On November 20, 2020, the Office of Inspector General of the U.S. Department of Health and Human Services (HHS-OIG) approved a final rule titled "Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements." The Final Rule took effect on January 19, 2021, though the effective date of certain portions not discussed here has been delayed until March 22, 2021.

The Final Rule is part of HHS's Regulatory Sprint to Coordinated Care, which aims to reduce regulatory barriers to care coordination and accelerate the transformation of the health care system into one that better pays for value and promotes care coordination. The broad reach of the federal anti-kickback statute potentially inhibits arrangements that advance the transition to value-based care and improve the coordination of patient care. Accordingly, the Final Rule implements seven new safe harbors and modifies four existing safe harbors in order to promote value-based arrangements.

The Anti-Kickback Statute, Civil Monetary Penalty Law and Safe Harbors

The federal anti-kickback statute makes it a criminal offense to knowingly and willfully offer, pay, solicit, or receive remuneration (that is, anything of value) to induce or reward the generation of business for products or services reimbursable by a federal health care program. The statute ascribes criminal liability to both sides of an impermissible "kickback" transaction, and it covers arrangements in which even one purpose is to obtain money for referrals or induce further referrals. Violation carries a maximum fine of $100,000, imprisonment of up to 10 years, or both, and a conviction also leads to automatic exclusion from federal health care programs. In addition, the OIG may initiate administrative proceedings for civil monetary penalties.

Safe harbor regulations describe various payment and business practices that, although they potentially implicate the anti-kickback statute, are not treated as offenses. Compliance with a safe harbor is voluntary. Failing to structure an arrangement to meet a safe harbor does not necessarily mean that the parties have violated the law. However, when an arrangement satisfies each and every element of a regulatory safe harbor, the parties are shielded from liability.

Overview of Changes

The Final Rule creates the following new safe harbors:

• Care coordination arrangements to improve quality, health outcomes, and efficiency

• Value-based arrangements with substantial downside financial risk

• Value-based arrangements with full financial risk

• Patient engagement and support to improve quality, health outcomes, and efficiency

• CMS-sponsored model arrangements and CMS-sponsored model patient initiatives

• Cybersecurity technology and related services

• Codification of statutory exception to the definition of "remuneration" related to ACO Beneficiary Incentive Programs for the Medicare Shared Savings Program

In addition, the Final Rule modifies the following existing safe harbors:

• Personal services and management contracts

• Warranties

• Electronic health records items and services

• Local transportation

New Value-Based Enterprise Safe Harbors

The safe harbors relating to value-based arrangements predominate the Final Rule. These safe harbors fall into two categories: remuneration exchanged between health care providers that participate in such arrangements and remuneration provided to patients.

A "value-based arrangement" is one between participants in a "value-based enterprise" who engage in an activity designed for a "value-based purpose." Not surprisingly, each of these terms has a lengthy and technical definition. In short, the safe harbors for value-based arrangements apply when individuals or entities collaborate under the financial and operational oversight of an accountable body or person and pursuant to a governing document that describes the enterprise and how the members of the enterprise intend to achieve the enterprise's purpose. That purpose, in turn, must be to coordinate and manage the care of a target patient population, improve the quality of care for a target patient population, reduce the costs to or growth in expenditures to payors without reducing the quality of care for the target patient population, or transition to a health care delivery and payment mechanism based on the quality of care and control of costs rather than on the volume of items and services provided.

The three safe harbors for remuneration exchanged between health care providers vary by the type of remuneration protected, the level of financial risk assumed by the parties, and the safeguards included as safe harbor conditions. For example, the "Care Coordination Arrangements to Improve Quality, Health Outcomes, and Efficiency" safe harbor applies only to in-kind remuneration, and the remuneration may not be used more than incidentally for the recipient's billing or financial purposes, or for patient recruitment or the marketing of items or services furnished by the participants.

The "Value-Based Arrangements With Substantial Downside Financial Risk" safe harbor applies where a provider has a meaningful downside financial risk for failure to achieve the value-based purpose of the enterprise during the entire duration of the arrangement. It allows for monetary remuneration, but the arrangement cannot involve pharmaceutical manufacturers, distributors, or wholesalers, pharmacy benefit managers, laboratory companies, pharmacies that primarily compound drugs, medical device or supply manufacturers, or durable medical equipment suppliers. HHS explained that these types of entities are typically on the frontlines of care coordination and pose a higher risk of fraud or abuse.

The third safe harbor concerning arrangements between providers, "Value-Based Arrangements With Full Financial Risk" applies when an enterprise has assumed full financial risk from a payor for patient care services for a target patient population. It imposes fewer conditions than either of the first two safe harbors, though it also restricts the type of businesses that may participate.

The patient engagement and support safe harbor protects remuneration in the form of patient engagement tools and supports furnished directly by participants in a value-based enterprise to patients in a target population. The tools and supports cannot be funded by anyone outside that enterprise, and only in-kind items, goods, or services are protected. The protected remuneration must have a direct connection to the coordination and management of care and must advance one of six enumerated goals to patient care. There is a $500 per-patient annual cap on the value of items and services provided, and the safe harbor includes a list of businesses that may not furnish or otherwise fund or contribute to protected foods and supports, including drug manufacturers, wholesalers, and distributors, and compounding pharmacies.

Other New Safe Harbors

The CMS-sponsored model safe harbor permits remuneration between and among parties to arrangements under a model or other initiative being tested or expanded by the CMS Innovation Center or the Medicare Shared Savings Program. Such remuneration includes the distribution of capitated payments or shared savings. The safe harbor also protects remuneration in the form of incentives to patients under these models. As with the other safe harbors, this one includes a lengthy list of conditions that must be satisfied, including that patient incentives must have a direct connection to the patient's health care. The safe harbor should reduce the need for separate and distinct fraud and abuse waivers for new CMS-sponsored models.

The cybersecurity technology and related services safe harbor protects nonmonetary donations of certain cybersecurity technology and related services to help improve the cybersecurity posture of the health care industry. It allows for the donation of software or other types of information technology that is necessary and used predominantly to implement, maintain, or reestablish the protection of information by preventing, detecting, and responding to cyberattacks. The donor may not condition the donation or the amount or nature of the technology or services to be donated on future referrals or the volume or value of past business generated between the parties.

Finally, the Final Rule codifies the statutory exception to the definition of "remuneration" related to the ACO Beneficiary Incentive Programs for the Medicare Shared Savings Program. Under these programs, Accountable Care Organizations may offer incentive payments to patients to encourage them to obtain medically necessary primary care services. Provided that payments comply with the terms of the shared savings program (which generally allow payments of up to $20 per qualifying service), they are not "remuneration" under the anti-kickback statute.

Modifications to Existing Safe Harbors

The Final Rule modifies the personal services and management contracts safe harbor. That safe harbor has long excluded from the definition of "remuneration" any payments made by a principal to an agent as compensation for the services of the agent, as long as, among other things, the agreement is set forth in writing, covers all of the services provided by the agent, is for a term of at least one year, provides for compensation that is consistent with fair market value, and the services contracted for do not exceed those which are reasonably necessary to accomplish the commercially reasonable business purpose of the services.

Most notably, the safe harbor required that the "aggregate compensation" be set forth in advance. This meant that the agreement had to set forth the precise, total dollar amount to be paid. The Final Rule eliminates the requirement that "aggregate compensation" be set in advance and replaces it with the requirement that "the methodology for determining compensation" be set in advance. This will enable providers to contract for services on a periodic, sporadic, or part-time basis.

In addition, the Final Rule modifies the existing safe harbor for warranties. Previously, the safe harbor applied only to items. The revision protects, for the first time, warranties covering services, as long as the warranty is bundled with one for related items. As under the prior rule, bundled warranty arrangements must be reimbursed by the same federal health care program and in the same payment.

The Final Rule also modifies the existing safe harbor for local transportation to expand distance limitations applicable to residents of rural areas from 50 to 75 miles, and to remove any mileage limitations for patients transported to their residence following discharge from an inpatient facility or release from a hospital after being placed in observation status for at least 24 hours.

Finally, the Final Rule modifies the electronic health records items and services safe harbor. It clarifies that safe harbor protection has always been available for certain cybertechnology software and services, and it expands the safe harbor's potential protection of the donation of software and services related to cybersecurity. In addition, it eliminates the sunset provision, which would only have protected EHR donations occurring on or before December 31, 2021, and it deletes the prohibition on the donation of replacement EHR technology. Finally, it expands the scope of protected donors to include entities with indirect responsibility for patient care such as health systems, accountable care organizations, and parent companies of providers.

Each of the new and modified safe harbors comes with scores of conditions that must be satisfied. OIG received over 300 unique written comments in the response to its proposals, and those comments and OIG's responses are critical to interpreting the safe harbors.