The Centers for Medicare & Medicaid Services (CMS) will enter into a new reporting relationship with liability, no-fault and workers' compensation insurers this year as the federal government looks for new revenue streams for a financially beleaguered Medicare Program.

CMS, the federal agency within the Department of Health and Human Services that administers the Medicare Program, is the largest payer of medical claims in the United States. Under the mandate of the Medicare, Medicaid and SCHIP Extension Act of 2007 (the Act), CMS will require liability, no-fault and workers' compensation insurers to report -- electronically and for the first time -- the resolution of all claims involving injury to Medicare beneficiaries. CMS estimates that these insurers receive 2.9 million claims annually from Medicare beneficiaries. Anything from an automobile accident under an automobile policy, to a simple slip-and-fall under a homeowners policy, to bodily injury arising out of exposure to toxic chemicals or asbestos under a liability policy may trigger these claims, whose resolution must shortly be shared with the federal government.

The Act seeks to enforce the insurers' existing payment obligations under the Medicare Secondary Payer (MSP) statute, which establishes Medicare as the secondary payer to Group Health Plans (GHPs) and three types of "non-GHP" insurance coverage: liability (including self-insurance), no-fault and workers' compensation. Medicare thus has a statutory right to recover the medical payments it makes on behalf of a Medicare beneficiary from any of these primary payers whose policies also cover the beneficiary's medical claims. In other words, Medicare holds the "secondary" payment position to all other forms of coverage for medical claims, and Medicare's right to recover any primary payment it makes before learning of a "non-GHP" obligation takes precedence over the rights of any other party.

The new reporting arrangement kicks off in May and June, when "non-GHP" insurers must register with CMS as responsible reporting entities. After a short period for system implementation and testing, they will begin submitting claims data during the last quarter of the year, or risk incurring civil money penalties of $1,000 a day for each individual for whom they should have submitted claims information. For some insurers, this amount could be substantial, particularly if their failure to report reaches back 90 days to the last reporting period.

How It Will Work

For years, CMS has received claims payment information from GHPs under voluntary data-sharing agreements designed to ensure that Medicare pays the medical claims of Medicare beneficiaries secondary to GHPs. The significance of the Act for GHPs is that their data transmissions to CMS are no longer voluntary; they are mandatory. In contrast, CMS has had limited interaction with "non-GHP" insurers. Although they routinely pay claims involving injuries to Medicare beneficiaries, CMS has not asked "non-GHP" insurers to enter into data-sharing agreements; any coordination of benefits activity has been handled on a case-by-case basis. That relationship is about to change significantly.

The Data

The Act requires "non-GHP" insurers to electronically transmit data to CMS on all claims involving an injury to a Medicare beneficiary that are "resolved" (or partially resolved) beginning July 1, 2009. The date of the settlement, judgment or award, not payment, is the date that triggers the insurer's obligation to report the resolved claim in the next calendar quarter. These insurers also must report claims for which they have a continuing responsibility, as of July 1, 2009, to pay for medical items or services, regardless of the age of the claim. For workers' compensation carriers in particular, this obligation may implicate claims that arose long ago but remain active today.

The claims data requested of "non-GHP" insurers is sizeable. The electronic file to be sent by the insurer captures more than 50 data elements, including information regarding the injured party (including a Social Security Number (SSN) or Medicare ID (HIC) Number); the claimant, if not the injured party (e.g., the Medicare beneficiary's estate); the primary plan; the policy holder; and the incident (including the date of incident as defined by CMS, not the Department of Labor). Insurers also must provide information regarding the resolution of the claim, including (i) whether the claim was contested, (ii) whether there is any ongoing payment responsibility, and (iii) what the insurer's "Total Payment Obligation" is (not simply the amount paid for medical items or services). Although there currently is no de minimis dollar exception for reporting purposes, CMS has stated it is gathering relevant data and will issue instructions if it adopts such a rule.

The Burden

CMS has assured "non-GHP" insurers that the collection of the required data elements will not place an undue burden on them. CMS contends that the insurers already have much, if not all, of the information in their possession due to existing coordination of benefits obligations and other internal business needs. CMS acknowledges, however, in recent guidance posted on its website, that "there may be effort involved in centralizing such information for reporting purposes," although "not a considerable burden." We leave it to each insurer to judge this burden, but CMS has estimated that the establishment of the data exchange process alone will take, on average, a total of 375 man-hours.

CMS most certainly will use the new data collected from the estimated 400 reporting "non-GHP" entities to augment its ability to identify situations in which Medicare has paid in the "primary" payment position but should have paid only in the "secondary" position. Medicare, through its MSP rights of subrogation, can recover in these situations from an insurer if its efforts to collect first from the Medicare beneficiary or the provider of medical services are unsuccessful. Medicare has this right of recovery regardless of whether the insurer has already paid the beneficiary or the provider for the medical items or services at issue, but CMS must submit a request for reimbursement to the insurer within three years of the date on which the items or services were furnished.

The Timeline

Although actual reporting will not go live until the fourth quarter of 2009, the first deadlines for insurers with reporting obligations are just a few months away. This May and June, insurers must register online with CMS as "responsible reporting entities" (RREs) and enroll any agents that will submit data files on their behalf. Insurers who use the services of agents nevertheless retain all liability for reporting obligations. By July, these insurers, or their agents, must have installed system software provided by the agency and have begun to send test data. After a series of successful transmissions, CMS will assign each insurer a date during the last quarter of 2009, by which it must begin its quarterly reporting. That reporting will continue indefinitely.

Agency Guidance

To assist insurers with their implementation efforts, CMS is offering town-hall-style, dial-in teleconferences and computer-based training, free of charge. CMS also has promised to post a "User Guide" on its Mandatory Insurer Reporting website that will offer more details and instruction on the registration process, the acquisition and use of mandated system software, file layouts, and file submissions.

Penalties and Enforcement

An insurer that fails to comply with its new reporting obligations will be subject to civil money penalties of $1,000 for each day of noncompliance for each individual for whom it should have submitted information. CMS has advised that whether insurers are likely to experience difficulties in meeting their reporting requirements will depend, in part, upon the current format of their claims records and their ability to identify whether an individual is Medicare eligible. The agency's recommendation for insurers is to start now to become familiar with their new reporting obligations.

Does this mean that CMS will aggressively pursue noncompliant insurers once all insurers should be routinely reporting in January 2010? Recognizing that CMS has stated publicly that it is primarily interested in facilitating insurer compliance with the Act's reporting requirements and not in collecting penalties, we expect that CMS will take into consideration an insurer's diligent efforts to come into regulatory compliance before pursuing any enforcement action. CMS's initial enforcement actions more logically will focus on those insurers that fail entirely to register, implement a reporting system or transmit data files. Whether CMS intends to audit "non-GHPs" for compliance (or has authority to do so on a routine basis when noncompliance is not suspected) is unclear. CMS guidance does make clear, however, that the agency "recommends" that insurers retain their "MSP related information" for a period of ten years, noting that certain administrative and legal actions (including administrative offsets and False Claims Act suits) can be brought against a responsible entity for ten years. In contrast, as noted above, the MSP statute only permits CMS to recover primary payments from a liability insurer for a period of three years, beginning on the date the medical item or service was furnished to the Medicare beneficiary.

Given the uncertainty over CMS enforcement activities, our recommendation for insurers is to begin now to document efforts to come into compliance with the new reporting requirements. This is particularly important for liability insurers. CMS is less familiar with "non-GHP" claims than GHP claims (CMS estimates that it is already receiving data for "some 90% of all GHP covered lives" through voluntary GHP reporting), and CMS appears still to be working out the precise details of its expectations regarding the "non-GHP" reporting process. For this reason, insurers also should monitor closely CMS's now frequent updates to its Medicare reporting guidance.

Open Questions

Although the new reporting obligations seem straightforward, many questions appear to go unanswered in the agency guidance. Here are some of the questions insurers are asking:

  • What, if any, payments will CMS seek to recover from "non-GHP" insurers if Medicare paid primary for medical items or services covered by "non-GHP" insurance? Because insurers must report the total amount they pay on a claim, will CMS make any effort to determine how much of the insurer payment was for medical items or services? Can CMS demand the full amount of the negotiated settlement regardless of the terms of the settlement? Specifically, can CMS reach sums allocated to compensate for other damages, like pain and suffering?
  • Recognizing that the reimbursement obligation of the "non-GHP" insurer under MSP law is joint and several with the Medicare beneficiary, can CMS require the insurer to pay in excess of its policy limits, or at the very least in excess of a negotiated settlement amount up to the policy limit? If policy limits are insufficient to fully compensate Medicare, can CMS reach past or future insurer payments?
  • The Act only requires insurers to report once they have resolved a claim. Can a "non-GHP" insurer effectively limit its MSP exposure or reporting obligations by notifying CMS of a pending resolution?
  • Can a "non-GHP" insurer effectively insulate or limit its MSP exposure through agreement with the claimant? Is there a way to structure insurer settlements to avoid incurring some or all reporting obligations under the Act?
  • What if a claimant or an injured party refuses to provide a SSN or HIC Number? How will the insurer determine if the individual is a Medicare beneficiary? Must the insurer make this determination? MSP regulations that predate the Act do not impose an affirmative duty on "non-GHP" insurers to inquire as to Medicare eligibility; in contrast, the MSP Manual states that knowledge of a claimant's Medicare status will be imputed to the liability carrier if the claimant is 65 years of age or older.
  • If a Medicare beneficiary suffers no medical injury, or at least none is discovered by the time the claimant files for other damages
  • (e.g., personal property damage), must the insurer nevertheless report the claim resolution to CMS?
  • What, if any, reported "non-GHP" information does CMS intend to share with Medicare Advantage or Part D plans?

It is not surprising that many of these questions are the same questions that "non-GHP" insurers have been asking for years. Indeed, the body of agency guidance relating to the application of MSP law to liability insurers is not nearly as extensive or well-settled as the guidance available to other insurers. In addition, CMS has commented that the new reporting requirements do not change or eliminate any existing insurer obligations under the MSP statute or regulations. Any prior uncertainty surrounding such obligations and liabilities thus logically still exists and may be further complicated by the overlay of new reporting requirements. For all these reasons, and with some step-up in MSP enforcement activity expected in 2010, a "non-GHP" insurer would be well served to review its current MSP practices to ensure they are in line with "non-GHP" insurer obligations under MSP law.