This is part 3 of 7 in the Medicare Secondary Payer Compliance series. All titles in this series can be viewed below. Subscribe to our blog to receive these future updates. Prior installments of this series can be accessed using the links provided.

In our previous posts, we mentioned that the Medicare Secondary Payer (MSP) law imposes obligations upon Group Health Plans (GHPs).   This post will explain those obligations, both provided for in the regulations and in the CMS guidance, in more detail, and highlight the potential compliance pitfalls for GHPs. Given recent enforcement trends, and the risk of raising damages for non-compliance from double to treble, including a minimum fine of $1000 per day per unreported beneficiary, GHPs may want to review and audit their compliance with MSP requirements.

Generally, a GHP is sponsored by an employer to provide healthcare to employees and their families.[1]  These include self-insured plans that may be administered through a third party administrator (TPA) and plans arranged by employers through a health insurer.  The MSP requires that GHPs with 20 or more employees report certain information to CMS to avoid payment conflicts (although smaller companies have certain limited reporting obligations).  CMS refers to these plans as Responsible Reporting Entities (RREs), and they must report all Active Covered Individuals to Medicare.  An Active Covered Individual is defined as:

  • Those between 45 and 64 years of age covered through the GHP based on their own or a family member’s current employment status;
  • Those 65 and older covered based on their own or their spouse’s current employment status;
  • All individuals covered under a GHP who have been receiving kidney dialysis or have received a kidney transplant (ESRD); and
  • All individuals covered under a GHP who are under 45, are known to be entitled to Medicare, and have coverage in the plan based on their own or a family member’s current employment status.[2]

There are exceptions to this definition for (i) employers with less than 20 employees, who need not report unless a covered individual has ESRD, in which case the ESRD covered individuals must be reported, and (ii) employers with less than 20 employees who must report if they are part of a multi-employer/multiple employer GHP.[3]

CMS recognizes that this will constitute a large class of individuals for many GHPs, and also recognizes that many people who are currently not eligible for Medicare will have their information reported as a part of this process.[4]  Retirees and their spouses who are covered under a GHP do not count as Active Covered Individuals, but are termed Inactive Covered Individuals and do not need to be reported in the same manner as Active Covered Individuals.  The reason for this is that in most cases Inactive Covered Individuals (retirees) have Medicare as a primary payer.

GHP RREs have multiple reporting options, but the basic option requires a GHP RRE to submit an MSP Input File containing information about each Active Covered Individual, as outlined in the CMS manual.  The GHP RRE submits reports to a CMS website known as the Coordination of Benefits Secure Website (COBSW).[5]  The GHP may submit a Query Only Input File to the website, which helps the GHP assess if potential employees are covered by Medicare.

There are many situations that create potential pitfalls for GHPs.  For example, if an employer hires several new employees and adds them to its health plan, a GHP administrator may fail to ask the essential questions necessary to determine if any employee is an Active Covered Individual.  While it is clear that those over the age of 45 need to be reported, if the plan does not inquire about the current health coverage for an employee’s family, the plan might fall out of compliance with MSP reporting requirements if it did not know that a family member receives health care coverage due to a disability or has ESRD. In addition, while a GHP with less than 20 employees generally does not have to submit a report, the small GHP may forget to inquire about the coverage status of a new employee’s family.

The basic rules are summarized in the following chart:

Acting Party Responsibilities Liabilities for Non-Compliance
Group Health Plans (GHPs) (Generally Employer-Sponsored Plans)



·         20+ GHPs[6] must generally be the primary payer for all Active Covered Individuals except for ESRD patients

·         100+ GHPs[7] must generally be the primary payer for all Active Covered Individuals

·         20+ GHPs must report quarterly all Active Covered Individuals (includes all covered individuals over 45, including employees or spouses/partners, and those with ESRD regardless of age, and those under 45 who are known to be entitled to Medicare.)

·         Failure to report results in a minimum fine of $1000 a day per unreported beneficiary, with CMS reserving the right to collect double damages


Andrew Kuder, a Law Clerk (not admitted to the practice of law) in the firm’s Newark office, contributed significantly to the preparation of this post.

[1] 26 USC § 5000(b)(1).

[2] CMS, MMSEA Section 111 MSP Mandatory Reporting: GHP User Guide 7-2—7-3 (v5.0 2017).

[3] CMS, MMSEA Section 111 MSP Mandatory Reporting: GHP User Guide 7-3 (v5.0 2017).

[4] CMS, MMSEA Section 111 MSP Mandatory Reporting: GHP User Guide 7-2 (v5.0 2017).


[6] 20+” means GHPs with 20 or more employees

[7] 100+” means GHPs with 100 or more employees