CMS Finalizes New Value Based Arrangement and Cybersecurity Exceptions and New Guidance for Complying with Stark Law

On November 20, 2020, the Centers for Medicare & Medicaid Services (CMS) published its Final Rule updating the physician self-referral law (“Stark Law”) located at 42 CFR 411. Originally proposed in 2018, the Final Rule establishes new exceptions for certain arrangements under which a physician receives limited or value-based remuneration for items or services provided by the physician; creates a new exception to the Stark Law for donations of cybersecurity technology and related services; and amends the existing Stark exception for electronic health records (EHR) items and services. The Final Rule, generally effective as of January 19, 2021, also amended several Stark related definitions, providing guidance for physicians and health care providers to help conform with CMS’s new payment goals. These are part of CMS’s current “shift from volume-driven to value-driven payment models.”

While the new Stark Law Final Rule was developed along with new rules for the anti-kickback statute, the Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191) (HIPAA), and those related to opioid and substance use disorder treatment under 42 CFR part 2, this advisory focuses on the changes and updates to the Stark Law. Similar changes by the Office of Inspector General (OIG) at the Department of Health and Human Services (HHS), HIPAA, and Part 2’s substance abuse treatment rules are addressed in separate advisories. CMS’s Final Rule is available here.

New Stark Exception for Certain Value-Based Arrangements

The reimbursement landscape is shifting from a traditional fee-for-service model to more innovative models that pay better for value and promote care coordination with the goal of improving healthcare delivery and results. This transition towards better incentives for better care required changes to the Stark Law regulations and rules, which had previously limited the types of acceptable arrangements between physicians and other health care providers. Recognizing this shift in health care reimbursement, CMS’s Final Rule creates three new permanent exceptions for providers participating in value-based enterprises. Specifically: (i) value-based arrangements with full financial risk, (ii) value-based arrangements with meaningful downside financial risk; and (iii) any value-based arrangement provided the enumerated requirements are met (including those with little to no risk).

The Final Rule identifies arrangements with full financial risk as those having prospective or future cost risk for patient care items/services for the target patient population. CMS gives providers who seek protection under this exception 12 months to assume full financial risk after the commencement of the value-based arrangement. There can be no inducements to reduce or limit medically necessary care. Remuneration may be conditioned on target patient population referrals if there is no condition on referrals of nontarget patient population or other business. The arrangement must be in writing, and there are exceptions for patient preference, professional judgement, and payor requirements. Finally, records used for determining remuneration must be kept for 6 years.

The meaningful downside financial risk exception applies when the physician is at risk for at least 10% of the remuneration the physician receives for the target patient population. The risk can be in the form of paybacks, withholds, incentive bonuses, and other payment structures, so long as at least 10% of the physician’s total remuneration is at risk to the payor. This exception also requires that there be no inducement to reduce or limit medically necessary care, remuneration cannot be conditioned on referrals of non-target patient population patients or business, and any directed referral must include exceptions for patient preference, payor requirement and physician judgement.

The last value-based exception applies to arrangements that meet with little to no risk but that meet specific requirements. For this exception, the terms of the arrangement must be in a signed writing, be commercially reasonable, and include at least annual monitoring of the effectiveness of the value-based purposes, with the requirement to terminate within 30 days or modify the terms within 90 days if monitoring indicates that a value-based activity is not expected to further the purpose of the enterprise. This last requirement is a significant change as it requires review and course correction to replace ineffective activities or outcomes measures if the value-based purposes are not being achieved.

New Stark Definitions for Value-Based Arrangements

The new Stark exceptions are limited to compensation arrangements that qualify as “value-based arrangements.” According to CMS, value-based arrangements that qualify for the exception must include: (i) an entity, as defined at 42 CFR 411.351, and a physician; and (ii) a compensation agreement, as defined at 42 CFR 411.354(c), (i.e., and not another type of financial relationship to which the Stark Law applies). Moreover, a “value-based arrangement” must have one value-based activity for a target patient population between or among a value-based enterprise or participants in the same value-based enterprise. CMS defines “value-based activity” as an activity reasonably designed to achieve at least one value-based purpose that is: (1) the provision of an item or service; (2) the taking of an action; or (3) the refraining from taking an action.

Recognized value-based activities may include coordinating care for a target patient population, providing health technology to track patient data among target populations, providing transportation services or other on-medical supports, instituting medical protocols to reduce overuse of certain items or services, or create greater efficiencies in care delivery. Value-based arrangements to perform these value-based activities typically involve federal and state healthcare value-based programs, arrangements with private insurers, and state and federal managed care plans such as Virginia’s Commonwealth Coordinated Care Plus (CCC Plus). A “value-based enterprise” is where “two or more value-based enterprise participants: (1) collaborate to achieve at least one value-based purpose; (2) each of which is a party to a value-based arrangement with the other or at least one other value-based enterprise participant in the value-based enterprise; (3) that have an accountable body or person responsible for financial and operational oversight of the value-based enterprise; and (4) that have a governing document that describes the value-based enterprise and how the value-based enterprise participants intend to achieve its value-based purpose(s).” These can take the form of Accountable Care Organizations (ACOs); Clinically Integrated Networks (CINs), Independent practice associations (IPAs), Physician hospital organizations (PHOs), or another kind of network of physicians, facilities, and/or suppliers. Value-based enterprise are not defined by size as long as at least two value-based enterprise participants are involved, permitting small local and practice-specific projects.

A “value-based enterprise participant” is an individual or entity that engages in at least one value-based activity as part of a value-based enterprise. The Stark exceptions do not exclude any specific entities or provider-types from eligibility. In addition to physicians and other clinicians, hospitals, health systems and public and commercial insurers, the Final Rule permits laboratories, pharmacy benefit managers and drug manufacturers, compounding pharmacies, DMEPOS suppliers and manufactures, and others in the care delivery process to participate in value-based enterprises. CMS defines value-based purpose” as (1) coordinating and managing the care of a target patient population; (2) improving the quality of care for a target population; (3) appropriately reducing the costs to, or growth in expenditures of, payors without reducing the quality of care for a target patient population; or (4) transitioning from health care delivery and payment mechanisms based on the volume of items and services provided to mechanisms based on the quality of care and control of costs of care for a target patient population. Because hospital cost savings alone are not a value-based purpose, nor is maintaining quality (without cost savings to payor), existing hospital gainsharing arrangements must include a quality or transition purpose to qualify as value-based. Finally, the “target patient population” is defined as an identified patient population selected by a value-based enterprise or its value-based enterprise.

Providers must be value-based participants in the same value-based enterprise with those in which they have arrangements. In addition, CMS made clear that while referrals are not explicitly excluded from the definition of “value-based activity”, they are generally not items or services for which a physician may be compensated without violating the Stark Law. The definition of designated health services to which the Stark Law applies now excludes inpatient services paid for under prospective payment systems if providing those services does not increase the amount of Medicare’s payment to the hospital. Each exception is available only for compensation arrangements, not ownership arrangements.

Additional Changes to the Stark Law and Definitions

For purposes of the new value-based enterprise exceptions, CMS removed the fair market value requirement found in previous exceptions. Now, remuneration paid under a value-based arrangement need not be consistent with fair market value or take into account the volume or value of referrals or business generated between the parties to the new value-based arrangement. It also changed the traditional definition of “commercially reasonable” as meaning the arrangement “furthers a legitimate business purpose of the parties to the arrangement and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty… even if it does not result in profit for one or more of the parties.” It has not removed the commercially reasonable requirement from non-risk bearing value-based enterprises.

CMS revised the signature requirements by excusing a practice’s signature requirement under certain physician recruitment arrangements and recognizing electronic signatures as valid for purposes of Stark Law compliance. CMS provided a 90-day grace period in which to fix any non-compliance issues as of the expiration or termination of a compensation arrangement, if after the reconciliation all the remuneration has been paid under the terms of the original arrangement.

CMS excluded inpatient services paid under prospective payment systems from the definition “designated health services” if the cost of those services does not increase the amount of Medicare’s payment to the hospital. On the other hand, CMS removed its exceptions for surgical devices, items, or supplies from the definition of “remuneration.”

CMS added additional clarifications to existing exceptions such as those for equipment and property leases, isolated transactions, and arrangements for fair market value. The definition of indirect compensation arrangements now requires the compensation to the physician vary with the volume or value of the referrals and the individual unit of compensation must be either not fair market value or calculated using a formula that uses the physician’s referrals before an exception is needed.

CMS revised the definition of “group practice” to clarify circumstances under which the profits of a group practice may be shared with its members, including compensation that relates to participation in a value-based arrangement. In addition, a group practice cannot distribute profits from designated health services on a “service-by-service” basis, making it clear that all profits from DHS must be distributed to either the entire group or any subpart that consists of at least five physicians. Groups that need to modify their contracts accordingly have until January 1, 2022 to comply.

CMS excluded titular ownership or interests arising from a qualified employee stock ownership plan from the definition of “ownership or investment interests.”

CMS created a small dollar exception to cover arrangements with limited remuneration to physicians. It can be for no more than $5,000 per calendar year in the aggregate, must be fair market value, not based on the volume and value of referrals, and be commercially reasonable. However, unlike other exceptions, no written agreement or signatures are required, and the compensation does not have to be set in advance. This new exception works for short-term arrangements or where the requirements of another exception are not initially met.

EHR Exception and the Cybersecurity Technology and Related Services Exception

The Final Rule addressed arrangements for cybersecurity software and services and made permanent the exception for Electronic Health Records (EHR) by removing the sunset provision so that it does not end December 31, 2021. To encourage continued growth of EHR use, CMS expanded the list of the types of entities that can be permissible donors of EHR technology, to include parent companies of hospitals, health systems and ACOs. CMS further distinguished donated updates of EHR software, equipment, and services from contributions of first-time EHR technology or replacement EHR technology. Updates no longer have the requirement that the recipient contribute at least 15% of the cost before receipt. This payment only needs to be made “at reasonable intervals,” not in advance of receiving the update. However, initial recipients of donated EHR items and services, whether provided as first-time or replacement EHR technology, must still pay the required 15% contribution in advance of the initial donation.

CMS also clarified the meaning of “interoperable” to require that donated EHR items and services to require that it: (1) securely exchange data with and use data from other health information technology; and (2) allow for complete access, exchange, and use of all electronically accessible health information for authorized use under applicable State or Federal law. It will be considered interoperable for purposes of meeting the EHR Exception if it was ONC certified on the date it was received.

CMS’s Final Rule added a separate exception to the Stark Law for Cybersecurity Technology and Related Services. This exception is broader than the EHR exception and lacks many of the restrictions such as no recipient contribution requirements for the software, services and hardware that qualify for donation.

Conclusion

The Final Rule did not adopt all of the proposals from the Proposed Rule, but still broadened the protected arrangements physicians can enter into to meet CMS’ goals for value-based enterprises. Physicians and other health care entities can now rely on CMS’ guidance and these new exceptions to the Stark Law as they develop new ways to be reimbursed for delivering quality care.

Should you have any questions about these changes to the Stark Law and how they will affect your business, please contact Peter Mellette, Harrison Gibbs, or Elizabeth Dahl-Coleman at Mellette PC.

This client advisory is for general educational purposes only and does not cover every provision of the final rule. It is not intended to provide legal advice specific to any situation you may have. Individuals desiring legal advice should consult legal counsel for up-to-date and fact-specific advice.