Alayna Frauhiger
Associate Editor
Loyola University Chicago School of Law, JD 2021
On September 5, 2019, the Centers for Medicare and Medicaid Services (“CMS”) released its final rule with comments on Program Integrity Enhancements to the Provider Enrollment Process (“ The Program Integrity Enhancements”). The final rule gives CMS the power to revoke Medicare, Medicaid, and Children’s Health Insurance Program (CHIP) enrollments of providers or suppliers who have an “affiliation” with previously sanctioned entities, even if those providers and suppliers aren’t directly violating any existing rules themselves. CMS says that this new authority will help to “stop fraud before it happens.”
What to know
The Program Integrity Enhancements to the Provider Enrollment Process creates several new revocation and denial authorities to bolster CMS’s efforts to stop waste, fraud, and abuse. Importantly, a new “affiliations” authority in the rule allows CMS to identify individuals and organizations that pose an undue risk of fraud, waste, or abuse based on their relationships with other previously sanctioned entities. The final rule, which is open for commentary until its effective date, November 4, 2019, builds on CMS’s previous efforts to protect federal health care programs from potential fraud, waste, and abuse.
The rule in a snapshot
The new rule requires healthcare providers and suppliers to disclose any current or previous direct or indirect affiliation with a provider or supplier that: (1) has uncollected debt; (2) has been or is subject to a payment suspension under a federal health care program; (3) has been or is excluded by the Office of Inspector General (OIG) from Medicare, Medicaid, or CHIP; or (4) has had its Medicare, Medicaid, or CHIP billing privileges denied or revoked. It also provides the agency with additional authority to deny or revoke a provider’s or supplier’s Medicare enrollment in certain circumstances, including but not limited to, if: individuals and organizations that pose an undue risk of fraud, waste or abuse based on their relationships with other previously sanctioned entities. CMS broadly defines an “affiliation” to include any of the following: 1) 5% or more ownership, including “passive” investor ownership, 2) partnership interest, including any limited partnership interest, 3)any interest in exercising operational or managerial control, including board membership, 4) officer or director position with any entity; or 5) any reassignment relationship. There are also limitations on partner affiliations under the new rule.
These new provisions in this rule “are necessary to address various program integrity issues and vulnerabilities” by enabling CMS to act against unqualified and potentially fraudulent entities and individuals, which in turn could deter other parties from engaging in improper behavior. CMS reiterated that it would review each situation on a case-by-case basis in determining whether the disclosing entity knew or should have known of the information. The agency intends to issue sub-regulatory guidance clarifying the level of effort that it expects from the provider/supplier for securing relevant affiliation information.
Failing to comply
In determining whether or not to deny or revoke a provider or supplier’s enrollment CMS finalized a “reasonableness” standard. Under the standard, CMS would require “information to be reported only if the disclosing provider or supplier knew or should reasonably have known of said data.” For instance, while a provider or supplier would typically know of a past affiliation, it may not necessarily know whether a statutorily prohibited action occurred or was imposed after the affiliation ceased. CMS stated that we would review each situation on a case-by-case basis in determining whether the disclosing entity knew or should have known of the information.
Applicants who submit false or misleading information in initial applications will be prohibited from reapplying for up to three years, and any provider or supplier whose enrollment has been revoked once will not be permitted to re-enroll for up to ten years. An applicant whose enrollment has been revoked twice will not be permitted to re-enroll for up to 20 years. After an individual or organization is penalized, an appeal process will likely be difficult. The appeal will evaluate whether CMS followed the right process to arrive at the sanction rather than if the CMS made the right decision with the penalty.
Summary of costs and benefits
CMS estimates an annual cost to providers and suppliers of $937,500 in each of the first 3 years of this rule. This cost reflects the information collection burden associated with the requirement that Medicare, Medicaid, and CHIP providers and suppliers disclose certain current and prior affiliations.
CMS projects numerous savings from the finalized provisions including approximately 2,600 new revocations per year, resulting in a 10-year savings of $4.16 billion (based on a projected per-revoked provider amount of $160,000).
A full list of projected savings can be found in the federal register.
Impact moving forward
Although CMS has issued the final rule, it will be enforcing these new requirements via a “phased-in” approach, due to growing concerns from healthcare providers during the comment period over the burden of collecting and evaluating so much affiliate information and meeting new guidelines persuaded CMS to ease into all of the requirements of the new rule.
CMS’s final rule shifts the government’s focus from reimbursing improper payments and later attempting to recoup the fraudulent health care payments, better known as “pay and chase,” to attempting to protect government funds before fraudulent billing occurs. In addition, providers and regulators now bear a huge burden of responsibility for ensuring overall compliance for their healthcare organizations.
Providers and suppliers preparing for initial enrollment or re-enrollment should be prepared to carefully review all affiliations from the last five years and to comply with the new disclosure requirements or they may be in jeopardy of having their enrollment revoked. Not only do the increased disclosure requirements apply to providers and suppliers enrolling in Medicare and Medicaid but the new rule also applies to changes of information that must be reported under the Final Rule.
Moreover, the implementation of the Final Rule will have an enormous impact on the credentialing process. Federal and State payors have historically used the credentialing process as their first line of defense with respect to program integrity, but the new disclosure obligations set out in the Final Rule are quite comprehensive and require third-party billing companies and credentialing companies to diligently work to better ensure that each submission is both accurate and complete before submitting the credentialing package to a Federal or State payor. On the payor side of the credentialing equation, professional credentialing companies will likely see an exponential increase in the demand for their verification and screening services. Furthermore, it is likely to see private payors, medical centers, and healthcare systems adopt program integrity safeguards similar to those outlined in the Final Rule as they take steps to protect their organizations from fraud, waste, and abuse.
