By Hannah Cross, Esq., CHC, Jamie Gelfman, Esq., CHC, and Timothy Wombles, Esq.
Hannah L. Cross (hannah.cross@nelsonmullins.com) is a Partner in the Washington, DC, office; Jamie B. Gelfman (jamie.gelfman@nelsonmullins.com) is a Partner in the Boca Raton office; and Timothy S. Wombles (timothy.wombles@nelsonmullins.com) is an Associate in the Orlando office of the Nelson Mullins Riley & Scarborough law firm.
The United States Department of Health & Human Services Centers for Medicare and Medicaid Services (CMS) and Office of Inspector General (OIG) have published final rules amending major healthcare fraud and abuse laws. These final rules were issued approximately one year after CMS and OIG issued proposed rules for comment. Born out of U.S. Department of Health & Human Services’ Regulatory Sprint to Coordinated Care and CMS’s Patients over Paperwork initiatives, these final rules are intended to align existing regulations with and remove regulatory impediments to the healthcare industry’s shift toward value-based and coordinated care payment models. The final rules also tackle technical obstacles that present significant liability. After receiving hundreds of comments from various stakeholders on the 2019 proposed rules, CMS and OIG published these final rules December 2, 2020, to be effective January 19, 2021 (the CMS final rule[1] and OIG final rule,[2] respectively). Worth noting is that while the majority of the CMS final rule is effective January 19, 2021, revisions to the group practice special rules for profit shares and productivity bonuses will become effective January 1, 2022.
CMS final rule: The Stark Law
The Stark Law prohibits a physician from making referrals for certain designated health services (DHS) payable by Medicare if the physician (or an immediate family member) has a financial relationship with the entity performing the DHS. An entity is prohibited from billing Medicare for those prohibited referrals. Statutory and regulatory exceptions protect arrangements that otherwise would violate the Stark Law. The CMS final rule is the most ambitious and significant rulemaking that CMS has issued since 2007, introducing five new exceptions, clarifying fundamental terminology, and finalizing numerous important revisions and clarifications. A summary of some of the most significant and highly anticipated provisions of the CMS final rule follows.
Arrangements that facilitate value-based healthcare delivery and payment
CMS introduced three new exceptions addressing value-based care arrangements along with six applicable definitions. All three exceptions are available to direct compensation arrangements and certain indirect compensation arrangements that include a direct value-based compensation arrangement with a physician in the unbroken chain of financial relationships. These new exceptions share a few common requirements. First, they protect remuneration as a result of value-based activities undertaken for patients in the “target patient population,” as defined in the new regulations.[3] Second, they prohibit the remuneration from serving as an inducement to restrict medically necessary items or services to any patient. Third, each exception allows remuneration to be conditioned upon patient referrals after meeting additional program safeguard requirements.
-
Full financial risk. This new exception protects remuneration paid under a value-based arrangement if the value-based enterprise (VBE), as defined in the new regulations, is at full financial risk during the entire value-based arrangement.[4] Full financial risk requires the VBE to be financially responsible on a prospective basis for the cost of all patient care covered by an applicable payer for each patient in the target patient population for a specified period of time.
-
Value-based arrangements with meaningful downside financial risk to a physician. Remuneration paid under a value-based arrangement is protected by this new exception if a physician is at “meaningful downside financial risk” in the event of failure to achieve the value-based purpose(s) of the VBE.[5] “Meaningful downside risk” means the physician must repay or forgo no less than 10% of the value of the remuneration the physician receives under the value-based arrangement. Similar to the full financial risk exception, the meaningful downside financial risk must last the entire duration of the value-based arrangement.
-
Value-based arrangements. This exception protects remuneration paid under a value-based arrangement at any risk level.[6] Given the breadth of this third new exception, it has the most requirements, including traditional program safeguard requirements, such as writing and signature requirements. Parties should be aware that this exception includes an explicit monitoring requirement that may result in an obligation to terminate ineffective value-based arrangements. So long as parties terminate ineffective arrangements during the applicable time frame, CMS will deem that value-based activity to be reasonably designed to achieve at least one value-based purpose.
Clarification of fundamental terminology and requirements
-
Commercially reasonable. CMS introduced a definition for the term “commercially reasonable” and clarified that a determination of commercial reasonableness is not one of valuation. Commercially reasonable means that “the particular arrangement furthers a legitimate business purpose of the parties to the arrangement and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty. An arrangement may be commercially reasonable even if it does not result in profit for one or more of the parties.”[7]
-
Volume or value of referrals and other business generated. New special rules address the volume or value standard and the other business-generated standards.[8] In a departure from CMS’s previous approach, these new standards define the universe of circumstances that will take into account the volume or value of referrals or other business generated. Compensation will only take into account the volume or value of referrals from an entity to a physician if the formula used to calculate compensation includes that physician’s referrals to the entity as a variable resulting in a positive correlation between referrals and compensation. If one variable increases as the other increases, or one decreases as the other decreases, that is a positive correlation. These standards apply to certain exceptions and include specific special applications, such as application to the special rules for unit-based compensation. Relatedly, CMS finalized amendments to the former volume or value standard within indirect compensation relationships.[9] These new standards are key to understanding CMS’s position on the correlation theory advanced in cases such as Tuomey.[10] In fact, CMS addressed the correlation theory in preamble, stating that “[a]n association between personally performed physician services and designated health services furnished by an entity does not convert compensation tied solely to the physician’s personal productivity into compensation that takes into account the volume or value of a physician’s referrals to the entity or the volume or value of other business generated by the physician for the entity.”[11] CMS declined commenters’ requests to codify this policy, and without such clarity in regulation, it is unclear how these new standards will affect enforcement activity in the future.
-
Fair market value. CMS restructured the definition of fair market value with attendant modifiers for general application, rental of equipment, and rental of office space to provide further meaning to the statutory definition of fair market value.[12] Fair market value, generally, means the value of an arm’s-length transaction, consistent with the general market value of the subject transaction. General market value, which also has attendant modifiers, reflects the result of bona fide bargaining between well-informed parties.
Additional new exceptions
-
Limited remuneration to a physician. This new exception protects remuneration from an entity to a physician for the provision of items or services provided by the physician to the entity that does not exceed $5,000 in the aggregate per calendar year.[13] CMS added this exception out of its experience with the Self-Referral Disclosure Protocol, in which it found parties disclosing arrangements that could not fit within an existing exception, but that did not present a risk of program or patient abuse.
-
Cybersecurity technology and related services. This new exception broadly protects nonmonetary remuneration in the form of technology and services necessary and used predominantly to implement, maintain, or reestablish cybersecurity.[14] The technology and services may be any software or other type of technology. While this new exception does not have many requirements, it does include a requirement that the arrangement be documented in writing.
Notable revisions
The CMS final rule presents a number of significant revisions to existing exceptions as well as pertinent special rules. Highlights of select revisions are below:
-
Group practice.[15] New revisions to the group practice rules include the new volume or value standard, references to new definitions, and special rules related to commercially reasonable compensation arrangements and fair market value compensation. CMS also revised the rules on distribution of overall profits in order to further value-based care models. (Revisions to the special rules of profits shares and productivity bonuses are effective January 1, 2022).
-
Definition of DHS.[16] CMS amended the definition of DHS, significantly limiting the services that may be considered inpatient hospital services. Services furnished to inpatients by a hospital will only be considered DHS if the services increase the amount of Medicare’s payment to the hospital under the Inpatient Prospective Payment System. The definition extends to additional prospective payment systems, including those for inpatient rehabilitation facilities, inpatient psychiatric facilities, and long-term care hospitals. CMS did not extend the policy change to hospital outpatient services since it is rare for a physician other than an ordering physician to refer a patient for additional outpatient services compensated within the same ambulatory payment classification.
-
Special rules on compensation and compensation arrangements.[17] CMS clarified that the “set in advance” language found in the special rules is a deeming provision, and that reducing compensation to writing before the furnishing of items or services is not the only avenue to comply with the set in advance requirement. The rules also make clear that compensation may be modified, prospectively, during the term of an arrangement and still be considered set in advance. Additionally, a new special rule on compensation arrangements was finalized, including new special rules for noncompliance with writing and signature requirements, as well as a new rule on electronic signatures.
-
Exception of electronic health record (EHR) items and services.[18] Notably, CMS eliminated the sunset provision of the exception for EHR items and services. CMS stated that despite the achievement of widespread adoption of EHRs, it did not anticipate the need for donation of such items, and services would disappear. The revisions to this exception are complemented by the new exception for cybersecurity technology and related services.
OIG final rule: The Anti-Kickback Statute
The federal Anti-Kickback Statute (AKS) prohibits the knowing and willful payment of any remuneration to induce the referrals or generation of business of any item or service payable by a federal healthcare program.[19] The AKS and its regulations include exceptions to the definition of “remuneration,” where certain payment arrangements would not be deemed as violating the AKS (the safe harbors) if all of the safe harbor elements are met. OIG, attempting to balance “flexibility for beneficial innovation and better coordinated patient care,” while ensuring that necessary safeguards against federal healthcare program abuse remain intact, amended the AKS by implementing seven additions and four modifications to the safe harbors. Of the new safe harbors, three are specifically intended to address the shift toward value-based care, paralleling CMS’s incorporation of value-based exceptions into the Stark Law, as explained above. A high-level summary of these safe harbors follows. (Note that each safe harbor contains substantially more detail than described in this article, including numerous new definitions and elements).
Value-based arrangements
OIG established three new AKS safe harbors for remuneration among eligible value-based arrangement participants involving publicly or privately insured patients. The safe harbors offer greater flexibility for parties with greater financial risk. (The protections offered by the value-based arrangement safe harbors are prospective only and will be effective 60 days after the final rule is published in the Federal Register). OIG specified that only the VBE and its participants may be parties to a value-based arrangement, and the safe harbor does not protect remuneration to VBE participants’ contractors or beneficiaries.
-
Care coordination arrangements to improve quality, health outcomes, and efficiency without requiring the parties to assume risk. This safe harbor applies to in-kind remuneration among qualifying VBE participants with no risk or which assume less than substantial downside risk. This safe harbor must be commercially reasonable, in writing, and with records retained. The safe harbor also requires the parties to establish and monitor legitimate outcomes or process measures that they reasonably anticipate will advance the “coordination and management of care for the target patient population based on clinical evidence or credible medical or health science support.”[20] The safe harbor prohibits the remuneration offeror from considering the volume or value of, or conditioning the remuneration on, “(i) referrals of patients that are not part of the value-based arrangement’s target patient population; or (ii) business not covered under the value-based arrangement.”[21] This safe harbor requires the recipient to pay at least 15% of the offeror’s cost for the in-kind remuneration.[22]
-
Arrangements with substantial downside financial risk. This safe harbor covers in-kind and monetary remuneration, offering more flexibility than the care coordination safe harbor. Even though this safe harbor’s elements are similar to the care coordination safe harbor, the VBE must have assumed substantial downside financial risk from a payer for at least one year.[23] The remuneration also “need not be used predominantly to engage in value-based activities that are directly connected to the items and services for which the VBE is at substantial downside financial risk.”[24]
-
Arrangements with full financial risk. The full financial risk safe harbor addresses in-kind and monetary remuneration. Full financial risk requires that “the VBE [be] financially responsible on a prospective basis for the cost of all items and services covered by the applicable payor for each patient in the target patient population for a term of at least 1 year.”[25] This safe harbor requires the arrangement to be set forth in writing for at least one year and prohibits the parties from taking into account patient referrals when the patients do not fall within the target population or the value-based arrangement.[26]
Additional new AKS safe harbors
-
Arrangements for patient engagement and support to improve quality, health outcomes, and efficiency. This protects patient engagement tools or support, which are in-kind items, goods, and services furnished directly by VBE participants to patients in a target population that have a direct connection to the coordination and management of care of the target patient population.[27] For purposes of this safe harbor, “target patient population” means “an identified patient population selected by the VBE or its VBE participants using legitimate and verifiable criteria” that must be set out in writing at the commencement of the value-based arrangement and further the VBE’s value-based purpose. The items must advance one or more of the enumerated goals set forth in the regulation, such as ensuring patient safety or prevention or management of a disease or condition. The tools and support may not be cash or a cash equivalent, and are subject to a $500.00 annual, aggregate cap. However, OIG noted that there may be lawful means for providers to offer tools and support in excess of this figure where patients demonstrate financial need. Significantly, note that because a practice that is permissible under the AKS is excepted from the beneficiary inducements civil monetary penalty law, this safe harbor would also remove barriers presented by that law.
-
CMS-sponsored model arrangements and CMS-sponsored patient incentives. This protects remuneration furnished between or among parties to financial arrangements established under the Medicare Shared Savings Program and/or other models tested by the CMS Innovation Center (CMS-sponsored models), including distribution of capitated payments, shared savings, or shared losses.[28] This also protects remuneration in the form of patient incentives provided by CMS-sponsored model participants, as long as certain conditions are met, including, for example, that the patient incentive have a direct connection to the patient’s healthcare (unless otherwise stated in the CMS-sponsored model participation documentation).
-
Cybersecurity technology and services. This safe harbor is intended to tackle the increasing threat of cyberattacks affecting healthcare entities by protecting the furnishing of “nonmonetary remuneration (consisting of cybersecurity technology and services) that is necessary and used predominantly to implement, maintain, or reestablish effective cybersecurity,”[29] with no monetary cap. All donors and recipients of donations are protected by this safe harbor, including when the recipient is a patient. However, donors may not directly take into account the volume or value of referrals or other business generated between the parties when determining the eligibility of a potential recipient or the amount or nature of the technology or services to be donated.[30] Donors and recipients must enter into a written agreement specifying the technology and services that are being provided, although the writing does not have to be reduced to a single document.[31]
-
Accountable care organizations (ACO) beneficiary incentive program. The Bipartisan Budget Act of 2018[32] added a section to the Social Security Act to permit an ACO participating under one of two payment models to apply to establish an ACO Beneficiary Incentive Program to enable an ACO to provide incentive payments to beneficiaries who are furnished “qualifying services,” which are defined as primary care services furnished through an ACO by an ACO professional who has a primary care specialty designation.[33] OIG incorporated this statutory exception into a safe harbor by excluding from the definition of “remuneration” incentive payments made by an ACO to an assigned beneficiary under an ACO Beneficiary Incentive Program, so long as the payment is made in accordance with the requirements set forth in the Social Security Act.[34]
Modifications to existing AKS safe harbors
-
Outcome-based payments and part-time arrangements. The personal services and managements contracts safe harbor was modified to protect “outcomes-based payments,” defined as “payments between or among a principal and an agent that: (A) Reward the agent for successfully achieving an outcome measure described in paragraph (d)(2)(i) [of the safe harbor]; or (B) Recoup from or reduce payment to an agent for failure to achieve an outcome measure described in paragraph (d)(2)(i) [of the safe harbor].”[35] These arrangements must be set out in writing and signed by the parties in advance of, or contemporaneous with, the commencement of the terms of the outcome-based payment arrangement.[36] OIG also revised this safe harbor to allow for more flexibility for personal services arrangements, replacing the requirement that aggregate compensation be set in advance with a requirement that the compensation methodology be set in advance and eliminating the requirement that periodic, sporadic, or part-time agreements specify the schedule, length, and exact charge for such intervals.[37]
-
Warranties. OIG modified this safe harbor to incorporate a definition of warranty, which used to be defined by reference to another regulation.[38] In doing so, OIG noted that this safe harbor is available for Food and Drug Administration–regulated drugs and devices. This safe harbor was also modified to cover warranties that warrant a bundle of items or one or more items and services, although it does not cover warranties that only warrant services. OIG also added a requirement that warranty remuneration for any medical, surgical, or hospital expense incurred by a beneficiary is capped at the cost of the items and services subject to the warranty, which is intended to play “an important role in safeguarding against sellers providing excess remuneration to providers to induce referrals.”[39]
-
EHR items and services. This safe harbor protects remuneration in the form of donated cybersecurity software and services that protect EHR, although hardware is expressly excluded.[40] OIG also modified the definition of EHR, clarifying that it is “‘a repository of electronic health information that: (A) Is transmitted by or maintained in electronic media; and (B) relates to the past, present, or future health or condition of an individual or the provision of healthcare to an individual.’”[41] Significantly, OIG also eliminated the safe harbor’s sunset provision, which required all protected EHR donations to occur before December 31, 2021, allowing for the permanent protection of donations that meet the requirements of this safe harbor.[42]
-
Local transportation. This safe harbor protects remuneration in the form of free or discounted local transportation made to federal healthcare program beneficiaries if certain conditions are met. OIG revised this safe harbor to expand the distance to which residents of rural areas may be transported from 50 to 75 miles.[43] OIG also eliminated any mileage limit on transportation furnished to a patient who has been discharged from a facility after admission as an inpatient or when a patient is discharged after spending 24 hours in observation status, regardless of where the patient resides, so long as the transportation is to the patient’s residence or another residence of the patient’s choice.[44]
OIG final rule: Beneficiary inducements CMP
The beneficiary inducements civil monetary penalty (CMP) law prohibits any person from offering or transferring any remuneration to a Medicare or Medicaid beneficiary that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier of Medicare or Medicaid payable items or services.[45] In 2000[46] and in 2016,[47] OIG codified final rules amending the term “remuneration” to exclude from its definition certain payment arrangements under the Beneficiary Inducement CMP law.[48]
Exception for telehealth technologies for in-home dialysis
In the OIG final rule, OIG established a new exception to the definition of remuneration in the CMP law to protect the provision of telehealth technologies by a provider of services, physician, or renal dialysis facility to an individual with end-stage renal disease who is receiving in-home dialysis paid for by Medicare Part B.[49] “Telehealth technologies” is defined broadly to mean “hardware, software, and services that support distant or remote communication between the patient and provider, physician, or renal dialysis facility for diagnosis, intervention, or ongoing care management,”[50] without reference to any specific type of technology, a limit on the type of communication, or a requirement that the telehealth services be paid for by Medicare Part B. As such, OIG noted that all technologies would be protected (including telephones, facsimile machines, and electronic mail systems), as long as all conditions of the exception are met.[51]
Conclusion
As the CMS final rule is almost 200 pages and the OIG final rule is more than 212 pages, both are extremely detailed and cover significant territory. Stakeholders should carefully review both final rules to ensure current and future arrangements comply with these fraud and abuse regulations, as amended.
Takeaways
-
The final rules create new regulatory exceptions to the Stark Law and new regulatory safe harbors to the Anti-Kickback Statute to accommodate innovative, value-based arrangements.
-
The Centers for Medicare & Medicaid Services final rule revises the Stark Law regulations, eliminating or revising certain requirements in current regulatory exceptions and clarifying key terminology.
-
The Office of Inspector General final rule established seven additions and four modifications to the Anti-Kickback Statute safe harbors.
-
The Office of Inspector General final rule excludes certain telehealth technologies for in-home dialysis from the definition of compensation under the Civil Monetary Penalties Law.
-
The final rules are effective January 19, 2021, with the exception of revisions to the Stark Law’s special rules for group practice, which become effective January 1, 2022.