Author: Logan Pry, VP, Medicare Compliance

CMS opened 2026 with additional clarity on the Civil Money Penalty (CMP) enforcement timeline during its January 15th webinar, offering important operational details for Responsible Reporting Entities (RREs) preparing for the first audits under the Section 111 Final Rule. While much of the rule’s framework has already been published, CMS used this session to reinforce expectations, outline milestone dates, and highlight critical administrative steps that RREs should take now.

The agency confirmed that the first CMP audit cycle is imminent and clarified timing nuances between NGHP, GHP, and Workers’ Compensation (WC) reporting—particularly given last year’s addition of the WCMSA‑related fields. CMS also reiterated the importance of accurate profile information to ensure notices reach the correct parties and encouraged the use of the safe harbor provision when SSNs cannot be obtained despite good‑faith attempts.

Highlights and Takeaways:

  • First CMP audit starts in February 2026
    CMS will begin its initial review of 250 randomly selected accepted records from NGHP and GHP submissions for Q4 2025, limited to post–October 11, 2025 records.
  • Penalty pre‑notices coming in March 2026
    If suspected non‑compliance is identified, CMS expects to issue the first informal notices (pre‑determinations) beginning in March.
  • Workers’ Compensation claims exempt from audit until July 2026
    To accommodate the significant WCMSA reporting updates implemented in April 2025, CMS will not review WC records for CMP applicability until July 2026—the earliest date a WC record could be considered late.
  • Update your Section 111 profile report now
    The Authorized Representative will receive all CMP correspondence, with a copy to the Account Manager. Reporting agents do not receive CMP notices. RREs should verify contacts and addresses via the EDI Representative or secure site to avoid missing critical communications.
  • GHP vs. NGHP audit ratios will vary widely
    CMS emphasized that because reporting volumes fluctuate significantly quarter‑to‑quarter, it will not provide advance estimates of the proportional split between GHP and NGHP records in each audit cycle.
  • Use the Social Security Number safe harbor when applicable
    When an SSN cannot be obtained, RREs should rely on the safe harbor provisions: three documented attempts (two in writing) made to both the beneficiary and their attorney unless written refusal is received. Proper documentation preserves compliance and protects against CMP exposure.

Bottom Line

The CMP enforcement era is now officially underway. With the first audit beginning in February and informal notices expected as early as March, RREs should use this window to validate reporting processes, tighten internal timelines, confirm beneficiary‑information workflows, and ensure all contact details in your profile report are accurate.

Contact us today for more information on how Allan Koba Compliance Solutions can help you avoid penalty as well as our new indemnification suite for Section 111 Mandatory Insurer Reporting services.