[Federal Register Volume 84, Number 175 (Tuesday, September 10, 2019)]
[Rules and Regulations]
[Pages 47794-47857]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-19208]
[[Page 47793]]
Vol. 84
Tuesday,
No. 175
September 10, 2019
Part III
Department of Health and Human Services
-----------------------------------------------------------------------
Centers for Medicare & Medicaid Services
-----------------------------------------------------------------------
42 CFR Parts 405, 424, et al.
Medicare, Medicaid, and Children's Health Insurance Programs; Program
Integrity Enhancements to the Provider Enrollment Process; Final Rule
Federal Register / Vol. 84 , No. 175 / Tuesday, September 10, 2019 /
Rules and Regulations
[[Page 47794]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
42 CFR Parts 405, 424, 455, 457, and 498
[CMS-6058-FC]
RIN 0938-AS84
Medicare, Medicaid, and Children's Health Insurance Programs;
Program Integrity Enhancements to the Provider Enrollment Process
AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.
ACTION: Final rule with comment period.
-----------------------------------------------------------------------
SUMMARY: This final rule with comment period implements statutory
provisions that require Medicare, Medicaid, and Children's Health
Insurance Program (CHIP) providers and suppliers to disclose certain
current and previous affiliations with other providers and suppliers.
In addition, it provides the agency with additional authority to deny
or revoke a provider's or supplier's Medicare enrollment in certain
specified circumstances. The provisions we are finalizing in this rule
are necessary to address various program integrity issues and
vulnerabilities by enabling CMS to take action against unqualified and
potentially fraudulent entities and individuals, which in turn could
deter other parties from engaging in improper behavior.
DATES: Effective date: This final rule with comment period is effective
on November 4, 2019.
Comment date: To be assured consideration, comments regarding
sections II.A.1. and 2. of this final rule with comment period and
Sec. Sec. 424.519 and 455.107 must be received at one of the addresses
provided below, no later than 5 p.m. on November 4, 2019.
ADDRESSES: In commenting, please refer to file code CMS-6058-FC.
Because of staff and resource limitations, we cannot accept comments by
facsimile (FAX) transmission.
Comments, including mass comment submissions, must be submitted in
one of the following three ways (please choose only one of the ways
listed):
1. Electronically. You may submit electronic comments on this
regulation to http://www.regulations.gov. Follow the ``Submit a
comment'' instructions.
2. By regular mail. You may mail written comments to the following
address only: Centers for Medicare & Medicaid Services, Department of
Health and Human Services, Attention: CMS-6058-FC, P.O. Box 8013,
Baltimore, MD 21244-8013.
Please allow sufficient time for mailed comments to be received
before the close of the comment period.
3. By express or overnight mail. You may send written comments to
the following address only: Centers for Medicare & Medicaid Services,
Department of Health and Human Services, Attention: CMS-6058-FC, Mail
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
For information on viewing public comments, see the beginning of
the SUPPLEMENTARY INFORMATION section.
FOR FURTHER INFORMATION CONTACT: Frank Whelan, (410) 786-1302.
SUPPLEMENTARY INFORMATION:
I. Executive Summary and Background
A. Executive Summary
1. Purpose and Need for Regulatory Action
This final rule with comment period will implement a provision of
the Social Security Act (the Act) that requires Medicare, Medicaid, and
Children's Health Insurance Program (CHIP) providers and suppliers to
disclose any current or previous direct or indirect affiliation with a
provider or supplier that--(1) has uncollected debt; (2) has been or is
subject to a payment suspension under a federal health care program;
(3) has been or is excluded by the Office of Inspector General (OIG)
from Medicare, Medicaid, or CHIP; or (4) has had its Medicare,
Medicaid, or CHIP billing privileges denied or revoked. This provision
permits the Secretary to deny enrollment based on such an affiliation
when the Secretary determines that the affiliation poses an undue risk
of fraud, waste, or abuse. Also, this final rule with comment period
will revise various provider enrollment provisions in 42 CFR part 424,
subpart P, and certain program integrity provisions in 42 CFR parts
405, 455, and 457. We proposed these provisions in a proposed rule
published in the March 1, 2016 Federal Register (81 FR 10720) titled,
``Medicare, Medicaid, and Children's Health Insurance Programs; Program
Integrity Enhancements to the Provider Enrollment Process.''
As discussed in greater detail in section II. of this final rule
with comment period, the provisions we are finalizing in this rule are
necessary to address various program integrity issues and
vulnerabilities. We believe that these provisions will help make
certain that entities and individuals who pose risks to the Medicare
and Medicaid programs and CHIP are removed from and kept out of these
programs; this final rule with comment period will also assist in
preventing providers and suppliers from circumventing Medicare
requirements through name and identity changes, as well as through
elaborate, inter-provider relationships. In short, this final rule with
comment period will enable us to take action against unqualified and
potentially fraudulent entities and individuals, which in turn could
deter other parties from engaging in improper behavior.
The following are the principal legal authorities for our final
provisions:
Section 1902(kk)(3) of the Act,\1\ as amended by section
6401(b) of the Affordable Care Act, which mandates that states require
providers and suppliers to comply with the same disclosure requirements
established by the Secretary under section 1866(j)(5) of the Act.\2\
---------------------------------------------------------------------------
\1\ Because section 6401(b) of the Affordable Care Act
erroneously added a duplicate section 1902(ii) of the Act, the
Congress enacted a technical correction in the Medicare and Medicaid
Extenders Act of 2010 (MMEA) (Pub. L. 111-309) to redesignate
section 1902(ii) of the Act as section 1902(kk) of the Act, a
designation we will use in this final rule with comment period.
\2\ Section 1304 of the Health Care and Education Reconciliation
Act (Pub. L. 111-152) added a new paragraph (j)(4) to section 1866
of the Act, thus re-designating the subsequent paragraphs.
Accordingly, we are interpreting the reference in section
1902(kk)(3) of the Act to ``disclosure requirements established by
the Secretary under section 1866(j)(4)'' of the Act to mean the
disclosure requirements described in section 1866(j)(5) of the Act.
---------------------------------------------------------------------------
Section 2107(e)(1) of the Act, as amended by section
6401(c) of the Affordable Care Act, which makes the requirements of
section 1902(kk) of the Act, including the disclosure requirements,
applicable to CHIP.
Section 1866(j) of the Act, which provides specific
authority with respect to the enrollment process for providers and
suppliers.
Sections 1102 and 1871 of the Act, which provide general
authority for the Secretary to prescribe regulations for the efficient
administration of the Medicare program.
2. Summary of the Major Provisions
The major provisions of this final rule with comment period will do
the following:
Implement a provision of the Act that requires Medicare,
Medicaid, and CHIP providers and suppliers to disclose any current or
previous direct or indirect affiliation with a provider or supplier
that has uncollected debt; has been or is subject to a payment
suspension under a federal health care program; has been excluded from
[[Page 47795]]
Medicare, Medicaid, or CHIP; or has had its Medicare, Medicaid, or CHIP
billing privileges denied or revoked (all of which are hereafter
occasionally referred to as ``disclosable events''), and that permits
the Secretary to deny enrollment based on such an affiliation when the
Secretary determines that it poses an undue risk of fraud, waste, or
abuse.
++ Define the terms ``affiliation,'' ``disclosable event,''
``uncollected debt,'' and ``undue risk'' as they pertain to this
provision of the Act.
Provide CMS with the authority to do the following:
++ Deny or revoke a provider's or supplier's Medicare enrollment if
CMS determines that the provider or supplier is currently revoked under
a different name, numerical identifier, or business identity, and the
applicable reenrollment bar period has not expired.
++ Revoke a provider's or supplier's Medicare enrollment--including
all of the provider's or supplier's practice locations, regardless of
whether they are part of the same enrollment--if the provider or
supplier billed for services performed at, or items furnished from, a
location that it knew or should reasonably have known did not comply
with Medicare enrollment requirements.
++ Revoke a physician's or eligible professional's Medicare
enrollment if he or she has a pattern or practice of ordering,
certifying, referring, or prescribing Medicare Part A or B services,
items, or drugs that is abusive, represents a threat to the health and
safety of Medicare beneficiaries, or otherwise fails to meet Medicare
requirements.
++ Increase the maximum reenrollment bar from 3 to 10 years, with
exceptions as stated in this rule.
++ Prohibit a provider or supplier from enrolling in the Medicare
program for up to 3 years if its enrollment application is denied
because the provider or supplier submitted false or misleading
information on or with (or omitted information from) its application in
order to gain enrollment in the Medicare program.
++ Revoke a provider's or supplier's Medicare enrollment if the
provider or supplier has an existing debt that CMS refers to the United
States Department of Treasury.
++ Deny a provider's or supplier's Medicare enrollment application
if--(1) the provider or supplier is currently terminated or suspended
(or otherwise barred) from participation in a state Medicaid program or
any other federal health care program; or (2) the provider's or
supplier's license is currently revoked or suspended in a state other
than that in which the provider or supplier is enrolling.
3. Summary of Costs and Benefits
a. Costs
As explained in greater detail in sections IV. and V. of this final
rule with comment period, we estimate an annual cost to providers and
suppliers of $937,500 in each of the first 3 years of this rule. This
cost involves the information collection burden associated with the
requirement that Medicare, Medicaid, and CHIP providers and suppliers
disclose certain current and prior affiliations.
b. Savings
As described further in section V. of this final rule with comment
period, we project the following savings from our finalized
provisions:'
Our new revocation authorities will lead to approximately
2,600 new revocations per year, resulting in a 10-year savings of $4.16
billion (based on a projected per-revoked provider amount of $160,000).
Our new reenrollment and reapplication bar provisions will
apply to approximately 400 of CMS' revocations per year, resulting in
an estimated 10-year actual savings of $1.79 billion (based on a
projected per-revoked provider amount of $160,000) and a caused savings
of $4.48 billion. ``Caused savings'' refers to the full amount of money
that will be saved based on the new reenrollment and reapplication bars
applied over 10 years; a large portion of the savings will be made
after the first 10-year period of interest and will not be fully
actualized until year 20. (Section IV of this final rule with comment
period discusses the concept of ``caused savings'' in greater detail.)
Concerning our affiliation provisions, over the last 5
years, $51.9 billion (with adjusted factors applied) has been paid to
2,097 entities with affiliations stemming from the revoked Medicare
enrollment of an associated individual or other entity. Adjusted
factors refer to adjustments made to gross billing, based on provider
and supplier type, in relation to the percentage of services that are
not transferred to a different provider or supplier after a revocation.
There is a range across provider and supplier types of what percentage
of services transfer to other practitioners or entities after a
revocation--that is, they were legitimate services--versus what
percentage of services do not transfer to another practitioner or
entity--that is, the services were never rendered, were medically
unnecessary, or for some other reason do not result in a transfer of
services to another practitioner or entity. If the affiliations/undue
risk revocation authority we are finalizing in this rule had been in
place during that period, we project that CMS would have taken
revocation action in approximately 40 percent of identified prior
affiliation cases (or approximately 838 cases) based on a determination
of undue risk of fraud, waste, or abuse. We accordingly would not have
paid those problematic providers. As a result, over the last 5 years
the program would have seen a resulting $20.7 billion in cost-avoidance
savings, or an average of $4.14 billion per year. We recognize, though,
that our 40 percent figure is merely an estimate. To accommodate the
possibility of fluctuation, below are projections of savings based on
figures of 20 percent, 40 percent, and 60 percent:
Table 1--Range of Projected Savings Related to Affiliations Provisions
------------------------------------------------------------------------
5-year Annual
Percentage affiliations affiliations
authority total authority total
------------------------------------------------------------------------
60% of the 5-year adjusted $31.1 billion over $6.22 billion.
factor total of $51.9 billion. 5 years.
40% of the 5-year adjusted $20.7 billion over $4.14 billion.
factor total of $51.9 billion. 5 years.
20% of the 5-year adjusted $10.3 billion over $2.06 billion.
factor total of $51.9 billion. 5 years.
------------------------------------------------------------------------
Given the foregoing savings estimates for revocations based on new
authorities other than the affiliations authority, reenrollment and
reapplication bars, and revocations stemming from the affiliations
authority (using our median 40 percent figure), we project a total
savings over a 10-year period of $47.35 billion.
[[Page 47796]]
B. General Overview
1. Medicare
The Medicare program (title XVIII of the Act) is the primary payer
of health care for approximately 54 million enrolled beneficiaries.
Under section 1802(a) of the Act, a beneficiary may obtain health care
services from an individual or organization qualified to participate in
the Medicare program. Qualifications to participate are specified in
statute and in regulations (see, for example, sections 1814, 1815,
1819, 1833, 1834, 1842, 1861, 1866, and 1891 of the Act; and 42 CFR
chapter IV, subchapter G, of the regulations, which concerns standards
and certification requirements).
Providers and suppliers furnishing services must comply with the
Medicare requirements stipulated in the Act and in our regulations.
These requirements are meant to confirm compliance with applicable
statutes as well as to promote the furnishing of high quality care. As
Medicare program expenditures have grown, we have increased our efforts
to make certain that only qualified individuals and organizations are
allowed to enroll in and maintain their enrollment in Medicare.
2. Medicaid and CHIP
The Medicaid program (title XIX of the Act) is a joint federal and
state health care program that covers nearly 70 million low-income
individuals. States have considerable flexibility in how they
administer their Medicaid programs within a broad federal framework,
and programs vary from state to state. CHIP (title XXI of the Act) is a
joint federal and state health care program that provides health care
coverage to more than 8.4 million children. In operating Medicaid and
CHIP, states historically have permitted the enrollment of providers
who meet the state requirements for program enrollment as well as any
applicable federal requirements (such as those in 42 CFR part 455).
State enrollment requirements must be consistent with section
1902(a)(23) of the Act and implementing regulations at Sec. 431.51,
under which states may set reasonable standards relating to the
qualifications of providers but may not restrict the right of
beneficiaries to obtain services from any person or entity that is both
qualified and willing to furnish such services.
C. General Background on the Enrollment Process
1. The 2006 Provider Enrollment Final Rule
In the April 21, 2006 Federal Register (71 FR 20754), we published
a final rule titled, ``Medicare Program; Requirements for Providers and
Suppliers to Establish and Maintain Medicare Enrollment.'' The final
rule set forth certain requirements in 42 CFR part 424, subpart P, that
providers and suppliers must meet to obtain and maintain Medicare
billing privileges. We cited in that rule sections 1102 and 1871 of the
Act as general authority for our establishment of these requirements,
which were designed for the efficient administration of the Medicare
program.
2. The 2011 Provider Enrollment Final Rule
In the February 2, 2011 Federal Register (76 FR 5861), we published
a final rule with comment period titled, ``Medicare, Medicaid, and
Children's Health Insurance Programs; Additional Screening
Requirements, Application Fees, Temporary Enrollment Moratoria, Payment
Suspensions and Compliance Plans for Providers and Suppliers.'' This
final rule with comment period implemented various provisions of the
Act, including the following:
Required submission of application fees by institutional
providers and suppliers as part of the Medicare, Medicaid, and CHIP
provider enrollment processes.
Establishment of Medicare, Medicaid, and CHIP provider
enrollment screening categories and corresponding screening
requirements.
Authorization of temporary moratoria on the enrollment of
new Medicare, Medicaid, and CHIP providers and suppliers of a
particular type (or the establishment of new practice locations of a
particular type) in a geographic area when necessary to combat fraud,
waste, or abuse.
3. Form CMS-855--Medicare Enrollment Application
Under Sec. 424.510, a provider or supplier must complete, sign,
and submit to its assigned Medicare contractor the appropriate Form
CMS-855 (OMB Control No. 0938-0685) application in order to enroll in
the Medicare program and obtain Medicare billing privileges. The Form
CMS-855, which can be submitted via paper or electronically through the
internet-based Provider Enrollment, Chain, and Ownership System (PECOS)
process, captures information about the provider or supplier that is
needed for CMS or its contractors to determine whether the provider or
supplier meets all Medicare requirements. The enrollment process helps
ensure that unqualified and potentially fraudulent individuals and
entities do not bill Medicare and that the Medicare Trust Funds and
Medicare beneficiaries are accordingly protected. Data collected during
the enrollment process include but are not limited to--(1) general
identifying information (for example, legal business name, tax
identification number); (2) licensure data; (3) practice locations; and
(4) information regarding the provider's or supplier's owning and
managing individuals and organizations. The application is used for a
variety of provider enrollment transactions, including the following:
Initial enrollment--The provider or supplier is--(1)
enrolling in Medicare for the first time; (2) enrolling in another
Medicare contractor's jurisdiction; or (3) seeking to enroll in
Medicare after having previously been enrolled.
Change of ownership--The provider or supplier is reporting
a change in its ownership.
Revalidation--The provider or supplier is revalidating its
Medicare enrollment information in accordance with Sec. 424.515.
Reactivation--The provider or supplier is seeking to
reactivate its Medicare billing privileges after it was deactivated in
accordance with Sec. 424.540.
Change of information--The provider or supplier is
reporting a change in its existing enrollment information in accordance
with Sec. 424.516.
Besides the aforementioned 2006 and 2011 final rules, we have made
several other regulatory changes to 42 CFR part 424, subpart P, to
address various payment safeguard issues that have arisen.
D. Background on Disclosure of Affiliations for Medicare, Medicaid, and
CHIP (Section 1866(j)(5) of the Act)
As previously mentioned, providers and suppliers must complete and
submit (via paper or through internet-based PECOS) a Form CMS-855
application to their Medicare contractor in order to enroll or
revalidate their enrollment in the Medicare program. The Form CMS-855
requires the provider or supplier to disclose certain information, such
as general identifying data (for example, legal business name), the
provider's or supplier's practice locations, and the provider's or
supplier's owning and managing employees and organizations.
[[Page 47797]]
In operating Medicaid and CHIP, states may have somewhat different
enrollment processes, although all states must comply with the federal
requirements in 42 CFR part 455, subparts B and E, as well as the
``free choice of provider'' requirement in Sec. 431.51. Under 42 CFR
part 455, subpart B, providers and disclosing entities must furnish
disclosures regarding ownership and control of the provider or
disclosing entity, certain business transactions, and criminal
convictions related to federal health care programs.
Section 1866(j)(5) of the Act, added by section 6401(a)(3) of the
Affordable Care Act, states that a provider or supplier that submits an
enrollment application or a revalidation application for Medicare,
Medicaid, or CHIP shall disclose (in a form and manner and at such time
as determined by the Secretary) any current or previous affiliation
(directly or indirectly) with a provider or supplier that has
uncollected debt; has been or is subject to a payment suspension under
a federal health care program (as defined in section 1128B(f) of the
Act); has been excluded from participation from Medicare, Medicaid, or
CHIP; or has had its billing privileges denied or revoked. Under
section 1866(j)(5)(B) of the Act, the Secretary may deny the
application if the Secretary determines that the affiliation poses an
undue risk of fraud, waste, or abuse.
Pursuant to section 1902(kk)(3) to the Act, states must require
providers and suppliers to comply with the same disclosure requirements
established by the Secretary under section 1866(j)(5) of the Act.
Further, pursuant to section 2107(e)(1) of the Act, the requirements of
section 1902(kk) of the Act, including the disclosure requirements, are
applicable to CHIP.
II. Provisions of the Proposed Regulations and Analysis of and
Responses to Public Comments
We received 87 timely pieces of correspondence in response to the
March 1, 2016 proposed rule. A summary of the major issues raised and
our responses thereto follow.
A. Disclosure of Affiliations
We proposed in the March 1, 2016 proposed rule to implement section
1866(j)(5) of the Act. We explained that, consistent with this
statutory provision, the implementation of these disclosure provisions
would help combat fraud, waste, and abuse by enabling CMS and the
states to: (1) Better track current and past relationships between and
among different providers and suppliers; and (2) identify and take
action on affiliations among providers and suppliers that pose an undue
risk to Medicare, Medicaid, and CHIP.
In November 2008, the OIG of the Department of Health and Human
Services issued an Early Alert Memorandum titled ``Payments to Medicare
Suppliers and Home Health Agencies Associated with `Currently Not
Collectible' Overpayments'' (OEI-06-07-00080). The memorandum stated
that anecdotal information from OIG investigators and Assistant United
States Attorneys indicated that suppliers of durable medical equipment,
prosthetics, orthotics, and supplies (DMEPOS) with outstanding Medicare
debts may inappropriately receive Medicare payments by, among other
means, operating businesses that are publicly fronted by business
associates, family members, or other individuals posing as owners. In
its study, the OIG selected a random sample of 10 DMEPOS suppliers in
Texas that each had Medicare debt of at least $50,000 deemed currently
not collectible (CNC) by CMS during 2005 and 2006. The OIG found that 6
of the 10 reviewed DMEPOS suppliers were associated with 15 other
DMEPOS suppliers or home health agencies (HHAs) that received Medicare
payments totaling $58 million during 2002 through 2007. Most associated
DMEPOS suppliers had lost their billing privileges by January 2005 and
had accumulated a total of $6.2 million of their own CNC debt to
Medicare. The OIG also found that most of the reviewed DMEPOS suppliers
were connected to other DMEPOS suppliers and HHAs through shared owners
or managers.
On March 2, 2011, the OIG testified before the Congress that fraud
schemes in South Florida often rely on the use of networks of
affiliations among fraudulent owners.\3\ In those schemes, Medicare
providers and suppliers disguise their true ownership by the use of
nominee owners to bill Medicare fraudulently on a temporary basis so as
to evade detection. Providers and suppliers will--(1) hide their true
ownership through the use of nominee owners; (2) bill the Medicare
program for millions of dollars; and (3) close down, take over another
company, and then repeat the process in another location. In addition
to this information from the OIG, our own experience has shown that
networks of individuals and entities can be behind widespread fraud
schemes; in some instances, shared owners were behind multiple
providers and suppliers engaging in improper billings.
---------------------------------------------------------------------------
\3\ https://oig.hhs.gov/testimony/docs/2011/perez_testimony_03022011.pdf.
---------------------------------------------------------------------------
We have long shared these and other concerns the OIG has expressed
regarding individuals and entities that enroll in Medicare (or own or
operate Medicare providers or suppliers), accumulate large debts or
otherwise engage in inappropriate activities, and depart the Medicare
program voluntarily or involuntarily, yet continue their behavior by--
(1) reentering the program in some capacity (for instance, as an
owner); and/or (2) shifting their activities to another enrolled
Medicare provider or supplier with which they are affiliated. To
illustrate, a provider or supplier may engage in inappropriate billing,
exit Medicare prior to detection, and then change its name or business
identity in order to reenroll in Medicare under this new identity.
Another example involves an entity that owns or manages several
Medicare providers and suppliers. One of the providers or suppliers may
be involved in abusive behavior with the approval or at the instigation
of that owner or managing entity. In this example, if the abusive
provider's enrollment is revoked, the owning/managing entity shifts its
behavior to another of its enrolled entities.
In such situations, and absent the owning or managing individual's
or organization's (1) felony conviction, (2) exclusion from Medicare by
the OIG, or (3) debarment from participating in any federal procurement
or non-procurement program, CMS does not currently have a regulatory
basis to prevent such individuals or entities from continuing their
activities through other enrolled or newly enrolling providers and
suppliers. Put another way, providers and suppliers currently can be
denied, revoked, or terminated from participating in Medicare,
Medicaid, or CHIP; but absent a felony conviction, exclusion, or
debarment, their owners and managers can often remain as direct or
indirect participants in these programs. Consider this example:
Individual X owns 100 percent of three enrolled DMEPOS suppliers, each
of which has submitted a revalidation application to Medicare.
Individual X completes each application. He submits false information
on one application in order to retain that supplier's existing Medicare
enrollment but not on the other two applications. CMS revokes the first
DMEPOS supplier's enrollment under Sec. 424.535(a)(4). However, we
cannot revoke the other two suppliers because false information was not
submitted on their applications; this means that two Medicare suppliers
[[Page 47798]]
whose owner has furnished false information to Medicare are still
enrolled in the program.
CMS must have the capacity to address this and similar situations
when necessary and appropriate. In many cases, the owners and managers
of fraudulent entities hide behind the organizational structure itself
when in fact they are, for purposes of their behavior, one and the
same. This final rule with comment period will allow CMS to take
immediate action against such persons and entities to ensure that they
do not continue to use the provider or supplier organization as a
shield for their conduct. This, in turn, will help protect the Medicare
Trust Funds, the taxpayers, Medicare beneficiaries, and honest and
legitimate Medicare providers and suppliers. The changes described
later in this section II serve these goals by implementing section
1866(j)(5) of the Act.
We also proposed to apply these changes to Medicaid and CHIP, such
that states must require providers and suppliers to comply with the
same disclosure requirements established by the Secretary.
Many of the comments we received regarding this proposal--(1)
covered multiple topics (for example, application of the undue risk
standard and the proposed requirement to report new or changed
information), and (2) did not indicate whether they applied to Medicare
alone or to Medicare, Medicaid, and CHIP. Therefore, except as
otherwise noted, we--(1) have organized the comments and our responses
thereto within what we believe are the most appropriate sections
(though there may be occasional overlap between sections); and (2)
assume that the comments apply to all three federal programs (that is,
while our responses may refer to the Medicare program, they should be
presumed to apply equally to the disclosure of affiliation provisions
in the Medicaid program and CHIP, unless otherwise noted). Comments
that exclusively applied to Medicaid and CHIP are addressed in our
discussion of the affiliation disclosure provisions for those programs.
1. Medicare
a. Definition of Affiliation
We proposed to define ``affiliation'' in Sec. 424.502, for
purposes of applying the affiliation disclosure provisions in Sec.
424.519, as meaning any of the following:
A 5 percent or greater direct or indirect ownership
interest that an individual or entity has in another organization.
A general or limited partnership interest (regardless of
the percentage) that an individual or entity has in another
organization.
An interest in which an individual or entity exercises
operational or managerial control over, or directly or indirectly
conducts, the day-to-day operations of another organization (including,
for purposes of Sec. 424.519 only, sole proprietorships), either under
contract or through some other arrangement, regardless of whether or
not the managing individual or entity is a W-2 employee of the
organization.
An interest in which an individual is acting as an officer
or director of a corporation.
Any reassignment relationship under Sec. 424.80.
The first four types of interests (5 percent or greater ownership,
partnership interests, managing control, and corporate officer and
director interests) are consistent with the definitions of--(1)
``owner'' and ``managing employee'' in Sec. 424.502; and (2)
``ownership or control interest'' in section 1124(a)(3) of the Act. We
also note that consistent with sections 1124 and 1124A of the Act,
entities and individuals that have one or more of these four interests
in an enrolling or enrolled Medicare provider or supplier must be
reported on the provider's or supplier's Form CMS-855 enrollment
application. Likewise, reassignment relationships must be reported to
Medicare via the Form CMS-855R (OMB Control No. 0938-1179); this form
facilitates the reassignment of benefits from a physician or non-
physician practitioner to another Medicare provider or supplier. To
make certain that there is uniformity with these other reporting
requirements and that we are aware of prior and current relationships
that could present risks of fraud, waste, or abuse, we proposed that
the ``affiliation'' definition should include these five interests.
We explained in the proposed rule our belief that there is a
sufficiently close relationship between a reassignor (the physician or
non-physician practitioner) and a reassignee (the other provider or
supplier) to warrant including reassignments within the definition of
``affiliation.'' Indeed, a W-2 employee or independent contractor may
have a closer day-to-day relationship with the entity or person he or
she works for and reassigns benefits to than, for instance, an indirect
owner has with an entity in which he or she has a 5 percent ownership
interest. We requested comment on the regularity of close reassignor
and reassignee relationships and whether inclusion of these
relationships is likely to lead to additional information that may
prevent fraud, waste, and abuse. We also solicited comment on whether
the types of disclosable affiliations should include additional
ownership or managerial interests or other relationships.
We received the following comments regarding our proposed
definition of ``affiliation'':
Comment: A commenter questioned whether a physician director and a
director of nursing must be reported as managing parties on the Form
CMS-855A as part of the existing provider enrollment process and the
proposed disclosure requirement. The commenter, as well as other
commenters, also questioned whether the following parties and interests
fall within the definition of ``affiliation'': (1) Members of the board
of trustees of a tax-exempt entity; (2) billing agencies and/or
collection agencies; and (3) 5 percent or greater mortgage or security
interests. Another commenter questioned whether general and limited
partnerships include both direct and indirect interests for purposes of
the definition of ``affiliation.''
Response: As previously noted, our definition of ``affiliation''
incorporates concepts of ownership and managerial control from other
program integrity and provider enrollment provisions. We interpret our
definition of ``affiliation'' consistent with these other provisions.
Accordingly, if the physician director or director of nursing in
question falls within the definition of managing employee under Sec.
424.502, he or she must be reported as part of the existing enrollment
process and, if the requirements of Sec. 424.519 are met (for example,
the individual was previously a managing employee of another provider
or supplier with a disclosable event), also falls within the purview of
the latter provision.
Per CMS Publication 100-08, Program Integrity Manual (PIM), Chapter
15, members of a board of trustees are considered to be corporate
directors for purposes of Form CMS-855 reporting. Hence, the definition
of affiliation in Sec. 424.502 encompasses such relationships.
Also per Chapter 15 of the PIM, 5 percent or greater mortgage and/
or security interests are considered to be 5 percent or greater
ownership interests for purposes of the Form CMS-855. They will be
treated similarly with respect to our disclosure of affiliation
provisions.
[[Page 47799]]
Concerning billing agencies and/or collection agencies, we believe
the commenters were mentioning these parties in the context of
managerial control over the provider or supplier. If the agency in
question meets the definition of managing employee as it applies to
organizations, it will fall within the previously mentioned
``operational or managerial control'' category of the ``affiliation''
definition.
Indirect partnership interests are not considered partnership
interests under our definition of affiliation in Sec. 424.502.
However, the interest could qualify as an indirect ownership interest
of at least 5 percent.
Comment: A commenter questioned whether an affiliation exists if a
board of trustees or other governing body holds a 5 percent or greater
direct or indirect ownership in another organization, a general or
limited partnership interest in another organization, or exercises
operational or managerial control in another organization. The
commenter also questioned whether officers and directors of tax-exempt
providers fall within the ``affiliation'' definition if they serve in
similar capacities on other governing bodies or hold ownership
interests or provide operational or managerial control in other
organizations (tax-exempt or otherwise). The commenter cited the
example of a local hospital administrator who serves as treasurer and
member of the board of trustees of a local HHA; the commenter asked
whether this individual's association with the hospital would be deemed
an affiliation.
Response: Non-profit entities and officials thereof fall within the
purview of the affiliation definition to the same extent as for-profit
organizations and their officials; thus, for example, officers and
directors of non-profit corporations come within the definition of
affiliation, as do--(1) ownership, partnership, and managerial
interests in non-profit entities; and (2) reassignment relationships
with non-profit organizations.
Comment: A commenter stated that CMS should not consider an
affiliation with a public company that owns 5 percent or more of an
enrolling or reenrolling company to pose an ``undue risk'' to Medicare,
Medicaid, or CHIP. Such companies, the commenter stated, are subject to
adequate oversight of investors, the Securities and Exchange
Commission, and the public, and the risks presented by a public company
that owns a portion of another public company would be extremely
limited.
Response: We do not believe that public companies should be
automatically excluded from the purview of Sec. 424.519, nor can we
conclude that any affiliation with a public company with a disclosable
event will never pose an undue risk. All factual scenarios are
different, and we must retain the flexibility to address them on their
own merits.
Comment: A commenter stated CMS should only require disclosure of
affiliated managing individuals who are responsible in some way for
actions relating to Medicare, Medicaid, or CHIP payment. Citing the
example of laboratories, the commenter stated that managing individuals
often have no responsibilities concerning payments for services.
Rather, a managing employee who conducts the ``day to day operations''
of a laboratory facility often is in charge of maintaining the
licensure of a laboratory facility, ensuring that the facility follows
industry standards, evaluating information associated with laboratory
procedures performed onsite, and overseeing the scientific integrity of
the processes and protocols followed at the site. The commenter noted
that laboratories necessarily are vigilant about the credentials and
actions of those who are in charge of laboratory sites, for any hint of
impropriety may put the site's entire operations at risk.
Response: We respectfully disagree with the commenter. We note that
the statutory definition of managing employee in section 1126(b) of the
Act, upon which the definition of managing employee in Sec. 424.502
and the reference to managing parties in the definition of affiliation
are based, includes all persons who directly or indirectly conduct the
provider's day-to-day operations. It is not limited to parties involved
in actions related to the payment of services. In other words, the test
is the broader direct or indirect conduct of operations, not merely a
relationship to the payment of services. Thus we believe that the
inclusion within the definition of affiliation and the scope of Sec.
424.519 of--(1) managerial interests for purposes of enrollment and (2)
affiliations involving managing parties with disclosable events, should
not be based strictly on the party's involvement with payment-related
actions.
Comment: Several commenters stated that the minimum 5 percent
ownership stake referenced in the ``affiliation'' definition should be
higher. They generally stated that a party with a low ownership
interest is unlikely to be involved in the day-to-day operations of the
practice. Raising the required percentage of ownership, the commenters
believed, would not only better safeguard the Medicare program but also
substantially lower the regulatory burden on honest providers; with a
higher required percentage, CMS could better identify affiliates that
actually pose a danger to the Medicare program without being bogged
down with information from providers and suppliers on harmless
affiliations. They also cited the likely burden of tracking all 5
percent or greater ownership interests. Several commenters suggested a
25-percent threshold, while others suggested a 50-percent threshold or
a majority interest.
Response: The affiliation definition's 5 percent threshold is
consistent with our existing enrollment reporting requirements and with
sections 1124 and 1124A of the Act, both of which reference a 5 percent
standard. Further, it is conceivable that parties with a minority
ownership interest as low as 5 percent could be involved in
questionable activities, hence jeopardizing the integrity of the
Medicare program. The fact that they may not actively control the
provider's or supplier's daily operations should not exclude such
parties and affiliations from scrutiny. We recognize, however, that
certain levels of ownership interests may pose different risks than
others and, as we proposed, will consider the degree and extent of the
affiliation in determining whether an undue risk of fraud, waste, and
abuse exists.
Comment: Several commenters stated that CMS should not
automatically consider a general or limited partnership interest that
an individual or entity has in another organization to be an
affiliation. The commenters generally stated that a limited or general
partner with only a minority interest is unlikely to influence the
operations of the entity and, as such, likely would not pose a risk to
the Medicare program. A commenter stated that CMS should consider the
percentage of a party's general or limited partnership in determining
whether the party is an affiliate; another commenter suggested a 25-
percent threshold.
Response: Similar to our earlier statements regarding the 5 percent
ownership threshold, we believe that parties with even small
partnership interests can, depending on the scope and type of behavior
involved, threaten the integrity of the Medicare program. However, we
will consider the extent of the affiliation in determining whether an
undue risk exists.
Comment: A commenter recommended that CMS add a ``catch-all''
provision to the affiliation definition stating that the provider or
supplier report any affiliation (regardless of ownership or operational
[[Page 47800]]
interest) where the affiliate has, for instance, uncollected Medicare
debt, past exclusions or civil penalties. As examples, the commenter
suggested adding phrases to the definition such as ``association
with,'' ``connection with/to,'' ``alliance with/to,'' ``alignment
with,'' ``link with/to,'' ``incorporation into,'' and ``integration
into.''
Response: While we appreciate this suggestion, we believe that the
phrases the commenter proposes describe relationships that may be more
vague than those contemplated in this final rule with comment period.
To illustrate, a 5 percent ownership stake is a clear and determinable
interest, whereas an ``association'' or ``alignment'' can be
susceptible to a variety of interpretations. Therefore, we prefer to
include within our definition of ``affiliation'' only those interests
that are quantifiable (for example, limited partnership interests) or
have been used in the provider enrollment context for many years (for
example, managing employee) and with which the provider community is
familiar. Moreover, we believe that the commenter's suggested
relationships may be more distant and loose than those which we
proposed and which, we believe, the statute contemplates; a 50 percent
ownership interest, for instance, likely reflects a closer, clearer
relationship than a mere ``association'' or ``connection.''
Comment: Many commenters opposed the inclusion of reassignments
within the definition of ``affiliation.'' Overall, they contended
that--(1) reassignment relationships do not raise the same risks of
fraud, waste, and abuse as other affiliations referenced in the
definition; and (2) for large provider organizations and health
systems, the burden of having to constantly track and disclose all of
its reassignment relationships would be enormous. Several commenters
added that the practitioner typically has no ownership or managerial
interest in the reassignee and no direct or indirect influence over the
reassignee's decision-making; the mere fact of a reassignment
relationship without more, one of the commenters stated, does not
result in the close relationship that CMS assumes.
Response: We continue to believe there is a sufficiently close
relationship between a reassignor (the physician or non-physician
practitioner) and reassignee (the provider or supplier) to warrant
including reassignments within the definition of ``affiliation.''
Again, a W-2 employee or independent contractor may have a closer day-
to-day relationship with the entity or person he or she works for and
reassigns benefits to than, for instance, an indirect owner has with an
entity in which he or she has a 5 percent ownership interest. We are
therefore retaining reassignments within the definition of
``affiliation.'' Nonetheless, we recognize the potentially sizable
burden on physician and practitioner organizations (and especially
hospitals and large health plans) in researching, tracking and, if
applicable, submitting disclosable affiliation data involving the
individuals who reassign their benefits to them. In sections II.A.1.b.
and II.A.1.e. of this final rule with comment period, we discuss means
we are adopting to limit the burden on providers and suppliers.
Comment: A commenter stated that since both parties (the reassignor
and reassignee) are already jointly responsible for claims and
associated overpayment risk within their reassignment relationship, it
is unnecessary to go further and define a reassignment relationship as
an ``affiliation.'' Another commenter stated that because reassignors
and reassignees must be enrolled in Medicare to facilitate a
reassignment relationship, these parties have already (1) been properly
vetted by Medicare and (2) submitted the data we referenced under our
proposal. Several other commenters stated that including reassignments
within the affiliation definition exceeds what the Congress intended
and authorized.
Response: With respect to the first commenter, the closeness of the
relationship that the commenter implies is precisely why we believe it
is appropriate to include reassignments within the definition of
``affiliation.''
We respectfully disagree with the second and third comments. While
the individual Form CMS-855 applications for enrollment for the
reassignor and reasignee are screened, there currently is no review of
whether the relationship between these two parties presents an undue
risk to the Medicare program, which is the precise issue that section
1866(j)(5) seeks to address. In addition, we note that section
1866(j)(5) does not define the term ``affiliation,'' and thus the scope
of that term must be defined via regulation. We also have general
rulemaking authority under sections 1102 and 1871 of the Act to include
reassignments within the definition of ``affiliation.''
Comment: In response to our request for comments on the subject, a
commenter stated that no additional ownership or managerial interests
or other relationships (beyond those in the proposed definition of
``affiliation'') should be disclosed, in part because providers and
suppliers currently provide a significant amount of information.
Response: We agree that no additional interests or relationships
should be included within the definition of affiliation.
Comment: Several commenters urged CMS to remove indirect ownership
interests from the definition of affiliation. They generally contended
that--(1) it would be very difficult to obtain, track, and maintain
this information, especially for providers and suppliers with complex
ownership structures (such as chain organizations) involving many
affiliates; (2) many indirect owners have very little involvement in or
influence over the day-to-day operations of the provider or supplier;
and (3) some providers and suppliers have up to five levels of indirect
ownership. One commenter noted that an applicant would not only have to
report its own indirect owners, but also identify all affiliation
relationships held by the applicant's indirect owners. The applicant
would then be required to determine whether any such affiliation is
with a provider or supplier that has had a disclosable event. All of
these steps, this commenter concluded, would be very burdensome for
providers and suppliers.
Response: We disagree that indirect ownership interests should be
excluded. It should not be assumed that indirect owners never exercise
certain degrees of control over providers; in fact, a provider's direct
owner may be a mere holding company with the indirect owner actually
operating the provider. Given the vast variety of ownership
arrangements among provider and supplier organizations, we must retain
our flexibility to address particular situations. We further note that
section 1866(j)(5) of the Act refers to any current or previous
affiliation (directly or indirectly). We will consider the degree and
extent of the indirect owner's affiliation in determining whether an
undue risk exists.
Comment: A commenter stated that CMS should remove officers,
directors, and managing employees from the definition of affiliation,
citing the reporting burden.
Response: We respectfully disagree that these parties should be
removed from the definition of affiliation, given their typical level
of control over the provider's or supplier's operations. Yet we
recognize that certain officials may have greater influence over said
operations than others, and we will consider the degree and extent of
the affiliation in our determination of whether an undue risk exists.
Also, and as previously stated, we discuss in
[[Page 47801]]
sections II.A.1.b. and II.A.1.e. of this final rule with comment period
means by which we are limiting the burden on providers and suppliers.
Comment: Several commenters requested that the final rule provide
clearer directions and guidance on reporting affiliations and
histories. Some commenters stated that the definition of affiliation is
confusing and impractical.
Response: Although we believe that the definition of affiliation is
clear on its face, we may issue subregulatory guidance on this topic as
necessary.
Comment: A commenter stated that the disclosure of ``passive''
investors (that is, non-health care investors such as large mutual or
pension funds) could prove extremely difficult. These entities would
need to--(1) identify for the provider or supplier all current and
previous indirect ownership interests they have had in other health
care providers and suppliers; and (2) further ascertain whether any of
these affiliated providers and suppliers has or has had a disclosable
event. Passive investors, the commenter stated, may not know of those
providers and suppliers in which they have had an indirect ownership
interest, nor have any mechanism to determine whether they have or have
had any disclosable events.
Response: Under sections 1124 and 1124A of the Act, all parties
with at least a 5 percent direct or indirect ownership must be
disclosed as part of the enrollment process. These statutory provisions
do not exempt ``passive'' investors, and we do not believe such parties
should be exempt from the definition of affiliation or the purview of
Sec. 424.519. We again recognize, though, that it may prove difficult
at times to obtain affiliation data related to such parties, which is
why we proposed a knew or should reasonably have known standard for
disclosure. We discuss this standard in more detail in section
II.A.1.c. of this final rule with comment period.
Comment: A commenter stated that if the final rule includes
indirect ownership interests within the affiliation definition, CMS
should impose practical limitations or cut-offs at which such interests
are excluded from the definition. Suggestions included exempting--(1)
parties that have an ownership interest in another provider or supplier
through a publicly-traded company, mutual fund, or other large
investment vehicle; and (2) indirect ownership interests under 50
percent.
Response: We respectfully disagree. As previously indicated, there
could be situations where an indirect owner, even one with less than a
50 percent interest, exercises some influence over the provider. We
also reiterate that neither sections 1124 and 1124A of the Act, nor the
current definition of owner in Sec. 424.502, exclude public companies
or investment interests from the purview of those provisions.
Comment: A commenter stated that CMS should define affiliation by
those interests reported on all of the Form CMS-855 applications,
rather than those reported on only some of the forms; otherwise, the
commenter stated, CMS will be demanding that physicians disclose far
more information than is currently required.
Response: Section 1866(j)(5) of the Act addresses a provider's or
supplier's relationships with other parties; the focus, in other words,
is on affiliations rather than on identifying data that is specific to
the enrolling provider or supplier. Thus, physicians may be required
under Sec. 424.519 to furnish more data than they currently do.
Comment: A commenter stated that including 5 percent or greater
direct or indirect ownership interests within the affiliation
definition is problematic because the reporting burden associated
therewith would--(1) discourage joint ventures and provider
collaborations, which are necessary for the success of payment reform
and alternate payment models; and (2) place chain organizations at a
disadvantage.
Response: We respectfully disagree. Five percent or greater direct
and indirect ownership interests, including those involving chain
organizations, are currently disclosed as part of the regular provider
enrollment process. However, we are unaware of any discouragement of
joint ventures or provider collaborations or a disproportionately
negative impact on chain organizations stemming therefrom.
Comment: A commenter stated that the Form CMS-855A requires
disclosure of limited partnership interests that are at least 10
percent. The commenter questioned whether the Form CMS-855A and other
enrollment applications will be modified to incorporate the disclosure
of all limited partnership interests.
Response: We appreciate this comment and will consider whether the
referenced change to the scope of reportable limited partnership
interests on the Form CMS-855A is warranted.
Comment: A commenter stated that CMS should exclude from the
definition of affiliation--(1) disclosed officers', directors', or
managing employees' indirect operational or managerial control
interests in other providers; and (2) officer, director, or operational
or managing control positions of another provider's indirect owners and
parent companies. The commenter stated that these are not individuals
who fit within the current definition of a control interest in a
provider or supplier; thus they are not individuals (absent some
additional relationship with the provider or supplier) currently
identified on the Form CMS-855 applications. The commenter added that
these individuals generally are not involved in the day-to-day
operations of the provider or suppliers, and that reporting them would
be unduly burdensome and unlikely to result in a finding of undue risk.
Response: For reasons previously discussed, we are retaining
managing employees, corporate officers, corporate directors, and 5
percent or greater indirect owners within the definition of
affiliation. We note again that all of a provider's or supplier's
managing employees, corporate officers and directors, and 5 percent or
greater indirect owners currently must be disclosed as part of the Form
CMS-855 provider enrollment process.
Comment: Several commenters stated that only direct owners,
managing employees, and managing organizations (which the commenters
described as ``close affiliates'') should be included within the
affiliation definition. Distant affiliates (described by a commenter as
affiliates of close affiliations or affiliates that are not close
affiliates) should not be included, with one commenter stating that CMS
could review PECOS to ascertain distant affiliations. A commenter
stated that CMS should limit disclosure of prior affiliations to close
affiliates for which CMS can show it does not have available
information. Another commenter suggested that CMS bifurcate the
disclosure of affiliations into two parts--(1) affiliations reportable
by providers directly (``reportable affiliations''); and (2) other
affiliations on which CMS may rely in making a determination of undue
risk, provided that CMS takes materiality into account. The commenter
believed this would achieve an appropriate balance between the dual
needs to reduce the burden on providers and suppliers and to ensure
that CMS can take action to protect program integrity.
Response: We appreciate these comments but do not believe that
affiliation disclosures should be bifurcated or restricted as
suggested. While we acknowledge that some affiliations may pose greater
risks than others (and some may pose little, if any, risk), it is
possible that even certain ``distant'' affiliations could, depending on
the particular facts of the case,
[[Page 47802]]
threaten the integrity of Medicare, Medicaid, or CHIP. We consequently
must retain the discretion to review each case on its own merits by
carefully considering the factors outlined in Sec. 424.519(f), which
are discussed elsewhere in this final rule with comment period.
Comment: A commenter stated that suppliers should only have to
disclose past affiliations for persons identified as 5 percent or
greater owners on the Form CMS-855.
Response: We respectfully disagree. Parties such as managing
employees and general partners can often have as much, if not more,
influence over the daily operations of a provider or supplier than an
owner. As such, we do not believe they should be excluded from the
definition of affiliation.
After consideration of the comments received, we are finalizing our
definition of affiliation as proposed.
b. Disclosable Events (Sec. 424.519)
In new Sec. 424.519, we proposed in paragraph (b) that a provider
or supplier that is submitting an initial or revalidating Form CMS-855
application must disclose whether it or any of its owning or managing
employees or organizations (consistent with the terms ``owner'' and
``managing employee'' as defined in Sec. 424.502) has or, within the
previous 5 years, has had an affiliation with a currently or formerly
enrolled Medicare, Medicaid, or CHIP provider or supplier that--
Currently has an uncollected debt to Medicare, Medicaid,
or CHIP, regardless of--(1) the amount of the debt; (2) whether the
debt is currently being repaid (for example, as part of a repayment
plan); or (3) whether the debt is currently being appealed. For
purposes of Sec. 424.519 only, and as stated in proposed Sec.
424.519(a), we proposed that the term ``uncollected debt'' only applies
to--
++ Medicare, Medicaid, or CHIP overpayments for which CMS or the
state has sent notice of the debt to the affiliated provider or
supplier;
++ Civil money penalties (CMP) (as defined in Sec. 424.57(a)); and
++ Assessments (as defined in Sec. 424.57(a)).
Has been or is subject to a payment suspension under a
federal health care program (as that term is defined in section
1128B(f) of the Act), regardless of when the payment suspension
occurred or was imposed;
Has been or is excluded by the OIG from participation in
Medicare, Medicaid, or CHIP, regardless of whether the exclusion is
currently being appealed or when the exclusion occurred or was imposed
(we note that although section 1866(j)(5) of the Act uses the phrase
``has been excluded,'' we proposed to clarify that a current exclusion
is also a disclosable event); or
Has had its Medicare, Medicaid, or CHIP enrollment denied,
revoked or terminated, regardless of--(1) the reason for the denial,
revocation, or termination; (2) whether the denial, revocation, or
termination is currently being appealed; or (3) when the denial,
revocation, or termination occurred or was imposed. For purposes of
Sec. 424.519 only, and as stated in proposed paragraph (a), we
proposed that the terms revoked, revocation, terminated, and
termination would include situations where the affiliated provider or
supplier voluntarily terminated its Medicare, Medicaid, or CHIP
enrollment to avoid a potential revocation or termination.
We stated in the proposed rule that the affiliated provider or
supplier need not have been enrolled in Medicare, Medicaid, or CHIP
when the disclosing party had its relationship with the affiliated
provider or supplier. We cited the following illustration. Assume
Provider A sold its 30 percent interest in an affiliated provider in
January 2016. In March 2016, the affiliated provider enrolled in
Medicare yet had its enrollment revoked in September 2016. In April
2017, Provider A applied for Medicare enrollment. If we limited the
reporting of affiliations to periods when the affiliated provider was
enrolled in Medicare, Medicaid, or CHIP, Provider A would not have to
report--and we would perhaps not learn of--its relationship with a
provider that was revoked only 8 months after the affiliation ended. We
concluded in the proposed rule that such information would be valuable
in helping us determine whether the affiliation poses an undue risk of
fraud, waste, or abuse.
We also proposed that the disclosable event could have occurred or
been imposed either before the affiliation began or after it ended. We
stated that if disclosure of an affiliation were restricted to the time
period of the disclosing party's relationship with the affiliated
provider, we might remain unaware of situations where, for instance--
(1) a disclosing party sells its majority interest in an affiliated
provider or supplier that is terminated from Medicaid 2 months after
the sale; and (2) a 40 percent owner of a Medicare-enrolled affiliated
provider engages in questionable billing practices, sells its share,
and seeks to separately enroll in Medicare, shortly after which the
affiliated provider is notified that it has a large Medicare debt that
must be repaid. We expressed particular concern about the latter
scenario; as previously mentioned, we have seen instances where
providers and suppliers with significant overpayments close down their
businesses and attempt to enroll under other business identities.
Additionally, we proposed that the actions identified in Sec.
424.519(b) applied regardless of whether an appeal is pending. We
wanted to avoid situations where an initially enrolling provider or
supplier would not have to disclose, for example, an affiliated
provider that was revoked from Medicare 6 months ago (based on a felony
conviction) because the revocation is under appeal; without this
information, the provider or supplier in question might become enrolled
in Medicare without CMS knowing of its relationship with a recently
convicted affiliated provider or supplier. Conversely, we proposed that
actions that have been overturned on appeal or otherwise reversed would
not need to be reported.
We further proposed a look-back period of 5 years for previous
affiliations. A sufficient look-back period was deemed necessary
because a past affiliation could be an indicator of a disclosing
party's future behavior. The look-back period would be the 5-year
timeframe prior to the date on which the disclosing provider or
supplier submits its Form CMS-855; thus at least part of the
affiliation must have occurred within the 5-year period preceding the
date on which the application is submitted. However, we did not propose
to limit the look-back period for disclosable events (other than
uncollected debts), meaning that said event could have occurred any
time in the past to be subject to disclosure.
We proposed, too, that if the affiliated provider or supplier had
its Medicare, Medicaid, or CHIP enrollment denied, revoked, or
terminated, this must be reported regardless of the reason for the
denial, revocation, or termination. Since all denial, revocation, and
termination reasons are of concern to us, we did not believe certain
reasons should be excluded from disclosure. Nevertheless, we solicited
comment on whether disclosure should be restricted to particular
denial, revocation, and termination reasons and, if so, what those
reasons should be.
We also sought comment on the following issues regarding our
proposed definition of uncollected debt: (1) Whether there should be a
threshold for the level of debt that would need to be reported; (2)
whether a provider or supplier should be exempt from
[[Page 47803]]
reporting an uncollected debt if it is complying with a repayment plan;
and (3) whether the level of reporting burden on the provider or
supplier is low enough to merit collection of this information without
any threshold or exemption.
We previously mentioned our proposal that the terms revoked,
revocation, terminated, and termination (for purposes of disclosure
under Sec. 424.519) would include situations where the affiliated
provider or supplier voluntarily terminated its Medicare, Medicaid, or
CHIP enrollment to avoid a potential revocation or termination; this is
referenced in proposed Sec. 424.519(a). As explained in more detail in
section II.B.10. of this final rule with comment period, we have seen
instances where a provider or supplier engages in inappropriate
behavior, recognizes that its enrollment may soon be revoked, and then
voluntarily withdraws from Medicare prior to the imposition of a
revocation so as to avoid the revocation and an associated reenrollment
bar under Sec. 424.535(c). (See section II.B.4. of this final rule
with comment period for more information on reenrollment bars.) Since
the provider or supplier is thus not revoked from Medicare, it could
immediately reenroll in Medicare without having to wait until the
reenrollment bar expires. We believed such behavior poses a risk to the
Medicare program in that the provider or supplier is seeking to avoid
Medicare rules and, in the process, possibly reenter the Medicare
program to continue its improper activities. Accordingly, although we
also address this concern in new Sec. 424.535(j), which is discussed
in section II.B.10. of this final rule with comment period, we stated
our view that for purposes of Sec. 424.519, such actions should be
included within the category of revocations and terminations.
We further solicited comment on proposed Sec. 424.519(b) regarding
the following issues--
Whether 5 years is an appropriate look-back period for
affiliations;
Whether exclusions, denials, and revocations that are
being appealed should be exempt from disclosure.
Whether there should be a limited look-back period for
disclosable events and, if so, how long (for example, 15 years, 10
years, 7 years).
We note that, pursuant to Sec. Sec. 424.502 and 424.519, an
affiliation applies to both parties in the affiliation. This means that
if the definition of affiliation is met with respect to a particular
relationship, both parties have an affiliation. However, whether the
affiliation must be disclosed will depend upon whether the requirements
of Sec. 424.519(b) are met. For example, suppose Enrolling Provider X
has a 50 percent ownership interest in Enrolled Provider Y, which is
currently under a Medicare payment suspension. X would have to disclose
its relationship with Y. Yet Y would not have to disclose the
affiliation pursuant to Sec. 424.519(b) unless X has a disclosable
event.
We received the following comments regarding proposed Sec.
424.519(a) and (b).
Comment: Many commenters expressed general concern about the burden
of researching, tracking, and reporting information under Sec.
424.519(b). One commenter stated that the rule as a whole (including
the affiliation provision) should be geared towards non-compliant
providers and suppliers rather than burdening honest providers and
suppliers. Another commenter noted that the entire rule (including the
affiliation provision) would significantly increase regulatory burden
without efficiently targeting enforcement toward higher-risk enrollees,
with another commenter stating that the rule should be more focused on
identifying and weeding out potentially fraudulent parties. Another
commenter stated that--(1) random, untargeted program integrity
measures can bring harm to Medicare beneficiaries and all other
stakeholders, and (2) Medicare providers may be forced to incur
unnecessary costs to comply with a new rule and respond to a new
integrity effort when a broad-based action is taken to address the
abusive, but isolated conduct of a few providers. Another commenter
stated that CMS should reconsider some of the disclosure, timing, and
reporting requirements to lessen the administrative burden on providers
and suppliers.
Consistent with the suggestion to modify our proposed affiliation
provision to target providers and suppliers potentially posing a threat
to the Medicare program instead of burdening all providers and
suppliers, a commenter noted the previously mentioned February 2, 2011
final rule with comment period, wherein we established categories of
risk for provider and supplier types for purposes of enrollment
screening. These screening requirements were specifically tailored
based upon the level of risk that the category of provider/supplier
posed to Medicare, Medicaid, and CHIP. The commenter stated that CMS
should consider taking a similar approach with the disclosure of
affiliations requirement. The commenter stated it is unlikely that CMS
is concerned with the risk of fraud posed by, for example, a hospital
that previously employed a physician as a managing employee who now
seeks to work at a new hospital; if the goal is not to target these
types of scenarios, the commenter added, CMS should consider
implementing a narrower, more focused approach in the final rule.
Another commenter noted language in section 1866(j)(5) of the Act
stating that the provider or supplier shall disclose the information
referenced in section 1866(j)(5) of the Act in a form and manner and at
such time as determined by the Secretary. The commenter believed this
language permits CMS to consider ``alternative approaches.''
Too, a number of commenters stated that CMS can already access much
of a provider's or supplier's disclosable affiliation data through
PECOS; therefore, it is duplicative and unnecessary to burden providers
and suppliers with obtaining, maintaining, tracking, and submitting
this information.
Response: We appreciate these comments and are sympathetic to the
concerns raised by the commenters regarding the significant burden this
rule could place on providers and suppliers. In response to these
concerns, and given the statutory language requiring disclosures to be
provided in a form and manner and at such time as determined by the
Secretary, we have decided to adopt a ``phased-in'' approach to
implementing Sec. 424.519(b), beginning with a more targeted approach
that will then be expanded following further rulemaking and a
concomitant assessment of the progress of the phased-in approach. To
this end, we are revising Sec. 424.519(b) to, for now, require
disclosure of affiliations only from those providers and suppliers that
have one or more affiliations, as determined by CMS, that would trigger
a disclosure in accordance with Sec. 424.519. Such providers and
suppliers will be required to report their disclosable affiliations
upon request from CMS, as detailed later in this final rule with
comment period. This requirement will become effective after CMS has
revised the Form CMS-855 to accommodate the required disclosures. (For
purposes of this policy, the term ``Form CMS-855'' includes, and will
collectively refer to--(1) the applicable Form CMS-855 paper
applications; and (2) the respective online enrollment applications
submitted through PECOS. Thus, both the paper and online applications,
which will be subject to notice-and-comment, will be revised prior to
the commencement of any affiliation disclosure requests.)
[[Page 47804]]
In reviewing whether a particular provider or supplier has one or
more applicable affiliations, CMS will, as applicable, research and
consider data revealed through such sources as, but not limited to: (1)
PECOS, which, as explained previously, contains provider enrollment
information submitted by the provider or supplier (for instance, as
part of an initial application submission, a change of information
request, a revalidation application, or a reactivation application);
and (2) other CMS databases and external, non-CMS databases that could
indicate behavior (such as improper billing patterns) of concern to us.
After reviewing all applicable data, CMS will request the disclosure of
affiliations in accordance with Sec. 424.519 from a provider or
supplier if the provider or supplier, or any of its owning or managing
employees or organizations may currently have or, within the previous 5
years, have had an affiliation with a currently or formerly enrolled
Medicare, Medicaid, or CHIP provider or supplier that may have one or
more of the following disclosable events:
++ Currently has an uncollected debt to Medicare, Medicaid, or
CHIP.
++ Has been or is subject to a payment suspension under a federal
health care program;
++ Has been or is excluded by the OIG from participation in
Medicare, Medicaid, or CHIP.
++ Has had its Medicare, Medicaid, or CHIP enrollment denied,
revoked or terminated.
We believe that these four events are appropriate triggers for the
requirement to report all affiliations specified in this rule. In
addition to being consistent with the statutory language regarding the
types of events to be disclosed, we believe that each of these events
raises potential program integrity concerns and accordingly provides a
basis to require the provider or supplier to disclose all applicable
affiliations.
For now, providers and suppliers will not be required to disclose
affiliations under Sec. 424.519 unless CMS, after performing the
research and analysis described earlier and determining that the
provider or supplier may have at least one affiliation that includes
any of the four disclosable events, specifically requests it to do so.
We believe this will ease the burden on the provider community because
CMS, rather than the provider or supplier, will be responsible for
reviewing whether the disclosure requirement applies to the provider or
supplier. However, should CMS find, that it does apply, the provider or
supplier in question must then report any and all affiliations that
come within the scope of Sec. 424.519, not merely the one(s) on which
CMS made its determination. This could require the provider or supplier
to conduct research to determine whether additional disclosable
affiliations exist, which would then need to be reported to CMS.
We stress that merely because a provider or supplier may have at
least one affiliation with a disclosable event and must therefore
report all such affiliations upon a CMS request does not mean that CMS
has determined that the provider and/or its affiliations pose an undue
risk of fraud, waste, or abuse as stated in section 1866(j)(5) of the
Act. The disclosure requirement is entirely separate from any undue
risk finding. Indeed, CMS must first carefully review and analyze all
disclosed affiliations before determining whether the undue risk
standard (described in more detail in section II.A.1.d of this final
rule with comment period) has been met; CMS will, in every case, act
with caution and prudence when determining whether an undue risk of
fraud, waste, or abuse exists.
To summarize, once CMS updates its Form CMS-855 applications to
include an affiliation disclosure section, a provider or supplier that
may have at least one affiliation involving a disclosable event, as
identified by CMS, will be required to report any and all affiliations
upon initial enrollment or revalidation, as applicable, when CMS
specifically requests such information from the particular provider or
supplier. Submission via revalidation will be done through a provider's
or supplier's periodic revalidation (every 3 years for DMEPOS suppliers
per Sec. 424.57(g); every 5 years for all other provider and supplier
types per Sec. 424.515) or an off-cycle revalidation per Sec.
424.515(d). We estimate that this will affect only about 2,500 to 4,000
providers and suppliers per year, although this figure could vary. This
means that well over 99 percent of prospective and currently enrolled
providers and suppliers will not be required to research or disclose
affiliation information in the first several years following the
effective date of this rule.
Although we will initially be implementing a more targeted approach
to the disclosure requirement, we recognize that section 1866(j)(5) of
the Act requires every provider and supplier (regardless of the
relative risk they may pose) to disclose affiliations upon initial
enrollment and revalidation. While section 1866(j)(5) of the Act does
give the Secretary some discretion in applying this provision in terms
of form, manner, and timing, it does not permanently exempt any
provider or supplier from its applicability; for example, section
1866(j)(5) of the Act does not permit the Secretary to establish an
exception for physicians or hospitals or other specific provider or
supplier types. Moreover, even if CMS already has, for instance,
affiliation data in PECOS regarding a provider that is nearing the end
of its 5-year revalidation cycle, section 1866(j)(5) of the Act still
requires disclosure as part of the provider's upcoming revalidation.
Consequently, CMS must eventually secure affiliation data from all
initially enrolling and revalidating providers. In light of the very
large universe of such providers and suppliers, which we project would
be around 1.7 million, we seek public comment on potential approaches
for obtaining affiliation information from this group in terms of
timing, mechanism, and priority. After receiving and reviewing these
comments, CMS will publish a notice of proposed rulemaking (NPRM)
outlining the proposed handling of disclosures for these providers and
suppliers, followed by the issuance of a final rule (hereafter
occasionally referred to as ``the subsequent final rule'') after
consideration of the public comments received on the proposed rule.
The specific issues on which we seek public feedback are as
follows:
Whether CMS should adhere to a specific schedule in its
requests, such as, for example, requesting 20,000 providers and
suppliers to disclose affiliations in the first 12 months after the
subsequent final rule's effective date; 30,000 providers and suppliers
in the second year; 40,000 in the third year; and so forth.
Whether CMS, beginning in the first year after the
subsequent final rule's effective date, should stagger its requests
based on:
++ The risk of fraud, waste, or abuse posed by the individual
provider or supplier in question and how CMS should assess this risk.
++ The risk of fraud, waste, or abuse posed by provider and
supplier type (for example, Provider Type A is considered the highest
risk provider or supplier type in Medicare and should, therefore, be
the first provider type to disclose affiliations).
++ Whether the provider or supplier is initially enrolling in
Medicare or is revalidating their enrollment (that is, whether
initially enrolling providers or, instead, revalidating providers
should take precedence in CMS' disclosure requests.)
++ The size of the provider or supplier and/or likely number of
affiliations (for instance, larger
[[Page 47805]]
providers with presumably more affiliations should be required to
disclose affiliations in the initial year following the subsequent
final rule's effective date; small providers with few affiliations
should receive disclosure requests only in future years).
++ Any combination of the previous criteria.
++ Any other consideration (for example, geographic location).
The total length of time that CMS should take to complete
its collection of affiliation data from the entire universe of
providers and suppliers (for example, 2 years; 4 years; 7 years; 10
years; etc.)
How and when a provider or supplier should be notified
that it must or need not disclose affiliation information on its
initial or revalidation application, such as, for example:
++ When a provider or supplier submits an initial enrollment
application, whether it should--(1) receive prior notice (for instance,
via the www.cms.gov website) as to whether it must complete the
disclosure of affiliation section of the Form CMS-855; or (2) only be
notified after submitting the application and after review by CMS or
the Medicare contractor.
++ Whether the letter that a provider or supplier receives from CMS
or the Medicare contractor requesting the submission of a revalidation
application should indicate whether the provider or supplier needs to
disclose its affiliations.
Comment: A number of commenters stated that CMS should establish a
monetary threshold for reporting debts. They generally contended that--
(1) small or nominal amounts of debts would not pose an undue risk to
Medicare, Medicaid, or CHIP; and (2) obtaining specific data from other
parties (for example, indirect owners; an outside entity for which one
of the enrolling provider's board members serves as a managing
employee) on such small amounts would be an enormous burden. Suggested
minimum debt amounts included $1,000, $10,000, and $100,000; another
commenter recommended $50,000 since this is the minimum amount required
for DMEPOS surety bonds. Another commenter urged CMS to consider
establishing a de minimis standard based upon a percentage of a
provider's/supplier's gross billings.
Response: While we appreciate these comments and carefully
considered them, we do not believe a monetary threshold should be
formalized in this rule. Our preferred approach is to consider the
debt's amount as a factor in determining whether the debt presents an
undue risk of fraud, waste, or abuse. We recognize that smaller debts
often will not pose the same degree of risk as larger debts. However,
there could be isolated cases where a particular debt, though of a de
minimis amount, presents an undue risk when all of the applicable
factors are considered. In short, we believe that viewing the debt
amount as one factor among several, rather than automatically excluding
all smaller debts from consideration, will give us the necessary
flexibility to address a variety of factual scenarios.
Comment: Several commenters stated that debts that are being repaid
should be exempt from the scope of ``uncollected debt.'' They contended
that this would reduce the reporting burden on providers and suppliers.
Moreover, the commenters stated that parties that are repaying their
debts are proving their good-faith and are very unlikely to pose an
undue risk of fraud, waste, or abuse.
Response: We appreciate these comments. For reasons similar to our
position regarding debt thresholds, however, we decline to exclude
debts that are being repaid from the scope of this rule. We believe
that consideration of the debt's repayment status as one of several
factors in determining whether an undue risk exists is the sounder
path. This will give us the flexibility to address a variety of factual
scenarios. To illustrate, suppose Enrolling Medicare Provider X was
until recently a 60 percent owner of Medicare Provider Y. Y has an
outstanding Medicare debt of $2.5 million. Even if the debt is being
repaid, we would have reason to be concerned about the amount of the
debt, X's recent relationship with Y, and the potential risk posed to
the Medicare program. We acknowledge that a debt that is being repaid
might in some cases present less of a risk than one that is not. Yet
this does not mean that a debt being repaid can never present concerns;
indeed, other factors may indicate that an undue risk exists. We
believe, in sum, that excluding all debts that are being repaid from
disclosure could permit certain providers and suppliers with
affiliations posing an undue risk to enroll or remain enrolled in
Medicare. This would be inconsistent with our obligation to protect the
Medicare program and the Trust Funds.
Comment: A commenter recommended that CMS broaden the scope of the
Electronic Submission of Medical Documentation (``edMD'') tool to allow
Medicare contractors, states, and CHIP programs to transmit
documentation, notices, and letters to providers and suppliers
electronically. This would facilitate efficient routing within an
organization to those responsible for monitoring and acting on debt and
overpayment notices; it also would allow for electronic receipt
confirmation. The commenter, as well as several others, urged CMS to
consider creating a centralized database through which providers and
suppliers can monitor, identify, and address debt notices that CMS and
state health care programs have issued; said database should include
the information required to research and reconcile submitted claims and
track recoupments and interest.
Response: We appreciate these comments but believe they are outside
the scope of this rule.
Commenter: A number of commenters stated that debts that are being
appealed should be exempt from the category of ``uncollected debts.''
In general, they contended that--(1) the appeals process can often take
considerable time; (2) many overpayments are overturned on appeal; (3)
obtaining, maintaining, and tracking information on debts that are
being appealed would be overly burdensome for providers and suppliers;
(4) debts that are being appealed (as well as the providers and
suppliers availing themselves of the appeals process) lack any indicia
or risk of fraud, waste, or abuse; and (5) the current backlog in the
appeal process must be factored into consideration regarding the
reporting of debt. A commenter stated that including debts under appeal
is administratively burdensome and pressures providers to affirmatively
pay Zone Program Integrity Contractors (ZPIC) and Additional
Documentation Request (ADR) amounts, versus allowing the Medicare
Administrative Contractor (MAC) to recoup the amount.
Response: We appreciate these comments. As with debts that are
being repaid, however, we do not believe that debts under appeal should
be automatically excluded from disclosure. Instead, we believe it is
more appropriate to consider the appeal status of an affiliated party's
debt as one of the factors in determining whether the affiliation
presents an undue risk. In situations where, for instance, an enrolling
provider or supplier has a close affiliation with another provider that
has a very large overpayment, we believe that the existence of the
overpayment, whether or not under appeal, could be an indication of
risk. Thus, consistent with our obligation to protect the Medicare
program and the Trust Funds, as well as with our authority under
section 1866(j)(5) of the Act, we believe we should have the ability to
determine whether the debt and the associated affiliation pose an
[[Page 47806]]
undue risk regardless of whether the debt is being appealed. If we
excluded such debts from disclosure, we might be compelled to enroll a
provider or supplier that was at least indirectly involved in
accumulating significant debt. In short, we continue to believe that--
(1) we must have the discretion and flexibility to address a wide
variety of situations; and (2) the exclusion of certain actions, such
as debts being repaid or under appeal, would hinder us in detecting
risks to Medicare.
Additionally, as a point of clarification, ZPICs are no longer
operational. Uniform Program Integrity Contractors (UPICs) have taken
over the functions that ZPICs previously performed. Furthermore, while
on the topic of contractors, we note that affiliation disclosures also
may support CMS contractor investigative efforts related to discovering
networks of individuals and entities engaged in fraud, waste, or abuse
(for example, information regarding new leads, new networks, or more
extensive networks than previously known), in addition to revealing
affiliations that pose an undue risk of fraud, waste, or abuse.
Comment: Several commenters stated that the phrase ``notice of the
debt to the provider, civil money penalties, or assessments'' should
not include audit requests or routine denial letters where refunds are
made through remittance advices or claims corrections and the provider
has otherwise been in good standing. Another commenter stated that the
definition of uncollected debt should exclude certain recoveries, such
as those associated with the Electronic Health Records (EHR) Incentive
Program and reconciliations from alternative payment models, to prevent
duplicative penalties for the same instance (which the commenter
believed would effectively constitute double jeopardy). Another
commenter stated that hospices routinely receive notices of debt for
hospice cap overpayments and regular Periodic Interim Payment
settlements. The commenter questioned whether such notices would
trigger the disclosure requirement at Sec. 424.519.
Response: We recognize that there are numerous types of Medicare,
Medicaid, and CHIP debts. As applied to Sec. 424.519, ``uncollected
debt'' refers to any debt stemming from a Medicare, Medicaid, or CHIP
overpayment for which CMS or the state has sent notice of the debt,
such as a demand letter or other formal request for payment, to the
affiliated provider or supplier and which has not been fully repaid.
Comment: A commenter suggested that the language regarding
overpayments in the definition of uncollected debt be restricted to
overpayments for which CMS or the state has sent notice of the debt to
the affiliated provider or supplier and the due date for payment
thereof has passed, subject to the following exceptions: (1) Debt for
which the provider or supplier has filed a timely notice of appeal,
until such time as a court or agency of competent jurisdiction has
found the debt to be valid and no further appeals are available; or (2)
debt that is subject to a repayment plan.
Response: For reasons previously stated, we are not exempting debts
that are being either repaid or appealed from disclosure.
Comment: A commenter stated that there is a separate statutory and
regulatory process in place (with separate requirements, timelines, and
consequences for any failure to comply) for provider and supplier
overpayments. The commenter stated that overpayments should be handled
through this already well-defined and finalized process and not brought
within the scope of this rule.
Another commenter stated that all overpayments should be--(1)
excluded from the definition of uncollected debts; and (2) reviewed
differently than CMPs and assessments. The commenter contended that the
term ``overpayment'' in and of itself does not signify fraud or
intentional harm but rather that payments were made erroneously. The
commenter cited an example of when the components of a service are
improperly documented and, as documented, do not justify the code for
which the program was billed; the commenter stated that this is not
indicative of intentional fraud. The commenter also stated that it can
often be some time before overpayments are identified by an
organization; as such, the overpayment amounts may be substantial,
seriously affecting an individual's or organization's ability to
quickly repay the amount, particularly in situations where significant
interest has accrued. These situations may require negotiations and the
development of repayment schedules.
Response: We respectfully disagree with these commenters. Section
1866(j)(5) of the Act specifically references uncollected debts, and we
previously mentioned instances where providers and suppliers have
accumulated large uncollected debts, closed their business, and
reopened another provider or supplier organization to repeat their
behavior. Therefore, we believe that including uncollected overpayments
within Sec. 424.519 is necessary.
Comment: A commenter stated that CMS should clarify whether its
intent is only for CMPs and assessments imposed on DMEPOS suppliers to
be disclosed or those imposed against any type of provider or supplier.
Response: We appreciate this comment. We will clarify in the final
regulatory text that the scope of CMPs and assessments applies to all
provider and supplier types by--(1) deleting the references to the
definitions of CMPs and assessments in Sec. 424.57(a), which are
limited to DMEPOS suppliers; and (2) adding language that refers to any
CMP and assessment imposed under title 42. We note that the latter
includes, but is not limited to, OIG CMPs under Title XI of the Act
that are referenced in title 42.
Comment: Many commenters expressed concern about the burden of
obtaining, tracking, and maintaining debt information regarding
affiliates (and the affiliates of the provider's or supplier's
affiliates). Several contentions were made. First, Medicare contractors
do not always send debt notices to the correct address, especially when
the provider's administrative office is different from the provider's
place of operations. Second, contractors sometimes have different
procedures for notifying providers and suppliers of debts and for
collecting such debts; issues presented by the first and second
scenarios, a commenter stated, are particularly acute with respect to
Medicaid debts and state Medicaid programs. Third, it would be
difficult for large providers and suppliers with many locations to
accumulate the debt information involving all of its sites.
Response: We appreciate these concerns. In light of our previously
mentioned revision to Sec. 424.519(b), the overwhelming majority of
providers and suppliers will not have to report the information to
which the commenters refer for several years. Also, CMS will closely
monitor the progress of Sec. 424.519(b)'s implementation; should
limitations on the reporting of certain types of uncollected debts be
necessary, CMS may consider additional rulemaking. We further note that
we understand the concerns about a provider's or supplier's ability to
obtain debt (and other) data from affiliates. We address this matter
further in section II.A.1.c. of this final rule with comment period.
Comment: Several commenters stated that denials, revocations, and
terminations should be deemed reportable only if they involved
fraudulent activities (for example, a formal finding of fraud by the
OIG, the Department of Justice, a Medicare
[[Page 47807]]
contractor, or a court of law) or were imposed on otherwise serious
grounds. One commenter stated that this is necessary because of the
possibility of denials and revocations due to mistakes or technical
misunderstandings. Other commenters stated that this limitation would
reduce the regulatory burden.
Another commenter stated that termination reasons should be limited
to fraudulent or wasteful behavior. The commenter cited the example of
a provider terminated from Medicaid because he or she did not renew his
or her Drug Enforcement Administration (DEA) certification in a timely
manner; the commenter did not believe this behavior should be disclosed
and scrutinized for possible Medicare termination. Another commenter
stated that providers and suppliers should not be required to disclose
denials for what the commenter deemed non-substantive reasons, such as
minor typographical or similar errors that are not based on an
assessment that the provider or supplier is ineligible to participate
in the program. Another commenter requested that CMS distinguish
between OIG exclusions based on fraud, waste, or abuse, and those based
on what the commenter described as more innocuous reasons, such as a
failure to repay student loans; the commenter did not believe the
latter would affect a provider's or supplier's ability to furnish
services to patients. An additional commenter stated that CMS should
differentiate between denials, revocations and terminations that are
``without fault'' and ``without cause'' and those related to fraud,
integrity or quality concerns. The commenter appeared to indicate that
the former should be exempt from disclosure, such as instances where a
provider's application is denied for failing to respond to a Medicare
contractor's request for additional information. Yet another commenter
stated that the reporting of payment suspensions should be limited to
those imposed based on a determination of a credible allegation of
fraud.
Response: We respectfully disagree with these commenters. All
program denials, revocations, terminations, OIG exclusions, and payment
suspensions are of concern to us. However, we understand that the facts
and circumstances behind each action may differ and, consequently, pose
different risks to Medicare, Medicaid, and CHIP. Rather than explicitly
exempt certain types of these actions from disclosure, we believe the
better approach is to carefully consider the factors we proposed in
Sec. 424.519 in determining whether an undue risk exists. This will
give us the flexibility needed to address a variety of scenarios.
Comment: A number of commenters opposed including voluntary
terminations within the scope of disclosable events. They stated that--
(1) many voluntary terminations are for innocuous reasons and do not
pose a risk to federal health care programs; and (2) including
voluntary terminations as a disclosable event is inconsistent with
congressional intent.
Response: Although we recognize the commenters' concerns, we
explained previously our reasons for including voluntary terminations
within the scope of Sec. 424.519; specifically, there have been
instances where providers and suppliers have voluntarily terminated
their enrollment in order to avoid a revocation and subsequent
reenrollment bar. To allow CMS to determine whether such a scenario
occurred, we maintain that all voluntary terminations should be
included within Sec. 424.519, all the while understanding that there
are voluntary terminations that are for legitimate reasons unrelated to
a pending revocation and thus pose no risk to Medicare.
We wish to reiterate that simply because a particular affiliation
must be disclosed does not automatically mean that it will result in a
finding that the affiliation poses an undue risk of fraud, waste, or
abuse. CMS will--(1) review each situation based on the totality of the
circumstances at hand; and (2) exercise its discretion to deny or
revoke in a cautious and prudent manner.
Comment: A commenter stated that section 1866(j)(5) of the Act does
not require the disclosure of terminations; hence, terminations should
be excluded as a disclosable event.
Response: Section 1866(j)(5) of the Act refers to Medicare,
Medicaid, and CHIP denials and revocations. However, in Medicaid and
CHIP terminology, providers are terminated, rather than revoked. Our
reference to terminations in Sec. 424.519 is thus intended to cover
Medicaid and CHIP program actions.
Comment: A commenter questioned what is meant by the ``to avoid a
potential revocation or termination'' standard and how it would be
applied. The commenter also requested that CMS issue standards for
distinguishing between affected and non-affected voluntary
terminations.
Response: The phrase ``to avoid a potential revocation or
termination'' means that the provider or supplier voluntarily
terminated its enrollment to avoid being revoked by Medicare and
subjected to a reenrollment bar. Regarding the establishment of
standards as the commenter suggests, we will consider--(1) issuing
subregulatory guidance concerning the reporting of voluntary
terminations to assist providers and suppliers; and (2) the surrounding
facts of the case in determining whether the voluntary termination
falls within this category.
Comment: A commenter stated that the late filing of a cost report
may trigger a payment suspension. The commenter questioned whether such
a payment suspension would have to be reported at that time. Another
commenter posed the same question regarding payment suspensions
stemming from the late submission of a self-determined Medicare cap
liability based on an inability to secure Provider Statistical and
Reimbursement report (PS&R) information.
Response: As we proposed, all payment suspensions under a federal
health care program, regardless of the specific regulatory basis
involved, fall within the purview of Sec. 424.519. This will enable us
to examine the facts behind the payment suspension in determining
whether an undue risk exists.
Comment: Several commenters recommended that CMS exempt from
disclosure all disclosable events that are currently being appealed.
They generally stated that this--(1) would ease the reporting burden on
providers and suppliers; (2) eliminate any presumption that the
disclosable event actually happened; (3) be consistent with due
process; (4) prevent parties from being permanently harmed if the event
is later overturned on appeal (for instance, it would not remain in
CMS' records as a disclosable event); and (5) prevent providers,
suppliers, CMS, and Medicare contractors from having to expend
resources on premature reporting and undue risk determinations. Another
commenter suggested that CMS add a provision to the final rule that
allows for all appeals to be exhausted before a provider or supplier is
required to report under Sec. 424.519(b). Another commenter disagreed
with CMS' stated concern in the proposed rule about the filing of
frivolous appeals to avoid reporting disclosable events; the commenter
urged CMS to exclude disclosable events that are being appealed.
Response: We respectfully decline to exempt denials, revocations,
terminations, payment suspensions, and exclusions by the OIG that are
being appealed from the purview of Sec. 424.519. Such actions can
involve significant transgressions, and we must be able to take prompt
action to protect the Medicare program and the Trust Funds.
[[Page 47808]]
Comment: Several commenters stated that CMS should not require a
provider or supplier to report if an affiliate had its Medicare,
Medicaid, or CHIP enrollment denied, revoked, or terminated if said
affiliate was not enrolled in Medicare, Medicaid, or CHIP at the time
of the affiliation. One commenter stated that providers should only be
required to disclose affiliations with other providers that were--(1)
enrolled or attempted to enroll during the period in which the
affiliation occurred; or (2) enrolled prior to the affiliation period.
If the affiliate was not enrolled during or prior to the affiliation
period, this commenter stated, the provider would have no reason to
believe that it had a disclosable event and would not collect or
monitor such information.
Response: We respectfully disagree with these commenters. Improper
behavior within a health care provider or supplier can occur regardless
of whether it is enrolled in a federal health care program. In other
words, the crucial issue with respect to the scenario the commenters
pose is more the behavior itself than the provider's or supplier's
enrollment status. We thus believe that disclosable events should be
reported even if the provider or supplier in question was not enrolled
at the time of the affiliation.
Comment: Several commenters stated that a 5-year look-back period
for affiliations is appropriate.
Response: We appreciate the commenters' support.
Comment: A number of commenters stated that our proposed 5-year
look-back period is too long. They generally contended that--(1)
requiring research, tracking, and disclosure over a 5-year period would
be too burdensome for providers and suppliers; and (2) relationships
occurring 4 or 5 years ago typically would not pose a risk of fraud,
waste, or abuse. Commenters suggested a shorter period; among those
mentioned were 3 years, 2 years, and 1 year. They stated that a shorter
period would still permit CMS to take action against providers and
suppliers with problematic affiliations without--(1) penalizing
providers and suppliers for having affiliations with entities whose
disclosable events have passed; and (2) imposing an unacceptable burden
on providers and suppliers.
Response: We appreciate these comments and concerns. After careful
consideration, though, we continue to believe that a 5-year period is
warranted. A 5-year period will enable us to capture a sufficient
extent of the provider's or supplier's disclosable event history
without requiring the provider or supplier to research affiliations
from many years prior. Put another way, we believe a 5-year period
strikes a suitable balance between--(1) ensuring our ability to detect
undue risks to the Medicare program and the Trust Funds and (2)
restricting the burden of research and disclosure on providers and
suppliers. We acknowledge that current or more recent affiliations may,
depending on the facts of the case, present more concern than those
that ended 4 or 5 years ago, and we will take into account when the
affiliation occurred in determining whether an undue risk exists.
Comment: A commenter stated that the proposed 5-year look-back
period for previous affiliations is longer than any of the look-back
periods associated with related fraud and abuse statutes, such as the
physician self-referral (Stark) law, the CMP provisions, or the anti-
kickback statute. The commenter contended that CMS fails to provide any
justification as to why 5 years is the appropriate timeframe.
Response: Our 5-year look-back period is based on the objectives of
section 1866(j)(5) of the Act. It need not be predicated on look-back
periods for other, unrelated statutes; indeed, the affiliation
disclosure requirement is entirely different from these other statutes,
and any disclosure period established therewith must be predicated on
the particular objectives and circumstances of said requirement.
Further, we explained in the proposed rule that a 5-year look-back
period would divulge to us past situations that could present future
concerns, while being less onerous than, for instance, a 10-year
period. We also respectfully note that a 5-year lookback period for
previous affiliations is shorter than the lookback periods associated
with overpayment and fraud and abuse statutes to which the commenter
referred.
Comment: A number of commenters recommended that CMS establish a
look-back period for disclosable events. They essentially stated that--
(1) the lack of a look-back period would impose an enormous burden on
providers and suppliers because they would have to obtain, submit, and
regularly monitor information from potentially decades ago, which could
take resources away from patient care, and (2) disclosable events that
occurred many years prior do not pose a significant, if any, risk to
federal health care programs. Among the look-back periods they
suggested for disclosable events were 5 years, 3 years, and 2 years.
The commenters stated that such periods would be sufficient to remove
problematic parties from Medicare, Medicaid, and CHIP without overly
burdening providers and suppliers. One commenter stated that if there
is no look-back period for disclosable events, the universe of
organizations that will have experienced at least one disclosable event
will increase dramatically year-to-year; eventually, it is conceivable
that nearly all providers and suppliers will have experienced at least
one disclosable event at some point in their existence. Other
commenters noted that CMS has a 10-year reporting limit for felony
convictions and suggested that--(1) any look-back period for
disclosable events should not exceed 10 years for offenses equivalent
in scope to a felony; and (2) CMS should strongly consider reducing the
disclosure period for less severe actions (such as non-felony final
adverse actions), which a commenter suggested should be 3 years.
Response: We appreciate these comments and understand the concerns
regarding burden. However, after carefully considering them, we
maintain our view that no look-back period for disclosable events
should be established. While we recognize that disclosable events
occurring many years previously often will not present the same level
of concern as a more recent action, such events could still pose risks.
Given our obligation to protect the Medicare program and the Trust
Funds, we must retain the flexibility to address various factual
scenarios. Yet we also reemphasize that, per our previously discussed
revisions to Sec. 424.519(b), many providers and suppliers will not
have to research or report disclosable affiliations for at least
several years after the effective date of this rule.
Comment: A commenter recommended a 7-year look-back period that
would involve the submission of reports documenting disclosable events
(including those for the potential billing service provider, the
service owner or director, and accounts receivable personnel) that
occurred during that timeframe. The commenter stated that such an
assessment is necessary for the prevention of fraudulent activity. The
commenter also stated that--(1) a 7-year timeframe is consistent with
credit reporting; and (2) the Internal Revenue Service has a timeline
of 7 years for documentation regarding a loss.
Response: We appreciate this suggestion. For reasons previously
stated, however, we are not adopting a look-back period for disclosable
events and are retaining our proposed 5-year period for disclosable
affiliations.
Comment: Several commenters stated CMS should not require a
provider or supplier to report any disclosable event
[[Page 47809]]
imposed on a prior affiliate after the relationship between the
provider or supplier and the affiliate is terminated. A commenter
stated that while the statute requires reporting current and past
affiliations with individuals or entities that have experienced certain
events, it references past events by using the past perfect
conjugation. The commenter believed that this indicates that the
Congress did not intend for providers or suppliers to disclose
information on events that occurred after the affiliation period. Such
events, the commenter stated, would be in the future in terms of the
relationship between the individuals or entities, thus making the
events outside the scope of the requirement.
Response: We respectfully disagree with these commenters. Adoption
of this suggestion could mean, for instance, that a party involved in
improper activities could depart an affiliated provider immediately
before any sanctions are imposed on the latter and purchase an
enrolling provider, but CMS could take no action under Sec. 424.519 to
prevent said enrollment. We explained in the proposed rule our concern
about parties that engage in inappropriate behavior in one forum and
then move to another provider or supplier to repeat their activities.
The structure and scope of our disclosure requirements are designed to
prevent this. We believe we have the discretion to interpret section
1866(j)(5)(A) of the Act as not requiring the disclosable event to have
occurred during the affiliation. Additionally, we have authority to
include such situations within the scope of disclosable affiliations
pursuant to our general rulemaking authority under sections 1102 and
1871 of the Act.
Comment: A commenter stated that any look-back period for
disclosable events should not precede the date on which the provider or
supplier established a covered affiliation with the relevant entity.
Response: It appears that the commenter is suggesting that
disclosable events occurring prior to the establishment of the
affiliation should not be included within the scope of Sec. 424.519.
We respectfully disagree. Depending on the particular facts of the
case, we believe that affiliations established with parties that have
some type of adverse history can still present risks. We believe we
must retain the discretion to address such situations in order to
protect the Medicare program and the Trust Funds.
Comment: A commenter stated that look-back periods for affiliations
and disclosable events should be 2 to 3 years and limited to timeframes
following the acquisition of an entity and prior to the sale of an
entity.
Response: We appreciate this comment. However, for reasons stated
earlier, we believe that a 5-year period is more appropriate for
affiliations, with no look-back period for disclosable events. As we
mentioned in the proposed rule, the 5-year timeframe extends back from
the date on which the application is submitted; it is unrelated to the
date of any relevant acquisition or sale.
Comment: Several commenters recommended that CMS only require the
reporting of disclosable events that occurred during the affiliation;
in other words, the disclosable event must have occurred during the
affiliation, not before or after, to require disclosure. A commenter
contended that an enrolling or revalidating provider may have no way to
reasonably know about disclosable events occurring outside the period
of their affiliation with another provider or supplier. Another
commenter stated that if the look-back period for disclosable events is
not coterminous with the affiliation reporting obligation, providers
will have to track the activities of entities either pre- or post-
affiliation. Another commenter stated that a provider typically would
not (and should not be expected to) know of a disclosable event after
an affiliation has ended. Several commenters added that providers and
suppliers should only be required to report disclosable events that
occurred before the end of an affiliation with a close affiliate.
Another commenter stated that if CMS requires reporting of disclosable
events occurring before or after an affiliation, such events should not
be considered for purposes of determining undue risk.
Response: For reasons stated previously, we believe it is important
that disclosable events occurring before or after an affiliation be
included within the purview of Sec. 424.519. It is possible that such
an affiliation--even one involving parties that might not be considered
``close'' affiliates--could pose an undue risk; indeed, we previously
cited the example of a party that associates with a provider, engages
in improper conduct, and then ends the association prior to any
imposition of an adverse action or before the determination that a
large overpayment exists. We again recognize, though, as we have
discussed in detail in this section II of this final rule with comment
period, the burden that could be involved in ascertaining this
information. We also have revised Sec. 424.519(b) such that only a
very small number of providers and suppliers will have to report
affiliations in the initial years following the effective date of this
final rule with comment period.
Comment: A commenter stated that with respect to past affiliations,
providers should only be required to disclose whether the provider or
the affiliate had a disclosable event during the affiliation period.
Having to obtain information from past affiliates, the commenter
stated, could be extremely difficult. Another commenter stated that
providers and suppliers should not be required to report prior
disclosable events of any other providers or suppliers with which it
has or had an affiliation. The commenter stated that once a
relationship with a close affiliate ends, the provider or supplier may
have no way to know or obtain information about the individual's or
entity's behavior and actions. Another commenter stated that requiring
reporting disclosable events occurring after an affiliation ends would
be extremely burdensome on providers and suppliers; it would mandate
them to continue to perform due diligence on an organization with which
they no longer do business. Once a financial relationship has been
terminated, the commenter explained, there would be no plausible reason
for either party to maintain contact and, moreover, it is unclear
whether the former affiliate could be compelled to disclose whether,
for instance, it had its enrollment denied, revoked, or terminated
after the affiliation had ended; also, the former affiliate would have
no incentive to be forthcoming with the provider or supplier because
there would be no penalty for being untruthful. This would, the
commenter stated, leave providers or suppliers who are acting in good
faith in a precarious position.
Response: We understand the potential difficulty involved in
obtaining data from past affiliates. However, we reiterate our belief
that disclosable events occurring before or after an affiliation could
present program integrity risks and that we must be able to take action
to protect the Medicare program and the Trust Funds.
After consideration of the comments received, we are finalizing
proposed Sec. 424.519(a) and (b) with several exceptions and with a
revision to Sec. 424.502:
In paragraph (a), we are doing the following:
++ Changing the language ``(as defined in Sec. 424.57(a))'' to
``imposed under this title.''
++ Adding the language ``to the definition of disclosable event in
Sec. 424.502'' to the end of the opening
[[Page 47810]]
paragraph. This is to accommodate our revisions to Sec. Sec. 424.502
and 424.519(b).
In lieu of listing the four disclosable events that we
proposed in Sec. 424.519(b) within that paragraph, we are adding to
Sec. 424.502 a definition of ``disclosable event'' to encompass them.
Doing so, we believe, will shorten Sec. 424.519(b) to make it more
concise and readable. Within this definition, we are also adding ``by
the OIG'' immediately after the word ``excluded'' to clarify that we
are referring to OIG exclusions.
We are revising the entirety of Sec. 424.519(b) to read
as set out in the regulatory text.
In addition, and as mentioned previously, we solicit public comment
on operational approaches (specifically with respect to timing,
mechanism, and priority) for obtaining affiliation information from
providers and suppliers other than those to which Sec. 424.519(b) will
apply.
c. Affiliation Data, Mechanism of Disclosure, and ``Reasonableness''
Standard
In Sec. 424.519(c), we proposed to require the disclosure of the
following information about the affiliation:
General identifying data about the affiliated provider or
supplier. This includes the following:
++ Legal name as reported to the Internal Revenue Service or the
Social Security Administration (if the affiliated provider or supplier
is an individual).
++ ``Doing business as'' name (if applicable).
++ Tax identification number.
++ NPI.
Reason for disclosing the affiliated provider or supplier
(for example, uncollected Medicare debt or Medicaid payment
suspension).
Specific data regarding the relationship between the
affiliated provider or supplier and the disclosing party. Such data
include the--(1) length of the relationship; (2) type of relationship
(for instance, an owner of the initially enrolling provider or supplier
was a managing employee of the affiliated provider or supplier); and
(3) degree of affiliation (for example, percentage of ownership;
whether the ownership interest was direct or indirect; the individual's
specific managerial position; the scope of the individual's or entity's
managerial duties; whether the partnership interest was general or
limited).
If the affiliation has ended, the reason for the
termination.
We stated that the information in proposed Sec. 424.519(c) is
necessary to help us assess the risk of fraud, waste, or abuse that the
affiliation poses.
In Sec. 424.519(d), we proposed that the information required
under Sec. 424.519 be furnished to CMS or its contractors via the Form
CMS-855 application (paper or the internet-based PECOS enrollment
process). This is to ensure that all enrollment information continues
to be reported via a single vehicle.
In Sec. 424.519(e), we proposed that the disclosing provider's or
supplier's failure to fully and completely furnish the information
specified in Sec. 424.519(b) and (c) when the provider or supplier
knew or should reasonably have known of this information may result in
either of the following:
The denial of the provider's or supplier's initial
enrollment application under Sec. 424.530(a)(1) and, if applicable,
Sec. 424.530(a)(4).
The revocation of the provider's or supplier's Medicare
enrollment under Sec. 424.535(a)(1) and, if applicable, Sec.
424.535(a)(4).
Under our proposed ``reasonableness'' standard in Sec. 424.519(e),
we would require particular information to be reported only if the
disclosing provider or supplier knew or should reasonably have known of
said data. For instance, while a provider or supplier would typically
know of a past affiliation, it may not necessarily know whether a Sec.
424.519(b) action occurred or was imposed after the affiliation ceased.
We stated that we would review each situation on a case-by-case basis
in determining whether the disclosing entity knew or should have known
of the information.
We also solicited comment regarding the following:
Whether we should establish a ``reasonableness'' test,
whereby we explain what constitutes a sufficient effort to obtain
information in the context of the ``should reasonably have known''
standard.
If we establish such a test, what its specific elements
should be (for example, what constitutes a reasonable inquiry; the
minimum steps that the provider must undertake in researching
information).
We received the following comments regarding paragraphs (c), (d),
and (e):
Commenter: A commenter questioned whether affiliations would have
to be reported prior to updates to the Form CMS-855 to capture this
information. In a similar vein, another commenter questioned whether,
once the rule becomes final, organizations would immediately be
required to collect data regarding ownership interests or other
affiliations with Medicare providers and suppliers, or whether there
would be a grace period to permit entities (especially large ones) to
prepare for the affiliation disclosure requirements. Another commenter
urged CMS to give providers and suppliers a reasonable implementation
period to prepare for said requirements.
Response: Disclosable affiliations will not have to be reported
until the Form CMS-855 applications are updated to collect this data;
additionally, CMS will issue accompanying subregulatory guidance
regarding the affiliation disclosure process, though this may or may
not be issued before CMS' begins sending affiliation disclosure
requests to providers and suppliers. Because disclosure will not be
required until the applicable forms are revised, all stakeholders will
have sufficient time to prepare for said requirements.
Comment: A commenter stated that an elaborate regulatory
``reasonableness'' test is unnecessary. Instead, the commenter
suggested that--(1) the reasonableness standard should be based on the
principle of good faith, and (2) physicians should be neither required
nor expected to research information about disclosable events relevant
to affiliations that they would not otherwise be aware of in the
general course of business. The commenter stated that a presumption of
good faith should be applied that takes account of the limited
knowledge providers may possess regarding their affiliated entities,
especially when the extent or duration of the affiliation is relatively
minor. Several other commenters also recommended a ``good-faith'' basis
for any reasonableness test, with another commenter stating that
providers and suppliers should not be required or expected to research
data about disclosable events relevant to prior affiliations that they
would not be otherwise aware of in the overall course of business.
An additional commenter stated that setting a standard for a
``reasonable'' effort might inadvertently--(1) expose honest providers
to a level of risk that this rule does not intend, and (2) offer a
potential benchmark for questionable and fraudulent parties. With the
former, the commenter stated that most medical practices would strive
to meet any reasonableness standard, but that they may lack the
resources to meet an excessive standard. Concerning the latter, the
commenter stated that a clearly delineated standard would signal to
parties engaged in fraudulent behavior exactly how ``far away'' to keep
their information, thus increasing the chances that innocent providers
are unknowingly associated with unethical entities. The commenter
recommended that CMS base any reasonableness
[[Page 47811]]
standard on the presumption of good faith and not a complex process.
Response: As previously stated in both this final rule with comment
period and the proposed rule, we recognize that various data may be
difficult to obtain. We intend to issue subregulatory guidance that
will clarify our expectations regarding the level of effort that is
required in securing the relevant affiliation information.
Comment: A number of commenters recommended that CMS--(1) more
clearly define the ``knew or should reasonably have known'' standard;
(2) develop criteria for said standard; (3) explain what constitutes a
sufficient effort to obtain information; (4) specify how CMS will
assess whether a provider or supplier knew or should reasonably have
known of an affiliation or disclosable event; and (5) furnish examples
of when and how the standard would and would not be applied. One
commenter stated that CMS should provide illustrations of what would
constitute a reasonable attempt to obtain certain information, similar
to the Internal Revenue Service's ``Rebuttable Presumption'' standard.
For example, the commenter stated, if a provider adheres to certain
protocols, it should not be penalized if the information gathered
pursuant to such protocols turns out to be false. The commenter
believed this was equitable and would promote practical compliance.
An additional commenter stated that CMS should not institute a
strict test for reasonableness but instead provide guidance on the
steps that CMS expects providers and suppliers to take to meet the
``should reasonably have known'' standard. The commenter contended that
an explicit test--(1) may be too administratively burdensome on
providers and suppliers; and (2) might not be applicable to a variety
of activities and relationships.
Response: We appreciate and understand the commenters' concerns. As
stated previously, we plan to issue subregulatory guidance that will
clarify our expectations regarding the level of effort providers and
suppliers must expend when researching affiliations.
Comment: A commenter sought clarification as to the appropriate
process for providers and suppliers to follow if they disagree with
CMS' application of the ``knew or should reasonably have known''
standard in a particular case; the commenter asked whether the remedy
is limited to a post-revocation appeal. The commenter recommended that
if there is a dispute about whether the test has been met, no final
enrollment action should be taken until all rights of appeal are
exhausted. Another commenter stated that if the provider or supplier
disagrees with any CMS application of the ``knew or should reasonably
have known'' test that results in a denial or revocation, the provider
or supplier can appeal CMS' denial or revocation. Another commenter
stated that individuals often cannot be expected to discover a
disclosable event when many of the affected parties are not in a
sufficient position of control to obtain data regarding whether past,
present, or future relationships may involve such an event; the
commenter added that there is no comprehensive database of this
information.
Response: We acknowledge the commenters' concerns and, as already
stated, will issue appropriate subregulatory guidance concerning the
``knew or should reasonably have known'' standard. We note also that
the provider or supplier may appeal a denial or revocation triggered by
our affiliation disclosure provisions under 42 CFR part 498.
Comment: A commenter recommended that CMS require providers to
report debts only for affiliates that they have reasonable knowledge to
believe are over the established debt threshold. A reasonable knowledge
standard, the commenter stated, would--(1) allow CMS to identify
debtors that could pose a risk to the integrity of the Medicare
program; and (2) ease the regulatory burden on providers because they
would not have to investigate in-depth every current or past affiliate.
Response: We appreciate this comment and believe that our ``knew or
should reasonably have known'' standard is not inconsistent therewith.
However, we strongly reemphasize, that this does not mean that actual
knowledge without any attempt to research affiliation data should be
the test for compliance. Even with our ``knew or should reasonably have
known'' standard, the provider or supplier must put forth a sufficient
effort to research actual and possible affiliations.
We also reiterate that we are not establishing a debt threshold in
this final rule with comment period.
Comment: Several commenters stated that a failure to report a
disclosable event (either during initial enrollment, revalidation, or
through changes in information) should not result in denial or
revocation unless the omission was material and intentional, with some
commenters adding that this policy is necessary because of the lack of
clarity regarding what constitutes an affiliation. Some stated that
denial or revocation would only harm legitimate providers and suppliers
that are making honest efforts to report said data but that
inadvertently neglect certain information or are unable to obtain it.
Response: We respectfully decline to establish a ``material and
intentional'' standard, for this could give the impression that--(1)
certain required data can be withheld without consequences; and (2)
little effort is necessary so long as information is not purposely
withheld. Nevertheless, we again recognize that some data could be
difficult to secure, and we stress that we will only take denial or
revocation action pursuant to Sec. 424.519(e) after careful
consideration of the facts and circumstances and not as a matter of
course.
Comment: A commenter stated that by using certified mail to inform
providers and suppliers of certain information, CMS will have a legally
binding signed document with which to prove what an entity or person
should reasonably have known. The commenter added that a searchable CMS
program participant database that tracks this information could prevent
fraudulent activity before payments are made.
Response: We appreciate these comments but believe they are outside
the scope of this rule.
Comment: A commenter stated that a provider or supplier should only
be required to complete steps in its research that are clearly outlined
and can be accomplished through publicly available search mechanisms,
such as the OIG exclusion list. The commenter added that DMEPOS
suppliers are required to complete a fingerprinting process as part of
enrollment and re-enrollment, which, the commenter believed, should
suffice to meet the intent of background research on individual owners.
Response: While we believe that public database searches would
prove useful in obtaining affiliation data, we do not believe the
provider's or supplier's efforts should be automatically restricted to
these means. Depending on the particular circumstances involved and
recognizing that certain instances might necessitate greater degrees of
research, this could require, for instance, a review of internal
records and contacting affiliates. Such actions may yield data and
information that is not otherwise available via public databases.
We note that DMEPOS suppliers are subject to our fingerprinting
requirements only as prescribed in Sec. 424.518.
Comment: A commenter suggested that CMS--(1) should establish a
rebuttable presumption that the
[[Page 47812]]
provider or supplier exercised sufficient diligence in gathering
affiliation information; and (2) should not deny or revoke enrollment
if the provider or supplier follows the appropriate procedure to obtain
a rebuttable presumption. The commenter stated that this would promote
compliance while recognizing that legitimate mistakes will be made in
the data collection process.
Response: We respectfully disagree that we should automatically
presume that every provider or supplier submitting affiliation data
exercised sufficient diligence in gathering the required information.
We will review each case on its own merits, while acknowledging, as
previously stated, that certain data may be difficult to secure.
Comment: A commenter stated that CMS should explicitly state that
hospitals and health systems may rely upon disclosures furnished by
their affiliates, rather than being held to a ``should reasonably have
known'' standard.
Response: We respectfully disagree. A provider's or supplier's
reliance upon information furnished by its affiliates is a matter
between those parties, and the provider or supplier itself is
ultimately responsible for furnishing accurate data to CMS. This is no
different from the current requirement to furnish correct ownership,
managerial, and adverse history information on the Form CMS-855 as part
of the regular enrollment process. As stated previously, we will review
each case on its own merits with the understanding that certain data
may be difficult to obtain.
After reviewing the comments received, we are finalizing Sec.
424.519(c), (d), and (e) as proposed.
d. Undue Risk
We proposed in Sec. 424.519(f) that upon receiving the information
described in Sec. 424.519(b) and (c) (and consistent with section
1866(j)(5)(B) of the Act), we would determine whether any of the
disclosed affiliations poses an undue risk of fraud, waste, or abuse.
The following factors would be considered:
The duration of the disclosing party's relationship with
the affiliated provider or supplier.
Whether the affiliation still exists and, if not, how long
ago it ended.
The degree and extent of the affiliation (for example,
percentage of ownership).
If applicable, the reason for the termination of the
affiliation.
Regarding the disclosable event--
++ The type of action (for instance, payment suspension);
++ When the action occurred or was imposed;
++ Whether the affiliation existed when the action (for example,
revocation) occurred or was imposed;
++ If the action is an uncollected debt--(1) the amount of the
debt; (2) whether the affiliated provider or supplier is repaying the
debt; and (3) to whom the debt is owed (for example, Medicare); and
++ If a denial, revocation, termination, exclusion, or payment
suspension is involved, the reason for the action (for example, felony
conviction; failure to submit complete information).
Any other evidence that CMS deems relevant to its
determination.
In summary, these factors would focus largely, though not
exclusively, on--(1) the length and period of the affiliation; (2) the
nature and extent of the affiliation; and (3) the type of disclosable
event and when it occurred. We stated in the proposed rule that a
closer, longer, and more recent affiliation involving, for instance, an
excluded provider or a large uncollected debt might present a greater
risk to the Medicare program than a brief affiliation that occurred 5
years ago. Yet we stressed that it should not be assumed that the
latter situation would never pose an undue risk. We declined to make
specific conclusions in the proposed rule regarding what would
constitute an undue risk, for affiliations vary widely. We stated that
we must retain the flexibility to deal with each situation on a case-
by-case basis, utilizing the aforementioned factors. We also solicited
comment on the following issues related to these factors:
Whether additional factors should be considered.
Which, if any, of the proposed factors should not be
considered.
Which, if any, factors should be given greater or lesser
weight than others.
In Sec. 424.519(g), we proposed that a CMS determination that a
particular affiliation poses an undue risk of fraud, waste, or abuse
would result in, as applicable, the denial of the provider's or
supplier's initial enrollment application under new Sec.
424.530(a)(13) or the revocation of the provider's or supplier's
Medicare enrollment under new Sec. 424.535(a)(19). We noted that an
actual finding of fraud, waste, or abuse would not be necessary for
Sec. 424.519(g) to be invoked. Only a determination that an undue risk
of fraud, waste, or abuse exists would be required.
We received the following comments regarding proposed Sec.
424.519(f) and (g):
Comment: A commenter stated that CMS should include in its undue
risk determinations the following factors--(1) whether the disclosing
provider or supplier was involved with the disclosable event; and (2)
whether the affiliated individual or organization plays a tangible role
in the day-to-day management and operations of the disclosing provider
or supplier. Another commenter stated that CMS should evaluate whether
the disclosing provider or supplier had any involvement with or was
otherwise implicated by the disclosable event.
Response: We believe that the commenter's second suggested factor
falls within the scope of our proposed factor concerning the degree and
extent of the affiliation. We do not believe that the commenter's first
criterion should be explicitly listed as a factor in Sec. 424.519(f).
Section 1866(j)(5)(B) of the Act focuses on whether the affiliation
poses an undue risk rather than on the provider's or supplier's actual
or potential involvement in the adverse action. In other words, the
relationship itself is the relevant issue. We are concerned that adding
the suggested factor would imply that the provider or supplier must
have been directly involved with the disclosable event (and for there
to be clear evidence thereof) in order for an undue risk under Sec.
424.519(f) to exist. We believe this would be inconsistent with the
spirit of section 1866(j)(5)(B) of the Act and could hinder our efforts
to protect Medicare against problematic provider relationships.
Consider the following illustration: Assume that a non-physician
practitioner has been a one-third owner of three separate Medicare-
enrolled group practices for the past 5 years. Two of the groups have
their enrollments revoked; the third group has an outstanding
overpayment of $300,000. The practitioner wants to open a separate
practice of which she will be the sole owner. The practitioner's
affiliations would certainly raise questions about whether an undue
risk exists. However, if we included the commenter's suggested factor
within Sec. 424.519(f) and there is no firm proof directly tying the
practitioner to the grounds for the revocations or the debt, we could
be required to enroll the practitioner despite our legitimate concerns
and the possible threat to the Medicare Trust Funds.
Notwithstanding this, we wish to make clear that we will exercise
our denial or revocation authority under Sec. 424.519(f) cautiously.
We recognize that many disclosable affiliations may not pose an undue
risk. Yet we must be
[[Page 47813]]
able to take action to protect Medicare from those affiliations that
do.
Comment: A commenter recommended that CMS--(1) furnish providers
with a written explanation of why it determined that an undue risk
exists, including credible evidence of its belief, before taking action
under Sec. 424.519(g); and (2) provide examples in the rule's preamble
of types of disclosable events, how it plans to apply the undue risk
factors, and what action CMS may take in response. Other commenters
also requested such examples, with a commenter stating that the
examples should be subject to public notice and comment before the rule
is finalized. Overall, commenters requested greater clarification of
what constitutes an undue risk including, perhaps, a concrete
definition or, at a minimum, objective standards. The commenters
expressed concern that--(1) CMS' desire to retain its flexibility to
address situations on a case-by-case basis gives CMS too much
discretion; and (2) several of the factors are too broad. An additional
commenter stated that CMS must establish objective measures with clear
correlation to consequences in determining undue risk.
Response: We appreciate the commenters' concerns and will include
pertinent information regarding the reason(s) for the undue risk
determination in the denial or revocation letter sent to the provider
or supplier. Such information would be in the revocation or denial
letter itself, not a pre-revocation or pre-denial notice, as suggested
by one commenter. Furthermore, as we stated in the proposed rule, the
determination of undue risk will be so dependent on the individual
facts and circumstances involved that it is difficult to identify
examples of what would and would not constitute an undue risk or to
clearly define the term ``undue risk.'' Every case is different, and we
must retain the discretion to address each based on its own merits and
facts. In addition, we do not believe our factors are overly broad; we
believe they are fairly specific, while simultaneously containing a
measure of flexibility to deal with particular circumstances.
Comment: A commenter stated that CMS should not take action against
the disclosing provider or supplier without credible evidence or
information showing that there will be an undue risk of fraud, waste,
or abuse. The commenter stated that without this limitation, large
groups and chains of providers and suppliers might have their Medicare
enrollments revoked due to loose, indirect affiliation relationships
with parties that have had disclosable events unrelated to the
disclosing entities.
Response: As stated earlier, we will only take action under Sec.
424.519(f) after a very careful review of the aforementioned factors.
Comment: A commenter questioned--(1) how CMS would handle undue
risk determinations when it only has partial information available; and
(2) whether a decision would be based only on that partial data.
Response: Although the commenter's reference to ``partial''
information is somewhat unclear, we will make our determination based
on the available information. If an undue risk is found and the
provider's or supplier's enrollment is consequently denied or revoked,
the provider or supplier may challenge the determination through an
appeal of the denial or revocation.
Comment: A commenter requested that CMS furnish guidance in the
rule as to when CMS will notify a provider or supplier of whether an
affiliation poses an undue risk; the commenter suggested a 30-day
decision period. The commenter stated that prompt notice is important
so that if the provider or supplier has employment screening
procedures, the hiring process is not hindered.
Response: Since the facts of each case will differ, we cannot
conclusively specify the timeframe in which an undue risk determination
will be made. If an undue risk is found and the enrollment is denied or
revoked, the affected provider or supplier will be notified via letter.
Comment: A commenter stated that if Medicare contractors will make
undue risk determinations, CMS must ensure that such determinations are
made in a consistent manner; if CMS will perform the determinations,
CMS must have sufficient staff to timely make these determinations and
communicate them to the provider or supplier. Another commenter stated
that CMS should clarify whether CMS Central Office, CMS' Regional
Offices, or the MACs will perform undue risk determinations.
Response: We may issue subregulatory guidance concerning the
process by which undue risk determinations will be made. In all cases,
however, we will ensure that sufficient resources for implementing our
disclosure of affiliation provisions are available.
Comment: A commenter stated that in determining undue risk, CMS
should only rely upon disclosable events involving parties with at
least 50 percent ownership, which the commenter referred to as
``substantial owners'' who are in a position to control or otherwise
influence the provider's actions; alternatively, CMS should consider
only those affiliations that occurred within 1 year or are currently in
effect and are of a significant degree. The commenter stated that
affiliations with parties other than these do not accurately reflect
whether a provider poses an undue risk.
Response: For reasons mentioned previously, we do not believe
that--(1) affiliations involving less than 50 percent ownership and (2)
prior affiliations should be automatically excluded from disclosure or
consideration regarding risk. Every disclosable affiliation will be
reviewed under Sec. 424.519, although the degree, extent, and timing
of the affiliation will be among the factors considered in our undue
risk determinations.
Comment: A commenter stated that CMS should establish clear factors
by which disclosable events and undue risk are evaluated. In general,
the commenter suggested criteria such as--(1) how recent the
affiliation was; (2) the type of disclosable event; (3) how much
control (or interest) the provider or supplier reporting the
disclosable event has over the affiliated party; and (4) intent. The
commenter cited an illustration of a current affiliation less than 1
year old with a party that is excluded by the OIG; the commenter stated
that this poses a substantially higher risk than an affiliation of
multiple years involving uncollected debt. The commenter also stated
that a 5 percent ownership interest is less likely to involve
significant influence over an affiliate than a significantly higher
percentage.
Response: The first three factors are already included within Sec.
424.519(f). Concerning intent, we are unclear as to whether the
commenter is referring to the affiliation or the disclosable event. In
either case, evidence of intentional wrongdoing would, of course,
impact our determination, but the lack thereof would not dictate that
there is no undue risk. All of the factors in Sec. 424.519(f),
including any evidence that is relevant to our decision, will be
considered. However, we note that not all or even a majority of the
factors would have to indicate risk in order for us to conclude that a
denial or revocation is warranted.
The percentage of ownership will fall within our analysis of the
degree and extent of the affiliation. While larger ownership shares
could, depending on the facts involved, weigh more heavily towards a
finding of undue risk, it should not be assumed that a 5 or 10 percent
interest will never result in such a determination. Again, each case
will
[[Page 47814]]
be judged on its particular circumstances.
Comment: Several commenters stated that findings of undue risk
should be restricted to egregious conduct. Another commenter stated
that, except for uncollected debts, CMS should restrict undue risk
determinations to cases involving intentional fraud or misconduct or
exclusions.
Response: As stated previously, we will exercise our denial or
revocation authority under Sec. 424.519(f) carefully. However, we do
not believe that the disclosable event must have involved intentional
fraud or misconduct for an affiliation to present an undue risk. Other
types of affiliations involving behavior that does not contain such
elements can endanger federal health care programs. Again, we will
carefully consider the circumstances of the disclosable event in making
our undue risk determinations.
Comment: A commenter contended that the statute requires the
affiliation to pose an undue risk by the provider or supplier.
Response: We are not entirely certain of the commenter's
contention, but we believe it is that the statute requires the provider
or supplier--rather than the affiliation--to pose an undue risk. We
respectfully disagree. Section 1866(j)(5)(B) of the Act refers to the
affiliation itself posing an undue risk of fraud, waste, or abuse,
rather than such risk being posed by the provider or supplier.
Comment: A commenter stated that the lack of objective standards
regarding undue risk creates a high potential for inconsistent
determinations on comparable facts. To reduce subjectivity, the
commenter suggested that CMS establish a decision matrix that includes
decision ``weights'' regarding the relevant factors. Each undue risk
criterion and ``should reasonably have known'' evaluation would be
assigned a weight of importance, which would then create a score tied
to a decision outcome. The commenter stated that CMS has used decision
matrices in other areas, most recently with the CMP provisions of the
home health intermediate sanction rules.
Response: We appreciate this suggestion but do not believe such a
matrix is necessary or advisable. Given the vast variety of factual
situations we will encounter, as stated previously, we must retain as
much flexibility as possible in our undue risk determinations. We
believe that elements such as ``decision weights'' would adversely
impact our ability to fairly consider all of the facts, since it would
effectively require that specific ``scores'' be given for certain
criteria and circumstances.
After reviewing the comments received, we are finalizing Sec.
424.519(f) and (g) as proposed with one exception. In Sec. 424.519(f),
we are changing the term ``action'' to ``disclosable event.'' This is
to achieve greater consistency with our addition of the definition of
``disclosable event'' to Sec. 424.502. In addition, we are changing
the heading of Sec. 424.530(a)(13) from ``Affiliation that poses undue
risk of fraud'' to simply ``Affiliation that poses an undue risk'' in
order to achieve consistency with the heading of Sec. 424.535(a)(19).
e. Additional Affiliation Provisions
We proposed in Sec. 424.519(h)(1) that providers and suppliers
must report new or changed information regarding existing affiliations,
consistent with our requirement in Sec. 424.516 to submit changes in
enrollment data; this would include the reporting of new affiliations.
However, under paragraph (h)(2) providers and suppliers would not be
required to report either of the following:
New or changed information regarding past affiliations
(except as part of a Form CMS-855 revalidation application) (paragraph
(h)(2)(i)).
Affiliation data in that portion of the Form CMS-855 that
collects affiliation information if the same data is being reported in
the ``owning or managing control'' (or its successor) section of the
Form CMS-855 (paragraph (h)(2)(ii)).
We stated that requiring providers and suppliers to report new or
changed information regarding past affiliations would impose an
unnecessarily excessive burden; providers and suppliers would have to
constantly monitor and track information changes involving parties with
whom they, their owners, or their managers no longer have a
relationship. Regarding the second exception, we believed this would
limit duplicate reporting and ease the burden on providers and
suppliers.
We received the following comments regarding this section:
Comment: Several commenters expressed concern about the requirement
to report changes in affiliation data. They generally stated that--(1)
the burden of continually monitoring, tracking, and reporting data on
many possible affiliates would be enormous; and (2) the penalty of
revocation for failing to timely a report a change is too severe,
especially if a reenrollment bar is imposed as well, and could unfairly
and substantially impact legitimate providers and suppliers. Given the
substantial burden involved, some commenters stated that any changes
should only be reported during the provider's or supplier's next
revalidation, rather than requiring the constant reporting of new or
changed information.
Response: We agree with the commenters' concerns regarding the
potential burden and will not finalize proposed Sec. 424.519(h)(1) and
(h)(2)(i). As already discussed, affiliation data under Sec. 424.519
will only be required in the limited circumstances described in revised
Sec. 424.519(b). However, we emphasize that providers and suppliers
will still be required to report changes in ownership and management
consistent with existing regulations.
Comment: A commenter stated that CMS has not outlined a plan for
how it will track new or changed affiliation data and how this
information should be reported. The commenter asked whether--(1) CMS
staff will check and monitor such data; and (2) PECOS will recognize
these changes. Another commenter stated that CMS should only require
providers to report new or changed information on close affiliates.
Response: As stated in the previous response, we are not finalizing
proposed Sec. 424.519(h)(1) and (h)(2)(i) due to the potential burden
of regularly tracking and reporting disclosable affiliation
information.
After reviewing the comments submitted, we are deleting Sec. Sec.
424.519(h)(1) and (h)(2)(i). Paragraph (h)(2)(ii) will be redesignated
as paragraph (h).
In Sec. 424.519(i), we proposed that CMS may apply proposed Sec.
424.530(a)(13) or Sec. 424.535(a)(19) (as applicable) to situations
where a disclosable affiliation (as described in Sec. 424.519(b) and
(c)) presents an undue risk of fraud, waste, or abuse, but the provider
or supplier has not yet disclosed or is not required at that time to
disclose the affiliation to CMS. Although we received no specific
comments on proposed Sec. 424.519(i) and are therefore finalizing it,
we received the following comment that we believe indirectly touches
upon this provision:
Comment: A commenter posed a scenario where a provider (the first
provider) is owned by five individuals, one of whom is associated with
another provider (the second provider) that has an uncollected Medicare
debt. The commenter asked whether the first provider would be denied or
revoked if the aforementioned individual's ownership interests in the
first provider are terminated prior to enrollment or revalidation.
[[Page 47815]]
Response: The first provider or supplier could be denied or revoked
if the scenario meets the requirements of Sec. 424.519(i) regarding
undisclosed affiliations. In that case, if CMS learned of the first
provider's affiliation prior to the individual in question terminating
his or her ownership interest, CMS could make an undue risk
determination under Sec. 424.519(g). CMS could then elect to revoke
the first provider under Sec. 424.535(a)(19). However, this could only
occur if CMS identified the affiliation while the individual owner was
still in an ownership role with the first provider. In addition, if,
when CMS evaluated the first provider, the individual owner was no
longer in an ownership or other applicable role, with the second
provider, no affiliation would be present; thus, no undue risk
determination could be made.
From a disclosure perspective under Sec. 424.519(b), CMS would not
take action against the first provider at the time of an initial or
revalidation application if the individual owner had already terminated
his or her ownership interest with the first provider. Whether related
to a disclosure or a CMS assessment, an owning or managing party must
be in an ownership or managerial role with the provider in order for an
affiliation to exist and an undue risk determination to be made.
2. Medicaid
Consistent with our discussion in section II.A.1.a. of this final
rule with comment period and for the reasons stated therein, we
proposed to revise the Medicaid provisions in 42 CFR part 455.
In Sec. 455.101, we proposed to add the same definition of
``affiliation'' that we proposed to add to Sec. 424.502, with the
exception of the paragraph regarding ``reassignment.'' Section 424.80
only applies to Medicare. However, we proposed to include payment
assignments under Sec. 447.10(g) within the definition of
``affiliation'' in Sec. 455.101. Under Sec. 447.10(g), payment for
services provided by an individual practitioner may be made to--
++ The employer of the practitioner, if the practitioner is
required as a condition of employment to turn over his fees to the
employer;
++ The facility in which the service is provided, if the
practitioner has a contract under which the facility submits the claim;
or
++ A foundation, plan, or similar organization operating an
organized health care delivery system, if the practitioner has a
contract under which the organization submits the claim.
As with Medicare reassignments, we stated in the proposed rule that
the relationships described in Sec. 447.10(g) are sufficiently close
to warrant their inclusion within the definition of ``affiliation'' in
Sec. 455.101; again, a W-2 employee or independent contractor may have
a closer day-to-day relationship with the individual or organization he
or she works for than, for instance, an indirect owner has with an
entity in which he or she has a 5 percent ownership interest. We also
noted that these provisions are similar to those in Sec. 424.80.
After considering the previously discussed comments we received
regarding our Medicare definition of ``affiliation,'' we are finalizing
our proposed definition of ``affiliation'' in Sec. 455.101.
In revised Sec. 455.103, we proposed that a state plan must
provide that the requirements of Sec. Sec. 455.104 through 455.107 are
met. Section 455.103 currently only references Sec. Sec. 455.104
through 455.106. Our revision included a reference to new Sec.
455.107. We received no comments on this proposal and are, therefore,
finalizing it.
In new Sec. 455.107, we proposed several paragraphs.
(i) Discussion of Sec. 455.107(a) and (b)
In paragraph (b), we proposed that a provider that is submitting an
initial or revalidating Medicaid application must disclose whether it
or any of its owning or managing employees or organizations (consistent
with the definitions of ``person with an ownership or control
interest'' and ``managing employee'' in Sec. 455.101) has or, within
the previous 5 years, has had an affiliation with a currently or
formerly enrolled Medicare, Medicaid, or CHIP provider or supplier
that--
Currently has an uncollected debt to Medicare, Medicaid,
or CHIP, regardless of--(1) the amount of the debt; (2) whether the
debt is currently being repaid (for example, as part of a repayment
plan); or (3) whether the debt is currently being appealed. For
purposes of Sec. 455.107 only, and as stated in proposed Sec.
455.107(a), the term ``uncollected debt'' would only apply to--
++ Medicare, Medicaid, or CHIP overpayments for which CMS or the
state has sent notice of the debt to the affiliated provider or
supplier;
++ CMPs (as defined in Sec. 424.57(a)); and
++ Assessments (as defined in Sec. 424.57(a));
Has been or is subject to a payment suspension under a
federal health care program (as that latter term is defined in section
1128B(f) of the Act), regardless of when the payment suspension
occurred or was imposed;
Has been or is excluded from participation in Medicare,
Medicaid, or CHIP, regardless of whether the exclusion is currently
being appealed or when the exclusion occurred or was imposed; or
Has had its Medicare, Medicaid, or CHIP enrollment denied,
revoked or terminated, regardless of--(1) the reason for the denial,
revocation, or termination; (2) whether the denial, revocation, or
termination is currently being appealed; or (3) when the denial,
revocation, or termination occurred or was imposed. For purposes of
Sec. 455.107 only, the terms ``revoked,'' ``revocation,''
``terminated,'' and ``termination'' would include situations where the
affiliated provider or supplier voluntarily terminated its Medicare,
Medicaid, or CHIP enrollment to avoid a potential revocation or
termination. This clarification is included in proposed Sec.
455.107(a).
After considering the previously discussed comments regarding the
related Medicare provisions at Sec. 424.519(a) and (b), we are
finalizing proposed Sec. 455.107(a) with two exceptions. First, we are
changing the language ``(as defined in Sec. 424.57(a))'' to ``imposed
under this title.'' Second, we are adding the following language to the
end of the opening paragraph of Sec. 455.107(a): ``to the definition
of disclosable event in Sec. 455.101:''
Similar to our previously referenced change to Sec. 424.502, we
are also adding a definition of ``disclosable event'' to Sec. 455.101
to encapsulate the four aforementioned events (that is, uncollected
debt, payment suspension, OIG exclusion, enrollment denial/revocation/
termination) that will trigger an affiliation disclosure under Sec.
455.107. We believe this will help simplify and shorten the text of
Sec. 455.107(b). In addition, we are adding ``by the OIG'' immediately
after the word ``excluded'' in our ``disclosable event'' definition''
to clarify that we are referring to OIG exclusions.
With respect to paragraph (b), and for reasons akin to those
concerning our changes to Sec. 424.519(b), we are making a number of
revisions to incorporate a ``phased-in'' approach. However, there are
some differences between how the ``phased-in'' approach will be
conducted under Sec. 424.519 for Medicare providers and suppliers and
how the approach will be conducted under Sec. 455.107 for Medicaid
providers.
[[Page 47816]]
(A) Implementation Approaches for Medicaid and CHIP--Background
Under revised Sec. 455.107(b), each state will, in consultation
with CMS, select one of two options for the implementation of the
affiliation disclosure requirement. The option chosen will be in effect
until we engage in further rulemaking regarding this requirement;
states will not be able to switch options prior to such additional
rulemaking. Under the first option, disclosures must be submitted by
all newly enrolling or revalidating Medicaid and/or CHIP providers that
are not enrolled in Medicare. Under the second and more targeted
option, disclosures must be submitted only upon request by the state.
Specifically, the states that choose this second option will request
disclosures from those Medicaid and/or CHIP enrolled providers that are
not enrolled in Medicare and that the state, in consultation with CMS,
determines meets certain criteria, discussed further below.
(1) First Option
In states that select the first option, a provider that is not
enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or
is revalidating its Medicaid or CHIP enrollment information) must
disclose any and all affiliations that it or any of its owning or
managing employees or organizations (consistent with the terms ``person
with an ownership or control interest'' and ``managing employee'' as
defined in Sec. 455.101) has or, within the previous 5 years, had with
a currently or formerly enrolled Medicare, Medicaid, or CHIP provider
or supplier that has a disclosable event (as defined in Sec. 455.101).
(2) Second Option
In states that select the second option, upon request from the
state, a provider that is not enrolled in Medicare but is initially
enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP
enrollment information) must disclose any and all affiliations that it
or any of its owning or managing employees or organizations (consistent
with the terms ``person with an ownership or control interest'' and
``managing employee'' as defined in Sec. 455.101) has or, within the
previous 5 years, had with a currently or formerly enrolled Medicare,
Medicaid, or CHIP provider or supplier that has a ``disclosable event''
(as defined in Sec. 455.101). The state will request such disclosures
when it, in consultation with CMS, has determined that the initially
enrolling or revalidating provider may have at least one such
affiliation.
(A) Characteristics of Each Option
There are several similarities between the two options.
First, under either option, only those providers that are not
enrolled in Medicare would be required to disclose affiliations. This
is because the states will, as applicable, be able to rely on CMS'
review of actual or potential affiliation data for dually-enrolled
providers (that is, providers enrolled in both Medicare and Medicaid or
CHIP). In contrast, Medicare and PECOS would not have affiliation
information for Medicaid-only or CHIP-only providers; thus, the state
would be unable to rely upon any affiliation data that Medicare may
have on file for these providers. The limiting of the disclosure
requirement to providers not enrolled in Medicare would therefore
eliminate duplicative efforts by CMS and the states.
Second, the disclosable events pertaining to each option mirror not
only each other but also the disclosable events applicable to Medicare
enrollment as defined in Sec. 424.502 and in section 1866(j)(5) of the
Act. We believe this will help ensure consistency with Medicare and
with the statute. In addition, and as previously discussed, the
relationships described in section 1866(j)(5) of the Act are of concern
to CMS and the states from a program integrity perspective. Including
them within the scope of Sec. 455.107(b) will assist our efforts in
deterring fraud, waste, and abuse.
Third, with both options, any provider required to submit a
disclosure of affiliations must report any and all affiliations that
come within the scope of Sec. 455.107. Even if the state selects the
second option and, for a particular provider, identifies only one
affiliation that triggers a request for the provider to submit a
disclosure of affiliations, that provider must disclose all applicable
affiliations regardless of whether the state may already have
information on these relationships.
Fourth, a provider's disclosure of affiliations, irrespective of
which option is selected, does not automatically mean that the state,
in consultation with CMS, has determined or will determine that all or
any of the disclosed affiliations pose an undue risk of fraud, waste,
or abuse.
Fifth, providers will not be required to report all applicable
affiliation information to the state under either option until the
applicable state has revised its relevant enrollment application(s) to
accommodate the disclosure of affiliations requirement. However, per
Sec. 455.107(h) and as addressed in more detail later in this section,
if a state determines that a provider has an affiliation(s)--via a
source(s) other than provider reporting--and determines, in
consultation with CMS, that one or more affiliations of that provider
represent an undue risk of fraud, waste, or abuse, the state may deny
or terminate the provider's enrollment in the state Medicaid program
even before the state's applications (or other means of capturing
affiliation information, whether in physical or electronic form) have
been updated with an affiliation disclosure section.
Despite the parallels between the two options, there is one
critical difference, in that the first option is significantly broader
than the second. Excluding Medicare-enrolled providers and suppliers,
the former option applies to all newly enrolling and revalidating
providers without exception, whereas the second option only requires
the submission of affiliation data upon a state request. On a broader
level, the first option does not involve a gradual, incremental
enforcement such as that which we are adopting with Medicare providers
and suppliers in Sec. 424.519(b). The second option, however, largely
duplicates the ``phased-in'' approach of Sec. 424.519(b), under which
the states will conduct internal research to determine whether a
disclosable affiliation under Sec. 455.107 may exist and then request
a disclosure of all applicable affiliations. We believe that affording
the states more than one alternative will permit them greater
flexibility in implementing the affiliation requirement.
We note that section 1866(j)(5) of the Act requires every provider
and supplier (regardless of the relative risk they may pose) to
disclose affiliations upon initial enrollment and revalidation. All
states that choose the second option will therefore eventually be
required to collect affiliation disclosures from their providers upon
the submission of each initial and revalidation application. Future
rulemaking will address the next phases of the Medicaid and CHIP
affiliations disclosure process. We would appreciate feedback from the
public on the possible content of this rulemaking, particularly with
respect to the same general topics on which we have requested comments
regarding the Medicare affiliation process (for example, priority of
disclosure requests).
States will notify CMS, via a process outlined in future
subregulatory guidance, as to which of the two options
[[Page 47817]]
they are choosing. CMS subregulatory guidance will also provide
instruction to the states as to how to inform the necessary
stakeholders, such as the relevant health care provider community,
about which option it has selected so that Medicaid-only and CHIP-only
providers know if they are automatically required to furnish
affiliations disclosures upon initial enrollment or revalidation or if
they must do so only upon request. After a state notifies both CMS and
necessary stakeholders about which option it selected, the state will
then begin to collect affiliation disclosures in a manner consistent
with that option.
(ii) Discussion of Sec. 455.107(c), (d), and (e)
In paragraph (c), we proposed that the following information about
the affiliation must be disclosed:
General identifying data about the affiliated provider or
supplier. This would include the following:
++ Legal name as reported to the Internal Revenue Service or the
Social Security Administration (if the affiliated provider or supplier
is an individual).
++ ``Doing business as'' name (if applicable).
++ Tax identification number.
++ NPI.
++ Reason for disclosing the affiliated provider or supplier (for
example, uncollected CHIP debt; payment suspension).
++ Specific data regarding the affiliation relationship. Such data
would include the--(1) length of the relationship; (2) type of
relationship; and (3) degree of affiliation.
++ If the affiliation has ended, the reason for the termination.
In paragraph (d), we proposed that the information described in
Sec. 455.107(b) and (c) must be furnished to the state in a manner
prescribed by the state.
In paragraph (e), we proposed that the disclosing provider's
failure to fully and completely furnish the information in Sec.
455.107(b) and (c) when the provider knew or should reasonably have
known of this information may result in--
The denial of the provider's initial enrollment
application; or
The termination of the provider's Medicaid or CHIP
enrollment.
Based on the previously discussed comments we received regarding
the general contents of Sec. 424.519(c) through (e), we are finalizing
Sec. 455.107(c), (d), and (e) as proposed with one exception. We are
adding the language ``in consultation with the Secretary'' to the end
of Sec. 455.107(d). Section 1866(j)(5) of the Act, as explained
earlier, specifies that affiliation disclosures are to be furnished
``in a form and manner and at such time as determined by the
Secretary.'' To comply with this requirement, we believe that states
should consult with CMS as to the ``form and manner'' of said
disclosures. We will communicate with the states regarding this
consultation requirement and issue subregulatory outlining the
parameters thereof.
(iii) Discussion of Sec. 455.107(f), (g), (h), and (i)
In paragraph (f), we proposed that upon receiving the information
described in Sec. 455.107(b) and (c), the state, in consultation with
CMS, would determine whether any of the disclosed affiliations poses an
undue risk of fraud, waste, or abuse. The state, in consultation with
CMS, would consider the following factors in its determination:
The duration of the disclosing party's relationship with
the affiliated provider or supplier.
Whether the affiliation still exists and, if not, how long
ago it ended.
The degree and extent of the affiliation.
If applicable, the reason for the termination of the
affiliation.
Regarding the affiliated provider's or supplier's
disclosable event--
++ The type of action;
++ When the action occurred or was imposed; and
++ Whether the affiliation existed when the action occurred or was
imposed.
++ If the action is an uncollected debt--(1) the amount of the
debt; (2) whether the affiliated provider or supplier is repaying the
debt; and (3) to whom the debt is owed (for example, Medicare);
If a denial, revocation, termination, exclusion, or
payment suspension is involved, the reason for the action; and
Any other evidence that the state, in consultation with
CMS, deems relevant to its determination.
In paragraph (g), we proposed that a determination by the State, in
consultation with CMS, that a particular affiliation poses an undue
risk of fraud, waste, or abuse results in, as applicable, the denial of
the provider's initial enrollment application or the termination of the
provider's Medicaid or CHIP enrollment.
We received the following comments that were specific to proposed
Sec. 455.107(f) and (g):
Comment: A commenter stated that there is no current federal
requirement that a state Medicaid agency consult with CMS in making
enrollment determinations. The commenter recommended that CMS--(1)
permit greater discretion regarding the required consultation with CMS;
(2) furnish clarification and guidance to states concerning this
process; (3) establish timeframes by which CMS, under this provision,
must respond to the state in order to avoid delays in application
processing; and (4) permit states to rely upon any CMS undue risk
determinations involving Medicare-enrolled providers or providers
enrolled with another state Medicaid agency. Concerning the final
recommendation, the commenter believed there would be no need for the
state to consult CMS on a matter that CMS has already reviewed. Another
commenter stated that CMS should eliminate the requirement that the
state consult with CMS on undue risk determinations, contending that
the rule does not address the possibility of disagreement or delays in
reaching a determination. If the requirement is retained, the commenter
stated that the rule should establish a clear and expedited process for
making such determinations. This should include a provision that all
state recommendations are automatically affirmed after 15 days, which
would ensure that determinations are promptly made.
Response: While we appreciate these comments, we respectfully
decline to remove the consultation language, for consultation is
necessary to satisfy the statutory requirement that the Secretary
determine ``undue risk.'' However, we will work closely with the states
in developing a subregulatory process by which there is adequate
guidance and efficient communication between the states and CMS, while
recognizing the traditional flexibility given to states in their
enrollment determinations. We note that the two previously mentioned
options under Sec. 455.107(b) will apply only to providers that are
not enrolled in Medicare because, as we explained, states will be able
to rely on CMS' review of Medicare-enrolled providers and suppliers in
the matter of affiliation disclosures.
Comment: A commenter requested that CMS provide clear guidance
regarding a state agency's responsibility under our proposal,
specifically (1) the degree to which a state must establish that a
provider seeking Medicaid enrollment has accurately disclosed
affiliations under Sec. 455.107; (2) the required extent of the
state's consultation with CMS, provider outreach and education, and
ongoing documentation of information outlined in Sec. 455.107; and (3)
the length of time that states will have to implement Sec. 455.107.
Another commenter
[[Page 47818]]
suggested that the final rule contain a provision making the rule
effective no sooner than 6 months from the end of the state's
legislative session that begins after the rule's publication date. This
will help states ensure that--(1) state law reflects the rule's
requirements; and (2) providers are fully informed of said
requirements. Another commenter requested that CMS consider allowing
sufficient time to implement the rule, suggesting a 12-month period
that, the commenter believed, would enable providers to prepare for and
be compliant at the onset of these changes.
Response: We will work closely with the states and disseminate
sufficient guidance to them in implementing our affiliation disclosure
provisions. The three issues the first commenter raised may be
addressed in such guidance.
Consistent with our position regarding Sec. 424.519, states will
not be expected to implement Sec. 455.107--and Medicaid and CHIP
providers will not have to disclose affiliation data under this
provision--until each state's pertinent Medicaid and/or CHIP initial
and/or revalidation applications are updated to collect this
information. Further, CMS will issue accompanying subregulatory
guidance to the states regarding the operationalization of Sec.
455.107 (although said guidance may or may not be issued before some
states send out their initial affiliation disclosure requests). The
timing of the updates to each state's Medicaid and/or CHIP applications
will vary from state to state; it is not possible, of course, to
predict how long it will take each state to update its applications
because of the numerous variables involved. Regardless, we believe that
the need for each state to revise its applications and discuss with CMS
those aspects of this process where such consultation is required will
give stakeholders sufficient time to prepare for these requirements.
After reviewing the comments received, we are finalizing Sec.
455.107(f) and (g) as proposed with one exception. In Sec. 455.107(f),
we are changing the term ``action'' to ``disclosable event.'' This is
to achieve greater consistency with our addition of the definition of
``disclosable event'' to Sec. 455.101.
In paragraph (h), we proposed the following:
Providers would be required to report new or changed
information regarding existing affiliations. This would include
reporting any new affiliations.
Providers would not be required to report new or changed
information regarding past affiliations (except as part of a
revalidation application).
We received the following comment regarding Sec. 455.107(h):
Comment: A commenter questioned whether providers would have to
furnish this new or changed data to Medicaid or CHIP within a CMS-
specified time period, or whether the state has the discretion to
establish the time period.
Response: For the same reasons behind our revision of proposed
Sec. 424.519(h), we have decided not to finalize proposed Sec.
455.107(h).
In paragraph (i), we proposed that the state, in consultation with
CMS, may apply paragraph (g) to situations where a reportable
affiliation poses an undue risk of fraud, waste, or abuse, but the
provider has not yet disclosed or is not required at that time to
disclose the affiliation to the state. We received no comments
specifically referencing Sec. 455.107(i) and are, therefore,
finalizing it as proposed, with one exception: we are re-designating
Sec. 455.107(i) as Sec. 455.107(h) due to our previously mentioned
decision not to finalize proposed Sec. 455.107(h).
c. CHIP
Section 2107(e) of the Act states that sections 1902(a)(77) and
(kk) of the Act (which relate to Medicaid provider screening,
oversight, and reporting requirements) apply to CHIP to the same extent
that they apply to Medicaid. We thus proposed to apply our proposed
Medicaid affiliation disclosure requirements to CHIP providers for two
principal reasons. First, section 1866(j)(5) of the Act specifically
references the need to disclose current and prior affiliations with
CHIP providers. We believe it logically follows that CHIP providers
should have to disclose similar affiliation information. Second, and
for reasons previously explained, the disclosure of affiliation
information would assist efforts in deterring fraud, waste, and abuse
in CHIP.
Section 457.990(a) states that part 455, subpart E, applies to a
state under Title XXI in the same manner as it applies to a state under
Title XIX. We proposed to revise Sec. 457.990(a) such that Sec.
455.107 would also apply to Title XXI. Paragraph (a) would thus read:
Section 455.107.
We received no comments on our proposed revision to Sec.
457.990(a), therefore we are finalizing it as proposed.
3. Miscellaneous Comments
We received the following miscellaneous comments on our affiliation
disclosure proposal. They pertain more to the proposal in general than
to specific provisions in Sec. Sec. 424.519 and 455.107.
Comment: A commenter stated that to ensure that providers and
suppliers have sufficient notice to begin preparing for this new
requirement (for example, to begin acquiring and tracking affiliation
data), CMS should only apply the reporting requirement to existing
affiliations or to those established on or after the implementation
date of the final rule.
Response: We disagree. We believe that any affiliation covered
under Sec. 424.519, including those that existed prior to the rule's
implementation date, should be reported. We must be able to take action
to protect the Medicare program and the Trust Funds against undue
risks.
Comment: A commenter stated that the DMEPOS industry seeks clear
guidance on how different infractions will impact their supplier
number(s). The commenter stated that the rule does not specify how--(1)
each type of reported affiliation will affect impact the enrolling
supplier; and (2) a reported affiliation that results in a revocation
would be applied to other NPIs associated with the enrollee. The
commenter recommended that affiliations be reported based on the NPI.
Response: Denials and revocations pursuant to Sec. 424.519 will be
applied no differently than how other denials and revocations are
currently applied. As for the commenter's recommendation, affiliations
will be reported in accordance with the requirements of this rule
irrespective of the particular NPI enumeration involved.
Comment: A commenter stated that CMS should delay the
implementation of the look-back requirements for at least the length of
the look-back period. This will allow providers and suppliers to
identify all existing affiliations as of the rule's effective date and
monitor them prospectively for disclosable events.
Response: We do not believe that the implementation of Sec.
424.519 should be delayed 5 years. It is important that we be able to
take prompt action to protect Medicare and the Trust Funds against
undue risks.
Comment: Several commenters questioned whether this proposal would
be effective in addressing CMS' program integrity concerns. They
contended that--(1) dishonest providers and suppliers that CMS is
concerned about will not disclose affiliations to CMS, much less to
other providers and suppliers with which it competes; and (2) only
well-intentioned providers and suppliers, who pose little if any risk,
[[Page 47819]]
will report this data yet will ultimately bear the significant
administrative and cost burdens of doing so. In other words, the
commenters stated, honest providers and suppliers, rather than
dishonest ones, would be penalized under this proposal. They added that
the rule as a whole should be geared towards non-compliant providers
and suppliers instead of burdening honest parties.
Response: We recognize that many providers and suppliers have and
have had affiliations that pose little if no risk, and we have taken
steps in this rule to reduce the reporting burden on these parties.
However, dishonest providers and suppliers that deliberately withhold
information must understand that we will, through our examination of
internal data--(1) be able to determine whether such providers and
suppliers have or have had a disclosable affiliation; and (2) take
appropriate administrative action as needed.
Comment: Several commenters stated that the proposal would
effectively require providers and suppliers to become investigative
bodies; that is, they would have to expend considerable resources
(including, perhaps, hiring additional personnel and outside parties)
to investigate other providers and suppliers. Such resources, they
maintained, would be better used towards patient care. Another
commenter stated that CMS should recognize that certain affiliates may
be reluctant for various reasons to furnish data to the provider or
supplier. The commenter added that CMS should avoid imposing
requirements that could place current or former affiliates in untenable
positions or create conflicts of interest.
Response: As stated earlier, we recognize the potential researching
and reporting burden involved and that certain data may be difficult to
obtain. As one step toward reducing said burden, we have removed the
requirement to disclose new or changed affiliations (except as part of
a revalidation). Moreover, CMS will review each affiliation disclosure
situation on its own merits, acknowledging that there may be cases
where a provider or supplier simply cannot secure particular
information even after making a substantial effort to do so. We
anticipate that future subregulatory guidance will address the research
and reporting process for affiliations.
Comment: Several commenters stated that many providers and
suppliers already closely screen their owners, managers, physicians,
health care personnel, etc., before including them within their
organization; this may consist of, for instance, reviews of the
individual's malpractice and medical discipline record via the National
Practitioner Data Bank (NPDB).
Response: We appreciate the efforts of these providers and
suppliers in screening their owners, managers, and personnel. However,
consistent with section 1866(j)(5)(b) of the Act, we believe that CMS
and the states, in consultation with CMS, must be able to make their
own undue risk determinations independent of any internal screening the
provider or supplier undertakes.
Comment: A commenter stated that CMS should rescind the proposed
rule and craft a new rulemaking that is more narrowly focused.
Response: We respectfully disagree that the proposed rule should be
rescinded. We believe that these new disclosure provisions will be
valuable tools in our program integrity efforts, especially with
respect to inter-provider schemes.
Comment: A commenter stated that a disclosable affiliation that
occurred prior to the rule's effective date should not have to be
reported.
Response: We respectfully disagree. We believe that previous
disclosable affiliations, even those ending prior to this final rule
with comment period, can be germane to a determination of whether an
undue risk exists and should be considered, assuming they occurred
within the prior 5 years.
Comment: Several commenters stated that there is no publicly
available federal database that instantly updates all disclosable
events, such as debts and revocations; this could lead to innocent
provider and supplier errors in disclosure or an inability to furnish
certain information, with resulting revocations and appeals. They urged
the establishment of such a database.
Response: We appreciate this comment and may explore means of
increasing the public availability of certain data.
Comment: A commenter asked why the proposed affiliation provision
did not include section 1877 of the Act, which addresses various
financial and ownership relationships.
Response: Our focus in this rule was on addressing the
relationships referenced in section 1866(j)(5) of the Act.
Comment: A commenter questioned--(1) whether CMS and/or its
contractors would review every application in detail; (2) if not, how
they would determine which applications to focus on; and (3) whether
CMS and its contractors actually have enough personnel with sufficient
expertise to review all submitted data and to detect any omissions of
information.
Response: All disclosures will be closely reviewed, and we intend
to have sufficient personnel available to carry out this function. We
may issue subregulatory guidance concerning the process by which undue
risk determinations will be made.
Comment: A commenter indicated that CMS' recent amendment to the
appeals process (via a manual revision) requiring providers and
suppliers to perfect their appeals at the reconsideration level without
the ability to add additional evidence beyond this stage could
negatively impact a provider's or supplier's ability to effectively
appeal a denial or revocation under Sec. 424.519.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter questioned whether any Form CMS-855 changes
resulting from our proposed disclosure requirements would be subject to
public notice and comment prior to finalization.
Response: All Form CMS-855 changes are subject to public notice and
comment under the Paperwork Reduction Act. This will also be the case
with our revisions to the Form CMS-855 to capture affiliation
information.
Comment: A commenter stated that there should be no exemptions for
complete disclosure. The commenter believed that full disclosure would
demonstrate the integrity of the individual who is applying for CMS
enrollment.
Response: Although we appreciate this comment, we have modified
certain aspects of our disclosure requirements to reduce the overall
reporting burden while simultaneously ensuring that we can detect risks
to the Medicare program and the Trust Funds.
Comment: A commenter stated that a revocation resulting in the
maximum reenrollment bar should always be disclosed regardless of age.
For all other actions, however, the commenter contended that ``expanded
documentation'' at CMS should be sufficient for the agency to capture
information on other disclosable events.
Response: We appreciate this suggestion and believe that there
should be no look-back period for disclosable events, including
revocations involving a maximum reenrollment bar. As for internal CMS
documentation, we earlier recognized that CMS may have much of the
required affiliation data in PECOS
[[Page 47820]]
and other systems. Section 1866(j)(5) of the Act, however, is clear
that such information must be furnished upon initial enrollment and
revalidation in a form and manner and at such time as determined by the
Secretary.
Comment: A commenter stated that when a health care organization
(such as a hospital) submits and/or obtains affiliation data on behalf
of a physician it employs, the legal responsibility for this should
shift to the physician, for the hospital is dependent on the physician
to furnish accurate information; in other words, the individual
physician should be held accountable for providing accurate enrollment
information. The commenter further recommended that there be--(1) an
opportunity for the health care entity to work with the physician to
correct the information, and (2) an appeals process for denials.
Response: The provider or supplier is solely responsible for
ensuring the accuracy and completeness of enrollment data it furnishes
to Medicare, Medicaid, or CHIP under parts 424 and 455. It cannot shift
this burden to another party. This is current CMS policy and will
remain so with respect to Sec. 424.519. We also believe that the
provider and supplier should work with the affiliate to confirm the
accuracy of the information prior to submitting it, although the
provider or supplier may appeal any subsequent denial or revocation
under part 498.
Comment: A commenter stated that the proposed rule was an excellent
way to discourage fraud and waste in the health care system through a
stricter Medicare enrollment process. The commenter stated that our
proposals regarding the denial or revocation of enrollment before
making payments could prevent fraudulent activities and abuses from
occurring, which can be more efficient than later tracking down false
claims and fraudulent providers. While expressing support for the rule,
the commenter stated that it--(1) could impose a massive burden on
doctors and providers; and (2) should include clear directions,
guidance, and resources for identifying, evaluating and reporting
partnership histories.
Response: We appreciate this comment, which we believe pertains
largely to our affiliation provisions. We recognize that there may be
operational concerns associated with our affiliation policies, and we
will provide subregulatory guidance to address the matters raised in
the commenter's final sentence.
Comment: A commenter believed that Sec. 424.519 would require a
change to the Disclosure of Ownership and Control Interest forms that
Medicaid Managed Care Organizations (MCO) must send to their providers
through the MCO contracts' flow-through of the federal provision. The
commenter recommended that the proposal be for the proactive collection
of information only during the initial credentialing or re-
credentialing process. The commenter also requested CMS' support in
encouraging states to share their collected information with MCOs, when
applicable.
Response: We will work with the states and MCOs to ensure the
effective implementation of this rule as it pertains to Medicaid.
Comment: A commenter sought clarification regarding--(1) the types
of verifications that would be required when providers disclose
affiliations with organizations other than hospitals and clinics; (2)
how often a provider would be required to notify all of its affiliate
organizations that it has a new interest or ownership in another
Medicare or Medicaid provider or supplier; (3) whether entities would
be required to disclose to other organizations that they do not have
any current CMS sanctions or actions against them; (4) what would
constitute sufficient documentation of the provider's enrollment status
(that is, in ``good-standing'' or not) of an organization or affiliated
entity; and (5) what information, if any, would organizations be
required to provide to each other for purposes of verifying current or
past affiliations to ensure that provider enrollment applications are
completed correctly.
Response: The specific means of securing such data will depend on
the surrounding circumstances, the provider's or supplier's operations,
and the likely number of affiliations to research, although such means
could include reviewing internal records and contacting affiliates.
These are mechanisms that providers and suppliers currently use in
acquiring information about, for instance, indirect owners and
corporate directors.
This rule does not require the regular exchange or updating of
information between providers and suppliers and their affiliates. It
only requires the provider's or supplier's disclosure of data upon
initial enrollment and revalidation.
Comment: A commenter requested that CMS include language in the
final rule (presumably in the regulatory text) to clearly confirm that
providers would not have to report new or changed information regarding
past affiliations except as part of a revalidation application.
Response: As stated earlier, we are removing proposed Sec. Sec.
424.519(h)(1) and (h)(2)(i) and 455.107(h) in this final rule with
comment period.
Comment: A commenter suggested the following alternative to our
disclosure provisions (1) providers and suppliers (and all applicable
owners, partners, officers, directors, and managing employees) must
report whether they have had any disclosable events, though this
disclosure would not extend to other providers and suppliers when an
initial or revalidation application is submitted; (2) CMS and/or the
states would review the information disclosed, confirm its accuracy,
and determine whether it raises an undue risk of fraud, waste, or
abuse--either for the disclosing provider or supplier or any other
provider or supplier with which they may be affiliated; and (3) if an
undue risk is found, CMS could query the disclosing provider or
supplier for additional information about their affiliation
relationships. The commenter stated that this would meet the
requirements of section 1866(j)(5) while eliminating the need for
providers and suppliers to continuously monitor their affiliations and
those of their owners, officers, directors, partners, and managing
employees for potential disclosable events. Another commenter stated
that if CMS determines that a provider or supplier failed to report a
disclosable affiliation, CMS should, before taking any action--(1)
notify the provider or supplier of the disclosable event; and (2) give
it the opportunity to explain the basis for the failure to disclose.
Response: We appreciate these comments. We note that we have
removed proposed Sec. Sec. 424.519(h)(1) and (h)(2)(i) and 455.107(h)
from this final rule with comment period, which we believe will
eliminate much of the burden of regularly tracking and reporting new or
changed information. We disagree, however, with suggestions that we
should never take action prior to querying the provider or supplier
about a detected undue risk or a failure to report a disclosable
affiliation. We believe we must be able to act promptly to protect
Medicare, Medicaid, and CHIP against threats to these programs. We
reiterate, though, that the provider or supplier may appeal any denial
or revocation; moreover, failure to report a disclosable affiliation
will not automatically result in a denial or revocation if, for
instance--(1) the affiliation poses no undue risk; and (2) the failure
to disclose was based on an honest inability to obtain the relevant
information.
[[Page 47821]]
Comment: Several commenters believed that our proposal violates
basic constitutional principles because it implies ``guilt by
association.'' One commenter stated that due process requires that
those accused of a crime have the opportunity to respond to those
allegations before guilt or innocence is pronounced and sanctions are
imposed. The commenter stated that--(1) mere affiliation with those who
have been found guilty of criminal behavior is not enough and that they
themselves must have also been found guilty of such behavior; (2) the
proposed regulation assumes that all individuals or organizations
associated with parties that have violated the law or engaged in
suspicious behavior have themselves also violated the law. Another
commenter contended that CMS is ``punishing'' providers based on the
parties with whom they choose to affiliate yet over whom they have no
control. The commenter stated that it would be impossible for CMS to
ensure that enrollees are accurately reporting their affiliations and
disclosable events, short of ``spying'' on enrollees and tracking their
public accounts; to ensure compliance with this provision, the
commenter continued, CMS would have to employ means that trespass upon
the privacy of providers and suppliers and approach unconstitutional
practices. Other commenters contended that it would be unfair to punish
parties who may have only had marginal relationships with other parties
that have or had disclosable events, with several commenters
questioning the constitutionality of this and the impact on due
process.
Response: We respectfully disagree that our proposal implies guilt
by association. We believe that section 1866(j)(5) of the Act and
Sec. Sec. 424.519 and 455.107 of the regulations are clear that the
core issue is whether the affiliation itself, rather than the enrolling
or enrolled provider or supplier, poses an undue risk of fraud, waste,
or abuse. In other words, these provisions focus on whether certain
relationships present risks; they do not automatically ascribe
nefarious behavior to the provider or supplier. Our recognition that
most affiliations may not pose such risks is reflected in our earlier
statement that we will only take action under Sec. 424.519 or Sec.
455.107 after careful consideration of the facts and circumstances. We
have further acknowledged that some data may be difficult to secure.
Given that we have also taken steps to reduce the reporting burden on
providers and suppliers and that denied or revoked enrollments may be
appealed, we believe that our disclosure provisions contain sufficient
due process and fairness safeguards for providers and suppliers.
Comment: A commenter expressed concern that our proposal could
discourage co-ownership arrangements between health care entities and
providers, which could negatively impact team-based delivery of health
care.
Response: We do not believe our affiliation provisions will
discourage co-ownership arrangements, particularly since we have stated
that the denial, revocation, or termination authority under Sec.
424.519 or Sec. 455.107 will be invoked only after careful
consideration. We also note that providers and suppliers are currently
required to report certain ownership and managerial relationships and
any associated adverse action history.
Comment: A commenter recommended that CMS exempt referral-dependent
specialties from our proposal, stating that such providers would have
to obtain, maintain, and submit information regarding many
relationships. Another commenter suggested that the disclosure
requirements be tailored toward higher-risk provider and supplier
categories, similar to the screening requirements in Sec. 424.518.
Response: We do not believe that certain provider and supplier
types should be automatically exempt from Sec. 424.519. Affiliations
can pose risks regardless of the provider or supplier type involved.
Further, excluding particular provider or supplier types would, in our
view, be inconsistent with the statute, which we interpret as applying
to all providers and suppliers submitting an initial or revalidation
application. As mentioned previously, however, we have revised Sec.
424.519(b) such that we will undertake a ``phased-in'' approach that
initially (though not exclusively or permanently) targets potentially
high risk providers or suppliers, for which CMS believes that at least
one affiliation could apply.
Comment: A commenter expressed concern that--(1) CMS, its
contractors, and Medicaid, and CHIP state programs would apply aspects
of our proposal inconsistently, and (2) the affiliation requirement
would greatly increase the number of applications submitted to these
entities, resulting in processing delays and errors. The commenter
urged CMS to issue clear guidance to all stakeholders regarding the
processing of such applications and how the disclosure and risk factors
would be applied.
Response: CMS and the states will take steps to ensure that undue
risk determinations are made consistently and that sufficient guidance
is disseminated to relevant stakeholders.
Comment: A commenter stated that radiologists are commonly involved
in reassignment agreements involving imaging facilities and referring
providers. The commenter expressed concern that the proposed rule could
cause sweeping changes to these agreements.
Response: We respectfully disagree with this comment, which we
believe pertains to our affiliation provisions. Nothing in this rule
prohibits providers and suppliers from engaging in reassignment
relationships. Insofar as the definition of ``affiliation'' in Sec.
424.502 includes reassignments, we do not believe that the reporting
requirements in revised Sec. 424.519(b) will significantly alter
reassignment relationships. This is particularly true given that CMS
requests for disclosable affiliation data will be made only--(1) upon
initial enrollment and revalidation; and (2) to providers and suppliers
that CMS has determined may have one or more disclosable affiliations.
Comment: A commenter contended that CMS exceeded its statutory
authority under section 1866(j)(5) by proposing to--(1) revoke
providers and suppliers under Sec. 424.519; and (2) require the
submission of new or changed data. Another commenter stated that the
mandate in section 1866(j)(5) was exceeded because the latter only
requires a provider to report an affiliation with a provider that has a
reportable event; that is, the statute only requires that a provider
disclose whether its close affiliates have had a disclosable event.
Response: Concerning revocations, as we stated in the proposed
rule, section 1866(j)(5)(A) of the Act references a revalidation
application, which can only be submitted by an enrolled provider or
supplier. Having the ability to revoke the enrollment of providers or
suppliers with affiliations posing an undue risk is necessary to
protect the integrity of the Medicare program. Thus, we interpret the
statute as applying to both enrolled providers and suppliers and those
applying for enrollment. As for new or changed information, we have
removed proposed Sec. Sec. 424.519(h)(1) and (h)(2)(i) and 455.107(h)
so as to limit the burden on providers and suppliers. Regarding the
suggestion that the statute only requires disclosures with respect to
``close affiliates,'' we note that section 1866(j)(5)(A) of the Act
expressly applies to both direct and
[[Page 47822]]
indirect affiliations. In sum, we believe that Sec. Sec. 424.519 and
455.107 are consistent with section 1866(j)(5) as well as our general
rulemaking authority under sections 1102 and 1871 of the Act.
Comment: A commenter questioned whether a provider that is
revalidating its enrollment in 2017 and has an affiliated provider that
had a 2015 debt that has been repaid would be required to report the
debt, since the affiliation existed within the previous 5 years.
Response: This scenario would not involve a disclosable affiliation
because the debt has been repaid. It is no longer an uncollected debt
for purposes of our affiliation requirements.
Comment: Several commenters stated that CMS should consider the
potential impact that this rule's reporting burden would have on
beneficiary access to care.
Response: We believe that our previously referenced modification to
Sec. 424.519(h) and removal of proposed Sec. 455.107(h) will
alleviate any concerns regarding access to care by limiting the burden
on providers and suppliers, hence allowing more time to treat patients.
Rather than having to regularly track, monitor, and report new and
changed affiliation data, providers and suppliers will only need to
disclose affiliation information in the limited circumstances outlined
in Sec. 424.519(b) or Sec. 455.107(b).
Comment: Several commenters expressed concern that providers and
suppliers may have to establish new employment screening processes to
help identify and determine whether its physicians, managing employees,
etc., may have disclosable affiliations. One commenter questioned
whether providers will be afforded any protection in the reporting
process when such individuals or organizations furnish false or
incomplete representations to the provider. Another commenter stated
the affiliations proposal could negatively impact managers of providers
by effectively requiring them to examine prospective employees well
beyond what normal procedures would mandate.
Response: Our affiliation provisions do not require providers and
suppliers to undertake or increase employment screening practices. Any
decision to do so lies solely within the provider's or supplier's
discretion. The provider or supplier is ultimately responsible for
furnishing accurate information to CMS or the state irrespective of the
source of the data.
Comment: A commenter requested clarification that--(1) disclosures
are only required when submitting an initial or revalidating Form CMS-
855 application; and (2) disclosures are not required when a change of
information or change of ownership is reported on the Form CMS-855.
Response: Disclosures are only required--(1) upon initial
enrollment and revalidation; (2) if Sec. 424.519(b) or Sec.
455.107(b) applies to the provider or supplier; and (3) if CMS or a
state asks the provider or supplier to disclose affiliation
information. Also, for reasons explained previously, we are not
finalizing proposed Sec. Sec. 424.519(h)(1) and (h)(2)(i) and
455.107(h).
Comment: A commenter recommended that emergency physicians be
excluded from our affiliation disclosure provisions. The commenter
stated that many emergency medicine practices are very large with
multiple affiliations, most of which are unbeknown to the individual
emergency physicians on staff. The commenter recommended that if CMS
does not exempt emergency physicians from the affiliation provisions,
CMS should clarify the following issues: (1) Whether an emergency
physician who leaves one emergency medicine practice to join another
such practice is required to know the affiliations of his or her former
employer; (2) if the answer to the first question is yes, how the
physician would learn of the former employer's affiliations in order to
disclose them; (3) what mechanisms exist to require the physician's
former employer to disclose its affiliations to the physician; and (4)
which party--the physician or the new practice he or she is joining--
would be liable if the physician's former employer had affiliations
that were not disclosed and reported on the physician's enrollment
application.
Response: As stated previously, we do not believe certain provider
or supplier types should be automatically and permanently exempt from
Sec. 424.519. Regarding the remaining comments, and as already
explained, it is the provider's or supplier's responsibility to report
all affiliations pursuant to Sec. 424.519(b). We stress, though, that
only the provider's or supplier's affiliations would need to be
disclosed, not the affiliations of an unrelated party.
Comment: A commenter stated that any previous affiliation with a
Medicare, Medicaid, or CHIP provider should be disclosed to CMS for
review and approval. If CMS determines that one of the associated
providers previously committed fraud while employed as a managing
partner, owner, or stakeholder, the provider should not be allowed to
furnish CMS-covered services in the future.
Response: We appreciate this comment and believe that our finalized
affiliation provisions will assist us in protecting Medicare, Medicaid,
and CHIP against the behavior and relationships the commenter
describes.
B. Other Proposed Provisions Affecting the Medicare Program Only
Except as noted otherwise, the legal authorities for our proposed
provisions in section II.B. of this final rule with comment period are
as follows. First, section 1866(j) of the Act states that the Secretary
shall establish by regulation a process for the enrollment of providers
of services and suppliers. Second, sections 1102 and 1871 of the Act
give the Secretary the authority to establish requirements for the
efficient administration of the Medicare program.
1. Revoked Under Different Name, Numerical Identifier, or Business
Identity
We proposed in new Sec. 424.530(a)(12) that CMS may deny a
provider's or supplier's Medicare enrollment application if CMS
determines that the provider or supplier is currently revoked under a
different name, numerical identifier, or business identity, and the
applicable reenrollment bar period has not expired. Likewise, we
proposed in new Sec. 424.535(a)(18) that CMS may revoke a provider's
or supplier's Medicare enrollment if CMS determines that the provider
or supplier is revoked under a different name, numerical identifier, or
business identity.
As discussed in section II.A.1.a. of the proposed rule, we have
identified instances where a provider or supplier has its Medicare
enrollment revoked but tries to evade the revocation and reenrollment
bar by opening a new provider or supplier organization to effectively
``replace'' the revoked entity. In the previously mentioned November
2008 OIG Early Alert Memorandum, the OIG indicated that some providers
and suppliers operate ``fronts,'' whereby associates, family members,
or other individuals pose as owners or managers of the entity on behalf
of the persons who actually operate, run, or profit from the business.
We proposed to add new Sec. Sec. 424.530(a)(12) and 424.535(a)(18) to
address this type of behavior.
In determining whether a provider or supplier is in fact a
currently revoked provider or supplier under a different name,
numerical identifier, or business identity, CMS proposed to investigate
the degree of commonality by considering the following factors:
Owning and managing employees and organizations,
regardless of whether
[[Page 47823]]
they have been disclosed on the Form CMS-855 application (since the
definitions of ``owner'' and ``managing employee'' in Sec. 424.502 do
not require the individual or organization to be listed on the Form
CMS-855 in order to qualify as such).
Geographic location (for example, same city or county).
Provider or supplier type (for example, same provider
type).
Business structure.
Any evidence indicating that the two parties are similar
or that the provider or supplier was created to circumvent the
revocation or the reenrollment bar.
We stated that it should not be assumed that having different
owners, locations, or business structures would automatically result in
a finding that the two are not the same. CMS would consider any
evidence indicating that the entities are effectively identical or that
the new entity was established to avoid the revocation or reenrollment
bar. Thus, even if several factors suggest that the entities may be
distinct, we would reserve the right to apply Sec. 424.530(a)(12) or
Sec. 424.535(a)(18) if we find evidence of evasion.
We further stated that we would invoke the latter two provisions
without requiring a separate finding that the revoked entity, the newly
enrolling entity, or the currently enrolled entity (as applicable)
poses an undue risk of fraud, waste, or abuse. This is because--(1) we
were not relying upon section 1866(j)(5) of the Act as authority for
these two provisions, and (2) we believe that behavior designed to
evade the reenrollment bar poses an inherent risk. We instead relied
upon our general rulemaking authority in sections 1102 and 1871 as well
as section 1866(j) of the Act, which provides specific authority
concerning the enrollment process for providers and suppliers.
We received the following comments regarding our proposal:
Comment: A commenter asked whether--(1) an ``attempt to evade''
standard regarding parties that open a new provider organization to
replace a revoked entity actually applies; or (2) it is automatically
determined that if the two involved businesses meet the ``commonality''
test, the new provider is attempting to evade the revocation or
enrollment bar.
Response: As indicated in the factors listed in Sec. Sec.
424.530(a)(12) and 424.535(a)(18), evidence of deliberate circumvention
will be only one of several criteria we will consider in determining
the degree of commonality. Depending upon the specific facts of the
case, we may still determine that the two parties are sufficiently
similar if the other factors suggest as much.
Comment: A commenter contended that CMS must carefully evaluate
situations where a supplier is reorganizing its business and not
automatically determine that the supplier intends to commit fraud. The
commenter stated that suppliers may add new locations or consolidate
locations to better manage their business.
Response: We agree with the commenter, and in each case we will
review all of the circumstances in determining whether action under
Sec. 424.530(a)(12) or Sec. 424.535(a)(18) is warranted.
After consideration of the comments received, we are finalizing
Sec. 424.530(a)(12) and Sec. 424.535(a)(18) as proposed.
2. Non-Compliant Practice Location
We proposed in new Sec. 424.535(a)(20) that we may revoke a
provider's or supplier's Medicare enrollment--including all of the
provider's or supplier's practice locations, regardless of whether they
are part of the same enrollment--if the provider or supplier billed for
services performed at or items furnished from a location that it knew
or should reasonably have known did not comply with Medicare enrollment
requirements.
As explained in the proposed rule, we have identified examples of
providers and suppliers operating from multiple practice locations
(either as part of the same enrollment or, for DMEPOS suppliers and
independent diagnostic testing facilities (IDTFs), through separately
enrolled locations) of which one or more of the locations does not meet
Medicare enrollment requirements. For instance, a particular location
may not be operational, fails to comply with certain DMEPOS or IDTF
supplier standards, or is otherwise noncompliant. The provider or
supplier, however, continues to perform services at or furnish items
from this location (or claims to do so) when it knows or should know
that the location does not meet Medicare enrollment requirements. We
have seen this with providers and suppliers operating locations that
either do not exist or are false storefronts, meaning that the location
appears legitimate from the outside but is in fact a vacant site or a
nonmedical business.
We have conducted site visits uncovering several similar
situations, and revocations of providers and suppliers locations have
accordingly ensued. Yet we stressed in the proposed rule that more must
be done. Providers and suppliers must realize that if they submit
claims for services or items furnished at or from non-compliant
locations, they risk not only the revocation of that site but also of
their other locations. As an illustration, assume that a DMEPOS
supplier has four separately enrolled locations. The supplier shifts
one of its locations without notifying Medicare, and the new site is a
false storefront. The supplier furnishes no items from this location,
but it submits bills for DME allegedly provided from the site. Under
our proposal, CMS could revoke this location as well as the three other
sites. Even if the other sites had different numerical identifiers,
legal business names, or ownership, we could take action against them
if there is evidence to suggest that they are effectively under the
control of similar parties. This is to ensure that providers and
suppliers do not attempt to circumvent Sec. 424.535(a)(20) by opening
locations under different identities or with different ``front men''
(such as family members).
We proposed to consider the following factors when determining
whether and how many of the provider's or supplier's other locations
should be revoked:
The reason(s) for and facts behind the location's non-
compliance (for example, false storefront; otherwise non-operational;
other violation of supplier standards).
The number of additional locations involved.
Whether the provider or supplier has any history of final
adverse actions (as that term is defined in Sec. 424.502) or Medicare
or Medicaid payment suspensions.
The degree of risk that the location's continuance poses
to the Medicare Trust Funds (specifically, the other location(s),
rather than the non-compliant location).
The length of time that the non-compliant location was
non-compliant.
The amount that was billed for services performed at or
items furnished from the non-compliant location.
Any other evidence that we deem relevant to our
determination.
We received the following comments regarding this proposal:
Comment: Several commenters stated that CMS already has the
authority to revoke enrollment based on the grounds indicated in
proposed Sec. 424.535(a)(20). The commenters contended that CMS should
rely upon existing protocols (such as fines, recoupments, and
revocations) rather than create new revocation mechanisms.
[[Page 47824]]
Response: The circumstances addressed in Sec. 424.535(a)(20) go
beyond the mere non-compliance of a single practice location or single
Medicare enrollment. For instance, suppose a provider has four practice
locations (A, B, C, and D) under four separate enrollments. The
provider knows that Location D is non-compliant yet bills for services
performed there. While Sec. 424.535(a)(5) permits the revocation of
the enrollment associated with Location D, it does not explicitly
address the potential revocation of the provider's other three
enrollments associated with Locations A, B, or C, respectively.
However, Sec. 424.535(a)(20) will emphasize that the provider and all
of its locations can be revoked (in other words, all of the enrollments
associated with the practice locations). In short, we do not believe
our existing regulations sufficiently address this type of arrangement
and that additional clarification is needed.
Comment: Several commenters expressed concern about CMS' proposed
ability under Sec. 424.535(a)(20) to revoke the provider's other
locations if there is evidence to suggest that they are effectively
under the control of similar parties. Two of the commenters stated that
this disregards corporate formalities without evidence of wrongdoing by
the providers. Two other commenters suggested that CMS apply the
proposed undue risk standard in determining whether other locations
should be revoked under Sec. 424.535(a)(20).
Response: We do not believe a provider should be able to avoid the
revocation of its other locations under Sec. 424.535(a)(20) simply
because they are, for instance, under different tax identification
numbers. CMS must be able to take action against the provider's other
or associated locations if truly warranted under the circumstances in
order to protect the Medicare program. We emphasize, however, that CMS
will carefully consider the factors outlined in Sec. 424.535(a)(20) in
determining whether and/or which other locations should be terminated.
As previously described, this will include reviewing the degree of risk
that a particular location's continuance poses to the Trust Funds.
Comment: A few commenters stated that Sec. 424.535(a)(20)'s
application should be restricted to cases where the provider has actual
knowledge of non-compliance or, one of the commenters stated,
demonstrated gross negligence in failing to monitor the location.
Response: Providers are responsible for closely monitoring and
ensuring the compliance of all of their locations at all times.
Establishing an ``actual knowledge'' or ``gross negligence'' standard
would, in our view, effectively permit providers to avoid this
responsibility and the potential application of Sec. 424.535(a)(20).
Comment: Opposing the proposal as written, a commenter stated that
the proposed regulatory text did not include language from the preamble
regarding CMS' intent on stopping providers and suppliers from
knowingly operating fictitious or otherwise non-compliant locations to
circumvent CMS policies. The commenter added that a revocation could
become a permanent blemish (and potentially render an affected
practitioner virtually unemployable). The commenter recommended that
CMS revise the regulatory text to limit the authority to revoke
multiple locations to egregious, fraudulent transgressions.
Response: We do not believe that language such as ``egregious,
fraudulent transgressions'' is appropriate for regulatory text.
However, we reiterate that this provision will be applied in cases
where the maintenance of the provider's or supplier's other enrollments
would jeopardize the Medicare Trust Funds.
Comment: A commenter stated that CMS currently may revoke Medicare
enrollment under Sec. 424.535(a)(1) if the provider is determined to
not be in compliance with the enrollment requirements applicable for
its provider or supplier type, and has not submitted a plan of
corrective action as outlined in part 488 of this chapter. The
commenter stated that by adding more revocation authorities, CMS seeks
to circumvent the existing regulatory scheme, which permits providers
to submit a plan of correction for violations of Medicare requirements.
Response: The addition of Sec. 424.535(a)(20) and other revocation
reasons in the rule are not intended to circumvent part 488. Nothing in
Sec. 424.535(a) prohibits a certified provider or certified supplier
from submitting a part 488 plan of correction under the provisions of
that part. This does not mean, however, that we cannot take revocation
action even if such plan is submitted (except as stated in Sec.
424.535(a)(1)). Moreover, providers and suppliers are ensured due
process through their right to appeal any revocation under part 498.
Comment: A commenter stated that CMS should clarify that it can
only take action against different legal entities under paragraph
(a)(20) if it determines that the sites are exercising a circumvention
scheme.
Response: We respectfully disagree because Sec. 424.535(a)(20) is
not primarily focused on the issue of schemes designed to circumvent
revocations and reenrollment bars. Rather, Sec. 424.535(a)(20)
concerns billing for services furnished at or from a non-compliant
location and whether any of the provider's other locations should be
revoked as a result.
Comment: While stating that the proposed factors are reasonable
considerations, a commenter expressed concern about the possible
revocation of many or all of a provider's practice locations for minor
technical instances of non-compliance in a single location. The
commenter urged CMS to include in the regulatory text the language from
the proposed rule's preamble indicating that this provision is designed
primarily to stop providers and suppliers that knowingly operate
fictitious or otherwise non-compliant locations in order to circumvent
CMS policies.
Response: Language that outlines the underlying purpose of (or
rationale for) a particular regulatory provision is generally not
included in regulatory text; the latter is typically limited to
outlining specific requirements or standards. We thus respectfully
decline to insert the commenter's requested verbiage. Regardless, we
note again that this provision concerns billing for services furnished
at or from a non-compliant location and whether any of the provider's
other locations should be revoked as a result.
After consideration of the comments received, we are finalizing
Sec. 424.535(a)(20) as proposed, with the exception of modifying the
first two sentences of the paragraph. We believe it is necessary to
clarify that a revocation occurs at the enrollment level, rather than
the practice location level. We are concerned that paragraph (a)(20),
as currently written, could be construed as indicating that practice
locations themselves can be revoked. Accordingly, the first two
sentences of paragraph (a)(20) will be slightly revised to read as set
out in the regulatory text.
3. Improper Ordering, Certifying, Referring, or Prescribing of Part A
or B Services, Items, or Drugs
In a final rule published in the Federal Register on December 5,
2014 titled ``Medicare Program; Requirements for the Medicare Incentive
Reward Program and Provider Enrollment'' (72 FR 72499), we finalized
Sec. 424.535(a)(8)(ii). Under this provision, CMS may revoke a
provider's or supplier's Medicare billing privileges if the provider or
supplier has a pattern or practice of submitting claims that fail to
meet Medicare requirements such as, but not limited to, the requirement
that the service be reasonable and necessary.
[[Page 47825]]
The provision is intended to place providers and suppliers on notice
that they have a legal obligation to submit correct and accurate
claims; the provider's or supplier's repeated failure to do so, we
concluded, poses a risk to the Medicare Trust Funds.
We also published a final rule in the Federal Register (79 FR
29843) on May 23, 2014, titled ``Medicare Program; Contract Year 2015
Policy and Technical Changes to the Medicare Advantage and the Medicare
Prescription Drug Benefit Programs.'' Under Sec. 424.535(a)(14), which
was finalized in that rule, we may revoke a physician's or eligible
professional's Medicare billing and prescribing privileges if we
determine that he or she has a pattern or practice of prescribing Part
D drugs that fall into one of the following categories:
The pattern or practice is abusive, represents a threat to
the health and safety of Medicare beneficiaries, or both.
The pattern or practice of prescribing fails to meet
Medicare requirements.
In the January 10, 2014 proposed rule (79 FR 1917), which resulted
in the aforementioned May 23, 2014 final rule, we expressed our view
that the concept behind proposed Sec. 424.535(a)(8)(ii) should extend
to revoking Medicare enrollment for Part D prescribers who engage in
abusive prescribing practices. We explained that if a physician or
eligible professional consistently fails to exercise reasonable
judgment in his or her prescribing practices, we should be able to
remove such individuals from the Medicare program in order to protect
beneficiaries' safety and health, as well as the Medicare Trust Funds.
Notwithstanding these new safeguards, neither Sec. 424.535(a)(14)
nor Sec. 424.535(a)(8)(ii) address the improper ordering or certifying
of Medicare services and items or the prescribing of Part B drugs. We
have received numerous reports of physicians and eligible professionals
engaging in abusive or otherwise inappropriate ordering. While the
particular circumstances of each case have varied, they frequently fall
within one or more of the following categories--(1) the ordered item or
service was not reasonable, not necessary, or both; or (2) the
physician or eligible professional misrepresented his or her diagnosis
to justify the service or test.
Such behavior increases the risk of improper payment for
inappropriate items or services or Part B drugs. It also endangers
Medicare beneficiaries by unnecessarily exposing them to potentially
harmful services and tests. As with the threats that abusive
prescribing and billing pose, we believe that the risks of improper
ordering, certifying, and referring, as well as the prescribing of Part
B drugs, must be stemmed in order to protect the Medicare program.
Accordingly, we proposed in new Sec. 424.535(a)(21) that CMS may
revoke a physician's or eligible professional's Medicare enrollment (as
the term ``enrollment'' is defined in Sec. 424.502) if he or she has a
pattern or practice of ordering, certifying, referring, or prescribing
Medicare Part A or B services, items or drugs that is abusive,
represents a threat to the health and safety of Medicare beneficiaries,
or otherwise fails to meet Medicare requirements. Recognizing that not
all patterns or practices involve inappropriate behavior, we stated in
the proposed rule that we would consider the following factors in
determining whether a pattern or practice of improper ordering,
certifying, referring, or Part B drug prescribing exists:
Whether the physician's or eligible professional's
diagnoses support the orders, certifications, referrals, or
prescriptions in question.
Whether there are instances where the necessary evaluation
of the patient for whom the service, item, or drug was ordered,
certified, referred, or prescribed could not have occurred (for
example, the patient was deceased or out of state at the time of the
alleged office visit).
The number and type(s) of disciplinary actions taken
against the physician or eligible professional by the licensing body or
medical board for the state or states in which he or she practices, and
the reason(s) for the action(s).
Whether the physician or eligible professional has any
history of final adverse actions (as that term is defined in Sec.
424.502).
The length of time over which the pattern or practice has
continued.
How long the physician or eligible professional has been
enrolled in Medicare.
The number and type(s) of malpractice suits that have been
filed against the physician or eligible professional related to
ordering, certifying, referring, or prescribing that have resulted in a
final judgment against the physician or eligible professional or in
which the physician or eligible professional has paid a settlement to
the plaintiff(s) (to the extent this can be determined).
Whether any state Medicaid program or any other public or
private health insurance program has restricted, suspended, revoked, or
terminated the physician's or eligible professional's ability to
practice medicine, and the reason(s) for any such restriction,
suspension, revocation, or termination.
Any other information that we deem relevant to our
determination.
We received the following comments regarding our proposal:
Comment: A commenter expressed support for our proposed addition of
Sec. 424.535(a)(21).
Response: We appreciate the commenter's support.
Comment: A commenter opposed our proposal, stating that it--(1)
duplicates current safety mechanisms; (2) interferes with the long
history of states regulating the licensure process; and (3) adds
another layer of bureaucracy and administrative costs to the program.
The commenter added that CMS is inappropriately suggesting that a
medical liability lawsuit is somehow equivalent to liability without
regard for the lawsuit's outcome. The commenter stated that--(1) there
are many ways in which physicians could be named in a medical liability
suit, regardless of whether there is any evidence of negligence; and
(2) many liability insurers settle cases with little to no merit.
Response: We respectfully disagree with the commenter's
contentions. First, Sec. 424.535(a)(21) does not duplicate any
existing Medicare safety mechanisms. Unlike with abusive billing (Sec.
424.535(a)(8)(ii)) and abusive prescribing of Part D drugs (Sec.
424.535(a)(14)), we currently lack the authority to take enrollment
action against patterns or practices of abusive ordering or certifying
of Medicare items and services or Part B drugs. This is behavior we
have seen and against which we must protect the Medicare program.
Second, we recognize the role of state medical boards in monitoring the
practice of medicine. Such bodies, however, operate independently of
CMS. They play no role in overseeing the Medicare program, a
responsibility that rests with CMS. As such, we must be able to rapidly
take protective measures without having to wait for possible action by
state licensing boards or other bodies.
We do not believe this provision adds layers of bureaucracy. It is
simply a further regulatory protection for the Medicare program.
Concerning medical liability lawsuits, we currently consider this
criterion in determining whether a revocation under Sec.
424.535(a)(14) is warranted, and we are duplicating this factor in
Sec. 424.535(a)(21). We emphasize, however, that it is only one of
several factors we will consider in
[[Page 47826]]
our determination; it is not alone dispositive.
After consideration of the comments received, we are finalizing
Sec. 424.535(a)(21) as proposed.
4. Reenrollment and Reapplication Bar Period
a. Reenrollment Bar
Under Sec. 424.535(c), if a provider, supplier, owner, or managing
employee has their billing privileges revoked, they are barred from
participating in Medicare from the date of the revocation until the end
of the reenrollment bar. The reenrollment bar begins 30 days after CMS
or its contractor mails notice of the revocation. It lasts a minimum of
1 year, but not greater than 3 years, depending on the severity of the
basis for revocation.
We proposed the following changes to Sec. 424.535(c):
First, we proposed to incorporate the existing version of Sec.
424.535(c) into a new paragraph (c)(1) that would increase the current
maximum reenrollment bar from 3 years to 10 years (excluding the
situations described in new paragraphs (c)(2) and (3), discussed later
in this section of this final rule with comment period). We stated in
the proposed rule that it would be reasonable in certain cases to
prevent a provider or supplier from participating in Medicare for
longer than 3 years. Indeed, certain behavior could prove so harmful to
Medicare, its beneficiaries, and/or the Trust Funds that a very lengthy
bar from Medicare is warranted. We believed that a 10-year maximum
timeframe is appropriate, both to--(1) ensure that providers and
suppliers engaging in such activities are kept out of Medicare; and (2)
deter others from potentially duplicating this behavior. We chose 10
years because there is precedent for this period; under Sec.
424.535(a)(3)(iii), it constitutes the minimum revocation timeframe for
providers that have been convicted of multiple felonies. However, we
did not expect to impose longer reenrollment bars for certain existing
revocation reasons. Revocations that currently involve only a 1-year
reenrollment bar, for instance, would not necessarily result in a
longer period under new Sec. 424.535(c)(1).
Second, we proposed in new Sec. 424.535(c)(2) that CMS may add up
to 3 more years to the provider's or supplier's reenrollment bar (even
if such period exceeds the maximum otherwise allowable under paragraph
(c)(1)) if CMS determines that the provider or supplier is attempting
to circumvent its existing reenrollment bar by enrolling in Medicare
under a different name, numerical identifier, or business identity. We
stated that such efforts to avoid Medicare rules warrant the provider's
or supplier's Medicare revocation being for a longer timeframe than was
originally imposed.
We noted that the affected provider or supplier could appeal CMS'
imposition of additional years to the provider's or supplier's existing
reenrollment bar under Sec. 424.535(c)(2). These appeal rights would
be governed by 42 CFR part 498. However, they would not extend to the
imposition of the original reenrollment bar under Sec. 424.535(c)(1);
they would be limited to the additional years imposed under Sec.
424.535(c)(2).
Third, we proposed in new Sec. 424.535(c)(3) that CMS may impose a
reenrollment bar of up to 20 years if the provider or supplier is being
revoked from Medicare for the second time. Multiple revocations
indicate that the provider or supplier cannot be considered a reliable
partner of the Medicare program. The reenrollment bar under paragraph
(c)(3) would be in lieu of the reenrollment bar described in paragraph
(c)(1). We proposed to determine the bar's length by considering the
following factors--(1) the reasons for the revocations; (2) the length
of time between the revocations; (3) whether the provider or supplier
has any history of final adverse actions (other than Medicare
revocations) or Medicare or Medicaid payment suspensions; and (4) any
other information that CMS deems relevant to its determination. In
addition, we proposed to apply paragraph (c)(3) even if the two
revocations occurred under different names, numerical identifiers, or
business identities so long as we can determine that the two actions
effectively involved the same provider or supplier.
Fourth, we proposed in new Sec. 424.535(c)(4) that a reenrollment
bar would apply to a provider or supplier under any of its current,
former, or future business names, numerical identifiers, or business
identities. We explained that this would help ensure that revoked
providers and suppliers do not attempt to circumvent a revocation and
reenrollment bar by changing their name, identity, business structure,
etc.
We emphasized in the proposed rule that our sole objective was to
make certain that unscrupulous providers and suppliers are kept out of
Medicare for as long as possible.
b. Reapplication Bar
We also proposed in new Sec. 424.530(f) that CMS may prohibit a
prospective provider or supplier from enrolling in Medicare for up to 3
years if its enrollment application is denied because the provider or
supplier submitted false or misleading information on or with (or
omitted information from) its application in order to gain enrollment
in Medicare. This reapplication bar would apply to the individual or
organization under any current, former, or future name, numerical
identifier, or business identity.
The purpose of this proposal was to keep untrustworthy providers
and suppliers from entering the Medicare program and to forestall
future efforts to enroll. We explained that the submission of false
information or the withholding of information relevant to the
provider's or supplier's enrollment eligibility represents a
significant program integrity risk. For this reason, and to provide
consequences for such behavior, we stated that our proposed
reapplication bar was warranted. When determining the reapplication
bar's length, we proposed to consider the following factors--(1) the
materiality of the information in question; (2) whether there is
evidence to suggest that the provider or supplier purposely furnished
false or misleading information or deliberately withheld information;
(3) whether the provider or supplier has any history of final adverse
actions or Medicare or Medicaid payment suspensions; and (4) any other
information that we deem relevant to our determination.
c. Comments Received
We received the following comments regarding our reenrollment bar
and reapplication bar proposals:
Comment: A number of commenters opposed our proposed--(1) expansion
of the maximum reenrollment bar from 3 years to 10 years; and (2)
establishment of a maximum reenrollment bar of 20 years for a second
revocation. They believed the proposed bars were excessive and overly
punitive. Several of them urged CMS to retain the existing 3-year
reenrollment bar.
Response: As explained in the proposed rule, we believe it is
reasonable in certain cases to prevent a provider or supplier from
participating in Medicare for longer than 3 years. Certain behavior
could prove so harmful to Medicare, its beneficiaries, and/or the Trust
Funds that a longer bar from Medicare is justified. Again, we believe
that the 10-year and 20-year maximum periods are appropriate to--(1)
make sure that abusive parties are kept out of Medicare; and (2) deter
others from mirroring such behavior. We emphasize, though, that 10-year
and 20-year bars (as
[[Page 47827]]
well as other longer bars) will typically be reserved for more serious
conduct and not be imposed unless determined to be warranted after
careful consideration of all of the required factors.
With respect to the maximum 20-year bar for individuals or entities
that have been revoked a second time, CMS believes that the standard
appeals process at Part 498 should allow for the resolution of
``mistaken identity'' cases regarding the first revocation. In other
words, if a provider or supplier to which CMS applies Sec.
424.535(c)(3) correctly claims on appeal that a different individual or
entity was, in fact, the subject of the first revocation, CMS will be
able modify the re-enrollment bar length such that it only applies to
the second revocation, pursuant to Sec. 424.535(c)(1). As explained
below, we are modifying Sec. 498.3(b)(17) to afford appeal rights in
this scenario.
Comment: A commenter stated that the proposed rule does not clarify
the lengths of the reenrollment bars that will be applied to different
offenses, meaning that reenrollment bars would be determined
arbitrarily. The commenter, as well as others, urged CMS to provide
guidelines as to what offenses would merit bans of certain time
periods. They added that said guidance should be narrowly defined to
target egregious cases and hold harmless reputable providers.
Response: We respectfully decline to specify in regulation the
precise reenrollment bar lengths that will be imposed for particular
acts. Each case could vary widely, and we must continue to have the
discretion and flexibility to (consistent with current practice)
consider all relevant facts, including circumstances that mitigate
against a longer reenrollment bar.
Comment: A commenter suggested--(1) a maximum reenrollment bar of 5
years instead of 10 years; and (2) a bar for a second revocation of 10
years rather than 20. Another commenter urged a maximum reenrollment
bar of 6 years with exceptions.
Response: We appreciate these recommendations. As indicated
earlier, we believe that the seriousness of certain conduct warrants a
longer maximum re-enrollment bar. A 5-year or 6-year bar may be
insufficient to protect the Medicare program in some instances. We
believe that our 10-year and 20-year maximum bars enable us to address
various factual situations, including particularly improper or
fraudulent behavior.
Comment: Some commenters supported our proposed reenrollment bar
provisions in Sec. 424.535(c).
Response: We appreciate the commenters' support.
Comment: A commenter contended that barring a provider for 10 years
would only be justified in extreme cases of fraud. Another commenter
stated that any reenrollment bar should only be imposed when there--(1)
is sufficient evidence that serves a program integrity goal; and (2)
are robust due process and appeal rights for the affected provider or
supplier.
Response: While we respectfully disagree that a 10-year bar should
only be warranted in extreme instances of fraud, 10-year timeframes
will generally be restricted to serious behavior. Concerning the second
commenter, we believe that every reenrollment bar aids our program
integrity objectives by prohibiting revoked parties from effectively
circumventing the revocation by immediately submitting an application
to reenroll. We note also that providers and suppliers may appeal a
revocation under Sec. 498.3, thus ensuring due process.
Comment: A commenter cited CMS's statement in the proposed rule's
preamble concerning precedent for the 10-year reenrollment bar in
existing Sec. 424.535(a)(3)(ii) (specifically, a 10-year bar for
multiple felony convictions). The commenter stated that felony
convictions involve substantially more due process than the largely
administrative adjudications addressed under Sec. 424.535(c). The
commenter contended that Sec. 424.535(a)(3)(ii) is not a precedent for
the proposed reenrollment bar. Rather, it is a cautionary note about
the degree of due process that should be afforded to providers before
such a lengthy ban is imposed. The commenter added that CMS' assurance
that longer bars would only apply to egregious cases is an inadequate
substitute for a finding of criminal guilt beyond a reasonable doubt by
a court of law. Another commenter stated that under 48 CFR 9.406-4, the
period of debarment for a government contractor generally should not
exceed 3 years unless there is a violation of the Drug-Free Workplace
Act of 1988; even in the latter situation, the debarment may not exceed
5 years.
Response: The reference to Sec. 424.535(a)(3)(ii) was strictly
intended to demonstrate a precedent for a 10-year timeframe, not to
equate felony convictions with all other actions covered under Sec.
424.535(a). Regardless, we note that serious misconduct can occur
without a criminal conviction. In fact, many of our revocation reasons
in Sec. 424.535(a) neither involve criminal behavior nor require a
judgment of guilt. We reiterate our view that an extended reenrollment
bar (that is, longer than 3 years) may sometimes be warranted,
depending upon the facts, circumstances, and scope of the provider's or
supplier's conduct. Moreover, we--(1) do not believe that significantly
longer bars should be restricted to felony convictions; and (2) are not
bound by 48 CFR 9.406-4 and have the discretion to establish a
reenrollment bar specific to Medicare.
Comment: A commenter stated that expanding the reenrollment bar
beyond 3 years may be appropriate under certain limited circumstances
for program integrity reasons. However, the commenter was concerned
about the reenrollment bar's application to any current, former or
future business names, identifiers or business identities. The
commenter stated that this could lead to an overly broad application to
well-intentioned and compliant providers and suppliers. The commenter
urged that CMS--(1) not impose a reenrollment bar across multiple
providers or suppliers that may be affiliated with a provider or
supplier, but which had no knowledge of the behavior leading to the
bar; and (2) allow flexibility in extenuating circumstances that
appropriately balances program integrity risk with community need.
Response: Section 424.535(c)(4) is designed to prevent situations
where a provider or supplier is revoked and under a reenrollment bar,
and then changes its name to circumvent both sanctions. In cases where,
for instance, a provider or supplier is revoked based on an affiliation
with another revoked provider or supplier, each revocation is treated
separately. Both revoked providers, moreover, should be subject to a
reenrollment bar to prevent an immediate reenrollment and consequent
circumvention of their revocation, though it should not be assumed that
both bars will be the same length. We will carefully review the
circumstances of each revocation on its own merits and facts in
determining the appropriate bar for that provider; as the commenter
suggests in its second comment, we will balance various considerations
in establishing bars.
Comment: A commenter opposed the extension of the maximum re-
enrollment bar if the affiliation disclosure provisions are finalized.
The commenter stated that a 10-year reenrollment bar is too drastic
given the extreme difficulty of complying with the reporting
requirements in certain circumstances.
[[Page 47828]]
Response: We have stated in this final rule with comment period our
rationale for the 10- and 20-year reenrollment bars. We will make
certain, however, that the length of the imposed re-enrollment bar is
proper for the behavior involved by considering all relevant facts and
circumstances.
Comment: A commenter recommended that CMS establish a specific
reenrollment bar for each revocation reason. Citing examples, the
commenter stated that if a site survey found the supplier to be non-
compliant and the supplier is appealing the revocation, 3 or 5 years
would be an appropriate period; if an owner of the supplier is found
guilty of a felony, the commenter stated, a 10-year period would be
more appropriate.
Response: We appreciate the commenter's suggestions and examples.
As previously stated, however, each case may differ widely. We must
have the flexibility to consider every situation on its own merits
rather than be compelled to impose certain reenrollment bar lengths for
particular actions.
Comment: Several commenters stated that--(1) a 3-year reenrollment
or reapplication bar is adequate only in egregious cases of intentional
fraud, submission of false claims, or other instances that CMS
specifically identifies; (2) any bar should be removed or shortened if
the provider eliminates its affiliation with an organization or
individual that had a disclosable event; and (3) CMS should only bar
reenrollment and reapplication if a provider's actions or omissions
were intentional and material.
Response: We respectfully disagree with the commenters' first and
third contentions regarding reenrollment bars. A 3-year reenrollment
bar for the conduct described may often be too short. Such providers
and suppliers should not be permitted to reenter Medicare to
potentially repeat their behavior after such a comparatively brief
timeframe; the Medicare Trust Funds and Medicare beneficiaries must be
protected for as long as possible. Further, as already mentioned, any
failure to impose a reenrollment bar for a revocation would undercut
the latter action since the provider could otherwise immediately
resubmit an application for reenrollment. As for the second contention,
we note that a provider or supplier under Sec. 424.535(e) may avoid a
revocation and associated reenrollment bar if it terminates (and
submits proof that it has terminated) its business relationship with
the applicable party within 30 days of the revocation notification. If
said affiliation relationship does not fall within the confines of
Sec. 424.535(e), CMS considers the scope of the relationship in
determining whether an undue risk exists under Sec. 424.519(f) and, by
extension, the appropriate length of any reenrollment bar.
Regarding the reapplication bar, evidence of intent and the
information's materiality are factors that we will consider in our
determination. Certainly, evidence of purposeful falsification of
crucial data will warrant a longer reapplication bar. Given the various
factual scenarios that could arise and the need for flexibility in our
determinations, however, we believe it is imprudent to explicitly
require evidence of intent and materiality before a bar is imposed.
After consideration of the comments received, we are finalizing our
proposed reenrollment bar and reapplication bar provisions. However, we
believe that two minor technical edits to Sec. Sec. 405.800 and
498.3(b)(17) are necessary to ensure that appeal rights are available
under Part 498 regarding additional years applied under Sec.
424.535(c)(2)(i) to any existing reenrollment bar.
First, we are adding a new paragraph (c) to Sec. 405.800 that
discusses notification to the provider or supplier of additional years
applied to a provider's or supplier's existing reenrollment bar under
Sec. 424.535(c)(2)(i). Said notice per Sec. 405.800(c)(1) will
include the following:
The reason for the application of additional years in
sufficient detail to allow the provider or supplier to understand the
nature of the action.
The right to appeal in accordance with part 498 of this
chapter.
The address to which the written appeal must be mailed.
In Sec. 405.800(c)(2), we specify that paragraph (c)(1) applies
only to the years added to the existing reenrollment bar under Sec.
424.535(c)(2)(i) and not to the original length of the reenrollment
bar, which is not subject to appeal.
The language concerning written notice and the contents thereof is
consistent with that used in Sec. 405.800(a) and (b) regarding denials
and revocations of enrollment. It is designed to ensure that the
provider or supplier receives sufficient information regarding the
action taken. Paragraph (c)(2) is necessary to clarify that the
original length of the reenrollment bar is not appealable.
Second, Sec. 498.3(b) outlines matters on which CMS makes initial
determinations. Paragraph (b)(17) lists among them the determination as
to whether to deny or revoke a provider or supplier's Medicare
enrollment in accordance with Sec. 424.530 or Sec. 424.535. To
clarify the availability of appeal rights, we are reorganizing and
revising paragraph (b)(17) as follows:
The existing version of paragraph (b)(17) will be
redesignated as paragraph (b)(17)(i).
New paragraph (b)(17)(ii) will state: ``Whether, under
Sec. 424.535(c)(2)(i) of this chapter, to add years to a provider's or
supplier's existing reenrollment bar;''
New paragraph (b)(17)(iii) will state: ``Whether, under
Sec. 424.535(c)(3) of this chapter, an individual or entity other than
the provider or supplier that is the subject of the second revocation
was the actual subject of the first revocation.''
5. Referral of Debt to the United States Department of Treasury
The Debt Collection Improvement Act of 1996 requires federal
agencies to refer eligible delinquent debt to the United States
Department of Treasury-designated Debt Collection Center (DCC) for
cross-servicing and offset. CMS must refer all eligible debt over 120
days delinquent for cross-servicing and offset. Prior to sending a debt
to the Department of Treasury, CMS attempts to recoup it via the
procedures outlined in CMS Publication 100-06, chapter 4. Generally
speaking, we refer a debt to the Department of Treasury only if we
cannot fully recover the debt through our existing procedures. In all
cases, though, a provider or supplier is given adequate opportunity to
repay the debt or make arrangements to do so (for example, if eligible
for an extended repayment plan) before the debt is sent to the
Department of Treasury.
We stated in the proposed rule that referral to the Department of
Treasury may indicate the provider's or supplier's unwillingness to
repay a debt, which brings into doubt whether the provider or supplier
can be a reliable partner of the Medicare program. Accordingly, we
proposed in new Sec. 424.535(a)(17) that CMS may revoke a provider's
or supplier's Medicare enrollment if the provider or supplier has an
existing debt that CMS refers to the Department of Treasury. In
determining whether a revocation is appropriate, we proposed to
consider the following factors:
The reason(s) for the failure to fully repay the debt (to
the extent this can be determined).
Whether the provider or supplier has attempted to repay
the debt.
Whether the provider or supplier has responded to our
request(s) for payment.
Whether the provider or supplier has any history of final
adverse actions
[[Page 47829]]
or Medicare or Medicaid payment suspensions.
The amount of the debt.
Any other information that we deem relevant to our
determination.
We received the following comments regarding this proposal:
Comment: A commenter requested that CMS eliminate proposed Sec.
424.535(a)(17) from the final rule.
Response: We respectfully disagree. We believe that this provision
is based upon sound fiscal policy and will help ensure that providers
and suppliers repay their debts to the Medicare program.
Comment: A commenter stated that there have been instances where a
referral of a debt to Treasury occurred--(1) when the debt has been or
was in the process of repayment through an agreed-upon repayment plan;
or (2) regarding an individual when a corporate debt had not been
timely repaid. The commenter requested that CMS clarify when the
Treasury referral applies to the enrollment determination and to
identify the remedy for erroneous referrals.
Response: We appreciate this comment. If a provider's or supplier's
debt is referred to the Department of Treasury, we may invoke Sec.
424.535(a)(17) after a careful consideration of the factors stated
therein. The provider or supplier may appeal the revocation under part
498. CMS recognizes, however, that some debts could indeed, as the
commenter suggests, be referred to Treasury incorrectly. We are
therefore adding the word ``appropriately'' before ``refers'' in Sec.
424.535(a)(17). This will clarify that only debts that have been
referred to Treasury correctly will constitute a ground for revocation
under Sec. 424.535(a)(17).
After consideration of the comments received, we are finalizing
Sec. 424.535(a)(17) as proposed with two exceptions. First, as just
explained, we are adding the word ``appropriately'' before ``refers''.
Second, we are adding the language ``(to the extent this can be
determined)'' to the end of the factors enumerated in Sec.
424.535(a)(17)(ii) (concerning attempts to repay) and (iii) (regarding
responses to request for repayment). This is to account for the
possibility that it may occasionally prove difficult to ascertain and
acquire this information.
6. Failure to Report
Existing Sec. 424.535(a)(9) permits CMS to revoke the Medicare
enrollment of a physician, non-physician practitioner, physician group,
or non-physician practitioner group if the supplier fails to comply
with Sec. 424.516(d)(1)(ii) or (iii), which requires the supplier to
report a change in its practice location or final adverse action status
within 30 days of the change.
We proposed to expand Sec. 424.535(a)(9) in two ways. First, we
proposed that CMS may apply Sec. 424.535(a)(9) to all of the reporting
requirements in Sec. 424.516(d), not merely those in Sec.
424.516(d)(1)(ii) and (iii). We could thus revoke the Medicare
enrollment of a physician, non-physician practitioner, physician group,
or non-physician practitioner group if the supplier fails to report
either of the following:
A change of ownership, final adverse action, or practice
location within 30 days of the change (as required under Sec.
424.516(d)(1)(i), (ii), and (iii), respectively).
Any other change in enrollment data within 90 days of the
change (as required under Sec. 424.516(d)(2)).
Second, we proposed that CMS may apply Sec. 424.535(a)(9) to the
reporting requirements in Sec. 410.33(g)(2) (pertaining to IDTFs),
Sec. 424.57(c)(2) (pertaining to DMEPOS suppliers), and Sec.
424.516(e) (pertaining to all other provider and supplier types). This
means we could revoke a provider or supplier under Sec. 424.535(a)(9)
if any of the following occur:
An IDTF fails to report a change in ownership, location,
general supervision, or final adverse action within 30 days of the
change or fails to report any other change in its enrollment data
within 90 days of the change.
A DMEPOS supplier fails to submit any change in its
enrollment information within 30 days of the change.
A provider or supplier other than a physician, non-
physician practitioner, physician group, non-physician practitioner
group, IDTF, or DMEPOS supplier fails to report any of the following:
++ A change in ownership or control within 30 days of the change.
++ A revocation or suspension of a federal or state license or
certification within 30 days of the revocation or suspension.
++ Any other change in its enrollment data within 90 days of the
change.
We contended that our revocation authority under Sec.
424.535(a)(9) should not be restricted to certain provider and supplier
types that have omitted reporting a change in practice location or
final adverse action. Any failure to report changed enrollment data,
regardless of the provider or supplier type involved, is of concern to
us. We must have complete and accurate data on each provider and
supplier to help confirm that the provider or supplier still meets all
Medicare requirements and that Medicare payments are made correctly.
Inaccurate or outdated information puts the Medicare Trust Funds at
risk.
While we stated that we would retain the discretion to revoke a
provider's or supplier's enrollment for any failure to meet the
reporting requirements in Sec. 424.516(d) or (e), Sec. 410.33(g)(2),
or Sec. 424.57(c)(2), our proposal was focused on significant cases of
non-reporting. For instance, a provider's belated omission to report a
ZIP code change until 120 days after the change does not represent an
equivalent level of program integrity risk as a complete failure to
report a new practice location. We proposed to consider the following
factors in determining whether a Sec. 424.535(a)(9) revocation is
appropriate (1) whether the data in question was reported; (2) if the
data was reported, how belatedly; (3) the materiality of the data in
question; and (4) any other information that we deem relevant to our
determination.
We received the following comments regarding our proposal:
Comment: Several commenters expressed concern regarding our
proposed revision to Sec. 424.535(a)(9). They stated that the proposal
could allow CMS to revoke providers and suppliers for inadvertent or
innocent errors or oversights, even if no federal health care program
reimbursement was involved with the enrollment change that was not
reported. They added that many reporting failures are mere oversights
and not indicative of fraud or abuse. They recommended that CMS rescind
its proposal, believing that revocation in such instances is an overly
severe penalty.
Response: We note that we already have the authority to revoke
providers and suppliers under Sec. 424.535(a)(1) for failing to timely
report changes of information under, as applicable, Sec. Sec.
424.516(d), 410.33(g)(2), and 424.57(c)(2). Our revision to Sec.
424.535(a)(9) simply establishes a dedicated paragraph in Sec.
424.535(a) to address all information changes, not merely those in
Sec. 424.516(d)(ii) and (iii). In other words, we have always had
general authority to revoke for failing to report changes, and this
rule expands upon that existing authority. The expansion of Sec.
424.535(a)(9), however, is focused largely on significant cases of non-
reporting, and we will carefully consider several factors, such as the
data's materiality, in determining
[[Page 47830]]
whether a revocation is appropriate. Yet we must emphasize that we
still retain the right to revoke under Sec. 424.535(a)(9) for any
failure to timely report informational changes.
Comment: A commenter suggested that CMS require advance notice and
an opportunity for information correction or rebuttal of allegations of
noncompliance prior to imposing a revocation for a failure to timely
report a practice location change.
Response: We believe that a failure to report a practice location
is a serious matter, especially considering that practice location data
has a material effect on the accuracy of Medicare payments. Thus, we do
not believe that advance notice and an opportunity to correct is
appropriate and stress that the provider or supplier may appeal any
revocation under part 498. We note further that advance notice and a
correction opportunity could remove any incentive for providers and
suppliers to timely report information changes. The provider or
supplier could simply wait until receiving such notice (assuming that
CMS even learns of the new or changed data) to disclose the information
via the Form CMS-855.
Comment: A commenter stated that while our proposed factors under
Sec. 424.535(a)(9) were reasonable considerations, they were
inadequate to protect against the revocation of a provider for trivial
reasons. The commenter recommended that CMS add to the regulatory text
the language from the proposed rule's preamble indicating that a
decision to revoke would be focused on ``egregious'' cases of non-
reporting. Another commenter stated that revoking Medicare enrollments
under Sec. 424.535(a)(9) should only occur in egregious cases.
Response: We believe that our proposed factors sufficiently ensure
that--(1) we will carefully consider all circumstances of the case
before taking action; and (2) any decision to revoke will not be taken
lightly. Also, we believe that the language regarding ``egregious''
non-reporting is inappropriate for regulatory text.
Comment: A commenter stated that revocation under Sec.
424.535(a)(9) should extend only to instances where the unreported
information was material and the non-disclosure intentional.
Materiality would thus be the threshold question as opposed to a mere
factor for consideration. The commenter suggested that materiality
could be based on whether the failure to report would result in ``undue
risk'' (as articulated in section 1866(j)(5)) or otherwise would have
changed the provider's enrollment status. The commenter also requested
that CMS provide additional examples of what constitutes egregious
cases of non-reporting.
Response: We do not believe that materiality should be the
threshold question, for this would imply that certain information need
never be reported to CMS. In other words, providers and suppliers might
assume that they need not comply with our reporting requirements in
many cases because they would only be revoked for instances involving
material data. We emphasize that providers and suppliers have a
continuing obligation to report changes in their enrollment information
via the Form CMS-855 regardless of the data's relative materiality. In
addition, we respectfully decline to set forth examples of significant
non-reporting. The facts of each case may vary greatly, and we must
retain our flexibility to address and consider particular
circumstances.
After consideration of the comments received, we are finalizing our
proposed revisions to Sec. 424.535(a)(9).
7. Payment Suspensions
Section 424.530(a)(7) permits the denial of a provider's or
supplier's Medicare enrollment application if the current owner,
physician, or non-physician practitioner has been placed under a
Medicare payment suspension in accordance with Sec. Sec. 405.370
through 405.372. Under Sec. 405.371, a Medicare payment suspension may
be imposed if CMS determines that a credible allegation of fraud
against a provider or supplier exists. The general purpose of a payment
suspension based upon a credible allegation of fraud is to temporarily
halt the payment of Medicare Trust Fund dollars to a provider or
supplier pending the resolution of a particular investigation
concerning, for instance, whether the provider or supplier has engaged
in fraudulent activity. CMS also has the authority to impose a payment
suspension based upon reliable information that an overpayment exists.
The goal of this type of suspension is to temporarily halt Medicare
payments while CMS performs subsequent action to determine the
existence of an overpayment.
We proposed several revisions to Sec. 424.530(a)(7) and one
revision to Sec. 405.371.
First, we proposed to expand the applicability of Sec.
424.530(a)(7) to--(1) all provider and supplier types; and (2) any
owning or managing employee or organization of the provider or
supplier. We stated that the existing scope of Sec. 424.530(a)(7),
which is limited to owners, physicians, and non-physician
practitioners, does not address the continuum of program
vulnerabilities in this area. Indeed, providers and suppliers other
than physicians and non-physician practitioners are currently not
prohibited from enrolling in Medicare based on a payment suspension. We
note further that a managing individual or entity often has as much (or
more) day-to-day control over a provider or supplier as an owner. In
our view, automatically allowing a provider or supplier to enroll in
Medicare even though one of its managing officials or organizations is
under a payment suspension poses a risk to Medicare and its
beneficiaries.
Second, we proposed to include Medicaid payment suspensions within
the purview of Sec. 424.530(a)(7). Under Sec. 455.23, the state
Medicaid agency must suspend all Medicaid payments to a provider or
supplier after the agency determines that there is a credible
allegation of fraud for which a Medicaid investigation is pending
(unless the agency has good cause to not suspend payments). We
contended that there was no significant difference between Medicare and
Medicaid payment suspensions in terms of the threat posed to federal
health care program integrity; potentially fraudulent behavior in the
Medicaid program could be repeated in the Medicare program. We thus
proposed to be able to prevent such providers and suppliers from
entering Medicare.
Third, we proposed to incorporate these revised provisions into a
new Sec. 424.530(a)(7)(i).
Fourth, we proposed to establish a new Sec. 424.530(a)(7)(ii) that
would permit CMS to apply Sec. 424.530(a)(7) to the following:
Any of the provider's or supplier's or owning or managing
employee's or organization's current or former names, numerical
identifiers, or business identities.
Any of the provider's or supplier's existing enrollments.
This reflected our previously discussed desire to ensure that
questionable parties are unable to reenter the Medicare program (be it
as a provider, supplier, owner, or manager) by using alternate
identifiers. We were also concerned about situations where the provider
or supplier has multiple enrollments, including those under different
names, tax identification numbers, or other identifiers or business
structures.
We proposed to consider the following factors in determining
whether a denial is appropriate:
The specific behavior in question.
[[Page 47831]]
Whether the provider or supplier is the subject of other
similar investigations.
Any other information that we deem relevant to our
determination.
Fifth, we proposed to expand Sec. 405.371 to state that a Medicare
payment suspension may be imposed if a state Medicaid program suspends
payment pursuant to Sec. 455.23(a)(1). Again, we expressed concern
that possible fraudulent behavior in Medicaid might be repeated in
Medicare.
We received the following comments regarding these proposals:
Comment: Regarding our proposal to expand the application of Sec.
424.530(a)(7), a commenter questioned whether this authority applies if
the payment suspension is later lifted or reversed.
Response: Under existing policy, if a Medicare enrollment
application is denied under Sec. 424.530(a)(7) because of a current
payment suspension, the application denial is not reversed if the
payment suspension is later lifted or reversed. Once the suspension
ends, however, the provider or supplier may submit another initial
application for enrollment.
Comment: A commenter expressed concern about denials based on
terminations or suspensions that are under appeal because the latter
actions can be caused by administrative or other error. The commenter
recommended that CMS allow the appeals process to run its course before
denying an application, stating that--(1) this would be consistent with
due process; and (2) CMS would retain the ability to revoke the
provider's enrollment if the appeal is unsuccessful.
Response: We respectfully disagree. If a provider or supplier has
potentially engaged in questionable behavior, we should not be required
to enroll the provider or supplier pending the completion of the
appeals process or, in the case of payment suspensions, the rebuttal
process under Sec. 405.374. We must be able to take steps at the
beginning of the enrollment process to protect the Medicare program,
the Trust Funds, and beneficiaries from such risks.
After consideration of the comments received, we are finalizing our
proposed changes to Sec. Sec. 424.530(a)(7) and 405.371.
8. Other Federal Program Termination
To further protect Medicare from inappropriate activities occurring
in other programs, we proposed two changes regarding denials and
revocations.
a. Denials
We proposed in new Sec. 424.530(a)(14) that CMS may deny a
provider's or supplier's Medicare enrollment application if:
The provider or supplier is currently terminated or
suspended (or otherwise barred) from participation in a state Medicaid
program or any other federal health care program; or
The provider's or supplier's license is currently revoked
or suspended in a state other than that in which the provider or
supplier is enrolling.
Section 455.416(c) states that a Medicaid state agency must deny
enrollment or terminate the enrollment of any provider that is
terminated on or after January 1, 2011, under Medicare or the Medicaid
program or CHIP of any other state. We explained in the proposed rule
that Sec. 424.530(a)(14) would facilitate consistency with the
framework of Sec. 455.416(c). Again, a provider's or supplier's
improper behavior in another federal health care program may be
duplicated in Medicare. Likewise, a Medicare provider's or supplier's
actions that led to a license revocation or suspension in one state
could be repeated with respect to its prospective enrollment in another
state.
We stated in the proposed rule that a relevant program or license
suspension warrants additional scrutiny, for the conduct behind the
suspension could raise questions concerning the prospective provider's
or supplier's ability to be a dependable Medicare participant. We
recognized that license and federal program suspensions are generally
temporary rather than permanent actions. Under certain conditions,
however, license suspensions may be imposed for extended periods and
involve serious transgressions. We believed that in circumstances
triggering significant program integrity concerns, we should consider
such conduct and determine the risk it poses before allowing the
provider or supplier to enroll.
We stated that Sec. 424.530(a)(14) could apply regardless of
whether any appeals are pending. We acknowledge that, under current
Sec. 424.535(a)(12)(ii), we may not revoke a provider's or supplier's
Medicare enrollment based on a Medicaid termination unless the provider
or supplier has exhausted all applicable appeal rights regarding the
Medicaid termination. Yet we did not believe a similar clause should
apply to Sec. 424.530(a)(14). As discussed earlier regarding license
or federal program suspensions, Medicaid or other program terminations
may be indicators of serious transgressions. We thus deemed it
inappropriate to permit a Medicaid-terminated provider or supplier (or
a provider or supplier terminated under any federal program) into
Medicare simply because that party had not yet exhausted its appeal
rights. In fact, such a clause might encourage the provider or supplier
to file a frivolous appeal in order to enroll in Medicare prior to the
exhaustion of its appeal rights.
In determining whether to invoke Sec. 424.530(a)(14) in a
particular case, we proposed to consider the following factors:
The reason(s) for the termination, revocation, or
suspension.
Whether, as applicable, the provider or supplier:
++ Is currently terminated or suspended (or otherwise barred) from
more than one program (for example, more than one state's Medicaid
program);
++ Has been subject to any other sanctions during its participation
in other programs or by any other state licensing boards; or
++ Has had any other final adverse actions imposed against it.
Any other information that we deem relevant to our
determination.
Consistent with our previously discussed rationale, we further
proposed that Sec. 424.530(a)(14) would apply to the provider or
supplier under any of its current or former names, numerical
identifiers, or business identities.
b. Revocations
Under existing Sec. 424.535(a)(12), Medicare may revoke a
provider's or supplier's enrollment if a state Medicaid agency
terminates the provider's or supplier's Medicaid enrollment. Similar to
our discussion concerning Sec. 424.530(a)(14), we proposed to expand
Sec. 424.535(a)(12)(i) such that CMS may revoke a provider's or
supplier's Medicare enrollment if the provider or supplier is
terminated or revoked (or otherwise barred) from participation in any
other federal health care program. In determining whether a revocation
is appropriate, we proposed to consider the following factors:
The reason(s) for the termination or revocation.
Whether the provider or supplier:
++ Is currently terminated, revoked, or otherwise barred from more
than one program (for example, more than one state's Medicaid program);
or
++ Has been subject to any other sanctions during its participation
in other programs.
Any other information that we deem relevant to our
determination.
Section 424.535(a)(12)(ii) states that Medicare may not terminate a
provider's
[[Page 47832]]
or supplier's enrollment unless and until a provider or supplier has
exhausted all applicable appeal rights. We did not propose to modify
this provision. We would not revoke a provider's or supplier's
enrollment under paragraph (a)(12)(i) unless all applicable appeal
rights relating to the termination have been exhausted.
In addition, and for reasons previously explained, we proposed to
add new Sec. 424.535(a)(12)(iii). This would enable us to apply Sec.
424.535(a)(12)(i) to the provider or supplier under any of its current
or former names, numerical identifiers, or business identities.
c. Comments Received
We received the following comments regarding these denial and
revocation proposals:
Comment: A commenter stated that CMS should apply penalties only
after a termination or suspension is final and not while it is being
appealed. The commenter stated that this is similar to how CMS treats
revocations.
Response: We respectfully disagree. As already stated, if a
provider or supplier has perhaps engaged in questionable behavior, we
should not be required to enroll the provider or supplier pending the
completion of the appeals process. We must be able to protect the
Medicare program, the Trust Funds, and beneficiaries from such risks at
the beginning of the enrollment process. Waiting to take action until
the end of a possibly lengthy appeals process could permit the provider
or supplier to continue its behavior for an extended period. We also
note that Medicare revocations may be and have been imposed prior to
the expiration of the applicable Medicare appeals process.
Comment: A commenter supported our proposal to deny or revoke
enrollment if the provider or supplier is currently terminated from a
Medicaid or other federal health care program under any of its current
or former names, numerical identifiers, or business entities. However,
the commenter opposed the proposal to deny or revoke enrollment if the
provider's or supplier's license is revoked in a state other than that
in which the provider or supplier is enrolled or enrolling.
Response: We appreciate the commenter's support for our proposal
addressing program terminations. Concerning out-of-state license
terminations, we note that these denial and revocation authorities are
discretionary and will only be exercised after a careful consideration
of the specified factors. We add that these authorities regarding out-
of-state license terminations are necessary because, once again,
potentially improper conduct in one state can be repeated in another
state.
After consideration of the comments received, we are finalizing new
Sec. 424.530(a)(14) and revised Sec. 424.535(a)(12) as proposed with
several exceptions. In Sec. 424.530(a)(14), we are changing the phrase
``particular State Medicaid program'' to ``State Medicaid program''. We
believe that elimination of the term ``particular'' will help clarify
that the provisions refer to any state Medicaid program rather than a
specific one. In the same section, we are adding ``(as that term is
defined in Sec. 424.502)'' to Sec. 424.530(a)(14)(i)(B) as a
reference to the regulatory definition of final adverse actions. As for
Sec. 424.535(a)(12), we are changing ``particular Medicaid program''
to ``State Medicaid program'' for the same reason described above.
Also, we are changing the term ``terminate'' to ``revoke'' in Sec.
424.535(a)(12)(ii) to clarify that CMS revokes enrollments.
9. Extension of Revocation
We proposed in new Sec. 424.535(i) that CMS may revoke any and all
of a provider's or supplier's Medicare enrollments--including those
under (1) different names, numerical identifiers, or business
identities, and (2) different types (for example, an entity is enrolled
as a group practice via the Form CMS-855B and a DMEPOS supplier via the
Form CMS-855S--if the provider or supplier is revoked under Sec.
424.535(a). This proposal was designed to make certain that parties
that are revoked for inappropriate behavior are not permitted to remain
enrolled in Medicare in any capacity. Consider the following examples:
A physician's State X enrollment is revoked because his
license in X was revoked. Under Sec. 424.535(i), we also could revoke
the physician's State Y enrollment even if he is still licensed in Y.
An entity has two enrollments: One via the Form CMS-855A
as a certified supplier, another via the Form CMS-855B as a group
practice. The entity's Form CMS-855A enrollment is revoked under Sec.
424.535(a)(4). Under Sec. 424.535(i), CMS could also revoke the
organization's Form CMS-855B enrollment, even if that enrollment is in
another state.
A non-physician practitioner is enrolled via the Form CMS-
855I (OMB Control No. 0938-0685)) as an individual supplier and as a
DMEPOS supplier via the Form CMS-855S. The individual's Form CMS-855I
enrollment is revoked for abusive billing practices. Under Sec.
424.535(i), CMS could also revoke her Form CMS-855S enrollment.
In determining whether to revoke a provider's or supplier's other
enrollments under Sec. 424.535(i), we proposed to consider the
following factors:
The reason for the revocation and the facts of the case.
Whether any final adverse actions have been imposed
against the provider or supplier regarding its other enrollments (for
example, licensure suspensions imposed by the state, prior revocations,
and/or payment suspensions).
The number and type(s) of other enrollments (for instance,
Form CMS-855B).
Any other information that we deem relevant to our
determination.
We stated that this provision would not be an ``all or nothing''
provision; that is, we would not be required to automatically revoke
all of the provider's or supplier's other enrollments if we chose to
invoke Sec. 424.535(i). We would instead apply the previously listed
factors to each enrollment in determining whether it should be revoked.
We received the following comments concerning this proposal:
Comment: A commenter contended that a separate justification for
extending an enrollment/reactivation bar to related entities should be
required. This should include, the commenter stated, a requirement that
the secondary entities be found to pose an undue risk beyond the fact
that the entity is related to a party that is subject to a warranted
enrollment/reactivation bar. The commenter added that there should be
no extension of an enrollment/reactivation bar until all appeals by the
primary affected entity are concluded.
Response: We stated in the proposed rule that the factors outlined
in Sec. 424.535(i) would be individually applied to each location and
enrollment. We still hold this position. However, we disagree with
explicitly requiring an undue risk standard for other locations and
enrollments. Secondary locations and enrollments, in our view, can pose
as much (or even more) of a threat to the Medicare program as the
principal ones. Accordingly, they should not be held to a different
standard (via the undue risk threshold) than the primary locations and
enrollments. We also do not believe that we should be required to wait
until all appeals involving the principal location and enrollment have
been exhausted before taking action against the secondary ones. CMS
must retain
[[Page 47833]]
the ability to take immediate steps to protect the Medicare program,
the Trust Funds, and beneficiaries. Delaying action for a potentially
lengthy period due to an ongoing appeals process would hinder this
objective.
After consideration of the comments received, we are finalizing
Sec. 424.535(i) as proposed.
10. Voluntary Termination Pending Revocation
As we explained in section II.A. of the proposed rule, we have seen
instances of providers and suppliers failing to meet Medicare
requirements or otherwise engaging in improper behavior, and then
voluntarily terminating their Medicare enrollment to avoid a potential
revocation of their enrollment and a consequent reenrollment bar. For
instance, assume that we perform a site visit of a provider's lone
location. The site does not comply with our requirements. Knowing that
its Medicare enrollment may soon be revoked, the provider submits a
Form CMS-855 to voluntarily terminate its enrollment; the purpose,
again, is to depart Medicare to avoid a formal revocation and
reenrollment bar and any other consequences stemming therefrom.
We contended in the proposed rule that such attempts to circumvent
the revocation process represent a risk to the Medicare program. Not
only do they reflect dishonesty on the provider's or supplier's part,
but also that the provider or supplier may be deliberately taking
advantage of program vulnerabilities because no reenrollment bar has
been imposed. To this end, we proposed in new Sec. 424.535(j)(1) that
we may revoke a provider's or supplier's Medicare enrollment if we
determine that the provider or supplier voluntarily terminated its
Medicare enrollment in order to avoid a revocation under Sec.
424.535(a) that CMS would have imposed had the provider or supplier
remained enrolled in Medicare. This would prevent the provider or
supplier from avoiding a re-enrollment bar.
In making our determination, we proposed to consider the following
factors:
If there is evidence to suggest that the provider knew or
should have known that it was or would be out of compliance with
Medicare requirements.
If there is evidence to suggest that the provider knew or
should have known that its Medicare enrollment would be revoked.
If there is evidence to suggest that the provider
voluntarily terminated its Medicare enrollment in order to circumvent
such revocation.
Any other evidence or information that CMS deems relevant
to its determination.
In new paragraph (j)(2), we proposed that a revocation under Sec.
424.535(j)(1) would be effective the day before the Medicare contractor
receives the provider's or supplier's Form CMS-855 voluntary
termination application. We believed this date was appropriate because
the provider's or supplier's submission of the voluntary termination
application is the basis for the paragraph (j)(1) revocation.
Procedurally, the voluntary termination would be reversed (if the
Medicare contractor processed the application to completion) and the
provider's or supplier's enrollment would then be revoked.
Although we received several comments regarding voluntary
terminations in the context of our proposed affiliation disclosure
requirements (see section II.A of this final rule with comment period),
we received no comments specifically pertaining to Sec. 424.535(j).
Therefore, we are finalizing this proposal.
11. Enrollment for Ordering/Certifying/Referring/Prescribing of All
Part A and B Services, Items, and Drugs; Maintenance of Documentation
a. Background of Part A and B Enrollment Proposal
Section 6405(c) of the Affordable Care Act gives the Secretary the
authority to extend the requirements of section 6405(a) and (b) of the
Affordable Care Act to all other categories of items or services under
title XVIII of the Act (including covered Part D drugs) that are
ordered, prescribed, or referred by a physician or eligible
professional enrolled under section 1866(j) of the Act. Under this
authority, existing Sec. 424.507(a) and (b) collectively state that to
receive payment for ordered imaging services, clinical laboratory
services, DMEPOS items, or home health services, the service or item
must have been ordered or certified by a physician or, when permitted,
an eligible professional who--(1) is enrolled in Medicare in an
approved status; or (2) has a valid opt-out affidavit on file with an
Part A/B MAC.
Section 424.507(a) and (b) were implemented via an April 27, 2012
final rule titled ``Medicare and Medicaid Programs; Changes in Provider
and Supplier Enrollment, Ordering and Referring, and Documentation
Requirements; and Changes in Provider Agreements'' (77 FR 25284). Also,
in the previously mentioned May 23, 2014 final rule (79 FR 29843), we
finalized provisions under which the prescriptions of a physician or
eligible professional who is not enrolled in Medicare and does not have
a valid opt-out affidavit on file with an A/B MAC would not be covered
under the Part D program.
The purpose of the provider enrollment process is to ensure that
providers and suppliers that furnish services and items to Medicare
beneficiaries meet all Medicare requirements. We stated in the proposed
rule that the importance of confirming that all physicians and eligible
professionals who order, certify, refer, or prescribe Part A or B
services, items, or drugs (and not simply those services and items
described in Sec. 424.507) are qualified to do so dictated that we
expand the purview of Sec. 424.507. To this end, we proposed the
following changes to Sec. 424.507(a) and (b):
The heading to paragraph (a) currently reads--``Conditions for
payment of claims for ordered covered imaging and clinical laboratory
services and items of durable medical equipment, prosthetics,
orthotics, and supplies (DMEPOS).'' We proposed to change this to
state: ``Conditions for payment of claims for ordered, certified,
referred, or prescribed covered Part A or B services, items, or
drugs.''
The heading to existing paragraph (a)(1) reads--``Ordered covered
imaging, clinical laboratory services, and DMEPOS item claims.'' We
proposed to change this to state: ``Ordered, certified, referred, or
prescribed covered Part A or B services, items or drugs.''
The opening sentence in paragraph (a)(1) currently states in part:
``To receive payment for ordered imaging, clinical laboratory services,
and DMEPOS items (excluding home health services described in Sec.
424.507(b), and Part B drugs)''. We proposed to change this language to
read: ``To receive payment for ordered, certified, referred, or
prescribed covered Part A or B services, items or drugs''.
Paragraph (a)(1)(i) states in part: ``The ordered covered imaging,
clinical laboratory services, and DMEPOS items (excluding home health
services described in paragraph (b) of this section, and Part B drugs)
must have been ordered by''. We proposed to change this language to:
``The ordered, certified, referred, or prescribed covered Part A or B
service, item, or drug must have been ordered, certified, referred, or
prescribed by''.
In paragraph (a)(2), we proposed to change the heading from ``Part
B beneficiary claims'' to ``Part A and B
[[Page 47834]]
beneficiary claims.'' We also proposed to change the language that
states ``To receive payment for ordered covered items and services
listed at Sec. 424.507(a)'' to ``To receive payment for ordered,
certified, referred, or prescribed covered Part A or B services, items
or drugs''.
In paragraphs (a)(1)(ii) and (iii), and (a)(2)(i), we proposed to
change the language that reads ``who ordered the item or service'' to
``who ordered, certified, referred, or prescribed the Part A or B
service, item, or drug''.
We proposed to change the existing language in paragraphs
(a)(1)(iv) and (a)(2)(ii) that reads ``If the item or service is
ordered by'' to ``If the Part A or B service, item, or drug is ordered,
certified, referred, or prescribed by''.
We proposed to revise the existing language in paragraphs
(a)(1)(iv)(A)(1) and (a)(2)(ii)(A)(1) from ``As the ordering supplier''
to ``As the ordering, certifying, referring or prescribing supplier''.
We proposed to change the current language in paragraphs
(a)(1)(iv)(B) and (a)(2)(ii)(B) that reads ``order such items and
services'' to ``order, certify, refer, or prescribe such services,
items, and drugs''.
In paragraphs (a)(1)(iv)(B)(1) and (a)(2)(ii)(B)(1), we proposed to
replace the word ``order'' with ``order, certify, refer, or
prescribe''.
We proposed to delete the existing version of paragraph (b), which
deals with home health services. Such services would be addressed in
revised paragraph (a). We proposed to redesignate current paragraph (c)
as revised paragraph (b). We also proposed in this paragraph to--
Change the language that reads ``covered items and
services'' to ``ordered, certified, referred, or prescribed Part A or B
services, items or drugs;''
Delete ``or (b)'' and ``and (b)'', since the existing
version of paragraph (b) would be replaced;
Change ``paragraphs (a)(1)'' to ``paragraph (a)(1)''; and
Delete ``respectively.''
We proposed to redesignate current paragraph (d) as revised
paragraph (c). We also proposed in this paragraph to:
Change the language that reads ``covered items or
services'' to ``ordered, certified, referred, or prescribed covered
Part A or B services, items or drugs''.
Change the language that states ``paragraphs (a) and (b)''
to ``paragraph (a).''
Delete paragraph (d).
Our proposal included drugs that are covered under Part B. We
believed that this, combined with Sec. 423.120(c), would help confirm
that all prescribers of Medicare drugs are thoroughly vetted for
compliance with Medicare requirements.
We also proposed that our changes to Sec. 424.507 would become
effective on January 1, 2018 to give sufficient time for--(1) providers
and suppliers to complete the enrollment or opt-out process; (2)
stakeholders (including CMS and its contractors) to prepare for,
operationalize, and implement these requirements; and (3) provider and
beneficiary education.
In the April 27, 2012 final rule (77 FR 25291), we agreed with
commenters that there were a number of operational issues associated
with a requirement that services of a specialist be ordered or
referred. We thus removed that requirement. However, with the
successful implementation of the current version of Sec. 424.507, we
stated in the proposed rule that the expansion of Sec. 424.507 to
include other services can be fully operationalized.
b. Preclusion List for Medicare Advantage (MA) and Part D
In the previously mentioned May 23, 2014 final rule, we finalized
provisions that would require Medicare Part D prescribers to enroll in
or opt-out of the Medicare program in order to prescribe Part D drugs
to Medicare beneficiaries. In a similar vein, we established provisions
in a November 15, 2016 final rule (81 FR 80170) titled ``Medicare
Program; Revisions to Payment Policies Under the Physician Fee Schedule
and Other Revisions to Part B for CY 2017; Medicare Advantage Bid
Pricing Data Release; Medicare Advantage and Part D Medical Loss Ratio
Data Release; Medicare Advantage Provider Network Requirements;
Expansion of Medicare Diabetes Prevention Program Model; Medicare
Shared Savings Program Requirements'' requiring Medicare Advantage (MA)
providers to enroll in Medicare in order to furnish MA services and
items to Medicare beneficiaries. These provisions were intended to
supplement those in Sec. 424.507 by expanding the enrollment
requirement to include MA and Part D, thereby strengthening the payment
safeguard elements of the latter two programs.
During our preparations to implement the Part D and MA enrollment
provisions by the January 1, 2019 effective date, several provider
organizations expressed concerns about our forthcoming requirements.
With respect to Part D, these organizations stated that--(1) most
prescribers pose no risk to the Medicare program; (2) certain types of
physicians and eligible professionals prescribe Part D drugs only very
infrequently; and (3) the burden to the prescriber community would
outweigh the program integrity benefits of the Part D enrollment
requirement. Regarding MA, some stakeholders were, too, concerned about
the burden of having to enroll in Medicare, particularly considering
that MA organizations enrolling in Medicare must also undergo
credentialing by their respective health plans. While enrolling such
prescribers and providers gives Medicare a greater degree of scrutiny
in determining a prescriber's or provider's qualifications, we noted
that the perceived burden associated with this process could cause some
prescribers and providers not to enroll in Medicare, thus possibly
leading to access to care issues if such providers left MA networks as
a result. As of early 2018, approximately 420,000 Part D prescribers
and 120,000 MA providers remained unenrolled in Medicare.
Given these concerns, on April 16, 2018 we published in the Federal
Register a final rule titled, ``Medicare Program; Contract Year 2019
Policy and Technical Changes to the Medicare Advantage, Medicare Cost
Plan, Medicare Fee-for-Service, the Medicare Prescription Drug Benefit
Programs, and the PACE Program'' (83 FR 16440) (hereafter referred to
as the April 16, 2018 final rule). In that rule, we removed the MA and
Part D enrollment requirements outlined in the May 23, 2014 and
November 15, 2016 final rules, respectively. They were replaced with a
payment-oriented (rather than an enrollment-based) approach by which we
would focus on prescribers and providers that present an elevated risk
to Medicare beneficiaries and the Trust Funds. Rather than require the
enrollment of MA providers and Part D prescribers regardless of the
level of risk they might pose, we would prevent payment for MA items or
services and Part D drugs that are, as applicable, furnished or
prescribed by demonstrably problematic prescribers and providers. To
this end, the April 16, 2018 rule stated that--(1) such problematic
parties would be placed on a ``preclusion list''; and (2) payment for
Part D drugs and MA services and items prescribed or furnished by these
individuals and entities would be rejected or denied, as applicable.
The implementation of the MA and Part D preclusion list policies began
in late 2018.
c. Comments Received on Proposed Changes to Sec. 424.507
We received a number of comments regarding our proposed changes to
[[Page 47835]]
Sec. 424.507. They focused on several matters. First, commenters
expressed concern about the burden that would be involved in enrolling
in Medicare to order, certify, refer, or prescribe Part A or B
services, items, or drugs. Second, several stated that our proposal
would negatively impact beneficiaries who seek care and treatment in
emergency departments for acute illnesses or acute exacerbations of a
chronic condition. Third, commenters requested that the proposed
January 1, 2018 effective date was much too soon to enable stakeholders
to prepare for these requirements and should be significantly pushed
back.
Given the adoption of the preclusion list approach in lieu of MA
and Part D enrollment and our interest in reducing burden on the
provider and supplier community, we have decided not to finalize our
proposed changes to Sec. 424.507.
d. Maintenance of Documentation
In the November 19, 2008 Federal Register, we published a final
rule titled, ``Medicare Program; Payment Policies Under the Physician
Fee Schedule and Other Revisions to Part B for CY 2009; E-Prescribing
Exemption for Computer-Generated Facsimile Transmissions; and Payment
for Certain Durable Medical Equipment, Prosthetics, Orthotics, and
Supplies'' (73 FR 69726). In that rule, we established Sec. 424.516(f)
stating that--(1) a provider or supplier is required to maintain
ordering and referring documentation, including the NPI, received from
a physician or eligible non-physician practitioner for 7 years from the
date of service; and (2) physicians and non-physician practitioners are
required to maintain written ordering and referring documentation for 7
years from the date of service.
Section 1866(a)(1) of the Act, which was amended by section
6406(b)(3) of the Affordable Care Act, require that providers and
suppliers maintain and, upon request, provide to the Secretary access
to written or electronic documentation relating to written orders or
requests for payment for durable medical equipment, certifications for
home health services, or referrals for other items or services written
or ordered by the provider as specified by the Secretary. Under section
1842(h) of the Act, which was amended by section 6406(a) of the
Affordable Care Act, the Secretary may revoke a physician's or
supplier's enrollment if the physician or supplier fails to maintain
and, upon request of the Secretary, provide access to documentation
relating to written orders or requests for payment for durable medical
equipment, certifications for home health services, or referrals for
other items or services written or ordered by such physician or
supplier, as specified by the Secretary.
Consistent with the authority given to the Secretary in sections
1866(a)(1) and 1842(h) of the Act, we revised Sec. 424.516(f) in the
previously referenced April 27, 2012 final rule to specify the
following:
Under paragraph (f)(1), a provider or supplier that
furnishes covered ordered items of DMEPOS, clinical laboratory, imaging
services, or covered ordered/certified home health services is required
to maintain documentation for 7 years from the date of service, and
provide access to that documentation upon the request of CMS or a
Medicare contractor.
Under paragraph (f)(2), a physician who orders/certifies
home health services and the physician or, when permitted, other
eligible professional who orders items of DMEPOS or clinical laboratory
or imaging services is required to maintain documentation for 7 years
from the date of service, and provide access to that documentation upon
the request of CMS or a Medicare contractor.
The documentation in paragraphs (f)(1) and (2) includes written and
electronic documents (including the NPI of the physician who ordered/
certified the home health services and the NPI of the physician or,
when permitted, other eligible professional who ordered items of DMEPOS
or clinical laboratory or imaging services) relating to written orders
and certifications and requests for payments for items of DMEPOS and
clinical laboratory, imaging, and home health services.
We proposed to expand these requirements in Sec. 424.516(f) to
include all Part A and Part B services, items, and drugs that are
ordered, certified, referred, or prescribed by a physician or, when
permitted, eligible professional. Thus, the provider or supplier
furnishing the Part A or B service, item, or drug, as well as the
physician or, when permitted, eligible professional who ordered,
certified, referred, or prescribed the service, item or drug, would
have to maintain documentation for 7 years from the date of the service
and furnish access to that documentation upon a CMS or Medicare
contractor request. The documentation would include written and
electronic documents (including the NPI of the ordering/certifying/
referring/prescribing physician or, when permitted, eligible
professional) relating to written orders, certifications, referrals,
prescriptions, and requests for payments for a Part A or B service,
item, or drug.
We stated in the proposed rule that it is important that payments
for Part A and B services, items, and drugs be made correctly. Without
being able to review the documentation addressed in Sec. 424.516(f),
we may be unable to confirm that the order, certification, referral, or
prescription was proper and that the ordering, certifying, referring or
prescribing individual was qualified. We further noted in the proposed
rule our belief in the importance of revising Sec. 424.516(f) to be
consistent with our proposed changes to Sec. 424.507. We stated that
to require all persons who order, certify, refer, and prescribe Part A
and B services, items, or drugs to enroll in Medicare without requiring
them (or the billing provider) to retain supporting documentation would
undercut the effectiveness of Sec. 424.507. Although, as already
mentioned, we are not finalizing our proposed changes to Sec. 424.507,
we maintain this view. We must be able to verify that the--(1) order,
certification, referral, or prescription was appropriate; (2) ordering,
certifying, referring or prescribing individual was qualified; and (3)
payment at issue was correctly made.
We received the following comments regarding this proposal:
Comment: A commenter stated that the proposed 7-year documentation
requirement was onerous, with seemingly no basis for such lengthy
documentation retention. The commenter recommended that the proposed
timeframe be reduced to 3 years, while recognizing that providers and
suppliers may choose or be required (under state law) to maintain such
documentation for longer periods.
Response: We believe that a 7-year period is appropriate and note
that this timeframe has been in place in Sec. 424.516(f) since its
enactment in the previously mentioned November 19, 2008 final rule. We
continue to believe that the timeframe must be of sufficient length to
ensure that we can confirm the accuracy and legitimacy of prior orders,
certifications, referrals, and prescriptions and the payments stemming
therefrom. A 3-year period, in our view, would remove from our
requirement certain documents that could help us execute this function.
Comment: A commenter concurred that the ordering provider should
maintain the clinical justification for the imaging study. The
commenter added that a radiology group--(1) need only maintain the
documentation it receives from the ordering physician or non-physician
practitioner; and (2) must ensure that the submitted information
[[Page 47836]]
on the claim accurately reflects the information it received from the
ordering physician or non-physician practitioner. Further, the
commenter agreed that it is the ordering professional's responsibility
to provide the documentation associated with the imaging order to CMS
or a Medicare contractor.
Response: Portions of this comment are outside the scope of this
final rule with comment period, but we appreciate the commenter's
support.
Comment: A commenter sought clarification regarding--(1) the
penalty for a physician who fails to maintain documentation under Sec.
424.516(f); and (2) whether there is any penalty for the provider that
supplied the care that the physician ordered, certified, or referred.
Response: Section 424.516(f) includes document retention
requirements for -- (1) the ordering, certifying, referring, or
prescribing physician or eligible professional; and (2) the provider or
supplier furnishing the service. Currently, failure to comply with
these requirements may result in the revocation of the responsible
party's enrollment under Sec. 424.535(a)(1).
Comment: A commenter was concerned that certain dentists, such as
locum tenens dentists or those who were formerly employed by a
government agency or group dental practice, may be unable to comply
with this proposal because they do not have control over the relevant
documents. The commenter recommended that CMS place the burden for any
recordkeeping compliance solely on the individual or entity who
controls such records.
Response: Consistent with long-standing CMS policy, the physician
for whom the locum tenens physician is substituting is responsible for
retaining and furnishing the application documentation under Sec.
424.516(f).
After consideration of the comments received, and for reasons
stated previously, we are finalizing our revisions to Sec. 424.516(f)
as proposed notwithstanding the non-finalization of our proposal to
revise Sec. 424.507.
12. Opt-Out Physicians and Practitioners
As previously referenced, no Medicare payment (either directly or
indirectly) will be made for services furnished by opt-out physicians
or practitioners, except as permitted in accordance with Sec. Sec.
405.435(c) and 405.440. The effects of opting-out are described in
Sec. 405.425. Section 405.425(i) states that an opt-out physician or
practitioner who has not been excluded under sections 1128, 1156 or
1892 of the Act may order, certify the need for, or refer a beneficiary
for Medicare-covered items and services, provided he or she is not paid
directly or indirectly for such services (except as provided in Sec.
405.440). Under Sec. 405.425(j), an excluded physician or practitioner
may not order, prescribe, or certify the need for Medicare-covered
items and services, except as provided in 42 CFR 1001.1901, and must
otherwise comply with the terms of the exclusion in accordance with 42
CFR 1001.1901.
We proposed to revise Sec. 405.425(i) and (j) by including opt-out
physicians and practitioners who are revoked under Sec. 424.535. Thus,
a revoked opt-out physician or practitioner would be unable to order,
prescribe, and certify the need for or refer a beneficiary for
Medicare-covered services and items except as otherwise provided in
those paragraphs. We expressed concern that revoked physicians and
practitioners who have opted-out could, through inappropriate ordering
and certifying practices, pose a risk to Medicare beneficiaries. Our
concern is heightened because opt-out physicians and practitioners are
not subject to the same stringent enrollment and verification processes
that enrolled physicians and practitioners are. Therefore, we believed
that these proposed changes were necessary.
We received the following comment regarding our proposal:
Comment: A commenter expressed concern that there is no publicly
available list of revocations and that, other than receiving a claim
denial, it is unclear how the recipient of an order, prescription,
certification, or referral would be able to identify an opt-out
provider's revocation status. The commenter stated that CMS should not
hold hospitals to this standard until there is a viable way to
determine which ordering physicians have been revoked.
Response: We appreciate the commenter's concerns. While we are
finalizing this provision, we may examine means to expand the scope of
revocation data that is available to the public.
After reviewing the comment received, we are finalizing our
proposal with three exceptions.
First, the opening language of Sec. 405.425(j) states: ``The
physician or practitioner who is excluded . . . or whose Medicare
enrollment is revoked under Sec. [thinsp]424.535 of this chapter may
not order, prescribe or certify the need for Medicare-covered items and
services except . . . '' We are changing the language ``items and
services'' to ``items, services, and drugs . . . '' The addition of the
term ``drugs'' is meant to correspond with our addition of
``prescribe'' to Sec. 405.425(j). To ensure consistency with this
addition, we are also changing the language in Sec. 405.425(i) that
reads ``may order, certify the need for, prescribe, or refer a
beneficiary for Medicare-covered items and services'' to ``may order,
certify the need for, prescribe, or refer a beneficiary for Medicare-
covered items, services, and drugs''.
Second, the closing language of Sec. 405.425(j) reads, '' . . .
except as provided in Sec. 1001.1901 of this title, and must otherwise
comply with the terms of the exclusion in accordance with Sec.
1001.1901 effective with the date of the exclusion.'' Because Sec.
1001.1901 of this title only applies to excluded individuals and
entities, we are clarifying that the references to Sec. 1001.1901 in
Sec. 405.425(j) are inapplicable to revocations. We are therefore
revising Sec. 405.425(j) to read, '' . . . except, with respect to
exclusions, as provided in Sec. 1001.1901 of this title, and must
otherwise comply with the terms of any exclusion in accordance with
Sec. 1001.1901 effective with the date of the exclusion.''
Third, the opening language of Sec. 405.425(i) specifies that:
``The physician or practitioner who has not been excluded under
sections 1128, 1156 or 1892 of Social Security Act or whose Medicare
enrollment is not revoked under Sec. 424.535 of this chapter may
order, certify the need for, prescribe. . . .'' We are changing the
phrase ``or whose Medicare enrollment'' to ``and whose Medicare
enrollment.'' This is to clarify our intention that a physician or
practitioner must be neither excluded nor revoked in order to conduct
the activities addressed in paragraph (i).
13. Moratoria
Under Sec. 424.570(a), CMS may impose a temporary moratorium on
the enrollment of new Medicare providers and suppliers of a particular
type or the establishment of new practice locations of a particular
type in a particular geographic area. Per Sec. 424.570(a)(2)(i), a
moratorium is imposed when CMS determines that there is a significant
potential for fraud, waste, or abuse with respect to a particular
provider or supplier type, a particular geographic area, or both.
Consistent with this authority, we have published several Federal
Register documents announcing the imposition of temporary moratoria on
the enrollment of HHAs and certain ambulance suppliers. (See, for
example, the July 31, 2013 (78 FR 46339) and February 4, 2014 (79 FR
6475) Federal Registers.)
[[Page 47837]]
We proposed several changes to Sec. 424.570(a).
a. Change in Practice Location
Section 424.570(a)(1)(iii) states that a temporary moratorium does
not apply to changes in practice locations, changes in provider or
supplier information (such as phone numbers), or changes in ownership
(except changes in ownership of HHAs that would require an initial
enrollment under Sec. 424.550)).
We proposed three revisions to Sec. 424.570(a)(1)(iii).
The first proposal divided the current version of Sec.
424.570(a)(1)(iii) into paragraphs (a)(1)(iii)(A), (B), and (C) so that
each requirement mentioned in paragraph (a)(1)(iii) could be addressed
individually.
Secondly, we clarified in paragraph (a)(1)(iii)(A) (which would
address practice locations) that a temporary moratorium applies to
situations in which a provider or supplier is changing a practice
location from a location outside the moratorium area to a location
inside the moratorium area. We saw no difference between this situation
and one in which a provider or supplier is opening a brand new practice
location in the moratorium area. In both cases, an additional site is
being established in the moratorium area, something the moratorium is
designed to prevent. We thus believed this change was necessary.
Lastly, we proposed to clarify the existing policy in paragraph
(a)(1)(iii)(C) by removing the language ``under Sec. 424.550''. Under
Sec. 489.18(c), if an HHA changes ownership as specified in Sec.
489.18(a), the existing provider agreement is automatically assigned to
the new owner. However, if the new owner declines to accept the assets
and liabilities of the HHA and refuses assignment of the provider
agreement, Sec. 489.18(c) does not apply and the HHA must enroll as a
new provider via an initial enrollment. The existing reference to Sec.
424.550 in paragraph (a)(1)(iii) may have caused some confusion on this
point. Accordingly, we proposed to remove this reference in order to
clarify current policy.
b. Application of Moratorium
Section 424.570(a)(1)(iv) currently states that a temporary
enrollment moratorium does not apply to any enrollment application that
has been approved by the enrollment contractor but not yet entered into
PECOS at the time the moratorium is imposed. We proposed to revise this
paragraph to state that a temporary moratorium does not apply to any
enrollment application received by the Medicare contractor prior to the
date the moratorium is imposed.
In the moratoria that have been imposed, some providers and
suppliers have spent significant resources to prepare for enrollment
only to have their Form CMS-855 applications denied near the end of the
enrollment process because of the sudden imposition of a moratorium.
This has been especially problematic for HHAs--(1) whose Form CMS-855A
applications, at the time a moratorium is imposed, have been
recommended for approval by the contractor; (2) that have successfully
completed a state survey; and (3) whose applications and survey results
have been forwarded by the state to a CMS Regional Office for final
review. This entire process, much of which occurs after an application
is received by the contractor but before the application is finally
approved by the contractor, can take a substantial amount of time, and
the considerable resources the provider or supplier may have expended
by this point are effectively lost when CMS imposes a moratorium.
We stated that this has been an unintended consequence of the
moratoria. In our view, the overall objective of the moratoria--the
need to reduce the potential for fraud, waste, or abuse in certain
geographic areas--can be equally satisfied by not applying a moratorium
to applications submitted before the moratorium is imposed,
irrespective of whether they have been approved. Therefore, we believed
that our proposed ``prior to the moratorium date'' threshold was an
appropriate balance between limiting provider burden and protecting the
integrity of the Medicare program and the Trust Funds.
We also proposed in Sec. 424.570(a)(1)(iv) to change the term
``enrollment contractor'' to ``Medicare contractor.'' We believed the
latter term is more consistent with CMS' use of MACs.
We received the following comments regarding our proposed revisions
to Sec. 424.570.
Comment: A few commenters supported our proposed addition of Sec.
424.570(a)(1)(iv).
Response: We appreciate the commenters' support.
Commenter: A commenter opposed our proposed revision to Sec.
424.570(a)(1)(iii), stating that it would prevent an entity from
relocating its office into the moratoria area while maintaining its
existing service area. As a result, the moratoria would erect
unnecessary barriers to enhancement of care quality and block the cost
efficiencies that relocation could bring. The commenter recommended
that CMS permit a practice location change from outside the moratoria
area to inside the area when a provider can demonstrate that it
currently has the moratoria area as a service area.
Response: We respectfully disagree with this recommendation. As we
stated in the proposed rule, we see no difference between the
relocation of an office into a moratorium area and the opening of a
brand new practice location in the moratorium area. In both cases, an
additional site is being established in the moratorium area, something
the moratorium is designed to prevent. We also stress that Sec.
424.570 is and has been focused on the specific location of the office
site itself rather than on the larger area that the provider services.
Therefore, we believe this change is necessary and vital to protecting
the integrity of the Medicare program.
Comment: A commenter stated, for CMS' consideration, that the
current prohibitions against (1) the establishment of new HHA branch
offices and (2) allowing established provider organizations outside the
moratorium area to expand into the moratorium area can lock in some of
the providers that CMS seeks to address through its program integrity
initiatives. In other words, the commenter explained, the prohibitions
in some ways maintain the status quo rather than producing the desired
change. . The commenter added that it could also restrict the
opportunity for patients and referral sources to choose a more
compliant provider organization.
Response: We appreciate the commenter's suggestion. For reasons
previously stated, however, we believe that our revision of Sec.
424.570(a)(1)(iii) is consistent with the purpose of a temporary
enrollment moratorium and is warranted in order to protect the
integrity of the Medicare program.
After consideration of these comments, we are finalizing our
proposed revisions to Sec. 424.570.
14. Surety Bonds
Since 2009, certain DMEPOS suppliers have been required under Sec.
424.57(d) to obtain, submit, and maintain a surety bond in an amount of
at least $50,000 as a condition of enrollment. Paragraph (d)(5)(i)
states that the surety bond must guarantee that the surety will--within
30 days of receiving written notice from CMS containing sufficient
evidence to establish the surety's liability under the bond of unpaid
claims, CMPs, or assessments--pay CMS a total of up to
[[Page 47838]]
the full penal amount of the bond in the following amounts: (1) The
amount of any unpaid claim, plus accrued interest, for which the DMEPOS
supplier is responsible; and (2) the amount of any unpaid claims, CMPs,
or assessments imposed by CMS or the OIG on the DMEPOS supplier, plus
accrued interest. Paragraph (d)(5)(ii), meanwhile, states that the
surety bond must provide that the surety is liable for unpaid claims,
CMPs, or assessments that occur during the term of the bond.
We have specific procedures for collecting monies from sureties in
accordance with Sec. 424.57(d)(5) and have recouped several million
dollars via these procedures. However, we have encountered instances
where the surety has failed to submit payment to CMS, notwithstanding
its obligation to do so under both Sec. 424.57(d)(5) and the surety
bond's terms. We stated in the proposed rule that CMS should not permit
a DMEPOS supplier to use that particular surety when the latter has not
fulfilled its legal responsibilities to us as the obligee under the
surety bond. We thus proposed in new Sec. 424.57(d)(16) that CMS may
reject an enrolling or enrolled DMEPOS supplier's new or existing
surety bond if the surety that issued the bond has failed to make a
required payment to CMS in accordance with Sec. 424.57(d). This means
that we could reject any and all surety bonds furnished by the surety
to enrolling or enrolled DMEPOS suppliers under Sec. 424.57(d), not
just the surety bond(s) on which the surety refused to make payment. If
we reject a surety bond under proposed Sec. 424.57(d)(16), the
enrolling or enrolled DMEPOS supplier would have to obtain a bond from
a new surety in order to enroll in or maintain its enrollment in
Medicare.
We illustrated how Sec. 424.57(d)(16) would operate with this
example. Suppose a surety has issued surety bonds for DMEPOS Suppliers
W, X, Y, and Z, all of which are enrolled in Medicare. CMS sought to
collect from the surety on the bond issued for Supplier X, but the
surety failed to make payment. We would have the discretion to--(1)
reject the bonds for W, X, Y, and Z, thus requiring the suppliers to
obtain new bonds from a different surety; and (2) refuse to accept
future bonds issued to DMEPOS suppliers by the non-compliant surety.
In making a determination under items (1) and (2) in the previous
sentence, we proposed to consider the following factors:
The total number of Medicare-enrolled DMEPOS suppliers to
which the surety has issued surety bonds.
The total number of instances in which the surety has
failed to make payment to CMS.
The reason(s) for the surety's failure(s) to pay.
The percentage of instances in which the surety has failed
to pay.
The total amount of money that the surety has failed to
pay.
Any other information that CMS deems relevant to its
determination.
Although CMS would reserve the right to reject all of a surety's
existing bonds with Medicare-enrolled DMEPOS suppliers if the surety
failed to make even one required payment, CMS would take into account
the circumstances surrounding the surety and its failure to make
payment per the aforementioned factors.
Comment: A commenter opposed our proposed addition of Sec.
424.57(d)(16) on several grounds. First, the commenter contended that
the proposal changes the surety bond requirement under Sec. 424.57(d)
from a conditional obligation for the surety (that is, the surety must
currently pay only if, for instance, (1) the DMEPOS supplier's non-
payment of the claim; and (2) sufficient evidence to establish
liability being presented to the surety) to a demand obligation. The
commenter stated that the threat of rejection under Sec. 424.57(d)(16)
as a means of coercing sureties to pay legitimately disputed claims
effectively converts the bond to a demand obligation.
Second, the commenter stated that the surety should have an
opportunity before an impartial tribunal to present its defenses (and
those of the DMEPOS supplier) and explain why payment is not due.
Sureties are not supposed to advocate for the supplier but merely pay
the bond. The imposition of Sec. 424.57(d)(16) requires due process
for the surety.
Third, the commenter stated that sureties would respond to the
increased risk that Sec. 424.57(d)(16) poses by tightening its
underwriting requirements, meaning that fewer DMEPOS suppliers would be
able to obtain bonds.
Fourth, the commenter explained that Sec. 424.57(d)(16) would
effectively amount to a debarment of the surety; debarment authority,
however, is vested in the Department of Treasury.
Fifth, the commenter stated that Sec. 424.57(d)(16) does not
comply with the requirements of 31 CFR 223.17, which permits an agency
to refuse future bonds from a surety ``for cause''; this includes
failing to pay an administratively final bond obligation. Some of the
commenters contentions included--(1) CMS does not articulate its
procedures and ``for cause'' standards for declining to accept bonds in
an agency regulation or for declining bonds in specific cases; (2) the
provision does not define when a bond obligation becomes
administratively final under agency procedures, establish advance
notice, or give the surety an opportunity to cure or rebut; (3) the
provision does not allow the surety an opportunity to be heard, to
confront and cross-examine witnesses, to be represented by for counsel,
to submit evidence, or to have an impartial decision-maker.
Sixth, the commenter contended that there is a strong presumption
of judicial review of administrative actions; with respect to
prohibiting sureties from providing bonds, Congress has actually
required judicial involvement. The commenter stated that Sec. 9305(e)
prohibits a surety from providing further bonds if it has failed to pay
a final judgment. The commenter concluded because the proposed
regulation does not comply with 31 CFR 223.17, including rudimentary
due process protection, CMS may not exercise any authority to reject
bonds.
Response: We appreciate the commenter's concerns. After reviewing
these comments, and given the complexity of certain operational aspects
of our proposal, we are not finalizing proposed Sec. 424.57(d)(16) in
this rule.
Comment: A commenter stated that CMS should not implement Sec.
424.57(d)(16) without several prerequisites. First, CMS must create
tools to help sureties understand a supplier's history and also develop
a process for issuing claims against sureties. Second, the commenter
believed that since sureties likely have not seen or commented on this
proposal, CMS should issue a proposed rule specific to the surety bond
issues under discussion; this should include a process for filing a
claim against a surety. Third, the GAO should complete a study on the
entire surety bond process and its guidelines before CMS institutes the
policies addressed in this final rule. Fourth, CMS should clarify that
one bond can cover the requirement for both Medicare and Medicaid
programs for a particular location. The commenter stated that many
state Medicaid programs will not accept a supplier's bond if it shows
CMS as the Obligee but will require the supplier to obtain a second
bond showing Medicaid as the Obligee. Since the bonds are required to
be under the Obligee of CMS, the commenter stated, one bond should
cover the requirements for both programs.
[[Page 47839]]
Response: As previously stated, we are not finalizing proposed
Sec. 424.57(d)(16).
After consideration of the comments received, we are not finalizing
proposed Sec. 424.57(d)(16).
15. Reactivation
Under Sec. 424.540(a), a provider's or supplier's Medicare billing
privileges may be deactivated if the provider or supplier fails to--(1)
submit any Medicare claims for 12 consecutive calendar months; (2)
report a change to its Medicare enrollment information within 90
calendar days (or, for changes in ownership or control, within 30
days); or (3) furnish complete and accurate information and all
supporting documentation within 90 calendar days of receipt of
notification from CMS to submit an enrollment application and
supporting documentation, or to resubmit and certify the accuracy of
its enrollment information. To reactivate its billing privileges, the
provider or supplier must follow the requirements of Sec. 424.540(b).
Specifically--
Paragraph (b)(1) states that if the provider or supplier
is deactivated for any reason other than non-submission of a claim, the
provider or supplier must submit a new enrollment application or, when
deemed appropriate, recertify that the enrollment information currently
on file with Medicare is correct; and
Paragraph (b)(2) states that if the provider or supplier
is deactivated for non-submission of a claim, it must recertify that
the enrollment information currently on file with Medicare is correct
and furnish any missing information as appropriate.
We proposed to revise paragraph (b) in two ways. Paragraph (b)(1)
would state that in order for a deactivated provider or supplier to
reactivate its Medicare billing privileges, it must recertify that its
enrollment information currently on file with Medicare is correct and
furnish any missing information as appropriate. Paragraph (b)(2) would
state that notwithstanding paragraph (b)(1), CMS may for any reason
require a deactivated provider or supplier to submit a complete Form
CMS-855 application as a prerequisite for reactivating its billing
privileges.
There were several reasons for these proposed changes. First, the
existing language in Sec. 424.540(b)(1) had been a source of confusion
for providers and suppliers because it does not articulate what the
phrase ``when deemed appropriate'' means. There also is some repetition
between paragraphs (b)(1) and (2), for both indicate that a
recertification is acceptable. Our proposed version of paragraph
(b)(1), which combined parts of existing paragraphs (b)(1) and (2),
clarified that a provider or supplier may use recertification--
regardless of the deactivation reason--as a means of reactivation.
Second, we believed that CMS should have the discretion to require
at any time the submission of a complete Form CMS-855 reactivation
application irrespective of the deactivation reason. The Form CMS-855
captures information about the provider or supplier that, in the case
of a reactivation, would help us determine whether the provider or
supplier is still in compliance with Medicare enrollment requirements.
A recertification, meanwhile, generally only consists of a statement
from the provider or supplier that the information on file is correct
and, if necessary, the submission of Form CMS-855 pages containing
updated information. Therefore, the Form CMS-855 collects more
information than the recertification submission, and there may be
situations where CMS determines that a complete application must be
submitted. These could include, but are not limited to, the following:
The provider or supplier was deactivated for failing to
submit a claim for 12 consecutive months and has been deactivated for
at least 6 months.
The provider or supplier does not have access to internet-
based PECOS.
The provider or supplier was deactivated for failing to
report a change of information.
In these circumstances, respectively, the provider or supplier--(1)
has not submitted a claim for at least 18 months; (2) cannot view its
existing enrollment data and thus may be unable to determine the
accuracy of this information; and (3) previously failed to comply with
Medicare requirements by not timely reporting changed enrollment data.
Such instances, in our view, raise questions as to the validity of the
provider's or supplier's current enrollment information and possibly
its compliance with existing Medicare requirements, thus warranting a
complete Form CMS-855 if we deem it necessary. We stressed that we
could request a complete application in any reactivation situation, not
simply those outlined in this section. We solicited comment on whether
we should restrict the reasons for which CMS may request a complete
reactivation application and, if so, what those reasons should be.
While we proposed to revise Sec. 424.540(b)(1) and (2) as
previously described, we did not propose any changes to Sec.
424.540(b)(3).
We received no comments regarding our proposed changes to Sec.
424.540 and are therefore finalizing them.
16. Changes to Definition of Enrollment
We proposed several additional changes to 42 CFR part 424 to
address the general concept of enrollment as it pertains to the Form
CMS-855O (OMB Control No. 0938-1135). This form is used by physicians
and eligible professionals seeking to enroll in Medicare solely to
order and certify certain items or services and/or prescribe Part D
drugs.
We received no comments on any of the proposals outlined in this
section II.B.16. Given, however, our above-referenced non-finalization
of our revisions to Sec. 424.507 and our elimination of the Part D
enrollment requirement, we believe that many of these section II.B.16
proposed changes may be unnecessary. We are therefore finalizing,
modifying, and/or not finalizing these provisions as follows.
a. Definition of ``Enroll/Enrollment'' (Sec. 424.502)
We proposed several revisions of the existing definition of
``Enroll/Enrollment'' in Sec. 424.502.
First, the opening sentence of the definition currently specifies
that enroll/enrollment means the process that Medicare uses to
establish eligibility to submit claims for Medicare-covered items and
services, and the process that Medicare uses to establish eligibility
to order or certify Medicare-covered items and services. We proposed to
change this definition to specify that enroll/enrollment means the
process that Medicare uses to establish eligibility to submit claims
for Medicare-covered items and services, and the process that Medicare
uses to establish eligibility to order, certify, refer, or prescribe
Medicare-covered Part A or B services, items or drugs or to prescribe
Part D drugs.'' There were two reasons for this proposed change. One
was to align this definition with the language in our proposed
revisions to Sec. 424.507(a) and (b). (See section II.A.12. of this
final rule with comment period.) The second was to address in this
definition the enrollment provisions in Sec. 423.120(c)(6) relating to
Part D drugs.
Second, the current version of paragraph (2) of the definition of
``Enroll/Enrollment'' specifies that except for those suppliers that
complete the Form CMS-855O form, CMS-identified equivalent, successor
form or process for the sole purpose of obtaining eligibility to order
or certify Medicare-covered items and services, validating
[[Page 47840]]
the provider or supplier's eligibility to provide items or services to
Medicare beneficiaries. We proposed to change this to provide that
except for those suppliers that complete the Form CMS-855O, CMS-
identified equivalent, successor form or process for the sole purpose
of obtaining eligibility to order, certify, refer, or prescribe
Medicare-covered Part A or B services, items or drugs or to prescribe
Part D drugs, validating the provider's or supplier's eligibility to
provide items or services to Medicare beneficiaries. This revision was
to clarify that a supplier's completion of the Form CMS-855O solely to
obtain eligibility to order, certify, refer, or prescribe Medicare-
covered Part A or B services, items or drugs or to prescribe Part D
drugs, does not convey Medicare billing privileges to the supplier.
Third, and for reasons similar to those involving our proposed
change to paragraph (2) of the definition of ``Enroll/Enrollment,'' we
proposed to revise paragraph (4) thereof. The new version of paragraph
(4) would specify that except for those suppliers that complete the
Form CMS-855O, CMS-identified equivalent, successor form or process for
the sole purpose of obtaining eligibility to order, certify, refer, or
prescribe Medicare-covered Part A or B services, items or drugs or to
prescribe Part D drugs, granting the Medicare provider or supplier
Medicare billing privileges.
As we are not finalizing our proposed revisions to Sec. 424.507
and in light of the rescission of the Part D enrollment requirement, we
do not believe these proposed changes to the definition of ``Enroll/
Enrollment'' in Sec. 424.502 are necessary. We therefore decline to
finalize them.
b. Revision to Sec. 424.505
We also proposed to replace the language in Sec. 424.505 that
states ``to order or certify Medicare-covered items and services'' with
``to order, certify, refer, or prescribe Medicare-covered Part A or B
services, items or drugs or to prescribe Part D drugs.''
This was to clarify that completion of the Form CMS-855O does not
convey Medicare billing privileges to the supplier. For the same
reasons behind our non-finalization of our proposed revisions to the
``Enroll/Enrollment'' definition in Sec. 424.502, we are not
finalizing our proposed change to Sec. 424.505.
c. Revision to Sec. 424.510(a)(3)
Section 424.510(a)(3) currently specifies that to be enrolled
solely to order and certify Medicare items or services, a physician or
non-physician practitioner must meet the requirements specified in
paragraph (d) except for paragraphs (d)(2)(iii)(B), (d)(2)(iv),
(d)(3)(ii), and (d)(5), (6), and (9). We proposed to revise this to
specify that to be enrolled solely to order, certify, refer, or
prescribe Medicare-covered Part A or B services, items or drugs or to
prescribe Part D drugs, a physician or non-physician practitioner must
meet the requirements specified in paragraph (d) except for paragraphs
(d)(2)(iii)(B), (d)(2)(iv), (d)(3)(ii), and (d)(5), (6), and (9). This
proposal was intended to include within the purview of Sec.
424.510(a)(3) those suppliers who are enrolling via the Form CMS-855O
pursuant to Sec. 423.120(c)(6) or pursuant to our proposed revisions
to Sec. 424.507(a) and (b).
However, for reasons similar to those discussed previously, we are
not finalizing this change.
d. Revision to Sec. 424.535(a)
We also proposed to change the term ``billing privileges'' in the
opening paragraph of Sec. 424.535(a) to ``enrollment.'' The paragraph
would thus read: ``CMS may revoke a currently enrolled provider's or
supplier's Medicare enrollment and any corresponding provider agreement
or supplier agreement for the following reasons''. This was to clarify
that the revocation reasons in Sec. 424.535(a) apply to all enrolled
parties, including suppliers who are enrolled solely to order, certify,
refer, or prescribe Medicare-covered Part A or B services, items, or
drugs, or to prescribe Part D drugs; the reasons are not limited to
providers and suppliers that have Medicare billing privileges. Thus,
for instance, a Part D prescriber's Medicare enrollment may be revoked
if one of the revocation reasons in Sec. 424.535(a) applies.
We note also that the opening paragraph of Sec. 424.530(a), which
deals with denials, uses the term ``enrollment'' as well. Our change to
Sec. 424.535(a) would achieve consistency with Sec. 424.530(a) in
this regard.
Notwithstanding the non-finalization of the proposed changes to
Sec. 424.507 and the removal of the Part D enrollment requirement, we
believe that this proposed clarification to Sec. 424.535(a) remains
necessary. This is because some providers and suppliers (for example,
DMEPOS suppliers; physicians who certify home health services) are
still required under Sec. 424.507(a) to enroll in Medicare to order or
certify certain Medicare items or services. We are thus finalizing this
revision.
In addition, we are removing the phrase ``or supplier agreement''
from Sec. 424.535(a). We believe that the reference to ``supplier
agreement'' in this paragraph has caused confusion.
17. Miscellaneous Comments
We also received the following miscellaneous comments:
Comment: A commenter questioned whether a prescriber whose
enrollment has been denied or revoked and has been terminated on the
Medicare Individual Provider List will still qualify for provisional
fills and, if not, how they will be identified.
Response: This comment is outside the scope of this rule.
Comment: A commenter stated that there must be stricter
requirements that individuals must meet before being approved for
Medicare, Medicaid, or CHIP. The commenter stated that--(1) there
should be a marketing committee established to go into low-income
neighborhoods to educate individuals about government health insurance
assistance programs and to work to enroll individuals who meet the
requirements; and (2) after these individuals are enrolled into a
qualified health insurance program, there should be a follow-up
conducted every 3 months to ensure that the individual still meets the
requirements and that there is no increase in his or her income. The
commenter added that conducting daily license and background monitoring
will help individuals who are misusing their access to these federal
health insurance assistance programs. Moreover, the commenter stated
that there should be a fine for individuals who commit fraud relating
to a failure to report changes that have been made to their income or
even if they no longer need the assistance of their federal health
insurance.
Response: This comment is outside the scope of this rule.
Comment: A commenter commended CMS for continuing work on anti-
fraud issues in the proposed rule and recommended that the agency
emphasize the use of cost-effective anesthesia care provided by
certified registered nurse anesthetists (CRNAs). Anesthesiologist
medical direction reimbursement models, the commenter stated,
contribute to increased healthcare system costs without improving
access or quality. They also present fraud risk when medical direction
requirements are not met by the anesthesiologist submitting a claim for
such services. The commenter stated that CMS should--(1) direct
Medicare, Medicaid and CHIP programs to
[[Page 47841]]
consider such costs in developing and carrying out their systems for
anesthesia reimbursement, and to favor reimbursement systems that
support the most cost-effective and safe anesthesia delivery models,
such as for non-medically directed CRNA services; and (2) direct states
to eliminate from their Medicaid plans such requirements for medical
direction of CRNA services.
Response: This comment is outside the scope of this rule.
Comment: A commenter stated that the proposed rule does not specify
how long CMS might suspend payments to wrongly accused providers. The
commenter requested further clarification on the timeline CMS envisions
for due process in cases where payments are suspended due to suspected
fraud.
Response: This comment is outside the scope of this rule.
Comment: A commenter expressed concern about providers and
suppliers repeatedly changing their names and identities to avoid
sanctions. The commenter suggested that if the provider is about to be
revoked due to a questionable situation, it should be allowed 30 days
to change its practices or procedures. If it fails to comply with CMS
regulations--(1) its enrollment should be revoked; and (2) the revoked
status should apply to the name of the provider as well as everyone in
management, billing, and any other identifications regarding that
business. This would prevent the owners from filing for a new federal
employee identification number (FEIN), a new business license from the
state, and ``opening'' a new business in the same location. If CMS
could develop this ability, the commenter stated, it could track this
type of fraudulent activity and prevent such situations from happening.
Response: We appreciate these suggestions and will take them into
consideration as we continue to explore additional means of protecting
the Trust Funds from improper behavior.
Comment: A commenter stated that when seeking enrollment in
Medicare, a provider should furnish supporting documentation to
establish its identity and the business that it is conducting. This
could include--(1) documentation of state licensure to practice and/or
state business licensure; (2) federal payroll information proving that
the provider has employees or is paying payroll taxes; (3) receipts of
sales for services to customers that are not being billed through CMS;
(4) any and all legal matters that are being investigated for fraud or
misrepresentation; (5) for practicing physicians, a copy of his or her
malpractice insurance, and a report of the number of malpractice cases
pending or settled on his or her behalf; and (6) a background report
from the OIG on all employees and managing partners that will be
involved in the billing process. The commenter stated that by providing
this additional information, CMS can more easily determine the nature
and character of the individual or business applying for enrollment.
Response: We appreciate these suggestions and will take them into
consideration as we continue to explore additional means of protecting
the Trust Funds from improper behavior.
Comment: A commenter stated that the high burden of the proposed
rule could force innocent providers and suppliers to downscale or close
their practices altogether, which could cause access to care issues.
Another commenter stated that the final rule should focus on
organizations with historical integrity issues versus a ``wide swath''
approach.
Response: We appreciate these concerns. As previously explained,
however, we have, among other things--(1) modified our affiliation
disclosure provisions; and (2) consistently emphasized in this final
rule with comment period that we will exercise our denial and
revocation authorities in a cautious, careful, and judicious manner,
and not as a routine matter of course.
Comment: A commenter expressed concern about the disclosure of SSNs
as part of the enrollment process, citing the need to protect providers
and suppliers and their owners and managers against identity theft. The
commenter suggested that CMS--(1) consider the need to eliminate SSN
disclosure; (2) work with key stakeholders to integrate Medicare/
Medicaid/NPI enrollment into PECOS, thereby reducing the need for
multiple submissions of SSNs to different programs and eliminating
duplicative work for providers, CMS, contractors and the states; and/or
(3) consider establishing a pseudo-identifier in lieu of the NPI.
Response: We appreciate these suggestions and will take them into
consideration as we continue to explore additional means of protecting
the Trust Funds from improper behavior.
Comment: A commenter stated that, with more than 60,000 DMEPOS
suppliers enrolled in Medicare, CMS should discontinue its practice of
allowing Medicare beneficiaries to submit claims for DMEPOS services.
Response: This comment is outside the scope of this rule.
Comment: A commenter requested that CMS clarify which NPI is
entered into the ordering and referring field of the 837P by a locum
tenens physician.
Response: This comment is outside the scope of this rule.
Comment: A commenter recommended that CMS discontinue permitting
physicians and other practitioners who have their Medicare billing
privileges suspended from ordering, certifying, or prescribing in the
Medicare program during the period of said suspension.
Response: This comment is outside the scope of this rule. We also
note that, under current policy, Medicare billing privileges are not
``suspended'' but are instead either denied or revoked. However,
Medicare payments may be suspended under Sec. 405.371.
Comment: A commenter recommended that CMS implement the necessary
edits within its claims processing systems to link a claim with a
Medicare order or certification for DMEPOS or lab services with the
name and NPI of the practitioner who furnished the service. The
commenter believed that this change would prevent suppliers from
submitting a claim with the name and NPI of a physician that has not
seen the patient.
Response: This comment is outside the scope of this rule.
Comment: A commenter requested clarification regarding the
rationale for allowing Medicare beneficiaries to submit--(1) DMEPOS
claims from suppliers that are not accredited; and (2) the CMS-1490
without the name and NPI of the ordering physician. With the latter,
the commenter requested an explanation for why CMS does not have
policies for its contractors to request that name and NPI of the
physician, recommended that contractors require beneficiaries to submit
this information, and that contractors verify this information before
paying a Medicare claim.
Response: This comment is outside the scope of this rule.
Comment: A commenter requested clarification as to whether a
beneficiary can submit a claim for a DMEPOS item when the DMEPOS
supplier is not enrolled in Medicare. The commenter stated that CMS
permits this practice.
Response: This comment is outside the scope of this rule.
Comment: A commenter sought clarification regarding--(1) whether a
beneficiary can be paid for DMEPOS when the item or service is obtained
from a non-Medicare supplier or is ordered or referred from an
unenrolled physician; (2) how contractors verify whether the ordering
physician is Medicare-enrolled when the information about the ordering
[[Page 47842]]
physician is not on the Medicare beneficiary claim form; (3) whether
Medicare will pay a beneficiary for services when the DMEPOS supplier
does not have a valid supplier number; (4) the number of beneficiary
DMEPOS claims paid in 2015; and (5) whether CMS' new policies for
Medicare beneficiaries will prevent beneficiaries from submitting
claims for off-the-shelf DMEPOS or items purchased at a store that does
not participate in Medicare.
Response: These comments are outside the scope of this rule.
Comment: A commenter urged CMS and its contractors to structure
their teams to measure and promote continuity with provider
organizations. The commenter stated that it is important for CMS and
its contractors to build solid working relationships with local
providers and organizations that serve Medicare beneficiaries.
Response: This comment is outside the scope of this rule.
Comment: A commenter stated that the proposed rule unfairly
penalizes all providers and suppliers even when there is no risk of
fraud, abuse and waste. Specifically, the proposal--(1) increases the
administrative burden and complexity of the enrollment process; (2)
severely penalizes providers for inadvertent errors without any
recourse for them; (3) potentially exceeds and contravenes the
statutory authority granted to CMS through the Affordable Care Act; (4)
allows CMS to pierce to corporate veil and ignore corporate
formalities; and (5) creates a de facto exclusion with no accompanying
due process. In particular, the commenter stated that due process for a
denied or revoked provider or supplier under the rule is impossible
within the existing appeals process. The commenter contended that the
current appeals process furnishes too short a timeframe for providers
and suppliers to compile and submit evidence of compliance, does not
permit expedited appeals (which could severely hurt cash flow), and
contains no process for timely restoring a provider's or supplier's
enrollment and for reversing any concomitant overpayment demand or
recalling any debt referral. The commenter made two specific
recommendations concerning the appeals process. First, CMS should
modify its existing appeals processes so that providers and suppliers
can effectively appeal denials and revocations. Second, in the case of
an overpayment demand for services billed from the retroactive
effective date of a revocation, the overpayment obligation should be
stayed to allow providers and suppliers to utilize the appeals process.
Response: This comment is outside the scope of this rule.
Comment: A commenter recommended that CMS eliminate the 36-month
rule under Sec. 424.550(b). The commenter stated that this would
enable compliance-oriented providers to make business decisions that
are in the best interests of their operations, their patients and
communities, and in some instances, their institutional connections.
Response: This comment is outside the scope of this rule.
Comment: A commenter stated that it strongly supported the proposed
rule. The commenter explained that CMS must ensure that only qualified
providers and suppliers that meet and maintain compliance with the
program's participation requirements are enrolled. The screening and
enrollment processes now in place because of the Affordable Care Act,
the commenter added, help serve that goal, and the enhanced policies,
authorities, and requirements described in the proposed rule would do
even more to enhance these processes.
Response: We appreciate the commenter's support.
Comment: A commenter recommended that CMS consider sharing
information with other public and private payers concerning the actions
taken under this rule. For example, if CMS revokes or denies an
enrollment based on a risk of fraud, waste, or abuse, it should share
that information with other payers, including Medicare Part C or D
contractors, state Medicaid managed care programs, and private health
insurers. Such information-sharing, the commenter stated, is critical
to the effective and timely prevention of health care fraud and abuse
throughout America's health care system.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter stated that the only factor CMS should use to
determine whether an individual or organization is eligible to
participate in Medicare is verifiable proof of that party's fraudulent
or criminal activity.
Response: We respectfully disagree. We must take steps to protect
the Medicare program, its beneficiaries, and the Trust Funds against
wasteful and abusive behavior and potential threats (which can
eventually materialize into very serious harm) to the same extent we do
against actual fraudulent and criminal activity.
Comment: A commenter stated that this and other regulations will
continue to discourage physicians from wanting to see Medicare and
Medicaid patients. The commenter added that so long as physicians
``follow the rules,'' they should not have to report their personal
investments to the public.
Response: We respectfully disagree that this rule will discourage
physicians from seeing Medicare and Medicaid patients. We have issued
other provider enrollment regulations in previous years, yet the number
of enrolled physicians continues to increase. Although we are unclear
which rules and personal investments the commenter is referring to, we
believe that our new authorities in this final rule with comment period
will aid our program integrity efforts without unduly burdening the
vast majority of honest and legitimate providers and suppliers.
Comment: A commenter encouraged the streamlining of the process
through which MA plans are notified about providers who are excluded,
sanctioned, or opted-out of Medicare. The commenter believed this will
help ensure that MA plans are not paying or including these providers
in their networks. The commenter made several other recommendations.
First, CMS should amend its look-back periods for both participating
and non-participating providers. Participating providers should have a
1 year look-back period due to contracting constraints; non-
participating providers be given a 3-year look-back period. The
commenter believed these changes would replace the current 7-year look-
back period. Second, if a provider opted-out of Medicare or Medicaid
(or both), a private fee agreement between the provider and member
should be mandated for a provider to bill the member for any services
rendered. Third, CMS should make clear that a provider opting out of
Medicare or Medicaid cannot otherwise bill the member without a private
fee agreement and that there will consequences for doing so.
Response: This comment is outside the scope of this rule.
Comment: A commenter stated that CMS' proposed provider enrollment
standards are mostly proper and effective program integrity measures,
though the commenter added several recommendations and observations.
First, any program integrity measure must be targeted to the fraud
matter at issue; random, untargeted measures could harm to Medicare
beneficiaries and all other stakeholders. Second, anti-fraud
initiatives should be evidence-based with a demonstrated return on
investment. Third, stakeholder support is essential to achieving
success in
[[Page 47843]]
program integrity; program integrity measures should be developed in a
transparent manner that allows for public input. Fourth, there must be
clear legal authority for any program integrity activity. Fifth, anti-
fraud measures should not erect a barrier to appropriate health care
access. Sixth, any program integrity initiative should properly
distinguish fraud from unintentional noncompliance. Finally, the
outcome of program integrity measures should be reliable with no
``innocent victims'' resulting.
Response: We appreciate these suggestions and observations and will
consider them as we continue our efforts to further strengthen Medicare
program integrity.
Comment: CMS refers to denials, revocations, and terminations of
enrollment in the rule. A commenter questioned whether these include
actions that have been reversed on appeal and/or informal review. The
commenter recommended that such actions be limited to those that are
final and/or those that CMS has not reversed.
Response: We are unclear as to the specific provisions to which the
commenter is referring, though we believe the reference is to Sec.
424.519. For reasons previously discussed, we believe that denials,
revocations, and terminations qualify as disclosable events even if
they are under appeal.
Comment: A commenter noted that CMS referred in the proposed rule
to Sec. 424.535(a)(8)(ii), which permits revocation if the provider
``has a pattern or practice of submitting claims that fail to meet
Medicare requirements.'' The commenter requested that CMS define a
``pattern'' of submitting noncompliant claims.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period. We refer the commenter to
our discussion of this provision in the previously mentioned December
5, 2014 final rule, which finalized Sec. 424.535(a)(8)(ii).
Comment: A commenter requested that CMS furnish guidance on how
rejected Form CMS-855 applications will be treated as opposed to Form
CMS-855 application denials. The commenter did not believe that an
inadvertent clerical error in leaving a data element on the Form CMS-
855 incomplete should be considered a denied enrollment.
Response: We believe this comment is outside the scope of this
rule, though we note that existing procedures regarding rejected and
denied applications can be found in CMS Publication 100-08, Program
Integrity Manual, Chapter 15.
Comment: A commenter stated that CMS should establish processes to
ensure that providers and suppliers--(1) promptly receive notice of
uncollected debt (for example, sending the notices to multiple
addresses in the provider's or supplier's enrollment record or creating
a database that providers and suppliers can query to determine whether
CMS believes an uncollected debt is owed to CMS or a state Medicaid
agency); and (2) are given a reasonable amount of time to repay a debt
(for example, 60 days) and that the debt need not be reported as
uncollected debt until that time period has elapsed.
Response: We appreciate these suggestions and observations and will
consider them as we continue our efforts to further strengthen Medicare
program integrity.
Comment: A commenter stated that CMS should avoid broadly painting
clinicians as perpetrators of fraud, for this fundamentally damages the
clinician-patient relationship. It also makes it difficult to ensure
that patients will follow through on recommendations provided by their
treating professional.
Response: While we appreciate this comment, we have an obligation
to protect Medicare, its beneficiaries, and the Trust Funds against
improper activities. This rule is, accordingly, directed towards
parties that engage in such behavior.
Comment: A commenter stated that CMS should revoke all of a
supplier's NPIs if an owner is convicted of fraud in a court of law.
Response: We appreciate this comment and note that several of our
finalized provisions will permit CMS to expand a revocation to a
provider's or supplier's other locations and enrollments.
Comment: A commenter stated that CMS should--(1) automatically
terminate a supplier that has not submitted a claim in 18 months; and
(2) consider requiring suppliers to maintain all enrollment records
electronically via PECOS. The commenter believed that the latter would
better enable suppliers to periodically review their enrollment records
to ensure their accuracy.
Response: We appreciate these suggestions and observations and will
consider them as we continue our efforts to further strengthen Medicare
program integrity.
Comment: A commenter stated that while making certain that
suppliers maintain accurate enrollment information, CMS should be
similarly required to ensure that PECOS records are up to date. The
commenter recommended that a timeframe (preferably 30 days) be
established in which CMS must confirm that online records are up to
date and accurate.
Response: We appreciate these suggestions and observations and will
consider them as we continue our efforts to further strengthen Medicare
program integrity.
Comment: A commenter recommended that the effective date of
enrollment be the date the supplier meets accreditation and licensure
requirements for a particular location. The commenter stated that
because this rule may significantly increase the volume of Form CMS-
855S applications received, CMS should ensure that any delays resulting
therefrom are considered in establishing a date.
Response: We believe that the commenter's first comment is outside
the scope of this final rule with comment period. Regarding the second
comment, we understand the concerns about workload, and we will take
steps to ensure that applications are processed as promptly as
possible.
Commenter: A commenter stated that CMS and its contractors should
have a defined timeframe in which various processes related to
enrollment applications must be completed; the commenter cited, as
examples, a new application being processed within 60 days and a change
of information or ownership being processed in 90 days. The commenter
stated that such requirements should extend to Medicaid programs,
adding that--(1) some state Medicaid programs take up to 9 months to
process a change of address; and (2) suppliers are not usually notified
that their application has been processed and approved and that state
programs should be required to do this.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter stated that CMS should (1) clarify how it will
treat health care professionals whose Medicare payments were improperly
suspended because they did not actually commit fraud; and (2) make
certain that health care professionals whose Medicare enrollment is
revoked or denied have the opportunity to discuss their matter with
CMS.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter stated that the costs associated with
implementing and forcing adherence to the proposed rule outweigh the
potential benefits to CMS. The vast majority of information will be
useless to CMS, the commenter
[[Page 47844]]
contended, and not worth the time it takes for CMS to review the data.
The commenter added that the rule's requirements--(1) could push more
physicians away from CMS; and (2) are impossible to comply with,
difficult to enforce, and most likely unconstitutional.
Response: We disagree that the costs associated with this rule will
outweigh the benefits to CMS. CMS has an obligation to protect the
Medicare program, the Trust Funds, and beneficiaries, and we believe
this rule will go far towards achieving these objectives. Also, and for
reasons stated previously, we do not believe this rule--(1) will
discourage physicians from enrolling and remaining in Medicare; or (2)
lack legal authority. As we are unclear which provisions the commenter
believes are impossible to comply with and difficult to enforce, we are
unable to address this particular comment.
Comment: A commenter recommended that CMS either--(1) incorporate
data collected by the Council for Affordable Quality Healthcare (CAQH)
ProView portal system for enrollment; or (2) adopt a system that has
usability similar to the CAQH portal. CMS could use the CAQH data as a
starting point (subject to review by the physician and a CMS credential
verification contractor) to reduce the amount of information doctors
must provide to CMS. The commenter stated that CMS' adoption of such a
system would--(1) enable physicians and their practices to spend less
time and resources on enrollment, focus more on accurately disclosing
information that may help CMS discover fraud and abuse, and spend more
time treating patients; and (2) improve the overall enrollment process
by simplifying and increasing the usability of the current enrollment
system.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter stated that the proposed rule did not specify
whom within CMS or its contractors will apply the outlined factors and,
if applicable, deny or revoke enrollment. Given the potential
consequences of a denial or revocation, the commenter continued, CMS
should require contractors to escalate cases to the CMS Regional Office
for assessment of the factors and final denial or revocation actions.
Response: We appreciate the commenter's concern. This information
may be issued via subregulatory guidance.
Comment: A commenter stated that there should be a ``phase-in
period'' or a stay on edits within CMS' systems to enable providers to
come into compliance with the proposed requirements.
Response: We respectfully disagree that the implementation of this
rule's provisions should be delayed beyond the timeframes prescribed
therein. This is particularly true concerning our new denial and
revocation reasons, which are necessary for the protection for the
Medicare program, its beneficiaries, and the Trust Funds.
Comment: A commenter stated that CMS should clarify--(1) which
penalties would apply to specific types of offenses; and (2) the amount
of time a potential ban from the Medicare program would be.
Response: We are unable to provide such specifics in this final
rule with comment period. The imposition of a denial, revocation, or
termination and the length of any subsequent reenrollment bar will
depend upon the particular facts of the situation.
Comment: A commenter stated that it agreed that some of the
proposed denial and revocation reasons regarding affiliations may be
appropriate, but urged CMS implement a materiality threshold to avoid
denials and revocations for immaterial deficiencies that do not
adversely affect program integrity.
Response: We are unclear as to the specific denial and revocation
reasons to which the commenter believes a materiality standard should
be applied. Nonetheless, we emphasize that many of our existing and
proposed denial and revocation reasons contained regulatory-prescribed
criteria that CMS must carefully take into account before taking
action; generally speaking, the degree of the provider's or supplier's
conduct is considered in each case.
Comment: Several commenters stated that if CMS plans to use
contractors to implement this rule, it should avoid creating a ``bounty
system'' that inappropriately incentivizes contractors (for example,
based on the volume or percentage of providers whose enrollments or
revalidations they deny or revoke).
Response: CMS contractors are not rewarded or otherwise given
financial contractual incentives for denying or revoking provider or
supplier enrollments or a percentage thereof.
Comment: A commenter stated that publicly-traded companies should
not be required to report any direct or indirect ownership interests
held by mutual funds or other large investment or stock-holding
vehicles on the Form CMS-855. Since the exact percentage of such
interests can fluctuate daily and because this data can be very
difficult to obtain, it is unreasonable and burdensome for publicly-
traded providers or suppliers to track and report such changes.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter recommended that CMS consider implementing
similar reporting obligations under Medicare and Medicaid. The
commenter believed that consistency between the Medicare and Medicaid
programs would--(1) help ensure that the enhanced program integrity
protections in this rule apply to both programs; and (2) reduce
providers' compliance burden through uniform reporting requirements,
even if said requirements reflects the regulatory schemes of the more
stringent state Medicaid agencies.
Response: We appreciate this comment but believe it is outside the
scope of this final rule with comment period.
Comment: A commenter suggested that CMS specifically include
notification given to the state confirming the provider's compliance
with the conditions of participation as a mitigating circumstance in
determining whether a revocation under Sec. 424.535 is warranted.
Inclusion of this factor would reduce the concerns of compliant home
care organizations regarding the proposed rule.
Response: We appreciate this comment but believe it is outside the
scope of this rule.
III. Provisions of the Final Rule With Comment Period
This final rule with comment period incorporates the provisions of
the proposed rule. Those provisions of this final rule with comment
period that differ from the proposed rule are as follows:
We are not finalizing our proposed changes to Sec. Sec.
424.505, 424.507, 424.510, or to the definition of Enroll/enrollment in
Sec. 424.502.
Changes to ``Disclosure of affiliations'' (Medicare Sec.
424.519 and Medicaid Sec. 455.107):
++ We are adding a definition of ``disclosable event'' to
Sec. Sec. 424.502 and 455.101 that will apply to, respectively,
Sec. Sec. 424.519 and 455.107. A ``disclosable event'' under these
definitions means any of the following:
--Currently has an uncollected debt to Medicare, Medicaid, or CHIP,
regardless of: the amount of the debt;
[[Page 47845]]
whether the debt is currently being repaid (for example, as part of a
repayment plan); or whether the debt is currently being appealed;
--Has been or is subject to a payment suspension under a federal health
care program (as that latter term is defined in section 1128B(f) of the
Act), regardless of when the payment suspension occurred or was
imposed;
--Has been or is excluded by the OIG from participation in Medicare,
Medicaid, or CHIP, regardless of whether the exclusion is currently
being appealed or when the exclusion occurred or was imposed; or
--Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or
terminated, regardless of: (i) The reason for the denial, revocation,
or termination; (ii) whether the denial, revocation, or termination is
currently being appealed; or (iii) when the denial, revocation, or
termination occurred or was imposed.
++ We are adding the following language to the end of the opening
paragraph of Sec. 424.519(a): ``to the definition of disclosable event
in Sec. 424.502:'' We are making a similar change to the opening
paragraph of Sec. 455.107(a) with respect to Sec. 455.101.
++ Proposed Sec. Sec. 424.519(a)(1)(ii) and 455.107(a)(1)(ii) are
being finalized as ``Civil money penalties imposed under this title''.
++ Proposed Sec. Sec. 424.519(a)(1)(iii) and 455.107(a)(1)(iii)
are being finalized as ``Assessments imposed under this title.''
++ We are revising the entirety of Sec. 424.519(b) to now read as
set out in the regulatory text.
--In Sec. Sec. 424.519(f) and 455.107(f), we are changing the term
``action'' to ``disclosable event.''
--We are not finalizing proposed Sec. 424.519(h)(1) and (h)(2)(i).
--Proposed Sec. 424.519(h)(2)(ii) is being finalized as new paragraph
(h) ``Duplicate data''.
++ We are revising 455.107(b) to specify the following:
++ Under paragraph (b)(1)(i), a state, in consultation with CMS,
must select one of the two options identified in paragraph (b)(2) for
requiring the disclosure of affiliation information.
++ Under paragraph (b)(1)(ii), a state may not change its selection
under paragraph (b) after it has been made.
++ Paragraph (b)(2)(i) describes the first option. Specifically, in
a state that has selected this option, a provider that is not enrolled
in Medicare but is initially enrolling in Medicaid or CHIP (or is
revalidating its Medicaid or CHIP enrollment information) must disclose
any and all affiliations that it or any of its owning or managing
employees or organizations (consistent with the terms ``person with an
ownership or control interest'' and ``managing employee'' as defined in
Sec. 455.101) has or, within the previous 5 years, had with a
currently or formerly enrolled Medicare, Medicaid, or CHIP provider or
supplier that has a disclosable event (as defined in Sec. 455.101).--
++ Paragraph (b)(2)(ii) describes the second option. Specifically,
in a state that has selected this option, upon request by the state, a
provider that is not enrolled in Medicare but is initially enrolling in
Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment
information) must disclose any and all affiliations that it or any of
its owning or managing employees or organizations (consistent with the
terms ``person with an ownership or control interest'' and ``managing
employee'' as defined in Sec. 455.101) has or, within the previous 5
years, had with a currently or formerly enrolled Medicare, Medicaid, or
CHIP provider or supplier that has a disclosable event (as defined in
Sec. 455.101). The state will request such disclosures when it, in
consultation with CMS, has determined that the initially enrolling or
revalidating provider may have at least one such affiliation.
++ In Sec. 455.107(d), we are adding the language ``in
consultation with the Secretary'' at the end thereof.
++ We are not finalizing proposed Sec. 455.107(h) and are
redesignating Sec. 455.107(i) as Sec. 455.107(h). We are changing the
heading of Sec. 424.530(a)(13) from ``Affiliation that poses undue
risk of fraud'' to simply ``Affiliation that poses an undue risk''.
In Sec. 424.530(a)(14), we are changing the phrase
``particular State Medicaid program'' to ``State Medicaid program''. We
are also adding ``(as that term is defined in Sec. 424.502)'' to Sec.
424.530(a)(14)(i)(B) as a reference to the regulatory definition of
final adverse actions.
In Sec. 424.535(a)(12), we are changing ``particular
Medicaid program'' to ``State Medicaid program''. Also, we are changing
the term ``terminate'' to ``revoke'' in Sec. 424.535(a)(12)(ii) to
clarify that CMS revokes enrollments.
In Sec. 424.535(a)(17), we are adding the word
``appropriately'' before ``refers''. Also, we are adding the language
``(to the extent this can be determined)'' to the end of the factors
enumerated in Sec. 424.535(a)(17)(ii) and (iii).
In Sec. 424.535(a)(20), we are modifying the beginning of
the section to read as set out in the regulatory text.
We are revising Sec. 405.425(i) to state that the
physician or practitioner who has not been excluded under sections
1128, 1156 or 1892 of the Act and whose Medicare enrollment is not
revoked under Sec. 424.535 of this chapter may order, certify the need
for, prescribe, or refer a beneficiary for Medicare-covered items,
services, and drugs, provided the physician or practitioner is not
paid, directly or indirectly, for such services (except as provided in
Sec. 405.440).
In Sec. 405.425(j), we are changing the language ``items
and services'' to ``items, services, and drugs''. Also, we are revising
the closing language of Sec. 405.425(j) by revising the last clause of
the paragraph to clarify the compliance with and the effective date of
the exclusion.
We are not finalizing proposed Sec. 424.57(d)(16).
We are adding a new paragraph (c) to Sec. 405.800 that
discusses additional years applied to a provider's or supplier's
existing reenrollment bar under Sec. 424.535(c)(2)(i) and the
notification requirements associated therewith. These requirements
apply only to the years added to the existing reenrollment bar under
Sec. 424.535(c)(2)(i) and not to the original length of the
reenrollment bar, which is not subject to appeal.
We are revising Sec. 498.3(b)(17) as follows:
++ The existing version of paragraph (b)(17) will be redesignated
as paragraph (17)(i).
++ New paragraph (b)(17)(ii) will address the addition of years to
a provider's or supplier's existing reenrollment bar;
++ New paragraph (b)(17)(iii) will address appeals concerning Sec.
424.535(c)(3).
IV. Collection of Information Requirements
Under the Paperwork Reduction Act of 1995, we are required to
provide 60-day notice in the Federal Register and solicit public
comment before a collection of information requirement is submitted to
the Office of Management and Budget (OMB) for review and approval. In
order to fairly evaluate whether an information collection should be
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act
of 1995 requires that we solicited comment on the following issues:
The need for the information collection and its usefulness
in carrying out the proper functions of our agency.
The accuracy of our estimate of the information collection
burden.
[[Page 47846]]
The quality, utility, and clarity of the information to be
collected.
Recommendations to minimize the information collection
burden on the affected public, including automated collection
techniques.
In the proposed rule, we estimated a total information collection
burden of $285 million in each of the first 3 years of this rule. Most
of this cost stemmed from our affiliation proposal (Sec. Sec. 424.519
and 455.107), the principal burden of which would come from--(1) all
initially enrolling and revalidating providers and suppliers having to
completion of the applicable enrollment application sections; and (2)
the time involved in researching data. We solicited public comment and
feedback regarding these burdens.
This collection of information section will address the costs
associated with this rule. The regulatory impact analysis section of
this final rule with comment period will analyze the rule's savings.
A. ICRs Related to Affiliations (Sec. Sec. 424.519 and 455.107)
Proposed Sec. Sec. 424.519 and 455.107 required that a Medicare,
Medicaid, or CHIP provider or supplier disclose information about
present and past affiliations with certain currently or formerly
enrolled Medicare, Medicaid, or CHIP providers and suppliers. Medicare
providers and suppliers will furnish this information via the paper or
internet-based version of the Form CMS-855 applications, which will be
updated to collect this data.
Though the specific vehicle for collecting affiliation information
a from Medicaid and CHIP providers and suppliers is left to the state's
discretion, we anticipate that the information will be provided on an
existing enrollment form or through a separate form created by the
state. The principal burden involved with this collection will be the
time and effort needed to--(1) obtain this information; and (2)
complete and submit the appropriate section of the applicable form.
We proposed that the data would be submitted upon initial
enrollment and revalidation; new affiliations and changes in current
affiliations would also have to be reported. As discussed in section
II.A. of this final rule with comment period, and with the exception of
the first option under Sec. 455.107(b), we are now restricting the
reporting requirements to instances where CMS or the state, as
applicable, requests the information. The following estimates in
section V.A. of this final rule with comment period reflect our final
policies for Sec. Sec. 424.519 and 455.107.
1. Medicare
We estimated in the proposed rule that it would take each provider
or supplier an average of 10 hours to obtain and furnish this
information. Although some commenters, as described later in section,
expressed concern with the 10-hour estimate for obtaining and
furnishing this data after a CMS request, we are retaining our estimate
of 10 hours. We believe that a typical provider or supplier's effort to
secure the data, coupled with furnishing the information on the
appropriate Form CMS-855 application, will require, on average, 10
hours or less in most cases. It is true that for large providers or
suppliers, the average time expenditure may be higher than 10 hours;
for small providers and suppliers, however, the average time
expenditure will likely be considerably less than 10 hours. Therefore,
we believe that 10 hours remains a reasonable estimate for purposes of
the information collection requirement (ICR) cost burden projection.
We cannot conclusively predict the number of instances in which CMS
will request the reporting of disclosable affiliations under Sec.
424.519 in each of the first 3 years of the rule. However, for purposes
of this information collection request only, and as we indicated
previously in this rule, we believe that average of 2,500 requests per
year is a reasonable projection. This results in an estimated annual
hour burden of 25,000 hours.
Per our experience, we believe that the reporting provider's or
supplier's administrative staff (for example, officer managers and
support staff) will be responsible for securing and listing affiliation
data on the Form CMS-855. According to the most recent wage data
provided by the Bureau of Labor Statistics (BLS) for May 2018, the mean
hourly wage for the general category of ``Office and Administrative
Support Occupations'' is $18.75 per hour (see http://www.bls.gov/oes/current/oes_nat.htm#430000). With fringe benefits and overhead, the per
hour rate is $37.50. Given the foregoing, and using this per hour rate,
we estimate the annual ICR burden for initially enrolling and
revalidating providers and suppliers from Sec. 424.519 to be 25,000
hours (2,500 requests x 10 hours) at a cost of $937,500 (25,000 hours x
$37.50).
2. Medicaid and CHIP
We cannot project the number of instances in which states will
request the reporting of disclosable affiliations under Sec. 455.107.
This is particularly true given that, under revised Sec. 455.107(b)--
(1) states will have two options for requesting affiliation
information, and we do not know which states will select which
alternatives; and (2) we do not know when each state will update its
applicable data collection mechanism to reflect the Sec. 455.107(b)
requirements.
3. Collection of Information From States
As we stated in the proposed rule, it is possible that states may
eventually be required to report to CMS certain information regarding
its processing of data submitted under Sec. 455.107. This may include,
for example, the number of applications in which an affiliation was
reported and the number of cases in which the state determined that an
affiliation posed an undue risk. However, we are unable to estimate the
possible ICR burden because we do not know whether, to what extent, and
by what vehicle data concerning Sec. 455.107 will be reported to CMS.
4. Total Burden
We estimate a total annual ICR burden of our affiliation disclosure
requirements of 25,000 hours at a cost of $937,500.
B. ICRs Related to Our Proposed and Finalized Denial Reasons in Sec.
424.530 and Revocation Reasons in Sec. 424.535
We do not anticipate any collection burden resulting from our
revisions to the denial authorities in Sec. 424.530 or the revocation
authorities in Sec. 424.535. An appeal from a denial of enrollment or
an appeal from a revocation of enrollment are both exempt from the PRA.
There are no other potential sources of ICR that would result from the
final rule's changes to the denial or revocation authorities.
C. ICRs Related to Changes in Maximum Reenrollment Bars (Sec.
424.535(c)) and the Establishment of Reapplication Bars (Sec.
424.530(f))
We do not anticipate any collection burden resulting from our
revisions to Sec. 424.535(c). The burden, in fact, may actually
decrease because certain providers and suppliers may be barred from
Medicare for a longer period of time and thus will submit Form CMS-855
applications less frequently. In addition, we do not anticipate any
collection burden resulting from our addition of Sec. 424.530(f).
Additional applications will not be submitted because of this
provision.
D. Documentation
We revised Sec. 424.516(f) to state that a provider or supplier
furnishing a Part A
[[Page 47847]]
or B service, item, or drug, as well as the physician or, when
permitted, eligible professional who ordered, certified, referred, or
prescribed the Part A or B service, item, or drug must maintain
documentation for 7 years from the date of the service and furnish
access to that documentation upon a CMS or Medicare contractor request.
The burden associated with the requirements in Sec. 424.516(f)
will be the time and effort necessary to both maintain documentation on
file and to furnish the information upon request to CMS or a Medicare
contractor. While the requirement is subject to the PRA, we believe the
associated burden is negligible. As discussed in the previously
referenced November 19, 2008 final rule (73 FR 69915) and the April 27,
2012 final rule (77 FR 25313), we believe the burden associated with
maintaining documentation and furnishing it upon request is a usual and
customary business practice.
E. ICRs Related to Temporary Moratorium (Sec. 424.570)
We were unable in the proposed rule to estimate the number of
applications that will be approved or denied as a result of our changes
to Sec. 424.570, for we had insufficient data on which to base a
precise projection. To enhance our ability to formulate such an
estimate, we solicited comment on--(1) whether an annual figure of
2,000 potentially impacted providers and suppliers could serve as a
reasonable approximation; and (2) the potential cost burden to
providers and suppliers. We received no specific comments on either
issue and remain unable to provide a reasonable estimate because we do
not have adequate information with which to do so.
F. ICRs Related to Reactivations (Sec. 424.540(b))
We were unable in the proposed rule to project the number of
certifications that will be submitted versus the number of complete
Form CMS-855 applications. To enhance our ability to formulate a
projection of the ICR burden associated with this provision, we
solicited comment on--(1) whether an annual figure of 10,000 instances
in which a Form CMS-855 will be requested could serve as a reasonable
approximation; and (2) the potential cost burden to providers and
suppliers. We received no comments and remain unable to formulate a
reasonable estimate due to the lack of sufficient data.
G. Revision to Definition of Enrollment (Sec. 424.535(a))
As this revision is primarily technical in nature, we do not
foresee an associated ICR burden.
H. Total ICR Overall Burden
Based on the foregoing, we estimate an annual ICR burden over each
of the first 3 years of the rule of 25,000 hours at a cost of $937,500.
These costs are limited to our affiliation provisions, for, as
discussed above, we do not anticipate costs associated with any of our
other provisions. We note that the annual ICR burden in this final rule
with comment period is significantly less than the predicted $285
million dollar annual ICR burden in the proposed rule based on our
election to pursue a phased-in approach for Medicare, Medicaid, and
CHIP affiliation disclosures.
I. Comments Received on Our ICR Estimates in the Proposed Rule
The following is a summary of the comments we received on our ICR
estimates in the proposed rule:
Comment: Several commenters contended that the $289.8 million cost
estimate and the 10-hour estimate in the proposed rule associated with
reporting disclosable affiliations were too low. They generally stated
that these projections did not account for lost productivity to
physician practices, including diversion of staff from clinical and
related duties that directly impact and support patient care. A
commenter stated that the rule's cost does not justify the value of any
benefits accruing from the rule.
Response: We disagree. As stated previously, we will be taking a
phased-in approach with the affiliations provisions. The overwhelming
majority of enrolling and revalidating providers will not be requested
to provide affiliations disclosures upon the effective date of this
rule. Accordingly, consistent with our earlier discussion, the annual
costs over the first 3 years of this rule will be less than $1 million
because far fewer providers and suppliers than estimated in the
proposed rule will be required to disclose affiliation data.
The 10-hour estimate, which formed the basis of our initial $289.8
projection in the proposed rule, accounts for the fact that many
providers and suppliers are small in nature (for example, solo
practitioners and small group practices) and will accordingly have few,
if any, affiliations. It is true that larger providers and suppliers
may need to spend more than 10 hours in researching affiliation
information. Insofar as any diversion from patient care, we do not
believe that reporting affiliation data upon initial enrollment and
once every 3 or 5 years thereafter (depending on provider or supplier
type) will negatively impact beneficiary services. Finally, and as
shown in Table 2, we believe that the prevention of problematic
providers and suppliers from accessing the Trust Funds will more than
offset the costs associated with this rule.
Comment: A commenter stated that providers and suppliers would need
to (1) develop systems to track and monitor all identified affiliation
relationships; and (2) rely on higher paid, more sophisticated
employees or an outside consultant or attorney, at a rate substantially
higher than $34 per hour.
Response: We disagree. We believe that our removal of proposed
Sec. Sec. 424.519(h)(1) and (h)(2)(i) and 455.107(h) will effectively
eliminate the burden of regularly tracking disclosable affiliation
data. Also, it has been our experience that the researching and
reporting of ownership and managerial information on the Form CMS-855
is typically performed by the provider's or supplier's administrative
staff. We believe that providers and suppliers will use this same
approach with disclosable affiliation data.
Comment: Several commenters stated that the 30-minute estimate for
reporting a new affiliation or a change to an existing affiliation is
too low.
Response: As previously stated, we are not finalizing proposed
Sec. Sec. 424.519(h)(1) and (h)(2)(i) and 455.107(h).
Comment: A commenter stated that CMS (1) underestimated the time
necessary to complete the Form CMS-855O, (2) underestimated the value
of the doctors' time at $93.74 (or $187.48 with fringe benefits and
overhead), (3) did not account for the cost to patients and society of
diverting so many hours of doctors' time away from patient care for the
completion of government forms, and (4) unrealistically limited the ICR
cost to the rule's first 3 years.
Response: We disagree with these comments. Our estimated time for
completing the Form CMS-855O is consistent with our prior public
projections as well as with feedback we have received from the provider
community. Also, our projection regarding physician wages and our use
of the 3-year ICR estimate are consistent with policies established by
the Office of Management and Budget. Regarding the third comment, and
as alluded to earlier, we do not believe that--(1) reporting
affiliation data upon initial
[[Page 47848]]
enrollment and once every 3 or 5 years thereafter; or (2) completing
the Form CMS-855O will negatively affect patient care. However, we note
that we are not finalizing our proposed changes to Sec. 424.507, which
we believe would alleviate further the burden on the physician
community.
If you comment on these information collection and recordkeeping
requirements, please do either of the following:
1. Submit your comments electronically as specified in the
ADDRESSES section of this final rule with comment period; or
2. Submit your comments to the Office of Information and Regulatory
Affairs, Office of Management and Budget,
Attention: CMS Desk Officer, CMS-6058-P
Fax: (202) 395-6974; or
Email: [email protected]
V. Regulatory Impact Analysis
A. Statement of Need
As previously stated, this final rule with comment period is
necessary to implement sections 1866(j)(5) and 1902(kk)(3) of the Act,
which require providers and suppliers to disclose information related
to any current or previous affiliation with a provider or supplier that
has uncollected debt; has been or is subject to a payment suspension
under a federal health care program; has been excluded from
participation under Medicare, Medicaid, or CHIP; or has had its billing
privileges denied or revoked. This final rule with comment period is
also necessary to address other program integrity issues that have
arisen. We believe that our finalized provisions will--(1) enable CMS
and the states to better track current and past relationships involving
different providers and suppliers; and (2) assist our efforts to stem
fraud, waste, and abuse, hence protecting the Medicare Trust Funds.
Failure to publish this rule, we believe, would continue to enable
certain parties engaging in fraud, waste, and abuse to bill the
Medicare program, endangering both the Trust Funds and Medicare
beneficiaries.
B. Savings and Impact
1. Background
We have examined the impacts of this rule as required by Executive
Order 12866 on Regulatory Planning and Review (September 30, 1993),
Executive Order 13563 on Improving Regulation and Regulatory Review
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19,
1980, Pub. L. 96-354), section 1102(b) of the Social Security Act,
section 202 of the Unfunded Mandates Reform Act of 1995 (March 22,
1995; Pub. L. 104-4) and Executive Order 13132 on Federalism (August 4,
1999) and the Congressional Review Act (5 U.S.C. 804(2)) and Executive
Order 13771 on Reducing Regulation and Controlling Regulatory Costs
(January 30, 2017).
Executive Orders 12866 and 13563 direct agencies to assess all
costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). Section
3(f) of Executive Order 12866 defines a ``significant regulatory
action'' as an action that is likely to result in a rule--(1) having an
annual effect on the economy of $100 million or more in any 1 year, or
adversely and materially affecting a sector of the economy,
productivity, competition, jobs, the environment, public health or
safety, or state, local or tribal governments or communities (also
referred to as ``economically significant''); (2) creating a serious
inconsistency or otherwise interfering with an action taken or planned
by another agency; (3) materially altering the budgetary impacts of
entitlement grants, user fees, or loan programs or the rights and
obligations of recipients thereof; or (4) raising novel legal or policy
issues arising out of legal mandates, the President's priorities or the
principles set forth in the Executive Order.
A regulatory impact analysis (RIA) must be prepared for major rules
with economically significant effects ($100 million or more in any 1
year). We explained in section IV. of this final rule with comment
period that the costs of our provisions will not exceed $100 million in
any of the first 3 years of this final rule with comment period.
However, as discussed we expect that annual federal budget savings over
this 3-year period will exceed $100 million. Therefore, we estimate
that this rulemaking is economically significant as measured by the
$100 million threshold and thus is a major rule under the Congressional
Review Act. We have accordingly prepared this RIA.
2. Savings
a. Affiliations (Sec. Sec. 424.519 and 455.107)
As explained in Section I. of this rule, over the last 5 years,
$51.9 billion dollars (with adjusted factors applied) has been paid to
2,097 entities with affiliations stemming from the revoked Medicare
enrollment of an associated individual or other entity. If the
affiliations/undue risk revocation authority we are finalizing had been
in place during that period, we project that CMS would have taken
revocation action in approximately 40 percent of identified prior
affiliation cases (or approximately 838 cases) based on a determination
of undue risk of fraud, waste, or abuse. Accordingly, we would not have
paid those problematic providers who we know are at the core of the
ongoing fraud risk we face. As a result, over the last 5 years the
program would have seen a resulting $20.7 billion in cost-avoidance
savings, or an average of $4.14 billion per year. We project for
purposes of this final rule with comment period that similar savings
could be achieved once our affiliation provisions become effective.
We believe it is appropriate, however, to outline a range of
savings estimates for our affiliation provisions, given the potential
for fluctuations. We thus restate the projections we outlined in Table
1, based on figures of 20 percent, 40 percent, and 60 percent:
Table 2--Range of Projected Savings Related to Affiliations Provisions
------------------------------------------------------------------------
Annual
affiliations
Percentage 5-Year affiliations authority
authority total total
(billion)
------------------------------------------------------------------------
60% of the 5-year adjusted factor $31.1 billion over 5 $6.22
total of $51.9 billion. years.
40% of the 5-year adjusted factor $20.7 billion over 5 4.14
total of $51.9 billion. years.
20% of the 5-year adjusted factor $10.3 billion over 5 2.06
total of $51.9 billion. years.
------------------------------------------------------------------------
[[Page 47849]]
We plan to begin updating our enrollment applications within 1 year
of publication of the final rule with comment. Once all of the
enrollment forms are completed and have gone through the PRA process
(during which we will solicit public comment on our burden estimates
for completing and submitting affiliation data via the Form CMS-855),
and subregulatory guidance has been disseminated to the states
regarding phase one, we will begin the process of entering phase two of
the affiliations disclosure process. As we have stated throughout this
rule, the initial period of the affiliation requirement will enable CMS
to carefully monitor and analyze the progress and operational
components of the phased-in approach in preparation for the subsequent
future rulemaking.
b. New Denial Reasons in Sec. 424.530 and Revocation Reasons in Sec.
424.535
In section IV. of the proposed rule, we explained the difficulty in
predicting the number of denials and revocations that would result from
our proposed revisions. Considering that these would be new provisions,
there were no historical statistics upon which we could base adequate
estimates. Nonetheless, we outlined the following tentative estimates
strictly for purposes of soliciting public comment on the number of
denials or revocations that CMS was likely to undertake each year:
Table 3--Projected Denials/Revocations in Proposed Rule
------------------------------------------------------------------------
Projected number of
denials/revocations
Denial/revocation authority for purposes of
comment solicitation
------------------------------------------------------------------------
Different Name, Numerical Identifier or Business 8,000
Identity (Sec. Sec. 424.530(a)(12) and
424.535(a)(18))..................................
Billing for Non[dash]Compliant Location (Sec. (*)
424.535(a)(20))..................................
Abusive Ordering, Certifying, Referring or 4,000
Prescribing of Part A or B Services, Items or
Drugs (Sec. 424.535(a)(21))....................
Referral of Debt to the United States Department 2,000
of Treasury (Sec. 424.535(a)(17))..............
Reporting Requirements (Sec. 424.535(a)(9))..... 10,000
Payment Suspensions (Sec. 424.530(a)(7) and Sec. 1,000
405.371).......................................
Denials and Revocations for Other Federal Program 2,500
Termination or Suspension (Sec. 424.530(a)(14))
Extension of Revocation (Sec. 424.535(i))....... **12,000
Voluntary Termination Pending Revocation (Sec. 2,000
424.535(j))......................................
------------------------------------------------------------------------
* We were and remain unable to devise a concrete estimate for this
revocation reason. While there is data concerning the number of
locations that are terminated from Medicare for non-compliance each
year, we cannot predict the number of additional locations that will
be terminated due to Sec. 424.535(a)(20). In other words, if a
provider or supplier has five locations and one is terminated for non-
compliance, we have no means of predicting whether any or all of the
remaining four locations will be terminated. This is because each
provider's and supplier's circumstances are different.
** The 12,000 figure represents revoked enrollments. We projected (for
purposes of comment solicitation only) that this would involve 5,000
providers and suppliers.
We received no comments on these estimates. After careful
consideration, and for several reasons, we believe that said
projections were too high and that a smaller, uniform number
encompassing all of the denial and revocation reasons listed earlier is
more appropriate. First, and as we explain throughout this final rule
with comment period, we do not intend to deny and revoke providers and
suppliers as a routine matter of course. We recognize the legal
significance of such actions and the effect it can have on the provider
or supplier in question. We reiterate that we will only exercise our
authority under these new denial and revocations very cautiously and
only after the most careful and thorough consideration of--(1) the
regulatorily-outlined factors associated with each reason; and (2) the
circumstances surrounding the particular case. This warrants, in our
view, significantly smaller estimates than what we proposed for public
comment. Second, while we made tentative estimates in the proposed rule
for comment solicitation purposes, we made clear that we did not, and
indeed could not, know how many instances in which each denial and
revocation authority would be exercised. These were entirely new
provisions for which there was no historical data upon which to base
reasonable estimates. We continue to hold this view and accordingly
believe that the best approach for projecting the number of denials and
revocations is to establish a single figure encompassing all of the
authorities identified in Table 1.
We project that our new revocation authorities will lead to 2,600
new revocations per year, which we believe is a conservative and, as
explained previously, a necessarily cautious estimate. This will result
in 10-year savings to the federal government of $4.16 billion, a figure
predicated on internal CMS data indicating a per provider annual
payment amount of $160,000 (2,600 x $160,000). The average annual
savings to the federal government will thus be $416 million.
c. Maximum Reenrollment Bars (Sec. 424.535(c)) and the Establishment
of Reapplication Bars (Sec. 424.530(f))
We estimate that our reenrollment and reapplication bar provisions
will annually impact 400 Medicare revocations, leading to savings above
and beyond that which CMS experiences today based on the current three-
year maximum reenrollment bar.
We project that this would result in estimated actual savings of
$1.79 billion over 10 years based on our earlier project per provider
amount of $160,000. The following example illustrates the rationale
behind this calculation. The year 1 batch of 400 revocations would have
7 years of actualized savings during the first 10 year period. The
first 3 years would not generate new savings because the previous
maximum reenrollment bar was 3 years. Thus, savings from this rule
would begin in year 4 and run through year 10 yielding a savings of
$448 million for the year 1 batch of revocations ($160,000 x 400 x 7).
Additionally, the year 2 batch of 400 revocations would have 6 years of
actualized savings during the first 10 year period. In year 1 these
entities were not revoked and years 2 through 4 did not generate new
savings. Thus, savings for the year 2 batch of 400 revocations would
begin in year 5 and run through year 10 resulting in a savings of $384
million ($160 x 400 x 6). This pattern would continue for each year's
batch of 400 revocations. The total 10 year
[[Page 47850]]
savings is, accordingly, anticipated to be $1.79 billion.
Furthermore, we project that this would result in a ``caused
savings'' of $4.48 billion based on our earlier projected per provider
amount of $160,000 (400 x 10 x 7 x $160,000). As noted above, ``caused
savings'' refers to the full amount of money that will be saved based
on the new reenrollment and reapplication bars over a 10-year period; a
large portion of the savings will be made after the first 10-year
period of interest and will not be fully actualized until year 20.
The following example illustrates the rationale behind this
calculation. In year 1, 400 revocations would occur. Currently, and
until the provisions in this rule are effective, CMS may impose a
reenrollment bar of 1 to 3 years. Thus, the year 1 batch of 400
revocations mentioned earlier will not have actualized savings derived
from this rule until year 4 in the 10-year period following revocation.
The 7 years of savings associated with the year 1 batch of 400
revocations would be actualized over the next 10 years, with all 7 of
those years falling within the initial 10-year period. Additionally,
the average annual actualized savings during the initial 10-year period
would be $179 million (the total actualized savings during the first
10-year period of interest would be $1.79 billion). This is because
each year's batch of 400 revocations will have 1 less year of
actualized savings during the first 10-year period. For instance, the
year 1 batch of 400 revocations will have all 7 years of savings
actualized within the first 10-year period, the year 2 batch will only
have 6 of its 7 years of savings actualized within the first 10-year
period, etc.
d. Totals
Table 4 outlines the projected annual savings to the federal
government for the applicable provisions described previously. (For
affiliations, we are using the aforementioned 40 percent figure, which
we believe is the most accurate notwithstanding our establishment of a
projected range in Tables 1 and 2).
Table 4--Projected Annual Savings to the Federal Government
------------------------------------------------------------------------
Savings per
Provision year ($)
------------------------------------------------------------------------
Affiliation-Based Revocations........................... 4,140,000,000
Other new Revocation Authorities........................ 416,000,000
Reenrollment and Reapplication Bars..................... 179,000,000
---------------
Total............................................... 4,735,000,000
------------------------------------------------------------------------
Given, therefore, our annual savings estimates for affiliation-
based revocations (using our median 40 percent figure), revocations
from other new authorities, and reenrollment and reapplication bars, we
project a total savings over a 10-year period of $47.35 billion.
2. Impact
We believe there will be three principal impacts associated with
our finalized provisions. First, denied and revoked suppliers could
incur costs associated with potential lost billings due to denials and
revocations. Second, we estimate that the denial, revocation,
reenrollment bar, and reapplication bar provisions described earlier
will result in approximately $4.735 billion dollars of annual savings
to the federal government and, by extension, the Medicare Trust Funds
and the taxpayers. Third, we believe that CMS, Medicare contractors,
and the states may incur costs, in implementing and enforcing our
affiliation disclosure provision. These could include information
technology system changes and provider education. We estimate total
costs of $937,500 in each year following implementation of the proposed
rule.
Executive Order 13771, titled Reducing Regulation and Controlling
Regulatory Costs, was issued on January 30, 2017. It requires that the
costs associated with significant new regulations shall, to the extent
permitted by law, be offset by the elimination of existing costs
associated with at least two prior regulations. This final rule with
comment period is considered an E.O. 13771 regulatory action. We
estimate that this rule generates $0.73 million in annualized costs in
2016 dollars, discounted at 7 percent relative to year 2016, over a
perpetual time horizon. Details on the estimated costs of this rule can
be found in the preceding analyses.
In accordance with the provisions of Executive Order 12866, this
rule was reviewed by the Office of Management and Budget.
Finally, we do not anticipate any significant impact on beneficiary
access to care from the provisions in this final rule with comment
period. Only a minute fraction of providers and suppliers, when
compared to the entire population of providers and suppliers enrolled
in Medicare, will be revoked or denied as a result of these new and
revised revocation and denial authorities.
C. Anticipated Effects
The RFA requires agencies to analyze options for regulatory relief
of small businesses. For purposes of the RFA, small entities include
small businesses, nonprofit organization, and small governmental
jurisdictions. Most entities and most other providers and suppliers are
small entities, either by nonprofit status or by having revenues less
than $7.5 million to $38.5 million in any 1 year. Individuals and
states are not included in the definition of a small entity.
For several reasons, we do not believe that this final rule with
comment period will have a significant economic impact on a substantial
number of small businesses. First, the furnishing of affiliation data
will be required very infrequently, for example, once every 5 years for
non-DMEPOS suppliers. The cost burden per provider or supplier (10
hours for affiliation data) will likely be less than $1,000, which
should not be a significant burden on a provider or supplier. Second,
it is true that some small businesses could be denied enrollment or
have their enrollments revoked under our provisions. Yet the number of
denials and revocations per year is currently--and will continue to be
under our new provisions --very small when compared to the total number
of enrolled providers and suppliers nationwide. Therefore, we do not
believe that our new denial and revocation reasons will have a
significant impact on a substantial number of small businesses.
D. Effects on Small Rural Hospitals
In addition, section 1102(b) of the Act requires us to prepare a
regulatory impact analysis if a rule may have a significant impact on
the operations of a substantial number of small rural hospitals. This
analysis must conform to the provisions of section 604 of the RFA. For
purposes of section 1102(b) of the Act, we define a small rural
hospital as a hospital that is located outside of a metropolitan
statistical area and has fewer than 100 beds. We are not preparing an
analysis for section 1102(b) of the Act because we have determined, and
therefore the Secretary has determined, that this final rule with
comment period will not have a significant impact on the operations of
a substantial number of small rural hospitals.
E. Unfunded Mandates
Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) also
requires that agencies assess anticipated costs and benefits before
[[Page 47851]]
issuing any rule whose mandates require spending in any 1 year of $100
million in 1995 dollars, updated annually for inflation. In 2018, that
is approximately $150 million. This rule does not mandate any
requirements for state, local or tribal governments or for the private
sector.
F. Executive Order 13132
Executive Order 13132 establishes certain requirements that an
agency must meet when it promulgates a proposed rule (and subsequent
final rule) that imposes substantial direct requirement costs on state
and local governments, preempts state law or otherwise has federalism
implications. Since this regulation does not impose any costs on state
or local governments, the requirements of Executive Order 13132 are not
applicable.
G. Accounting Statement and Table
As required by OMB Circular A-4 (available at http://www.whitehouse.gov/omb/circulars/a0004/a-4/pdf), in Table 5 we have
prepared an accounting statement showing estimates, over the first 3
years of the rule's implementation, of the total cost burden to
providers and suppliers for reporting data using, respectively, 7
percent and 3 percent annualized discount rates.
Table 5--Accounting Statement Classification of Estimated Costs and Federal Budget Savings
[$ in millions]
----------------------------------------------------------------------------------------------------------------
Units
--------------------------------------------------------------
Category Estimates Discount rate
Year dollar (%) Period covered
----------------------------------------------------------------------------------------------------------------
Costs: *
Annualized Monetized 0.9 2017 7 FY 2019-FY 2021.
($million/year).
0.9 2017 3 FY 2019-FY 2021.
Savings to the Federal
Government:
Annualized Monetized 4,735 2017 7 FY 2019-FY 2021.
($million/year).
4,735 2017 3 FY 2019-FY 2021.
----------------------------------------------------------------------------------------------------------------
* Cost associated with the information collection requirements.
H. Alternatives Considered
We considered and have finalized several alternatives to reduce the
overall burden of our provisions.
First, we contemplated a 10-year timeframe for the affiliation
lookback period but proposed to limit the timeframe to 5 years. We
believed this would ease the burden on Medicare, Medicaid, and CHIP
providers and suppliers by restricting the volume of information that
must be reported. Similarly, we proposed that changed data regarding
past affiliations need not be reported. We have finalized the 5-year
lookback period and have eliminated altogether the requirement to
report new and changed affiliations as part of a change of information
request. Although we are unable to calculate the financial savings that
would accrue to providers and suppliers from not having to (1) research
and report affiliation data from 6 to 10 years ago, and (2) regularly
monitor and disclose new or changed affiliation information, we believe
that the burden on providers and suppliers would be reduced.
Second, and more generally, we have incorporated a phased-in
approach for our affiliation disclosure requirements. As previously
explained, this would dramatically reduce the annual costs to providers
and suppliers over the first three years of this rule to less than $1
million. We believe that a phased-in approach is a sounder alternative
than an immediate, full-blown implementation not only because of the
burden reduction but also because it would: (1) Give the provider and
supplier community at large more time to prepare for our affiliation
provisions; and (2) enable CMS to carefully monitor and analyze the
progress and operational components of the phased-in approach in
preparation for the subsequent future rulemaking.
Third, and for reasons already discussed, we have elected not to
finalize our proposed changes to Sec. 424.507. We estimated in the
proposed rule that the annual cost burden to affected providers and
suppliers of these changes (over the first 3 years of the rule) would
be approximately $4.5 million. Our non-finalization of these changes
will eliminate said costs.
Fourth, regarding our extension of the maximum re-enrollment bar to
10 years, we considered shorter alternative timeframes. However, we
settled on 10 years because we believe it was imperative to keep
demonstrably problematic providers and suppliers out of the Medicare
program for an extended period. We believe similarly with respect to
the maximum 20-year period for twice-revoked providers and suppliers.
Although we contemplated briefer maximum periods, repeated improper
conduct potentially warranted, in our view, a very long bar.
List of Subjects
42 CFR Part 405
Administrative practice and procedure, Health facilities, Health
professions, Kidney diseases, Medical devices, Medicare Reporting and
recordkeeping requirements, Rural areas, X-rays.
42 CFR Part 424
Emergency medical services, Health facilities, Health professions,
Medicare, Reporting and recordkeeping requirements.
42 CFR Part 455
Fraud, Grant programs--health, Health facilities, Health
professions, Investigations, Medicaid Reporting and recordkeeping
requirements.
42 CFR Part 457
Administrative practice and procedure, Grant programs--health,
Health insurance, Reporting and recordkeeping requirements.
42 CFR Part 498
Appeals.
For the reasons stated in the preamble of this final rule with
comment period, the Centers for Medicare & Medicaid Services amends 42
CFR chapter IV as follows:
PART 405--FEDERAL HEALTH INSURANCE FOR THE AGED AND DISABLED
0
1. The authority for part 405 is revised to read as follows:
Authority: 42 U.S.C. 263a, 405(a), 1302, 1320b-12, 1395x,
1395y(a), 1395ff, 1395hh, 1395kk, 1395rr, and 1395ww(k).
[[Page 47852]]
0
2. Section 405.371 is amended---
0
a. By revising paragraph (a) introductory text;
0
b. In paragraph (a)(1) by removing the semicolon at the end of the
paragraph and adding in its place a period.
0
c. In paragraph (a)(2) by removing ``; or'' at the end of paragraph and
adding in its place a period; and
0
d. By adding paragraph (a)(4).
The revision and addition read as follows.
Sec. 405.371 Suspension, offset, and recoupment of Medicare payments
to providers and suppliers of services.
(a) General rules--Medicare payments to providers and suppliers, as
authorized under this subchapter (excluding payments to beneficiaries),
may be one of the following:
* * * * *
(4) Suspended, in whole or in part, by CMS or a Medicare contractor
if the provider or supplier has been subject to a Medicaid payment
suspension under Sec. 455.23(a)(1) of this chapter.
* * * * *
0
3. Section 405.425 is amended by revising paragraphs (i) and (j) to
read as follows:
Sec. 405.425 Effects of opting-out of Medicare.
* * * * *
(i) The physician or practitioner who has not been excluded under
sections 1128, 1156 or 1892 of the Act and whose Medicare enrollment is
not revoked under Sec. 424.535 of this chapter may order, certify the
need for, prescribe, or refer a beneficiary for Medicare-covered items,
services, and drugs, provided the physician or practitioner is not
paid, directly or indirectly, for such services (except as provided in
Sec. 405.440).
(j) The physician or practitioner who is excluded under sections
1128, 1156 or 1892 of the Act or whose Medicare enrollment is revoked
under Sec. 424.535 of this chapter may not order, prescribe or certify
the need for Medicare-covered items, services, and drugs except, with
respect to exclusions, as provided in Sec. 1001.1901 of this title,
and must otherwise comply with the terms of any exclusion in accordance
with Sec. 1001.1901 of this title effective with the date of the
exclusion.
0
4. Section 405.800 is amended by adding paragraph (c) to read as
follows:
Sec. 405.800 Appeals of CMS or a CMS contractor.
* * * * *
(c) Additional years applied to a reenrollment bar. (1) If, under
Sec. 424.535(c)(2)(i) of this chapter, CMS or a CMS contractor applies
additional years to a provider's or supplier's existing reenrollment
bar, CMS or the CMS contractor notifies the provider or supplier by
certified mail. The notice includes the following:
(i) The reason for the application of additional years in
sufficient detail to allow the provider or supplier to understand the
nature of the action.
(ii) The right to appeal in accordance with part 498 of this
chapter.
(iii) The address to which the written appeal must be mailed.
(2) Paragraph (c)(1) of this section applies only to the years
added to the existing reenrollment bar under Sec. 424.535(c)(2)(i) of
this chapter and not to the original length of the reenrollment bar,
which is not subject to appeal.
PART 424--CONDITIONS FOR MEDICARE PAYMENT
0
5. The authority for part 424 continues to read as follows:
Authority: 42 U.S.C. 1302 and 1395hh.
0
6. Section 424.502 is amended by adding the definitions for
``Affiliation'', ``Disclosable event'', ``NPI'', and ``PECOS'' in
alphabetical order to read as follows:
Sec. 424.502 Definitions.
* * * * *
Affiliation means, for purposes of applying Sec. 424.519, any of
the following:
(1) A 5 percent or greater direct or indirect ownership interest
that an individual or entity has in another organization.
(2) A general or limited partnership interest (regardless of the
percentage) that an individual or entity has in another organization.
(3) An interest in which an individual or entity exercises
operational or managerial control over, or directly or indirectly
conducts, the day-to-day operations of another organization (including,
for purposes of this paragraph (3), sole proprietorships), either under
contract or through some other arrangement, regardless of whether or
not the managing individual or entity is a W-2 employee of the
organization.
(4) An interest in which an individual is acting as an officer or
director of a corporation.
(5) Any reassignment relationship under Sec. 424.80.
* * * * *
Disclosable event means, for purposes of Sec. 424.519, any of the
following:
(1) Currently has an uncollected debt to Medicare, Medicaid, or
CHIP, regardless of--
(i) The amount of the debt;
(ii) Whether the debt is currently being repaid (for example, as
part of a repayment plan); or
(iii) Whether the debt is currently being appealed;
(2) Has been or is subject to a payment suspension under a federal
health care program (as that latter term is defined in section 1128B(f)
of the Act), regardless of when the payment suspension occurred or was
imposed;
(3) Has been or is excluded by the OIG from participation in
Medicare, Medicaid, or CHIP, regardless of whether the exclusion is
currently being appealed or when the exclusion occurred or was imposed;
or
(4) Has had its Medicare, Medicaid, or CHIP enrollment denied,
revoked, or terminated, regardless of--
(i) The reason for the denial, revocation, or termination;
(ii) Whether the denial, revocation, or termination is currently
being appealed; or
(iii) When the denial, revocation, or termination occurred or was
imposed.
* * * * *
NPI stands for National Provider Identifier.
* * * * *
PECOS stands for Internet-based Provider Enrollment, Chain, and
Ownership System.
* * * * *
0
7. Section 424.516 is amended by revising paragraphs (f)(1)(i)
introductory text, (f)(1)(ii), (f)(2)(i) introductory text, and
(f)(2)(ii) to read as follows:
Sec. 424.516 Additional provider and supplier requirements for
enrolling and maintaining active enrollment status in the Medicare
program.
* * * * *
(f) * * *
(1)(i) A provider or a supplier that furnishes covered ordered,
certified, referred, or prescribed Part A or B services, items or drugs
is required to--
* * * * *
(ii) The documentation includes written and electronic documents
(including the NPI of the physician or, when permitted, other eligible
professional who ordered, certified, referred, or prescribed the Part A
or B service, item, or drug) relating to written orders,
certifications, referrals, prescriptions, and requests for payments for
Part A or B services, items or drugs.
(2)(i) A physician or, when permitted, an eligible professional who
orders, certifies, refers, or prescribes Part A or
[[Page 47853]]
B services, items or drugs is required to--
* * * * *
(ii) The documentation includes written and electronic documents
(including the NPI of the physician or, when permitted, other eligible
professional who ordered, certified, referred, or prescribed the Part A
or B service, item, or drug) relating to written orders,
certifications, referrals, prescriptions or requests for payments for
Part A or B services, items, or drugs.
0
8. Section 424.519 is added to read as follows:
Sec. 424.519 Disclosure of affiliations.
(a) Definitions. For purposes of this section only, the following
terms apply to the definition of disclosable event in Sec. 424.502:
(1) ``Uncollected debt'' only applies to the following:
(i) Medicare, Medicaid, or CHIP overpayments for which CMS or the
state has sent notice of the debt to the affiliated provider or
supplier.
(ii) Civil money penalties imposed under this title.
(iii) Assessments imposed under this title.
(2) ``Revoked,'' ``Revocation,'' ``Terminated,'' and
``Termination'' include situations where the affiliated provider or
supplier voluntarily terminated its Medicare, Medicaid, or CHIP
enrollment to avoid a potential revocation or termination.
(b) General. Upon a CMS request, an initially enrolling or
revalidating provider or supplier must disclose any and all
affiliations that it or any of its owning or managing employees or
organizations (consistent with the terms ``owner'' and ``managing
employee'' as defined in Sec. 424.502) has or, within the previous 5
years, had with a currently or formerly enrolled Medicare, Medicaid, or
CHIP provider or supplier that has a disclosable event (as defined in
Sec. 424.502). CMS will request such disclosures when it has
determined that the initially enrolling or revalidating provider or
supplier may have at least one such affiliation.
(c) Information. The provider or supplier must disclose the
following information about each reported affiliation:
(1) General identifying data about the affiliated provider or
supplier. This includes the following:
(i) Legal name as reported to the Internal Revenue Service or the
Social Security Administration (if the affiliated provider or supplier
is an individual).
(ii) ``Doing business as'' name (if applicable).
(iii) Tax identification number.
(iv) NPI.
(2) Reason for disclosing the affiliated provider or supplier.
(3) Specific data regarding the affiliation relationship, including
the following:
(i) Length of the relationship.
(ii) Type of relationship.
(iii) Degree of affiliation.
(4) If the affiliation has ended, the reason for the termination.
(d) Mechanism. The information required to be disclosed under
paragraphs (b) and (c) of this section must be furnished to CMS or its
contractors via the Form CMS-855 application (paper or the internet-
based PECOS enrollment process).
(e) Denial or revocation. The failure of the provider or supplier
to fully and completely disclose the information specified in
paragraphs (b) and (c) of this section when the provider or supplier
knew or should reasonably have known of this information may result in
either of the following:
(1) The denial of the provider's or supplier's initial enrollment
application under Sec. 424.530(a)(1) and, if applicable, Sec.
424.530(a)(4).
(2) The revocation of the provider's or supplier's Medicare
enrollment under Sec. 424.535(a)(1) and, if applicable, Sec.
424.535(a)(4).
(f) Undue risk. Upon receiving the information described in
paragraphs (b) and (c) of this section, CMS determines whether any of
the disclosed affiliations poses an undue risk of fraud, waste, or
abuse by considering the following factors:
(1) The duration of the affiliation.
(2) Whether the affiliation still exists and, if not, how long ago
it ended.
(3) The degree and extent of the affiliation.
(4) If applicable, the reason for the termination of the
affiliation.
(5) Regarding the affiliated provider's or supplier's disclosable
event under paragraph (b) of this section:
(i) The type of disclosable event.
(ii) When the disclosable event occurred or was imposed.
(iii) Whether the affiliation existed when the disclosable event
occurred or was imposed.
(iv) If the disclosable event is an uncollected debt:
(A) The amount of the debt.
(B) Whether the affiliated provider or supplier is repaying the
debt.
(C) To whom the debt is owed.
(v) If a denial, revocation, termination, exclusion, or payment
suspension is involved, the reason for the disclosable event.
(6) Any other evidence that CMS deems relevant to its
determination.
(g) Determination of undue risk. A determination by CMS that a
particular affiliation poses an undue risk of fraud, waste, or abuse
will result in, as applicable, the denial of the provider's or
supplier's initial enrollment application under Sec. 424.530(a)(13) or
the revocation of the provider's or supplier's Medicare enrollment
under Sec. 424.535(a)(19).
(h) Duplicate data. A provider or supplier is not required to
report affiliation data in that portion of the Form CMS-855 application
that collects affiliation information if the same data is being
reported in the ``owning or managing control'' (or its successor)
section of the Form CMS-855 application.
(i) Undisclosed affiliations. CMS may apply Sec. 424.530(a)(13) or
Sec. 424.535(a)(19) to situations where a disclosable affiliation (as
described in Sec. 424.519(b) and (c)) poses an undue risk of fraud,
waste or abuse, but the provider or supplier has not yet reported or is
not required at that time to report the affiliation to CMS.
0
9. Section 424.530 is amended by revising paragraph (a)(7) and adding
paragraphs (a)(12) through (14) and (f) to read as follows:
Sec. 424.530 Denial of enrollment in the Medicare program.
(a) * * *
(7) Payment suspension. (i) The provider or supplier, or any owning
or managing employee or organization of the provider or supplier, is
currently under a Medicare or Medicaid payment suspension as defined in
Sec. Sec. 405.370 through 405.372 or in Sec. 455.23 of this chapter.
(ii) CMS may apply the provision in this paragraph (a)(7) to the
provider or supplier under any of the provider's, supplier's, or owning
or managing employee's or organization's current or former names,
numerical identifiers, or business identities or to any of its existing
enrollments.
(iii) In determining whether a denial is appropriate, CMS considers
the following factors:
(A) The specific behavior in question.
(B) Whether the provider or supplier is the subject of other
similar investigations.
(C) Any other information that CMS deems relevant to its
determination.
* * * * *
(12) Revoked under different name, numerical identifier or business
identity. The provider or supplier is currently revoked under a
different name, numerical identifier, or business identity, and the
applicable reenrollment bar period has not expired.
[[Page 47854]]
In determining whether a provider or supplier is a currently revoked
provider or supplier under a different name, numerical identifier, or
business identity, CMS investigates the degree of commonality by
considering the following factors:
(i) Owning and managing employees and organizations (regardless of
whether they have been disclosed on the Form CMS-855 application).
(ii) Geographic location.
(iii) Provider or supplier type.
(iv) Business structure.
(v) Any evidence indicating that the two parties are similar or
that the provider or supplier was created to circumvent the revocation
or reenrollment bar.
(13) Affiliation that poses undue risk. CMS determines that the
provider or supplier has or has had an affiliation under Sec. 424.519
that poses an undue risk of fraud, waste, or abuse to the Medicare
program.
(14) Other program termination or suspension. (i) The provider or
supplier is currently terminated or suspended (or otherwise barred)
from participation in a State Medicaid program or any other federal
health care program, or the provider's or supplier's license is
currently revoked or suspended in a State other than that in which the
provider or supplier is enrolling. In determining whether a denial
under this paragraph (a)(14) is appropriate, CMS considers the
following factors:
(A) The reason(s) for the termination, suspension, or revocation.
(B) Whether, as applicable, the provider or supplier is currently
terminated or suspended (or otherwise barred) from more than one
program (for example, more than one State's Medicaid program), has been
subject to any other sanctions during its participation in other
programs or by any other State licensing boards or has had any other
final adverse actions (as that term is defined in Sec. 424.502)
imposed against it.
(C) Any other information that CMS deems relevant to its
determination.
(ii) CMS may apply paragraph (a)(14)(i) of this section to the
provider or supplier under any of its current or former names,
numerical identifiers or business identities, and regardless of whether
any appeals are pending.
* * * * *
(f) Reapplication bar. CMS may prohibit a prospective provider or
supplier from enrolling in Medicare for up to 3 years if its enrollment
application is denied because the provider or supplier submitted false
or misleading information on or with (or omitted information from) its
application in order to gain enrollment in the Medicare program.
(1) The reapplication bar applies to the prospective provider or
supplier under any of its current, former, or future names, numerical
identifiers or business identities.
(2) CMS determines the bar's length by considering the following
factors:
(i) The materiality of the information in question.
(ii) Whether there is evidence to suggest that the provider or
supplier purposely furnished false or misleading information or
deliberately withheld information.
(iii) Whether the provider or supplier has any history of final
adverse actions or Medicare or Medicaid payment suspensions.
(iv) Any other information that CMS deems relevant to its
determination.
0
10. Section 424.535 is amended--
0
a. In paragraph (a) introductory text, by removing the term ``billing
privileges'' and adding in its place the word ``enrollment'';
0
b. By revising paragraphs (a)(9) and (12);
0
c. By adding reserved paragraphs (a)(15) and (16);
0
d. By adding paragraphs (a)(17) through (21);
0
e. By revising paragraph (c); and
0
f. By adding paragraphs (i) and (j).
The additions and revisions read as follows:
Sec. 424.535 Revocation of enrollment in the Medicare program.
(a) * * *
(9) Failure to report. The provider or supplier did not comply with
the reporting requirements specified in Sec. 424.516(d) or (e), Sec.
410.33(g)(2) of this chapter, or Sec. 424.57(c)(2). In determining
whether a revocation under this paragraph (a)(9) is appropriate, CMS
considers the following factors:
(i) Whether the data in question was reported.
(ii) If the data was reported, how belatedly.
(iii) The materiality of the data in question.
(iv) Any other information that CMS deems relevant to its
determination.
* * * * *
(12) Other program termination. (i) The provider or supplier is
terminated, revoked or otherwise barred from participation in a State
Medicaid program or any other federal health care program. In
determining whether a revocation under this paragraph (a)(12) is
appropriate, CMS considers the following factors:
(A) The reason(s) for the termination or revocation.
(B) Whether the provider or supplier is currently terminated,
revoked or otherwise barred from more than one program (for example,
more than one State's Medicaid program) or has been subject to any
other sanctions during its participation in other programs.
(C) Any other information that CMS deems relevant to its
determination.
(ii) Medicare may not revoke unless and until a provider or
supplier has exhausted all applicable appeal rights.
(iii) CMS may apply paragraph (a)(12)(i) of this section to the
provider or supplier under any of its current or former names,
numerical identifiers or business identities.
* * * * *
(15)-(16) [Reserved]
(17) Debt referred to the United States Department of Treasury. The
provider or supplier has an existing debt that CMS appropriately refers
to the United States Department of Treasury. In determining whether a
revocation under this paragraph (a)(17) is appropriate, CMS considers
the following factors:
(i) The reason(s) for the failure to fully repay the debt (to the
extent this can be determined).
(ii) Whether the provider or supplier has attempted to repay the
debt (to the extent this can be determined).
(iii) Whether the provider or supplier has responded to CMS'
requests for payment (to the extent this can be determined).
(iv) Whether the provider or supplier has any history of final
adverse actions or Medicare or Medicaid payment suspensions.
(v) The amount of the debt.
(vi) Any other evidence that CMS deems relevant to its
determination.
(18) Revoked under different name, numerical identifier or business
identity. The provider or supplier is currently revoked under a
different name, numerical identifier, or business identity, and the
applicable reenrollment bar period has not expired. In determining
whether a provider or supplier is a currently revoked provider or
supplier under a different name, numerical identifier, or business
identity, CMS investigates the degree of commonality by considering the
following factors:
(i) Owning and managing employees and organizations (regardless of
whether they have been disclosed on the Form CMS-855 application).
(ii) Geographic location.
(iii) Provider or supplier type.
(iv) Business structure.
(v) Any evidence indicating that the two parties are similar or
that the provider or supplier was created to
[[Page 47855]]
circumvent the revocation or reenrollment bar.
(19) Affiliation that poses an undue risk. CMS determines that the
provider or supplier has or has had an affiliation under Sec. 424.519
that poses an undue risk of fraud, waste, or abuse to the Medicare
program.
(20) Billing from non-compliant location. CMS may revoke a
provider's or supplier's Medicare enrollment or enrollments, even if
all of the practice locations associated with a particular enrollment
comply with Medicare enrollment requirements, if the provider or
supplier billed for services performed at or items furnished from a
location that it knew or should have known did not comply with Medicare
enrollment requirements. In determining whether and how many of the
provider's or supplier's enrollments, involving the non-compliant
location or other locations, should be revoked, CMS considers the
following factors:
(i) The reason(s) for and the specific facts behind the location's
non-compliance.
(ii) The number of additional locations involved.
(iii) Whether the provider or supplier has any history of final
adverse actions or Medicare or Medicaid payment suspensions.
(iv) The degree of risk that the location's continuance poses to
the Medicare Trust Funds.
(v) The length of time that the non-compliant location was non-
compliant.
(vi) The amount that was billed for services performed at or items
furnished from the non-compliant location.
(vii) Any other evidence that CMS deems relevant to its
determination.
(21) Abusive ordering, certifying, referring, or prescribing of
Part A or B services, items or drugs. The physician or eligible
professional has a pattern or practice of ordering, certifying,
referring, or prescribing Medicare Part A or B services, items, or
drugs that is abusive, represents a threat to the health and safety of
Medicare beneficiaries, or otherwise fails to meet Medicare
requirements. In making its determination as to whether such a pattern
or practice exists, CMS considers the following factors:
(i) Whether the physician's or eligible professional's diagnoses
support the orders, certifications, referrals or prescriptions in
question.
(ii) Whether there are instances where the necessary evaluation of
the patient for whom the service, item or drug was ordered, certified,
referred, or prescribed could not have occurred (for example, the
patient was deceased or out of state at the time of the alleged office
visit).
(iii) The number and type(s) of disciplinary actions taken against
the physician or eligible professional by the licensing body or medical
board for the state or states in which he or she practices, and the
reason(s) for the action(s).
(iv) Whether the physician or eligible professional has any history
of final adverse actions (as that term is defined in Sec. 424.502).
(v) The length of time over which the pattern or practice has
continued.
(vi) How long the physician or eligible professional has been
enrolled in Medicare.
(vii) The number and type(s) of malpractice suits that have been
filed against the physician or eligible professional related to
ordering, certifying, referring or prescribing that have resulted in a
final judgment against the physician or eligible professional or in
which the physician or eligible professional has paid a settlement to
the plaintiff(s) (to the extent this can be determined).
(viii) Whether any State Medicaid program or any other public or
private health insurance program has restricted, suspended, revoked, or
terminated the physician's or eligible professional's ability to
practice medicine, and the reason(s) for any such restriction,
suspension, revocation, or termination.
(ix) Any other information that CMS deems relevant to its
determination.
* * * * *
(c) Reapplying after revocation. (1) After a provider or supplier
has had their enrollment revoked, they are barred from participating in
the Medicare program from the effective date of the revocation until
the end of the reenrollment bar. The reenrollment bar--
(i) Begins 30 days after CMS or its contractor mails notice of the
revocation and lasts a minimum of 1 year, but not greater than 10 years
(except for the situations described in paragraphs (c)(2) and (3) of
this section), depending on the severity of the basis for revocation.
(ii) Does not apply in the event a revocation of Medicare
enrollment is imposed under paragraph (a)(1) of this section based upon
a provider's or supplier's failure to respond timely to a revalidation
request or other request for information.
(2)(i) CMS may add up to 3 more years to the provider's or
supplier's reenrollment bar (even if such period exceeds the 10-year
period identified in paragraph (c)(1) of this section) if it determines
that the provider or supplier is attempting to circumvent its existing
reenrollment bar by enrolling in Medicare under a different name,
numerical identifier or business identity.
(ii) A provider's or supplier's appeal rights regarding paragraph
(c)(2)(i) of this section--
(A) Are governed by part 498 of this chapter; and
(B) Do not extend to the imposition of the original reenrollment
bar under paragraph (c)(1) of this section; and
(C) Are limited to any additional years imposed under paragraph
(c)(2)(i) of this section.
(3) CMS may impose a reenrollment bar of up to 20 years on a
provider or supplier if the provider or supplier is being revoked from
Medicare for the second time. In determining the length of the
reenrollment bar under this paragraph (c)(3), CMS considers the
following factors:
(i) The reasons for the revocations.
(ii) The length of time between the revocations.
(iii) Whether the provider or supplier has any history of final
adverse actions (other than Medicare revocations) or Medicare or
Medicaid payment suspensions.
(iv) Any other information that CMS deems relevant to its
determination.
(4) A reenrollment bar applies to a provider or supplier under any
of its current, former or future names, numerical identifiers or
business identities.
* * * * *
(i) Extension of revocation. (1) If a provider's or supplier's
Medicare enrollment is revoked under paragraph (a) of this section, CMS
may revoke any and all of the provider's or supplier's Medicare
enrollments, including those under different names, numerical
identifiers or business identities and those under different types.
(2) In determining whether to revoke a provider's or supplier's
other enrollments under this paragraph (i), CMS considers the following
factors:
(i) The reason for the revocation and the facts of the case.
(ii) Whether any final adverse actions have been imposed against
the provider or supplier regarding its other enrollments.
(iii) The number and type(s) of other enrollments.
(iv) Any other information that CMS deems relevant to its
determination.
(j) Voluntary termination. (1) CMS may revoke a provider's or
supplier's Medicare enrollment if CMS determines that the provider or
supplier voluntarily terminated its Medicare enrollment in
[[Page 47856]]
order to avoid a revocation under paragraph (a) of this section that
CMS would have imposed had the provider or supplier remained enrolled
in Medicare. In making its determination, CMS considers the following
factors:
(i) Whether there is evidence to suggest that the provider knew or
should have known that it was or would be out of compliance with
Medicare requirements.
(ii) Whether there is evidence to suggest that the provider knew or
should have known that its Medicare enrollment would be revoked.
(iii) Whether there is evidence to suggest that the provider
voluntarily terminated its Medicare enrollment in order to circumvent
such revocation.
(iv) Any other evidence or information that CMS deems relevant to
its determination.
(2) A revocation under paragraph (j)(1) of this section is
effective the day before the Medicare contractor receives the
provider's or supplier's Form CMS-855 voluntary termination
application.
0
11. Section 424.540 is amended by revising paragraphs (b)(1) and (2) to
read as follows:
Sec. 424.540 Deactivation of Medicare billing privileges.
* * * * *
(b) * * *
(1) In order for a deactivated provider or supplier to reactivate
its Medicare billing privileges, the provider or supplier must
recertify that its enrollment information currently on file with
Medicare is correct and furnish any missing information as appropriate.
(2) Notwithstanding paragraph (b)(1) of this section, CMS may, for
any reason, require a deactivated provider or supplier to, as a
prerequisite for reactivating its billing privileges, submit a complete
Form CMS-855 application.
* * * * *
0
12. Section 424.570 is amended by revising paragraphs (a)(1)(iii) and
(iv) to read as follows:
Sec. 424.570 Moratoria on newly enrolling Medicare providers and
suppliers.
(a) * * *
(1) * * *
(iii) The temporary moratorium does not apply to any of the
following:
(A) Changes in practice location (except if the location is
changing from a location outside the moratorium area to a location
inside the moratorium area).
(B) Changes in provider or supplier information, such as phone
numbers.
(C) Changes in ownership (except changes in ownership of home
health agencies that would require an initial enrollment).
(iv) A temporary moratorium does not apply to any enrollment
application that has been received by the Medicare contractor prior to
the date the moratorium is imposed.
* * * * *
PART 455--PROGRAM INTEGRITY: MEDICAID
0
13. The authority citation for part 455 is revised to read as follows:
Authority: 42 U.S.C. 1302.
0
14. Section 455.101 is amended by adding the definitions for
``Affiliation'' and Disclosable event'' in alphabetical order to read
as follows:
Sec. 455.101 Definitions.
Affiliation means, for purposes of applying Sec. 455.107, any of
the following:
(1) A 5 percent or greater direct or indirect ownership interest
that an individual or entity has in another organization.
(2) A general or limited partnership interest (regardless of the
percentage) that an individual or entity has in another organization.
(3) An interest in which an individual or entity exercises
operational or managerial control over, or directly or indirectly
conducts, the day-to-day operations of another organization (including,
for purposes of this paragraph (3), sole proprietorships), either under
contract or through some other arrangement, regardless of whether or
not the managing individual or entity is a W-2 employee of the
organization.
(4) An interest in which an individual is acting as an officer or
director of a corporation.
(5) Any payment assignment relationship under Sec. 447.10(g) of
this chapter.
* * * * *
Disclosable event means, for purposes of Sec. 455.107, any of the
following:
(1) Currently has an uncollected debt to Medicare, Medicaid, or
CHIP, regardless of--
(i) The amount of the debt;
(ii) Whether the debt is currently being repaid (for example, as
part of a repayment plan); or
(iii) Whether the debt is currently being appealed;
(2) Has been or is subject to a payment suspension under a federal
health care program (as that latter term is defined in section 1128B(f)
of the Act), regardless of when the payment suspension occurred or was
imposed;
(3) Has been or is excluded by the OIG from participation in
Medicare, Medicaid, or CHIP, regardless of whether the exclusion is
currently being appealed or when the exclusion occurred or was imposed;
or
(4) Has had its Medicare, Medicaid, or CHIP enrollment denied,
revoked or terminated, regardless of--
(i) The reason for the denial, revocation, or termination;
(ii) Whether the denial, revocation, or termination is currently
being appealed; or
(iii) When the denial, revocation, or termination occurred or was
imposed.
* * * * *
0
15. Section 455.103 is revised to read as follows:
Sec. 455.103 State plan requirement.
A State plan must provide that the requirements of Sec. Sec.
455.104 through 455.107 are met.
0
16. Section 455.107 is added to subpart B to read as follows:
Sec. 455.107 Disclosure of affiliations.
(a) Definitions. For purposes of this section only, the following
terms apply to the definition of disclosable event in Sec. 455.101:
(1) ``Uncollected debt'' only applies to the following:
(i) Medicare, Medicaid, or CHIP overpayments for which CMS or the
State has sent notice of the debt to the affiliated provider or
supplier.
(ii) Civil money penalties imposed under this title.
(iii) Assessments imposed under this title.
(2) ``Revoked,'' ``Revocation,'' ``Terminated,'' and
``Termination'' include situations where the affiliated provider or
supplier voluntarily terminated its Medicare, Medicaid, or CHIP
enrollment to avoid a potential revocation or termination.
(b) General. (1)(i) Selection of option. A State, in consultation
with CMS, must select one of the two options identified in paragraph
(b)(2) of this section for requiring the disclosure of affiliation
information.
(ii) Change of selection. A State may not change its selection
under paragraph (b) of this section after it has been made.
(2)(i) First option. In a State that has selected the option in
this paragraph (b)(2)(i), a provider that is not enrolled in Medicare
but is initially enrolling in Medicaid or CHIP (or is revalidating its
Medicaid or CHIP enrollment information) must disclose any and all
affiliations that it or any of its owning or managing employees or
organizations (consistent with the terms ``person with an ownership or
control interest'' and ``managing employee'' as defined in
[[Page 47857]]
Sec. 455.101) has or, within the previous 5 years, had with a
currently or formerly enrolled Medicare, Medicaid, or CHIP provider or
supplier that has a disclosable event (as defined in Sec. 455.101).
(ii) Second option. In a State that has selected the option in this
paragraph (b)(2)(ii), and upon request by the State, a provider that is
not enrolled in Medicare but is initially enrolling in Medicaid or CHIP
(or is revalidating its Medicaid or CHIP enrollment information) must
disclose any and all affiliations that it or any of its owning or
managing employees or organizations (consistent with the terms ``person
with an ownership or control interest'' and ``managing employee'' as
defined in Sec. 455.101) has or, within the previous 5 years, had with
a currently or formerly enrolled Medicare, Medicaid, or CHIP provider
or supplier that has a disclosable event (as defined in Sec. 455.101).
The State will request such disclosures when it, in consultation with
CMS, has determined that the initially enrolling or revalidating
provider may have at least one such affiliation.
(c) Information. The initially enrolling or revalidating provider
must disclose the following information about each affiliation:
(1) General identifying information about the affiliated provider
or supplier, which includes the following:
(i) Legal name as reported to the Internal Revenue Service or the
Social Security Administration (if the affiliated provider or supplier
is an individual).
(ii) ``Doing business as'' name (if applicable).
(iii) Tax identification number.
(iv) National Provider Identifier (NPI).
(2) Reason for disclosing the affiliated provider or supplier.
(3) Specific data regarding the affiliation relationship, including
the following:
(i) Length of the relationship.
(ii) Type of relationship.
(iii) Degree of affiliation.
(4) If the affiliation has ended, the reason for the termination.
(d) Mechanism. The information described in paragraphs (b) and (c)
of this section must be furnished to the State in a manner prescribed
by the State in consultation with the Secretary.
(e) Denial or termination. The failure of the provider to fully and
completely report the information required in this section when the
provider knew or should reasonably have known of this information may
result in, as applicable, the denial of the provider's initial
enrollment application or the termination of the provider's enrollment
in Medicaid or CHIP.
(f) Undue risk. Upon receipt of the information described in
paragraphs (b) and (c) of this section, the State, in consultation with
CMS, determines whether any of the disclosed affiliations poses an
undue risk of fraud, waste, or abuse by considering the following
factors:
(1) The duration of the affiliation.
(2) Whether the affiliation still exists and, if not, how long ago
the affiliation ended.
(3) The degree and extent of the affiliation.
(4) If applicable, the reason for the termination of the
affiliation.
(5) Regarding the affiliated provider's or supplier's disclosable
event under paragraph (b) of this section, all of the following:
(i) The type of disclosable event.
(ii) When the disclosable event occurred or was imposed.
(iii) Whether the affiliation existed when the disclosable event
occurred or was imposed.
(iv) If the disclosable event is an uncollected debt--
(A) The amount of the debt;
(B) Whether the affiliated provider or supplier is repaying the
debt; and
(C) To whom the debt is owed.
(v) If a denial, revocation, termination, exclusion, or payment
suspension is involved, the reason for the disclosable event.
(6) Any other evidence that the State, in consultation with CMS,
deems relevant to its determination.
(g) Determination of undue risk. A determination by the State, in
consultation with CMS, that a particular affiliation poses an undue
risk of fraud, waste, or abuse will result in, as applicable, the
denial of the provider's initial enrollment in Medicaid or CHIP or the
termination of the provider's enrollment in Medicaid or CHIP.
(h) Undisclosed affiliations. The State, in consultation with CMS,
may apply paragraph (g) of this section to situations where a
reportable affiliation (as described in paragraphs (b) and (c) of this
section) poses an undue risk of fraud, waste, or abuse, but the
provider has not yet disclosed or is not required at that time to
disclose the affiliation to the State.
PART 457--ALLOTMENTS AND GRANTS TO STATES
0
17. The authority citation for part 457 is revised to read as follows:
Authority: 42 U.S.C. 1302.
0
18. Section 457.990 is amended by redesignating paragraphs (a) and (b)
as paragraphs (b) and (c) and adding a new paragraph (a) to read as
follows:
Sec. 457.990 Provider and supplier screening, oversight, and
reporting requirements.
* * * * *
(a) Section 455.107.
* * * * *
PART 498--APPEALS PROCEDURES FOR DETERMINATIONS THAT AFFECT
PARTICIPATION IN THE MEDICARE PROGRAM AND FOR DETERMINATIONS THAT
AFFECT THE PARTICIPATION OF ICFs/IID AND CERTAIN NFs IN THE
MEDICAID PROGRAM
0
19. The authority citation for part 498 is revised to read as follows:
Authority: 42 U.S.C. 1302, 1320a-7j, and 1395hh.
0
20. Section 498.3 is amended by revising paragraph (b)(17) to read as
follows:
Sec. 498.3 Scope and applicability.
* * * * *
(b) * * *
(17)(i) Whether to deny or revoke a provider's or supplier's
Medicare enrollment in accordance with Sec. 424.530 or Sec. 424.535
of this chapter;
(ii) Whether, under Sec. 424.535(c)(2)(i) of this chapter, to add
years to a provider's or supplier's existing reenrollment bar; or
(iii) Whether, under Sec. 424.535(c)(3) of this chapter, an
individual or entity other than the provider or supplier that is the
subject of the second revocation was the actual subject of the first
revocation.
* * * * *
Dated: April 4, 2019.
Seema Verma,
Administrator, Centers for Medicare & Medicaid Services.
Dated: April 9, 2019.
Alex M. Azar II,
Secretary, Department of Health and Human Services.
[FR Doc. 2019-19208 Filed 9-5-19; 11:15 am]
BILLING CODE 4120-01-P