Overview of Regulations Requiring Medicaid and Medicare Revalidation and New Enrollment Screening Procedures for Providers and Suppliers
I. Background to Changes to Medicare and Medicaid Provider Enrollment
The days of free provider agreements with minimal strings and traps are no more. The enactment of the Affordable Care Act (ACA)[1] has resulted in several changes to Medicare and Medicaid programs. The program changes that require the most awareness and response by health care providers of all types are changes to the enrollment process. The purpose of these changes, as explained in the Federal Register, is to “enhance the provider and supplier enrollment process to improve the integrity of the programs to reduce fraud, waste, and abuse.”[2] Providers and suppliers will now be subject to different enrollment screening criteria based on their risk level, and the new regulations also require Medicaid and Medicare providers and suppliers to participate in a periodic revalidation process. The following will give providers and suppliers an overview of the revalidation process, a succinct description of the new screening requirements, and highlight similarities and differences between the changes to Medicare and Medicaid regulations.
II. Overview of Medicare Revalidation Process
Changes to the ACA require that Medicare enrolled providers and suppliers must revalidate their enrollment information pursuant to new screening criteria. This revalidation process will only apply to those providers and suppliers who were enrolled in Medicare prior to March 25, 2011.[3] Affected providers and suppliers will receive a revalidation notice in the mail from their Medicare administrative contractor (MAC) and should only complete the revalidation process when they receive notice to do so.[4] CMS has stated that revalidation notices will continue to be mailed up until March 2015 on an “intermittent, but regular basis.”[5] Although providers and suppliers have been advised by CMS not to complete the revalidation process until they receive the notice, it is important for all providers and suppliers to be prepared to respond quickly as the regulations only allow sixty (60) calendar days from the postmarked date of the notification letter for providers and suppliers to submit the applicable enrollment application with supporting documentation.[6] Providers and suppliers that do not submit the necessary paperwork within this timeframe are subject to suspension from Medicare. For a sample revalidation letter, see Attachment A. Providers and suppliers should also familiarize themselves with the enhanced screening levels described in Section III below to determine whether they will be required to have a site visit or fingerprinting of individuals with a five (5) percent or greater direct or indirect ownership in the provider.
To date, three batches of revalidation notices have been mailed out. For providers and suppliers who do not know whether they have received a revalidation notice, CMS has a list of all provider and supplier notices mailed to date.[7] The revalidation process can be completed either online on the Internet-based PECOS system or by completing the CMS-855 Medicare Enrollment paper application.[8] Both options require signature on a certification statement. Upon revalidation, “institutional providers” will also be required to pay an application fee. The ACA excludes certain professionals, such as physicians and nurse practitioners from paying enrollment application fees, therefore the providers and/or suppliers subject to the application fee requirement would be “be any health care provider that bills Medicare, Medicaid, or CHIP on a fee-for-service basis, with the exception of Part B medical groups or clinics and physician and nonphysician practitioners who submit the CMS 855I to enroll in Medicare.”[9] The application fee for the 2012 calendar year is $523.00.[10]
The revalidation process does not affect other ongoing Medicare notification requirements such as provider/supplier change of address, change of ownership, addition of practice location, etc.
The new revalidation requirements also do not limit CMS to revalidation every five (5) years (three (3) years for DMEPOS suppliers); instead they are given the right under the new regulations to require revalidation on a more frequent basis due to complaints or evidence that a specific provider or supplier type is not complying with Medicare statutes and/or regulations.[11] On the other hand, CMS can require less frequent revalidation if evidence supports that a less frequent revalidation schedule is warranted.[12] In either event, CMS will provide notice ninety (90) days prior to implementing the change.[13] CMS may require additional “off-cycle” revalidation for a provider or supplier outside the 5-year revalidation cycle. CMS is required to notify the provider or supplier if off-cycle revalidation is required and any such revalidation will be conducted in accordance with the new screening criteria described below.[14]
III. New Screening Requirements for Medicare Providers
One of the biggest changes to Medicare regulations under the ACA is the implementation of enhanced screening levels. Providers and suppliers will be placed in “limited”, “moderate” or “high” risk screening levels based on provider or supplier type. The chart below shows the three screening levels, along with the provider and supplier types covered under that screening level and the screening requirements.
| Screening Level | Provider Type | Screening Requirements |
| Limited |
| For providers/suppliers designated as “limited” risk level, the Medicare Contractor will do the following:
(i) Verify that the provider/supplier meets all applicable Federal regulations and State requirements prior to enrolling or denying the provider/supplier.
(ii) Conduct license verifications. This will include license verifications across state lines for physicians or nonphysician practitioners and providers and suppliers that obtain or maintain Medicare billing privileges as a result of State licensure, including State licensure in States other than where the provider/supplier is enrolling.
(iii) Conduct database checks on a pre- and post-enrollment basis to ensure the providers/suppliers continue to meet enrollment criteria.[16] |
| Moderate |
| For providers/suppliers designated as “moderate” risk level, the Medicare Contractor will do the following:
(i) Perform all the limited screening level requirements listed above.
(ii) Conduct an on-site visit.[18]
|
| High |
| For providers/suppliers designated as “high” risk level, the Medicare Contractor will do the following:
(i) Perform all the limited and moderate screening level requirements listed above.
(ii)(A) Require the submission of a set of fingerprints for a national background check from all individuals who maintain a 5 percent or greater direct of indirect ownership in the provider or supplier; and
(B) Conduct a fingerprint-based criminal history record check of the FBI’s Automated Fingerprint Identification System on all individuals who maintain a 5 percent or great direct or indirect ownership interest in the provider/supplier.[20] |
While many providers and suppliers will fall into the “limited” and “moderate” categories, it is important to note that CMS will adjust a provider or supplier’s screening level to “high” if CMS has imposed a payment suspension on that provider or supplier in the last ten (10) years, and/or the provider or supplier:
- Has been excluded from Medicare by the Office of Inspector General (OIG);
- Had its billing privileges revoked by a MAC within the previous ten (10) years and is either attempting to enroll as a new provider or establish billing privileges at a new practice location;
- Has been terminated or otherwise precluded from billing Medicaid;
- Has been excluded from any Federal health care program; or
- Has been subject to any final adverse action, defined at 42 C.F.R. 424.502, within the previous ten (10) years.[21]
CMS may also now impose a temporary moratorium on the enrollment of new Medicare provider or supplier types or the establishment of new practice locations of a certain type in a particular geographic area upon the determination that a certain provider/supplier type or geographic location has “a significant potential for fraud, waste or abuse.” [22] These moratoriums can be imposed for an initial period of six (6) months and may be extended in 6-month increments thereafter.[23] The moratorium is both established and lifted by CMS publication of a document in the Federal Register. Upon the lifting of a moratorium, any provider or supplier who was prevented from enrolling under the moratorium will automatically be placed in the “high” screening level if it tries to enroll within six (6) months from the date the moratorium was lifted.[24]
Also important to note, an individual who is subject to the fingerprinting requirement must submit fingerprints for a national background check either (a) upon submission of a Medicare enrollment application, or (b) within thirty (30) days of a Medicare contractor request.[25] Any provider or supplier that knows they will be subject to the fingerprinting requirement should make efforts to be fingerprinted as soon as possible and keep the fingerprints on file either for the revalidation process or in the case of a Medicare contractor request.
IV. Interplay of Medicare and Medicaid Revalidation and Screening Requirements
Many of the new Medicaid regulations echo the Medicare regulations while giving individual states room to adjust according to their own findings and practices. The new Medicaid regulations require revalidation every five (5) years, enrollment fees, and a revalidation process similar to the one undertaken by CMS for Medicare.[26] Some states, for example, New York, are implementing a similar revalidation procedure and are currently in the process of sending revalidation notices to Medicaid providers and suppliers.[27] In Virginia, a revalidation similar to Medicare’s will be implemented, including enhanced screening.[28] A $505 application fee will apply for Medicaid only enrollments by institutional providers such as nursing facilities or behavioral health providers.
Medicaid providers and suppliers may not be required to immediately revalidate their enrollment application as the States have until March 2016 to implement the requirement. However, the new Medicaid regulations do establish screening levels based on risk similar to Medicare. Providers and suppliers will be categorized as “limited”, “moderate” or “high” risk provider types and subject to varying levels of scrutiny when enrolling or revalidating. In order to determine one’s screening level for Medicaid, a provider or supplier should look to the Medicare risk levels, however, for Medicaid provider or supplier types “that are not recognized by Medicare, states will need to assess the risk posed by a particular provider or provider type. States should examine their programs to identify specific providers or provider types that may present increased risks of fraud, waste or abuse to their Medicaid programs . . . .”[29]
The requirements for each screening level are almost exactly the same as Medicare. For a provider type categorized as “limited” risk, the state must: (1) verify that a provider meets any applicable Federal regulations, or State requirements for the provider type prior to making an enrollment determination; (2) conduct license verifications, including State licensure verifications in States other than where the provider is enrolling; and (3) conduct database checks on a pre- and post-enrollment basis to ensure that providers continue to meet the enrollment criteria for their provider type.[30] For a provider type categorized as “moderate” risk, the state must: (1) perform the “limited” screening requirements; and (2) conduct on-site visits in accordance with 42 C.F.R. 455.432.[31] For a provider type categorized as “high” risk, the state must: (1) perform the “limited” and “moderate” screening requirement; (2) conduct a criminal background check; and (3) require the submission of a set of fingerprints from any provider or person who holds a 5 percent or greater direct or indirect ownership interest in the provider.[32] States can similarly move a provider or supplier up to the “high” screening level in certain cases: Medicaid suspension based on a credible allegation of fraud; an existing Medicaid overpayment; or exclusion by the OIG or another state’s Medicaid program within the previous 10 years.[33] Similarly, a provider or supplier that has been subject to either a State Medicaid or CMS moratorium will be placed in the “high” risk screening level for the six (6) months following the lifting of the moratorium.[34]
Rather than performing their own screening procedures, States have the option of relying on the results of provider or supplier screening performed by either a Medicare contractor, or another state’s Medicaid agency or CHIP program.[35] Each state, however, will determine exactly how to implement the new screening procedures. While the effective date of the new Medicaid regulations was March 25, 2011, many states are still determining the most cost effective and efficient way to revise Medicaid policy in order to be in compliance with the new federal regulations. Providers and suppliers should actively stay apprised of changes to State Medicaid policy that change enrollment procedures through the individual State’s Medicaid website. Virginia expects to have a provider memorandum offering guidance in the process soon.
V. Conclusion
Providers of all types need to be aware of the new enrollment rules and periodically confirm that they are not subject to a revalidation request. The most important thing for providers and suppliers to do in order to stay in compliance with the new Medicare and Medicaid enrollment regulations is to prepare in advance to file the necessary Medicare revalidation forms and documentation and to stay apprised of any changes to an individual State’s Medicaid policy. Being familiar with the different screening levels is key to ensuring that a provider or supplier has the necessary paperwork and information when the time comes to revalidate for either Medicare or Medicaid.
We acknowledge with appreciation Maggie Collins O’Connell’s work on putting together this advisory.
[1] The Patient Protection and Affordable Care Act (Pub. L. 111-148) and the Health Care and Education Reconciliation Act of 2010 (Pub. L. 111-152) are collectively known as the Affordable Care Act (ACA).
[2] Medicare, Medicaid, and Children’s Health Insurance Programs; Additional Screening Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions and Compliance Plans for Providers and Suppliers, 75 FR 58204, 58205 (Sept. 23, 2010).
[3] U.S. Department of Health and Human Services, Centers for Medicare & Medicaid Services, MLN Matters, Further Details on the Revalidation of Provider Enrollment Information, SE1126 (12/9/2011).
[4] Ibid.
[5] Ibid.
[6] 42 C.F.R. 424.515(a)(2).
[7] The list of revalidation notices mailed in October 2011, December 2011, and January 2012 can be found at: https://www.cms.gov/MedicareProviderSupEnroll/11_Revalidations.asp#TopOfPage.
[8] Further Details on the Revalidation of Provider Enrollment Information, supra at note 3.
[9] Medicare, Medicaid, and Children’s Health Insurance Programs, supra at note 2, at 58217.
[10] Further Details on the Revalidation of Provider Enrollment Information, supra at note 3.
[11] 42 C.F.R. 424.515(d).
[12] Id.
[13] Id.
[14] 42 C.F.R. 424.515(e).
[15] 42 C.F.R. 424.518(a)(1).
[16] 42 C.F.R. 424.518(a)(2).
[17] 42 C.F.R. 424.518(b)(1).
[18] 42 C.F.R. 424.518(b)(2).
[19] 42 C.F.R. 424.518(c)(1).
[20] 42 C.F.R. 424.518(c)(2).
[21] 42 C.F.R. 424.518(c)(3).
[22] 42 C.F.R. 424.570.
[23] Id.
[24] 42 C.F.R. 424.518(c)(3)(iii).
[25] 42.C.F.R. 424.518(d).
[26] 42 C.F.R. 455.414. See http://www.medicaid.gov/Federal-Policy-Guidance/downloads/CIB-12-23-11.pdf (CMS instructions to state Medicaid agencies on developing State plan amendments to implement.)
[27] New York State, Department of Health, 28 New York State Medicaid Update 1, New Rules Require Enrollment Revalidation for All Providers (01/2012) (http://www.health.ny.gov/health_care/medicaid/program/update/2012/2012-01.htm).
[28] Email from Peter Lubinskas, Enrollment Manager, Virginia Department of Medical Assistance Services, March 23, 2012.
[29] Medicare, Medicaid, and Children’s Health Insurance Programs, supra at note 2, at 58213.
[30] 42 C.F.R. 455.450(a).
[31] 42 C.F.R. 455.450(b).
[32] 42 C.F.R. 455.450(c).
[33] 42 C.F.R. 455.450(e)(1).
[34] 42 C.F.R. 455.450(e)(2).
[35] 42 C.F.R. 455.410(c).
