The year 2010 introduced employers to a new world of regulations relating to health care. Since, fortunately, many of them phase in over years, employers have some breathing room before they take effect.

That time has passed, though, for an entirely different set of new regulations specific to Medicare. These regulations, which carry stiff penalty provisions for noncompliance, took effect on January 1.

Broad brush, these regulations require mandatory reporting by applicable employers to Medicare of settlements, awards and other payments made by employers and their insurance companies to Medicare-eligible claimants. The purpose is to secure reimbursements to Medicare for payments that Medicare may have made previously.

If Medicare is not reimbursed within 60 days by the beneficiaries or other recipients, the employers will be required to reimburse Medicare themselves — even when the reimbursements duplicate their payments to the beneficiaries.

FOR WHOM DOES THIS BELL TOLL?

These new regulations are potentially applicable to any employer, business or entity that ever has occasion to pay a health-related claim. All such entities fall under the acronym in the new law of RRE (responsible reporting entity).

Employers typically qualify as RREs in one of two ways. First, an employer can be an RRE if it sponsors a group health plan for its employees, rather than purchasing traditional health insurance policies. About two-thirds of employers fall into this category.

Second, an employer can be an RRE if it is “self-insured” with respect to liability or workers’ compensation insurance. Medicare interprets “self insurance plans” broadly — an employer who has a traditional insurance policy to cover these risks can still be an RRE if it pays deductibles or self-insured retentions to or on behalf of claimants.

The bottom line is — be careful. If you’re an employer, these new regulations could apply to you.

WHAT’S IT ALL ABOUT?

Under the new regulations, self-insured plans, along with insurance companies, are required to report all claims made by Medicare-eligible employees to the Centers for Medicare and Medicaid Services (CMS). The reporting obligation is retroactive to July 1, 2009.

On the surface, the new Medicare regulations are simple. Whenever a company makes a payment to a person eligible to receive Medicare, that company is required to report that payment to CMS. That way, if Medicare has paid the claim already, Medicare will know to pursue a claim for reimbursement.

Medicare’s right to receive reimbursement arises from a 1980 law called the Medicare Secondary Payer Act (MSP). MSP establishes Medicare as a secondary payer of health-related claims, responsible only for claims that are not otherwise paid by a “primary plan.” Thus, when Medicare pays claims first — which happens frequently — its payments are conditional and Medicare is entitled to reimbursement for them when later payments are made by private insurance companies, self-insured employers or others.

The source of the new regulations is the Medicare, Medicaid and SCHIP Extension Act (MMSEA) of 2007. MMSEA establishes the reporting mechanism, which is designed to put teeth into the previously unenforceable concept of Medicare as “secondary” payer.

Medicare has high hopes for MMSEA. By increasing its ability to identify individuals who receive Medicare payments, Medicare expects to recoup approximately $1.74 billion of duplicate benefits each year.

While apparently a great idea for Medicare, the new regulations bring a lot of new work for employers, along with new risks and liabilities for any employers who happen to miss a step along the way.

HOW DOES IT WORK?

For starters, the regulations require employers with reporting responsibilities to register online as RREs with the Medicare Coordination of Benefits Contractor. The deadline to register was September 30, 2009, but registration is still permitted and in fact required. Registration requires various related acts, like naming an authorized representative to assume responsibility for reporting.

These employers then are required to verify the eligibility status for Medicare of anyone who is to receive a payment, as through a settlement, judgment or award. While employers are allowed to obtain eligibility information from the claimant directly, they also must obtain the claimant’s social security number and submit it, along with other personal information about the claimant, to CMS for verification. Depending on the type of plan, some employers may have reporting obligations beginning this year, and others may have reporting obligations that start next year.

Employers will need to move carefully with regard to the collection and disclosure of the required personal information. Such information often is governed by completely separate confidentiality obligations, such as nondisclosure provisions under confidentiality agreements.

Other than social security numbers, such required information can include Medicare Health Insurance Claim Numbers (HICNs), employer identifier numbers (EINs) and Internal Revenue Service Form W-2, which is the Wage and Tax Statement that employees receive from employers.

Before taking action on the claim, the employers must wait for CMS to respond back about the claimant’s Medicare status. Employers must repeat this process as often as necessary to identify changes in the claimant’s eligibility status and must retain all of these records, per claimant, for at least 10 years.

When a claimant turns out to be eligible, the employer must report information about the claim and the claimant to CMS as soon as a payment is made or is imminent. Parties to the claim have 60 days to reimburse Medicare and failure to do so may result in CMA charging interest on that amount.

Then, whenever an award or a settlement order provides for a payment to a Medicare beneficiary, the employer must complete an extensive report to CMS, with more than 100 categories of information. This obligation cannot be avoided by disclaimers of liability or statements — even in court orders — regarding the absence of medical damages.

The regulations also require employers to balance their reporting obligations about these payments with their various, and independent, confidentiality obligations to the payees.

Finally, if employers make mistakes, they are subject to costly fines, including a $1,000 fine for each day of noncompliance, as well as lawsuits from CMS seeking double recovery.

DO EMPLOYERS HAVE ANY ALTERNATIVES?

Employers need to appreciate that, as a secondary payer, CMS has broad recovery rights. Among other things, it can sue a primary plan to recover any “conditional payments” previously made by Medicare on behalf of the primary plan. If the lawsuit is successful, CMS can recover double damages from the primary plan, meaning two times the amount of those conditional payments.

In developing these regulations, CMS’s primary focus has been on insurance companies, who are well equipped to handle these kinds of bureaucratic procedures. Adjusters and agents are used for recording claims notes and updating entry journals to monitor insurance claims. For many employers, however, this is foreign territory. An employer who bought a CGL, D&O or E&O policy with a self-insured retention probably never anticipated having to collect and report Medicare claim information. They are in the business of their business, not the business of insurance.

CMS has authorized RREs to hire third-party administrators to help fulfill these reporting obligations. Employers must take note, however, that it is the employer, and not the agent, who will ultimately be held liable by CMS for any violations. In any event, employers will incur a significant burden as result of these new regulations. Employers must either divert internal resources away from primary business operations to handle Medicare claims reporting, or hire third-party administrators to do the work for them.

WHAT SHOULD EMPLOYERS BE DOING?

• Test and adjust internal reporting mechanisms, including the training of personnel.
• Ensure that a process is in place for gathering the appropriate personal information from known claimants.
• Test the method for verifying the accuracy of this information from CMS.
• Establish a process for identifying conditional payments previously made by Medicare.
• Assess whether they have the capacity to handle these obligations in-house or whether it would be better to hire a third-party administrator.

If it’s true, as they say, that the first steps are the hardest, that would bode well for the new Medicare Reporting Requirements. The initial steps of getting this system underway look pretty daunting at this point. Hopefully, those difficulties will disappear as the journey gets underway.