On September 5, 2019, the Centers for Medicare and Medicaid Services (“CMS”) released its final rule with comments on Program Integrity Enhancements to the Provider Enrollment Process (the “Program Integrity Enhancements”). The new regulations impose additional disclosure requirements that may preclude certain providers and suppliers from receiving reimbursement under Medicare, Medicaid, and Children’s Health Insurance Program (“CHIP”).
The Program Integrity Enhancements intends to focus on providers and suppliers who have real and demonstrable histories of conduct that poses undue risks to taxpayers, patients, and program beneficiaries. The final rule, which is open for commentary until it goes into effect on November 4, 2019, builds on CMS’s previous efforts to protect federal health care programs from potential fraud, waste, and abuse. CMS announced additional disclosure requirements and penalties for fraudulent actions of providers and suppliers. The new regulations are intended to ensure proper billing practices, to prevent improper payments, and to deter potential fraud-feasors from submitting improper claims. Although the final rule’s broad disclosure obligations will pose a significant compliance burden on Medicare and Medicaid providers, the immediate impact of the rule is limited because of CMS’s “phased-in” approach to the new requirements.
New requirements under Program Integrity Enhancements
Under the final rule, during the enrollment process providers and suppliers must disclose to CMS any current or previous “affiliation” with a provider or supplier that: (1) has uncollected debt of any amount; (2) has been or is subject to a payment suspension under a federal health care program; (3) has been excluded by the Office of the Inspector General (“OIG”) from Medicare, Medicaid, or CHIP; or (4) has had its Medicare, Medicaid, or CHIP billing privileges denied, both voluntarily or involuntarily.
Based on the disclosures of such affiliation, CMS can approve or deny an initial application for enrollment, or it may revoke an accepted application if it finds the provider or supplier creates an undue risk of fraud, waste, or abuse either through its own actions or through an affiliation with another entity that has been sanctioned by CMS.
The agency broadly defines an “affiliation” to include any of the following:
- 5% or more ownership, including “passive” investor ownership;
- partnership interest, including any limited partnership interest;
- any interest in exercising operational or managerial control, including board membership;
- officer or director position with an entity; or
- any reassignment relationship.
CMS already requires providers and suppliers to disclose what it considers to be “adverse action,” including prior exclusions, revocations, and suspensions from the Medicare program, in enrollment documents; however, CMS appears to be taking a more aggressive, and potentially subjective, approach here. For example, by denying enrollment to an organization because an owner or managing employee is “affiliated” with another previously revoked organization, CMS may place “blame” at the individual level, upon individuals that may not have been intimately involved with whatever that previous cause of revocation was. However, it should be made clear that many disclosable affiliations may not pose an undue risk to a federal health care program and, therefore, would not lead to an adverse CMS decision. The degree, extent, and timing of the affiliation are among factors that the agency considers in its undue risk determination.
Furthermore, the Program Integrity Enhancements extend the length of CMS penalties. Under the new rule, CMS can deny re-enrollment for providers and suppliers that CMS finds have submitted false or misleading information on their initial application for enrollment for up to 10 years. Previously, CMS could only bar re-enrollment for up to three years for the same offense. Under the final rule, providers and suppliers who have their billing privileges revoked twice can be banned from re-enrolling for up to 20 years. CMS recognizes the severity of the new penalties and estimates that the expanded re-enrollment bar will only impact 400 Medicare revocations per year.
CMS has stated that the additional disclosure requirements and penalties attempt to prevent providers or suppliers from committing fraud, abuse, or waste and then “reinventing” themselves as a new entity. CMS also hopes to prevent providers or suppliers from billing for services from non-compliant practice locations (e.g., a location that fails to meet Durable Medical Equipment, Prosthetics, Orthotics, and Supplies supplier standards) and/or abusing Medicare Part A or B services or drugs.
Impact of Program Integrity Enhancements to the Provider Enrollment Process
The Program Integrity Enhancements reflect the current administration’s effort to reduce fraud, waste, and abuse within the federal health care programs. CMS’s final rule shifts the government’s focus from reimbursing improper payments and later attempting to recoup the fraudulent health care payments, better known as “pay and chase,” to attempting to protect government funds before fraudulent billing occurs.
Although the broad disclosure reporting requirements will be a significant compliance burden, the final rule adopts a “phased-in” approach. CMS will initially implement a targeted approach by only requiring providers and suppliers to report disclosable affiliation upon request from CMS. In the future, CMS will revise, through the notice and comment process, Form CMS-855 to include additional fields for the disclosures required under the final rule. CMS will also issue subregulatory guidance regarding the affiliation disclosure process. The forthcoming guidance will clarify the government’s expectations regarding the level of effort that is required in securing the relevant affiliation information.
Nonetheless, providers and suppliers preparing for initial enrollment or re-enrollment should be prepared to carefully review all affiliations from the last five years, and to comply with the new disclosure requirements.