On January 15, 2026 CMS held a long-awaited educational webinar on Section 111 Civil Money Penalties (CMPs). The session delivered much-needed clarity on how CMS intends to administer CMP audits, the communication process, and what Responsible Reporting Entities (RREs) can expect if potential non-compliance is identified.
Below are the key takeaways - and why they matter:
Audit Process
CMS confirmed that the first audits will occur in February 2026. The agency will randomly select 250 records to audit for reporting compliance. Records are selected across all accepted new Section 111 records received during the specific review period, as well as records Medicare received from non-Section 111 sources such as providers or beneficiaries. The 250 randomly selected records will proportionately represent the GHP and NGHP records accepted in a given quarter. Of note: While statistically unlikely, there is a chance that an RRE may have more than one record selected in the sample.
For the February 2026 audit, CMS will evaluate records submitted and accepted between October 11, 2025 and December 31, 2025. This aligns with the statutory lookback period, as CMPs may be assessed for TPOC dates and initial ORM reported more than one year on or after October 11, 2024. However, CMS is still processing claims from the final weeks of 2025 and therefore cannot yet determine the NGHP to GHP ratio for the first audit cycle. The agency emphasized that reporting volumes fluctuate greatly quarter to quarter, making projections unreliable.
Due to implementing the new MSA reporting requirement in April 2025, CMS announced that it will not assess penalties for any late-reported workers’ compensation claims until July 2026 for any claims reported late as of July 2025. This grace period is intended to allow WC RREs additional time to adapt to the technical and operational changes associated with mandatory MSA reporting.
Communication
CMS expects the first notices for possible CMPs to be issued in March 2026, if applicable. Importantly, CMS will only contact the RRE when a potential instance of non-compliance is identified. That means if you reported your claim in the prior quarter, and did not hear from CMS, you are good to go. All CMP correspondence will be mailed to the RRE’s Authorized Representative, with a copy issued to the Account Manager.
Best Practice Tip: RREs should verify the Profile Report recertification has been completed and all contact information is current to ensure that your organization does not miss any CMP-related correspondence. Failure to confirm all contact information is accurate is not an acceptable defense against a CMP.
CMS also clarified that it will not nickel and dime the quality of the reported data. Incorrect records on their own are not a reason for a CMP, but if a record is rejected due to error, then it is considered untimely for CMP purposes.
Best Practice Tip: ECS’ proactive data validations identify claims that will be rejected due to errors and allow our reporting customers to update data to ensure timely reporting. Timely clear any data validations so your claims will be reported successfully with no risk of penalty.
Appeals and Safe Harbors
The CMP appeals process includes both informal and formal components. First, the RRE may respond informally to CMS’ initial CMP notice, which is a notice of intent to impose a CMP. If no evidence or response is provided by the RRE, or the response was untimely or insufficient, CMS will provide a notice of proposed determination along with appeal rights. Appeals are first made to the Administrative Law Judge (within 60 days of receiving the proposed determination), then to the Departmental Appeals Board (within 30 days of the ALJ ruling), and finally judicial review (within 60 days of the DAB ruling). Once final and binding, payment must be made within 60 days.
CMS provided clarity around the safe harbor “2 and 1” rule. If an RRE makes a good faith effort to identify a Medicare beneficiary, no penalty will be assessed if a TPOC should have been reported but could not be due to the beneficiary’s failure to cooperate. Specifically, where the RRE makes two written (email or mail) and one other (phone, mail, email, text) attempt to obtain Medicare enrollment status from the beneficiary and their attorney. If the beneficiary or their attorney unambiguously refuses to cooperate, and indicates no information will be provided, no further attempts are required. CMS also clarified that the order of the attempts is irrelevant, as long as at least two written attempts are made and that all attempts are documented.
Final Word
This webinar delivered practical, actionable guidance for organizations navigating CMP risks. CMS was clear: it will only notify RREs when penalties are imposed – not when claims are evaluated and cleared, the “2 and 1” safe harbor rule is well-defined, and CMS’ temporary leniency for workers’ compensation RREs is a welcome development as the industry continues to adjust to mandatory MSA reporting.
Our expert team at ECS continues to closely monitor CMS trends and is here to support you in meeting your Medicare Secondary Payer (MSP) compliance obligations while also achieving the best claims outcomes. Should you have any questions, contact your local or national account manager or Neha Pellegrino at neha.pellegrino@examworkscompliance.com