How to Prepare for MIR Audits

Tuesday, September 20, 2022 | 0

MIR Audits: How to Prepare for $1,000 per Day Civil Monetary Penalties

Executive Summary

For fifteen years, payers have been wary of the potential $1,000 per day penalty for mandatory reporting non-compliance on claims involving Medicare beneficiaries. Experts now expect Medicare to finalize civil monetary reporting penalties no later than February 2023. Insurance executives, risk managers, and attorneys should take steps now to audit their Mandatory Insurer Reporting (“MIR”) protocols to reveal weaknesses and deficiencies which can then be remedied in advance of the penalty regulations. At a minimum, that audit should confirm the following: 1) your organization has registered as a Responsible Reporting Entity (“RRE”) and submits timely reports to Medicare; 2) your organization does not send Medicare contradictory data; 3) the reports submitted by your organization do not exceed Medicare’s established error tolerance thresholds; and 4) your organization makes good faith efforts to obtain reporting information which meets CMS standards from every Medicare beneficiary making a claim. MIR audits represent a best practice that all payers should adopt.

Introduction

Tick, tick, tick, tick, tick…do you hear it? Where’s that ticking noise coming from? It’s been getting a little louder every year for payers of claims since 2007. Have you grown immune to the ticking? Maybe not immune, but comfortable with it? Maybe it’s white noise to you at this point. Do you even understand the reason the ticking started?

When it comes to bodily injury claims involving current Medicare beneficiaries, that ticking is the $1,000 per day civil monetary reporting penalty. Sure, you’ve heard about it. But you don’t know of anyone penalized $1,000 per day by Medicare. Perhaps you’ve heard that Medicare has never used the penalty provision. That’s true, and there’s a reason for that. However, that reason evaporates in February 2023 at the latest.

With this article, you will understand the ticking. First, this article covers in detail the background of the Medicare program. Second, it follows the legal developments intended to preserve the Medicare program. Third, it describes the development of reporting provisions linked to the Medicare Secondary Payer (“MSP”) Act. Finally, it provides practical suggestions claims payers should implement today to prepare for final penalty regulations. Ultimately, this article explains why all payers should consider conducting an MIR audit to reveal and remedy deficiencies in its MIR protocols.

The ticking is not indefinite. By February 2023, Medicare should implement final penalty regulations. Adopting detailed MIR audit best practices today will insulate you from the damage once the ticking stops. Payers, whether small, medium, or large, whether insured or self-insured, should consider an MIR audit as an MSP best practice in order to minimize exposure to Medicare.

Background

On July 30, 1965, President Lyndon Johnson signed the Social Security Amendments of 1965. This law created the Medicare program. After more than 30 years of discussion, America now had a federal healthcare insurance program to provide coverage for historically vulnerable citizens.

Originally, Medicare coverage was based solely on age and consisted of two parts. Those original parts remain the same today. Medicare Part A is hospital insurance, and Medicare Part B is medical insurance. Collectively, you may hear these referred to as “Original Medicare” or “Medicare Fee-for-Service.” In year one of the Medicare program, approximately 19 million Americans enrolled in either Part A or Part B coverage. A Brief History of Medicare in America (June 22).

In 1972, the Medicare program expanded to provide insurance coverage for individuals afflicted with End Stage Renal Disease (“ESRD”). Id.  This expansion provided fast track Medicare coverage for those afflicted with kidney failure. Simultaneously, it granted enrollment to individuals with disabilities who received Social Security Disability Income (“SSDI”). As a result, Americans younger than age 65 could access Medicare coverage for the first time. This expansion allowed approximately 1.7 million Americans to join the Medicare program that year. Medicare Enrollment – National Trends 1966 – 2013 (June 22).

Since 1972, the Medicare program has expanded further, sometimes in baby steps and other times in giant leaps. One of the most notable expansions resulted from the Medicare Prescription Drug Improvement and Modernization Act of 2003 (the “MMA”). The MMA advanced the Medicare program in two main ways.

First, the MMA built upon The Balanced Budget Act of 1997, which introduced the world to what we refer to today as Medicare Part C (aka Medicare Advantage). Medicare Advantage plans offer private capitated health plans run by private companies approved by Medicare which stand in the shoes of Original Medicare. Understanding Medicare Advantage Plans (June 22). Instead of the federal government paying for a citizen’s health insurance directly, members of a Medicare Advantage plan work with a private organization who provide them health care coverage. Id.  That Medicare Advantage plan contracts with the federal government, and is compensated by the federal government at a capitated rate based on the number of plan members it covers. Id. The majority of Medicare Advantage plans cover everything that Original Medicare covers, but will also provide expanded coverage for certain services not traditionally covered by Original Medicare. Id.

Second, the MMA introduced Medicare Part D to cover prescription medications. Like Medicare Part C, private organizations offer Medicare Part D plans. These plans may be stand alone Part D plans or imbedded within a Medicare Advantage plan. Enrollment in Medicare Part D has doubled since going live Jan. 1, 2006. 10 Things to Know About Medicare Part D Coverage and Costs in 2019, Kaiser Family Foundation (June 22).

Thanks in part to these developments, the Medicare program now covers the health care needs of approximately 64 million Americans. In 2021, Medicare expenditures totalled $821 billion. Medicare Trustees Report & Trust Funds (June 22). Based on current projections, Medicare enrollment by 2030 is likely to approach 80 million individuals. CMS National Health Expenditure Data (June 22).

One can look to several factors to explain the popularity of the Medicare program. More baby boomers reaching Medicare enrollment by age, better science, and better diets all contribute to the geometric increase in Medicare beneficiaries. While these factors lead to longer lives for Medicare beneficiaries (a positive), it leads to longer lives for Medicare beneficiaries (a challenge). Living longer lives is a positive development for sure. The flip side, however, is more years lived during the golden years, years where Medicare pays for the majority of the medical expenses incurred during that period. Increased life expectancies compared to a generation ago combined with more people joining the Medicare program places added stress to the Medicare Trust Funds.

Absent increased Medicare funding up front, more people relying on Medicare means faster depletion of the Medicare Trust Funds. In recent years, the expected insolvency date of the Medicare Trust Funds, tracking by the Trustees Report, has crept closer. In the most recent report filed June 3, trustees expect the Medicare program to be insolvent by 2028. 2022 Annual Report of the Board of Trustees of the Federal Hospital Insurance and Federal Supplementary Medical Insurance Trust Funds. (June 22). As more people gained access to Medicare, the question over time became: “How do we ensure the longevity of the Medicare program?” The answer, in part, was to identify situations where Medicare should be a secondary payer instead of a primary payer.

Mandatory Insurer Reporting – Development of the Law

The year is 1980. America is in an economic recession. Unemployment is increasing, inflation rages in the low double digits and President Carter seeks reelection. The first baby boomers were turning 35 years old.
Approximately 28 million Americans were Medicare enrolled in 1980. Medicare Enrollment – National Trends 1966 – 2013 (June 22). Government population projections at the time projected Medicare enrollment rates to grow rapidly as more baby boomers reached age 65. The federal government had 30 years to implement lasting improvements to solidify the Medicare program for the coming wave of beneficiaries. For Congress, the legislative solution was to pass the Medicare Secondary Payer (MSP) Act.

    The Medicare Secondary Payer Act (1980).
The MSP Act is a law intended to preserve the Medicare program. It ensures that the Medicare program remains a payer of last resort for medical bills when another entity is responsible due to a workers’ compensation claim, automobile claim, or general liability claim. Simply put, if there is another entity that is responsible for a Medicare beneficiary’s medical bills, that entity should be the one to pay for those medical bills. Under those circumstances, the American taxpayer (by way of the Medicare program) should not be asked to pay those bills. The MSP Act extended Medicare’s status as a secondary payer from workers’ compensation and no-fault insurance to liability insurance.

The MSP Act has always contained two separate and distinct repayment obligations. “Payment under this subchapter may not be made, except as provided in subparagraph (B), with respect to any item or service to the extent that payment has been made or can reasonable be expected to be made under a workmen’s compensation law or plan of the United States or a State or under an automobile or liability insurance policy or plan (including a self-insured plan) or under no fault insurance.” 42 U.S.C. § 1395y(b)(2)(A)(ii).

Legislators thought that as more and more Medicare beneficiaries resolved certain insurance claims, Medicare would be reimbursed more frequently for medical expenses that were the responsibility of others. Over time, that would mean less leakage (or double dipping) from the Medicare Trust Funds. These larger balances carried over annually could help offset the projected increases in Medicare beneficiaries enrolling in the program once the baby boomers reached Medicare age.

While the logic was sound, it was premised on an important assumption: that parties resolving workers’ compensation, automobile, and liability insurance claims would actually comply with the statute and affirmatively address the MSP reimbursement obligations. In fact, this was not happening. A GAO report dated August 2004 revealed that for every $1 Medicare paid out as a “conditional payment”, settling parties reimbursed Medicare only $0.38. United States Government Accountability Office Report to the Ranking Minority Member, Subcommittee on Health, Committee on Ways and Means, House of Representatives, Medicare Secondary Payer – Improvements Needed to Enhance Debt Recovery Process (June 22). Congress read that report and acted to ensure Medicare’s demise would be delayed.

    The Medicare, Medicaid, and SCHIP Extension Act of 2007.
On Dec. 29, 2007, President George W. Bush signed into law the Medicare, Medicaid, and SCHIP Extension Act of 2007 (the “MMSEA” a/k/a Section 111 Reporting a/k/a Mandatory Insurer Reporting or “MIR”). Congress expected MIR to cure, in part, a growing concern: how to ensure the MSP program was as efficient as possible so as to help extend the life of the Medicare Trust Funds. Officials expected MIR to provide Medicare visibility to which Medicare beneficiaries were resolving insurance claims, and thus allow Medicare to seek more in terms of conditional payments from responsible parties.

On its face, MIR is simple: it requires certain entities resolving certain types of insurance claims with Medicare beneficiaries to report certain information to Medicare. Specifically, MIR requires entities defined as Responsible Reporting Entities (“RREs”) who resolve workers’ compensation, automobile, liability insurance (including self-insurance), or no-fault insurance claims with a Medicare beneficiary to report certain data to Medicare at certain times. Those reports may take one of two forms: ongoing responsibility for medicals (“ORM”) or a total payment obligation to the claimant (“TPOC”). MIR places the onus on the RRE to report to Medicare when appropriate.

To do so, RREs needed to figure out which claimants were Medicare enrolled. RREs also needed to understand precisely when those reports needed to be submitted to Medicare. Finally, the RRE needed to develop the means to submit these reports electronically (the only means acceptable to Medicare). A simple law quickly morphed into a complicated mess for the insurance industry.

That complicated mess becomes more acute when you understand the stakes. MIR as originally enacted carried with it a mandatory non-compliance penalty of $1,000 per day per Medicare beneficiary (as adjusted annually under 45 C.F.R. § 102). 42 U.S.C. § 1395y(b)(8)(E)(1). From the start, this penalty provision alerted the insurance industry to the seriousness of this law. While affected organizations began to plan how to comply, others lobbied Congress for a more sensible solution.

    The Strengthening Medicare and Repaying Taxpayers (SMART) Act of 2012.
That sensible solution was the SMART Act. Among other MSP enhancements (which are outside the scope of this article), the SMART Act amended MIR in 2013 to soften those $1,000 per day penalties. What was once a mandatory $1,000 per day penalty morphed into a discretionary penalty of up to $1,000 per day by replacing the word ‘shall’ in the statute with the word ‘may’. Id. Industry concerns eased, but were not cured.

In light of that statutory amendment, the question next posed to Medicare officials has been “When do you believe you have the discretion to impose MIR penalties?” In the 12 plus years MIR has been on the books, Medicare (to the author’s knowledge) has not imposed MIR penalties on a non-compliant RRE even once. While the MMSEA as amended by the SMART Act empowered Medicare to penalize up to $1,000 per day for MIR non-compliance, no one knew the criteria Medicare would apply or even if Medicare had the desire to penalize. Absent enforcement, statutory obligations may not be as concerning to some. It’s not as if Medicare raced to implement MIR regulations when MIR became law.

    The Provide Accurate Information Directly (PAID) Act of 2020.
The next important MIR development arrived with the Provide Accurate Information Directly (PAID) Act of 2020. Signed into law Dec. 11, 2020, the Centers for Medicare & Medicaid Services (CMS) implemented the PAID Act effective December 11, 2021. The PAID Act obligates CMS to provide enhanced information about individuals queried as part of the MIR process. 42 U.S.C. § 1395y(b)(8)(G)(ii). In addition to providing information about an individual's enrollment status specific to Medicare Parts A/B, it also provides results specific to that individual's enrollment status to Medicare Part C and Medicare Part D for the previous three years from the date of the query. Id.

With enactment of the PAID Act, the MSP conditional payment circle is now complete. Based on the current statutory construct, Medicare now provides information to payers about who receives Medicare Parts A, B, C, and D. Medicare provides payers information about which plans are providing the Medicare Part C and D coverage. Medicare has established electronic means to verify, resolve, and satisfy any outstanding conditional payment obligations. The congressional vision from 1980 to solidify the longevity of the Medicare program was finally a reality 41 years later.

The problem, however, is that the conditional payment circle was completed too late. Relying on the settlement community’s sense of duty and proactive compliance with the MSP conditional payment provisions alone could not be the Medicare program’s panacea at this point. Medicare allowed the industry to self-police for 40 years. This alone may have been sufficient if the industry were better about proactively addressing conditional payment obligations as standard operating procedure when resolving certain insurance claims. Since it is not and since some members of the industry requested clarification as to when Medicare might have the discretion to impose the $1,000 per day penalty for non-compliant MIR reporting, Medicare granted their wish in 2020.

Medicare Proposes a Penalty Regulation

On Feb. 18, 2020, Medicare published a proposed regulation addressing MIR civil monetary penalties. Medicare Program: Medicare Secondary Payer and Certain Civil Money Penalties (June 22). The proposed regulation revealed three situations where Medicare intends to penalize the non-compliant actor: 1) the entity has failed to register as an RRE and/or does not submit any MIR reports within the required timeframe; 2) the RRE reports contradictory data to what it previously reported when Medicare pursues recovery from that RRE; or 3) the RRE reports exceed Medicare’s error tolerance levels. Id. Let’s address these each in turn.

1) The entity has failed to register as an RRE and/or does not submit any MIR reports within the required timeframe.

This is the most basic of the basic and the most non-compliant of the non-compliant. This addresses situations where an organization who meets the definition of ‘RRE’ is not submitting any MIR reports within the prescribed timeframe set forth by Medicare or (worse) has not even registered with Medicare as an RRE for MIR purposes.

On its face, this feels like the worst possible position for an organization to find itself in 2022. Almost 15 years have past since the law was enacted. Countless articles, blog posts, emails, and continuing education sessions have stressed the importance of registering as an RRE and starting to report properly for MIR purposes. After all of that, and with ample warning of what’s coming, we believe Medicare may punish organizations in this group to the fullest extent possible: the full $1,000 per day per Medicare beneficiary (as adjusted annually under 45 C.F.R. § 102).

Some quick math reveals what that could look like: $365,000 per year per Medicare beneficiary (subject to adjustments under 45 C.F.R. § 102). For the entity that fails to register as an RRE and report compliantly to Medicare, that’s the annual penalty it faces in the event it resolves a claim involving a Medicare beneficiary and is not MIR compliant on just that single claim. To say that this proposed regulation has the potential to drive some penalized entities into bankruptcy is not hyperbole.

2) The RRE reports contradictory data to what it previously reported when Medicare pursues recovery from that RRE.

The second penalty scenario envisions an organization trying to do the right thing, but provides Medicare with inconsistent data. For example, assume the RRE originally reported a date of loss of Jan. 24, 2017, in its TPOC report. However, when Medicare seeks recovery of conditional payments made, the RRE asserts the real date of loss was Oct. 13, 2018. This information, relayed to Medicare in this inconsistent fashion, would trigger the penalty provisions under the proposed regulation.

Another example could be tied to ICD-10 coding. Perhaps in its ORM report, the RRE reported five different ICD-10 codes. Later, when Medicare issues a conditional payment notice (CPN) asserting recovery for claims related to those five codes, the RRE challenges Medicare’s recovery. The basis for the challenge is that, in fact, there was only one ICD-10 code related to the compensable claim. Thus, any charges related to the four other ICD-10 codes should be eliminated from the CPN as Medicare would not have a right of recovery for those. Again, inconsistent data such as this would trigger the penalty provisions, allowing Medicare to penalize that RRE up to $1,000 per day on that one claim.

3) The RRE reports exceed Medicare’s error tolerance levels.

The third penalty scenario also envisions an organization trying to do the right thing, but providing Medicare with sub-standard data. Instead of the data supplied at conditional payment recovery being inconsistent with what was previously provided via MIR, this scenario envisions data in the actual ORM or TPOC reports being ‘dirty’. According to the proposed regulation, Medicare would have the discretion to penalize up to $1,000 per day “If a  … [non-group health plan] NGHP entity has reported, and exceeds any error tolerance(s) threshold established by the Secretary in any 4 out of 8 consecutive reporting periods. We propose that the initial and maximum error tolerance threshold would be 20% (representing errors that prevent 20% or more of the beneficiary records from being processed) …” Id.

To better understand this final scenario, here are the examples Medicare provided within the proposed regulation: “The following examples demonstrate how the concept of exceeding error tolerances in “any four out of eight consecutive reporting periods” would work:

Example 1: The RRE, ABC Insurer, submitted a file for each quarter in Year 1 of its required submissions. For Year 1, quarters 1 and 2, ABC Insurer submitted files where the file submissions entirely failed processing (100% error rate), and thus the quarterly submissions exceeded the error rate tolerance. In quarter 3 of Year 1, ABC Insurer submitted a file with no serious errors that prevented the files from being processed. However, severe file errors again occurred in quarter 4 and 25% of its records failed. These errors were corrected by the RRE for the first quarter of Year 2. ABC Insurer continued to submit error-free files for quarter 2 and quarter 3 of Year 2. However, in quarter 4 of Year 2, 50% of the submitted records failed. CMS would impose a CMP because the error tolerances exceeded four out of the eight quarterly reporting periods as of quarter 4 of Year 2.

Example 2: In the first two quarters of Year 1, Acme Insurance submitted files with errors that prevented 30% of the records from processing (exceeding error tolerances for quarter 1 and quarter 2). The file submissions for the last two quarters of Year 1 and quarters 1 through 3 of Year 2 did not have any significant errors and did not exceed tolerances. However, quarter 4 of Year 2 saw a recurrence of serious errors and Acme Insurance again exceeded the error tolerance with 25% of its records failing to process. Quarters 1 and 2 of Year 3 did not exceed tolerances, but the third and fourth quarters of Year 3 again saw Acme Insurance exceed the error tolerance with 30% and 20% of its records failing to process, respectively. CMS would not impose a CMP as in no continuous eight reporting periods did Acme Insurance exceed error tolerance four or more times.” Id.

Medicare afforded the industry the opportunity to comment upon the proposed MIR regulation. Members of the industry submitted forty-seven comments, including this author (June 21). The commentary window closed more than two years ago, and Medicare has been plotting its next step since.

Experts now expect Medicare to publish a final regulation no later than Feb. 18, 2023. Federal Register Unified Agenda Spring 2022, Medicare Secondary Payer and Certain Civil Money Penalties (June 22). This estimate is based on Section 902 of the MMA, which established a general three window within which Medicare must publish a final regulation after it has published a proposed regulation. Medicare Program; Timeline for Publication of Medicare Final Regulations After Proposed or Interim Final Regulations (June 22). Medicare officials interpret section 902 of the MMA as rendering ineffective most Medicare proposed regulations that have not been finalized within three years of the proposed regulation publication dates. Id. Given these restrictions, you must expect to see the MIR civil monetary penalty regulations by February 2023.

How to Prepare for the Penalty Regulation – MIR Audit Best Practices

The proposed MIR civil monetary penalty regulation was not all doom and gloom though. Importantly, Medicare went one step further, identifying those situations where it would not penalize an RRE under this penalty regulation. Medicare Program : Medicare Secondary Payer and Certain Civil Money Penalties (June 22). Medicare advised as follows: “We would not impose a CMP in the following situations, where all of the applicable conditions are met:

• If a RRE reports any GHP beneficiary record that is reported on a quarterly submission timeframe within the required timeframe (not to exceed one year after the GHP effective date), or any NGHP beneficiary record that is submitted within the required timeframe (not to exceed one year after the TPOC date).
• If an RRE complies with any TPOC reporting thresholds or any other reporting exclusions published in CMS's MMSEA Section 111 User Guides or otherwise granted by CMS. Note that these thresholds are not defined in the regulatory text as TPOC reporting thresholds are currently subject to change on an annual basis per 42 U.S.C. 1395(y)(b)(9)(i). CMS also elects to impose operational thresholds for reporting, such as the current $5,000 threshold for Health Reimbursement Arrangements.
• If a GHP entity or NGHP entity does not exceed any error tolerance(s) in any four out of eight consecutive reporting periods.
• If an NGHP entity fails to report required information because the NGHP entity was unable to obtain information necessary for reporting from the reportable individual, including an individual's last name, first name, date of birth, gender, MBI, or SSN (or the last five digits of the SSN), and the responsible applicable plan has made and maintained records of its good faith effort to obtain this information by taking all of the following steps:
  • The NGHP has communicated the need for this information to the individual and his or her attorney or other representative and requested the information from the individual and his or her attorney or other representative at least twice by mail and at least once by phone or other means of contact such as electronic mail in the absence of a response to the mailings.
  • The NGHP certifies that it has not received a response in writing, or has received a response in writing that the individual will not provide his or her MBI or SSN (or last five digits of his or her SSN).
  • The NGHP has documented its records to reflect its efforts to obtain the MBI or SSN (or the last five digits of the SSN) and the reason for the failure to collect this information.” Id.

Based on these provisions, here are some MIR best practices RREs should implement immediately to avoid penalties under the proposed regulation:

1. Register as an RRE and submit timely reports.
2. Do not send Medicare contradictory data.
3. Do not exceed Medicare’s established error tolerance thresholds.
4. Make good faith efforts to obtain reporting information which meets CMS standards. When you cannot obtain the data required to make a complaint report, follow the steps to document those good faith efforts.

This is much easier said than done. When Medicare published the proposed regulation, it counted NGHP RREs as 19,816. Id. That figure seems low to most in the industry. Your first task is to determine if your organization has registered as an RRE. Once you know the answer to that, your next step could be one of two things.

If your organization has not registered as an RRE, do so immediately if you resolve claims involving Medicare beneficiaries. Consult the Mandatory Insurer Reporting page of the Medicare website to learn how to register. CMS Mandatory Insurer Reporting (NGHP) (June 22). You may wish to have an agent serve in your capacity as the Medicare site can be confusing.

If your organization has registered as an RRE, find out when your reporting window falls. Each RRE is assigned a seven day period every quarter within which all reports (ORM and TPOC) must be submitted. Queries may be conducted as frequently as once a month, and would not fall within your assigned seven day reporting window.

Best practice tips No. 2 and No. 3 both fall under the category of “Clean, Proper Data”. Simply sending Medicare data to fill the required fields has never been enough. Now, that practice will officially be deemed non-compliant and punishable by up to a $1,000 per day per claimant penalty.

The data you send to Medicare should be accurate. To be accurate, you should ensure that each claim lists the appropriate date of loss, date of settlement, proper ICD-10 codes, and all other data points Medicare requests on an ORM or TPOC report. Audits conducted by our firm to date reveal the following to be the fields containing the most consistent errors:  

1. ORM acceptance and termination dates;
2. Appropriate and correct ICD-10s related to claim;
3. Accurate and consistent TPOC date; and,
4. Accurate and consistent settlement amounts.

Guessing and guessing wrong on these fields and any others out of the 150 potential fields will now be punishable. Under reporting (leaving fields empty) and over reporting (providing data that might not actually be accurate/related to the compensable claim) will now be punishable. Adopting MIR best practices and validating those best practices through a stringent MIR Audit will be your best defense.

Conclusion

Time is almost up. After more than a decade of warnings from Medicare about $1,000 per day penalties, we are on the cusp of having a final regulation in place authorizing Medicare to punish non-compliant MIR RREs. It’s critical that your organization is ready when Medicare promulgates those final regulations. Again, industry experts expect to see those promulgated no later than February 2023. Tick, tick, tick.

Conducting an MIR audit of your current MIR process is your best defense against the civil monetary penalty regulations. The MIR audit will reveal what is good and what is bad about your current process. The MIR audit will spotlight areas requiring your attention in advance of the final regulations. Addressed immediately, the MIR audit buys you the time and peace of mind necessary to move into the post-regulatory world of civil monetary penalties with confidence. You are in complete control over how the penalty regulations affect your organization. Will you be proactive and use the audit to move outside the blast radius? Will you be reactive and hope your organization operates outside the blast radius? The choice is yours.