CMS Updates: COVID-19 Data Reporting and Enforcement Process for Hospitals that Fail to Report

On October 6, 2020, the Centers for Medicare & Medicaid Services (“CMS”) released a memorandum updating the COVID-19 reporting requirements for hospitals and critical access hospitals (together “Hospitals”) and setting forth the enforcement process CMS will follow to address Hospitals’ non-compliance with the reporting requirements (“Memorandum”). The Memorandum can be found here. Details on the reporting updates and CMS’s enforcement process are discussed below.

Background

On September 2, 2020, CMS published an Interim Final Rule (“Rule”) establishing additional COVID-19 public health emergency (“PHE”) data reporting requirements for Hospitals and clinical laboratories. CMS requires consistent data reporting to assist the White House Coronavirus Taskforce to track the transmission of SARS-CoV-2 and to identify potential strains in the health care delivery system.

With respect to Hospitals, CMS revised the conditions of participation at 42 CFR §§ 482.42(e) and 485.640(d) to require Hospitals to report COVID-19 information in a standardized format in accordance with a frequency as specified by the Secretary of the Department of Health and Human Services, during the PHE. CMS set forth in great detail the various Hospital capacity, utilization and other data elements it requires Hospitals to report. For example, CMS requires reporting of: the total number of hospitalized suspected or confirmed positive COVID‑19 patients; the total number of occupied staffed inpatient beds; the total number of staffed ICU beds and the number of ICU beds that are occupied; the total number of mechanical ventilators and the number of ventilators in use; the previous day’s patient deaths of those individuals with confirmed or suspected COVID-19; on-hand supply and ability to obtain personal protective equipment, medications such as Remdesivir and ventilator supplies. For additional information on the Rule, see this Hall Render blog post. And while CMS clarified in the Rule that non-compliant Hospitals could be subject to termination under the Condition of Participation found at 42 C.F.R. §489.53(a)(3) if they failed to report the required data, it did not offer any specifics on the enforcement process. The Memorandum provides details on CMS’s enforcement procedure.

Enforcement Process

CMS has established a multi-step process to enforce the PHE reporting requirements applicable to Hospitals. This enforcement process will be ongoing through the duration of the PHE. 14 weeks of sustained non-compliance with reporting requirements can lead to termination as follows:

Hospitals that fail to meet daily reporting requirements will receive an initial notification of non-compliance from CMS.
Three weeks after receiving the initial notification of non-compliance, those Hospitals that continue to fail to meet the daily reporting requirements will receive a second reminder notification advising such Hospitals that non-compliance will lead to future enforcement actions including the possibility of termination of the Medicare provider agreement.
After six weeks from the initial notification date, non-compliant Hospitals will receive the first in a series of enforcement notification letters. Hospitals will have one week to demonstrate compliance.
Continued non-compliance will lead to consecutive second and third enforcement notification letters, each providing for a calendar week to come into compliance. The third enforcement notification letter will indicate that the Hospital has one calendar week to comply with reporting requirements, otherwise, the Hospital will receive a fourth and final enforcement notification letter.
Hospitals that do not comply pursuant to the timeline set forth in the third enforcement notification letter will receive a fourth and final enforcement notification letter including a notice of termination to be effective 30 days after the date of the fourth notification letter. After 30 days and following 14 weeks of sustained non‑compliance with reporting requirements, the Hospital’s Medicare provider agreement can be terminated subject to the right of appeal. A “Hospital Mandatory COVID-19 Reporting Enforcement Workflow” chart showing the steps CMS will take from notification of non-compliance to termination from the Medicare program is set forth here.
Of note, Steps 1 and 2 of the enforcement process are only applicable from October 7 through November 18, 2020. For non-compliance identified after this time period, CMS will skip Steps 1 and 2 and proceed directly to Step 3 and begin sending enforcement notification letters.

Reporting Requirements Update

Pursuant to the Memorandum, CMS provided certain important updates:

The first 25 data elements required to be reported by CMS must be reported by Hospitals daily. However, effective October 6, 2020, psychiatric and rehabilitation hospitals need only report weekly as these types of specialty hospitals are less impacted by COVID-19. Effective November 5, 2020, Remdesivir use and inventory reporting, and critical staffing shortage reporting will become optional (data elements 21 through 25). For details on all of the data elements required by CMS and helpful FAQs, click here.
For data elements 26 through 32 which address the availability of critical supplies, Hospitals need only report once a week on Wednesdays.
Optional beginning on October 19, 2020, Hospitals may submit daily influenza data reports. Psychiatric and rehabilitation hospitals need only report weekly. However, CMS expects influenza data reporting to become mandatory “in the coming weeks” with further notices to follow.

Practical Takeaways

CMS has updated the data elements Hospitals must report but has tried to decrease burdens for psychiatric and rehabilitation hospitals and by making certain data elements reporting weekly or optional.
Hospitals should watch for a notification from CMS announcing mandatory influenza data reporting.
Although the COVID-19 data reporting enforcement process CMS is implementing is intimidating, CMS provides a number of opportunities for Hospitals to comply before it will terminate a provider agreement. In the Memorandum, CMS stated that Hospitals may work with HHS Team to develop a plan to meet requirements and may contact the HHS Protect Services Desk for assistance. Further, CMS recognizes that there may be data transmission problems. Accordingly, if Hospitals receive a notice of non‑compliance, they will have the opportunity to provide evidence of compliance. CMS will rescind enforcement remedies after Hospitals successfully demonstrate they have complied with the reporting requirements.
Hospitals should review their internal processes, including responsible parties and applicable policies and procedures, to ensure they will meet the latest data reporting requirements. Given the possibility of technical glitches, Hospitals may wish to confirm with CMS that submitted data is being received to avoid enforcement action.
Hospitals should have a back-up plan to ensure consistency and ongoing reporting in the event responsible parties are unable to complete data collection and submission on a daily basis.
To ensure ongoing compliance, we encourage Hospitals to include COVID-19 reporting on their annual Work Plan during the PHE.

If you have any questions, please contact: