A little over two years ago, Congress passed the Medicare, Medicaid and SCHIP Extension Act of 2007 (http://www.govtrack.us/congress/bill.xpd?bill=s110-2499) (“MMSEA”) 42 U.S.C., § 1395(b)(7)(8). Section 111 of MMSEA added new and significant mandatory reporting requirements for liability insurance, no-fault auto insurance and workers’ compensation (collectively “NGHPs” or non-group health plans) as well as group health plans (“GHPs”) and self-insurers. Every settlement, judgment, award, or other payment from insurers to a Medicare beneficiary must be reported to Health & Human Services (“HHS”) through its Centers for Medicare & Medicaid Services (“CMS”). Likewise, individuals who receive ongoing reimbursement for medical care through no-fault insurance or workers’ compensation funds must also be reported to CMS. CMS has a statutory lien on liability claims made by Medicare beneficiaries. This lien confers upon CMS the right to be reimbursed for medical expenses it paid on behalf of a Medicare beneficiary who recovers those expenses in a liability claim.
“Responsible Reporting Entities” (“RREs”) are those entities that have the responsibility to pay liability claims. Entities qualifying as RREs should have already registered with CMS (http://www.cms.hhs.gov/mandatoryinsrep) and should now be in “file testing” status. The MMSEA User Guide instructs reporting entities to "implement a procedure in their claims review process to determine whether an injured party is a Medicare beneficiary and gather the information necessary for Section 111 reporting." More specifically, entities subject to the reporting requirements should have taken the following steps by now to avoid penalties and ensure timely reporting:
1. Develop processes to determine which settlements are reportable and how the reporting responsibility is allocated between the defendant and its insurer (if any). Several factors determine whether a settlement is subject to Section 111 reporting, including the timing of the allegations, value of settlement, nature of claim and identity of the defendant and plaintiff.
2. Revise releases and other settlement documents to address the reporting requirements. Defendants should
consider developing reporting Fact Sheets to confirm the accuracy of reportable information with plaintiffs. The information to be reported depends on the nature and timing of the alleged and released claims, among other factors.
3. Update indemnification and confidentiality provisions in the release and other settlement documents to
reflect reporting penalties and duties.
4. Develop a process to utilize the model language safe harbor, which can exempt entities from reporting obligations in certain situations.
5. Implement policies and procedures to protect data confidentiality and limit the use, access and disclosure of the reportable information, as required by the Data Use Agreement that reporting entities must sign with the federal government when registering for the Section 111 program. The reporting process implicates state and federal privacy and confidentiality issues since a plaintiff's Social Security number and medical information must be collected and reported.
6. Review contracts with third party reporting vendors (if any) to allocate responsibility for penalties, duties and Data Use Agreement confidentiality obligations.
For the non-compliant, the new reporting law imposes hefty penalties for failure of an RRE to comply with the new requirements. Of primary significance, the law allows for a civil penalty of $1,000 per day of noncompliance with respect to each individual for whom information should have been submitted. The implementation of these new requirements has proven to be an anxiety-provoking exercise for those who are subject to the new Medicare requirements, especially with respect to the cases arising from toxic torts, like asbestos, product liability, medical malpractice and work place accidents.
In early February 2010, the American Insurance Association (http://www.aiadc.org/), the National Association of Mutual Insurance Companies (http://www.namic.org/) and the Self-Insurance Institute of America (http://www.siia.org/) groups urged HHS to delay implementation of the mandatory reporting requirements indicating that "[T]he agency has yet to demonstrate that the new reporting system will properly function. Yet, we are expected to begin reporting data using this system in just a matter of weeks. Even more critical, CMS has not yet provided final reporting parameters to those insurers and self-insureds subject to the new requirements. Since failure to comply with the reporting requirements . . . will expose insurers and self-insureds to substantial financial penalties, we believe that a more realistic implementation date is not only appropriate but also imperative.” The trade groups identified five major concerns supporting a delay in implementation:
1. CMS has yet to provide final guidance as to which entity has reporting responsibility in situations
involving risk-sharing arrangements where more than one RRE has a share in the settlement.
2. Insurers have serious concerns with the mandatory requirement to submit extensive private information such as a Medicare beneficiary’s social security number or health insurance claim numbers. In essence, RRE’s are being directed to obtain information from beneficiaries that CMS itself advises those same beneficiaries to provide only to their physician or other Medicare provider. Therefore, this information is often not readily available to an RRE without a HIPPA release. CMS has offered model language as a safe harbor to demonstrate compliance when a recalcitrant plaintiff refuses to provide their Social Security number for reporting purposes. The safe harbor is of limited practical use in general, and in particular does not benefit healthcare providers. CMS has repeatedly indicated it will release additional guidance on the safe harbor provisions that may expand its use, but has yet to do so.
3. There are serious concerns that CMS is not properly employing the highest-level security and encryption technology available to ensure the privacy of personally identifiable information that is required to be submitted by RREs. In this respect, there are significant concerns that required information may be subject to identity theft in the reporting phase.
4. CMS has only recently allowed entities to test the mandatory electronic reporting capabilities and interfaces with the CMS systems. This minimal opportunity for system testing has placed significant stress on capabilities of internal information technology groups, RRE’s, and other entities that must report. This has led to significant delays in the testing process. Given that there are more than 24,000 entities registered to report, the time contemplated for testing the system is insufficient to guarantee successful implementation by April 1, 2010.
5. There is a concern that the $1,000 per day, per claim penalty provision is excessive and at a minimum it should not be assessed on the first reports submitted by any RRE. For example, because CMS mandates that reporting occur quarterly, an error in reporting (significant or not) cannot be addressed for 90 days. Under the present state of affairs, a failure to report a $1,000 medical payment to a Medicare beneficiary could subject a RRE to a $90,000 fine.
In response to the aforementioned concerns, HHS announced on February 16, 2010, that it will extend the deadline for reporting requirements (http://www.cms.hhs.gov/MandatoryInsRep/04_Whats_New.asp#TopofPage) under the Medicare Secondary Payer Act from April 1, 2010 to January 1, 2011. This news provided welcome relief for property and casualty insurers who have been working diligently to meet the new reporting requirements amidst significant uncertainties in implementation.
Even though reporting has been delayed until the first quarter of 2011, defendants and insurers must determine if and when they are subject to the reporting obligation. CMS specifically requires entities that have an "expectation of having claims to report" to register in enough time to allow a full calendar quarter to test their reporting protocol. Clearly, timely registration and testing is necessary to demonstrating compliance. Presently, there are no exemptions for RRE’s even if they expect a low number of reportable events each year. Moreover, the newly-announced delay does not change the effective dates for what is reportable. RREs must still identify Total Payment Obligations to Claimants (TPOCs) in existence on or after Jan. 1, 2010 and Ongoing Responsibility for Medicals (ORMs) in existence on or after July 1, 2009.
Information and official instructions for Section 111 and its implementation including data reporting procedures can be found on the CMS website (http://www.cms.hhs.gov/MandatoryInsRep/) which can be found at www.cms.hhs.gov/. The website includes extensive information about reporting requirements, including Section 111 Computer Based Training for RREs and their agents, as well as the updated User Guide (Version 3.0), transcripts of Section 111 teleconferences and upcoming teleconferences.