the MBI or SSN (or the
                last 5 digits of the SSN). This documentation, including any written
                rejection correspondence, must be retained for a minimum of 5 years.
                 (B) An NGHP applicable plan complies with any reporting thresholds
                or any other reporting exclusions.
                 (C) The incident of noncompliance is associated with a specific
                reporting policy or procedural change on the part of CMS that has been
                effective for less than 6 months following the implementation of that
                policy or procedural change (or for 12 months, should CMS be unable to
                provide a minimum of 6 months' notice prior to implementing such
                changes).
                * * * * *
                0
                3. Section 402.105 is amended by revising paragraph (b)(2) and adding
                paragraph (b)(3) to read as follows:
                Sec. 402.105 Amount of penalty.
                * * * * *
                 (b) * * * *
                 (2) For entities with reporting obligations under section
                1862(b)(7) of the Act (``reporting entity''), if a reporting entity
                fails to report any beneficiary record within the specified period from
                the latter of the GHP coverage effective date or the Medicare
                beneficiary's entitlement date. The penalty is--
                 (i) Calculated on a daily basis, based on the number of recently
                added beneficiary records reviewed where CMS identifies that the entity
                submitted the required information more than 1 year after the GHP
                coverage effective date for the individual; and
                 (ii) $1,000 as adjusted annually under 45 CFR part 102 for each
                calendar day starting the day after 1 year (365 days) from the first
                instance of noncompliance, as defined in paragraph (b)(2)(i) of this
                section.
                 (3) For entities with reporting obligations under section
                1862(b)(8) of the Act (``applicable plan'') as follows:
                 (i) If an applicable plan fails to report any NGHP beneficiary
                record within the specified period from the date of the settlement,
                judgment, award, or other payment (including the effective date of the
                assumption of ongoing payment responsibility for medical care). The
                penalty is--
                 (A) Calculated on a daily basis, based on the number of recently
                added beneficiary records reviewed where CMS identifies that the entity
                submitted the required information more than 1 year after the date of
                settlement, judgment, award, or other payment (including the effective
                date of the assumption of ongoing payment responsibility for medical
                care);
                 (B) $250 (as adjusted annually under 45 CFR part 102) for each
                calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of
                this section for each individual for which the required information
                should have been submitted, but was reported more than 1 year but less
                than 2 years after the required reporting date;
                 (C) $500 (as adjusted annually under 45 CFR part 102) for each
                calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of
                this section for each individual for which the required information
                should have been
                [[Page 70373]]
                submitted, but was reported 2 years or more, but less than 3 years,
                after the required reporting date; and
                 (D) $1,000 (as adjusted annually under 45 CFR part 102), for each
                calendar day of noncompliance as defined in paragraph (b)(3)(i)(A) of
                this section for each individual for which the required information
                should have been submitted, but was reported 3 years or more after the
                required reporting date.
                 (ii) The maximum penalty that may be imposed for noncompliance
                associated with any one individual for which the required information
                should have been submitted is $365,000 (as adjusted annually under 45
                CFR part 102).
                * * * * *
                 For the reasons specified in the preamble, the Department of Health
                and Human Services amends 45 CFR part 102 as specified below:
                PART 102--ADJUSTMENT OF CIVIL MONETARY PENALTIES FOR INFLATION
                0
                4. The authority for part 102 continues to read as follows:
                 Authority: Pub. L. 101-410, Sec. 701 of Pub. L. 114-74, 31
                U.S.C. 3801-3812.
                0
                5. Section 102.3 is amended in table 1 by adding references for U.S.C.
                1395y(b)(6)(B), 1395y(b)(7)(B)(i), and 1395y(b)(8)(E)(i) in numerical
                order to read as follows:
                Sec. 102.3 Penalty adjustment and table.
                * * * * *
                 Table 1 to Sec. 102.3--Civil Monetary Penalty Authorities Administered by HHS Agencies and Penalty Amounts
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                 Date of last
                 statutorily 2021 maximum 2022 maximum
                 U.S.C. sections CFR \1\ HHS agency Description \2\ established adjusted adjusted
                 penalty figure penalty ($) penalty \4\
                 \3\ ($)
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                
                 * * * * * * *
                42 U.S.C.:
                
                 * * * * * * *
                1395y(b)(6)(B)..................... 42 CFR 402.1(c)(20), CMS Penalty for any entity 2021 3,484 3,701
                 402.105(a). that knowingly,
                 willfully, and repeatedly
                 fails to complete a claim
                 form relating to the
                 availability of other
                 health benefits in
                 accordance with statute
                 or provides inaccurate
                 information relating to
                 such on the claim form.
                1395y(b)(7)(B)(i).................. 42 CFR 402.1(c)(21), CMS Penalty for any entity 2021 1,247 1,325
                 402.105(a). serving as insurer, third
                 party administrator, or
                 fiduciary for a group
                 health plan that fails to
                 provide information that
                 identifies situations
                 where the group health
                 plan is or was a primary
                 plan to Medicare to the
                 HHS Secretary.
                
                 * * * * * * *
                1395y(b)(8)(E)(i).................. 42 CFR 402.1(c)(22), CMS Penalty for any entity 2021 1,247 1,325
                 402.105(a)(E). serving as insurer, third
                 party administrator, or
                 fiduciary for a non-group
                 health plan that fails to
                 provide information that
                 identifies situations
                 where the group health
                 plan is or was a primary
                 plan to Medicare to the
                 HHS Secretary.
                
                 * * * * * * *
                --------------------------------------------------------------------------------------------------------------------------------------------------------
                \1\ Some HHS components have not promulgated regulations regarding their civil monetary penalty-specific statutory authorities.
                \2\ The description is not intended to be a comprehensive explanation of the underlying violation; the statute and corresponding regulation, if
                 applicable, should be consulted.
                \3\ Statutory or Inflation Act Adjustment.
                \4\ The cost of living multiplier for 2018, based on the CPI-U for the month of October 2017, not seasonally adjusted, is 1.02041, as indicated in OMB
                 Memorandum M-18-03, ``Implementation of Penalty Inflation Adjustments for 2018, Pursuant to the Federal Civil Penalties Adjustment Act Improvements
                 Act of 2015'' (December 15, 2017).
                \5\ The cost of living multiplier for 2020, based on the Consumer Price Index for all Urban Consumers (CPI-U) for the month of October 2019, not
                 seasonally adjusted, is 1.01764, as indicated in OMB Memorandum M-20-05, ``Implementation of Penalty Inflation Adjustments for 2019, Pursuant to the
                 Federal Civil Penalties Adjustment Act Improvements Act of 2015'' (December 16, 2019).
                 Dated: October 3, 2023.
                Xavier Becerra,
                Secretary, Department of Health and Human Services.
                [FR Doc. 2023-22282 Filed 10-10-23; 8:45 am]
                BILLING CODE 4120-01-P
                

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT