Client Advisory: Program Integrity Enhancements or Compliance Nightmare? Changes to Providers’ Affiliation Disclosure Requirements

On November 4, 2019, a new final rule went into effect that dramatically expands affiliation disclosure requirements for enrolling and revalidating providers and suppliers in Federal health care programs. The new rule enhances CMS’s authority to deny and/or revoke enrollments and requires a provider or supplier to disclose current or previous affiliation with a provider or supplier that has had certain disclosable events. This Client Advisory will introduce many of the specific provisions of this new final rule as providers await further guidance on how the rule will be implemented in the coming months and years. A copy of this rule is available here.

Affiliation and Disclosable Events

In general, the final rule requires that, upon CMS’s request, a provider or supplier enrolling in or revalidating enrollment in Medicare, Medicaid, or CHIP will be required to disclose any “affiliations” they, or their owners and managers, have had within the previous five years with providers or suppliers currently or formerly enrolled in a Medicare, Medicaid, or CHIP that have experienced a disclosable event.

“Affiliation” is defined as any of the following:

• A five percent or greater direct or indirect ownership interest that an individual or entity has in another organization;
• A general or limited partnership interest that an individual or entity has in another organization;
• Any interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization;
• An interest in which an individual is acting as an officer or director of a corporation; or
• Any reassignment relationship under § 424.80.[1]

For the disclosure rule to apply, the affiliated provider or supplier did not have to be enrolled in a federal health care program when it had a relationship with the disclosing provider or supplier. “Disclosable Events” that trigger this disclosure requirement are:

• Uncollected debts to Medicare, Medicaid, or CHIP, regardless of the amount of the debt, repayment status, or any currently pending appeals;[2]
• Payment suspensions under a federal health care program, regardless of when the suspension occurred or was imposed;
• Exclusion from Medicare, Medicaid, or CHIP, regardless of when the exclusion occurred or was imposed or any currently pending appeals; or
• Denial or revocation of Medicare, Medicaid, or CHIP billing privileges, regardless of when and why such action was imposed or the status of any currently pending appeals.

The event that triggers the disclosure could have occurred before, during, or after the affiliation.

Importantly, for Medicare providers, this disclosure requirement will only apply once CMS has revised Form CMS-855 to include an affiliation disclosure section.[3] State certification agencies, in consultation with CMS, can choose one of two options for the implementation of the disclosure requirement for Medicaid and/or CHIP providers that are not enrolled in Medicare. They can either: (1) require disclosure by any newly enrolling or revalidating provider or supplier or (2) require disclosures upon request by the state. Once a state has selected one option, it cannot change its enforcement mechanism until there is further rulemaking on this requirement.

Disclosable Information and Standard of Review

If a provider or supplier has a disclosable affiliation, the provider or supplier must disclose the following information about the affiliate and the nature of the relationship with the affiliate:

• General identifying information of the affiliate, this includes the legal reported name of the affiliate, any “doing business as” name, its tax identification number, and its NPI;
• The reason for disclosing the affiliated provider or supplier;
• Specific information regarding the relationship between the disclosing party and the affiliate including the length of the relationship, the type of relationship, and the degree of the affiliation between the two parties; and
• The reason for the termination, if the relationship has ended.

The provider or supplier must disclose any affiliations and information they know or reasonably should have known. If the provider or supplier fails to disclose such information that they knew or reasonably should have known about, the provider or supplier’s initial enrollment application can be denied or its enrollment can be revoked. Once CMS receives this information, they will review the affiliation and disclosable event, and can deny or revoke a provider agreement if they find that the affiliation poses an undue risk of fraud, waste, or abuse to federal health care programs. CMS has listed some factors it will consider in this revocation analysis.[4] Notably, this does not require an actual finding of fraud, waste, or abuse, just an undue risk. Additionally, CMS can exercise this revocation or denial authority for an affiliation the provider has not disclosed, or has not yet been required to disclose.

Expanded Medicare Revocation Authority

Based on a stated desire to protect the integrity and beneficiaries of Medicare, the final rule significantly increases the revocation authority of CMS in the Medicare program. First, CMS is now permitted to deny an enrollment application if the applicant is currently revoked or barred from reenrollment “under a different name, numerical identifier, or business identity” and the reenrollment bar for the revoked entity has not passed. To determine whether a current enrollee is a stand-in of a revoked entity, CMS will examine the “degree of commonality” between the two entities by examining the following factors:

• Shared owning and/or managing employees;
• Geographic location (proximity);
• Provider/supplier type (consider if they are the same type of entity);
• Business structure; and
• Any other evidence indicating the two parties are similar or the second entity was created to circumvent the revocation or reenrollment bar.

Second, CMS can revoke a provider or supplier’s enrollment, at the provider level, if the provider or supplier billed for services performed at, or items furnished from, a location it knew or reasonably should have known did not comply with enrollment requirements. CMS will consider the following factors when making this determination:

• Reasons and facts behind the offending location’s non-compliance;
• Number of additional locations involved;
• Whether the provider or supplier has a history of final adverse actions[5] or Medicare or Medicaid payment suspensions;
• The degree of risk the other locations pose to the Medicare Trust Funds;
• Length of time the non-compliant location was non-compliant;
• Amount billed for and services performed at the non-compliant location; and
• Any other relevant evidence.

Third, CMS may revoke a physician or eligible professional’s Medicare enrollment if that professional “has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items, or drugs” in an abusive manner, a manner that threatens the health and safety of Medicare beneficiaries, or that otherwise fails to meets Medicare requirements. CMS may consider a litany of factors when invoking this authority.[6]

Fourth, CMS may revoke an enrollment if that provider or supplier has an existing debt that CMS refers to the Department of Treasury.

Fifth, CMS may revoke the enrollment of a provider or supplier that fails to report a change of ownership (“CHOW”), final adverse action, or practice location change within 30 days, or any other change in enrollment data within 90 days. In exercising this authority, CMS will consider:

• Whether the data in question was eventually reported;
• How late the report was;
• The materiality of the data in question; and
• Any other relevant information.

Sixth, CMS may deny Medicare enrollment of a provider or supplier if the owner or manager of the entity is currently under a Medicare or Medicaid payment suspension. This authority applies to any of the enrollee’s current enrollments and current or former entities. CMS will consider the following factors when considering exercising this authority:

• The specific behavior in question;
• Whether the provider or supplier is the subject of any other investigations;
• Any other relevant information.

Seventh, CMS may deny a provider or supplier’s enrollment application if the provider or supplier is currently terminated or suspended from a state Medicaid program, another federal health care program, or if an entity’s license is currently revoked or suspended in another state. Additionally, CMS can revoke a provider or supplier’s enrollment if it is terminated or revoked from participation in another federal health care program. When considering exercising this denial or revocation authority, CMS will consider:

• The reason for the adverse action;
• Whether the provider or supplier is subject to any other sanctions or adverse actions; and
• Any other relevant information.

Eighth, CMS may revoke enrollment, including those under different names, numerical identifiers, or business identities and different provider or supplier types if the enrollee is currently revoked. CMS will consider the following factors when making this determination:

• The reason for the revocation and the facts of the case;
• Whether any final adverse action has been imposed against the provider or supplier regarding other enrollments;
• The number and type of other enrollments;
• Any other relevant information.

Finally, CMS may revoke an enrollment if it determines the provider or supplier terminated a previous enrollment to avoid a revocation. CMS was concerned that providers and suppliers were voluntarily terminating their enrollment if they knew a revocation was imminent, and then reenrolling back in the program. In exercising this authority, CMS will consider evidence:

• Suggesting the provider knew or should have known it was out of compliance with Medicare requirements;
• That the provider or supplier knew or should have known its enrollment would be revoked;
• That suggests an enrollment was voluntarily terminated to circumvent such revocation;
• Any other relevant information.

Medicare Reenrollment Bars, Reapplication Bars, and Enrollment Moratoria

The final rule extends the maximum reapplication and reenrollment bars for those subject to revocation. The maximum reenrollment bar was increased from three years to ten years. Additionally, CMS can add up to three years on the bar, even beyond the ten-year maximum, if it determines the enrollee is attempting to circumvent an existing reenrollment bar by enrolling under a different entity. CMS may impose a reenrollment bar of up to twenty years if a provider or supplier is being revoked from Medicare for a second time. Finally, a reenrollment bar will apply to current, former, or future business names, numerical identifiers, or business identities of a barred provider or supplier.

If an applicant submits false or misleading information or withholds information on or with its Medicare application, CMS can impose a reapplication bar of up to three years on that applicant.

The rule amends enrollment moratoria so they no longer apply to any enrollment applications that the Medicare contractor receives prior to the date of imposition of the moratorium.

Conclusion

With the adoption of this final rule, CMS places a significant, additional administrative burden on its federal health care program providers and suppliers. Providers and suppliers will be required to go to significant lengths to exercise due diligence to try to protect themselves against any potential revocation or denial due to an affiliation. Medicare providers and suppliers will need to consider the impact of the rule on all of their contractual relationships with other providers and suppliers and will need to establish research and tracking mechanisms to identify potential risks from current or past affiliations. As past Administrative Law Judge (“ALJ”) decisions illustrate concerning CMS’s existing revocation authorities, ALJs will not review the exercise of revocation discretion of CMS, they will only review whether such authority to exercise revocation existed.[7] Without any apparent practical oversight, CMS has given itself nearly unfettered discretion to act as the gatekeeper to federal health care programs.

Should you, your practice, or your business have any questions about the implications and risk this final rule poses, please contact Peter Mellette, Harrison Gibbs, Elizabeth Dahl-Coleman, or Scott Daisley at Mellette PC.

This client advisory is for general educational purposes only and does not cover every provision of the final rule. It is not intended to provide legal advice specific to any situation you may have. Individuals desiring legal advice should consult legal counsel for up-to-date and fact-specific advice.

[1] This section prohibits the reassignment of Medicare payments except in certain specifically excepted circumstances. The provision concerning “reassignment” only applies to the Medicare program.

[2] Uncollected debt is defined to mean: (1) Medicare, Medicaid, or CHIP overpayments for which CMS or the state has sent notice of the debt to the affiliated provider or supplier; (2) civil money penalties imposed under Title 42; and (3) assessments imposed under Title 42.

[3] The Form CMS-855 will undergo notice and comment rulemaking revision.

[4] CMS has identified the following considered factors: (1) duration of the relationship; (2) whether the affiliation still exists, or how long ago it ended; (3) degree and extent of affiliation; (4) the reason for termination of the affiliation; (5) the type of action of the disclosable event; (6) when the event occurred; (7) whether the affiliation existed when the event occurred; (8) the amount of debt, whether the debt is being repayed, and to whom the debt is owed; (9) the reason for the denial, revocation, termination, exclusion, or payment suspension; and (10) any other evidence CMS deems relevant.

[5] “Final adverse actions” is as defined in 42 CFR § 424.502.

[6] CMS will consider: (1) whether the eligible professional’s diagnoses support the orders, certifications, referrals, or prescriptions in question; (2) whether there are instances where the necessary evaluation of the patient for whom the service, item, or drug was ordered, certified, referred, or prescribed could not have occurred; (3) the number, type, and reasons for actions taken against the professional by state licensing bodies and medical boards; (4) whether the professional has any history of final adverse action; (5) length of time the pattern or practice continued; (6) how long the professional has been enrolled in Medicare; (7) number and type of relevant malpractice suits that have been settled or reached final judgment against the professional; (8) whether any State Medicaid program or other public or private health insurance program has restricted, terminated, suspended, or revoked the professionals ability to practice medicine and the reason for this action; and (9) and other relevant information as deemed by CMS.

[7] See, e.g., Palmetto Faith Operating LLC d/b/a Faith Healthcare Center v. Centers for Medicare & Medicaid Services, Decision No. CR4781 (January 31, 2017).