HHS Announces Annual Adjustments to Civil Monetary Penalties, With Implications for Employer-Sponsored Health Plans

HHS has announced the annual adjustments of civil monetary penalties for statutes within its jurisdiction. As background, a 2015 law requires annual adjustments to specified penalty amounts. HHS’s latest adjustments are based on a cost-of-living increase of 2.04%. Here are highlights of adjustments potentially affecting employer-sponsored health plans:

• HIPAA Administrative Simplification. HIPAA administrative simplification encompasses standards for privacy, security, breach notification, and electronic health care transactions. The HITECH Act substantially increased the penalty amounts for violations of these standards, creating four categories of violations that reflect increasing levels of culpability and establishing minimum and maximum penalty amounts, as well as an annual cap on penalties for multiple violations of an identical provision (see our Checkpoint article). The indexed penalty amounts for each violation of a HIPAA administrative simplification provision are—

  • Lack of knowledge: The minimum penalty is $114 (up from $112); the maximum penalty is $57,051 (up from $55,910); and the calendar-year cap is $1,711,533 (up from $1,677,299).
  • Reasonable cause and not willful neglect: The minimum penalty is $1,141 (up from $1,118); the maximum penalty is $57,051 (up from $55,910); and the calendar-year cap is $1,711,533 (up from $1,677,299).
  • Willful neglect, corrected within 30 days: The minimum penalty is $11,410 (up from $11,182); the maximum penalty is $57,051 (up from $55,910); and the calendar-year cap is $1,711,533 (up from $1,677,299).
  • Willful neglect, not corrected within 30 days: The minimum penalty is $57,051; the maximum penalty is $1,711,533 (up from $1,677,299); and the calendar-year cap is $1,711,533 (up from $1,677,299).
• Medicare Secondary Payer. The Medicare Secondary Payer statute prohibits a group health plan from “taking into account” the Medicare entitlement of a current employee or a current employee’s spouse or family member and imposes penalties for violations. The indexed amounts for violations applicable to employer-sponsored health plans are—

  • Penalty for an employer that offers incentives to Medicare-eligible individuals not to enroll in a plan that would otherwise be primary: $9,239 (up from $9,054).
  • Penalty for willful or repeated failure to provide requested information regarding group health plan coverage: $1,504 (up from $1,474).
  • Penalty for responsible reporting entities that fail to provide information identifying situations where group health plan is primary: $1,181 (up from $1,157).
• Summary of Benefits and Coverage (SBC). An SBC generally must be provided to participants and beneficiaries before enrollment or re-enrollment in a group health plan. The penalty for a health insurer’s or non-federal governmental health plan’s willful failure to provide an SBC is $1,128 (up from $1,105) for each failure.

These adjustments are effective for penalties assessed on or after October 11, 2018, for violations occurring on or after November 2, 2015.

EBIA Comment: Congress amended the procedure for penalty adjustments in 2015 to preserve their deterrent effect in the face of inflation. Particularly with respect to HIPAA, the penalties can add up quickly and provide a strong incentive for compliance. For more information, see EBIA’s HIPAA Portability, Privacy & Security manual at Section XX.E (“Civil Monetary Penalties”). See also EBIA’s Group Health Plan Mandates manual at Section XXIV (“Medicare Secondary Payer (MSP) Requirements”), EBIA’s Health Care Reform manual at Section XVI.I (“Consequences of Failing to Provide the SBC”), and EBIA’s Self-Insured Health Plans manual at Section XXVIII.C (“Summary of Benefits and Coverage (SBC)”).

Contributing Editors: EBIA Staff.