U.S. businesses (and certain overseas businesses as well) of all sizes must comply with new federal Medicare reporting requirements beginning this month if they are fully or partially self-insured (defined broadly to include a variety of risk retention mechanisms such as deductibles) against third-party liabilities and likely to pay claims that arise in whole or in part from bodily injuries. Failure to comply can trigger fines of $1000 for each day of noncompliance with respect to each claimant as to whom the company should have submitted information.

The Centers for Medicare & Medicaid Services (CMS) define a self-insured entity as "an entity that engages in a business, trade or profession . . . [and] carries its own risk (whether by a failure to obtain insurance, or otherwise) in whole or in part. Self-insurance or deemed self-insurance can be demonstrated by a settlement, judgment, award, or other payment to satisfy an alleged claim (including any deductible or co-pay on a liability insurance, no-fault insurance, or workers' compensation law or plan) for a business, trade or profession." CMS User Guide at 216 (July 31, 2009), available at http://www.cms.hhs.gov (emphasis added).

An old law is back in the news. It is not widely known that for nearly thirty years, liability insurers and self-insured businesses that pay a settlement, judgment or award to a Medicare beneficiary in recompense for bodily injury have had an obligation to reimburse Medicare for any prior "conditional payments" Medicare may have made to cover the beneficiary's related medical expenses, if the beneficiary fails to provide such reimbursement. Medicare is a federal health insurance program for the elderly and disabled, administered by CMS. Under the 1980 Medicare Secondary Payer (MSP) statute, CMS may seek recovery of its past payments to medical providers if it learns that another entity had the obligation to pay those medical costs as the primary payer". 42 U.S.C. § 1395y(b)(2)(B)(ii). CMS may recover such a payment in most instances from either the provider or beneficiary that receives a third party payment for the bodily injury that led to those costs, or the liability insurer or self-insured entity that makes that payment. Another relatively unknown fact is that CMS may recover from a self-insured business regardless of whether that entity has already made payments to the provider or Medicare beneficiary-thus holding the business to double liability. To date, CMS for the most part has pursued only beneficiaries, group health plans (GHPs) and GHP insurers, not liability insurers or self-insured entities, to recoup Medicare overpayments.

CMS has imposed onerous reporting requirements on self-insured businesses. Section 111 of the Medicare, Medicaid and SCHIP Extension Act of 2007 (MMSEA) requires liability insurers (defined to include self-insured entities), no-fault insurers and workers' compensation insurers, as well as GHPs, to report to CMS their payments related to bodily injuries incurred by a Medicare beneficiary, as well as over 100 other data points. 42 U.S.C. § 1395y(b)(8). CMS, in exercising its exceptionally broad delegation of regulatory authority by Congress, has issued a 225-page User Guide containing complex IT and data reporting requirements. To implement this new reporting scheme, self-insured companies must create the necessary IT infrastructure and claims handling work flow to gather the required data and report it to CMS on a quarterly basis in the required format beginning in Spring 2010 as assigned by CMS. But the implications of this change go far beyond IT procedures.

The government seeks liability claims data for one principal reason: to pursue recoveries of Medicare conditional payments. Under the MSP statute, Medicare generally has secondary liability for payment of a Medicare beneficiary's medical expenses whenever a liability insurer or self-insured business pays compensation of some kind for all or part of the bodily injuries that led to those expenses. See 42 U.S.C. § 1395y(b); 42 C.F.R. Part 411. If Medicare makes a primary payment on behalf of a Medicare beneficiary who then receives payment from a self-insured business for the related injury, Medicare wants to pursue recovery of its payment (known under Medicare law as a "conditional payment"). Receiving claims data through Section 111 reporting will alert Medicare to opportunities to recover conditional payments that previously eluded it. The federal deficit, the escalating costs of the Medicare program, and the effort to fund some expansion of healthcare entitlements while implementing health care reform provide strong incentives for aggressive future government enforcement of the Section 111 requirements.

Even if a self-insured company retains a third party administrator (TPA) or other agent to handle all liability claims, the company, not the TPA, is the Responsible Reporting Entity (RRE) under Section 111. The RRE is defined by Section 111 as the "Applicable Plan" legally responsible for paying claims. CMSUser Guide (for "Non-Group Health Plans" or "NGHPs") at 19.

In perhaps a stretch of legislative intent, CMS has declared responsibility for paying any amount of deductible the equivalent of being self-insured. Thus, a business that defines itself as an insured entity and pays a small deductible that is applied toward a claims payment, may also be required to report claims data to CMS. According to draft CMS guidance, if a settlement, judgment, award or other claims payment is less than the deductible, the self-insured company is the RRE if it makes the payment to the injured party. If the amount of the payment exceeds the deductible, the insured is the RRE for both the amount above and below the deductible if it pays the full claim and is then reimbursed by the insurer. The insurer, on the other hand, is the RRE for both the amount above and below the deductible if it pays the claimant the amount above the deductible, regardless of whether or not the insured pays the deductible to the claimant or to the insurer. Alert for NGHPs, Draft Language for Public Comment (July 31, 2009) at ¶ 6.b.

Where a self-insured company pays an injured individual directly and is reimbursed at any level by its "reinsurer, stop loss insurer, excess insurer, umbrella insurance guaranty fund, or patient compensation fund," the company is the RRE and no reporting is required by the insurer. Id. at 75.

If a self-insured company participates in a self-insurance pool, the pool may be the RRE if it: (1) is a separate legal entity, (2) has full responsibility to resolve and pay claims using pool funds, and (3) does not require involvement of the participating pool entities. If all three criteria are not met, the pool members are the RREs. Id. at 20.

Overseas corporations that are self-insured and occasionally liable to Medicare beneficiaries for bodily injury may have to register and report as RREs. The extraterritorial reach of Section 111 depends in large part on a factual analysis of the claim, claim handling process and payment, including but not limited to the extent to which payment is made in or into the United States.

Implementation deadlines for Section 111 reporting are imminent:

  • The deadline for self-insured businesses to register on-line with CMS as RREs is September 30, 2009, if they have a "reasonable expectation of having to report" a payment related to the resolution of a bodily injury claim of a Medicare beneficiary. Registration is not required if they will have nothing to report. In all circumstances, registration must be made in time "to allow a full quarter for testing" before reporting of actual claims begins. Once registered, an RRE must submit a claim input file to the government once per quarter for each reporting account it sets up, regardless of whether the RRE has resolved a claim that it must report. CMS User Guide at 24.
  • Registration itself is a complicated, multi-step, time consuming process that requires the RRE to provide notification to the CMS-designated Coordination of Benefits Contractor (COBC) via the COB Secure Web site (COBSW) using an interactive Web portal designed for this purpose.
  • All claims that meet the CMS-established monetary thresholds ($5,000 in 2010) and are resolved through a settlement, judgment or award on or after January 1, 2010 or claims for which an RRE has assumed ongoing payment responsibility for medicals as of or after July 1, 2009 are subject to the new reporting regime.
  • Although CMS has not finalized long anticipated guidance to address certain situations in which the identity of an RRE may not be clear or there may be multiple RREs, CMS has not postponed the registration deadline. See Wiley Rein MSP Reporting and Liability webpage for further information.
  • All RREs must begin reporting quarterly to CMS during a seven-day window during the second quarter of 2010, by a date assigned by CMS after registration.
  • RREs who have already registered were permitted to begin their mandatory testing of reporting procedures starting in July 2009.

Self-insured businesses that qualify as RREs will be required to obtain and report extensive claims information, some of which is not likely to be available from traditional claims files and may be extremely difficult and sometimes impossible to collect. RREs must report to CMS under more than 100 data fields, including:

  • Social Security Number or Medicare Health Insurance Claim Number for the injured Medicare beneficiary.
  • Attorney for the claimant.
  • Date of Incident (DOI) (For an automobile collision or other accident, the DOI is the date of the accident. For claims involving exposure, the DOI is the date of first exposure).
  • Resolution (including how the claim was resolved and for what amount).

Stiff penalties can result from a failure to report. Insurers and self-insured entities that fail to report can be assessed civil monetary penalties of $1,000 for each day of noncompliance for each individual for whom they should have submitted information. The technical reporting procedures are complicated and will require significant time and money to implement. Because it is unclear when CMS will begin imposing penalties, and whether there will be circumstances that will mitigate penalties (CMS has defined only one safe harbor to date that provides limited protection to an RRE that is unable to obtain the SSN of a beneficiary), companies should be implementing their compliance programs now. Without development of additional safe harbors or mitigation criteria, a constitutional challenge to the penalty structure is likely.