On November 15, 2021, the Department of Health and Human Services (HHS) issued increased civil monetary penalties for HIPAA and Medicare payer violations based on inflation. The latest amounts are based on a cost-of-living increase of 1.01182%. The increases went into effect immediately.
What Penalties Affect Group Health Plans?
The following are key penalties affecting group health plans:
- Summary of Benefits and Coverage (SBC). An SBC generally must be provided to participants and beneficiaries before enrollment or re-enrollment in a group health plan. Failure to provide group health plan participants and beneficiaries with an SBC may now result in a penalty of up to $1,190 per participant or beneficiary.
- Medicare Secondary Payer (MSP). The Medicare Secondary Payer statute prohibits a group health plan from “taking into account” the Medicare entitlement of a current employee or a current employee’s spouse or family member and imposes penalties for violations. Violating the prohibition of offering Medicare beneficiaries financial or other benefits as incentives not to enroll in or to terminate enrollment in a group health plan that would otherwise be primary to Medicare will now trigger penalties of up to $9,753 and failure to provide information identifying situations where the group health plan is primary can trigger penalties of up to $1,247.
- HIPAA privacy and security rules. Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the rules’ requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. Penalties for a covered entity or business associate violating Health Insurance Portability and Accountability Act’s (HIPAA) privacy and security rules will depend on the type of violation involved. Penalties are broken down into tiers that reflect increasing levels of knowledge about the violation.
Each tier carries a minimum and maximum penalty with an annual cap, all of which have increased as follows:
Tier one (lack of knowledge): Minimum penalty $120, maximum penalty $60,226, annual cap $1,806,757
Tier two (reasonable cause and not willful neglect): Minimum penalty $1,205, maximum penalty $60,226, annual cap $1,806,757
Tier three (willful neglect, corrected within 30 days): Minimum penalty $12,045, maximum penalty $60,226, annual cap $1,806,757
Tier four (willful neglect, not corrected within 30 days): Minimum penalty $60,226, maximum penalty and annual cap $1,806,757
Next Steps for Employers
Employers should become familiar with the new penalty amounts and review their benefit plan administration procedures and processes to ensure full compliance.
