The authors wish to thank Kira Mann and Pamela Casey for their contributions to this content.
On September 10, 2019, the Centers for Medicare & Medicaid Services (CMS) published a final rule significantly expanding its authority to deny or revoke participation in Medicare, Medicaid or the Children’s Health Insurance Program (CHIP) based on any direct or indirect affiliation with any person or entity that has an outstanding Medicare debt; has previously had their Medicare, Medicaid or CHIP billing privileges denied or revoked; has been placed under a payment suspension; or, has been excluded from participation in federal healthcare programs. With this, and other new enforcement authorities implemented by the final rule, CMS enacts congressional mandates aiming to prevent bad actors from continuing to bilk Medicare, Medicaid and CHIP programs by moving from one enrolled entity to another. Although a laudable goal, the broad authorities and expansive definitions in the final rule leave much of the impact on providers and suppliers to CMS’ discretion.
The rule will affect all providers and suppliers, but not immediately. CMS softened its approach by initially requiring providers and suppliers to report “affiliate” information only upon request. CMS plans to phase-in front-end reporting of affiliate information over time. Regardless of timing, the final rule’s commentary makes clear CMS’ high expectations for enrollment information accuracy and timely reporting of enrollment changes. That commentary, in combination with the expanded authorities to deny and revoke enrollments, signals, now more than ever, that providers and suppliers should ensure their enrollment information is accurate and they have systems in place to timely update that information when changes occur. Large healthcare organizations may want to consider implementing mechanisms to track and document “affiliate” related “disclosable events” to enable them to quickly – and accurately – respond to CMS requests. Failure to respond timely may result in a delay in enrollment.
Despite three years having passed since CMS issued the proposed rule discussing these potential changes, the final rule implements many of the original proposals. Below we outline CMS’ new authorities, the new reporting requirement, who qualifies as affiliate, what events trigger disclosures, and CMS’ next steps for implementation. The final rule with comment period is effective on November 4, 2019.
Currently, for enrollment, provider and suppliers are required to disclose various relationships regarding ownership and control, certain organizational changes, and final adverse actions (e.g., criminal convictions). Once CMS revises its enrollment forms to include an affiliation disclosure section, providers and suppliers will be required to disclose affiliations upon CMS’ request in connection with initial enrollment and revalidation. For now, CMS plans to request affiliation disclosures from providers and suppliers when CMS has determined that one such disclosable affiliation exists. Upon CMS’ request, providers and suppliers will have to disclose any and all affiliations that they, or any of their owners (5% direct or indirect interest) or managing employees or organizations, have, or have had within the previous five years, that had a disclosable event. Thus, the disclosure is not limited to affiliations identified by CMS.
CMS may deny or revoke enrollment if a provider or supplier fails to fully and completely disclose an affiliation when the provider or supplier “knew or should reasonably have known” of the affiliation. This knowledge standard aims to ease the disclosure burden where it is difficult to obtain affiliation data. For example, CMS seems to recognize that providers and suppliers may not know (or reasonably be able to determine) whether passive investors, such as through pension funds, have a disclosable event. CMS also recognized that it is less likely that a provider or supplier would know of a disclosable event that occurred after an affiliation has ended. Fortunately, CMS did not finalize its proposal to require providers or suppliers to report new or changed information regarding existing affiliations. CMS agreed with commenters that this reporting standard would be burdensome on providers and suppliers who have already disclosed affiliations during the enrollment process.
CMS may deny or revoke enrollment if CMS determines a disclosed affiliation poses an undue risk of fraud, waste or abuse. To assess whether an affiliation constitutes an undue risk, CMS will consider the following criteria:
CMS may issue sub-regulatory guidance concerning the process by which it will analyze undue risk determinations.
To comply with the new rules, providers and suppliers will need to identify (i) all relevant affiliations of the entity, its direct and indirect owners (5% or more) and its managing employees and organizations and (ii) whether any of those affiliations have had a disclosable event.
Affiliation Defined. CMS defines “affiliation” to include five types of interests:
The first four types of interests remain consistent with the definitions of “owner” and “managing employee” in § 424.502. The fifth type, any reassignment relationship, broadly includes – among other things – any employee or independent contractor practitioner relationship.. For example, CMS notes that if a physician director falls within the definition of managing employee, he or she must be reported as part of the existing enrollment process. If that physician director was previously a managing employee of another provider/supplier with a disclosable event, that affiliation must be reported (upon request, initially).
Disclosable Events Defined. The disclosable events that would trigger the disclosure requirement include:
Lookback Period. Any affiliation that occurred in the last five years must be reported, regardless of whether the disclosable event occurred before, during or after the affiliation ended. This timeframe extends back from the date on which the application is submitted. CMS deemed that a sufficient look-back period was necessary because a past affiliation could be an “indicator of a disclosing party’s future behavior.” There is no look-back limitation for historic disclosable events, meaning that providers and suppliers must report disclosable events occurring more than five years ago if the affiliation occurred in the last five years.
In addition to the authorities discussed above, the final rule makes several other noteworthy changes to the Medicare rules, many of which further expand CMS’ ability to deny or revoke enrollment, or prevent re-enrollment.
In addition, the final rule also establishes similar affiliation reporting requirements applicable to the Medicaid and CHIP Programs. Concerning these programs, CMS offers states two options to implement the new rules, both of which focus on initial enrollments of providers and suppliers, who are not otherwise enrolled in Medicare. Under the first option, initial enrollments would automatically include disclosure of any and all affiliations of the enrolling party, its owners, or managing employees or organizations. Under the second option, disclosure would only be required upon the state’s request, which requests will be made in consultation with CMS after identifying a potential disclosable affiliation. States cannot implement the disclosure components until each state’s Medicaid or CHIP applications are updated to collect the data. The timing of the updates to each state’s applications will vary.
This final rule demonstrates how important it is for providers and suppliers to maintain accurate and up-to-date enrollment information. CMS now has numerous avenues to revoke, deny and place re-enrollment bars on providers and suppliers for a variety of behaviors, extending those rights to not only the provider or supplier that ran afoul, but also – at CMS’ discretion – to any other locations or affiliated enrolled providers or suppliers.
As a result, providers and suppliers should: