On October 6, 2020, the Centers for Medicare and Medicaid Services (“CMS”) released guidance regarding the requirements and enforcement process for hospital reporting of COVID-19 data elements (the “Guidance”). The Guidance follows the September 2, 2020 Interim Final Rule, which included new requirements for Medicare and Medicaid participating hospitals and critical access hospitals (“CAHs”) to report data that allows CMS “to monitor whether individual hospitals and CAHs are appropriately tracking, responding to, and mitigating the spread and impact of COVID-19 on patients, the staff who care for them, and the general public.”

As the Guidance was effective immediately, hospitals should quickly review the requirements and execute a plan for meeting them. The Guidance applies to the following hospitals:

• Short term
• Long term
• Critical access hospital
• Children’s
• Distinct part psychiatric hospital
• Medicaid only short term
• Medicaid only children’s
• Medicaid only long-term hospitals

The Guidance requires daily reporting of 25 data elements, including basic hospital and occupancy information, as well as specific information related to COVID-19 patients, use of mechanical ventilators, use of Remdesivir, and staffing shortages. On a weekly basis, hospitals must report another seven data elements regarding PPE, ventilator, and other medical supplies and medications. On an optional basis, although CMS notes it may become mandatory in coming weeks, hospitals may report six data elements related to influenza. Reporting must be completed within one business day of the reporting period.

Hospitals that fail to report on a daily basis will be subject to a series of notification and enforcement letters, that may culminate in termination from the Medicare and Medicaid programs for continued noncompliance. The details of the enforcement process are as follows:

1. Hospitals will receive an initial notification of noncompliance that includes a reminder of the reporting requirements.
2. Three weeks after receiving the initial notification, providers who continue not to submit the required information will receive a second reminder notification, warning that future enforcement actions will be taken for continued noncompliance, which may result in termination of the Medicare provider agreement.
3. Six weeks after receiving the initial notification, providers who have continually failed to meet the reporting requirements will receive the first in a series of enforcement notification letters, providing one calendar week to demonstrate compliance.
4. If a provider fails to demonstrate compliance within that week, the provider will receive a second enforcement notification letter, and a third if noncompliance the following week. The third letter will indicate that the provider will, again, have one calendar week to demonstrate compliance with the reporting requirements, or otherwise receive a fourth and final enforcement notification letter.
5. If, within one week following the third enforcement notification letter, a provider still fails to meet reporting requirements, the provider will receive the fourth and final enforcement notification letter. This notification will include a notice of termination to become effective within 30 days from the date of notification. Failure to meet the reporting requirements within this 30 day timeframe may then result in termination of the Medicare provider agreement.

Steps 1-2 of the enforcement process are only applicable from October 7- November 18, 2020. For non-compliance identified after this time period, the series of enforcement notifications described in steps 3–5 above will begin immediately.

Providers subject to termination for failure to comply with reporting requirements do have appeal rights, as with any other termination actions. Additionally, providers terminated for failure to report will be subject to a 30 day reasonable assurance period, if the provider submits an application to participate in Medicare as a certified provider.

Additionally, hospitals have an opportunity to work with the Department of Health and Human Services (“HHS”) Team to develop a plan for meeting reporting requirements. Hospitals and CAHs may contact the HHS Protect Service Desk. If the hospital or CAH has made arrangements for reporting with the HHS Team, CMS will receive this information from HHS and will suspend for 30 days further enforcement actions for reporting requirements.

This article is not an unequivocal statement of the law, but instead represents our best interpretation of where things currently stand.  This article does not address the potential impacts of the numerous other local, state and federal orders that have been issued in response to the COVID-19 pandemic, but which are not referenced in this article.