New Disclosure Requirements to be Phased-In to CMS Enrollment and Revalidation Process

On September 5, 2019, the Centers for Medicare & Medicaid Services (“CMS”) issued a final rule (“Final Rule”) effective November 4, 2019, which increases disclosure requirements for the provider and supplier enrollment and revalidation process. The Final Rule is aimed at increasing the information provided to CMS in enrollment and revalidation to identify fraud, waste, and abuse, and expanding CMS’s authority to deny, revoke, or delay a provider’s or supplier’s ability to participate in Medicare, Medicaid and CHIP based on a provider’s or supplier’s relationship with previously sanctioned entities.  The Final Rule revises several existing regulations and adds an onerous regulation titled “disclosure of affiliations,” at 42 C.F.R. § 424.519. This new disclosure requirement mandates that, at the time of reenrollment or revalidation, each provider and supplier must list all “disclosable events” for each “affiliation” within the past five (5) years, even if the provider/supplier is not affiliated with such person/entity at the time of enrollment or revalidation. This new requirement is greatly expanded from the previous disclosure requirement, where providers/suppliers were only required to disclose their own adverse actions.

A provider or supplier must disclose its affiliations that have one of the following “disclosable events”:

• Currently has an uncollected debt to Medicare, Medicaid or CHIP;
• Has been or is subject to a payment suspension under a federal health care program;
• Has been or is excluded by the Office of the Inspector General from participation in Medicare, Medicaid, or CHIP; or
• Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked, or terminated.

42 C.F.R. § 424.502.

Note that on the last disclosable event, the Final Rule could be interpreted to require disclosure of any enrollment denial, including billing privileges and arguably denials of Change of Ownership or Change of Location requests.

Moreover, CMS articulated a broad definition of “affiliations” which means, in relation to the provider/supplier, any individual or entity that holds:

• A five (5) percent or greater direct or indirect ownership interest;
• A general or limited partnership interest (regardless of the percentage);
• An interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization regardless of an employment relationship;
• An officer or director position; or
• Any reassignment relationship (e.g., reassignment of billing rights).

42 C.F.R. § 424.502.

CMS may revoke privileges if a provider or supplier knew or reasonably should have known about an affiliate’s disclosable events. CMS declined to provide an objective standard to such a knowledge requirement, but provided that a provider/supplier must make a “sufficient effort” when evaluating whether an affiliate has a disclosable event that such provider/supplier must report.  Such an effort could  include the provider/supplier directly contacting the affiliate, and potentially mining historical data, not just publically available data. In the context of complex legal structures including publicly owned companies or private equity-backed providers, CMS’s definition of affiliation can quickly result in a time-consuming process of review.  The disclosure requirements in the Final Rule apply to all providers and suppliers, but only at time of initial enrollment and revalidation, which is a significant improvement from the proposed rule (which, if adopted, would have required disclosures for change of ownership and change of information filings).

Once an affiliation is disclosed to CMS, CMS will require additional information about the affiliate, the relationship, and the disclosed adverse information, and will conduct an analysis of whether such affiliation presents an “undue risk” of fraud, waste, and abuse to the Medicare Program, such that the disclosing provider/supplier’s billing privileges should be denied or revoked.

Recognizing that compliance with this Final Rule will be an arduous task for a large number of providers and suppliers, CMS adopted a “phased in” approach. First, CMS will require disclosure of affiliations only when specifically requested by CMS. CMS will then implement new CMS-855 forms (which will also go through a separate notice and comment period), and will issue subregulatory guidance on the new forms and disclosure requirements. Only then will providers and suppliers be required to comply with the disclosure requirements during initial enrollment and revalidation.  It is expected that the “phased-in” approach could extend over the course of the next few years, and in the second phase, may initially only require compliance by certain providers/suppliers.

Even though the immediate impact of the disclosure requirements is limited, providers and suppliers should understand the extensive scope of the new requirement and understand what steps will need to be taken to review in detail their affiliations, both past and present, once the complete scope of the disclosure requirements are officially implemented.

If you have further questions about this Final Rule, please contact the authors or your regular Dorsey attorney.

The Final Rule on the new disclosure requirements can be found on the website of the Federal Register here.