New affiliations disclosure requirement

The Final Rule establishes an expansive new "affiliations" disclosure requirement that allows CMS to identify individuals and organizations that, according to CMS, pose an undue risk of fraud, waste or abuse based on their relationships (i.e., "affiliations") with other enrolled or previously enrolled entities (hereinafter the Affiliations Disclosure). Specifically, CMS will now require prospective and enrolled providers and suppliers to disclose any and all affiliations that they - or any of their owning or managing employees or organizations - have, or within the past five years have had, with a currently or formerly enrolled provider or supplier that:

• has uncollected debt, regardless of the amount of debt or whether the debt is currently being repaid or appealed; 
• has been or is subject to a payment suspension under a federal health care program, regardless of when the payment suspension accrued or was imposed; 
  
  has been or is excluded by OIG from Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred; or 
• has had its Medicare, Medicaid, or CHIP billing privileges denied or revoked, regardless of the reason for denial or revocation, whether it is currently being appealed, or when it occurred. 

Together, these are the "disclosable events" subject to the new Affiliations Disclosure requirement, with which providers and suppliers must comply in just under two weeks. 

What is an affiliation? 

In the context of the new Affiliations Disclosure requirement, "affiliation" is defined broadly to mean any of the following: 

• a 5 percent or greater direct or indirect ownership interest that an individual or entity has in another organization; 
• a general or limited partnership interest, regardless of the percentage that an individual or entity has in another organization; 
• an interest in which an individual or entity conducts the day-to-day operations of another organization, either under contract or through some other arrangement; 
• an interest in which an individual is acting as an officer or director of a corporation; or 
• any reassignment relationship under 42 CFR 424.519. 

The identities of the first four types of affiliates must already be reported on the CMS enrollment applications, including Forms 855A and 855B. Likewise, reassignment relationships must be reported to Medicare via Form 855R, which facilitates the reassignment of benefits from a physician or non-physician practitioner to another Medicare provider or supplier. 

Notably, however, the Final Rule magnifies existing reporting requirements far beyond the identities of a provider's or supplier's current affiliates. Specifically, providers and suppliers will now be required to disclose their own "affiliations" with current and former enrollees that have a disclosable event and the affiliations of their owners and managing employees or organizations that have a disclosable event. In other words, the Final Rule asks for enrollees to identify affiliates of affiliates and the disclosable events for those entities. Consider the following example:

The provider is a public company owned (at one moment in time) by four mutual fund stockholders that each own a 5 percent or more interest in the provider. Together, the provider's mutual fund stockholders also have a 5 percent or more ownership (via investment) interest in thousands of other health care entities that are enrolled in Medicare and Medicaid. Per the Final Rule, CMS requires that the provider report disclosable events for all of these health care entities, most of which are unknown to the provider, in which the provider's mutual fund stockholders have a 5 percent or greater ownership interest but with which the provider has no relationship, nor has access to such information. The provider itself also has over 500 Medicare and Medicaid enrollments and is required to report disclosable events for these enrollments per the Final Rule.

What is more, there is a five-year lookback period for all affiliations, creating an additional burden on enrollees. Consider the facts in the example above except that one of the provider's mutual fund stockholders sold its shares in the provider in 2015 (four years ago) and is now an unrelated third party. Per the Final Rule, CMS requires that the provider still obtain and report to CMS all disclosable events of the stockholder and the stockholder's enrolled affiliates, where there is no affirmative requirement or incentive for the stockholder, now a former affiliate of the provider, to be forthcoming with potentially sensitive information. It is possible, of course, that an entity could both purchase and sell 5 percent of the provider at a public stock exchange and yet remain unknown to the provider. 

As evident from these examples, the administrative impact alone on all providers and suppliers (and potentially their investors) charged with identifying, collecting, tracking, and reporting required disclosable affiliations will be astronomical and, in many cases, impossible. CMS addressed this fact pattern with the explanation that enrollees will be held to a "know or should know" standard for required identification of affiliates of affiliates and disclosable events for those entities. We think this is cold comfort given the Affiliations Disclosure will be submitted via CMS' 855 forms under penalty of perjury (and may therefore result in criminal sanction if disclosed incorrectly) and CMS has failed to otherwise define this standard. The agency instead has stated its intention to clarify its expectations regarding the level of effort required in securing relevant affiliation information via subregulatory guidance at some time in the future. 

What is a disclosable event?

Providers and suppliers should also understand CMS' expansive view of what is considered a disclosable event, and that if enrollees do not provide this information "fully and completely" to CMS, they may be subject to revocation. 

First, unlike the scope of an affiliate, there is no lookback period for reporting disclosable events, meaning that a provider or supplier may be required to report a disclosable event (e.g., uncollected debt or payment suspension) of its direct or indirect affiliates that occurred decades ago. The problem is that providers and suppliers may not have access to detailed and potentially sensitive disclosable event information about their affiliates and their owners and managing organizations or employees' affiliates (with whom providers and suppliers often have no relationship) that may have occurred many years prior. Yet, CMS provides no comfort or additional instruction to enrollees, who are now required to provide this information, which is limitless in scope, to the agency. Consider the following example:

The provider has an "affiliation" with a JV partner that has ownership interests in multiple enrolled suppliers that are not associated with the provider. One such supplier, an independent diagnostic testing facility (IDTF), was subject to a payment suspension under a state Medicaid program 15 years ago that occurred as a result of a clerical error. The payment suspension was resolved quickly and there was no finding of fraud. The IDTF became defunct five years ago and is no longer enrolled in the state Medicaid program. Per the Final Rule, CMS requires that the provider disclose the payment suspension of its JV partner's former affiliated entity, the IDTF, despite the fact that: (a) the provider has no relationship with the IDTF, (b) the provider's JV partner has not been affiliated with the IDTF for five years, (c) the IDTF is no longer enrolled in the state Medicaid program, and (d) the suspension was due to a clerical error resolved over a decade ago. 

Second, disclosable events include events that are currently being appealed by the provider or supplier. In other words, even if a provider or supplier formally disagrees with the government's initial determination and the enrollee has not yet had, and may not ever have, any of its billing privileges or participation in federal health care programs suspended, revoked, or terminated, it must still report the pending matter as a disclosable event, thereby putting the business at risk for CMS' undefined determination of fraud, waste, or abuse. CMS acknowledges public comments to this effect in the Final Rule, but is quick to dismiss stakeholders' concerns, citing the agency's need for flexibility in combating threats to program integrity.

Third, disclosable events may include certain enrollment consequences to the provider or supplier regardless of the reason. Importantly, CMS has failed to consider circumstances where the government or its administrative contractor has made an error resulting in a disclosable event. For example, consider a Medicare administrative contractor (MAC) that suspends payment or denies billing privileges because the MAC mistakenly concluded the practice location of the provider or supplier is not located at the address listed on the 855 form (a fact pattern that is familiar to us). Typically, these suspensions or denials are hastily overturned once the MAC or CMS becomes aware of the error. However, under the new Affiliations Disclosure requirement, despite no wrongdoing by the provider or supplier, the MAC's mistake would be considered a disclosable event, triggering CMS' scrutiny of the entity's enrollment status.

And fourth, the disclosable events are not adequately defined. For example, what is a "debt" that is subject to the disclosable event standard? CMS says when an enrollee: 

Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of

• the amount of the debt;
• whether the debt is currently being repaid (for example, as part of a repayment plan); or
• whether the debt is currently being appealed; 

And, uncollected debt only applies to the following:

• Medicare, Medicaid, or CHIP overpayments for which CMS or the state has sent notice of the debt to the affiliated provider or supplier
• Money penalties imposed under title 42; and
• Assessments imposed under title 42.1

This language is expansive. And since there is no dollar limit, the debt could involve any demand letter sent by a MAC to a single enrollee (where many large providers may have hundreds of locations) regardless of whether the enrollee intends to appeal the MAC's determination. In other words, it appears CMS is encouraging enrollees to affirmatively pay auditors (e.g., Uniform Program Integrity Contractors) and claims in response to Additional Documentation Requests, rather than waiting for the MAC to issue the demand letter that triggers the enrollee's appeal rights, or risk creating a disclosable event under this Final Rule.2 Of course, even assuming a single enrollee decides to affirmatively pay in these situations, that enrollee must still consider its affiliates' debts, and the debts of the affiliates of those affiliates. The broad scope of disclosable events is likely troubling to all enrolled providers and suppliers.

What next?

For now at least, in response to many Proposed Rule commenters who expressed grave concerns about the undue burden of researching, obtaining, tracking, and disclosing information that providers and suppliers have no reasonable way of accessing, CMS has agreed to a "phased-in" approach to the new Affiliations Disclosure requirement, which appears to only delay the inevitable. Specifically, under the phased-in approach, CMS (rather than providers and suppliers) will bear the burden of conducting research to determine whether a particular provider or supplier has one or more disclosable affiliations. To do this, CMS will research and consider data revealed through sources such as, but not limited to, PECOS, other CMS databases, and external non-CMS databases. After reviewing the applicable data, CMS will request the disclosure of affiliations from a provider or supplier if the organization may currently have, or within the previous five years has had, an affiliation with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that may have one or more disclosable events. According to CMS, this phased-in approach is a more targeted approach that CMS will later expand in further rulemaking and a concomitant assessment of the progress of the phased-in approach. Interestingly, perhaps as evidence of CMS' uncertainty as to how it will operationalize the Final Rule and, more immediately the phased-in approach, earlier this week CMS issued a formal request for information, stating that it "is looking for innovative, but fiscally prudent and operationally feasible, ways to conduct program integrity more effectively and efficiently."

At this time, it is not clear how often CMS will reach out to providers or suppliers and request data when it becomes aware of new affiliations and disclosable events, although CMS estimates that the first few years of the phased-in approach implementing the affiliations disclosure authority will affect only about 2,500 to 4,000 providers and suppliers per year (i.e., less than 1 percent of all currently enrolled providers and suppliers). Nonetheless, and importantly for enrollees, the burden on providers and suppliers is in no way lessened by CMS' phased-in approach. In fact, CMS acknowledges that while the agency is developing its requests, providers and suppliers must begin efforts to collect the required disclosable affiliation information before the requirement goes into effect. 

And while stakeholders would likely welcome additional clarity via any mechanism now, CMS unfairly, and arguably improperly, defers these issues and others to "subregulatory guidance" that it may or may not develop. Consider the Supreme Court's landmark decision in Azar v. Allina Health Servs., 139 S. Ct. 1804, 204 L. Ed. 2d 139 (2019), which held that the Medicare statute requires CMS to adopt "interpretive" rules through notice and comment rulemaking if the rule has a substantive legal effect on reimbursement. In other words, to the extent the subregulatory guidance establishes or changes a substantive legal standard governing the eligibility of individuals and entities to furnish services covered by Medicare (e.g., establishing a "reasonableness" standard governing Affiliations Disclosures), such guidance is arguably invalid under the Allina decision. Along the same lines, an Executive Order released earlier this month titled, Promoting the Rule of Law Through Transparency and Fairness in Civil Administrative Enforcement and Adjudication, stated that a government agency may not treat noncompliance with a standard of conduct announced solely in a guidance document as itself a violation of applicable statutes or regulations.

Extending CMS' authority to deny or revoke Medicare enrollment

In addition to establishing the Affiliations Disclosure requirement and CMS' authority over the same, the Final Rule authorizes CMS to revoke Medicare enrollment if it determines that a disclosable affiliation presents an undue risk of fraud regardless of whether a provider or supplier has made an Affiliations Disclosure or whether CMS has requested that the provider or supplier make such disclosure.

The Final Rule also solidifies other unprecedented bases, outlined below, upon which CMS will now have the authority to revoke or deny Medicare enrollment, greatly expanding the agency's previous authority to do so.

• "Re-invent" scenario. CMS may deny a provider's or supplier's Medicare enrollment application if CMS determines that the provider or supplier is currently revoked under a different name, numerical identifier, or business identity, and attempting to re-enroll under a new guise.
• Non-compliant practice locations. CMS may revoke or deny a provider's or supplier's Medicare enrollment or enrollments, even if all the practice locations associated with a particular enrollment comply with Medicare enrollment requirements, if the provider or supplier performed services from a location that it knew, or should reasonably have known, did not comply with Medicare enrollment requirements. For example:

A large nursing home and hospice provider chain with hundreds of enrolled practice locations has a compliance issue at one of its health care facilities that it "should have reasonably known" but that was nonetheless not detected. Under the Final Rule, Medicare has the authority to revoke all of the provider's enrollments for that one practice location’s compliance issue.

• Pattern or practice of "bad" behavior. CMS may revoke a physician's or eligible professional's Medicare enrollment if he or she has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements.
• Existing debt. CMS may revoke a provider's or supplier's Medicare enrollment if the provider or supplier has an existing debt that CMS refers to the Department of Treasury (i.e., CMS has exhausted attempts to fully recover the debt through its own procedures). 
• Failure to report ownership and other changes. CMS may revoke enrollment of any enrollee that fails to report either a change of ownership or practice location, or any adverse action within 30 days, or any other change in enrollment data within 90 days of the change. 

It is unclear whether CMS will interpret disclosable affiliations as part of enrollment data, particularly once the Medicare 855 applications are revised. If it does, providers and suppliers will be charged with identifying and collecting extensive affiliation disclosure information and reporting updates to this information to CMS within 90 days, or they may be subject to revocation.

Medicaid "options"

Any provider or supplier that is not enrolled in Medicare but is enrolled (or intends to enroll) in a state Medicaid program and/or CHIP must comply with states' versions of the new Affiliations Disclosure requirement discussed above. Per the Final Rule, each state will, in consultation with CMS, select one of two options for the implementation of the Affiliations Disclosure requirement. Option 1 is CMS' version of the Final Rule implemented without the phased-in approach, while Option 2 offers the phased-in approach at the state level. The chosen option will be in effect until CMS engages in further rulemaking and states will not be able to switch options before such additional rulemaking is issued. CMS believes that affording state Medicaid programs the opportunity to select one of two options will provide states greater flexibility in implementing the new Affiliations Disclosure requirement. However, many stakeholders are concerned that these options open the door to potential inconsistencies across state lines. The Final Rule does not offer a time frame for when states must select a Medicaid option. At most, CMS indicates that states will notify CMS via a process outlined in "future subregulatory guidance" as to which of the two options the state chooses. Even further, CMS does not instruct as to how soon the option selected by each state will be in effect or when states will roll out revisions to their enrollment application materials. As such, providers, suppliers, and other stakeholders should anticipate that states' implementation of the new Affiliations Disclosure requirement may be staggered and/or unpredictable.

Heightened bars to re-enrollment and re-application 

Under current Medicare rules, a provider, supplier, owner, or managing employee that has their billing privileges revoked, is barred from participating in Medicare from the date of revocation until the end of the re-enrollment bar. The re-enrollment bar begins 30 days after CMS or its contractor mails notice of the revocation and lasts a minimum of one year, but no greater than three years. The Final Rule substantially increases the penalty on former enrollees seeking re-enrollment. Beginning in less than two weeks, an enrollee barred from Medicare participation will face up to a 10-year penalty before it can re-enroll. If an enrollee experiences a second revocation, the penalty is up to 20 years. These heightened bars to re-enrollment may effectively put providers or suppliers that rely heavily on Medicare reimbursement out of business if faced with revocation.

Additionally, under the Final Rule, new providers or suppliers submitting initial enrollment applications should take caution to ensure their applications do not include any false or misleading information, as this could trigger CMS' new authority to impose up to a three-year penalty before the provider can re-apply. In particular, once the Medicare enrollment forms are revised to reflect the new Affiliations Disclosure requirement, not only will new providers and suppliers be tasked with reporting disclosable affiliations fully and completely, but they will also face a possible three-year delay to enrollment if the information provided is false and/or misleading, according to CMS.

Again, comments to the Final Rule are due to CMS in less than two weeks, no later than 5 p.m. on November 4, 2019, and can be submitted at federalregister.gov/medicare.

1. 42 C.F.R. §§ 424.502, 424. 519(a)(1).
2. 84 Fed. Reg. 47794, 47805-06 (Sept. 10, 2019).

Client Alert 2019-253