On November 20, 2020, the Department of Health & Human Services (HHS) finalized significant changes to the regulations implementing the Anti-Kickback Statute (AKS), the Physician Self-Referral Law (commonly known as the Stark Law), and the civil monetary penalty rules regarding beneficiary inducements (Beneficiary Inducements CMP). The sweeping changes come through corresponding final rules – one issued by the Office of Inspector General (OIG) addressing changes to the AKS and the Beneficiary Inducements CMP, and one issued by the Centers for Medicare & Medicaid Services (CMS) addressing changes to the Stark Law.  

The agencies originally planned to finalize the rules earlier this year, but CMS announced that it was extending its deadline until August 2021, which led to speculation that the OIG’s final rule would be similarly delayed. Nevertheless, industry stakeholders urged HHS to issue the long-awaited final rules, particularly in light of speculation that a Biden administration might be less likely to finalize the rules. 

The final rules are part of HHS’s Regulatory Sprint to Coordinated Care and are designed to offer the health care industry more flexibility and to reduce the regulatory burden associated with the AKS and the Stark Law, particularly with respect to value-based arrangements and care coordination.  Offering a number of industry-friendly changes, the final rules will have a far-reaching impact on the health care industry.

Below is a high-level overview of some of the key provisions from the final rules.  We will provide more in-depth summaries and analyses in our upcoming blog series.  

Value-Based Arrangements

Both final rules focus heavily on addressing the potentially chilling impact of the AKS, the Beneficiary Inducements CMP, and the Stark Law on care coordination and value-based care.  Broadly speaking, the OIG finalized the regulations addressing value-based arrangements as proposed, but it made a handful of modifications intended to further reduce the AKS’ regulatory burden.  Such changes include reducing certain thresholds to qualify for safe harbor protection and offering medical device and supplies manufacturers and DMEPOS suppliers a limited option to qualify for protection under the care coordination arrangements safe harbor, as discussed below.

The OIG implemented three new AKS safe harbors, all designed to protect certain arrangements entered into with or by a value-based enterprise (VBE), which is broadly defined to capture any number of network arrangements where the participants have agreed to collaborate for value-based purposes:

1. Care coordination arrangements. This safe harbor protects in-kind remuneration exchanged between VBE participants, provided that the remuneration is used predominately to engage in value-based activities that are directly connected to care coordination for a target patient population.

2. Value-based arrangements where the value-based enterprise assumes substantial downside financial risk.  This safe harbor covers both monetary and in-kind remuneration exchanges between a VBE and a VBE participant in a VBE that assumes substantial downside financial risk from a payer if the VBE participant assumes a meaningful share of the risk.  This safe harbor offers greater flexibility than the care coordination arrangements safe harbor.  The OIG finalized this safe harbor with industry-friend modifications.  For one of the four different payment methodologies used to determine “substantial downside financial risk,” the OIG reduced the risk threshold (i.e., the VBE has repayment obligation of 30% of shared losses rather than 30%).  While the proposed rule defined “meaningful share of the risk” to mean at least 8%, the OIG reduced this amount, requiring the VBE participant to share at least 5% of the financial risk to qualify.

3. Value based-arrangements where the value-based enterprise assumes full financial risk.  This safe harbor protects monetary or in-kind remuneration from a VBE to a VBE participant, provided that the VBE assumes full financial responsibility for the costs of all items and services covered by a payor for each patient in the target population for a term of one year and is paid prospectively.  This safe harbor is designed to afford the most flexibility.

While the OIG had proposed to exclude pharmaceutical manufacturers, distributors, and wholesalers; pharmacy benefit managers (PBMs); laboratories; manufacturers of devices and medical supplies; medical device distributors and wholesalers; DMEPOS suppliers; and physician-owned medical device companies from protection under all three of these safe harbors, the final rule offers a limited pathway for safe harbor protection for manufacturers of medical devices or supplies and DMEPOS suppliers under the care coordination arrangements safe harbor.  These entities can receive safe harbor protection for exchanges of digital health technology (e.g., software products that pair with implantable devices, diabetes management devices, and cloud storage services to monitor blood sugar levels) as part of a VBE.

Similarly, CMS implemented four new exceptions to the Stark Law for value-based arrangements that apply based on the level of risk assumed by the VBE or the physician:

1. Full financial risk.  This exception applies to value-based arrangements between VBE participants in a VBE that has assumed full financial risk for the cost of all patient care items and services covered by the applicable payor for each patient in the target patient population during the entire duration of the value-based arrangement.

2. Meaningful downside financial risk to the physician.  This exception applies to remuneration paid under a value-based arrangement where the physician is at “meaningful downside financial risk” for failure to achieve the value-based purpose of the VBE for the entire term of the value-based arrangement.  While the proposed rule set “meaningful downside financial risk” to mean that the physician is responsible to pay or forgo no less than 25% of the total value of the remuneration the physician receives under the value-based arrangement, CMS lowered the threshold to 10%.

3. Value-based arrangements regardless of the level of risk undertaken.  The most onerous exception for value-based arrangements, this exception applies to value-based arrangements, regardless of the level of risk undertaken by the VBE or any of the VBE participants.  Because the exception potentially applies to arrangements where neither party has assumed any financial risk, CMS included a number of additional requirements to satisfy this exception compared to the exceptions for full financial risk and meaningful downside financial risk, in an effort to guard against patient and program abuse.

4. Indirect compensation arrangements that include a value-based arrangement.  CMS finalized its proposal to make value-based exceptions applicable to indirect compensation arrangements that include a value-based arrangement to which the physician or physician organization is a direct party.

CMS did not include in these exceptions the typical Stark Law requirements that compensation be set in advance, consistent with fair market value, and not determined in any manner that takes into account the volume or value of a physicians’ referrals or other business generated by the physician for the entity.  However, these exceptions do require that the compensation arrangement be commercial reasonable.

Beneficiary Inducement

The OIG finalized a Beneficiary Inducements CMP exception and new safe harbors applicable to beneficiary incentives.  Specifically, the OIG finalized a new safe harbor for arrangements for patient engagement and support to improve quality, health outcomes, and efficiency.  While the proposed rule included a list of illustrative categories of the types of tools and support that could be provided to patients under this safe harbor, the OIG removed these categories and instead articulated a policy to be agonistic as to the type of tools or supports that could qualify for protection.  Similar to the VBE safe harbors discussed above, the OIG excluded pharmaceutical manufacturers; manufacturers, distributors, DMEPOS suppliers; and laboratories from protection under this safe harbor, but the final regulations allow manufacturers of devices or medical supplies to furnish digital health technology.  While the OIG had proposed that only items or supports furnished directly to patients by the VBE entity qualified for the safe harbor, the final rule provides slightly more flexibility because it allows the tools and supports to be furnished by the VBE participant or an eligible agent, such as employees or contractors or third party vendors or retailers.  The OIG finalized, as proposed, the annual $500 monetary cap on tools and supports that can be provided.  While the proposed rule allowed the annual cap to be exceeded for patients based on determinations of financial need, the OIG eliminated that exception.  Based on public comments, the OIG included an inflation adjuster.

The OIG modified its existing safe harbor for local transportation to increase the mileage limits for rural areas from 50 miles to 75 miles and eliminated distance limitations for transportation of discharged patients to their residences. The proposed rule sough to eliminate the distance limitations only after admission as an inpatient, but the final rule expanded the safe harbor by also removing the mileage limitation when a patient is discharged after spending 24 hours in observation status.

Lastly, the OIG adopted a much less stringent Beneficiary Inducements CMP exception for telehealth technologies for in-home dialysis than what was proposed.  It removed most of the additional proposed conditions and proposed regulatory language to more closely align with the statutory exception.  

Cybersecurity Donations

The final rules include a new Stark Law exception and a new AKS safe harbor to protect non-monetary donations of certain cybersecurity technology and related services to address the growing threat of cyberattacks impacting the health care industry.  This new safe harbor permits individuals or entities, such as large health systems, to donate cybersecurity technology to physician groups or other providers that may otherwise lack the resources to procure cybersecurity technology, as long as the technology is “necessary and used predominantly to implement, maintain, or reestablish cybersecurity.”

With the final rules, CMS and OIG expanded the scope of permissible donations beyond software and services to also include hardware.  The agencies believe that the “necessary and used predominantly” limitation will allay program integrity concerns regarding donations of valuable multifunctional hardware.  Both agencies considered whether to restrict the scope of potential donors but ultimately declined to do so in the final rules even though various laboratory industry organizations recommended the exclusion of laboratories based on the fact that many physicians reportedly conditioned referrals on EHR donations before laboratories became excluded donors in 2013 under the exception and safe harbor for EHR donations.  The agencies dismissed their concerns by noting that recipients cannot make the receipt of cybersecurity technology or services, or the amount or nature of such technology or services, a condition of doing business with the donor, but failed to acknowledge that this same condition applies to EHR donations.  Finally, the exception and safe harbor limit donors from making cybersecurity donation decisions in a manner that directly takes into account the volume or value of referrals or other business generated between the parties, but the agencies chose not to adopt a list of selection criteria that, if met, would deem the donation to meet this requirement.   

Clarification of Fundamental Stark Law Terminology and Requirements

CMS’s final rule includes critical guidance and clarification on fundamental Stark Law terminology and requirements, including key concepts such as commercially reasonable, the volume or value standard, and fair market value.  The proposed rule sought comments on two alternative definitions for commercially reasonable. After considering comments, CMS finalized that an arrangement is commercially reasonable if it furthers a legitimate business purpose of the parties to the arrangement and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty.  CMS also finalized its proposals to establish objective tests to determine whether compensation passes the “volume or value” and the “other business generated” standards, with only minor modifications.  For the definition of fair market value, CMS finalized its proposal to restructure the regulations to provide for three separate definitions of fair market value – one generally applicable definition, one definition applicable to the rental of equipment, and a definition applicable to the rental of office space.  Under the general definition, fair market value means the value in an arm’s length transaction, consistent with the general market value of the subject transaction.  CMS also adopted new definitions for designated health services, physician, referral, remuneration, and transaction.