On September 10, 2019, the Centers for Medicare and Medicaid Services (CMS) released a long awaited Final Rule that greatly expands the provider enrollment disclosure requirements for the Medicare, Medicaid and Children’s Health Insurance (CHIP) Programs and enhances the ability of CMS to deny and/or revoke enrollment of any provider or supplier participating or seeking to participate in the Medicare program. The Final Rule takes effect on November 4, 2019, despite CMS’s requests for continued comments regarding certain aspects of the Final Rule and ongoing development of the forms and processes necessary to fully implement it. The major provisions of the Final Rule are highlighted below.

Disclosure of Affiliations for Medicare, Medicaid and CHIP

The most anticipated (or dreaded) provision of the Final Rule requires any provider or supplier initially enrolling in or revalidating its enrollment in the Medicare, Medicaid or CHIP programs to identify any affiliations that it (or any owning or managing individuals or organizations of the provider or supplier) has with (or within the previous five years has had) any currently or formerly enrolled provider or supplier that has experienced a so called “disclosable event”, which includes: (a) uncollected debt to Medicare, Medicaid or CHIP (regardless of amount, repayment status or any pending appeals); (b) payment suspension under a federal health care program (regardless when it occurred or was imposed); (c) exclusion from Medicare, Medicaid or CHIP (regardless of when it occurred or the status of any pending appeals); and (d) denial or revocation of Medicare, Medicaid or CHIP billing privileges (regardless of when imposed, the reasons for such action or status of any appeals). Once a reporting obligation for an affiliate is triggered, the disclosure of “disclosable events” is unlimited in duration and affords CMS (or a state Medicaid or CHIP program, as applicable) the ability to deny or revoke enrollment of a provider or supplier based on its determination whether the affiliation and disclosable event(s) poses an “undue risk” of fraud, waste, or abuse to the Medicare (or Medicaid or CHIP) program.

Notably, unlike the proposed version of this Final Rule that was released in March 2016, the Final Rule limits the disclosure obligation to those providers and suppliers requested to so disclose by CMS. Moreover, for the vast majority of providers and suppliers participating in Medicare, Medicaid and CHIP programs, any such requests are likely to be delayed by several years while CMS and the states rush to develop a reporting process and new Form CMS-855 enrollment forms and state Medicaid/CHIP applications to capture such information. With regards to the Medicare program, the development of these processes and forms will be required to undergo the notice and comment rulemaking process. How and when such processes will roll out for the state Medicaid and CHIP programs is less clear as those programs were afforded two differing options for implementation of these new rules. For now, providers and suppliers in any of these programs should take the opportunity to identify any “affiliates” and determine whether those affiliates have any so-called “disclosable events” that would merit reporting, if requested to do so by CMS, especially considering the time and effort that process could take.

Expansion of CMS’s Denial and Revocation Authorities Under the Medicare Program

The Final Rule also expands the ability of CMS to deny or revoke the enrollment of a provider or supplier seeking to enroll in or currently enrolled in the Medicare program. The provisions under this expanded authority include denying or revoking the enrollment of a provider or supplier that:

1. Fails to fully and completely provide a list of affiliates and disclosable events upon request by CMS. Commenters indicated to CMS the difficulty that would be encountered in identifying affiliates and obtaining information regarding disclosable events and in response CMS indicated it will evaluate providers and suppliers according to what it determines the provider or supplier “knew or reasonably should have known”. Notably, states will hold similar authority to terminate a provider’s enrollment in state Medicaid and CHIP programs;

2. Is currently revoked under a different name, numerical identifier or business identity, and the applicable reenrollment bar has not expired. Notably, this is an expansion on current similar authority retained by CMS because under this enhanced provision CMS now clearly has the ability to reach across complex corporate structures and different legal entities to determine whether to deny or revoke the enrollment of related corporate entities that it previously did not have;

3. Billed for services performed at, or items furnished from, a location that the provider or supplier knew or should reasonably have known did not comply with Medicare enrollment requirements;

4. Demonstrates a pattern or practice of ordering, certifying, referring or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries or otherwise fails to meet Medicare requirements. Notably, this authority is reserved for physicians and other “eligible professionals”;

5. Has an existing debt that CMS refers to the United States Department of Treasury;

6. Is currently terminated or suspended (or otherwise barred) from participation in a state Medicaid program or any other federal health care program;

7. Has a license that is currently revoked or suspended in a state other than that in which the provider or supplier is seeking to enroll in or already enrolled in;

8. Is currently under a Medicare or Medicaid payment suspension. Notably, this authority extends as well to include Medicare or Medicaid payment suspensions against any owning or managing employee or organization of the provider or supplier as well;

9. Voluntarily terminates its enrollment in the Medicare program in order to avoid a revocation action by CMS; or

10. Fails to timely report a change of information. Notably, while CMS already retains similar authority, CMS seems to be hinting that it may seek to crack down on untimely change of information filings by its indication that in determining whether to revoke a provider or supplier’s enrollment in such instances CMS will weigh factors such as the materiality of the information being reported and how late the report is.

Extension of Medicare’s Reenrollment Bar; Institution of Reapplication Bar

Currently, if a provider or supplier’s enrollment in the Medicare program is revoked for any reason, CMS will institute a “reenrollment bar” for 1-3 years (depending on the underlying reason for the initial revocation) that prohibits the revoked provider or supplier attempting to enroll in the Medicare program for the duration of the bar. Under the Final Rule, CMS is expanding the standard reenrollment bar from 3 to 10 years (again, depending on the reason for the revocation action) and is expanding that bar out to 20 years for providers and suppliers who are revoked a second time. In discussing these expanded reenrollment bars, CMS emphasized that 10-year and 20- year bars will typically be reserved for more serious conduct and not be imposed unless determined to be warranted after careful consideration of all of the required factors. Lastly, CMS now has the ability to add up to three years to a provider’s or supplier’s reenrollment bar (even if such period exceeds the maximum 10-year period) if CMS determines that the provider or supplier is attempting to circumvent its existing reenrollment bar by enrolling in Medicare under a different name, numerical identifier or business identity.

In addition to the expansion of the reenrollment bar, CMS newly instituted a “reapplication bar.” The reapplication bar will seek to prohibit a provider or supplier from enrolling in the Medicare program for up to three years if its initial enrollment application is denied because the provider or supplier submitted false or misleading information on or with (or omitted information from) its application in order to gain enrollment in the Medicare program.

What Next?

As you contemplate your next moves in relation to this new Final Rule, consider the following:

• The Final Rule seeks comments from the provider and supplier community in various places. To the extent you are interested in submitting comments those are due on or before November 4, 2019. Given the lack of comments submitted in connection with the March 2016 proposed rule, the provider and supplier community alike would be well advised to seriously consider submission of comments in effort to help shape any future developments, such as the reporting process for affiliates and disclosable events or development of new Form CMS-855s. While comments aimed at dissuading CMS from continuing with this Final Rule likely won’t be fruitful, there still may be an opportunity to help shape future developments.

• Start reviewing for and identifying current and past “affiliates” and a process for requesting and identifying whether and if those affiliates have any “disclosable events” so if you get a knock on the door from CMS, you are prepared to respond in a timely fashion.

• If you are involved a transaction or considering one, think now about whether the sellers or any owning employees, managing employees or organizations affiliated with the sellers will trigger reporting as affiliates and whether they have any disclosable events. If so, how and when to request that information while you still maintain some degree of leverage over the seller.

• Keep a weathered eye on the horizon for future proposals and most notably the new Form CMS-855 applications.