CMS-R-131 Reporting Requirements, Thresholds, and Penalties

Section 111 reporting requirements obligate liability insurers, no-fault insurers, workers’ compensation plans, and self-insured entities to electronically send CMS the details of any settlement, judgment, award, or ongoing medical payment involving a Medicare beneficiary, so Medicare can recover payments it should not have made as the secondary payer. The rules come from Section 111 of the Medicare, Medicaid, and SCHIP Extension Act of 2007 and are enforced through daily civil money penalties, quarterly compliance audits, and expanded recovery rights.¹

Who Has to Report

The entity on the hook is called a Responsible Reporting Entity, or RRE. Under the statute, RREs are “applicable plans”: liability insurance (including self-insurance), no-fault insurance, and workers’ compensation plans and insurers. CMS refers to this group as Non-Group Health Plans, or NGHPs.² An entity qualifies as self-insured whenever it carries its own risk in whole or in part, so many corporate defendants without a traditional policy still fall inside the definition.

Every payment to a Medicare beneficiary is reportable, including settlements where the RRE denies liability. And the duty cannot be delegated. A third-party administrator or claims handler can push the buttons, but the legal responsibility stays with the RRE.

Group Health Plans have their own separate Section 111 obligations built around whether covered individuals are working aged, disabled, or have end-stage renal disease.³ The rest of this article deals with the NGHP side.

The Two Things That Trigger a Report: ORM and TPOC

NGHP reporting is built on two distinct triggers, and mixing them up is one of the more common compliance mistakes.

Ongoing Responsibility for Medicals

ORM applies when the RRE accepts a continuing obligation to pay for a beneficiary’s injury-related medical care. What triggers reporting is the decision to accept that obligation, not the date a medical bill is first paid. The RRE reports the assumption of ORM once, then reports again later when ORM terminates. Individual payments made under ORM are not reported one by one, and bundling several of them into a single check does not convert them into a TPOC.⁴

Total Payment Obligation to Claimant

A TPOC is a one-time payment obligation created by a settlement, judgment, or award. The TPOC date is the date the obligation is established. In most cases that means the date a written settlement agreement is signed. If court approval is required, the TPOC date is the later of the signing date or the court approval date. Without a written agreement, the TPOC date is the date the first payment is issued.⁵

A single claim can produce both. If a workers’ comp file has ongoing medical exposure and later resolves through a lump-sum settlement, that is two separate reportable records.

The $750 Threshold and Its Big Exception

Not every payment has to be reported. As of January 1, 2026, CMS applies a $750 reporting threshold across all three NGHP categories, so only TPOCs above $750 require reporting.⁶

The exception matters: the dollar threshold does not apply to claims alleging ingestion, implantation, or exposure, as opposed to physical trauma. For those non-trauma claims, every settlement is reportable regardless of amount.⁶

What Information You Have to Submit

Each report has to give CMS enough information to identify the beneficiary, the claim, and the payment. That comes down to four categories of data.

Beneficiary identification: name, date of birth, and either the Social Security Number or the Medicare Beneficiary Identifier. Either identifier is acceptable, and CMS correspondence will use whichever one was most recently supplied.⁷
Claim identification: date of injury, nature of the claim, and ICD diagnosis codes describing the condition.
Settlement and payment details: for a TPOC, the TPOC date, total amount, and payment type; for ORM, the date responsibility was accepted and, later, the date it terminated.
RRE identification: the reporting entity’s own identifying information, so CMS attributes the record to the right insurer or plan.

Before filing a claim report, an RRE also needs to confirm the injured party is actually a Medicare beneficiary. CMS offers a Beneficiary Lookup tool on the Section 111 portal (capped at 500 individual queries per RRE ID per month, though the cap does not apply to Direct Data Entry submitters) and a Query Input File for batch checks.⁸

How and When You Submit

All Section 111 reporting is electronic. Submissions go through the Benefits Coordination and Recovery Center using the Section 111 Coordination of Benefits Secure Website, or COBSW. RREs have to register on the portal and receive a Reporter ID before submitting anything.⁹

There are two submission methods, and they carry different deadlines.

High-volume RREs use a Claim Input File built to CMS’s electronic specifications. The BCRC processes the file and returns a Claim Response File showing which records were accepted, rejected, or flagged for errors. File submitters report during CMS’s quarterly submission windows, published in Chapter IV of the current NGHP User Guide (Version 8.3, January 2026).¹⁰

Lower-volume RREs can use Direct Data Entry, keying records directly into the portal. DDE submitters must report each TPOC within 45 calendar days of the TPOC date rather than waiting for a quarterly window.⁶

Either way, an outer deadline governs everything: records must be reported within one year (365 days) of the settlement date or the date funding was delayed beyond the TPOC date, whichever is later.¹¹

What Happens After You Report

Reporting is what tells CMS another insurer was primary, and CMS then moves to recover any conditional payments Medicare made for the related care. The BCRC issues a Conditional Payment Notice identifying those payments. Recipients have 30 calendar days to respond with documentation showing specific items are unrelated, plus proof of attorney fees and other procurement costs.¹²

If the BCRC gets a timely response, it reviews it and issues a demand letter for the final amount. No response, no reduction: the BCRC issues the demand automatically without deducting attorney fees or costs. Interest starts running from the date of the demand letter and is assessed every 30 days the debt sits unresolved.¹²

At day 90 after the demand letter, the BCRC issues an Intent to Refer notice. At day 150, if full payment or a valid defense has not arrived, the debt goes to Treasury for collection. CMS can also refer debts to the Department of Justice for litigation.¹²

Penalties for Not Reporting

Under 42 U.S.C. §1395y(b)(8), CMS can impose a civil money penalty for each day an RRE is out of compliance, per claimant. The statutory base is $1,000 per day, adjusted annually for inflation. The 2023 adjusted maximum was $1,428 per day per claimant, and the 2026 figure may be somewhat higher.¹³

Starting in January 2026, CMS enforces compliance through a quarterly audit. Each quarter, 250 MSP records are randomly selected across the entire universe of accepted new records, split proportionally between GHP and NGHP based on that quarter’s volume. The 250 is a system-wide total, not a per-RRE number. The sample also draws from records reported by providers or beneficiaries, meaning a claim an RRE failed to report can still surface in the audit through someone else’s submission.¹¹

Compliant records generate no notice. RREs only hear from CMS when a record has been flagged as potentially noncompliant.¹¹

The daily penalty is not the only exposure. The Medicare Secondary Payer statute also creates a private cause of action allowing the government or a private party to recover double the amount a primary plan should have paid when the plan fails to provide for primary payment or appropriate reimbursement. An RRE that ignores both the reporting duty and a later recovery demand can end up with the daily penalty stacking alongside a doubling of the underlying recovery.¹⁴

1
Centers for Medicare & Medicaid Services. Mandatory Insurer Reporting for Non-Group Health Plans
2
Centers for Homedicare & Medicaid Services. Mandatory Insurer Reporting for Non-Group Health Plans
3
Centers for Medicare & Medicaid Services. Mandatory Insurer Reporting for Group Health Plans
4
Centers for Medicare & Medicaid Services. Ongoing Responsibility for Medicals (ORM) Introduction
5
Centers for Medicare & Medicaid Services. NGHP User Guide Chapter IV Technical Information v8.3 January 2026
6
Centers for Medicare & Medicaid Services. NGHP User Guide Chapter III Policies v8.3 January 2026
7
Centers for Medicare & Medicaid Services. MMSEA Section 111 Mandatory Insurer Reporting Quick Reference
8
Centers for Medicare & Medicaid Services. Query File
9
Centers for Medicare & Medicaid Services. Section 111 COB Secure Website
10
Centers for Medicare & Medicaid Services. NGHP User Guide
11
Centers for Medicare & Medicaid Services. NGHP Civil Money Penalties
12
Centers for Medicare & Medicaid Services. Medicare’s Recovery Process
13
Federal Register. Medicare Program; Medicare Secondary Payer and Certain Civil Money Penalties; Correction
14
Office of the Law Revision Counsel. 42 U.S. Code 1395y – Exclusions From Coverage and Medicare as Secondary Payer