CMS on Sept. 5 finalized a program-integrity regulation that’s designed to keep, or kick, providers out of Medicare if they pose an “undue risk” of fraud, waste or abuse. The regulation, which implements provisions of the Affordable Care Act (ACA), requires providers to disclose “affiliations” with other providers who have been suspended or excluded from Medicare, Medicaid or the Children’s Health Insurance Program (CHIP); owe the programs money; or had their billing privileges denied or revoked.
According to the final rule (with comment period), which takes effect Nov. 4, providers will have to report affiliations when they enroll and revalidate as soon as CMS updates the 855 enrollment form. Until then, CMS will identify affiliations through databases, including the Provider Enrollment, Chain, and Ownership System (PECOS). There won’t necessarily be guilt by association. “CMS will, in every case, act with caution and prudence when determining whether an undue risk of fraud, waste, or abuse exists,” the regulation stated. If it does, however, the provider’s relationship with Medicare could be in jeopardy because of its affiliations.
This development is a very big deal, says attorney Judy Waltz, with Foley & Lardner LLP in San Francisco. “It’s like data mining on steroids, because as a provider, you have to figure out who your affiliates are, and all this information goes on your 855 enrollment form. At least in the transition period, CMS will have to figure out your disclosable events, and if you forget one of your affiliates and they have a disclosable event that’s discovered by CMS, it could be a real problem, because you have an incomplete and misleading enrollment application, which could lead to a civil monetary penalty.” Hospitals, for example, would be at risk of penalties or revocation if their affiliates—board members, joint venture partners and physicians who reassign their billing—have a skeleton in the closet that CMS determines results in an undue risk for participation by the provider. “It’s scary. I get where they’re coming from on this, but there may be some harsh results in certain situations,” Waltz says. “CMS’s answer to that is they have discretion based on their determination of risk. But we have seen CMS take a very aggressive approach on these enrollment questions, and it’s hard to believe there won’t be missteps along the way.”
CMS and the HHS Office of Inspector General have longstanding concerns about tainted providers who disguise themselves by using affiliations (and other methods) to bill Medicare. But there hasn’t been an effective way to expose them. CMS predicts the regulation will cost providers $937,500 annually each of the first three years of the rule.
‘Somehow You Have to Vouch for Affiliates’
An “affiliation” is defined in the regulation as “a 5 percent or greater direct or indirect ownership interest that an individual or entity has in another organization; a general or limited partnership interest (regardless of the percentage) that an individual or entity has in another organization; an interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization…; an interest in which an individual is acting as an officer or director of a corporation; and any reassignment relationship.”
Although CMS will initially research affiliations, if it finds any, the ball will be in the provider’s court. “This could require the provider or supplier to conduct research to determine whether additional disclosable affiliations exist, which would then need to be reported to CMS,” the regulation stated. Only affiliations going back five years are in play.
As a practical matter, it will be a while before providers themselves will be disclosing, which is a relief, Waltz says. But she doesn’t think hospitals can ignore the requirement in the meantime. Hospitals have to consider how to determine whether certain people in their orbit—including physicians who reassign their benefits using the 855R form, board members and investors—have a black mark, beyond screening for Medicare exclusion. For example, there’s no public database to check for Medicare payment suspensions or revocations. “Somehow the provider is going to have to vouch for all its affiliates,” she says. Maybe hospitals could ask relevant people to sign statements attesting to the fact they haven’t ever been suspended from Medicare, Medicaid, or CHIP; don’t owe the programs money; or haven’t had their billing privileges revoked or terminated. “Providers will need to hope that their affiliates will be complete and accurate in their disclosures,” Waltz says.
The regulation has other measures to flush out questionable providers who may be trying to disguise themselves to continue billing Medicare. For example, CMS may revoke the Medicare enrollment of a physician or eligible professional “if he or she has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements.”
Waltz says that provision may sound reasonable, but “the interpretation of its terms—such as ‘abusive’ and ‘threat to the health and safety of Medicare beneficiaries’— may result in disputes with CMS.”
Contact Waltz at jwaltz@foley.com. Read the regulation at http://bit.ly/2k4wYn5.