Licensure and scope of practice: Key aspects of state regulation

PA and NP licensure and scope of practice are regulated primarily at the state level, and states are anything but uniform in this regard. State boards of licensure (boards of nursing for NPs and either boards of medicine or boards of physician assistants for PAs) dictate limitations on such APPs’ scopes of practice and the extent to which they must be supervised, if at all, by physicians. Notably, a state’s rules may differ for PAs and NPs, although some states have made the regulatory regimes governing PAs and NPs fairly similar. Therefore, compliance professionals must be attuned to the differences between rules governing each type of APP.

Main categories of PA and NP regulation that compliance professionals should track based on their workforce and location include the following:

• Independent, transitional, or physician-supervised practice: A state may allow APPs to practice independently of physician supervision. Alternatively, a state may require that such APPs only practice under the supervision of or in collaboration with a physician. States may use either supervision or collaboration to refer to the involvement of a physician in overseeing the APP. Supervision generally relates to the oversight of an APP by a physician, whereas collaboration may refer to an agreement providing consultative services and general practice collaboration. The level of supervision or collaboration may also differ based on the practice setting. In some states, such APPs may transition from providing services under physician supervision to independent practice (after a defined period of supervised practice). In states where some type of physician relationship is required, the scope of practice of the APP generally may not exceed that of the supervising physician.

• Practice agreements: Many states where independent APP practice is not allowed require an agreement between an APP and the supervising or collaborating physician. These practice agreements document the terms of the relationship between the APP and the physician. They often must contain statutorily or regulatorily required elements, such as the frequency and mode of interaction between the APP and the physician, procedures for reviewing patient charts or outcomes, availability for consultation, backup supervision or collaboration procedures, and a list of drugs or devices that the APP is permitted to prescribe. Some states require these agreements to be filed with the state and/or reviewed and updated periodically. It is common for applicable rules to mandate that the agreements be kept on file at the primary location where either the APP or physician practices.

• Supervision/collaboration: For states where some form of supervision or collaboration is required, applicable rules often detail the permissible manner and mode of such interaction between APPs and physicians.

  • Location: Most states require physicians to be available for consultation via telecommunication in real-time. Other states permit broader supervision to occur remotely (e.g., monthly or quarterly check-ins). In contrast, some states impose periodic in-person meeting requirements or require the supervising physician to be within a certain distance from the APP. Most of these laws do not clearly address how supervision must be provided when care is delivered only virtually.

  • Ratios: Many states limit the number of APPs a physician can supervise at once based on either full-time equivalent hours or number of individuals. Some states impose one ratio requirement for both PAs and NPs, while other states apply one ratio for supervision of PAs and another for NPs.

• Chart reviews: States may require that the supervising or collaborating physician review a specific percentage of charts of patients seen by the APP or for which the APP has issued a prescription. States may prescribe that these reviews occur monthly, quarterly, or other frequencies and some states require that the APP and physician document the review in writing.

• Prescriptive practice: In most states, PAs and NPs have prescriptive authority by virtue of their license, irrespective of whether independent practice is allowed, but that authority is not unfettered. Where a physician relationship is required, APP prescriptive practice is generally limited to that of the supervising physician. States may impose a variety of additional requirements or restrictions on APPs’ prescribing authority.

  • Additional approvals: Some states require APPs to separately apply for prescriptive authority on top of their licenses. In other states, APPs may only apply for prescriptive authority after meeting specific education and mentoring requirements.

  • Formularies: Many states limit APPs’ prescriptive authority to non-dangerous or nonscheduled drugs or to lists of drugs or drug classes included in the APP’s agreement with a supervising physician.

  • Physician review: While few states require active physician involvement in APP prescribing (e.g., cosigning scripts or charts), some states require physicians to review a subset of prescriptions issued by the APP or need the APP to include particular identifying information of the supervising physician on the script.

As statutes and regulations evolve to address telehealth, provider organizations need to adjust their care delivery workforce structure and compliance functions to reflect new realities of PA and NP practice.

Billing requirements: Major aspects of federal regulation

Medicaid, Medicare, and other third-party payors generally pay bills directly submitted by an APP under such APP’s own national provider identifier (NPI). There are also several limited instances in which Medicare permits physicians to bill for services furnished by their contracted APPs and collect reimbursement at a higher rate as a result.

• Direct billing: Medicare permits PAs and NPs to bill directly for services they furnish. However, Medicare only pays 85% of the Medicare Physician Fee Schedule (MPFS) rate for services rendered by APPs.

• Incident-to billing: For individual services furnished in an outpatient setting in part by a physician and in part by either a PA or an NP, Medicare permits the physician to bill under their own NPI for the jointly performed service and collect 100% of the MPFS rate if specific incident-to requirements are satisfied. Services that may be performed by APPs on an incident-to basis include (i) services ordinarily rendered by a physician’s office staff person, and (ii) services that would typically be personally performed by the physician.^[2] A physician may only bill for the services of an APP on an incident-to basis when each of the following five requirements is met:

  1. The services must be of a type that is commonly furnished and considered medically appropriate to provide in a physician’s office setting.^[3]

  2. The APP performing the services must qualify as “auxiliary personnel” acting under the physician’s supervision and be an expense incurred by the physician or the legal entity billing and collecting for the incident-to services.^[4]

  3. There must be an initial physician’s service provided to the patient to which the services of the APP are considered an incidental part (i.e., an APP service furnished to a new patient or to an established patient with a new issue for which the physician has not seen the patient and initiated the course of treatment does not constitute an incident-to service).^[5]

  4. The physician must perform subsequent services at a frequency that reflects their active participation in and management of the course of treatment (but the physician need not actually render a service each time the APP sees the patient).^[6]

  5. The APP furnishing the service generally must do so under direct physician supervision (the physician does not need to be physically present in the same room but must be in the office suite and immediately available to provide assistance and direction).^[7] In group practices, the physician supervising the APP need not be the same physician treating the patient.^[8]

PA and NP billing rules under Medicare are typically of greatest concern to compliance professionals due to the complexity of complying with these requirements and the risk of civil monetary penalties and potential False Claims Act (FCA) liability resulting from submitting improper bills. Violations of the Civil Monetary Penalties Law^[9] or the FCA^[10] can result in substantial financial penalties and, in egregious cases, criminal liability under the FCA and exclusion from participation in federal healthcare programs under the exclusion statute.^[11]

COVID-19 waivers made APPs’ practice more flexible

Waivers of customary PA and NP requirements—while necessary for expanding access to care during the COVID-19 pandemic—created a compliance minefield that provider organizations continue to navigate.

During the pandemic, most states issued temporary waivers relaxing licensure and scope of practice requirements for healthcare professionals, including PAs and NPs. For example, some states allowed PAs and NPs to furnish services without practice agreements or formal supervisory relationships, waived APP-physician ratio limitations, suspended requirements regarding chart reviews and documented meetings between APPs and physicians, or allowed APPs to prescribe specific drugs without adhering to usual procedures. In addition, APPs were temporarily permitted to practice in many states where they were not licensed. This made it easier for telehealth delivered by APPs to proliferate.

The Centers for Medicare & Medicaid Services also issued temporary waivers of various federal healthcare program requirements. In Medicare, incident-to billing rules regarding a physician’s direct supervision of APPs were relaxed during the pandemic. Under the temporary change, physicians could bill incident-to services when providing supervision to PAs and NPs via real-time, interactive audio-visual technology; the physician no longer had to be physically present in the office suite but needed only to be immediately available via the required technology. Similarly, APPs furnishing services incident-to a physician’s service could provide such services via telehealth, assuming all other requirements were satisfied.

Most of the waivers have been rescinded in whole or part, and provider organizations that rely heavily on these waivers to deliver services need to ensure that they have properly implemented or reinstated proper protocols. If the 2023 MPFS proposed rule is finalized as currently drafted, Medicare incident-to billing rules are set to revert to requiring in-person direct supervision at the end of the calendar year in which the federal public health emergency is declared over (as of now, 2023). Provider organizations can expect that billing during and following the pandemic will continue to be put under the microscope—especially to the extent services are furnished or supervised via telehealth modalities.

Medicare billing rules and recent enforcement trends highlight APPs and telehealth

With the proliferation of telehealth and pandemic-era regulatory changes, provider organizations that utilize PAs and NPs must be attuned to new nuances in billing rules. There has been federal enforcement activity related to APPs centers on incident-to billing.^[12] In recent years, numerous instances have been of enforcement actions against providers for violating the FCA due to noncompliance with incident-to billing rules. For instance, recently, a physician-owned medical practice in New York paid $850,000 to settle that it improperly billed PA services as though a neurologist had rendered the services despite knowing that the incident-to billing rules were not met (in this case, no neurologist was even in the office on more than 120 occasions).^[13]

The U.S. Department of Health & Human Services, Office of Inspector General (OIG) has recently called attention to risks to Medicare posed by the intersection of telehealth and incident-to billing during the pandemic.^[14] Scrutiny of such billing practices will likely grow; as a result, it will be essential for compliance professionals to follow closely changes in Medicare billing rules and implement controls within their organizations to prevent improper billing.

Compliance professionals would also be wise to focus more broadly on telehealth practice by PAs and NPs. The U.S. Department of Justice has announced a telehealth fraud “takedown” in 2021 and 2022, each alleging over $1 billion in alleged losses by federal healthcare programs.^[15] This has prompted the OIG recently to issue a special fraud alert^[16] warning providers of suspect telehealth arrangements, in which the OIG cites two instances of NPs defrauding Medicare through telehealth schemes.^[17] While these are extreme examples, they indicate the growing focus of federal enforcement authorities on instances of fraudulent billing for services furnished via telehealth.

Licensure and scope of practice compliance concerns are at the fore of NP and PA telehealth practice

Provider organizations—especially primarily telehealth- or digitally based—are increasingly relying on PAs and NPs as the core of their provider workforce. In light of outdated statutory and regulatory regimes governing PA and NP practice in a telehealth environment, such reliance presents unique compliance challenges—mainly when the provider organization operates across multiple states.

• Maintaining state licenses and practice agreements: APPs and their supervising physicians, as applicable, must each be licensed in and comply with licensure and good standing requirements of every state where the patients they provide services to are located, as well as the state in which the APP is located. Compliance officers should ensure their provider organizations have processes in place to track state requirements and their APPs’ licensure and compliance. Where states require that documentation be retained at the APP’s or physician’s primary site of practice, it is unclear how to comply with such requirements in the context of a telehealth-based practice, but a potential strategy would be to maintain this documentation in a manner that makes it accessible to the physician, APP, compliance officer, and/or human resource department.

• Matching patients with appropriately licensed providers: The laws and regulations governing much of an APP’s practice are determined by the patient’s location—not the APP’s. Compliance officers must ensure telehealth or digital health providers have mechanisms to verify a patient’s current location at the time of service, which could be accomplished by geotracking, patient reporting, or attestation. Using this information, the provider organization must ensure the patient is matched with an appropriately licensed APP and as applicable, supervised by a similarly licensed physician with whom the APP has a valid practice agreement in such state.

• Supervisory meetings and chart reviews: In states where an APP is required to periodically meet with or review a subset of charts with their supervising or collaborating physician, rules are often unclear as to whether such activities can take place remotely. If such activities must be performed in person, absent guidance from the licensure board, whether those activities can occur via audio-visual modalities remains an open question for provider organizations to assess.

• Location requirements: For states that require APPs and their supervising physicians to practice within a certain distance from one another within the state, telehealth-based provider organizations may find it challenging to meet these requirements or figure out how these requirements apply to telehealth.

• Prescriptive practice: Perhaps of extreme concern to regulators—as highlighted by recent enforcement trends—is provider prescribing, particularly of controlled substances, based solely on a virtual visit.

  • Patient relationships and clinical appropriateness: Prevailing law requires that providers establish a patient relationship, which often requires a face-to-face or physical examination, prior to prescribing. Where clinically appropriate, most states allow for examination requirements to be satisfied via telehealth modalities (whether audio-visual or other). Despite these flexibilities, provider organizations—especially telehealth-based provider organizations—have recently come under fire for pressuring APPs to prescribe without having first examined a patient, following insufficient examinations, or based on patient responses to questionnaires (usually inadequate to establish a patient relationship or enable prescribing). The OIG’s special fraud alert on telehealth fraud specifically calls out suspect prescribing practices such as (i) using audio-only technology to engage patients, regardless of patient preference or appropriateness of such modality, and (ii) basing prescribing decisions on purported “medical records” that represent only “cursory patient demographic information or a medical history that…does not provide sufficient clinical information” to inform proper care.^[18]

  • Scope of practice and controlled substances: One common state restriction on APP prescribing is prohibiting or placing preconditions on APPs’ ability to prescribe controlled substances or requiring APPs to adhere to state formularies. States may also place general limitations on the ability of providers to prescribe controlled substances via telehealth. Such laws regarding prescribing controlled substances may be stricter than, and must be read alongside, federal requirements on the same topic. As the prevalence of telehealth-based provider organizations increases, so will enforcement targeting their prescribing practices, especially when controlled substances are routinely prescribed.

There is some good news: In response to the increased use of NPs and PAs and recognition of the essential role APPs play in addressing physician shortages, some states have recently relaxed some of the licensure and supervision requirements to allow APPs to practice more independently.