U.S. businesses of all sizes (and certain overseas businesses as well) must register on-line with the Centers for Medicare & Medicaid Services (CMS) and comply with new federal Medicare reporting requirements if: (i) they are fully or partially self-insured against third-party liabilities, and(ii) likely to pay claims that arise in whole or in part from bodily injuries. Because CMS defines self-insurance very broadly to include a variety of risk retention mechanisms, such as deductibles, businesses may be surprised to learn that they have acquired new legal obligations under the Medicare Program. Beginning in the second quarter of 2010, failure to report resolved claims could trigger fines of $1000 for each day of noncompliance with respect to each claimant as to whom the business should have submitted information.
CMS, the federal agency within the Department of Health and Human Services that administers the Medicare Program, defines a self-insured entity as "an entity that engages in a business, trade or profession . . . [and] carries its own risk (whether by a failure to obtain insurance, or otherwise) in whole or in part. Self-insurance or deemed self-insurance can be demonstrated by a settlement, judgment, award, or other payment to satisfy an alleged claim (including any deductible or co-pay on a liability insurance, no-fault insurance, or workers' compensation law or plan) for a business, trade or profession." CMS User Guide at 215 (July 31, 2009), available at http://www.cms.hhs.gov/MandatoryInsRep/Downloads/NGHPUserGuide2V2.pdf (emphasis added).
An old law is back in the news. It is not widely known outside of CMS that for nearly thirty years, self-insured businesses that pay a settlement, judgment or award to a Medicare beneficiary in recompense for bodily injury have had an obligation to reimburse Medicare for any prior "conditional payments" Medicare may have made to cover the beneficiary's related medical expenses, if the beneficiary fails to provide such reimbursement. Medicare is a federal health insurance program for the elderly and disabled, administered by CMS. Under the 1980 Medicare Secondary Payer (MSP) statute, CMS may seek recovery of its past payments to medical providers if it learns that another entity had the obligation to pay those medical costs as the primary payer. 42 U.S.C. § 1395y(b)(2)(B)(ii). CMS may recover such a payment in most instances from either the provider or beneficiary that receives a third-party payment for the bodily injury that led to those costs, or the liability insurer (which the law defines to include a self-insured entity) that makes that payment. Another relatively unknown fact is that CMS may recover from a self-insured business regardless of whether that entity has already made payments to the provider or Medicare beneficiary - thus imposing double liability on the business. To date, CMS for the most part has pursued only beneficiaries, group health plans (GHPs) and GHP insurers to recoup Medicare overpayments, but the agency's focus is now broadening to include liability insurers and self-insured entities.
CMS has imposed onerous new reporting requirements on self-insured businesses. Section 111 of the Medicare, Medicaid and SCHIP Extension Act of 2007 (MMSEA) requires liability insurers (defined to include self-insured entities), no-fault insurers and workers' compensation insurers, as well as GHPs, to report to CMS their payments related to bodily injuries incurred by a Medicare beneficiary, as well as over 100 other data points. 42 U.S.C. § 1395y(b)(8). CMS, in exercising its exceptionally broad delegation of regulatory authority by Congress, has issued a 223-page User Guide containing complex IT and data reporting requirements. To implement this new reporting scheme, self-insured businesses must create the necessary IT infrastructure and claims handling work flow to gather and report the required data to CMS on a quarterly basis beginning sometime in the second quarter of 2010 as assigned by CMS. But the implications of this change go far beyond IT procedures.
The government seeks liability claims data for one principal reason: to pursue recoveries of Medicare conditional payments. Under the MSP statute, Medicare generally has secondary liability for payment of a Medicare beneficiary's medical expenses whenever a liability insurer or self-insured business pays compensation for all or part of the bodily injuries that led to those expenses. See 42 U.S.C. § 1395y(b); 42 C.F.R. Part 411. If Medicare makes a primary payment on behalf of a Medicare beneficiary who then receives payment from a self-insured business for the related injury, Medicare wants to pursue recovery of its earlier payment (known under Medicare law as a "conditional payment"). Receiving claims data through Section 111 reporting will alert Medicare to opportunities to recover conditional payments that previously eluded it. The federal deficit, the escalating costs of the Medicare program, and the effort to fund some expansion of healthcare entitlements while implementing health-care reform provide strong incentives for aggressive government enforcement of the Section 111 requirements.
Even if a self-insured business retains a third-party administrator (TPA) or other agent to handle all liability claims, the company, not the TPA, is the Responsible Reporting Entity (RRE) under Section 111. The RRE is defined by Section 111 as an "Applicable Plan" legally responsible for paying claims.CMS User Guide (for "Non-Group Health Plans" or "NGHPs") at 19 (Section 7.1). The self-insured entity is an Applicable Plan.
In perhaps a stretch of legislative intent, CMS has declared responsibility for paying any amount of deductible as the equivalent of being self-insured. Thus, a business that defines itself as an insured entity but pays a small deductible that is applied toward a claims payment, may also be required to report claims data to CMS. According to draft CMS guidance, if a settlement, judgment, award or other claims payment is less than the deductible, the self-insured company is the RRE if it makes the payment directly to the injured party. If the amount of the payment exceeds the deductible, the insured is the RRE for both the amount above and below the deductible if the insured pays the full claim and is then reimbursed by the insurer. The insurer, on the other hand, is the RRE for both the amount above and below the deductible if it pays the claimant the amount above the deductible, regardless of whether or not the insured pays the deductible to the claimant or to the insurer. Alert for NGHPs, Draft Language for Public Comment (July 31, 2009) at ¶ 6.b. Where a self-insured business pays an injured individual directly and is reimbursed at any level by its "reinsurer, stop loss insurer, excess insurer, umbrella insurance guaranty fund, or patient compensation fund," the business is the RRE and must report the claim. Id. at 75.
If a self-insured company participates in a "self-insurance pool," the pool may be the RRE if it: (1) is a separate legal entity, (2) has full responsibility to resolve and pay claims using pool funds, and (3) does not require involvement of the participating pool entities. If all three criteria are not met, the pool members are each an RRE. Id. at 20.
Overseas corporations that are self-insured and occasionally liable to Medicare beneficiaries for bodily injury may have to register and report as RREs. The extraterritorial reach of Section 111 depends in large part on a factual analysis of the claim, the claims handling process and ultimate payment methodology, including but not limited to the extent to which payment is made within or into the United States.
Implementation deadlines for Section 111 reporting have kicked in:
• The deadline for self-insured businesses to register on-line with CMS as RREs was September 30, 2009, if at that time they had a "reasonable expectation of having to report" a payment related to the resolution of a bodily injury claim of a Medicare beneficiary. Registration was not required by those entities that had no expectation of having anything to report. In all circumstances, registration must be made in time "to allow a full quarter for testing" before reporting of actual claims begins. After registering, an RRE must submit a claim input file to the government once per quarter for each reporting account (or "RRE Identification Number") it sets up, regardless of whether the RRE has resolved any claims since the last reporting period. CMS User Guide at 23-24 (Section 8.1).
• Registration itself is a multi-step, time consuming process that requires the RRE to provide notification to the CMS-designated Coordination of Benefits Contractor (COBC) via the COB Secure Website (COBSW) using an interactive Web portal designed for this purpose.
• All claims that meet the CMS-established monetary thresholds for lump-sum payments ($5,000 in 2010) that are resolved through a settlement, judgment or award on or after January 1, 2010 (TPOC claims), or claims for which an RRE has assumed ongoing payment responsibility for medicals as of or after July 1, 2009 (ORM claims) are subject to the new reporting regime.
• Although CMS had not issued any final guidance by the middle of September 2009 (when this article was written) that addresses reporting obligations in certain situations in which the identity of an RRE may not be clear or in which there may be multiple RREs, CMS did not postpone the registration deadline. See Wiley Rein's MSP Reporting and Liability page at http://www.wileyrein.com/msp for further information.
• All RREs must begin reporting quarterly to CMS during a seven-day window during the second quarter of 2010, by a date assigned by CMS after RRE registration.
• Registered RREs were permitted to begin their mandatory testing of certain reporting procedures as early as July 2009. Testing of claims file transmissions must be completed by March 31, 2010.
Self-insured businesses that qualify as RREs will be required to obtain and report extensive claims information, some of which is not likely to be available from traditional claims files and may be difficult and sometimes impossible to collect. RREs must report to CMS under more than 100 data fields, including:
• Identity of the injured party, including a Social Security Number (SSN) or Medicare Health Insurance Claim Number (HICN)
• Description of injury
• Alleged cause of injury
• ICD-9 diagnosis codes
• Date of incident (DOI) (for an automobile collision or other accident, the DOI is the date of the accident; for claims involving exposure, the DOI is the date of first exposure)
• Self-insured type
• Resolution (including when the claim was resolved, how it was paid or structured, and for what amount)
Stiff penalties may result from a failure to report. Insurers and self-insured entities that fail to report can be assessed civil monetary penalties of $1,000 for each day of noncompliance for each individual claimant for whom they should have submitted information. The technical reporting procedures are complicated and will require significant time and money to implement. Because it is unclear when CMS will begin imposing penalties, and whether there will be circumstances that will mitigate penalties (CMS has defined only one safe harbor to date that provides limited protection to an RRE that is unable to obtain the SSN or HICN of a beneficiary), companies should be implementing their compliance programs now. Without development of additional safe harbors or mitigation criteria, a constitutional challenge to the penalty structure is likely.
Published October 4, 2009.
