CMS Proposes Significant Expansions to its Revocation Authority

On March 1, 2016, the Centers for Medicare & Medicaid Services (CMS) released a proposed rule that, if finalized in its current form, would significantly expand its authority to deny or revoke a provider’s participation in the Medicare program. As stated by CMS, “These enhancements, if finalized, would allow CMS to take action to remove or prevent the enrollment of health care providers and suppliers that attempt to circumvent Medicare’s enrollment requirements through name and identity changes as well as through elaborate, inter-provider relationships.”

The proposed rule requires Medicare, Medicaid, and Children’s Health Insurance Program (CHIP) providers to disclose any current or previous direct or indirect “affiliation” with a provider that has experienced a “disclosable event.” CMS proposed a broad definition of “affiliation” to encompass any of the following: (1) 5% or greater direct or indirect ownership interest that an individual or entity has in another organization; (2) a general or limited partnership interest that an individual or entity has in another organization, regardless of percentage; (3) an interest in which an individual or entity exercises operational or managerial control over or directly or indirectly conducts the day-to-day operations of another organization; (4) an interest as an officer or director of a corporation; or (5) any reassignment interest. With respect to the types of “disclosable events” that would require reporting under the proposed rule, a provider must disclose whether the provider or any of its owners or managing employees has had an affiliation with another provider that has (1) an uncollected debt; (2) been or is subject to a payment suspension under a federal health care program; (3) been excluded from Medicare, Medicaid, or CHIP; or (4) had its Medicare, Medicaid, or CHIP billing privileges denied or revoked. The foregoing disclosure requirements would apply to any affiliation within the previous 5 years, regardless of when the disclosable event occurred.

As it pertains to CMS’s expanded enforcement authority under the proposed rule, CMS may deny or revoke a provider’s Medicare, Medicaid, or CHIP enrollment if CMS determines that any of the disclosed affiliations poses an undue risk of fraud, waste, or abuse. In determining whether an “undue risk” exists, CMS would take into consideration the following factors relating to the affiliation: (1) the duration of the disclosing party’s relationship with the affiliated provider; (2) whether the affiliation still exists or how long ago it ended; (3) the degree and extent of the affiliation; and (4) the reason for the termination of the affiliation, if applicable. In addition to considering the factors relating to the affiliation itself, CMS will take into account the relevant factors regarding the disclosable event, including the type of action, when the action occurred or was imposed, and whether the affiliation existed when the action was occurred or was imposed. For disclosed affiliation concerning an uncollected debt, CMS will consider the amount of the debt, whether the affiliated provider is repaying the debt, and to whom the debt is owed (e.g., Medicare). If the disclosed affiliation involves a denial, revocation, termination, exclusion, or payment suspension, CMS will take into account the reason for the action (e.g., felony conviction, failure to report, etc.). CMS further provides that it will also consider any other evidence that it deems relevant to its determination. Finally, in addition to CMS denying or revoking a provider’s enrollment based on a finding of undue risk of a disclosed affiliations, CMS may also deny or revoke a provider who fails to appropriately report affiliations, including failing to report new affiliations or changes regarding existing affiliations.

In addition to the provisions regarding disclosure of affiliations, the proposed rule further expands the ability of CMS to deny or revoke a provider’s Medicare enrollment on other grounds. For example, CMS could deny or revoke a provider’s Medicare enrollment if it determines that the provider is currently revoked under a different name, numerical identifier (e.g., tax identification number), or business identity. CMS would also have the authority to revoke providers determined to have a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items, or drugs that is abusive, threatens the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements. In addition, providers may also be revoked by CMS if the provider has an existing debt (e.g., a Medicare overpayment resulting from a CMS audit) that CMS refers to the United States Department of Treasury.

Another major provision of the proposed rule relates to the re-enrollment bar imposed on providers whose enrollment is revoked by CMS. Currently, when CMS revokes a provider’s Medicare enrollment, the provider is barred from re-entering the Medicare program for a period of 1-3 years as determined by CMS. The proposed rule would expand the maximum re-enrollment bar from three to 10 years, and further extend the re-enrollment bar up to 20 years if the provider is being revoked for a second time.

Overall, the proposed rule, if finalized in its current form, represents a significant expansion to CMS’s authority to deny or revoke a provider’s Medicare enrollment. While CMS states its expanded authority is intended to protect the Medicare program and its beneficiaries from questionable and dishonest providers, the provisions in the proposed rule create serious compliance concerns for all prospective and existing Medicare providers. If finalized, failure to comply with the additional enrollment disclosure requirements could leave providers vulnerable to CMS’s discretion to deny or revoke their Medicare billing privileges, an action that not only affects a provider’s Medicare business but could also impact the provider’s participation status with other federal health programs and insurance networks. Thus, providers must ensure they perform the necessary due diligence in complying with all current and future Medicare enrollment requirements.