Government contractors that are self-insured against third-party liabilities and may pay claims submitted by Medicare-eligible individuals that arise from bodily injury must register with the Centers for Medicare & Medicaid Services (CMS) and then comply with Medicare reporting requirements that kick in early next year. Because CMS defines self-insurance very broadly to include a variety of risk retention mechanisms, even a deductible, Government contractors may be surprised to learn that they are subject to legal obligations and liabilities under the Medicare Program. Beginning in the second quarter of 2010, failure to report resolved claims with Medicare beneficiaries could trigger fines of $1,000 a day, per claim.

Section 111 of the Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA) requires "liability insurers" (which includes self-insured entities) to electronically report to CMS the claims payments they make to Medicare beneficiaries arising out of bodily injury, as well as over 100 other data points. 42 U.S.C. § 1395y(b)(8). CMS, the federal agency within the Department of Health and Human Services that administers the Medicare Program, defines a self-insured entity as "an entity that engages in a business, trade or profession . . . [and] carries its own risk (whether by a failure to obtain insurance, or otherwise) in whole or in part. Self-insurance . . . can be demonstrated by a settlement, judgment, award, or other payment to satisfy an alleged claim (including any deductible or co-pay on a liability insurance, no-fault insurance, or workers' compensation law or plan) for a business, trade or profession." CMS User Guide (for "Non-Group Health Plans" or "NGHPs") at 215 (July 31, 2009), available here.

An old law is back in the news. Medicare is the federal health insurance program for the elderly and disabled. Under the 1980 Medicare Secondary Payer statute, CMS may seek recovery of Medicare's past payments for medical services if it learns that another entity had the obligation to pay those medical costs as the primary payer. 42 U.S.C. § 1395y(b)(2)(B)(ii). Self-insured entities are deemed primary payers under the law. CMS therefore may recover a Medicare payment not only from the provider or Medicare beneficiary who received payment from a self-insured entity, but also from the entity itself, regardless of whether the entity has already made payment to the provider or beneficiary, thus imposing double liability on the entity. To date, CMS for the most part has pursued only beneficiaries, group health plans (GHPs) and GHP insurers to recoup Medicare overpayments. With the passage of MMSEA, the agency's focus is expected to broaden to include liability insurers, including self-insured businesses. Receiving claims data through Section 111 reporting will alert Medicare to opportunities to recover conditional payments from them that previously eluded it. The federal deficit, the escalating costs of the Medicare Program, and the effort to fund some expansion of healthcare entitlements while implementing health care reform provide strong incentives for aggressive government enforcement of the Section 111 requirements.

In perhaps a stretch of regulatory authority, CMS has declared a business that purchases insurance with any deductible amount to be a self-insured business. Thus, a Government contractor that considers itself an insured business, but pays a small deductible that is applied toward a claims payment, may in certain circumstances also be required to report claims data to CMS. For example, whenever a contractor makes a payment directly to the claimant, the contractor is the Responsible Reporting Entity (RRE) under Section 111 if the settlement, judgment or award is less than the deductible, or the contractor pays the entire claim and is reimbursed by the insurer. If the amount of the payment exceeds the deductible, the contractor is the RRE if the contractor pays the full claim and is then reimbursed by the insurer, but the insurer is the RRE if it pays the claimant the amount above the deductible, regardless of whether or not the contractor pays the deductible to the claimant or the insurer. The bottom line is that contractors need to be aware of this potential reporting requirement and either take steps to avoid situations where they could be deemed RREs or ensure they are reporting in accordance with the requirement.

The official deadline for self-insured businesses to register online with CMS as RREs was September 30, 2009, but at the very least, CMS advises that registration must be completed in time to allow a full quarter of data transmission testing before mandated reporting of actual claims data begins in the second quarter of 2010. Self-insured businesses that qualify as RREs will be required to report extensive claims information, some of which is not likely to be available from traditional claims files and may be difficult and sometimes impossible to collect, like the claimant's Social Security Number (SSN) or Health Insurance Claim Number (HICN). All claims that meet the CMS-established monetary threshold for lump-sum payments ($5,000 in 2010) and are resolved through a settlement, judgment or award on or after January 1, 2010 (TPOC claims), or claims for which an RRE has assumed ongoing payment responsibility for medical expenses as of or after July 1, 2009 (ORM claims) are subject to the new reporting regime.

Stiff penalties may result from a failure to report. Self-insured entities that fail to timely report can be assessed civil monetary penalties of $1,000 for each day of noncompliance with respect to each individual claimant for whom they should have submitted information. Because it is unclear when CMS will begin imposing penalties, and whether there will be circumstances that may mitigate penalties (to date CMS has offered only one narrowly prescribed safe harbor that provides limited protection to an RRE unable to obtain the SSN or HICN of a Medicare beneficiary), contractors that have not yet registered as RREs but are self-insured entities as defined by CMS should begin now to assess whether they will have obligations under Section 111 reporting. Registration itself is complicated, but RREs are finding the implementation of a reporting program that complies with more than 200 pages of CMS instructions even more challenging.