/>iA new federal law requires health care business entities to disclose personal information and photographs of persons with ownership and control over their business. The Centers for Medicare & Medicaid (CMS) and other federal and state agencies with oversight responsibilities for health care providers (e.g., State Medicaid Agencies) will soon have access to this information, allowing these agencies to easily verify enrollment and licensing records already submitted by health care providers.
Why this matters for you. From Wall Street to Main Street to your street, the vast majority of private and many nonprofit entities will be swept into Corporate Transparency Act (CTA) compliance. If you own or control a health care industry business entity, you need to pay attention. Not only is initial reporting important, but so is ongoing compliance and coordination with other information disclosures you are currently making, such as Medicare and Medicaid enrollment, licensure and ownership disclosures, and similar filings health care providers make on a regular basis.
What is this law about? If you have not heard of the CTA, you are not alone. Many business owners, executives and their professional advisors, are taken aback upon learning of the CTA’s existence and scope. At its core, the CTA requires reporting of personal direct and indirect beneficial ownership and control information pertaining to businesses operating in the U.S. The personal identifying information (PII) includes name, date of birth, physical home address and your photograph. The financial crimes enforcement arm of the U.S. Department of Treasury (FinCEN) is currently building out the Beneficial Ownership Secure System (BOSS) to receive, store and manage this vast influx of information. FinCEN estimates that over 32 million now-existing businesses will be required to report in year one. This law aims to prevent money laundering, illicit financial activities, corrupt practices and terrorist financing, at the expense of many legitimate businesses (and their owners and control persons) being swept up by these expansive new reporting requirements.
Who must report? Beginning January 1, 2024, PII must be reported for natural persons owning, directly or indirectly, 25% or more of any class or category of profit ownership in a business, or who have or may assert, directly or indirectly, “substantial control” over a business.
What ongoing reporting obligation exists? Once the initial report is filed, this information must be updated within 30 days of any subsequent event that makes the previously reported information inaccurate. Attribution of ownership and what constitutes substantial control will vary from business to business, and will require analysis and professional advice.
Exempt Entities. Some categories of business entities are exempted from CTA compliance. These generally include regulated business entities, such as publicly traded companies, insurance businesses, banking businesses, 501(c) federally tax-exempt non-profit entities, and quasi-governmental organizations. There are two other exemptions of particular importance to the health care sector:
Large Operating Entity Exemption
In addition to the other exempt categories, a catch-all exemption is available for any business entity that meets all three of the following thresholds: (1) operate from a physical commercial street address in the U.S., (2) have 21 or more full-time U.S. employees, and (3) generate more than $5 million in annual U.S. gross receipts as reported on the business entity’s prior year’s federal tax filing. Missing any of these criteria will render a business ineligible for this exemption. One key to this exemption is that only full-time, W-2 employees of the entity itself qualify.
Many operators in the health care industry rely upon part-time employees, leased employees, independent contractors and other mechanisms that could frustrate an entity’s ability to reach a 21 or more full-time employee count. Further, FinCEN has declined to permit companies to consolidate employee headcount across affiliated entities. This preclusion may also implicate affiliated professional entity and administrative service organization structures that are common for health care providers. It remains an open issue as to whether FinCEN will consider employees placed at an administrative service organization or professional employer organization to be the “employees” of the reporting entity.
With respect to professional entities (PCs, PLLCs), there are also special rules regarding who qualifies as an employee if the person also holds an ownership interest in the professional entity. Specifically, some “employees” will not be counted in the minimum of 21 employees for the exemption if that person also has an ownership interest in the reporting entity.
Exempt Entities’ Wholly Owned Subsidiaries Exemption
The CTA also contains an exemption for a wholly owned subsidiary of an exempt entity. For example, if a parent hospital corporation is a 501(c)(3) tax-exempt organization, and wholly-owns a subsidiary physician practice, that physician practice would also be exempt from CTA reporting. This exemption only applies, however, to wholly owned subsidiaries. For providers with large and complex organizational charts, it is important to analyze each individual entity, because joint ventures would not qualify for this exemption, even if all owners are themselves exempt. This exemption also does not apply to upstream entities, meaning that a holding company that is not exempt would not qualify for exemption because of its investment in an exempt entity.
Corporate Practice of Professions
Many health care providers are specifically structured to comply with state laws related to the corporate practice of health care professions. These structures, which involve affiliated administrative service organizations, may directly implicate the question of who has substantial “control” over a professional practice entity. The CTA invites analysis of the administrative services arrangement between the parties, and whether reporting will be required as it relates to indirect leadership and control of the practice entity and its operations in part by the administrative services provider. Non-exempt entities operating in this space must carefully consider both who needs to be reported, and how those reporting relationships align with state laws governing the corporate practice of professions.
Medicare/Medicaid Enrollment; Licensure and Ownership Disclosures
Health care providers are already regularly required to disclose ownership and managerial control information in a number of contexts – enrollment in Medicare and/or Medicaid, as well as applications for certain types of provider licenses. Because the BOSS system will enable access by state and federal agencies to the ownership information reported by non-exempt health care provider entities, there is a new, distinct capability for CMS and other regulatory agencies to verify a provider’s ownership structure. To the extent the disclosures do not match, this presents another potential opportunity for sanction by federal and state regulatory agencies who may seek to terminate provider enrollment based on inaccurate enrollment records. Of course, the CTA definitions of ownership may not match perfectly with Medicare, Medicaid or other state licensure definitions, so health care providers and suppliers must consider the variations and report accordingly.
What will compliance look like? Businesses will need to compile, maintain and update their reported PII constantly to meet the CTA’s compliance requirements. Any change to or correction of previously reported information must be done within 30 days of the event, not when the business becomes aware of the event. All newly formed business entities beginning January 1, 2024, will be required to file their initial CTA report within 30 calendar days of formation[1]. Reporting company businesses in existence before January 1, 2024, will have one year to make their original CTA report filing, along with any subsequent amendment filings that would have been required had the report been filed on January 1, 2024. That is, existing businesses have until January 1, 2025, to file the initial reports, but must incorporate any changes to their reporting information that take place during calendar year 2024.
What happens if you don’t comply? There are steep fines ($500 per day up to $10,000) per incident and possible jail time (up to two years) for those failing to timely and properly comply with the CTA. Those who fail to file their initial report will also be subject to fines for failing to file what should have been subsequent filings – the fines can rack up. Further, the IRS recently announced increased enforcement, intending to utilize new data analytics technology to identify audit targets. FinCEN’s database has been identified by the IRS as a key component to such data analytics initiatives. As noted above, this information is also available to other federal and state agencies (like CMS), who can use this new database to verify other enrollment information and potentially take action against health care providers.
Who may access FinCEN’s Beneficial Ownership Secure System (BOSS)? Information in the BOSS will be accessible to law enforcement at the federal, state and local levels, and includes the law enforcement arms of various federal agencies including CMS. Financial institutions may also have access upon their customer’s consent—anticipate CTA disclosures becoming a key component of corporate and regulatory diligence for future transactions. Importantly, this information is not available to the general public and is not accessible through Freedom of Information Act (FOIA) requests.
Conclusion. The compliance requirements under the CTA go live on January 1, 2024, and you have only the waning remainder of this year to take any action to prepare for your future compliance position. Now is the time to discuss the CTA with your legal team for guidance.
[1] There is a pending proposal to change this to 90 days, but only for entities created or registered in 2024.
