CMS states that its newaffiliations disclosure requirements allow it to identifyindividuals and organizations that pose an undue risk of fraud,waste or abuse based on their relationship with other previouslysanctioned individuals.

Fraud on government health benefit programs has been a majorproblem for decades. Despite enormous resources deployed at boththe federal and state levels to recover moneys fraudulentlyobtained and to hold the perpetrators accountable, programs such asMedicare and Medicaid continue to be billed for and pay out claimsfor items or services that were not actually provided, or that werenot necessary or appropriate for the patient, or that were providedpursuant to an illegal kickback or self-referral scheme.

A major part of this fraud problem clearly has been the factthat the programs' fiscal intermediaries (FI) usually pay out theseclaims, and then the FI or the government itself must take steps toretrieve the improper payments and punish the perpetrators. Theaudits, investigations, and subsequent criminal and civil actionsand debarment proceedings can take years. Another significantproblem is that some perpetrators, after being caught and excludedfrom the programs, manage to get back into business under differentnames or by exercising behind-the-scenes control of otherparticipating providers or suppliers (hereinafter collectively"providers").

Now, however, the federal Centers for Medicare and MedicaidServices (CMS) has finalized sweeping new rules that have been inthe works since the Obama administration giving CMS more authorityto prevent fraud by keeping problem providers from enrolling inMedicare, Medicaid or the Children's Health Insurance Program(CHIP), or removing them more expeditiously and barring them fromapplying for re-enrollment for longer periods of time. The finalrule, known as the Program Integrity Enhancements to the Provider EnrollmentProcess (CMS-6058-FC), takes effect on Nov. 4, 2019.

Affiliations

Under the final rule, all providers that participate inMedicare, Medicaid or CHIP must disclose any current or past"affiliations" with any organization that has any of the following"disclosable events":

• currently has an uncollected debt to Medicare, Medicaid or CHIPregardless of the amount, or whether the debt is currently beingrepaid or appealed;
• has been or is subject to a payment exclusion under a federalhealth care program regardless of when the payment suspensionoccurred or was imposed;
• has been or is excluded by the Office of Inspector General fromparticipation in Medicare, Medicaid or CHIP, regardless of whethersuch exclusion is currently being appealed or when it occurred orwas imposed; or
• has had its Medicare, Medicaid or CHIP enrollment denied,revoked or terminated regardless of the reason, or whether it iscurrently being appealed, or when it occurred or was imposed.

This disclosure must be made as part of a provider's initialenrollment application and when they revalidate. CMS is in theprocess of updating its 855 enrollment and revalidation form toaccommodate such disclosures.

The final rule defines a participating provider's "affiliation"as including:

• a 5 percent or greater direct or indirect ownership interestthat an individual or entity has in another organization;
• a general or limited partnership interest—regardless ofpercentage—that an individual or entity has in anotherorganization;
• an interest in which an individual or entity exercisesoperational or managerial control over, or directly or indirectlyconducts, the day to day operations of another organization eitherunder contract or some other arrangement;
• any interest in which an individual is acting as an officer ordirector of a corporation; and
• any re-assignment relationship under 42 CFR 424.80.

As examples, a Medicare-participating hospital would have todisclose to CMS if a director or trustee has a 5 percent or moreownership interest in another entity that owes a Medicare repaymentor has been under a Medicare payment exclusion. A hospital wouldalso have to disclose whether a physician who re-assigns his or herMedicare payment to the hospital owes a Medicare repayment, hasbeen subject to a payment exclusion, or has any other disclosableevent.

Once a provider discloses the required information, CMS is todetermine whether any of the disclosed affiliations "poses an unduerisk of fraud, waste or abuse" by considering the followingfactors:

• the duration of the affiliation;
• whether the affiliation is continuing, or if not, when itended;
• the degree and extent of the affiliation;
• the reason for the termination, if any, of theaffiliation;
• the circumstances of the affiliated provider's disclosableevent; and
• any other evidence that CMS deems relevant to itsdetermination.

The final rule also authorizes CMS to deny an enrollmentapplication or to revoke an existing enrollment if:

• a provider circumvents rules by coming back or attempting tocome back into the program under a different name;
• a provider bills for services/items from non-compliantlocations;
• a provider exhibits a pattern or practice of abusive orderingor certifying of Medicare Part A or Part B items, services ordrugs; or
• a provider has an outstanding debt to CMS from an overpaymentthat was referred to the Treasury Department.

The provision regarding billing from a non-compliant location isparticularly severe. The final rule states that CMS can revoke aprovider's Medicare enrollment "if the provider billed for servicesperformed at or items furnished from a location that it knew orshould have known did not comply with Medicare enrollmentrequirements." This penalty can be imposed even if all of theprovider's other practice locations comply with Medicare'senrollment requirements.

In determining whether enrollment should be revoked due to anon-compliant location or locations, the final rule states that CMSwill consider the following factors:

• the reason(s) for and the specific facts behind the location'snon-compliance;
• the number of additional locations involved;
• whether the provider has any history of final adverse actionsor Medicare or Medicaid payment suspensions;
• the degree of risk that the location's continuance poses to theMedicare Trust Funds;
• the length of time that the non-compliant location wasnon-compliant;
• the amount that was billed for services performed at or itemsfurnished from the non-compliant location; and
• any other evidence that CMS deems relevant to itsdetermination.

The final rule also targets "ordering, certifying, referring, orprescribing of Part A or B services, items or drugs" by physiciansor other practitioners "that is abusive, represents a threat to thehealth and safety of Medicare beneficiaries, or otherwise fails tomeet Medicare requirements." An obvious example of such abuse wouldbe a practitioner who has over-prescribed opioid medications.

The final rule sets forth the factors that CMS can consider indetermining whether abuse by a practitioner has occurred:

• whether the practitioner's diagnoses support the orders,certifications, referrals or prescriptions in question;
• whether the necessary evaluation of the patient occurred duringa legitimate office visit;
• the number and types of disciplinary actions taken against thepractitioner by a state licensing or medical board, and the reasonstherefor;
• whether the practitioner has any history of final adverseactions;
• the length of time over which the pattern or practice inquestion continued;
• how long the practitioner has been enrolled in Medicare;
• the number and type(s) of malpractice suits filed against thepractitioner related to ordering, certifying, referring orprescribing that have resulted in either a final judgment orsettlement;
• whether any state Medicaid program or any other public orprivate health insurance program has restricted, suspended, revokedor terminated the practitioner's ability to practice, and thereason(s) for same; and
• any other information that CMS deems relevant to itsdetermination.

Penalties

CMS states that its new affiliations disclosure requirementsallow it to identify individuals and organizations that pose anundue risk of fraud, waste or abuse based on their relationshipwith other previously sanctioned individuals or entities:

For example, a currently enrolled ornewly enrolling organization that has an owner/managing employeewho is "affiliated" with another previously revokedorganization can be denied enrollment in Medicare, Medicaid andCHIP or, if already enrolled, can have its enrollment revokedbecause of the problematic affiliation.

CMS Press Release, "CMSAnnounces New Enforcement Authorities to Reduce Criminal Behaviorin Medicare, Medicaid and CHIP" (Sept. 5, 2019).

The failure of a participating provider to "fully and completelydisclose" required information to CMS when it "knew or should havereasonably known" of this information can result in the denial ofthe provider's initial Medicare enrollment application or therevocation of its existing Medicare enrollment.

Re-application after revocation

The final rule imposes new obstacles to re-enrollment forproviders that have had their Medicare enrollment revoked.Previously, CMS could prevent revoked providers from re-applyingfor up to three years. The final rule authorizes CMS to blockrevoked providers from re-enrolling in Medicare for up to 10 years.CMS can also add up to three more years to a provider'sre-enrollment bar (even if it exceeds the 10-year period) if itdetermines that the provider is attempting to circumvent itsexisting enrollment bar by enrolling in Medicare under a differentname, numerical identifier, or business entity.

Moreover, under certain circumstances, CMS may revoke any andall of a provider's Medicare enrollments, whether under differentnames, numerical identifiers, or business entity. In other words,if a pharmacy and a durable medical equipment company are undercommon ownership, and the pharmacy's Medicare enrollment is revokedbecause of abuse, the medical equipment company's Medicareenrollment can also be revoked. If a provider has been revoked fromMedicare enrollment for a second time, CMS can now block thatprovider from re-enrolling in Medicare for up to 20 years.

Analysis

As noted earlier, the final rule takes effect on Nov. 4, 2019,which is also the last day for submitting comments to the finalrule. The disclosure requirement applies to any affiliation goingback up to five years, regardless of whether the affiliation hasbeen terminated.

Providers will have to take steps to protect themselves. It isadvisable, for example, to add a reporting requirement of any"disclosable event" to any governing board disclosure forms.Contracts with any individual or entity that qualifies as an"affiliation" should include a disclosure clause requiring theaffiliate to inform the provider about any "disclosable event" sothe provider can report it to CMS. The same applies to anyre-assignment agreement with any physician.

The final rule will place new stresses on already busycompliance officers, require providers to implement new policiesand procedures, and result in more paperwork. As some publiccommenters have pointed out, among the difficulties presented bythe final rule is the fact that, while there are public data basesidentifying providers who have been excluded from Medicare andMedicaid, there is no public database identifying those whoseMedicare enrollments have been denied, revoked or terminated, orwho have an uncollected debt to Medicare, Medicaid or CHIP. Thus,many providers will have to depend upon their affiliates to act ingood faith and timely inform the providers of any disclosableevent(s).

Francis J. Serbaroli is a shareholder inGreenberg Traurig and the former vice chair of the New York StatePublic Health Council.