Section 111 of the Medicare, Medicaid, and SCHIP Extension Act of 2007 adds a new mandatory reporting requirement for group health plans. The overall purpose of this program is to make sure that Medicare pays benefits secondary to any applicable private health care coverage. The Centers for Medicare and Medicaid Services (“CMS”) is responsible for this program, and has recently announced information about how the program will be implemented.
All “group health plans” are affected by this new requirement, but the burden of compliance falls on responsible reporting entities (“RREs”), defined as “an entity serving as an insurer or third party administrator for a group health plan…and, in the case of a group health plan that is self-insured and self-administered, a plan administrator or fiduciary.” Thus, employers that sponsor group health plans that are administered through an insurer or a third party administrator are not RREs, and therefore are not directly responsible for reporting. If an employer sponsors and administers a self-insured group health plan, however, it must comply with the new reporting requirement by registering with CMS and electronically reporting the required information. CMS has provided that RREs may contract with an agent to submit the required reports, but responsibility for compliance, including the accuracy of the reported data, remains with the RRE.
Participation in this program requires an RRE to register with CMS and collect and electronically transmit certain “data elements” to the “Medicare Coordination of Benefits Contractor.” Many RREs currently participate in similar voluntary reporting programs with CMS. These RREs must register and begin providing the required “data elements” effective January 1, 2009. RREs that do not currently participate in one of the voluntary programs must register with CMS online during April of 2009. After a testing period, mandatory reporting for these RREs will begin in July of 2009.
The mandatory reports will contain information for all individuals covered under the group health plan that may be eligible for Medicare. This includes beneficiaries age 45 and older who have coverage based on their own or a family member’s employment status. Many employers and plan beneficiaries may be surprised to learn that one of the data elements that is required for these reports is the Social Security number of all such beneficiaries under the plan. Privacy concerns have led many employers to move away from collecting SSNs. In light of this trend, CMS published an “Alert” that may be distributed by employers to employees, which explains the new program and verifies that collection of SSNs for purposes of complying with this program is appropriate.
Failure to comply with this new reporting requirement could be very expensive. A civil penalty of as much as $1,000 per day per individual about whom the information is required to be reported may be assessed if such information is not provided. Further information about this program, including the CMS Alert regarding the use of SSNs, may be found on the CMS website dedicated to this new program: www.cms.hhs.gov/MandatoryInsRep/.