Department of Health and Human Services Issues Updated Civil Monetary Penalties for 2018
On October 11, 2018, the Department of Health and Human Services (“HHS”) issued a final rule updating its regulations to reflect required inflation-adjusted civil monetary penalty amounts. While this update did not create new penalties, it does increase penalty amounts for penalties issued on or after October 11, 2018 for violations occurring on or after November 2, 2015. Therefore, employers, providers, plan sponsors, and administrators should consider these updated penalty amounts in their planning for 2019. Selected penalty amounts relevant to employer-sponsored health plans (with comparisons to 2017) are listed below; for a full list, visit: https://www.govinfo.gov/content/pkg/FR-2018-10-11/pdf/2018-22005.pdf.
HIPAA: HHS increased the penalties for violations of HIPAA Administrative Simplification Provisions, which include HIPAA standards for health information privacy, security, and notification in the event a breach occurs. The penalty amounts vary based on whether the covered entity or business associate knew of the violation, whether the violation was caused by the covered entity or business associate’s willful neglect, and, if so, whether the covered entity or business associate promptly corrected the violation:
Summary of Benefits and Coverage: By now, employers and insurers should be aware that the Patient Protection and Affordable Care Act (“ACA”) requires them to provide a written Summary of Benefits and Coverage (“SBC”) for each benefit package to applicants and participants. The penalty for failing to provide the SBC increased to $1,128 for 2018 from $1,105 in 2017.
Medicare Secondary Payer Rules: The Medicare Secondary Payer rules prohibit employers from taking an employee and/or an employee’s spouse’s Medicare eligibility into consideration when offering group health plan benefits. This may occur when an employer offers a financial incentive to employees to opt out of group health coverage or when an employer fails to provide group health plan information to Medicare-eligible employees.
