The Centers for Medicare & Medicaid Services has begun the machinery that, for the first time in the roughly 15-year history of mandatory Section 111 reporting, can turn a late Medicare Secondary Payer filing into a real dollar penalty. According to CMS’s own civil money penalty guidance pages, the agency began randomly auditing Section 111 records in January 2026 and is now working through its first round of noncompliance notices to insurers, self-insured employers, and workers’ compensation payers.
The penalties trace back to a final rule CMS published in the Federal Register on October 11, 2023, which took effect December 11, 2023, became applicable to new coverage events on October 11, 2024, and became enforceable, meaning penalties could actually attach, on October 11, 2025. The rule fills in details that Congress left to CMS’s discretion when it authorized penalties for Section 111 noncompliance back in 2013’s SMART Act.
Under the final rule, CMS narrowed what can trigger a penalty considerably from what it originally proposed. Early drafts would have allowed penalties for late reporting, for reporting that contradicted an entity’s earlier submissions during a recovery dispute, and for exceeding a data-quality error threshold in four of eight consecutive quarters. In the final version, CMS dropped the latter two triggers entirely; the sole basis for a civil money penalty now is late reporting, measured against a 365-day deadline running from a settlement date or the date an entity assumes ongoing responsibility for a claimant’s medical care.
The dollar amounts differ depending on the type of reporting entity. Group health plans face a flat penalty, currently $1,512 per day of noncompliance after inflation adjustment, with no discretion for CMS to reduce it, since the statute sets that rate directly. Non-group health plan entities, meaning liability insurers, no-fault carriers, and workers’ compensation payers, are subject to a tiered structure instead: $378 per day (2025, inflation-adjusted) for a record reported one to two years late, $756 per day for two to three years late, and $1,512 per day beyond three years, capped at $365,000 for any single record. CMS says it adopted the tiered approach, rather than mirroring the flat GHP rate, specifically in response to industry comments asking that penalty size track the severity of the delay.
To find violations, CMS is not scanning every submission. Instead, beginning in January 2026 and continuing every quarter, the agency randomly selects 250 records nationwide from newly accepted Section 111 filings, proportioned to reflect the actual mix of GHP and NGHP submissions that quarter. With roughly 20,800 active reporting entities registered, any individual company’s odds of being pulled into a given quarter’s sample are low, though CMS notes multiple records from the same entity can theoretically be selected.
An entity flagged in the audit receives an Informal Notice first, not an actual penalty, and has 30 days to submit mitigating evidence, such as documentation that a delay stemmed from a technical issue outside its control or from a beneficiary who refused to provide identifying information despite good-faith outreach. If CMS rejects that explanation or receives no response, the case proceeds to a formal Notice of Proposed Determination, and the entity can request a hearing before an administrative law judge within 60 days, followed by a further appeal to the Departmental Appeals Board’s Appellate Division. Notices go only to the entity’s Authorized Representative and Account Manager on file, according to CMS, and outdated contact information is not treated as an acceptable defense.
CMS reportedly told attendees at a January 15, 2026 webinar that its first informal notices for liability and no-fault claims were expected to go out in March 2026. Workers’ compensation reporting is on a delayed track: because CMS added new Medicare Set-Aside data fields to workers’ comp reporting requirements in April 2025, the earliest date CMS could issue a workers’-comp-related penalty notice is July 2026, according to that same account of CMS’s guidance. Those dates come from CMS’s public webinar remarks as relayed by outside counsel, not from the final rule’s text itself, and CMS’s own published materials describe the audit and notice cadence in general terms without committing to those specific calendar dates.
For employers and the insurance industry, the practical takeaway is that a rule which has existed on paper for more than two years is now generating actual audit activity, with real money attached for the first time. Self-insured employers and carriers that serve as Responsible Reporting Entities have reason to confirm their Section 111 profile contacts are current, and to review internal procedures with any third-party reporting agents, since CMS notices go to the RRE itself and reporting agents are not copied.
CMS’s own regulatory impact analysis, included in the final rule, flagged that the agency does not expect the penalty regime to be economically significant. Modeling the rule against 2022 reporting behavior, CMS estimated a worst-case aggregate of $128.8 million in penalties across the entire industry in a given year, below the $200 million threshold that would have required a fuller economic impact analysis, and CMS cautioned that the 2022 data likely overstates typical noncompliance since it predates entities’ efforts to come into compliance ahead of the rule.
This summary is for general informational purposes only; readers should consult the primary CMS guidance and Federal Register final rule linked above for complete, current data and methodology.