It pays to look closely. Buried deep within a 205-page and 1230-page Federal Register final rules publication, the Centers for Medicare & Medicaid Services (“CMS”) initiated impactful changes for pharmacies and Durable Medical Equipment, Prosthetics, Orthotics and Supplies (“DMEPOS”) suppliers. CMS tweaked DMEPOS refill policy; added heightened screening requirements to DMEPOS suppliers who enrolled during pandemic flexibilities and waivers; took this opportunity to authorize deactivations for billing inactivity after only six months; and modified grounds for revocation. The final rules were published on November 13, 2023, and November 16, 2023, respectively. All items became effective January 1, 2024.

Below, we identify some key takeaways in each category.

Refills

CMS policy responds to concerns related to DMEPOS auto-shipments – namely that auto-shipments create waste when a patient doesn’t need the product at the same quantity, yet deliveries keep occurring, thereby creating a stockpile that is wasted. Accordingly, CMS instituted policies that require a DMEPOS supplier to contact the patient prior to dispensing refills. CMS tinkered with various aspects of the policy for the past two decades. The refill policy was primarily found in Local Coverage Determinations. 

With the new regulations, CMS largely adopts those Local Coverage Determinations. However, there are some notable departures. We call them out, below:

• Like always, suppliers must contact patients prior to refilling product.
• However, under these new regulations, suppliers must now get an affirmative response from the patient. The supplier must confirm that the patient (1) is using the item and (2) wants a refill. The supplier need not identify how many refills remain.
• CMS notes that it purposefully did not prescribe how this communication should happen – it could be email, a phone call, a text message, a retail receipt, etc. Bottom line, the supplier must be able to provide proof of contact and affirmation upon request. Based on our outreach to CMS, this communication can be system-generated.
• Beneficiary contact needs to occur within the 30-day period prior to “the expected end of the current supply.” Suppliers no longer need to race to make contact only 14 days prior to “pending exhaustion.”

In case you already have burning suggestions—the policy tweaking isn’t yet done. CMS requested comments on whether there are certain products that don’t require the refill outreach. In other words, “[a]re there ways that Medicare could better balance the beneficiary burden of responding to supplier outreach (for example, text messaging, phone call to affirm need for recurring supply) when contrasted with the burden of receiving potentially unnecessary items (for example, co-insurance payments)? We will take these comments into consideration for potential future policy changes to our DMEPOS refill policies.”

Deactivation

Previously, if a provider or supplier did not bill Medicare for 12 months, it could be deactivated. The new regulations reduce that triggering inactivity to just six (6) months.

CMS maintains that “dormant” providers and suppliers present risk because: (1) providers and suppliers may scheme to bill from several different numbers to obfuscate fraud; (2) a dormant provider or supplier may have failed to advise the program of its closure; or (3) bad actors may obtain the dormant information and submit claims. This could be quite disruptive to those providers and suppliers who obtain a Medicare enrollment as a condition precedent to some other enrollment, but will rarely bill Medicare, if at all.

For instance, obtaining a Medicare enrollment is (essentially) required to obtain a New York Medicaid freestanding pharmacy enrollment. If that pharmacy doesn’t bill Medicare, it may experience frequent deactivations that then must be reactivated. The reactivation may take several months to approve, especially if an on-site audit is required. In this scenario, New York Medicaid could terminate the pharmacy for a failure to meet the conditions of participation (i.e., have an active Medicare enrollment). Whether the Medicaid programs will be understanding of this disruption is not clear.

CMS attempts to assuage those fears by highlighting that the authority is permissive. CMS states, “providers and suppliers that are not typically deactivated for 12 months of non-billing should not assume they are more likely to be deactivated under our proposed change to 6 months.” Various commentors recommended that the provider or supplier be provided an opportunity to explain the non-billing prior to deactivation, but CMS rejected that recommendation.

Revocation

CMS bolstered its grounds for revocation, effective January 1, 2024. Most applicable to DMEPOS suppliers, CMS may revoke an enrollment for the following reasons:

• Noncompliance with any application certification standards found in 42 C.F.R. § 424.57(c) (e.g., failure to have a state license) or
• Any civil judgement against the provider or supplier or any owner, managing employee, managing organization, officer or director of the provider or supplier under the False Claims Act within the previous 10 years.

The effective date of the revocation is now bespoke, based on the reason for revocation.

Writing about the bounds and intent of just these two new grounds and the corresponding effective date of revocation could be its own standalone post. Should we find increased revocations or an interest, we will publish more on this topic.

Revalidation

Newly enrolling Medicare DMEPOS suppliers are considered high-risk, and thus must undergo robust screening by CMS. However, during the pandemic CMS temporarily waived various aspects of initial enrollment for newly enrolling DMEPOS suppliers, including site visits, accreditation requirements, and fingerprint-based criminal background checks.

In December 2022, the U.S. Government Accountability Office (“GAO”) published a report indicating that during this waiver period, DMEPOS suppliers accounted for 4% of all enrollments, but 83% of all enrollments that were later revoked. As the GAO does, it flagged these problems and gave CMS a chance to comment. CMS took the opportunity to warn that it could not conduct the high-risk screening because revalidating DMEPOS suppliers are not considered high-risk. CMS urged regulatory changes.

And those regulatory changes were made. Effective January 1, 2024, any revalidating DMEPOS supplier that obtained its enrollment during the waiver period will be considered high-risk and undergo heightened screening.