CMS Strengthens Program Integrity through New Enrollment Requirements and Authorities.
The Centers for Medicare & Medicaid Services (CMS) recently released a final rule to strengthen program integrity within the Medicare, Medicaid, and Children Health Insurance Plan (CHIP) enrollment process. Specifically, the rule requires providers and suppliers to disclose certain ownership and management affiliations. The rule also provides CMS with greater authority to deny or revoke a provider or supplier’s Medicare, Medicaid, or Children Health Insurance Plan (CHIP) enrollment or revalidation in certain cases. CMS notes that it has long shared similar concerns as the Department of Health and Human Services (HHS) Office of Inspector General (OIG) that there are providers and suppliers who accumulate large debt or engage in improper activities, who then voluntarily or involuntarily depart Medicare or another federal health care program, and subsequently resume these same practices when either reentering the program in another capacity or shifting their activities to another affiliated provider or supplier. This final rule aims to reduce that risk at the time of enrollment or revalidation rather than after the provider or supplier has committed another act of fraud or abuse.
Disclosures of Affiliations
Medicare, Medicaid, and CHIP providers and suppliers will be required to disclose their past or present, direct and indirect affiliations when enrolling or re-enrolling in Medicare, Medicaid, or CHIP. For the Medicare program, the rule defines “affiliation” as any individual having: (1) a five percent or greater indirect or direct ownership interest in an organization; (2) a general or limited partnership interest in another organization regardless of the interest percentage; (3) an interest in which an individual or entity exercises operational or managerial control over day-to-day operations for an organization regardless of whether the individual is a W-2 employee; (4) an interest in which the individual is acting as an officer or director of an organization; or (5) any reassignment as defined under 42 CFR §424.80. The definition of “affiliation” for the Medicaid program is largely the same, but instead of applying the definition of reassignment under 42 CFR §424.80, CMS and the states will apply the definition of reassignment under 42 CFR §447.10(g).
The final rule further clarifies the definition of affiliation in response to public comments on the earlier proposed rule. CMS confirms that the affiliation reporting requirements apply to both for profit and non-profit organizations, and to passive investors such as large mutual or pension funds associated with health care providers and suppliers. Additionally, CMS notes that managers referred to in the definition of affiliation include all individuals who directly or indirectly conduct the provider’s day-to-day operations. CMS clarified that even if the individual was not responsible for operations that are often vulnerable to fraud, waste, and abuse such as billing or physician contracts, they still fall within the definition of affiliations. CMS reports that it will issue subregulatory guidance to further clarify the “affiliation” definition.
Disclosable Events
Medicare, Medicaid, and CHIP suppliers and providers must disclose any affiliations they had in the past five years that experienced a disclosable event. The timing of the disclosable event is not relevant; the supplier or provider must disclose the affiliation even if the disclosable event happened prior to or after the termination of the affiliation. Under the disclosable event provision, a provider or supplier must disclose if it has an affiliate that: (1) has an uncollected debt to Medicare, Medicaid, or CHIP including overpayments for which CMS has provided notice of the debt and civil monetary penalties; (2) has been or is subject to a payment suspension under federal health care programs; (3) has been or is currently excluded by the OIG from participation in Medicare, Medicaid, or CHIP; or (4) has had its enrollment denied, revoked, or terminated.
CMS requires providers and suppliers to report the information related to reportable events that they knew or should reasonably have known. The agency recognizes that some of the data required for disclosure is not easily available to enrolling suppliers or providers through public databases. As such, CMS will apply a reasonableness standard when evaluating the provider or supplier’s knowledge of its affiliates’ data, for purposes of the disclosure to the state or CMS. CMS seeks further comments on the reasonableness standard and how it should be applied to CMS’ evaluations of enrollment.
Undue Risk
The final rule provides CMS with the authority to deny or revoke a provider or supplier’s enrollment or revalidation if it determines that the reported affiliation poses an undue risk of fraud, waste, or abuse. CMS will make this determination on a case-by-case basis and will consider all relevant factors. CMS has indicated that it will consider: (1) the length and period of the affiliation; (2) the nature and extent of the affiliation; and (3) the type of disclosable event and when it occurred. The agency notes that it may consider additional factors when determining the level of risk posed by the affiliate.
Additional Enrollment Authorities
The final rule also provides CMS with the authority to:
- Deny or revoke a provider or supplier’s Medicare enrollment if they are revoked under another name, numerical identifier, or business identity, and the applicable reenrollment bar period has not expired;
- Revoke a provider or supplier’s Medicare enrollment and revoke all its practice location enrollments if the provider or supplier billed from a location that it knew or should have known did not comply with Medicare enrollment requirements;
- Revoke a physician or eligible professional’s Medicare enrollment if he or she has a pattern or practice of ordering, certifying, referring or prescribing services, items, or drugs that are abusive, non-compliant, or threaten the health and safety of beneficiaries;
- Increase the maximum reenrollment bar from 3 to 10 years with some exceptions;
- Bar a provider or supplier from enrolling in Medicare for up to three years if the provider or supplier submitted false or misleading information on the Medicare enrollment application, including omitting information;
- Revoke a provider or supplier’s Medicare enrollment if the provider or supplier has existing debt that CMS has referred to the U.S. Department of Treasury; and
- Deny a provider or supplier’s Medicare enrollment if the provider or supplier is currently barred from Medicaid participation or has a license that is currently revoked or suspended in another state.
CMS will accept comments on the final rule until November 4, 2019, which is also the rule’s effective date. However, the specific CMS affiliation reporting requirements will not be effective until CMS issues additional subregulatory guidance and amended enrollment forms. Once the guidance and amended forms are issued, CMS will use a “phased-in” approach; the affiliation reporting requirements will at first apply to a subset of providers and suppliers that CMS has identified as having at least one applicable affiliate.
The final rule with comment is available at:
https://www.govinfo.gov/content/pkg/FR-2019-09-10/pdf/2019-19208.pdf.