HHS Announces Adjustments to Penalties for SBC, MSP and HIPAA Violation

Effective March 17, 2022, the HHS has increased penalty amounts adjusted by inflation related to Summary of Benefits and Coverage (SBC), Medicare secondary payer (MSP) and HIPAA privacy and security rules violations. The new amounts are applied to penalties assessed on or after March 17, 2022, for violations occurring on or after November 2, 2015.

Summary of Benefits and Coverage (SBC)

The ACA requires insurers and group health plan sponsors to provide SBCs to eligible employees and their beneficiaries before enrollment or re-enrollment in a group health plan. The maximum penalty for a health insurer or plan’s failure to provide an SBC increased from $1,190 to $1,264 per failure.

Medicare Secondary Payer (MSP) Rules

The MSP provisions prohibit employers and insurers from offering Medicare beneficiaries financial or other benefits as incentives to waive or terminate group health plan coverage that would otherwise be primary to Medicare. The failure to comply with the MSP rules increased from $9,753 to $10,360.

The maximum daily penalty for the failure of an insurer, self-insured group health plan or a third-party administrator to inform HHS when the plan is or was primary to Medicare increased from $1,247 to $1,325.

HHS Administrative Simplification

The HIPAA administrative simplification regulations provide standards for privacy, security, breach notification and electronic health care transactions to protect the privacy of individuals’ health information.

The penalty amounts vary depending on the violators’ level of intentions and situations broken down by HIPAA’s four-tiered penalty structure. The chart below summarizes the new and prior penalty amounts.

With this latest increase in penalties, employers may want to review their compliance with the SBC, MSP and HIPAA requirements to help prevent violations, agency audits and potential penalties.

HHS Final Rule - Inflation Adjusted Civil Penalty Amounts for 2022  »