Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 70363 

petty officer, or any federal, state, or 

local law enforcement officer who has 

been designated by the Captain of the 

Port Northern New England (COTP), to 

act on his or her behalf. The designated 

representative may be on an official 

patrol vessel or may be on shore and 

will communicate with vessels via 

VHF–FM radio or loudhailer. In 

addition, members of the Coast Guard 

Auxiliary may be present to inform 

vessel operators of this regulation. 

Official patrol vessels mean any Coast 

Guard, Coast Guard Auxiliary, state, or 

local law enforcement vessels assigned 

or approved by the COTP to enforce this 

section. 

(c) Effective and Enforcement Period. 

The safety zone in paragraph (a) of this 

section is in effect from October 23, 

2023, through May 17, 2024, and is 

subject to enforcement 24 hours a day. 

(d) Regulations. When this safety zone 

is enforced, the following regulations, 

along with those contained in 33 CFR 

165.23 apply: 

(1) No person or vessel may enter or 

remain the safety zone described in 

paragraph (a) without the permission of 

the COTP or the COTP’s designated 

representative. However, any vessel that 

is granted permission to enter or remain 

in this zone by the COTP or the COTP’s 

designated representative must proceed 

through the zone with caution and 

operate at a speed no faster than that 

speed necessary to maintain a safe 

course, unless otherwise required by the 

Navigation Rules. 

(2) Any person or vessel permitted to 

enter the safety zone shall comply with 

the directions and orders of the COTP 

or the COTP’s designated representative. 

Upon being hailed by a U.S. Coast 

Guard vessel by siren, radio, flashing 

lights, or other means, the operator of a 

vessel within the zone shall proceed as 

directed. Any person or vessel within 

the safety zone shall exit the zone when 

directed by the COTP or the COTP’s 

designated representative. 

(3) To obtain permission required by 

this regulation, individuals may reach 

the COTP or the COTP’s designated 

representative via Channel 16 (VHF– 

FM) or (207) 741–5465 (Sector Northern 

New England Command Center). 

(e) Penalties. Those who violate this 

section are subject to the penalties set 

forth in 46 U.S.C. 70036. 

Dated: October 2, 2023. 

Amy Florentino, 

Captain, U.S. Coast Guard, Captain of the 

Port Northern New England. 

[FR Doc. 2023–22340 Filed 10–10–23; 8:45 am] 

BILLING CODE 9110–04–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Centers for Medicare & Medicaid 

Services 

42 CFR Part 402 

45 CFR Part 102 

[CMS–6061–F] 

RIN 0938–AT86 

Medicare Program; Medicare 

Secondary Payer and Certain Civil 

Money Penalties 

AGENCY: Centers for Medicare & 

Medicaid Services (CMS), HHS. 

ACTION: Final rule. 

SUMMARY: This final rule will specify 

how and when CMS must calculate and 

impose civil money penalties (CMPs) 

when group health plan (GHP) and nongroup health plan (NGHP) responsible 

reporting entities (RREs) fail to meet 

their Medicare Secondary Payer (MSP) 

reporting obligations by failing to 

register and report as required by MSP 

reporting requirements. This final rule 

will also establish CMP amounts and 

circumstances under which CMPs will 

and will not be imposed. 

DATES: 

Effective date: This final rule is 

effective on December 11, 2023. 

Applicability date: The provisions of 

this rule are applicable on or after 

October 11, 2024. 

FOR FURTHER INFORMATION CONTACT: 

Brian Broznowicz, (410) 786–3349. 

SUPPLEMENTARY INFORMATION: 

I. Background 

A. Imposition of Civil Money Penalties 

(CMPs)—Legislative Overview 

In 1981, the Congress added section 

1128A to the Social Security Act (the 

Act) (section 2105 of Pub. L. 97–35) to 

authorize the Secretary of Health and 

Human Services (the Secretary) to 

impose civil money penalties (CMPs) 

and assessments on certain health care 

facilities, health care practitioners, and 

other suppliers for noncompliance with 

rules of the Medicare and Medicaid 

programs. CMPs and assessments 

provide an enforcement tool for 

agencies to use to ensure compliance 

with statutory and regulatory 

requirements. These CMPs and 

assessments may be imposed in 

addition to potential criminal or civil 

penalties. 

Since 1981, the Congress has 

increased both the number and the 

types of circumstances under which the 

Secretary may impose CMPs. Some CMP 

authorities address fraud, 

misrepresentation, or falsification, while 

others address noncompliance with 

programmatic or regulatory 

requirements. The Secretary has 

delegated the authority for certain 

provisions to either the Office of 

Inspector General (OIG) or Centers for 

Medicare & Medicaid Services (CMS). 

(See the October 20, 1994, notice, titled 

‘‘Office of Inspector General; Health 

Care Financing Administration; 

Statement of Organization, Functions, 

and Delegations of Authority’’ (58 FR 

52967).) A summary of these CMP 

changes is discussed in this section of 

this final rule. 

B. Medicare Secondary Payer History 

In 1980, the Congress added section 

1862(b) of the Act, which defined when 

Medicare is the secondary payer to 

certain primary plans. These provisions 

are known as the Medicare Secondary 

Payer (MSP) provisions of the Act. 

Section 1862(b)(2)(A) of the Act 

prohibits Medicare from making 

payment if payment has been made, or 

can reasonably be expected to be made 

by any of the following primary plans: 

• Group Health Plans (GHPs). 

• Workers’ compensation plans. 

• Liability insurance (including selfinsurance). 

• No-fault insurance. 

Medicare may make conditional 

payments, subject to Medicare payment 

rules, in situations where workers’ 

compensation, liability insurance 

(including self-insurance), or no-fault 

insurance has not made payment or 

cannot be expected to make payment 

promptly. Any conditional payments 

that Medicare makes are subject to 

reimbursement from the primary plan. 

See section 1862(b)(2)(B) of the Act. 

C. Legislative Provisions Regarding 

Mandatory Reporting Requirements 

To enhance enforcement of the MSP 

provisions, section 111 of the Medicare, 

Medicaid, and SCHIP Extension Act of 

2007 (MMSEA) (Pub. L. 110–173) added 

paragraphs (7) and (8) to section 1862(b) 

of the Act. These paragraphs established 

new mandatory reporting requirements 

regarding Medicare beneficiaries who 

have coverage under GHP arrangements, 

as well as when liability insurance 

(including self-insurance), no-fault 

insurance, or workers’ compensation 

(collectively referred to as Non-Group 

Health Plans, or NGHPs) provide 

settlements, judgments, awards, or 

assume other payment responsibility for 

Medicare beneficiaries’ care. Sections 

1862(b)(7)(A) and (b)(8)(F) of the Act 

define those parties responsible for this 


lotter on DSK11XQN23PROD with RULES1
70364 Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 

reporting (collectively referred to as 

responsible reporting entities, or RREs). 

Under section 1862(b)(7)(A) of the Act, 

GHPs or third-party administrators are 

obligated to report beneficiary coverage; 

almost 1,000 entities are registered as 

GHP RREs, with 62 percent estimating 

between 1,000 and 100,000 individual 

beneficiaries to be reported annually. 

Under section 1862(b)(8)(F) of the Act, 

NGHP applicable plans are obligated to 

report settlements or when the entity 

otherwise assumes payment 

responsibility, and over 21,000 entities 

are registered as NGHP RREs, with the 

vast majority (88.29 percent) estimating 

fewer than 500 individual beneficiaries 

to report annually at the time of 

registration. 

RREs are currently required to submit 

coverage information for Medicare 

beneficiaries including, but not limited 

to, when coverage begins or ends, or 

when a judgment, award, settlement, or 

other payment is made, on a quarterly 

basis through an electronic file 

submission process that may vary 

depending upon the number of 

beneficiary records being reported or 

updated. NGHP RREs who submit 500 

or less claim reports per year are eligible 

to utilize the Coordination of Benefits 

Secure website (COBSW) Direct Data 

Entry (DDE) reporting option to add, 

update, or delete claim information. 

DDE submitters have the same 

responsibility and accountability as any 

other RRE. This coverage information 

primarily consists of enough identifying 

information to uniquely identify the 

Medicare beneficiary and confirm their 

beneficiary status, as well as 

information about the nature of the 

coverage (such as GHP or NGHP, 

coverage effective dates, policy limits, 

settlement amounts, and so forth). These 

section 111 of MMSEA reporting 

provisions did not alter any other 

existing statutory provisions or 

regulations. Further, these reporting 

provisions include authority for CMS to 

impose CMPs against entities that fail to 

comply with the section 111 of MMSEA 

reporting requirements under section 

1862(b)(7) or (b)(8) of the Act, as 

amended by the Medicare IVIG Access 

and Strengthening Medicare and 

Repaying Taxpayers Act of 2012 (the 

SMART Act). These provisions also 

require that GHPs and NGHPs that fail 

to comply with these reporting 

requirements shall be subject to a CMP 

of $1,000 and up to $1,000, respectively, 

for each calendar day of noncompliance. 

Imposition of penalties related to 

noncompliance with section 111 of 

MMSEA are required to be promulgated 

in regulation, which is the purpose of 

this rule. 

In 2013, Congress enacted the SMART 

Act, which amended section 

1862(b)(8)(E) of the Act, which includes 

the section 111 of MMSEA reporting 

requirements and describes the 

enforcement provisions for NGHPs that 

fail to comply with the reporting 

requirements. Specifically, the SMART 

Act revised section 1862(b)(8)(E) of the 

Act to state that NGHP applicable plans 

that fail to comply with the reporting 

requirements may be subject to a civil 

money penalty of up to $1,000 for each 

calendar day of reporting 

noncompliance required of NGHP 

applicable plans under section 

1862(b)(8)(E) of the Act. The SMART 

Act also added section 1862(b)(8)(I) of 

the Act, which specifically required 

rulemaking actions regarding the 

enforcement of CMP provisions under 

section 1862(b)(8)(E) of the Act. 

We note that the SMART Act did not 

amend any CMP provisions for GHP 

arrangements that have reporting 

obligations under section 1862(b)(7) of 

the Act. Such GHP arrangements remain 

subject to mandatory CMPs of $1,000 

per calendar day of noncompliance and 

per individual for whom submission of 

information was required. In addition, 

the SMART Act directed rulemaking for 

NGHP applicable plans regarding the 

imposition and non-imposition of 

CMPs. 

We further note that the statutory 

language speaks to ‘‘individuals,’’ 

though there are situations described 

that are specifically applicable to 

Medicare beneficiaries; we have 

attempted to be consistent with the 

usage of this statutory terminology but 

use the term ‘‘beneficiary’’ where it is 

more appropriate. 

D. Summary of Public Comments 

Received on the December 11, 2013, 

Advance Notice of Proposed 

Rulemaking (ANPRM) 

As the mandatory insurer reporting 

requirements themselves are selfimplementing, we were able to 

gradually implement the reporting 

process from 2009 through 2011. The 

implemented reporting process 

included informal communications to 

RREs regarding their compliance with 

reporting requirements, including 

‘‘compliance flags’’ in response to 

records that fail to meet specified 

criteria and even direct outreach to 

RREs. However, the implementation of 

civil money penalties for 

noncompliance requires formal 

rulemaking. In accordance with the 

rulemaking directed by the SMART Act, 

on December 11, 2013 (78 FR 75304), 

we published an advance notice of 

proposed rulemaking (ANPRM) titled 

‘‘Medicare Secondary Payer and Certain 

Civil Money Penalties.’’ The December 

2013 ANPRM solicited public comment 

on specific practices for which CMPs 

may or may not be imposed for failure 

to comply with MSP reporting 

requirements for certain GHP and NGHP 

arrangements. 

We received 34 timely pieces of 

correspondence in response to the 

December 2013 ANPRM. In section I.D. 

of the February 18, 2020, proposed rule, 

we provided an analysis of the public 

comments received by subject area, with 

a focus on the most common issues 

raised, and briefly discuss how we 

proposed to address the issues raised by 

commenters in response to the 2013 

ANPRM. Commenters expressed many 

of the same concerns and raised most of 

the same points that were raised in 

response to the proposed rule, 

published on February 18, 2020. While 

the proposed rule addressed these 

comments, alterations to the rule, as 

well as an evolving stakeholder 

landscape, resulted in many comments 

to the proposed rule being resubmitted 

in substantially similar form and 

content. Specifically, many commenters 

requested clarity around how a CMP 

would be calculated, the possibility of a 

sliding scale or tiered approach to 

levying CMPs, establishing a statute of 

limitations, and confirming that 

enforcement of the rule would be 

prospective only. For more detailed 

information on our analysis of the 

public comments on the ANPRM, please 

see the February 18, 2020, proposed rule 

(85 FR 8795 through 8797). 

II. Provisions of the Proposed Rule and 

the Analysis of and Responses to Public 

Comments 

In the February 18, 2020, Federal 

Register (85 FR 8793), we published the 

proposed rule titled ‘‘Medicare 

Secondary Payer and Certain Civil 

Money Penalties.’’ In drafting the 

February 2020 proposed rule, we 

reviewed the public comments in 

response to our December 11, 2013, 

ANPRM (78 FR 75304), and other policy 

considerations. Accordingly, we 

proposed specific criteria for when 

CMPs would be imposed and proposed 

specific criteria for when CMPs would 

not be imposed, in circumstances when 

a GHP or an NGHP entity fails to 

comply (either on its own or through a 

reporting agent) with MSP reporting 

requirements specified under section 

1862(b)(7) and (b)(8) of the Act. Further, 

we proposed to amend the amount of 

these CMPs, as set forth under 45 CFR 

102.3 (Penalty adjustment and table). 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 70365 

We received 47 timely pieces of 

public correspondence on the February 

18, 2020, proposed rule. Commenters 

included various group health plans and 

private insurance companies (non-group 

health plan insurers) as well as their 

representatives, special interest groups, 

and other interested individuals. Some 

comments addressed issues or 

expressed concerns that were outside 

the scope of this rule and were thus 

inappropriate to address in this venue. 

Of the remaining comments, there were 

many that expressed concern with 

various aspects of the proposed rule 

including the possible amount of CMPs, 

the process by which noncompliance 

would be discovered, and the 

proportionality of the possible penalties 

when compared to the severity of the 

noncompliance as well as the relative 

size of the entity against which a 

penalty was contemplated. In direct 

response to public comment, as well as 

substantial internal data analysis, CMS 

has revised the final rule to be 

responsive to the concerns of those 

entities that may be impacted by the 

rule. 

A. CMP Basis and Scope in the 

Proposed Rule 

The existing regulation at 42 CFR 

402.1 describes the basis for imposition 

of CMPs against parties who violate the 

provisions of the Act. We proposed to 

add regulatory language under 

§ 402.1(c), which would identify 

situations in which GHP and NGHP 

RREs would be subject to CMPs under 

sections 1862(b)(7) and (b)(8) of the Act. 

To accomplish this regulatory addition, 

we proposed the following regulatory 

revisions in § 402.1: 

• Removing paragraph (c)(20), which 

currently refers to a provision that is no 

longer applicable regarding the 

imposition of CMPs for employers that 

fail to timely, and accurately report an 

employee’s group health insurance 

coverage. 

• Redesignating paragraph (c)(21) as 

paragraph (c)(20). 

• Redesignating paragraphs (c)(22) 

through (34) as paragraphs (c)(23) 

through (35). 

• Adding new paragraphs (c)(21) and 

(22), which will incorporate the new 

text finalized in this rule and all 

applicable provisions. 

The existing regulation at 42 CFR 

402.105(b) establishes the amounts of 

penalties assessed against parties who 

violate the provisions of the Act. We 

proposed to amend § 402.105(b) by 

revising paragraph (b)(2) and adding a 

new paragraph (b)(3). The proposed 

regulation at § 402.105(b)(2) would 

codify the amounts of penalties imposed 

against GHPs, and the proposed 

regulation at § 402.105(b)(3) would 

establish the amounts of penalties 

imposed against NGHPs. 

In addition, we proposed to revise the 

regulations at 45 CFR 102.3 to establish 

the updated amounts for all CMPs at 

issue in these regulations. 

Comment: Some commenters 

expressed concerns about the potential 

size of the CMPs that would be imposed 

and recommended developing a 

‘‘sliding scale’’ or ‘‘tiered’’ CMP 

approach. These suggestions included 

scaling the amount of the CMP to be 

imposed based upon the intentions of 

the noncompliant entity, or upon 

whether an excess proportion of 

individual beneficiary records failed to 

be reported as required (in essence 

creating a safe harbor for a certain 

portion of records to not be reported as 

required), and other similar 

recommendations to limit the size of the 

CMP. Some commenters also noted the 

statutory discrepancy between the 

penalty amounts for GHP, which are 

$1,000 per day of noncompliance, and 

NGHP entities, which are up to $1,000 

per day of noncompliance. 

Response: We begin by noting that 

CMS does not have the authority to alter 

penalties for GHPs, as penalty amounts 

are stated in section 1862(b)(7) of the 

Act. In the proposed rule, we proposed 

that penalties for NGHP entities would 

parallel those for GHP entities. 

However, because CMS has the 

authority to adjust CMPs for NGHP 

entities, we are instead finalizing a 

tiered approach with respect to such 

entities, under which we will adjust 

penalty amounts based on the length of 

time that a report has been untimely. 

The full explanation of this approach 

appears in the next section of this 

document. 

While ultimately the responsibility of 

the RRE, CMS is not unsympathetic to 

RREs in regard to those situations where 

a particular late submission was the 

result of a rare situation, system glitch, 

defect, or other problem that was 

unanticipated or out of the immediate 

control of the RRE. For this reason, an 

informal notice process will be 

implemented so that any RRE that 

receives notice that a CMP is pending 

against them will have an opportunity 

to examine their records and alert CMS 

to any discrepancies or mistakes that 

could mitigate or eliminate the potential 

penalty. This process is described in full 

detail later in this document. 

Comment: Some commenters alleged 

that the amount of CMPs, in certain 

circumstances, are too high, excessive, 

disproportionate to the harm to the 

program, or unconstitutional. 

Response: The amounts of the GHP 

CMPs are set by statute, in accordance 

with section 1862(b)(7)(B) of the Act, 

and CMS must enforce the amount as 

set by statute. While CMS has discretion 

to adjust CMPs for NGHPs under section 

1862(b)(8)(E) of the Act, the statute does 

not authorize such discretion with 

respect to GHPs. In the proposed rule, 

we proposed that CMPs imposed against 

NGHPs would be aligned with those for 

GHP entities. However pursuant to this 

final rule, penalties for NGHP entities 

will instead be tiered based on the 

amount of time that a record has been 

late, or gone unreported, in accordance 

with the language of the statute which 

provides that penalties for NGHPs are 

up to $1,000 per day of noncompliance. 

We originally proposed that CMPs 

may be levied in addition to any MSP 

reimbursement obligations identified 

using the reported information, but that 

CMS would not impose duplicative 

penalties. For example, failure to timely 

report the termination of coverage and 

then submitting the late termination in 

a manner that exceeds the error 

tolerance threshold for the fourth time 

in eight consecutive reporting periods, 

may meet the criteria for two potential 

CMPs with the submission of one 

record. However, we proposed that CMS 

would only impose a CMP once, and for 

the lesser of the two potential CMPs. 

This proposed limitation has been 

eliminated in the final rule as a result 

of being rendered unnecessary by the 

new audit methodology that will be 

employed. 

B. CMP Imposition and Amounts in the 

Proposed Rule 

The proposed regulations at § 402.1(c) 

identified circumstances where GHP 

and NGHP entities would be subject to 

CMPs for violation of sections 

1862(b)(7) and (b)(8) of the Act. 

Following publication of the final rule, 

we intended to enhance monitoring of 

recovery process disputes and appeals 

that contradict reported data, as well as 

monitoring the reported data and 

performance over time to identify 

reporting that exceeded error tolerances. 

The proposed regulations at § 402.105(b) 

explained how we would calculate CMP 

amounts for GHP and NGHP entities 

that have reporting obligations under 

sections 1862(b)(7) and (b)(8) of the Act. 

Furthermore, proposed § 402.1(c) 

identified situations where GHP and 

NGHP RREs would not be subject to 

CMPs for violation of sections 

1862(b)(7) and (b)(8) of the Act. The 

final rule will limit CMPs to only 

instances of noncompliance based on 

timely reporting, so as to greatly 

simplify the process by which CMPs are 


lotter on DSK11XQN23PROD with RULES1
70366 Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 

levied. The changes to the final rule are 

largely in response to stakeholder 

concerns raised in response to the 

ANPRM and proposed rule that alleged 

that the proposed process was 

confusing, punitive, and failed to serve 

the intended purpose of encouraging 

compliance and fostering collaboration 

with CMS. More information on this 

will be in the following section. 

Under section 1862(b)(7) of the Act, a 

GHP RRE shall be subject to a CMP of 

$1,000 as adjusted annually under 45 

CFR part 102 (currently $1,325 as of 

June 8, 2023; see 87 FR 15101)) for each 

calendar day of noncompliance for each 

individual for which the required 

information should have been 

submitted. Under section 1862(b)(8) of 

the Act, an NGHP RRE may be subject 

to a CMP of up to $1,000 as adjusted 

annually under 45 CFR part 102 

(currently $1,325 as of June 8, 2023; see 

87 FR 15101) for each calendar day of 

noncompliance with respect to each 

claimant. These CMPs would be in 

addition to any other penalties 

prescribed by law, and in addition to 

any MSP claim under section 1862(b) of 

the Act with respect to an individual. 

1. Imposition of a CMP 

In the proposed rule, CMS indicated 

that a penalty would be imposed if an 

RRE fails to report or update any GHP 

beneficiary record within the required 

timeframe (no more than 1 calendar year 

after GHP coverage effective date or the 

Medicare beneficiary’s entitlement date, 

whichever is later). In the proposed 

rule, CMS proposed that the penalty be 

calculated on a daily basis, based on the 

actual number of individual 

beneficiaries’ records that the entity 

submitted untimely (that is, beyond the 

required timeframe after the GHP MSP 

effective date). CMS proposed that the 

penalty be $1,000 (as adjusted annually 

under 45 CFR part 102) for each 

calendar day of noncompliance for each 

individual for which the required 

information should have been 

submitted, as counted from the day after 

the last day of the RRE’s assigned 

reporting window where the 

information should have been submitted 

through the day that CMS received the 

information, up to a maximum penalty 

of $365,000 (as adjusted annually under 

45 CFR part 102) per individual per 

year. 

In the proposed rule, CMS also 

proposed a penalty if an RRE failed to 

report any NGHP beneficiary record 

within the required timeframe of no 

more than 1 year after the date of the 

settlement, judgment, award, or other 

payment (also referred to as the Total 

Payment Obligation to Claimant 

(TPOC)). CMS proposed that the penalty 

be calculated on a daily basis, based on 

the actual number of individual 

beneficiaries’ records that the entity 

submitted untimely (that is, in excess of 

the required timeframe after the TPOC 

date). In the proposed rule, CMS 

proposed that the penalty be up to 

$1,000 (as adjusted annually under 45 

CFR part 102) for each calendar day of 

noncompliance for each individual for 

which the required information should 

have been submitted, as counted from 

the day after the last day of the RRE’s 

assigned reporting window where the 

information should have been submitted 

through the day that CMS received the 

information, up to a maximum penalty 

of $365,000 (as adjusted annually under 

45 CFR part 102) per individual per 

year. 

In the proposed rule, CMS also 

proposed that a CMP be assessed if a 

GHP’s or NGHP’s response to CMS 

recovery efforts contradicted the entity’s 

section 111 of MMSEA reporting. For 

example, if an RRE reported and 

repeatedly affirmed ongoing primary 

payment responsibility for a given 

beneficiary, then responded to recovery 

efforts with the assertion that coverage 

for that beneficiary actually terminated 

2 years prior to the issuance of the 

recovery demand letter. The penalty as 

proposed would have been calculated 

based on the number of calendar days 

that the entity failed to appropriately 

report updates to beneficiary records, as 

required for accurate and timely 

reporting under section 111 of MMSEA. 

In the proposed rule, for a GHP, CMS 

proposed that the penalty be $1,000 (as 

adjusted annually under 45 CFR part 

102) for each calendar day of 

noncompliance for each individual for 

which the required information should 

have been submitted. For an NGHP, 

CMS proposed that the penalty be up to 

$1,000 (as adjusted annually under 45 

CFR part 102) per calendar day of 

noncompliance for each individual, for 

a maximum annual penalty of $365,000 

(as adjusted annually under 45 CFR part 

102) for each individual for which the 

required information should have been 

submitted. 

In the proposed rule, CMS also 

proposed that a penalty be assessed if a 

GHP or NGHP entity had reported and 

exceeded any error tolerance(s) 

threshold established by the Secretary 

in any 4 out of 8 consecutive reporting 

periods (as defined later in this section). 

We proposed that the initial and 

maximum error tolerance threshold 

would be 20 percent (representing errors 

that prevent 20 percent or more of the 

beneficiary records from being 

processed), with any reduction in that 

tolerance to be published for notice and 

comment in advance of implementation. 

We proposed that this tolerance would 

be applied as an absolute percentage of 

the records submitted in a given 

reporting cycle. 

In this final rule, all other proposed 

avenues for receiving a CMP have been 

eliminated and the only method of 

noncompliance that would be ripe for a 

CMP would be untimely reporting, as 

fully explained in the following section. 

Comment: Many commenters 

emphasized that this rule should not be 

aimed at those exhibiting ‘‘good faith 

efforts’’ or those who make an earnest 

attempt at reporting but may do so 

occasionally with error but instead be 

aimed at those who fail to report at all. 

Response: It is not our intent to 

penalize RREs for honest, infrequent 

mistakes, but instead to only resort to 

penalty when an RRE fails to report or 

submits reports in an untimely manner. 

We acknowledge that the overwhelming 

majority of RREs report correctly and 

timely a majority of the time and 

commend those entities for working 

with CMS to provide accurate data. It is, 

therefore, CMS’s shared opinion with 

commenters that the focus shall not be 

to punish and impose consequences but 

instead to motivate proper reporting and 

maintain compliance with existing 

statute and regulation. To that end, CMS 

is adopting an audit approach in this 

final rule whereby we will audit a 

randomized sample of new beneficiary 

records received each quarter, rather 

than undertaking an automated review 

of all records submitted, as proposed. 

By using this random auditing 

approach, CMS will be better able to 

monitor trends in reporting, via manual 

review of said records, rather than a 

mass, computer-based algorithm, which 

will allow us to discover areas that 

appear to be more of a challenge for 

RREs without resorting to penalties that 

may be disproportionate to the level of 

noncompliance exhibited or have the 

effect of penalizing an entity for an 

honest mistake or system error. RREs 

will also be able to avail themselves of 

the informal notice and dispute process 

to alert CMS to their ‘‘good faith efforts’’ 

to report any records that CMS has 

identified as being out of compliance. 

Comment: Some commenters raised 

concerns about the imposition of CMPs 

related to the reporting of Ongoing 

Responsibility for Medicals, (ORM). 

Specifically, these commenters cited 

difficulty with proper and timely 

reporting and understanding how to 

report ORM termination correctly. 

Response: In the proposed rule, CMS 

proposed imposing penalties for failing 

to accurately and timely report ORM 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 70367 

acceptance or termination. In the final 

rule, based on stakeholder concerns and 

submitted comments, CMS has chosen 

to focus its definition of noncompliance 

solely on those situations where an 

entity has failed to provide its initial 

report of primary payment 

responsibility in a timely manner. That 

means that untimely termination of 

ORM coverage records would not be 

considered eligible for a civil money 

penalty under this rule. While not a part 

of this final rule, we also note that CMS 

strives to engage with stakeholders, 

including RREs, about the reporting 

process and continuous process 

improvement efforts particularly as they 

relate to ORM, and will continue to do 

so in the future. We invite any RREs 

with concerns about ORM or any other 

aspect of reporting to proactively use 

the available outreach and education 

tools to address their questions. 

We also wish to convey that time 

delays caused by CMS or its contractors 

in the reporting process will not trigger 

penalties related to timeliness. RREs 

must adhere to all applicable timelines, 

but any delay encountered when 

following CMS’s policies and 

procedures will not be held against the 

RRE (for example, time delays related to 

processing by CMS contractors will not 

trigger any penalty). 

Comment: A number of commenters 

suggested that CMS should develop a 

formal appeal process to provide 

entities with reporting obligations a 

formal structure in which to appeal any 

notice of a pending or imposed CMP. 

Response: We note that CMPs 

imposed in accordance with this final 

rule will be subject to the formal 

appeals process as prescribed by 42 CFR 

402.19 and set forth under 42 CFR part 

1005. In broad terms, parties subject to 

CMPs will receive formal written notice 

at the time penalty is proposed. The 

recipient will have the right to request 

a hearing with an Administrative Law 

Judge (ALJ) within 60 calendar days of 

receipt. Any party may appeal the initial 

decision of the ALJ to the Departmental 

Appeals Board (DAB) within 30 

calendar days. The DAB’s decision 

becomes binding 60 calendar days 

following service of the DAB’s decision, 

absent petition for judicial review. 

Comment: Some commenters stressed 

the possibility of delays and uncertainty 

regarding their appeals due to backlogs 

at various stages of the administrative 

appeals process, and some suggested 

that CMS utilize a different appeals 

process. 

Response: We affirm that CMS is 

bound by the appeal process as 

prescribed in 42 CFR 402.19 and set 

forth under 42 CFR part 1005. 

Comment: Many commenters 

requested that CMS explain how it will 

provide notice to entities regarding 

pending or imposed CMPs and how 

much information will be included. 

Response: We intend to communicate 

with the entity informally before issuing 

formal notice regarding a CMP. The 

informal (that is, prior to formal 

enforcement actions) written ‘‘prenotice’’ process will allow the RRE the 

opportunity to present mitigating 

evidence for CMS review prior to the 

imposition of a CMP. The RRE will have 

30 calendar days to respond with 

mitigating information before the 

issuance of a formal written notice in 

accordance with 42 CFR 402.7. 

Common to all such instances where 

informal notice will be given is the 

intention to give the RRE an opportunity 

to clarify, mitigate, or explain any errors 

that were the result of a technical issue 

or due to an error or system issue 

caused by CMS or its contractors. It 

would be impractical and counter to the 

spirit of the informal notice process to 

regulate or enumerate all circumstances 

in which mitigating information could 

be provided or what that information 

should convey. As such, any mitigating 

factors or circumstances are welcomed, 

and a dialogue is encouraged in an 

attempt to find solutions that are short 

of imposing a CMP. We believe it is in 

the best interests of all RREs to leave the 

informal notice process open to any 

reasonable submission of mitigating 

factors so that we are free to entertain 

all such documentation without strict 

limits on what is, or is not, acceptable. 

Once we determine that a CMP will 

be imposed (after the informal notice 

period) we will provide formal notice to 

the entity in writing in accordance with 

42 CFR 402.7, which will contain 

information on the event that has 

triggered the proposed imposition of a 

CMP, the amount of the proposed CMP, 

and next steps for the entity, including 

a right to a hearing in accordance with 

42 CFR 402.19 and part 1005. 

Comment: Commenters suggested that 

CMS should not impose CMPs in 

situations where required information 

has already been reported to another 

agency or entity, such as the Department 

of Labor, or in situations where multiple 

entities have obligations to report the 

same information to CMS and one entity 

has already reported. 

Response: Sections 1862(b)(7) and 

(b)(8) of the Act imposed certain unique 

requirements on specific entities to 

report data to CMS for the purposes of 

identifying those situations where 

another party has primary payment 

responsibility. These reporting 

requirements were imposed under the 

Act, regardless of whether another 

agency or entity requires the same or 

similar data (and such data must also be 

reported to CMS in the manner and 

form specified by the Secretary). The 

current Office of Management and 

Budget (OMB) control number assigned 

to this information collection effort, as 

required under the Paperwork 

Reduction Act, is 0938–1074. 

Commenters provided examples of 

data submitted to other agencies that 

they believe are similar, but the data are 

not used for a comparable purpose to 

the data that is reported to CMS. 

Consequently, this data is neither in the 

same format that CMS systems require, 

nor is it the complete set of data that 

CMS needs for the proper coordination 

of benefits. Therefore, any attempt to 

create a data-sharing agreement that 

would render reporting to CMS truly 

duplicative would require that other 

agencies update their data collection 

efforts to align with CMS, despite the 

fact that those agencies may have no 

need for that data. Not only would that 

impose additional costs to the federal 

government to accommodate a relatively 

small number of entities, it would also 

undermine efforts under this rule to 

verify the accuracy or timeliness of the 

reporting. Therefore, it is impractical to 

attempt to promulgate such data sharing 

agreements and all RREs must continue 

to perform reporting as required by the 

Act. 

Comment: Commenters suggested that 

CMS not impose CMPs when CMS has 

been able to coordinate benefits 

correctly or CMS has otherwise been 

able to recover any conditional 

payments made due to untimely or 

inaccurate reporting. 

Response: The obligations to report 

under sections 1862(b)(7) and (b)(8) of 

the Act are separate and distinct from 

any other obligation with respect to 

MSP, including reimbursement. 

Providing accurate information in 

response to recovery efforts does not 

satisfy those obligations and the fact 

that we may be able to eventually 

correctly coordinate benefits and retain 

the right to pursue recovery does not 

negate the reporting obligations 

established under sections 1862(b)(7) 

and (b)(8) of the Act. 

Comment: Most commenters 

requested a statute of limitations on the 

imposition of CMPs. 

Response: We agree and will apply 

the 5-year statute of limitations as 

required by 28 U.S.C. 2462. Under 28 

U.S.C. 2462, we may only impose a 

CMP within 5 years from the date when 

the noncompliance occurred. 


lotter on DSK11XQN23PROD with RULES1
70368 Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 

Comment: Many commenters 

suggested that the statute of limitations 

should be 3 years. 

Response: Under 28 U.S.C. 2462, the 

applicable statute of limitations is 5 

years. Although section 

1862(b)(2)(B)(iii) of the Act establishes a 

3-year statute of limitations for certain 

actions, that provision applies only to 

legal actions CMS may utilize for the 

recovery of MSP debts. While recovery 

of conditional payments (overpayments) 

and the imposition of CMPs may 

appear, on their face, to be similar 

actions, they are unique and serve 

separate, distinct purposes and the 

statute of limitations applicable to the 

former does not also apply to the latter. 

An explanation and example of how 

this 5-year statute of limitations will 

apply is as follows: For failure to 

initially report the date of settlement or 

effective date of coverage timely (where 

applicable), noncompliance occurs on 

every day of non-reporting after the 

required timeframe for reporting has 

elapsed. For example, if the date of 

settlement is January 1, 2025, then the 

RRE will have 1 year from that date to 

report the coverage before being 

potentially subject to a CMP (that is, 

January 1, 2026). If the settlement date 

was January 1, 2025, but the RRE did 

not report it to CMS until October 15, 

2026, the RRE will be considered 

noncompliant for the period of January 

2, 2026, through October 15, 2026. If 

CMS does not act until after October 15, 

2031, then the statute of limitations has 

elapsed and no CMP may be imposed. 

Comment: Many commenters 

suggested that the rule should be 

enforced prospectively only. 

Response: We concur and will 

evaluate compliance based only upon 

files submitted by the RRE on or after 

the effective date of the final rule. CMPs 

will only be imposed on instances of 

noncompliance based on those 

settlement dates, coverage effective 

dates, or other operative dates that occur 

after the effective date of this regulation 

and as such, there will be no instances 

of inadvertent or de facto retroactivity of 

CMPs. The 1-year period to report the 

required information before CMPs 

would potentially be imposed would 

begin on the latter of the rule effective 

date or the settlement or coverage 

effective dates which an RRE is required 

to report in accordance with sections 

1862(b)(7) and (b)(8) of the Act. 

Comment: Commenters suggested that 

CMS refrain from imposing CMPs where 

NGHPs with reporting obligations under 

section 1862(b)(8) of the Act make 

‘‘good faith efforts’’ to obtain required 

information from individuals who are 

unwilling or unable to provide it. Some 

‘‘good faith efforts’’ suggested included 

the following: (1) CMS could accept 

documentation signed by the individual 

stating that he or she is either not a 

Medicare beneficiary, or will not 

provide the NGHP entity with his or her 

Social Security Number (SSN) (full SSN 

or last 5 digits); and (2) CMS could 

accept a judicial order establishing that 

the individual is not required to provide 

his or her Medicare Beneficiary 

Identifier (MBI) or SSN to the NGHP 

entity. 

Response: We note that concerns 

about ‘‘good faith efforts’’ were received 

from the NGHP industry and not the 

GHP industry during both rounds of 

comments, which we believe is 

reflective of the fundamental differences 

between the two industries and the 

relationships between those plans and 

the individuals in question. Our 

understanding is that NGHP applicable 

plans may at times be in an adversarial 

relationship with the reportable 

individual, whereas the reportable 

individual is typically the client of a 

GHP. To this end we understand the 

concern regarding privacy law or 

consumer protection statute violations, 

as were mentioned by some 

commenters. 

In response to these comments, we 

stress that CMPs will not be imposed 

against NGHP entities where those 

entities have made good faith efforts, as 

outlined in this final rule, to obtain 

necessary reporting information. NGHP 

entities must document their efforts to 

obtain this reporting information and 

retain this documentation, as we retain 

the right to audit such documentation. 

In response to comments, we are 

finalizing a revised version of our 

proposal regarding how NGHPs may 

avoid being subject to CMPs where they 

have made sufficient efforts to obtain 

the necessary information. The revisions 

we are finalizing address commenter 

concerns regarding the type and number 

of communication attempts an RRE 

must perform, as well as documentation 

of express refusal by an individual or 

their attorney or representative to 

provide the requested information as a 

way to satisfy the obligation to attempt 

to collect that information. 

Comment: Many commenters 

continued to suggest that CMS should 

specify a series of ‘‘safe harbors’’ that 

would preclude the assessment of a 

CMP. 

Response: In this section, we outline 

two such safe harbors but acknowledge 

that other situations may exist where it 

is inappropriate to penalize an entity for 

noncompliance. We welcome RREs to 

use the informal or formal appeal 

process if there are other situations that 

the RRE believes makes it inappropriate 

to receive a CMP. 

First, any untimely reporting that is 

the result of a technical or system issue 

outside of the control of the RRE, or that 

is the result of an error caused by CMS 

or one of its contractors would not be 

considered noncompliance for purposes 

of this rule. See a more thorough 

explanation in ‘‘Amount of CMPs’’. 

Second, any untimely reporting by an 

NGHP that is the result of a failure to 

acquire all necessary reporting 

information due to a lack of cooperation 

by the beneficiary will not lead to a 

CMP provided that certain standards are 

met. This situation is addressed in 

greater detail in section III.D. of this 

final rule and § 402.1(c)(22)(ii)(A) as 

finalized. 

Comment: Commenters suggested that 

CMS consider suspending the 

imposition of CMPs where changes to 

mandatory reporting procedures require 

RREs to make significant revisions to 

the systems used to prepare the data for 

reporting. 

Response: We will continue to 

provide a minimum of 6 months’ (180 

calendar days) notice prior to any 

changes in procedure, including 

systems alterations or changes to the 

required data elements, associated with 

section 111 of MMSEA required 

reporting to allow reporting entities 

adequate time to react. We will not 

assess any CMPs associated with a 

specific change for a minimum of 2 

reporting periods following the 

implementation (effective date) of that 

policy or procedural change. As 

provided in § 402.1(c)(21)(ii)(A) and 

(c)(22)(ii)(C) as finalized, in the event 

we are unable to provide a minimum of 

6 months’ notice prior to implementing 

any reporting process changes (such as 

the addition of a new required data 

element), we will not impose any CMPs 

associated with that specific reporting 

process change for a minimum of 1 year 

after that change becomes effective. 

CMPs associated with any unchanged 

aspects of reporting may still be 

imposed during this time. 

2. Overall Response to Comments 

We solicited comments on our 

proposed approaches to imposing and 

not imposing CMPs, including our 

proposed methods of calculating CMP 

amounts. Our proposed approach to 

imposing CMPs was developed with the 

intention of giving entities meaningful 

opportunities to resolve most reporting 

issues, without the immediate risk that 

a CMP would be imposed. After 

consideration of the public comments 

we received, we have made a number of 

important revisions in this final rule. 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 70369 

As described in the proposed rule and 

earlier in this final rule, the amount of 

CMPs for GHPs is established in section 

1862(b)(7)(B) of the Act, and, except for 

those situations and criteria described 

in this final rule, CMS does not have the 

authority to adjust the amount of the 

CMP levied on a GHP entity. In the case 

of NGHPs, where CMS is permitted 

discretion in the amount of the CMP, we 

are finalizing a tiered approach based 

upon the length of time for which a 

submission was untimely to better align 

the penalty to the severity of the 

noncompliance. In the case of GHPs, the 

statutory language at section 

1862(b)(7)(B) of the Act does not allow 

this level of discretion, and CMS is 

therefore unable to adjust the amount of 

GHP-related CMPs. 

The submission of information or 

documentation that serves to mitigate 

the noncompliance, or explain a 

technical error, will be considered on a 

case-by-case basis in an effort to prevent 

the imposition of a CMP at all. 

Based on the comments we received, 

we have determined that we will only 

impose penalties where the initial 

report was not received in a timely 

manner. Penalties will not be imposed 

on any other basis, such as in relation 

to the quality of reporting. Timeliness is 

determined by comparing the date a 

record is submitted and accepted 

against the date CMS should have 

received the record. The date CMS 

should receive a record is determined 

by the effective date of coverage or the 

date of settlement (or settlement funding 

date if the funding of the settlement is 

delayed) plus 1 year (365 days). For 

every day a record is submitted that is 

past the date that CMS should have 

received the information, a penalty of 

up to $1,000 per day for NGHP RREs or 

$1,000 per day, in the case of GHP 

RREs, will be imposed. 

No CMP will be imposed until at least 

1 year (365 days) after the later of: (1) 

the applicability date of this final rule; 

or (2) the coverage effective date, or 

settlement date, an RRE is required to 

report. This is a minor change from the 

proposed rule which seeks to clarify 

that RREs will have at least 1 year from 

the rule applicability date before any 

CMP is contemplated. The date that 

information was submitted by the RRE 

will determine timeliness. Any delay 

that is the result of technical or 

administrative issues on the part of CMS 

or its contractors will not be held 

against the RRE for purposes of 

calculating whether reporting was 

timely. 

In the proposed rule, we proposed 

that we would not impose a CMP in the 

following situations, where all of the 

applicable conditions are met: 

• If an RRE reports any GHP 

beneficiary record that is reported on a 

quarterly submission timeframe within 

the required timeframe (not to exceed 1 

year after the GHP effective date), or any 

NGHP beneficiary record that is 

submitted within the required 

timeframe (not to exceed 1 year after the 

settlement date or ORM effective date). 

• If an RRE complies with any 

settlement reporting thresholds or any 

other reporting exclusions published in 

CMS’s MMSEA Section 111 User Guides 

or otherwise established by CMS. Note 

that these thresholds are not defined in 

the regulatory text as they include 

operational thresholds that are currently 

subject to change on an annual basis per 

section 1862(b)(9)(B) of the Act as well 

as other operational thresholds for 

reporting that CMS elects to impose, 

such as the current $5,000 threshold for 

Health Reimbursement Arrangements, 

which are communicated to RREs 

through the MMSEA Section 111 User 

Guides. Our ability to implement such 

thresholds and operational exclusions, 

whether as statutorily mandated or to be 

responsive to stakeholder or litigation 

needs, is not altered by this regulation. 

• If an NGHP entity fails to report 

timely because the NGHP entity was 

unable to obtain information necessary 

for reporting from the reportable 

individual, including an individual’s 

last name, first name, date of birth, 

gender, MBI, or SSN (or the last 5 digits 

of the SSN), and the responsible 

applicable plan has made and 

maintained records of its good faith 

effort to obtain this information by 

taking all of the following steps: 

++ The NGHP has communicated the 

need for this information to the 

individual and his or her attorney or 

other representative (if applicable) and 

requested the information from the 

individual and his or her attorney or 

other representative at least twice by 

mail and at least once by phone or other 

means of contact such as electronic mail 

in the absence of a response to the 

mailings. 

++ The NGHP certifies that it has not 

received a response, or has received a 

response in writing that the individual 

will not provide his or her MBI or SSN 

(or last 5 digits of his or her SSN). 

++ The NGHP has documented its 

efforts to obtain the missing 

information, such as the MBI or SSN (or 

the last 5 digits of the SSN) and the 

reason for the failure to collect this 

information. 

The NGHP entity should maintain 

records of these good faith efforts (such 

as dates and types of communications 

with the individual) in order to be 

produced as mitigating evidence should 

CMS contemplate the imposition of a 

CMP. Such records must be maintained 

for a period of 5 years. The current OMB 

control number assigned to this 

information collection effort, as required 

under the Paperwork Reduction Act, is 

0938–1074. 

III. Provisions of the Final Regulations 

The final rule incorporates some of 

the provisions of the proposed rule and 

also revises some of the provisions as 

proposed. Additionally, the final rule 

clarifies how the identification of 

noncompliance will occur, which was 

not discussed in the proposed rule. 

Those provisions of this final rule that 

differ from the proposed rule are as 

follows: 

A. Removal of Any Basis Other Than 

Timeliness as a Reason for Imposing a 

CMP 

The only basis for the imposition of 

a CMP will be untimely reporting of 

required information. The final rule 

removes all references in the proposed 

rule to ‘‘contradictory reporting’’ or 

‘‘exceeding error tolerance’’ as a reason 

to impose a CMP. Specifically, any 

references to an applicable plan 

providing contradictory reporting, and 

any CMPs imposed as a result, that were 

proposed in 42 CFR 402.1(c)(21) and 

(c)(22), 402.105(b)(2) and (b)(3), or 

elsewhere, are removed and are not 

being finalized. As such, the following 

sections of the proposed regulations text 

have been removed and are not being 

finalized: 

• Sections 402.1(c)(21)(ii) and (iii). 

• Sections 402.1 (c)(22)(ii) and (iii). 

• Sections 402.105(b)(2)(ii) and (iii). 

• Sections 402.105(b)(3)(ii) and (iii). 

B. Audit Methodology for Analyzing 

Records 

To identify potential instances of 

noncompliance, rather than imposing 

CMPs based upon automated 

monitoring of all RRE submissions as 

contemplated in the proposed rule, we 

will utilize the following process to 

audit a randomized sample of recently 

added beneficiary records: 

• CMS has determined that, given the 

time and resources necessary to 

accurately and thoroughly evaluate the 

accuracy of any submitted record, it 

would be possible to audit a total of 

1,000 records per calendar year across 

all RRE submissions, divided evenly 

among each calendar quarter (250 

individual beneficiary records per 

quarter). 

• CMS will evaluate a proportionate 

number of GHP and NGHP records 


lotter on DSK11XQN23PROD with RULES1
70370 Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 

based on the pro-rata count of recently 

added records for both types of coverage 

over the calendar quarter under 

evaluation. For example, if over the 

calendar quarter being evaluated, CMS 

received 600,000 GHP records and 

400,000 NGHP records for a total of 

1,000,000 recently added beneficiary 

records, then 60 percent of the 250 

records audited for that quarter would 

be GHP records, and 40 percent would 

be NGHP records. 

• At the end of each calendar quarter, 

CMS will randomly select the indicated 

number of records and analyze each 

selected record to determine if it is in 

compliance with the reporting 

requirements as required by statute and 

defined herein. 

• Noncompliance is defined as any 

time CMS identifies a new beneficiary 

record that was not reported to CMS 

timely. Timeliness is defined as 

reporting to CMS within 1 year of the 

date GHP coverage became effective, the 

date a settlement, judgment, award, or 

other payment determination was made 

(or the funding of a settlement, 

judgment, award, or other payment, if 

delayed), or the date when an entity’s 

Ongoing Responsibility for Medicals 

(ORM) became effective. Failure to 

report timely prevents CMS from 

promptly and accurately determining 

the proper primary payer and taking the 

appropriate actions. 

• For GHP entities, for any selected 

record that is more than 1 year (365 

calendar days) late, a penalty of $1,000 

per day (as adjusted) of noncompliance 

will be imposed as indicated herein. 

• For NGHP entities, for any selected 

record determined to be noncompliant, 

a tiered approach to penalties will be 

implemented as described in detail in 

section III.C. of this final rule. 

• To calculate the penalty imposed 

against an RRE, CMS will multiply the 

number of audited records found to be 

noncompliant by the number of days 

that each record was late (in excess of 

365 days). The product will then be 

multiplied by the appropriate penalty 

amount, as described previously and 

below. 

C. Tiered Approach for NGHP RREs 

Because we have the statutory 

authority to adjust the amounts of 

penalties imposed on NGHP RREs, a 

tiered approach and cap on the total 

amount of penalties applicable to such 

RREs are being finalized in this rule. As 

explained previously, the statute does 

not permit us to extend this approach to 

GHP RREs. For any record selected via 

the random audit process described 

above where the NGHP RRE submitted 

the information more than 1 year after 

the date of settlement, judgment, award, 

or other payment (including the 

effective date of the assumption of 

ongoing payment responsibility for 

medical care); the daily penalty will 

be— 

• $250, as adjusted annually under 45 

CFR part 102, for each calendar day of 

noncompliance, where the record was 

reported 1 year or more, but less than 

2 years after, the required reporting 

date; 

• $500, as adjusted annually under 45 

CFR part 102, for each calendar day of 

noncompliance, where the record was 

reported 2 years or more, but less than 

3 years after, the required reporting 

date; or 

• $1,000, as adjusted annually under 

45 CFR part 102, for each calendar day 

of noncompliance, where the record was 

reported 3 years or more after the 

required reporting date. 

Additionally, the total penalty for any 

one instance of noncompliance by an 

NGHP RRE for a given record identified 

by CMS will be no greater than $365,000 

(as adjusted annually under 45 CFR part 

102). 

While we emphasize that all RREs are 

obligated to comply with their reporting 

obligations, CMS’s approach to 

enforcement, where a randomized 

sample of records will be reviewed 

closely (as opposed to an automated 

review of all records), means that 

smaller entities are inherently much less 

likely to have their records audited for 

compliance. We also encourage entities 

that are smaller and less experienced 

with Medicare’s coordination of benefits 

processes to take advantage of the 

resources and support available to 

ensure compliance. 

D. Clarification of Good Faith Efforts To 

Obtain Identifying Information 

A key change for the final rule is the 

expansion of the circumstances under 

which an NGHP entity may avoid CMPs 

for noncompliance caused by failure to 

obtain identifying information from an 

individual despite a good faith effort to 

do so. 

In the proposed rule, we proposed 

providing NGHPs with the ability to 

document ‘‘good faith’’ efforts to obtain 

identifying information of reportable 

individuals. In the final rule, we are 

expanding this exemption. Specifically, 

as proposed in the proposed rule, 

NGHPs must make a total of three 

attempts to obtain the required 

information. At least two attempts to 

obtain the required information from the 

individual and his or her attorney must 

be by mail or electronic mail, but the 

final rule permits that the third attempt 

may be via telephone, electronic mail, 

or some other reasonable method. 

Further, the final rule permits that, 

should an individual or their attorney or 

representative clearly and 

unambiguously decline to provide the 

information requested, no further 

attempts by the RRE to obtain the 

required information would be required. 

This documented refusal to provide the 

required information must be 

maintained for a minimum of 5 years, in 

accordance with the other requirements 

of this section of the rule. 

We understand that NGHP RREs are 

concerned that attempts to obtain 

beneficiary information, particularly 

when in an adversarial relationship 

with the beneficiary, may be construed 

as running afoul of certain state and 

local privacy and anti-harassment laws. 

If the intent and purpose of the RRE’s 

communications with beneficiaries was 

solely to comply with federal 

requirements, we believe any privacy or 

anti-harassment law would be 

preempted by the reporting 

requirements set forth in the Act. 

All other parameters related to 

obtaining identifying information, 

including records retention 

requirements, are being finalized as 

proposed. 

IV. Collection of Information 

Requirements 

This document does not impose any 

new information collection 

requirements, that is, reporting, 

recordkeeping, or third-party disclosure 

requirements. The associated 

information collection requirements 

imposed under mandatory insurer 

reporting are already approved under 

OMB control number 0938–1074. 

Consequently, there is no need for 

review by the Office of Management and 

Budget under the authority of the 

Paperwork Reduction Act of 1995 (44 

U.S.C. 3501 et seq.). We did not receive 

comments on the previous statement 

and therefore are finalizing the language 

without modification. 

V. Regulatory Impact Statement 

We have examined the impact of this 

rule as required by Executive Order 

12866 on Regulatory Planning and 

Review (September 30, 1993) and 

Executive Order 13563 on Improving 

Regulation and Regulatory Review 

(January 18, 2011) as amended by the 

Executive Order on Modernizing 

Regulatory Review on April 6, 2023), 

the Regulatory Flexibility Act (RFA) 

(September 19, 1980, Pub. L. 96–354), 

section 1102(b) of the Act, section 202 

of the Unfunded Mandates Reform Act 

of 1995 (March 22, 1995; Pub. L. 104– 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 70371 

4), Executive Order 13132 on 

Federalism (August 4, 1999), and the 

Congressional Review Act (CRA) (5 

U.S.C. 804(2)). 

Executive Orders 12866 and 13563, as 

amended by the Executive Order on 

Modernizing Regulatory Review on 

April 6, 2023, direct agencies to assess 

all costs and benefits of available 

regulatory alternatives and, if regulation 

is necessary, to select regulatory 

approaches that maximize net benefits 

(including potential economic, 

environmental, public health and safety 

effects, distributive impacts, and 

equity). A Regulatory Impact Analysis 

(RIA) must be prepared for major rules 

with economically significant effects 

($200 million or more in any 1 year). 

Modelling of potential penalties likely 

to be imposed under this rule 

demonstrates that this rule does not 

reach the economic threshold and thus 

is not considered a major rule. 

Based on CMS workload and resource 

availability, the sampling methodology 

explained herein would result in a fixed 

number of submitted records to be 

audited each calendar quarter to 

determine compliance and potential 

penalty. At present, and absent a noticeand-comment period to alter such limit, 

CMS will audit up to 1,000 records each 

year, or up to 250 each calendar quarter. 

CMS has utilized the methodology as 

described in previous sections, in 

conjunction with utilizing data from the 

preceding calendar year regarding RRE 

reporting habits and volume, to 

determine the anticipated penalties that 

would be levied if no other changes in 

behavior were observed. Although we 

note that CMS believes that publication 

of the rule will have the intended effect 

of incentivizing increased compliance 

with reporting requirements in an effort 

to avoid a CMP, we have analyzed the 

existing data with no adjustments for 

subjective analysis. Assuming the rule 

had been in effect and CMPs could have 

been imposed based upon reporting 

behavior for calendar year 2022, the 

maximum penalties imposed would 

have been $86.4 million for GHP entities 

and $42.4 million for NGHP entities, for 

a total annual CMP amount of $128.8 

million, which is below the $200 

million threshold to be considered an 

economically significant rule. We also 

note that reporting behavior in this 

period may be skewed towards more 

untimely reporting, potentially 

reflecting efforts to come into 

compliance in advance of this rule 

becoming effective. Consequently, we 

believe this is a worst-case scenario and 

do not expect to collect CMPs totaling 

$200 million or more in any given year, 

nor do we expect this rule to have any 

other economic effects that meet or 

exceed that threshold. 

The RFA requires agencies to analyze 

options for regulatory relief of small 

entities. For purposes of the RFA, small 

entities include small businesses, 

nonprofit organizations, and small 

governmental jurisdictions. Most 

hospitals and most other providers and 

suppliers are small entities, either by 

nonprofit status or by having revenues 

of $7.0 million to $35.5 million in any 

1 year. Individuals and States are not 

included in the definition of a small 

entity. We consider a rule to have a 

significant impact on a substantial 

number of small entities if it has at least 

a 3 percent impact of revenue on at least 

5 percent of small entities. Affected 

entities with reporting responsibilities 

have been required to comply with 

sections 1862(b)(7) and (b)(8) of the Act 

since these provisions were added to the 

Act in 2007. This rule is intended to 

define how CMPs would be imposed as 

a consequence of noncompliance with 

these statutory obligations, and thus 

does not present any additional burden 

beyond the review of the rule. As 

discussed later in this section, the total 

cost impact of reviewing this rule by all 

20,855 actively reporting RREs, 

regardless of size, is estimated to be 

$7,699,249, or $369.18 per entity. As the 

provisions and regulations, the violation 

of which will result in a CMP under this 

regulation, are already in place, no 

additional costs to comply with this 

regulation should be realized by any 

RRE. This regulation merely enumerates 

when and how CMPs will be levied but 

does not impose any additional rules or 

requirements on any RRE that does not 

already, at present, exist. This falls 

below the standard definition of 

‘‘significance’’ of 3 or more of small 

entity revenue. As a result, we have 

determined, and the Secretary certifies, 

that this rule would not have a 

significant economic impact on a 

substantial number of small entities. 

In addition, section 1102(b) of the Act 

requires us to prepare an RIA if a rule 

may have a significant impact on the 

operations of a substantial number of 

small rural hospitals. This analysis must 

conform to the provisions of section 604 

for the RFA. For purposes of section 

1102(b) of the Act, we define a small 

rural hospital as a hospital that is 

located outside of a Metropolitan 

Statistical Area for Medicare payment 

regulations and has fewer than 100 

beds. We are not preparing an analysis 

for section 1102(b) of the Act because 

we have determined, and the Secretary 

certifies, that this rule would not have 

a significant impact on the operations of 

a substantial number of small rural 

hospitals. 

Section 202 of the Unfunded 

Mandates Reform Act of 1995 also 

requires that agencies assess anticipated 

costs and benefits before issuing any 

rule whose mandates require spending 

in any 1 year of $100 million in 1995 

dollars, updated annually for inflation. 

In 2023, the threshold is approximately 

$177 million. This rule will have no 

consequential effect on state, local, or 

tribal governments or on the private 

sector. Executive Order 13132 

establishes certain requirements that an 

agency must meet when it promulgates 

a proposed rule (and subsequent final 

rule) that imposes substantial direct 

requirement costs on state and local 

governments, preempts state law, or 

otherwise has Federalism implications. 

Since this final rule does not impose 

any costs on state or local governments, 

the requirements of Executive Order 

13132 are not applicable. 

We used the current number of 

actively reporting GHP RREs (1,039) and 

NGHP RREs (19,816) to determine the 

total number of impacted entities 

(20,855). We recognize that this is a 

slight overestimate, as a single corporate 

parent may have multiple associated 

RREs. We welcome any comments on 

the approach in estimating the number 

of entities which will review this rule. 

Using the May 2022 wage information 

from the U.S. Department of Labor 

Bureau of Labor Statistics for medical 

and health service managers (Code 11– 

9111), we estimate that the cost of 

reviewing this rule is $123.06 per hour, 

based on doubling the mean hourly 

wage of $61.53 to include overhead and 

fringe benefits (see https://www.bls.gov/ 

oes/current/oes119111.htm). We assume 

that one individual associated with each 

of the 20,855 impacted entities will read 

the rule. Assuming an average reading 

speed, we estimate that it would take 

approximately 3 hours for the staff to 

review this rule. For each entity that 

reviews the rule, the estimated cost is 

$369.18 (3 hours × $123.06). Therefore, 

we estimate that the total cost of 

reviewing this rule is $7,699,249 

($369.18 × 20,855). 

We did not receive additional 

comments on the regulatory impact 

statement section through the public 

comment period. 

In accordance with the provisions of 

Executive Order 12866, this rule was 

reviewed by the Office of Management 

and Budget. 

Chiquita Brooks-LaSure, 

Administrator of the Centers for 

Medicare & Medicaid Services, 

approved this document on September 

28, 2023. 


lotter on DSK11XQN23PROD with RULES1
70372 Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 

List of Subjects 

42 CFR Part 402 

Assessments, Civil money penalties, 

Exclusions. 

45 CFR Part 102 

Administrative practice and 

procedure, Penalties. 

For the reasons set forth in the 

preamble, the Centers for Medicare & 

Medicaid Services proposes to amend 

42 CFR chapter IV as set forth below: 

PART 402—CIVIL MONEY PENALTIES, 

ASSESSMENTS, AND EXCLUSIONS 

■ 1. The authority citation for part 402 

is revised to read as follows: 

Authority: 42 U.S.C. 1302 and 1395hh. 

■ 2. Section 402.1 is amended— 

■ a. In paragraph (c) introductory text by 

removing the reference ‘‘(c)(34) of this 

section’’ and adding in its place the 

reference ‘‘(c)(35) of this section’’; 

■ b. By removing paragraph (c)(20); 

■ c. By redesignating paragraph (c)(21) 

as paragraph (c)(20); 

■ d. By redesignating paragraphs (c)(22) 

through (34) as paragraphs (c)(23) 

through (35); and 

■ e. Adding new paragraphs (c)(21) and 

(22). 

The additions read as follows: 

§ 402.1 Basis and scope. 

* * * * * 

(c) * * * 

(21) Section 1862(b)(7)(B)—Except for 

the situation described in paragraphs 

(c)(21)(ii)(A) and (B) of this section, any 

entity that has a reporting obligation 

under section 1862(b)(7) of the Act 

(‘‘reporting entity’’) that— 

(i) Fails to report any beneficiary 

record within 1 year of the last 

acceptable reporting date, defined as 

365 days from the GHP coverage 

effective date or the Medicare 

beneficiary’s entitlement date, 

whichever is later. 

(ii) A civil money penalty (CMP) is 

not imposed if— 

(A) The incident of noncompliance is 

associated with a specific reporting 

policy or procedural change on the part 

of CMS that has been effective for less 

than 6 months following the 

implementation of that policy or 

procedural change (or for 1 year, should 

CMS be unable to provide a minimum 

of 6 months’ notice prior to 

implementing such changes). 

(B) The entity complies with any 

reporting thresholds or any other 

reporting exclusions. 

(22) Section 1862(b)(8)(E)—Except for 

the situations described in paragraph 

(c)(22)(ii)(A), (B) and (C) of this section, 

any applicable plan that has a reporting 

obligation under section 1862(b)(8) of 

the Act (‘‘applicable plan’’), that— 

(i) Fails to report any beneficiary 

record within 1 year from the date of the 

settlement, judgment, award, or other 

payment, or the effective date where 

ongoing payment responsibility for 

medical care has been assumed by the 

entity. 

(ii) A CMP is not imposed in the 

following situations: 

(A) An NGHP applicable plan fails to 

report required information as a result 

of the applicable plan’s inability to 

obtain an individual’s last name, first 

name, date of birth, gender, Medicare 

Beneficiary Identifier (MBI), Social 

Security Number (SSN), or the last 5 

digits of the SSN, and the applicable 

plan has made a good faith effort to 

obtain this information by meeting the 

following: 

(1) Has communicated the need for 

this information to the individual and 

his or her attorney, or other 

representative, if applicable, or both. 

(2) Has requested the information 

from the individual and his or her 

attorney, or other representative (if 

applicable), at least three times— 

(i) Once in writing (including 

electronic mail); 

(ii) Then at least once more by mail; 

and 

(iii) At least once more by phone or 

other means of contact in the absence of 

a response to the mailings. 

(3) Has not received a response or has 

received a written response clearly 

indicating that the individual refuses to 

provide the needed information. Should 

the applicable plan receive a written 

response from the individual or their 

attorney or representative that clearly 

and unambiguously declines or refuses 

to provide any portion of the 

information specified herein, no 

additional communications with the 

individual or their attorney or other 

representative are required. 

(4) Has documented its efforts to 

obtain the MBI or SSN (or the last 5 

digits of the SSN). This documentation, 

including any written rejection 

correspondence, must be retained for a 

minimum of 5 years. 

(B) An NGHP applicable plan 

complies with any reporting thresholds 

or any other reporting exclusions. 

(C) The incident of noncompliance is 

associated with a specific reporting 

policy or procedural change on the part 

of CMS that has been effective for less 

than 6 months following the 

implementation of that policy or 

procedural change (or for 12 months, 

should CMS be unable to provide a 

minimum of 6 months’ notice prior to 

implementing such changes). 

* * * * * 

■ 3. Section 402.105 is amended by 

revising paragraph (b)(2) and adding 

paragraph (b)(3) to read as follows: 

§ 402.105 Amount of penalty. 

* * * * * 

(b) * * * * 

(2) For entities with reporting 

obligations under section 1862(b)(7) of 

the Act (‘‘reporting entity’’), if a 

reporting entity fails to report any 

beneficiary record within the specified 

period from the latter of the GHP 

coverage effective date or the Medicare 

beneficiary’s entitlement date. The 

penalty is— 

(i) Calculated on a daily basis, based 

on the number of recently added 

beneficiary records reviewed where 

CMS identifies that the entity submitted 

the required information more than 1 

year after the GHP coverage effective 

date for the individual; and 

(ii) $1,000 as adjusted annually under 

45 CFR part 102 for each calendar day 

starting the day after 1 year (365 days) 

from the first instance of 

noncompliance, as defined in paragraph 

(b)(2)(i) of this section. 

(3) For entities with reporting 

obligations under section 1862(b)(8) of 

the Act (‘‘applicable plan’’) as follows: 

(i) If an applicable plan fails to report 

any NGHP beneficiary record within the 

specified period from the date of the 

settlement, judgment, award, or other 

payment (including the effective date of 

the assumption of ongoing payment 

responsibility for medical care). The 

penalty is— 

(A) Calculated on a daily basis, based 

on the number of recently added 

beneficiary records reviewed where 

CMS identifies that the entity submitted 

the required information more than 1 

year after the date of settlement, 

judgment, award, or other payment 

(including the effective date of the 

assumption of ongoing payment 

responsibility for medical care); 

(B) $250 (as adjusted annually under 

45 CFR part 102) for each calendar day 

of noncompliance as defined in 

paragraph (b)(3)(i)(A) of this section for 

each individual for which the required 

information should have been 

submitted, but was reported more than 

1 year but less than 2 years after the 

required reporting date; 

(C) $500 (as adjusted annually under 

45 CFR part 102) for each calendar day 

of noncompliance as defined in 

paragraph (b)(3)(i)(A) of this section for 

each individual for which the required 

information should have been 


lotter on DSK11XQN23PROD with RULES1
Federal Register / Vol. 88, No. 195 / Wednesday, October 11, 2023 / Rules and Regulations 70373 

submitted, but was reported 2 years or 

more, but less than 3 years, after the 

required reporting date; and 

(D) $1,000 (as adjusted annually 

under 45 CFR part 102), for each 

calendar day of noncompliance as 

defined in paragraph (b)(3)(i)(A) of this 

section for each individual for which 

the required information should have 

been submitted, but was reported 3 

years or more after the required 

reporting date. 

(ii) The maximum penalty that may be 

imposed for noncompliance associated 

with any one individual for which the 

required information should have been 

submitted is $365,000 (as adjusted 

annually under 45 CFR part 102). 

* * * * * 

For the reasons specified in the 

preamble, the Department of Health and 

Human Services amends 45 CFR part 

102 as specified below: 

PART 102—ADJUSTMENT OF CIVIL 

MONETARY PENALTIES FOR 

INFLATION 

■ 4. The authority for part 102 

continues to read as follows: 

Authority: Pub. L. 101–410, Sec. 701 of 

Pub. L. 114–74, 31 U.S.C. 3801–3812. 

■ 5. Section 102.3 is amended in table 

1 by adding references for U.S.C. 

1395y(b)(6)(B), 1395y(b)(7)(B)(i), and 

1395y(b)(8)(E)(i) in numerical order to 

read as follows: 

§ 102.3 Penalty adjustment and table. 

* * * * * 

TABLE 1 TO § 102.3—CIVIL MONETARY PENALTY AUTHORITIES ADMINISTERED BY HHS AGENCIES AND PENALTY

AMOUNTS

U.S.C. sections CFR 1 HHS 

agency Description 2

Date of last 

statutorily 

established 

penalty 

figure 3

2021 

maximum 

adjusted 

penalty 

($) 

2022 

maximum 

adjusted 

penalty 4

($) 

*******

42 U.S.C.: 

*******

1395y(b)(6)(B) ............... 42 CFR 402.1(c)(20), 

402.105(a).

CMS Penalty for any entity that knowingly, willfully, 

and repeatedly fails to complete a claim form 

relating to the availability of other health benefits in accordance with statute or provides inaccurate information relating to such on the 

claim form.

2021 3,484 3,701 

1395y(b)(7)(B)(i) ............ 42 CFR 402.1(c)(21), 

402.105(a).

CMS Penalty for any entity serving as insurer, third 

party administrator, or fiduciary for a group 

health plan that fails to provide information 

that identifies situations where the group 

health plan is or was a primary plan to Medicare to the HHS Secretary.

2021 1,247 1,325 

*******

1395y(b)(8)(E)(i) ............ 42 CFR 402.1(c)(22), 

402.105(a)(E).

CMS Penalty for any entity serving as insurer, third 

party administrator, or fiduciary for a nongroup health plan that fails to provide information that identifies situations where the group 

health plan is or was a primary plan to Medicare to the HHS Secretary.

2021 1,247 1,325 

*******

1Some HHS components have not promulgated regulations regarding their civil monetary penalty-specific statutory authorities. 

2The description is not intended to be a comprehensive explanation of the underlying violation; the statute and corresponding regulation, if applicable, should be 

consulted. 3Statutory or Inflation Act Adjustment. 

4The cost of living multiplier for 2018, based on the CPI–U for the month of October 2017, not seasonally adjusted, is 1.02041, as indicated in OMB Memorandum 

M–18–03, ‘‘Implementation of Penalty Inflation Adjustments for 2018, Pursuant to the Federal Civil Penalties Adjustment Act Improvements Act of 2015’’ (December 

15, 2017). 5The cost of living multiplier for 2020, based on the Consumer Price Index for all Urban Consumers (CPI–U) for the month of October 2019, not seasonally adjusted, is 1.01764, as indicated in OMB Memorandum M–20–05, ‘‘Implementation of Penalty Inflation Adjustments for 2019, Pursuant to the Federal Civil Penalties 

Adjustment Act Improvements Act of 2015’’ (December 16, 2019). 

Dated: October 3, 2023. 

Xavier Becerra, 

Secretary, Department of Health and Human 

Services. 

[FR Doc. 2023–22282 Filed 10–10–23; 8:45 am] 

BILLING CODE 4120–01–P 


lotter on DSK11XQN23PROD with RULES1