On September 10, 2019, the US Department of Health and Human Services Centers for Medicare & Medicaid Services (CMS) published a final rule (Final Rule) expanding Medicare, Medicaid and Children’s Health Insurance Program (CHIP) enrollment reporting requirements as well as CMS’ ability to strengthen its program integrity efforts through the Medicare enrollment process. The Final Rule is effective November 4, 2019, and CMS is accepting public comments on certain aspects of the Final Rule until that time.

IN DEPTH

Background

The Affordable Care Act incorporated provisions in Section 1866(j)(5) of the Social Security Act requiring providers and suppliers to disclose certain enrollment information before CMS enrolls and makes payments to providers and suppliers. The requirements are in response to concerns that some enrolled providers and suppliers were able to evade federal healthcare program integrity provisions by changing their names or establishing complex entity relationships. On March 1, 2016, CMS published a proposed rule (Proposed Rule) to implement the requirements of Section 1866(j)(5) as well as provide CMS with additional authority to deny or revoke enrollments and impose and extend Medicare reenrollment and reapplication bars, among other provisions.

The Final Rule 

Disclosure of Affiliations and Disclosable Events

Under the Final Rule, providers and suppliers that are initially enrolling or revalidating an existing enrollment must disclose if the provider or supplier, or any of its owning or managing employees or organizations, currently has, or within the previous five years, has had an affiliation with a currently or formerly enrolled Medicare, Medicaid or CHIP provider with one of the following “disclosable events”:

• Current uncollected debt to Medicare, Medicaid, or CHIP (regardless of the amount or status of appeal or repayment terms)

• Prior or current payment suspension under a federal health program

• Exclusion from participation in Medicare, Medicaid, or CHIP (including those under appeal)

• Denial, revocation or termination of Medicare, Medicaid or CHIP enrollment (including decisions under appeal)

Consistent with current Medicare enrollment disclosure requirements, an “affiliation” includes:

• A 5% or greater direct or indirect ownership interest in another organization

• A general or limited partnership interest in an entity, regardless of the ownership interest

• The exercise of operational or managerial control, or directly or indirectly conducting the day-to-day operations of another organization

• Acting as an officer or director of a corporation

• Any reassignment relationship under 42 CFR § 424.80

In light of concerns about the burden of researching, tracking and reporting such information, CMS has adopted a phased-in approach for Medicare enrollment and will initially be requiring providers and suppliers to disclose affiliations only upon a specific request from CMS and after CMS updates the Form CMS-855 Medicare enrollment applications. CMS also declined to finalize its proposed revisions requiring providers and suppliers to report new or changed affiliation information. States may select from two potential phase-in options for Medicaid and CHIP enrollments. CMS did not provide a timeline for its implementation of the revised Form CMS-855s, but indicated that the updates will go through notice-and-comment rulemaking. CMS is seeking public comment on approaches for obtaining this information and the level of effort providers and suppliers must expend when researching affiliations.

Increased Authority to Revoke or Deny Medicare Enrollment

As finalized, CMS may deny or revoke a provider or supplier’s enrollment if (1) the provider or supplier fails to fully and completely disclose affiliations with individuals or entities that have or have had a disclosable event; or (2) if CMS determines any of the disclosed affiliations pose an “undue risk” of fraud, waste or abuse. In evaluating the risk of a disclosed affiliation, CMS will consider the following factors:

• The duration and extent of the affiliation (e.g., percent ownership)

• Whether the affiliation still exists or when it ended

• The reason the affiliation was terminated

• The type of disclosable event, when it occurred and whether the affiliation existed at that time

• In the case of uncollected debt, the amount, steps (if any) toward repayment and to whom the debt is owed

• In the case of denials, revocations, terminations, exclusions or payment suspension, the reason for the action

• Any other evidence CMS deems relevant

CMS noted that a disclosed affiliation will not automatically result in a finding that the affiliation poses an undue risk of fraud, waste or abuse. CMS will evaluate each affiliation based on the totality of the circumstances and “exercise its discretion to deny or revoke in a cautious and prudent manner.” The Final Rule also permits denial or revocation, as applicable, of a provider or supplier’s Medicare enrollment in the following circumstances:

• The provider or supplier’s billing privileges are currently revoked under a different name, numerical identifier, or business identity (CMS will consider the degree of commonality among the owning and managing employees and organizations, geographic location, provider or supplier type, business structure, and any other evidence indicating that the two parties are similar)

• The provider or supplier bills Medicare for services performed at or items furnished from a location it knew or should have known did not comply with the Medicare enrollment requirements (CMS may revoke multiple provider and supplier enrollments, including the non-compliant location or other locations, even if the sites have different numerical identifiers, legal business names or ownership if evidence suggests they are under control of similar parties)

• A physician or eligible professional has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items or drugs that are abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements (CMS will consider the diagnoses; instances where items or drugs ordered, certified, referred, or prescribed could not have occurred (e.g., the patient was deceased); prior disciplinary action or restriction, suspension, or revocation of an individual’s ability to provide healthcare services or participate in an insurance program; the length of time the pattern has continued and the individual has been enrolled in Medicare; and malpractice suits filed against the individual)

• The provider or supplier has an existing debt that CMS appropriately refers to the Department of the Treasury

• An enrolled individual or entity fails to report changes to certain enrollment information (e.g., changes of location or ownership, final adverse actions) within 30 or 90 days, depending on the entity type and information involved (CMS will consider whether the information was reported; if reported, how belatedly; and the materiality of the information)

• A provider or supplier’s owning or managing employee or organization has been placed under a Medicare or Medicaid payment suspension

• A provider or supplier’s license is currently revoked or suspended in a state other than the state where the provider or supplier is enrolling, or if the provider or supplier is currently terminated, revoked, barred or suspended from participation in any federal healthcare program

• A provider or supplier voluntarily terminated its Medicare enrollment in order to avoid a revocation

Reenrollment and Reapplication Bars 

CMS finalized its proposals to (1) increase the maximum reenrollment bar from three years to ten years, subject to exceptions where greater bars may be warranted; (2) extend the reenrollment bar for an additional three years (even beyond the ten-year maximum) if CMS determines that the provider or supplier is attempting to circumvent the reenrollment bar by reenrolling under a different name, numerical identifier, or business identifier; and (3) impose a reenrollment bar of up to 20 years if the provider or supplier is revoked from Medicare for the second time. In determining the length of the reenrollment bar, CMS will consider the reason for the revocation, the length of time between revocations and whether the provider or supplier has a history of final adverse actions (other than revocations) or Medicare or Medicaid payment suspensions. CMS declined to specify the reenrollment bar lengths for particular acts, stating that it needs to have discretion and flexibility to consider the facts of each situation.

As finalized, CMS has the authority to impose a reapplication bar of up to three years where a Medicare enrollment application is denied for submission of false or misleading information or where information is omitted in order to obtain enrollment. CMS will consider the following factors when setting the length of the reapplication bar: the materiality of the false, misleading, or withheld information; whether the provider or supplier purposefully provided or withheld this information; and whether the provider or supplier has a history of final adverse actions or payment suspensions. Both the reapplication and reenrollment bars will be applied to the previously enrolled or applicant entity under any current, former or future name, numerical identifier or business identity.

Other Relevant Provisions 

1. Document Retention

CMS expanded its documentation retention requirements to require physicians, suppliers, and eligible professionals to maintain documentation for all Part A and B services, items, and drugs for seven years from the date of service.

2. Restrictions on Opt-Out Physicians and Practitioners

A physician or practitioner whose enrollment is revoked because the individual voluntary terminated a prior enrollment in an attempt to avoid revocation by CMS may not order, prescribe, certify, or refer a beneficiary for Medicare-covered services, items, and drugs.

3. Enrollment Moratoria

CMS clarified that a provider or supplier cannot move an enrolled practice location inside a moratorium area because doing so has the same effect of establishing an additional location inside the moratorium area. CMS also expanded the exception to temporary moratoria to include both applications that are approved by the contractor but not yet entered into PECOS when the moratorium becomes effective or received by the contractor prior to the date the moratorium is imposed.

4. Reactivation of Billing Privileges

Deactivated providers or suppliers must now recertify that their enrollment information is correct and furnish any missing information before the provider or supplier’s billing privileges will be reactivated. CMS may also request that a new enrollment application be submitted before reactivating the provider or supplier’s billing privileges.

Conclusion

The Final Rule has the potential to impose significant burdens on existing and new federal healthcare program providers and suppliers to identify, evaluate and report certain arrangements and relationships for enrollment purposes. The reporting requirements, coupled with the revocation, denial and reenrollment and reactivation bar penalties, may have far-reaching implications for providers and suppliers who are otherwise without fault, but may have unknowingly engaged in arrangements with individuals or organizations that CMS determines present an undue risk to federal healthcare program integrity. Providers and suppliers should review the Final Rule carefully to understand their reporting obligations, consider providing comments to CMS on the reporting methodology, and prepare to collect certain information related to their existing affiliations.