CMS Finalizes New Anti-Fraud Tools Aimed at Affiliations

The Centers for Medicare & Medicaid Services (“CMS”) could revoke or deny a provider’s or supplier’s Medicare enrollment if it determines that any of its affiliations pose an “undue risk” under a Final Rule announced on September 5, 2019 (“Enrollment Rule”). Also under the Enrollment Rule, providers and suppliers (“Providers”) selected by CMS will be required to disclose whether any of their “affiliates” have experienced a “disclosable event.” While CMS estimates that relatively few Providers will be required to make this disclosure, those who are selected may face significant costs in collecting and reporting the information. CMS believes these new authorities will ensure entities and individuals who pose potential risks to the Medicare program are either removed from or kept out of the Medicare program for extended periods of time. The Enrollment Rule is effective as of November 4, 2019.

Revocations Based on Affiliations

The Enrollment Rule gives CMS the authority to revoke or deny a Provider’s Medicare enrollment if CMS determines that the Provider has an affiliation that poses an “undue risk of fraud, waste, or abuse.” As described below, CMS will collect information about a Provider’s affiliations through new disclosure requirements that CMS will impose on identified Providers through the Medicare enrollment process.

Affiliation Disclosures

The Enrollment Rule will grant CMS the authority to require Providers to include information about their own affiliations, as well as the affiliations of their owning or managing employees or organizations, when enrolling or revalidating their Medicare enrollment profile. The Enrollment Rule defines an “affiliation” as:

A 5 percent or greater direct or indirect ownership interest;
A general or limited partnership interest;
An interest in which an individual or entity exercises managerial or operational control;
An interest in which an individual is acting as an officer or director of the entity; or
A reassignment relationship under 42 C.F.R. § 424.80.

Once CMS has revised the 855 forms to include this new disclosure requirement, Providers will be required to disclose, upon request from CMS, any affiliation with a person or entity that has experienced a “disclosable event,” which is defined as follows:

Currently owing an uncollected debt to CMS, regardless of the amount of the debt, whether the debt is currently being repaid (g., as part of a repayment plan), or whether the debt is currently being appealed.
Being subject to a payment suspension under a federal health care program.
Being excluded from participation in Medicare, Medicaid or CHIP.
Having Medicare, Medicaid or CHIP enrollment denied, revoked or terminated, regardless of the reason for the denial, revocation or termination, whether the denial, termination or revocation is currently being appealed, or when the denial, termination or revocation was imposed.

A Provider will only be required to disclose affiliations that it has had in the last 5 years; however, any disclosable event within that 5 year lookback window must be included, even if it happened after a Provider has ended an affiliation. In other words, enrolled Providers must continue to monitor the actions of individuals or entities it is no longer affiliated with. This will be very difficult in many cases and will require the Provider to rely upon information from individuals and entities with whom they are no longer affiliated.

CMS did not set a time limit on disclosable events, other than uncollected debts. So, if a Provider currently has an affiliation with a person whose Medicaid enrollment was denied 20 years ago, it would have to disclose the affiliation at CMS’s request.

CMS will only request such disclosures from Providers whom they believe probably have an affiliation with an entity that has experienced a disclosable event based on the agency’s review of internal and external databases.

Other Components of the Enrollment Rule

Additional Revocation Authority

Additionally, the Enrollment Rule will grant CMS the following authority:

To deny or revoke a Provider’s Medicare enrollment if CMS determines that the Provider is currently revoked under a different name, numerical identifier or business identity, and the applicable reenrollment bar period has not expired.
To revoke a Provider’s Medicare enrollment for all enrolled locations if the Provider billed for services performed at, or items furnished from, a location that it knew or should reasonably have known did not comply with Medicare enrollment requirements.
To revoke a Provider’s Medicare enrollment if he or she has a pattern or practice of ordering, certifying, referring or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries or otherwise fails to meet Medicare requirements.
To revoke a Provider’s Medicare enrollment if the provider or supplier has an existing debt that CMS refers to the United States Department of Treasury.

Additional Reenrollment Bar Authority

The Enrollment Rule will also expand CMS’s authority to bar Providers from reenrolling in Medicare. Specifically, the Enrollment Rule will allow CMS to prohibit a Provider or supplier of Medicare billable items or services from enrolling in the Medicare program for up to 3 years if its enrollment application is denied because the Provider or supplier submitted false or misleading information on its application for enrollment in the Medicare Program.

Additionally, the Enrollment Rule increases the maximum reenrollment bar from 3 to 10 years. The reenrollment bar maximum is increased to 20 years for Providers who have had their Medicare privileges revoked for a second time.

Practical Takeaways

CMS estimates that fewer than 3,000 Providers per year will be required to disclose information related to their affiliations. With that in mind, Providers will have to decide whether and how to prepare for the possibility that they will be requested to make such a disclosure.

CMS left a number of important questions unanswered when it finalized the Enrollment Rule. As many commenters pointed out, it will be very difficult for Providers to know whether anyone they have an affiliation with has experienced some of the disclosable events. While the OIG List of Excluded Individuals and Entities is a reliable source of exclusion information, there is no public database that contains information on debts to Medicare, Medicaid or CHIP, nor does CMS maintain a list of persons whose Medicare enrollment has been denied, revoked or terminated. CMS stated that it intends to issue subregulatory guidance addressing this and a number of other outstanding issues.

While some Providers may take a wait-and-see approach, others may wish to be proactive. One way to reduce risk is to reevaluate reassignment practices. Since reassignment relationships trigger an “affiliation” under the Enrollment Rule, Providers could consider updating contract templates when the Provider takes assignment of billing rights. These revisions could require the reassigning party to disclose any disclosable event to the Provider, just as many Providers require their independent contractors to disclose pending or threatened exclusion.

In light of the Enrollment Rule’s five-year lookback period for affiliations regardless of when the affiliation may have terminated, the language should require the other party to make such a disclosure (or at least respond to a Provider request for information) for five years after the contract terminates. These and other steps may help Providers prepare for a future in which their Medicare enrollment is contingent on the good conduct of other Providers.

CMS has issued the Enrollment Rule as a final rule with comment period. Providers should review the Enrollment Rule carefully and consider submitting a comment to CMS. Comments must be submitted no later than November 4, 2019.

If you would like more information about this topic, please contact: