CMS and OIG released highly anticipated final changes to the rules implementing the Stark Law, the safe harbors issued under the Anti-Kickback Statute (AKS) and the beneficiary inducements provision in the civil monetary penalties law (Beneficiary Inducement CMP) on November 20, 2020 (Final Rule(s)). CMS has scheduled the publication date for the official version of the Final Rules in the Federal Register for December 2, 2020. The Final Rules address value-based arrangements, propose major changes to other key Stark Law concepts and definitions, address the donation of cybersecurity technology and services, and create flexibility to provide patient incentives in value-based arrangements and with respect to telehealth. More specifically, the Final Rules:

• Create AKS safe harbors for value-based arrangements;
• Create a Stark exception for value-based arrangements;
• Modify the personal services AKS safe harbor;
• Revise Stark exceptions to address value-based arrangements;
• Modify key Stark regulatory definitions (such as FMV);
• Modify how an indirect compensation arrangement is determined;
• Create Stark special rules for taking into account the volume and value of referrals;
• Ease compliance with the Stark writing requirement;
• Clarify how profits can be pooled and distributed in group practices;
• Create a Stark exception for limited remuneration to physicians;
• Clarify what is permissible in “directed referrals” provisions;
• Modify other Stark exceptions to address industry comments;
• Create an AKS safe harbor and Stark exception for cybersecurity technology;
• Revise the EHR donation AKS safe harbor and Stark exception;
• Create AKS safe harbors for patient incentives;
• Create a telehealth exception to the Beneficiary Inducement CMP;
• Revise the local transportation AKS safe harbor; and
• Revise the AKS safe harbor for warranties.

This Client Alert describes the key modifications. King & Spalding will be hosting webinars in the coming weeks to discuss the Final Rules in greater detail.

New Stark Law Exception and AKS Safe Harbors for Value-Based Arrangements

Following the framework of the proposed rules, CMS finalized one new Stark Law exception covering three types of value-based arrangements that correspond to three new AKS safe harbors for value-based arrangements finalized by the OIG. Both agencies use substantially the same defined terms for these value-based arrangements, and incorporate some of the same safeguards to protect the integrity of these arrangements. However, the Stark Law exceptions and the AKS safe harbors for value-based arrangements differ in some significant respects. The Stark Law exceptions are codified at 42 C.F.R. § 411.351 and 42 C.F.R. § 411.357(aa); and the AKS safe harbors are codified at 42 C.F.R. §§ 1001.952(ee), (ff) and (gg).

Key Definitions

At the core of these Stark Law exceptions and AKS safe harbors is the protection of “value-based arrangements,” which are defined as arrangements to provide at least one value-based activity for a target patient population to which the only parties are (1) the “value-based enterprise” (or “VBE”) and one or more of its VBE participants or (2) VBE participants in the same VBE. These terms are defined in the Stark Law exceptions and the AKS safe harbors as follows:

• “Value-based enterprise” or “VBE” is used by the agencies to mean two or more VBE participants (i) collaborating to achieve at least one value-based purpose; (ii) each of which is a party to a value-based arrangement with the other or at least one other VBE participant in the VBE; (iii) that have an accountable body or person responsible for financial and operational oversight of the VBE; and (iv) that have a governing document that describes the VBE and how the VBE participants intend to achieve its value-based purpose(s).
• “VBE participant” means a person or entity that engages in at least one value-based activity as part of a VBE. According to the AKS safe harbor definition, a patient acting in their capacity as a patient is not a VBE participant.
• “Value-based activity” means any of the following activities that are reasonably designed to achieve at least one value-based purpose of the VBE: (i) the provision of an item or service, (ii) the taking of an action, or (iii) the refraining from taking an action. The AKS safe harbor definition further specifies that a value-based activity does not include the making of a referral.
• “Value-based purpose” means any of the following: coordinating and managing the care of a target patient population; improving the quality of care for a target patient population; appropriately reducing the costs to, or growth in expenditures of, payors without reducing the quality of care for a target patient population; or transitioning from healthcare delivery and payment mechanisms based on the volume of items and services provided to mechanisms based on quality and control of the costs of care for a target patient population.
• “Target patient population” means an identified patient population selected by a VBE or its VBE participants based on legitimate and verifiable criteria that are set out in writing in advance of the commencement of the value-based arrangement and further the VBE’s value-based purpose(s).

General Requirements Applicable to Value-Based Arrangements

Both the Stark Law exception and the three AKS safe harbors for value-based arrangements generally impose fewer requirements as a VBE assumes a greater level of downside financial risk. The applicable requirements to protect a value-based arrangement depend on whether (i) the VBE has assumed full financial risk; (ii) in the case of the AKS safe harbor, the VBE has assumed substantial downside financial risk from a payor, and a VBE participant has assumed a meaningful share of such risk, or in the case of the Stark Law exception, the physician has assumed meaningful financial risk; or (iii) the VBE and its VBE participants have not assumed downside financial risk or have assumed less than full, meaningful or substantial downside financial risk.

Regardless of risk level, the AKS safe harbors and the Stark Law exceptions for value-based arrangements include some common integrity safeguards. The final Stark Law exception requires that all value-based arrangements meet the following requirements to protect remuneration paid under the arrangement:

• The remuneration must be for or result from value-based activities undertaken by the recipient of the remuneration for patients in the target population;
• The remuneration must not be an inducement to reduce or limit medically necessary items or services to any patient;
• The remuneration must not be conditioned on referrals of patients who are not part of the target population or business not covered under the value-based arrangement;
• If the remuneration paid to the physician is conditioned on the physician’s referrals to a particular provider, practitioner, or supplier, the value-based arrangement must satisfy the following two conditions: (i) the requirement to make referrals must be set out in writing and signed by the parties, and (ii) the requirement to make referrals must not apply if the patient expresses a preference for a different provider, practitioner, or supplier, the patient’s insurer determines the provider, practitioner, or supplier, or in the physician’s judgment the referral is not in the patient’s best medical interests; and
• Records of the methodology for determining the actual amount of remuneration paid under the value-based arrangement must be maintained for six years and made available to the Secretary upon request.

As in the proposed rule, the final Stark Law exception for value-based arrangements does not incorporate requirements found in most other compensation exceptions, namely, that the compensation paid pursuant to a value-based arrangement be set in advance, fair market value, and not determined in any manner that takes into account the volume or value of a physician’s referrals or the other business generated between the parties.

Each of the OIG safe harbors for value-based arrangements requires the following:

• The value-based arrangement must not induce the parties to reduce or limit medically necessary items or services furnished to any patient;
• The remuneration must not be exchanged or used for the purpose of marketing items or services furnished by the VBE or a VBE participant to patients or for patient recruitment activities;
• The VBE or VBE participant offering the remuneration must not take into account the volume or value of or condition remuneration on referrals of patients who are not part of the target population or business covered under the value-based arrangement; and
• For six years, the VBE or VBE participant must make available to the Secretary upon request all records and materials sufficient to establish compliance with the safe harbor requirements.

Notably, OIG omitted in the final safe harbors two additional limitations in its proposed rule, namely that remuneration could not be funded by, or result from the contributions of, any individual or entity outside of the VBE, and that at least one of the value-based purposes must be coordination and management of the care for the target population.

The final AKS safe harbors for value-based arrangements specifically exclude the following types of entities from protection: pharmaceutical manufacturers, distributors and wholesalers; pharmacy benefit managers; laboratory companies; compounding pharmacies; and a medical device distributor that is not otherwise a manufacturer of a device or medical supplies. Manufacturers of devices or medical supplies and DMEPOS suppliers are also excluded from AKS safe harbors for value-based arrangements involving substantial downside financial risk and full financial risk, but these entities are eligible under the care coordination safe harbor as “limited technology participants” that exchange “digital health technology” with another VBE participant or a VBE. These terms are discussed below in connection with the care coordination safe harbor.

We discuss below key additional requirements in these Stark Law exceptions and AKS safe harbors that vary according to the level of risk assumed by the VBE and VBE participants as part of the value-based arrangement.

Value-Based Arrangements with Full Financial Risk

The least onerous requirements apply to remuneration under a value-based arrangement when the VBE is at full financial risk. “Full financial risk” means that the VBE is financially responsible on a prospective basis for the cost of all items and services covered by the payor for each patient in the target patient population for a specified period of time, which under the AKS safe harbor is for at least one year. “Prospective basis” means assuming responsibility for the cost of such items and services prior to the provision of items and services to patients in the target population.

Under the new final Stark Law exception, when the VBE assumes full financial risk, remuneration paid under a value-based arrangement does not constitute a financial relationship if the VBE is at full financial risk for the entire duration of the value-based arrangement and the requirements listed in the preceding section are satisfied.

Under the new AKS safe harbor for value-based arrangements with full financial risk, the exchange of payments or anything of value between the VBE and a VBE participant pursuant to a value-based arrangement does not constitute prohibited remuneration under the AKS when the VBE has assumed full financial risk from a payor through a value-based arrangement or a written contract. In addition to the requirements in the preceding section that apply to all three safe harbors for value-based arrangements, OIG finalized the following requirements for the safe harbor for value-based arrangements with full financial risk:

• The value-based arrangement must be in a signed writing specifying material terms, the value-based activities, and the term;
• The VBE participant may not claim payment from a payor for items or services covered under the contract or the value-based arrangement between the VBE and the payor;
• The remuneration provided by or shared among the VBE and the VBE participant must be directly connected to one or more of the VBE’s value-based purposes and may not include the offer or receipt of an ownership or investment interest in an entity or any distributions related to such ownership or investment interest; and
• The VBE must provide or arrange for a quality assurance program for services furnished to the target population that protects against underutilization and assesses the quality of care furnished to the target population.

Value-Based Arrangements with Meaningful or Substantial Downside Financial Risk

Additional requirements apply to value-based arrangements when “meaningful” (CMS’s term) or “substantial” (OIG’s term) downside financial risk is assumed.

The Stark Law exception for meaningful downside financial risk as adopted by CMS requires that a physician be at meaningful downside financial risk for failure to achieve the value-based purpose(s) of the VBE for the duration of the value-based arrangement. CMS proposed to define “meaningful downside financial risk” as meaning the physician either: (i) is responsible for paying the entity at least 25% of the value of the remuneration the physician receives under the value-based arrangement; or (ii) is financially responsible to the entity on a prospective basis for the cost of all or a defined set of patient care items and services covered by the applicable payor for each patient in the target population for a period of time. In the Final Rule, CMS lowered the risk threshold to 10% in the first methodology and eliminated the second option. As in its proposed rule, this final Stark Law exception does not impose a specific requirement that the VBE assume a defined level of downside financial risk.

For value-based arrangements with meaningful downside financial risk, the Stark Law exception imposes all of the general requirements outlined above, and the same requirements as when the VBE is at full financial risk, with the addition of two requirements. A description of the nature and extent of the physician’s downside financial risk must be in writing. In addition, the methodology used to determine the amount of the remuneration must be set in advance of the value-based activities for which remuneration is to be paid.

The new AKS safe harbor for value-based arrangements with substantial downside financial risk requires that the VBE assume through a written contract or a value-based arrangement substantial downside financial risk from a payor for at least one year. OIG responded to public comments and generally reduced the risk threshold from the level in its proposed rule by defining substantial downside financial risk to mean:

• At least 30% of any loss, where losses and savings are calculated by comparing current expenditures for all items and services that are covered by the applicable payor and furnished to the target population to a bona fide benchmark designed to approximate the expected total cost of such care (the Shared Savings and Losses Methodology);
• At least 20% of any loss where losses and savings are calculated by comparing current expenditures for all items and services furnished to the target patient population pursuant to a defined clinical episode of care that are covered by the applicable payor to a bona fide benchmark designed to approximate the expected total cost of such care for the defined clinical episode of care, and the parties design the clinical episode of care to cover items and services collectively furnished in more than one care setting (the Episodic Payment Methodology); or
• The VBE receives from the payor a prospective per patient payment that is designed to produce material savings and paid on a monthly, quarterly, or annual basis for a predefined set of items and services furnished to the target patient population designed to approximate the expected total cost of expenditures for the predefined set of items and services (the VBE Partial Capitation Methodology).

OIG’s new safe harbor also requires that a VBE participant meaningfully share in the VBE’s substantial downside financial risk for providing or arranging for the provision of items and services for the target population under one of two methodologies. Those two methodologies are:

• Assuming two-sided risk for at least 5% of the losses and savings, as applicable, realized by the VBE pursuant to its assumption of substantial downside financial risk (the Risk-Sharing Payment Methodology); or
• Receiving from the VBE a prospective, per patient payment on a monthly, quarterly, or annual basis for a predefined set of items and services furnished to the target patient population, designed to approximate the expected total cost of expenditures for the predefined set of items and services, and does not claim payment in any form from the payor for the predefined set of items and services (the Meaningful Share Partial Capitation Methodology).

OIG did not finalize the section of its proposed rule that a VBE participant could meaningfully share in the VBE’s substantial downside financial risk under a third methodology available for VBE participants that are physicians, namely, that the terms of the Stark Law exception for value-based arrangements with meaningful downside financial risk were satisfied.

The AKS safe harbor for value-based arrangements with substantial downside financial risk also requires compliance with all of the following conditions:

• The value-based arrangement must be in writing, signed by the parties in advance of or contemporaneous with the commencement of the value-based arrangement and any material change to the value-based arrangement, and specify all of the material terms set forth in the safe harbor;
• The remuneration provided by or shared among the VBE and the VBE participant (i) unless exchanged pursuant to one of the risk methodologies constituting substantial downside financial risk or a meaningful share of risk, must be used predominately to engage in value-based activities that are directly connected to the items and services for which the VBE has assumed substantial downside financial risk; (ii) must be directly connected to one or more of the VBE’s value-based purposes; and (iii) must not include the offer or receipt of an ownership or investment interest in an entity or any distributions related to such ownership or investment interest; and
• The value-based arrangement must not place any limit on the VBE participant’s ability to make decisions in the best interests of its patients or direct or restrict referrals to a particular practitioner, provider or supplier if a patient or payor selects a different provider, practitioner or supplier or such direction or restriction is contrary to applicable Medicare or Medicaid law.

Value-Based Arrangements with No Downside Financial Risk

If the VBE and VBE participants assume neither full financial risk nor meaningful or substantial downside financial risk, then both the Stark Law rule for value-based arrangements and the AKS safe harbor for care coordination arrangements require that the arrangement satisfy more onerous conditions.

Remuneration paid under a value-based arrangement is protected under the Stark Law exception if, in addition to the general requirements outlined above, the arrangement meets all of the following conditions.

• The arrangement is set out in a writing signed by the parties, which includes a description of (i) the value-based activities to be undertaken under the arrangement; (ii) how the value-based activities are expected to further the value-based purposes of the VBE; (iii) the target patient population for the arrangement; (iv) the type or nature of the remuneration and the methodology used to determine the remuneration; and (v) the outcome measure against which the recipient of the remuneration is assessed, if any.
• If the recipient of the remuneration is to be measured against outcome measures, those measures must be objective, measurable, and selected based on clinical evidence or credible medical support. For purposes of this exception, “outcome measure” means a benchmark that quantifies improvement in or maintenance of the quality of patient care, or reductions in the costs to or reduction of the growth in expenditures of payors while maintaining or improving the quality of patient care. As noted above, if recipients of remuneration are assessed against outcome measures, those measures must be set out in writing and signed by the parties. In addition, any changes to the outcome measures must be made prospectively and set out in writing.
• The methodology used to determine the amount of the remuneration is set in advance of the undertaking of the value-based activities for which the remuneration is paid.
• The arrangement is commercially reasonable. (The new definition of this term in these final Stark Law rules is discussed below.)
• Similar to the proposed and final AKS safe harbor for care coordination arrangements, the final Stark Law exception for value-based arrangements incorporates requirements for monitoring value-based activities and outcome measures. At least annually (and at least once during the term of an arrangement having a duration of less than one year), the VBE or one or more of the parties are required to monitor the following: (i) whether the parties have furnished the value-based activities required under the arrangement; (ii) whether and how the continuation of the value-based activities is expected to further the value-based purposes of the VBE; and (iii) progress toward attainment of the outcome measure(s), if any, against which the recipient of remuneration is assessed. Further, if monitoring indicates that the value-based activity is not expected to further the value-based purposes of the VBE, the parties may remain in compliance with this exception if the parties terminate the arrangement within 30 consecutive calendar days after completion of the monitoring, if the parties modify the arrangement to terminate the ineffective value-based activity within 90 consecutive calendar days after completion of the monitoring. If the monitoring indicates that an outcome measure is unattainable during the remaining term of the arrangement, the parties must terminate or replace the unattainable outcome measure within 90 consecutive calendar days after completion of the monitoring.

The AKS safe harbor that most closely aligns with this Stark Law exception for value-based arrangements is the safe harbor for care coordination arrangements to improve quality, health outcomes and efficiency. This safe harbor protects the exchange of remuneration, that is, anything of value between a VBE and VBE participant or between VBE participants pursuant to a value-based arrangement if all of the standards of the safe harbor are met. In this safe harbor, the term “coordination and management of care (or coordinating and managing care)” is defined to mean the deliberate organization of patient care activities and sharing of information between two or more VBE participants, one or more VBE participants and the VBE, or one or more VBE participants and patients, that is designed to achieve safer, more effective, or more efficient care to improve the health outcomes of the target patient population.

As in the proposed rule, the AKS safe harbor for care coordination arrangements includes some requirements that are significantly different from and in some respects more stringent than the Stark Law exception for value-based arrangements. In particular --

• The AKS safe harbor protection for care coordination arrangements extends only to in-kind remuneration. The exchange of cash remuneration in the context of this type of value-based arrangements may be covered by the amended safe harbor for personal services and management contracts which now extends to “outcomes based payments.” This modification in the safe harbor rules is discussed in detail below. Notably, the safe harbor for outcomes-based payments includes fair market value and commercial reasonableness standards, and requires that the methodology for determining compensation not be determined in a manner that “directly” takes into account the volume or value of any referrals or other business generated between the parties for which payment may be made by a Federal health care program.
• This safe harbor requires that the recipient contribute at least 15% of the donor’s cost of the in-kind remuneration. This percentage of cost can be calculated “using any reasonable accounting methodology.” In the alternative, the recipient can pay the fair market value of the in-kind remuneration. If the in-kind remuneration represents a one-time cost, the recipient’s contribution is made in advance of receiving the remuneration; and if it involves an ongoing cost, then the recipient makes the required contribution at reasonable, regular intervals.
• This safe harbor specifically regulates the exchange of remuneration by a “limited technology participant” and the VBE or another VBE participant, which must not be conditioned on any recipient’s exclusive use or minimum purchase of any item or service manufactured, distributed or sold by the limited technology participant. For purposes of this rule, the term “limited technology participant” is defined to mean a VBE participant that exchanges “digital health technology” with another VBE participant or a VBE, and that is either of the following:
  • A manufacturer of a device or medical supply (as defined in 42 C.F.R. § 403.902), but not including a manufacturer of a device or medical supply that was obligated under federal rules (42 C.F.R. § 403.906) to report one or more ownership or investment interests held by a physician or an immediate family member during the preceding calendar year, or that reasonably anticipates that it will be obligated to make such a report during the present calendar year; or
  • An entity or individual that sells or rents DMEPOS (other than a pharmacy, physician, provider or other entity that primarily furnishes services).

“Digital health technology” is defined in this rule to mean hardware, software or services that electronically capture, transmit, aggregate or analyze data and that are used for the purpose of coordinating and managing care, including any internet or other connectivity service that is necessary and used to enable the operation of the item or service for that purpose.

In addition to these requirements, as well as the general requirements outlined above applicable to all of the safe harbors for value-based arrangements, the following conditions also apply for safe harbor protection of care coordination arrangements:

• The remuneration must be used predominantly to engage in value-based activities that are directly connected to the coordination and management of care for the target patient population, and not result in more than incidental benefits to persons outside of the target patient population.
• The remuneration must not be exchanged or used more than incidentally for the recipient’s billing or financial management services.
• The value-based arrangement is commercially reasonable, considering both the arrangement itself and all value-based arrangements within the VBE.
• The terms of the value-based arrangement are set out in writing and signed by the parties in advance of, or contemporaneous with, the commencement of the value-based arrangement. At a minimum, the writing states:
  • The value-based purposes(s) of the value-based activities provided for in the value-based arrangement;
  • The value-based activities to be undertaken by the parties to the value-based arrangement;
  • The term of the value-based arrangement;
  • The target patient population;
  • A description of the remuneration;
  • Either the offeror’s cost for the remuneration and the reasonable accounting methodology used by the offeror to determine its cost, or the fair market value of the remuneration;
  • The percentage and amount contributed by the recipient (and, if applicable, the frequency of the recipient’s contribution payments for the ongoing costs); and
  • The outcome or process measure(s) against which the recipient will be measured.
• Unlike the Stark Law exception for value-based arrangements, this safe harbor requires that the parties to the value-based arrangement establish one or more legitimate outcome or process measures that (i) the parties reasonably anticipate will advance the coordination and management of care for the target patient population based on clinical evidence or credible medical or health sciences support; (ii) include one or more benchmarks that are related to the improvement or maintaining the improvement in the coordination and management of care for the target patient population; (iii) are monitored, periodically assessed and prospectively revised as necessary to ensure that the measure and its benchmark continue to advance the coordination and management of care for the target patient population; (iv) relate to the remuneration exchanged under the value-based arrangement; and (v) are not based solely on patient satisfaction or patient convenience.
• The offeror of the remuneration does not know and should not know that the remuneration is likely to be diverted, resold, or used by the recipient for an unlawful purpose.
• The value-based arrangement does not (i) limit the VBE participant’s ability to make decisions in the best interests of its patients, or (ii) direct or restrict referrals to a particular provider if (a) the patient expresses a preference for a different provider, practitioner, or supplier, (b) the patient’s insurer determines the provider, practitioner, or supplier, or (c) the direction or restriction is contrary to applicable Medicare or Medicaid laws.
• Similar to the Stark Law exception for value-based arrangements, the safe harbor for care coordination arrangements requires that the VBE, a VBE participant acting on the VBE’s behalf, or the VBE’s accountable body or responsible person reasonably monitors and assesses the following, and reports to the VBE’s accountable body or responsible person: (i) the coordination and management of care for the target patient population in the value-based arrangement; (ii) any deficiencies in the quality of care under the value-based arrangement; and (iii) progress toward achieving the legitimate outcome or process measure(s) in the value-based arrangement. These monitoring activities must be carried out at least annually, and at least once during the term of an arrangement having a duration of less than one year. Further, if the VBE’s accountable body or responsible person determines, based on the monitoring and assessment, that the value-based arrangement has resulted in material deficiencies in the quality of care or is unlikely to further the coordination and management of care for the target patient population, then the parties must within 60 days either terminate the arrangement or develop and implement a corrective action plan designed to remedy the deficiencies within 120 days; and if the corrective action plans fails to remedy the deficiencies within 120 days, the parties must terminate the arrangement.

Other Modifications to the AKS Safe Harbors

Amendments to AKS Personal Services and Management Contracts Safe Harbor; Outcomes-Based Payments

The AKS Final Rule amends the personal services and management contracts safe harbor to make two significant changes. Certain changes apply generally to all independent contractor relationships, and some pertain to a new category of “outcomes-based payments.”

Instead of requiring that the aggregate compensation over the term of the arrangement be set in advance, the amended safe harbor for personal services and management contracts requires that the methodology for determining the compensation paid over the term of the agreement be set in advance. In addition, the Final Rule eliminates the longstanding requirements pertaining to part-time services that were not feasible in many independent contractor arrangements.

The Final Rule also adds a new section to this safe harbor for the protection of “outcomes-based payments.” This new safe harbor does not require that the parties have assumed downside financial risk in a value-based arrangement. For that reason, this provision for the protection of outcomes-based payments can be used in tandem with the safe harbor for care coordination arrangements, which protects only in-kind remuneration. Outcomes-based payments are subject to many of the same requirements as care coordination arrangements, as well as other independent contractor arrangements covered by the personal services and management contracts safe harbor.

“Outcomes-based payments” are defined in the rule as payments between or among a principal to an agent that: (i) reward the agent for successfully achieving certain types of outcome measures as described in the rule; or (ii) recoup from or reduce payment to an agent for failure to achieve an outcome measure as described in the rule. Outcomes-based payments specifically do not include payments that relate solely to achievement of internal cost saving for the principal (a limitation that covers certain types of hospital gainsharing arrangements with physicians), or that are based solely on patient satisfaction or patient convenience measures. Also excluded are payments made directly or indirectly by a pharmaceutical manufacturer, distributor or wholesaler; a pharmacy benefit manager; a laboratory company; a compounding pharmacy; a manufacturer of a device or medical supply (as defined in 42 C.F.R. § 403.902); a medical device distributor or wholesale that is not otherwise a manufacturer of a device or medical supply (as defined in 42 C.F.R. § 403.902); or an entity or individual that sells or rents DMEPOS (other than a pharmacy or a physician, provider or other entity that primarily furnishes services).

A number of conditions must be met to qualify for the safe harbor protection for outcomes-based payments, several of which are similar to the general requirements for personal services and management contracts:

• To receive the outcomes-based payment, the agent achieves one or more legitimate outcomes measures that are selected based on clinical evidence or credible medical support, and have benchmarks that are used to quantify one or both of the following: improvements in or the maintenance of improvements in, the quality of patient care; or a material reduction in costs to or growth in expenditures of payors while maintaining or improving quality of care for patients.
• The methodology for determining the aggregate compensation (including any outcomes-based payments), is set in advance, commercially reasonable and consistent with fair market value. In a departure from the general safe harbor terms, the methodology for determining outcomes-based payments must not be determined in a manner that directly takes in to account the volume or value of any referrals or business otherwise generated between the parties for which payment may be made in whole or in part by a Federal health care program.
• The agreement is set out in writing and signed by the parties in advance of, or contemporaneous with, the commencement of the terms of the outcomes-based payment arrangement. The writing includes a general description of the services to be performed for the term of the agreement; the outcomes measure(s) the agent must achieve to receive an outcomes-based payment; the clinical evidence or credible medical support relied upon by the parties to select the outcome measure(s); and the schedule of the parties to regularly monitor and assess the outcome measure(s). The term of the agreement is not less than one year.
• The agreement does not limit any party’s ability to make decisions in their patients’ best interest nor induce any party to reduce or limit medically necessary items or services.
• The parties regularly monitor and assess the agent’s performance including the impact of the outcomes-based payment arrangement on patient quality of care; and periodically assess, and revise as necessary, benchmarks and remuneration to ensure that the remuneration is consistent with fair market value in an arm’s-length transaction during the term of the agreement.
• The principal has policies and procedures to promptly address and correct identified material performance failures or material deficiencies in quality of care resulting from the outcomes-based payment arrangement.
• The services performed under the agreement do not involve the counseling or promotion of a business arrangement or other activity that violates any state or Federal law.

New Safe Harbor for CMS-Sponsored Models and Model Patient Incentives

OIG finalized, with modifications, its proposal to add a new safe harbor at 42 C.F.R. § 1001.952(ii) to protect: (i) remuneration between and among parties under a model or initiative being tested or expanded by the CMS Innovation Center or under the Medicare Shared Savings Program (MSSP) (CMS-sponsored models); and (ii) CMS-sponsored model patient incentives. The safe harbor is only available for arrangements or patient incentives as determined by CMS, and any “programmatic requirements” imposed by CMS in connection with the use of the safe harbor must be satisfied to receive safe harbor protection. OIG declined to expand protection beyond CMS-sponsored models, such as arrangements established in the Medicare Physician Fee Schedule and Merit-Based Incentive Payment System, citing the potential for variation in program integrity safeguards and level of CMS involvement and oversight as compared to CMS-sponsored models.

According to OIG, a goal of the safe harbor is to provide uniformity and predictability for those participating in CMS-sponsored models; however, the safe harbor does not supersede OIG’s existing fraud and abuse waivers, and parties within CMS-sponsored models for which OIG has issued fraud and abuse waivers may continue to use such waivers or may choose to comply with the new safe harbor or any other applicable safe harbor. While OIG noted that issuance of the safe harbor does not preclude OIG from issuing model-specific fraud and abuse waivers in the future, OIG stated that it expects issuance of model-specific waivers would be infrequent, and that model participants in new CMS-sponsored models will use this new safe harbor.

OIG largely finalized without substantive change the language regarding protection for arrangements, but made several changes to the protection for patient incentives to provide for increased flexibility. OIG revised the condition that the patient incentive have a “direct connection to the patient’s health care” by adding language that permits CMS to specify a different standard in the participation documentation, such as, for example, permitting incentives related to social determinants that bear a “reasonable connection” to a patient’s health but may not “directly” relate to a patient’s health. Similarly, OIG added language providing flexibility as to who may furnish a CMS-sponsored model patient incentive. The revised language, which is now included directly under the section setting forth the conditions for patient incentives rather than the proposed definition of “CMS-sponsored model patient incentive,” provides that the incentive must be furnished by a CMS-sponsored model participant or agent “unless otherwise specified by the participation documentation.”

Notably, CMS did not create a corresponding Stark Law exception for CMS-sponsored models, taking the position that it is not necessary since at least one of the new value-based exceptions is applicable to the types of compensation arrangements contemplated under each model, program, or initiative.

Other Modifications to the Stark Law Rules

Modifications to Definitions

Fair Market Value

Fair market value (FMV) means, in general, the value in an arm's-length transaction, consistent with the general market value of the subject transaction. With respect to the rental of equipment or office space, FMV is the value in an arm’s- length transaction of rental property for general commercial purposes (not taking into account its intended use), consistent with the general market value of the subject transaction. In addition, for office space, the value of the rental property is not adjusted to reflect the additional value the prospective lessee or lessor would attribute to the proximity or convenience to the lessor where the lessor is a potential source of patient referrals to the lessee.

“General market value” means:

• With respect to the purchase of an asset, the price that an asset would bring on the date of acquisition of the asset as the result of bona fide bargaining between a well-informed buyer and seller that are not otherwise in a position to generate business for each other.
• With respect to compensation for services, the compensation that would be paid at the time the parties enter into the service arrangement as the result of bona fide bargaining between well informed parties that are not otherwise in a position to generate business for each other.
• With respect to the rental of equipment or the rental of office space, the price that rental property would bring at the time the parties enter into the rental arrangement as the result of bona fide bargaining between a well-informed lessor and lessee that are not otherwise in a position to generate business for each other.

In finalizing these definitions, CMS eliminates references to “volume and value of referrals” and “other business generated” from the definition of “fair market value,” noting that those concepts are separate and distinct from FMV.

Importantly, in commentary, CMS clarifies that providers can deviate from FMV survey data based on facts and circumstances. Examples include a highly renowned orthopedic surgeon for whom FMV compensation may far exceed survey data suggesting $450,000 and a family practitioner relocating to an area with a low cost of living for whom FMV compensation may be lower than survey data suggesting $250,000.

Additionally, CMS reiterates that it is not specifying which valuation methodology should be used to establish the fair market value and general market value of a transaction. Rather, any method is acceptable that is commercially reasonable and provides evidence that the compensation is comparable to what is ordinarily paid for an item or service in the location at issue, by parties in arm’s-length transactions that are not in a position to refer to one another.

Taking Into Account The Volume or Value of Referrals or Other Business Generated

The industry has long complained that there is a lack of objective precision regarding application of the ubiquitous requirement that compensation cannot “take into account the volume or value of referrals or other business generated” between the parties. Now, CMS has adopted regulations that limit “taking into account” to situations in which the mathematical formula used to calculate the amount of the compensation includes referrals or other business generated as a variable. The Final Rule is substantially similar to that proposed by CMS and includes rules both for payments to a physician and payments from a physician. The new regulations are codified at 42 C.F.R. § 411.354(d)(5) & (6).

Compensation to a physician by an entity takes into account the volume or value of referrals or other business generated only if the formula used to calculate the physician’s compensation includes the physician’s referrals to (or other business generated for) the entity as a variable, resulting in an increase or decrease in the physician’s compensation that positively correlates with the number or value of the physician’s referrals to (or generation of other business for) the entity. A positive correlation between two variables exists when one variable decreases as the other variable decreases, or one variable increases as the other variable increases. For example, if an entity pays a physician one-fifth of a bonus pool that includes all collections from a set of services furnished by an entity, including those from “designated health services” (DHS) as defined in the Stark Law referred by the physician, the mathematical formula to calculate the physician’s compensation would include .20 x the value of the physician’s DHS referrals and other business generated, plus .20 x the value of services not referred or generated by the physician, causing the value of the physician’s referrals to or other business generated for the entity to be an explicit variable in the compensation formula.

Conversely, compensation from the physician to an entity takes into account the volume or value of referrals only if the formula used to calculate the entity’s compensation includes the physician’s referrals to (or other business generated for) the entity as a variable, resulting in an increase or decrease in the entity’s compensation that negatively correlates with the number or value of the physician’s referrals to (or generation of other business for) the entity. A negative correlation between two variables exists when one variable increases as the other variable decreases, or one variable decreases as the other variable increases.

CMS declined to adopt the proposed “taking into account” provisions that would have applied to fixed-rate compensation, such as a fixed annual salary or an unvarying per-unit rate of compensation, if there were a “predetermined, direct and meaningful ‘if X, then Y’ correlation between the volume or value of the physician’s prior referrals (or other business previously generated) and the prospective rate of compensation to be paid over the relevant period.” These provisions would have applied, for example, if a hospital agreed to pay a physician $30 per wRVU if the physician ordered 300 or fewer diagnostic tests per year and $35 per wRVU if the physician ordered more than 300 diagnostic tests per year. CMS agreed with commenters that this proposal would “essentially nullify” the pre-existing special rules on compensation applicable to unit-based compensation set forth at 42 C.F.R. § 411.354(d)(2) & (3). Instead, CMS modified the provision that currently permits entities to condition compensation for referrals, found at 42 C.F.R. § 411.354(d)(4), to prohibit the conditioning of compensation on referrals if the existence of the compensation arrangement or the amount of compensation is contingent on the number or value of the physician’s referrals to a particular provider, although the revised regulation may require that the physician refer an established percentage or ratio of the physician’s referrals to a particular provider.

The new “taking into account” provisions will not apply to each instance in which the Stark regulations contain a “taking into account” prohibition. The new provisions will not apply to exceptions in which the “taking into account” requirement does not apply specifically to calculation of compensation but applies instead to decisions about entering into an arrangement to begin with or offering remuneration preferentially based on the volume or value of referrals. Accordingly, the new provisions will not apply to the exceptions applicable to medical staff incidental benefits, professional courtesy, community-wide health information systems, electronic prescribing items and services, EHR items and services, and cybersecurity technology. The new provisions also will not apply to the indirect compensation arrangements definition. The new provisions will apply to the nonmonetary compensation exception, as well as to the exceptions where cash remuneration may be provided.

Notably, when a compensation arrangement is deemed to take into account the volume or value of referrals or other business generated under the new “taking into account” provisions, the pre-existing special rules on compensation applicable to unit-based compensation set forth at 42 C.F.R. § 411.354(d)(2) & (3) are inapplicable and accordingly may not “be applied to reverse that determination.” CMS stated that the pre-existing deemer provisions for unit-based compensation are superfluous going forward in light of the new “taking into account” rules, but CMS has left the unit-based special rules on the books “only for historical purposes to assist parties, CMS, and law enforcement in applying the historical policies in effect at the time of the existence of the compensation arrangement being analyzed for compliance with the physician self-referral law.”

Finally, CMS declined to codify in regulations its longstanding position that compensation for personally performed services should not be deemed to take into account the volume or value of referrals when the personally performed services are performed in relation to a designated health service ordered by the physician. Concerns about CMS’s position, or the ability of an entity to successfully deploy that informal, non-codified position as a defense in an enforcement action, arose in the aftermath of decisions in United States ex rel. Drakeford v. Tuomey Healthcare System, Inc., where the court declined to accord deference to CMS’s informal commentary about its position. In its preamble discussion to the final regulations, CMS reaffirmed its position but declined to codify it into the personal services, fair market value or indirect compensation arrangements exception in the manner that the principle is codified in the employment exception. By failing to amend those exceptions and to couple the amendments with a statement that they codify CMS’s longstanding interpretation, arrangements solely for personally performed services that pre-date the effective date of the new regulations, and that do not qualify for the unit-based compensation deeming provisions – such as compensation based on professional collections – remain vulnerable to attack by whistleblowers, enforcement authorities and courts that have shown a willingness to disregard CMS’s informal position when unbacked by a formal regulation.

Indirect Compensation Arrangements

In one of the most consequential departures from the proposed regulation, CMS has abandoned its proposal to modify the definition of an indirect compensation arrangement to remove the phrase “varies with.” 42 C.F.R. § 411.354(c)(2). Historically, when remuneration does not pass directly between a referring physician and an entity providing designated health services as defined in the Stark Law (DHS Entity), a Stark-regulated “indirect” compensation arrangement has existed only when the following three conditions are satisfied: (i) there exists between the referring physician and the DHS Entity an unbroken chain of any number (but not fewer than one) of persons or entities that have financial relationships between them; (ii) the referring physician receives aggregate compensation that varies with or takes into account the volume or value of referrals or other business generated by the referring physician for the DHS Entity; and (iii) the DHS Entity has actual knowledge of or acts in reckless disregard or deliberate ignorance of the fact that the physician receives aggregate compensation that varies with or takes into account the volume or value of referrals or other business generated by the referring physician for the DHS Entity.

With no discussion at all in the preamble to the proposed rule, other than a general reference to a desire to standardize where possible the language used to describe the volume or value standard, CMS proposed one simple change to the indirect compensation arrangements definition: to remove the phrase “varies with.” This proposal, coupled with the proposal to define “taking into account” to make it an objective test based solely on the mathematical formula used to calculate physician compensation, set the stage to make the indirect compensation arrangements definition objectively determinable and predictable instead of the perennial “jump ball” that it currently is in Stark enforcement actions.

Instead, CMS has adopted a Final Rule that will cause an indirect compensation arrangement to exist if compensation to the physician varies with the volume or value of referrals or other business generated by the physician for the DHS Entity; and the individual unit of compensation received by the physician either (i) is not fair market value; or (ii) is calculated using the physician’s referrals to or other business generated for the DHS Entity as a variable, resulting in an increase or decrease in the physician’s compensation that positively correlates with the number or value of the physician’s referrals or generation of other business for the entity (and the DHS Entity has the requisite knowledge or acts in reckless disregard or deliberate ignorance as described above). CMS stated that it decided to back off of the proposed change to the indirect compensation arrangement definition because of commenters’ and CMS’s own concerns that too many unbroken chains would be eliminated entirely from any scrutiny under the Stark Law.

Now, the entry portal for whether an indirect compensation arrangement exists will be whether aggregate compensation varies with the volume or value of referrals or other business generated. Presumably, aggregate fixed compensation, or compensation that varies based only on clearly non-volume-related factors, such as quality metrics or patient satisfaction, now will be outside the scope of Stark regulation, with respect to a DHS Entity that is not in direct compensation privity with the physician. Otherwise, what it means for compensation to “vary with” the volume or value of referrals or other business generated remains open to question and, accordingly, ripe for dispute. One need look no further than the main and concurring opinions in the initial decision in United States ex rel. Bookwalter v. UPMC, No. 18-1693 (3rd Cir. Sept. 17, 2019), for an example of the potentially dramatic difference of opinion on that issue. The “varies with” debate caused sufficient consternation that the opinion subsequently was vacated in December 2019 by the panel, which issued a new opinion that eliminated the “varies with” discussion entirely and focused instead on the “taking into account” analysis, upon which the panel agreed.

In addition, if aggregate compensation varies with the volume or value of referrals or other business generated, fair market value now is outcome determinative for whether an indirect compensation arrangement exists (and, if so, whether the arrangement can qualify for the indirect compensation arrangements exception). Previously, compensation above fair market value might support an inference that compensation was intended to take into account the volume or value of referrals or other business generated, but it was not dispositive as it will be going forward when compensation varies based on the volume or value of referrals or other business generated.

Although not as favorable to the industry as might have been hoped for based on the proposed change, the new definition likely will narrow somewhat the number of indirect arrangements that are, or will be alleged to be, Stark-regulated indirect compensation arrangements.

Commercially Reasonable

Commercially reasonable – a phrase that has been front and center in numerous False Claims Act cases – has now been defined by CMS. It means that the particular arrangement furthers a legitimate business purpose of the parties and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty. CMS further states that “an arrangement may be commercially reasonable even if it does not result in profit for one or more of the parties.” (emphasis added).

Commercial reasonableness is a fact-specific analysis, and an arrangement may be reasonable even if the parties know in advance that an arrangement may result in losses to one or more parties. CMS offers the following examples of when an unprofitable arrangement may nevertheless be commercially reasonable: community need, timely access to health care services, fulfillment of licensure or regulatory obligations, including those under the Emergency Medical Treatment and Labor Act (EMTALA), the provision of charity care, and the improvement of quality and health outcomes.

The key question in determining commercial reasonableness is “simply whether [it] makes sense as a means to accomplish the parties’ goals.” It is not a question of valuation.

This definition does not include language that the business purpose must be unrelated to the volume or value of referrals. However, certain exceptions - such as those for employment or timeshare arrangements – continue to include a requirement that the arrangement must be commercially reasonable even in the absence of referrals. Additionally, CMS added this concept in the new exception for limited remuneration and to the pre-existing FMV exception with this Final Rule. And CMS reiterates that “conduct that violates a criminal law, such as inducing or rewarding referrals in violation of the anti-kickback statute, would not be a legitimate business purpose” and would not be commercially reasonable.

Designated Health Services

In the Proposed Rule, CMS proposed re-defining the term “designated health services” (DHS) to exclude hospital inpatient services “if the furnishing of the service does not affect the amount of Medicare’s payment to the hospital under the Acute Care Hospital Inpatient Prospective Payment System (IPPS).” As noted in the preamble commentary, if a physician involved in a noncompliant financial arrangement with a hospital orders an x-ray for a Medicare patient who is inpatient but the x-ray does not affect the MS-DRG or otherwise impact the rate of payment, then the x-ray would not be considered a designated health service. In the Final Rule, CMS adopted this proposed revision to the definition of designated health services and expanded it to carve out inpatient services that do not impact payment for any of the following Medicare prospective payment systems: (i) Acute Care Hospital Inpatient (IPPS); (ii) Inpatient Rehabilitation Facility (IRF PPS); (iii) Inpatient Psychiatric Facility (IPF PPS); or (iv) Long-Term Care Hospital (LTCH PPS).

Physician

CMS finalized the proposed rule change for the definition of “physician” to cross-reference practitioners incorporated in the statutory definition of physician under section 1861(r) of the Social Security Act (Act), along with such practitioner’s professional corporation.

Referral

CMS finalized its proposed change to the definition of “referral” under the proposed rule to provide that “a referral is not an item or service for purposes of section 1877 of the Act and this subpart.” As stated in the proposed rule, CMS’s intent for this addition to the definition of referral was intended to make clear that it is not appropriate to pay for referrals under the guise that they are items or services.

Remuneration

CMS finalized the definition of “remuneration” in the proposed rule to exclude from the definition “single use” surgical devices “used solely” for one or more statutory purposes, including to collect, transport, process, or store specimens.

Isolated Financial Transactions

Responding to what the agency considers to be an erroneous interpretation of the scope of the isolated transactions exception, CMS proposed to establish an independent definition for the term “isolated financial transaction” and to exclude from its scope “a single payment for multiple or repeated services (such as a payment for service previously provided but not yet compensated).” CMS proposed this change to invalidate what it described as an industry approach of trying to protect an ordinary services arrangement that the parties had failed to document in a writing or get signatures for but had not yet made a payment. CMS adopted this proposal in the final regulations.

Although CMS rejected commenters’ requests that the isolated transactions exception should apply to a single payment for multiple or repeated services over time, CMS acknowledged that the pre-existing definition of “transaction” to mean “an instance or process of two or more persons or entities doing business” may have given stakeholders the impression that their interpretation was justified. Based on this, CMS is deleting the word “process” but stated that the revisions apply prospectively only. CMS also signaled that there may be some limited flexibility regarding what may qualify as a “one-time” isolated transaction, such as potentially a service arrangement where a service or bundle of services is provided in its entirety during a discrete time period of short duration, such as a 24-hour or weekend call coverage shift.

In addition, CMS included language in the “isolated financial transaction” definition and exception to clarify what it called its longstanding policy that a single instance of forgiveness of an amount owed in settlement of a bona fide dispute qualifies for protection under the exception – although the language also provides that the exception will not apply to the compensation arrangement that the parties dispute.

Modification of Ownership or Investment Interests

Titular Ownership or Investment Interest

The Final Rule finalizes the proposed rule’s proposal to extend the concept of titular ownership or investment interest to Stark’s rules governing ownership or investment interests. As finalized, ownership and investment interests would not include titular ownership or investment interests, which is an interest that “excludes the ability or right to receive the financial benefits of ownership or investment, including, but not limited to distribution of profits, dividends, proceeds of sale, or similar return on investment.”

Employee Stock Ownership Program

Similarly, CMS finalized its proposed rule to carve out interests in employee stock ownership plans (ESOPs) as an ownership or investment interest giving rise to an ownership or investment interest for Stark purposes.

Exceptions Available to Protect Indirect Compensation Arrangements

The Stark Law Final Rule sets forth a general rule and two special rules on what exceptions are available to protect indirect compensation arrangements. These rules are to be codified at 42 C.F.R. § 411.354(c)(4). The general rule states that except as otherwise provided in the two special rules, the only exceptions available to protect an indirect compensation arrangement are the indirect compensation arrangements exception, 42 C.F.R. § 411.357(p), and the exceptions applicable to both ownership and compensation arrangements found in 42 C.F.R. § 411.355, such as the exceptions for in-office ancillary services, services provided to enrollees in prepaid plans, and academic medical center services.

The first special rule states that in the case of an indirect compensation arrangement in which the entity furnishing DHS is an MCO or IPA, the exception for risk-sharing arrangements also is available, 42 C.F.R. § 411.357(n), along with the other exceptions identified above. This dovetails with a modification made in the risk-sharing exception. In a departure from the proposed rule, the amended exception pertains to “[c]ompensation paid directly or indirectly by a MCO or an IPA to a physician pursuant to a risk-sharing arrangement (including, but not limited to, withholds, bonuses, and risk pools) for services provided by the physician to enrollees of a health plan.”

The second special rule applies where the unbroken chain of financial relationships includes a “value-based arrangement” to which the physician (or the physician organization in whose shoes the physician stands) is a direct party. In such cases, the arrangement also may be protected by the new exception for value-based arrangements, as well as the exceptions provided for in the general rule. In addition, if the entity that furnishes DHS is an MCO or IPA, the arrangement also may be protected by the risk-sharing exception.

Modification of Writing and Signature Requirements

CMS finalized new special rules related to writing and signature requirements related to compensation arrangements. Under the new special rules, the regulations now expressly provide the following with respect to compensation arrangement exceptions with writing and signature requirements: (i) a writing requirement under compensation arrangement exceptions can be satisfied by a collection of documents, including contemporaneous documents evidencing the course of conduct between the parties; (ii) any signature requirement can be satisfied by an electronic or other signature that is valid under applicable federal or state law; (iii) the writing and signature requirement can be satisfied if (a) the compensation arrangement fully complies with an applicable exception except the writing or signature requirement, and (b) the parties obtain the required writing or signature within 90 consecutive days it became non-compliant with the writing or signature requirement.

Period of Noncompliance

CMS finalized the proposed rule by deleting the provisions setting forth the period of disallowance. Reiterating the points made in CMS’s proposed rule commentary, CMS reasoned that “although the rules were initially intended merely to establish an outside, bright-line limit for the period of disallowance, in application, they appear to be overly prescriptive and impractical.” To determine the period of disallowance, CMS stated in the Final Rule that “the analysis to determine when a financial relationship has ended is dependent in each case on the unique facts and circumstances of the financial relationship, including the operation of the financial relationship as negotiated between the parties, and it is not possible for us to provide definitive rules that would be valid in all cases.” However, CMS clarified that the removal of the period of disallowance regulations does not impact parties who relied on them in the past.

Group Practice Changes, Clarifications, and Updates

Changes and Clarifications on Pooling and Distributing “Overall Profits”

In the Final Rule, CMS provides clarification and guidance regarding the special profit-sharing rules for group practices. In doing so, CMS states that the changes are prospective, with a delayed effective date of January 1, 2022, to allow group practices sufficient time to revise their compensation methodologies and contractual arrangements to be consistent with the clarifying regulations at § 411.352(i) of the Final Rule.

These “clarifications” largely focus on how group practices can pool and then distribute overall profits in a fee-for-service world. In particular, CMS reiterates and clarifies guidance as follows:

• Size of Profit-Sharing Pool. CMS reiterates that group practices can pool DHS either from (i) a subset of 5 or more physicians or (i) all physicians in the group practice – and therefore that a group practice of 4 physicians can pool and distribute overall profits for the entire practice, even though there are fewer than 5 physicians.
• How to Select the Subcomponents of Five or More Physicians. CMS reiterates that a group has latitude in developing criteria and selecting the subcomponents, provided that the selection of the subgroup is not directly related to referrals.
  • CMS gives several examples of potential selection criteria in stating that “a group may establish components of at least five physicians by including physicians with similar practice patterns, who practice in the same location, with similar years of experience, with similar tenure with the group practice, or who meet other criteria determined by the group practice.” (Emphasis added.)
  • Furthermore, CMS further reiterates that not all physicians have to be included in a subgroup, stating “moreover, we are aware that group practices may utilize eligibility standards to determine whether a physician is eligible for a profit share, such as length of time with the group practice, whether the physician is an owner, employee, or independent contractor of the group practice, or the amount of time that the physician practices (for example, full-time or part-time). Nothing in our regulations prohibits the use of eligibility standards.” (Emphasis added.)
• Physicians Cannot Participate in Separate Profit Pools by Service or Treatment Modality. CMS states “if a group practice wishes to pay shares of overall profits to any of its physicians, it must first aggregate: (1) the entire profits from the entire group; or (2) the entire profits from any component of the group that consists of at least five physicians.” Consistent with this requirement, CMS further clarifies that a group practice may not distribute profits from designated health services on a service-by-service basis. In other words, a physician cannot participate in separate imaging and lab pools if the two pools have different physicians participating. CMS notes, further, that this clarification is prospective in nature.
• No Requirement, However, for a Group to Distribute All of its Profits to Physicians. CMS further clarifies that, although aggregating entire profits is the first step, the group is not required to distribute all of the profits: “once aggregated, the group practice may choose to retain some of the profits or distribute all of the profits through shares of overall profits paid to its physicians.”
• Different Subgroups of 5 or More Physicians Can Utilize Different Methodologies for Distributing Profits. CMS notes that “a group practice need not treat all components of at least five physicians the same with respect to the distribution of shares of overall profits from designated health services.” In other words, one subgroup of five physicians may distribute its pooled DHS profits per capita, while another may distribute based on personally performed RVUs. However, each physician within the same subgroup must have the same distribution methodology.

The Final Rule includes a number of other formatting, re-numbering, and other non-substantive changes to the group practice definition, including but not limited to, (i) replacing most references to “group’s profits” and “revenues” with “overall profits” and (ii) deleting references to Medicaid, reiterating that “the definition of “designated health services” includes only those services payable in whole or in part by Medicare.”

New Provision for Distributions Pursuant to a Value-Based Enterprise

CMS creates a new provision that allows distributions of DHS profits that are directly attributable to a physician’s participation in a value-based enterprise, as defined at § 411.351. Please see above regarding the requirements for VBE payments.

CMS provides additional commentary that distributions based on VBE participation should be made based on profits, not revenues, and in doing so, states: “in general, we believe that a group practice’s distribution of revenues to a referring physician rather than profits, which are calculated by deducting the expenses incurred in furnishing the designated health service, could serve as an inducement to make additional and potentially inappropriate referrals to the group practice.”

Additional Ownership Clarifications/Changes Potentially Relevant for Group Practices

As discussed above, there are a couple of additional clarifications that may be relevant for group practice ownership and/or investment interests. They are as follows:

• A physician with a titular ownership or investment interest is not required to meet an ownership/investment exception under Stark.
• Participation in an Employee Stock Ownership Plan qualified under IRC Section 401(a) does not qualify as an “ownership or investment interest” requiring an exception to the Stark Law.

Changes to Compensation Exceptions

New Exception for Limited Remuneration to a Physician

CMS is finalizing a new exception for the provision of limited remuneration by an entity to a physician for items or services actually provided by the physician where the compensation is not set in advance or documented in contemporaneous signed writings. CMS originally proposed that the exception would apply only when the remuneration does not exceed $3,500 per calendar year, but the Final Rule increases the annual limit to $5,000, subject to annual CPI adjustments. The compensation in the limited remuneration arrangement must not exceed fair market value or be determined in a manner that takes into account the volume or value of referrals or other business generated by the physician, and the arrangement must be commercially reasonable. The physician who receives the remuneration may provide the items or services personally, through employees, a wholly-owned entity, or locum tenens physicians. Arrangements that include a directed referral requirement must comply with the corresponding special rule on compensation at 42 C.F.R. § 411.354(d)(4). The exception also incorporates prohibitions on percentage-based and per-unit of service compensation to the extent the remuneration is for the use of premises or equipment (i.e., a timeshare arrangement) or the lease office space or equipment.

In determining whether payments to a physician under this exception exceed the annual aggregate remuneration limit, CMS will not count items or services provided outside of the arrangement, if the compensation for the items or services meets another exception. However, if an entity has multiple undocumented, unsigned arrangements under which it compensates a physician for items or services, CMS will aggregate the compensation under those arrangements for purposes of assessing whether the compensation exceeds the annual remuneration limit.

The new exception may be used in conjunction with other exceptions to protect an arrangement during the course of a calendar year. In the Final Rule, CMS clarified that an entity may rely on the new exception up to the point in a calendar year immediately prior to when the annual aggregate remuneration limit is exceeded. After that point, the ongoing compensation arrangement must either meet another applicable exception, or the arrangement will trigger the Stark Law’s referral and billing prohibitions with respect to the period following when the compensation exceeded the annual remuneration limit.

Elimination of References to the AKS

In the proposed rule, CMS proposed eliminating from Stark exceptions the requirement that the financial relationship not violate the AKS, and that the claim or bill otherwise complies with applicable federal and state laws or regulations governing billing or claims submission. Exceptions that have historically included this requirement as an element of the exception include: temporary noncompliance, academic medical centers, fair market value compensation, indirect compensation, risk-sharing arrangements, nonmonetary compensation, medical staff incidental benefits, physician recruitment, timeshare arrangements, and electronic health records. In the Final Rule, CMS elected to (i) remove the requirement that the arrangement does not violate the AKS from all exceptions, except for the fair market value exception; and (ii) remove requirements pertaining to compliance with federal or state laws or regulations governing billing or claims submission from all exceptions. CMS’s rationale for not removing the compliance with the AKS compliance from the exception for fair market value arrangements is that it applies to many types of arrangements that also could be protected by a statutory exception, but the exception for fair market value arrangements would otherwise include fewer safeguards than those other exceptions. Thus, CMS believes that “requiring that the arrangement does not violate the AKS in the exception for fair market value compensation at § 411.357(l) serves as a substitute safeguard, in lieu of certain safeguards that are included in the statutory exceptions but omitted from § 411.357(l).”

Directed Referrals

The Final Rules include a couple of notable changes to the existing special rule on compensation that allows the inclusion of a directed referrals provision in a physician employment agreement, personal services agreement or managed care contract based on compliance with specified rules. They are as follows:

• Even with a directed referral provision in an arrangement, an entity cannot terminate the arrangement or change the physician’s compensation based on the number or value of referrals that he or she made to a particular provider, supplier, or entity.
• An entity can, however, include a requirement that the provider refer a specified percentage or ratio of patients, and in commentary, CMS notes that the entity can terminate the arrangement if that percentage or ratio of referrals is not met.

From a technical standpoint, the “directed referrals” provision is now included as an element in the new limited remuneration exception, as well as in the pre-existing exceptions for academic medical centers, employment, personal services, physician incentive plans, fair market value compensation and indirect compensation.

Office Space and Equipment Leases

CMS is clarifying its “longstanding policy” regarding the “exclusive use” requirement under the exceptions for the rental of office space and equipment. Those exceptions require, among other things, that the office space or equipment must be used exclusively by the lessee when being used by the lessee. The agency previously advised this requirement was meant to prevent sham or “paper” leases where the lessor continues using the space or equipment during the period(s) ostensibly reserved for the lessee.

To further clarify its position, CMS is adding the following definition to the regulatory text of both exceptions:

For purposes of this [exception], exclusive use means that the lessee (and any other lessees of the same office space [or equipment]) uses the office space [or equipment] to the exclusion of the lessor (or any person or entity related to the lessor). The lessor (or any person or entity related to the lessor) may not be an invitee of the lessee to use the office space [or the equipment].

The agency is also clarifying that the exclusive use requirement does not prevent (i) multiple lessees from using the rented space or equipment at the same time, nor (ii) a lessee from inviting a party other than the lessor (or any party or entity related to the lessor) to use the space or equipment.

As noted below, CMS is also amending the exception for fair market value compensation so that it may now be used for office space and equipment lease arrangements. The fair market value exception lacks an exclusive use requirement.

Fair Market Value Compensation

The Final Rule expands the exception for fair market value compensation by making it available to arrangements for the rental of office space or equipment. Unlike the exception for the rental of office space or equipment, the exception for fair market value compensation does not require a term of at least one year. This means the fair market value exception may now be used to protect short term lease arrangements. (Notably, the existing timeshare exception can be used to address short term arrangements for the use of space, where dominion and control over the space is not transferred between the parties.) The Final Rule also incorporates prohibitions on percentage-based compensation and per-unit of service compensation formulas with respect to the determination of rental charges for the lease of office space or equipment. Additionally, the exception now requires that any arrangement that includes a directed referral requirement must satisfy the corresponding special rule on compensation at 42 C.F.R. § 411.354(d)(4).

Remuneration Unrelated to Designated Health Services

CMS did not finalize any of its proposed revisions to the exception for remuneration unrelated to the provision of designated health services. As background, the industry has long complained that in formulating regulations implementing the Stark statute, CMS has been overly restrictive in imposing limitations on this statutory exception. In the Proposed Rule, CMS considered changes to the regulatory text for the purpose of restoring utility to the exception. Specifically, the agency proposed that remuneration would not relate to the provision of designated health services if it was not determined in any manner that took into account the volume or value of the physician’s referrals, and it is for an item or service that is “not related to the provision of patient care services.” As proposed, services would have been deemed to be not related to the provision of patient care services “if the service could be provided by a person who is not a licensed health care professional.”

Some commenters to the proposed rule expressed concern that expanding the exception without substantial guidance or examples of its application would risk program or patient abuse. After considering these concerns, CMS elected against finalizing the proposed changes, but indicated that it may revisit the issue in future rulemaking.

Payments by a Physician

Historically, CMS took the restrictive position that the exception for payments by a physician was not available where any other Stark exception could apply to a given compensation arrangement. CMS is finalizing its proposal that this exception may apply generally to fair market value payments for items or services made by a physician to an entity furnishing designated health services, but remains unavailable to protect compensation arrangements addressed in one of the other statutory compensation exceptions. The statutory compensation arrangement exceptions are codified at 42 C.F.R. §§ 411.357(a) – (i). This means the payments by a physician exception still does not apply to leases of office space or equipment, among other statutory exceptions. In comparison, the amended exception can be used to protect arrangements that are otherwise addressed by the non-statutory exception for fair market value compensation, compliance with which is generally more burdensome.

Physician Recruitment

CMS is eliminating the signature requirement under the recruitment exception for physician practices that do receive financial benefits under a recruitment arrangement. In commentary to a prior rulemaking, CMS advised that under the recruitment exception, the writing documenting the arrangement must be signed by all parties, including the hospital, the recruited physician, and the physician practice that the physician will be joining, if any. Through the SRDP, the agency has reviewed arrangements in which the terms of the recruitment exception were not met because the physician practice did not sign the recruitment agreement, even though the practice did not receive a financial benefit through the arrangement. This may occur, for example, if the hospital pays remuneration directly to the recruited physician, or if the practice passes through to the physician all payments received from the hospital. In light of CMS’s experience administering the SRDP, the agency is amending the signature requirement so that the physician practice is required to sign the writing if payment is made to the practice and the practice does not pass directly through to the recruited physician all of the remuneration received from the hospital.

Assistance to Compensate a Non-Physician Practitioner (NPP)

An existing compensation exception protects remuneration provided by a hospital, Federally Qualified Health Center (FQHC) or Rural Health Clinic (RHC) to a physician to compensate an NPP to provide patient care services. The Final Rule addresses questions the industry has raised with CMS about this exception.

CMS notes it has received many questions about the meaning of the term “patient care services,” including whether services provided by the individual before becoming an NPP would be “patient care services.” To avoid confusion with the already defined term “patient care services” (which refers to physician services), CMS is defining a new term, “NPP patient care services,” to mean direct patient care services furnished by an NPP that address the medical needs of specific patients or any task performed by an NPP that promotes the care of patients of the physician or physician organization with which the NPP has a compensation arrangement. Under this definition, the exception would be available for an individual who has worked in the hospital’s service area for some period before entering into the arrangement with the physician or physician practice but has not worked as an NPP in that area.

The industry also raised questions about the timing of the arrangements that are permissible under this exception. CMS notes that the underlying policy goal of increasing access to care is not served if the physician is reimbursed by a hospital, FQHC or RHC for overhead costs of current employees or contractors. Therefore, the Final Rule amends the exception to expressly require that the compensation arrangement between the hospital/FQHC/RHC and the physician must start before the physician or physician organization enters into the compensation arrangement with the NPP.

Changes Related to Patient Incentives

The Final Rule provides greater flexibility for the provision of patient incentives under both the AKS and the Beneficiary Inducements CMP. OIG is finalizing a new AKS safe harbor to protect patient incentives in value-based arrangements and another to protect certain patient incentives in ACOs. OIG is also revising the existing safe harbor for local transportation. Because any practice that is permissible under the AKS is also excepted from the Beneficiary Inducements CMP, patient incentives that satisfy the new AKS safe harbors are also permissible under the Beneficiary Inducements CMP. Finally, OIG is codifying the statutory exception to the Beneficiary Inducements CMP for telehealth technologies furnished to in-home dialysis patients.

New Safe Harbor for Patient Engagement and Support

The Final Rule creates a new safe harbor that protects certain arrangements for in-kind patient engagement (PE) tools and supports to improve quality, health outcomes, and efficiency, that are furnished directly by a VBE participant to a patient in a target patient population of a value-based arrangement to which the VBE participant is a party, and that are directly connected to the coordination and management of care. This safe harbor is intended to remove barriers presented by the AKS and the Beneficiary Inducement CMP to providers offering patients beneficial tools and supports to improve quality, health outcomes, and efficiency, by promoting patient engagement with their care adherence to care protocols. The aggregate retail value of protected tools and supports is subject to an annual cap of $500, subject to annual CPI adjustments.

The conditions that a protected PE tool or support would need to satisfy include, but are not limited to the following:

• Offeror. Only PE tools and supports furnished by a VBE participant are eligible for protection. The safe harbor lists certain ineligible entities that may not furnish or otherwise fund or contribute to protected tools and supports: manufacturers, distributors, and wholesalers of pharmaceuticals; pharmacy benefit managers; labs; compounding pharmacies; manufacturers of devices and medical supplies (except for PE tools and supports that are digital health technologies); certain entities or individuals that sell or rent DMEPOs covered by a Federal health care program; medical device distributors and wholesalers; and physician-owned medical device companies.
• Recipients. Patients who may receive protected PE tools and supports must be members of a target patient population. Protected PE tools and supports must be furnished directly to the patient, or indirectly through a caregiver, family member, or another individual acting on the patient’s behalf, by a VBE participant or certain eligible agents.
• Remuneration Protected. PE tools and supports are limited to in-kind items, goods, or services that have a direct connection to the coordination and management of care of the target patient population. Cash and cash equivalents are excluded from safe harbor protection. Protected PE tools and supports may not result in medically unnecessary or inappropriate items or services reimbursed by Federal health care programs, must be recommended by the patient’s licensed health care professional, and must advance one or more the following goals: (i) adherence to a treatment or drug regimen or follow-up care plan; (ii) prevention or management of a disease or condition; or (iii) ensuring patient safety. PE tools and supports may not be exchanged or used by the VBE participant or its eligible agent to market other reimbursable items or services or for patient recruitment purposes. Finally, the availability of a tool or support may not be determined in a manner that takes into account the patient’s insurance coverage.
• Cost-Sharing Obligations. The safe harbor does not protect cost-sharing waivers or other tools and supports designed to effectuate a waiver of beneficiary cost-sharing. OIG explained that cost-sharing in the Medicare and Medicaid programs is required pursuant to statutes and regulations set forth by CMS and state programs, and that in the agency’s view, it would not be appropriate to broadly protect cost-sharing waivers that could obviate such programmatic requirements. The agency also observed that longstanding OIG guidance allows for waivers of cost-sharing amounts based on individualized, good faith determinations of financial need.

Revisions to the Local Transportation Safe Harbor

OIG finalized, with modifications, its proposal to revise the safe harbor for local transportation at 42 C.F.R. § 1001.952(bb) to: (i) expand mileage limits for rural areas (up to 75 miles); and (ii) eliminate mileage limits for transportation of patients discharged from a hospital to their place of residence. OIG declined to increase the mileage limitation above the proposed 75 miles or remove limits altogether for “special patient populations,” such as patients undergoing cancer or behavioral health treatment, as suggested by some commenters. OIG reiterated the importance of maintaining a “bright line” standard that is practical and clear to administer from a compliance perspective, but also acknowledged that the safe harbor does not provide a “one-size-fits-all” solution and that failure to meet the safe harbor does not make the arrangement per se unlawful. Additionally, OIG noted that certain arrangements may qualify for protection under the new patient engagement and support harbor at 42 C.F.R. § 1001.952(hh).

OIG modified the proposed language to remove the mileage limitation for post-discharge transport to a residence for patients who are either “discharged from an inpatient facility following inpatient admission” or “released from a hospital after being placed in observation status for at least 24 hours.” OIG was persuaded by commenters to expand the safe harbor to include discharge after 24-hour observation, finding it to be “sufficiently similar” to transportation home following inpatient discharge and stating a desire to “prevent any safe harbor compliance challenges resulting from a patient’s status as an inpatient or outpatient in the hospital.” OIG declined, however, to remove the mileage limitation for other categories of outpatients, including those seen in the emergency department but not under observation for at least 24 hours, or patients discharged from an ambulatory surgery center. OIG cited difficulty in defining acceptable medical justifications or category distinctions, as well as concern that expansion to include additional categories would create an overly broad exception. OIG also declined to extend protection for transportation to locations other than a residence, but clarified that “residence” may include custodial care facilities and homeless shelters under certain circumstances, and reaffirmed that residence may also include the residence of a friend or relative who is caring for the patient post-discharge. OIG also considered, but declined to extend, safe harbor protection for health-related, nonmedical purposes, reiterating concerns expressed in the 2016 Final Rule that the risk of improper inducement to obtain items or services is too high. However, OIG noted that the new safe harbor at 42 C.F.R. § 1001.952(hh) may protect protection for other types of patient transportation arrangements offered by VBE participants under certain conditions.

OIG confirmed that an eligible entity may make free or discounted local transportation available through ride-sharing arrangements or other future means of local transportation, such as “self-driving cars,” but did not revise the safe harbor language to expressly address these types of services to avoid being overly prescriptive and allow for flexibility.

New Safe Harbor for ACO Beneficiary Incentive Programs

OIG finalized, without modification, the proposed new safe harbor at 42 C.F.R. § 1001.952(kk) that protects incentive payments made by an ACO to an assigned beneficiary under a Beneficiary Incentive Program established under Section 1899(m) of the Social Security Act. Under the MSSP, ACOs in certain two-sided models may operate CMS-approved ACO Beneficiary Incentive Programs to provide incentive payments to assigned beneficiaries who receive qualifying primary care services. The Bipartisan Budget Act of 2018 (the Budget Act) amended the Social Security Act by adding an exception to the definition of “remuneration” under the AKS for such incentive payments that meet the requirements and conditions set forth under Section 1899(m). The new safe harbor codifies this statutory exception and includes language clarifying that incentives may be furnished only to the ACO’s assigned beneficiaries, but does not impose additional conditions. OIG stated in the Final Rule that it does not interpret the statutory exception or safe harbor to require satisfaction of any requirements found outside of Section 1899(m), including the regulatory requirements established by CMS at 42 C.F.R. § 425.304(c) implementing the ACO Beneficiary Incentive Program.

Telehealth Exception to Beneficiary Inducements CMP for In-Home Dialysis

OIG finalized with modification its proposed new exception to the definition of “remuneration” under the Beneficiary Inducements CMP for the provision of certain telehealth technologies related to in-home dialysis services. The exception is intended to codify the statutory exception in the Budget Act that permits an individual with ESRD receiving home dialysis to elect to receive their monthly ESRD-related clinical assessments via telehealth, if conditions are met.

The final rule expands application of the exception to the provision of such telehealth technologies by providers of services, renal dialysis facilities as well as by physicians. The provider, physician, or renal dialysis facility needs to be currently providing the patient in-home dialysis, telehealth visits, or other ESRD care, and the technologies may not be offered as part of any advertisement or solicitation. OIG eliminated the other following proposed conditions: (i) protected technologies need to “contribute substantially” to the provision of ESRD-related telehealth services and cannot be excessive in value nor duplicative of technology already owned by the beneficiary if that technology is adequate for the telehealth purposes; and (ii) providers and facilities are prohibited from shifting the cost of the telehealth technologies onto Federal healthcare programs, payors, or individuals. OIG instead replaced those conditions with a requirement that the telehealth technologies be provided for the purposes of furnishing telehealth services related to the individual’s ESRD.

For purposes of the exception, OIG broadened the definition of “telehealth technologies” to mean “hardware, software, and services that support distant or remote communication between the patient and provider, physician, or renal dialysis facility for diagnosis, intervention, or ongoing care management. The proposed definition had referenced specific types of technology. OIG noted in the final rule preamble that the final definition is “technology agnostic” and includes all technologies that OIG proposed would be protected as well as technologies that OIG specifically proposed to exclude, such as fax machines, telephones, and electronic mail systems.

Cybersecurity Technology and Electronic Health Records

New Stark Law Exception and AKS Safe Harbor for Donations of Cybersecurity Technology and Related Services

The agencies have finalized the proposed new Stark Law exception and AKS safe harbor designed broadly to permit non-monetary donations of cybersecurity technology and related services. The regulations have been finalized substantially as proposed, with the key difference that the agencies have decided to permit the donation of hardware under the new regulations. As with the proposed regulations, the final regulations are refreshingly short and simple and appear to be designed for straightforward implementation. The final regulations retain the agencies’ proposal not to require any cost contribution by the recipient.

The Stark Law exception and AKS safe harbor will protect donations of cybersecurity technology and related services that are necessary and used predominantly to implement, maintain or reestablish cybersecurity or, in the case of the AKS safe harbor, “effective” cybersecurity. “Cybersecurity” is defined to mean the process of protecting information by preventing, detecting and responding to cyberattacks. “Technology” means any software or other types of information technology, and the definition does not exclude hardware as it did in the proposed regulations.

To ensure that donated technology or services are necessary and used predominantly for cybersecurity purposes, the agencies believe that the “core function” of the donated technology or service must be to protect information by preventing, detecting and responding to cyberattacks. More general purpose technology or services that are otherwise used in the recipient’s business, such as general IT help desk services, are not be protected, although cybersecurity-specific help desk services are permissible.

Protected technology could include malware prevention software; software security measures to protect endpoints that allow for network access control; business continuity software that mitigates the effect of cyberattacks; encryption software; and email traffic filtering software. Software can be cloud-based or locally installed. Services could include any services associated with developing, installing and updating cybersecurity software; any kind of cybersecurity training; cybersecurity services for business continuity during and after a cyberattack; “cybersecurity as a service” models that rely on a third-party service provider to manage, monitor or operate cybersecurity of a recipient; cybersecurity risk assessments, vulnerability analysis or penetration testing; and services associated with the sharing of information about known cyber threats. The regulations would even protect the provision of a full-time cybersecurity officer if all applicable requirements are met. Covered donations can include technology that is neither software nor a service, such as an Application Programming Interface or API.

Again, the final regulations will permit donations of cybersecurity hardware, including, for example, encrypted servers, encrypted drives and network appliances, so long as the hardware is necessary and used predominantly to implement, maintain or reestablish cybersecurity. If an encrypted server is used predominantly to host the computer infrastructure of a recipient, it would not satisfy the “necessary and used predominantly” requirement, even if the server had ancillary cybersecurity uses and functionality. Cybersecurity technology and related services would not include donations of installation, improvement or repair of infrastructure related to physical safeguards, such as upgraded wiring or the installation of high security doors. Payment of ransom on behalf of the recipient also would not be protected.

Both final regulations require that (i) neither the eligibility of the recipient for the technology or services, nor the amount or nature of the technology or services, directly take into account the volume or value of the referrals or other business generated between the parties; and (ii) neither the recipient nor the recipients’ practice makes receiving technology or services, or the amount or nature of the technology or services, a condition of doing business.

The agencies state that they understand and expect that a donor would provide cybersecurity technology and related services only to recipients that connect to the donor’s systems, but that the proposed requirements are not intended to require, for instance, that a health system donor donate cybersecurity technology or services to every physician who connects to its systems. Donors would be able to select recipients and the nature and amount of donated technology and services in a variety of ways, such as by performing risk assessments, based on the nature and risk of the interface, or by virtue of a physician’s membership on a hospital’s medical staff – so long as decisions regarding eligibility or the amount and nature of services are not determined in a manner that directly takes into account the volume or value of referrals or other business generated. As in the proposed regulations, the final AKS safe harbor explicitly states that the donor cannot condition the donation of technology or services or the amount or nature of such technology or services on future referrals, but the Stark Law exception does not contain a similar requirement.

Another difference that has survived in the final regulations relates to the writing requirements. The Stark Law exception requires only that the arrangement be documented in writing, while the safe harbor requires a writing, signed by the parties, that contains a general description of the technology and services being provided and the amount of the recipient’s contribution, if any. OIG did back off of its proposed requirement that the parties enter into a written agreement, and OIG stated in preamble commentary that there need not be a single writing.

As noted above, the Stark Law exception requires that cybersecurity technology and services must be necessary and used predominantly to implement, maintain or reestablish cybersecurity, while the AKS safe harbor requires that the donation be necessary and used predominantly to implement, maintain or reestablish “effective” cybersecurity. Given the considerable efforts of the agencies to make the new regulations as similar as possible, the failure to reconcile the regulations around this single word tends to lend considerable significance to the word, but we are left in the dark as to what the agencies think the difference means. CMS commented that it elected not to use the word “effective” in order to avoid disagreements about what it effective cybersecurity in the context of the strict liability of the Stark Law.

Neither the safe harbor nor the exception limit the possible donors in the manner that the EHR donation regulations do, as described below. In particular, laboratory companies, excluded from protection under the EHR donation regulations, are not similarly excluded as donors under the cybersecurity technology and services donation regulations. In addition, the AKS safe harbor does not limit eligible recipients, which can include patients. Finally, the regulations do not limit the object of the cybersecurity technology and services, meaning that the donated items and services can be used to protect EHRs, medical devices or other information technology.

EHR Donation Regulations

The agencies proposed to modify the EHR donation regulations to incorporate prohibitions on information blocking, to clarify the applicability of the regulations to the donation of certain cybersecurity technology and services, and to eliminate the sunset provision. The agencies also solicited comments on possible revisions to the requirement that recipients of donated EHR technology and services contribute at least 15% of the donor’s cost. Finally, the agencies proposed to eliminate the prohibition on furnishing EHR technology that is equivalent to items or services already possessed by the recipient. In the Final Rule, the agencies eliminated the sunset requirement and the equivalent technology donation prohibition but declined to modify the minimum 15% cost sharing requirement.

One of the most significant issues on the table in the proposed regulations was consideration of whether to modify or even eliminate the requirement that a recipient of EHR software and services must contribute at least 15% of the donor’s cost. In the proposed rules, the agencies did not propose any specific changes to the cost sharing requirement but invited comments on several possible changes, including whether to modify or eliminate cost sharing for small or rural physician organizations, or for updates to previously donated EHR software or technology, or whether to simply eliminate cost sharing entirely for all recipients. Ultimately, however, the agencies decided to retain the minimum 15% cost sharing obligation for all recipients, concluding that the cost sharing obligation is an important check on potentially abusive arrangements and would incentivize recipients “to make economically prudent decisions and accept only items and services that they need.” The agencies did modify the requirements for the timing of cost sharing payments for donations of software and services to make EHR updates. In particular, although the cost sharing must be paid up front for an initial or replacement donation of EHR items and services, the donor’s costs for EHR updates do not have to be paid up front. The Stark EHR donation exception requires that the cost contribution can be paid “at reasonable intervals,” and the safe harbor states only that the cost contributions for an update need not be paid in advance of the update.

The current EHR donation regulations apply to certain software and services necessary and used predominantly to create, maintain, transmit, or receive electronic health records. The agencies proposed a language change to clarify that the EHR donation regulations are applicable to cybersecurity software and services that “protect” electronic health records. The agencies also noted their view that the EHR donation regulations always protected such software and services. The agencies now have codified this change as proposed to explicitly include “cybersecurity software and services” within the EHR items and services that permissibly may be donated under the EHR donation regulations, and to include the word “protect” along with “create, maintain, transmit or receive.”

The agencies recognized the overlap between this aspect of the EHR donation regulations and the separate regulations applicable solely to donations of cybersecurity technology and services, discussed above, but rejected commenters’ concerns that the overlap could cause confusion. The agencies believe that it is beneficial to have flexibility and options. According to the agencies, parties can structure EHR donations that include cybersecurity software and services in a single arrangement that would fall entirely within the EHR donation regulations, or in the alternative could structure the cybersecurity component as a separate arrangement that instead would be protected under the cybersecurity donation regulations. Parties might choose to do the latter, for instance, to avoid the cost contribution requirement of the EHR donation regulations.

The EHR donation regulations require that EHR software be “interoperable” and include a requirement that a donor not take any action to limit or restrict the use, compatibility or interoperability of the items or services with other electronic prescribing or EHR items or services. The latter requirement was designed to prevent misuse of the EHR donation regulations to create data and referral “lock-in” and to promote the free exchange of data. The agencies noted that there has been significant evolution in the understanding of this concept based on the anti-“information blocking” provisions of the 21^st Century Cures Act and proposed regulations issued thereunder, which now have been finalized (collectively, the “Cures Act”). Accordingly, the agencies proposed to modify the EHR donation regulations to contain specific prohibitions on information blocking updated to correspond to the Cures Act. However, the agencies ultimately determined that the Cures Act itself is better suited to police information blocking and therefore elected to eliminate the pre-existing information blocking provision from the EHR donation regulations.

In the proposed regulations, the agencies discussed the rationale behind setting an expiration date for the EHR donation regulations, which had been slated to sunset on December 31, 2021. According to the agencies, they had believed that the need for the EHR donation regulations, originally promulgated in 2006, would diminish over time as the use of EHR technology became a standard and expected part of practice. The agencies no longer subscribe to this view and, accordingly, have eliminated the sunset provisions and made the EHR donation regulations permanent.

The agencies also proposed to delete the prohibition on furnishing EHR technology that is equivalent to items or services already possessed by the recipient. Currently, the EHR donation regulations require that the donor cannot have actual knowledge of or act in reckless disregard or deliberate ignorance of the fact that the physician possesses or has obtained items or services equivalent to those provided by the donor. Commenters have noted that recipients of donated EHR technology get “locked in” to the donated technology because they cannot afford the cost of improved technology that may nevertheless be viewed as equivalent technology. The agencies now have finalized their proposal to remove the requirement prohibiting the replacement of equivalent technology. The minimum 15% cost sharing requirement and all other requirements will apply to such replacements just as they would to a new donation, which the agencies now view as an adequate safeguard against unnecessary replacements.

The final EHR donation safe harbor also expands the scope of protected donors. Currently, the safe harbor protects donors that either are (i) health care providers, other than laboratory companies, that provide and bill Federal health care programs for services; and (ii) health plans. The safe harbor now has been modified to protect not just qualifying providers themselves but also by entities “comprised of” such entities. The purpose of this change is to make the safe harbor applicable to, for example, “parent companies of hospitals, health systems, and accountable care organizations.” There is no corresponding change to the Stark exception, which continues to apply only to DHS Entities that are not laboratory companies.

Modifications to the Warranties Safe Harbor

OIG finalized as proposed the modifications to the warranties safe harbor under 42 C.F.R. § 1001.952(g), including modifications to: (i) expand safe harbor protection for “bundled” warranties meeting certain conditions, including that all federally reimbursable items and services subject to the bundled warranty arrangement be reimbursed by the same Federal health care program and in the same payment (the “same program/same payment requirement”); (ii) exclude beneficiaries from the reporting requirements applicable to buyers; and (iii) define “warranty” directly under the safe harbor to clarify availability of the safe harbor for drugs and devices regulated under the Federal Food Drug and Cosmetic Act (FCDA) and address bundled items and services.

Bundled Warranties

Under the current language, “remuneration” does not include “any payment or exchange of anything of value under a warranty provided by a manufacturer or supplier of an item to the buyer…of the item.” The Final Rule revises the language to state that remuneration does not include payments or exchanges of value under a warranty provided by a manufacturer or supplier “of one or more items and services (provided the warranty covers at least one item) to the buyer….of the items and services.” Thus, under the expanded language, safe harbor protection would be available for warranty arrangements that cover one or more items, as well as arrangements that cover items and services, but not for “services-only” warranty arrangements. OIG confirmed that items and services subject to a warranty may include services offered by a manufacturer that are not federally reimbursable and offered free of charge, but emphasized that the warranties safe harbor protects remuneration provided as a warranty remedy and does not protect the services themselves. Additionally, the warranties safe harbor would not protect any free items and services ancillary to the warranty arrangement that could have independent value to a buyer.

OIG finalized the proposed conditions for bundled arrangements, specifically: (i) revisions to paragraph (g)(4) to cap the amount a manufacturer or supplier may pay for medical, surgical or hospital expenses incurred by a beneficiary to the cost of the items and services subject to the warranty; (ii) addition of new paragraph (g)(5) with the “same program/same payment requirement;” and (iii) addition of new paragraph (g)(6) that prohibits a manufacturer or supplier from conditioning a warranty on a buyer’s exclusive use or minimum purchase of any of the manufacturer’s items or services.

Definition of Warranty

OIG finalized its proposal to define the term “warranty” directly in the safe harbor as a new paragraph (g)(7). The definition largely mirrors the prior definition incorporated by reference from 15 U.S.C. § 2301(6) but modifies the language to reference single-item and bundled warranties rather than consumer products.

OIG confirmed its interpretation stated in the Proposed Rule that the definition of “warranty” could apply to warranty arrangements conditioned upon clinical outcomes guarantees, but declined to provide specific examples of such arrangements so as not to “narrow the scope of innovative arrangements that might seek coverage under the safe harbor.” OIG did note, however, that that clinical outcomes guarantees could potentially include warranties conditioned upon value-based outcomes.

OIG also confirmed in response to comments that “reperformance of services” may qualify as “other remedial action” under the definition so long as that the total remuneration does not exceed the cost of the items and services subject to the bundled warranty arrangement and all other safe harbor conditions are met. Partial refunds and retrospective rebates resulting in a price adjustment may also qualify as other remedial action.