CMS on Thursday finalized a rule that provides the agency with more authority to prevent fraud by rejecting or revoking a provider's or supplier's enrollment in CHIP, Medicare, and Medicaid if they are affiliated with organizations that have had their enrollment revoked because of fraud, waste, or abuse.
Your cheat sheets for understanding health care's legal landscape
CMS first proposed the rule in 2016 under former President Barack Obama's administration. CMS in a fall 2018 regulatory agenda said the agency had until March 1, 2019, to finalize the rule under federal law, which requires Medicare rules be finalized within three years of being formally proposed.
However, CMS finalized the law three-and-a-half years after it was first proposed, which seemingly means that CMS violated federal law. When CMS was asked about the final rule's delayed release, a CMS spokesperson said the agency "determined that more time was needed to address and resolve" concerns raised about provider burden during the proposed rule's comment period.
Final rule details
The final rule, which is scheduled to take effect on Nov. 4, expands the agency's current efforts to address fraud, which mainly involve recouping fraudulent payments after CMS has issued them. CMS Administrator Seema Verma said the final rule will allow CMS to take a new approach to prevent fraud by blocking potential fraudsters from participating in federal health insurance programs.
The final rule will require CHIP, Medicare, and Medicaid providers and suppliers to disclose any of their current or former and direct or indirect affiliations with a provider or supplier that:
- Has been or currently is subject to payment suspension under a federal health care program;
- Has been or currently is excluded from CHIP, Medicare, or Medicaid by HHS' Office of Inspector General;
- Has had its CHIP, Medicare, or Medicaid billing privileges denied or revoked; or
- Has uncollected debt.
Under the final rule, CMS can choose to revoke or reject a provider's or supplier's CHIP, Medicare, and Medicaid enrollment based on their affiliations with an organization that has had its enrollment revoked.
The final rule also will allow CMS to deny or revoke Medicare enrollment if a provider or supplier:
- Bypasses Medicare rules by reenrolling in the program, or attempting to reenroll, under a different name;
- Bills for services or items from non-compliant locations;
- Demonstrates a pattern or practice of abusive ordering or certifying of Medicare Part A or Part B drugs, items, or services; or
- Owes CMS an outstanding debt from an overpayment that was referred to the Department of the Treasury.
In addition, the final rule permits CMS to ban a provider or supplier from reenrolling in Medicare for up to three years for submitting false or misleading information in their initial Medicare applications. The final rule also increases the amount of time CMS can bar "fraudulent or otherwise problematic providers from re-entering the Medicare program" to up to 10 years, from a previous limit of up to three years, the agency said in a release. Further, the final rule allows CMS to bar providers and suppliers whose Medicare is revoked for a second time from re-entering the program for up to 20 years.
CMS in the final rule noted that the agency has paid nearly $52 billion over the past five years to 2,097 entities that were affiliated with individuals or organizations that have had their enrollment revoked. The agency estimated it would have saved $20.7 billion over the past five years if the final rule had been in place.
CMS estimated that providers and suppliers will spend $937,500 over the final rule's first three years of implementation to gather documents about their affiliations. The agency projected the final rule will lead to approximately 2,600 withdrawals from federal health programs, which will result in an estimated $4.16 billion in savings over 10 years. Overall, CMS estimates the final rule's new reenrollment and reapplication standards will save the agency up to $4.48 billion over 10 years.
Verma in a statement said, "For too many years, we have played an expensive and inefficient game of 'whack-a-mole' with criminals—going after them one at a time—as they steal from our programs. Now for the first time, we have tools to stop criminals before they can steal from taxpayers."
However, regulatory experts have raised concerns over the final rule's broad reach.
William Horton, a partner at the law firm Jones Walker, said CMS in the final rule essentially tells health care organizations to "trust us, we'll only do this where we are convinced that there are bad actors who are intentionally and deliberately doing bad things"—which health care organizations view as a scary proposition. He explained, "The troubling matter here is, these are draconian penalties levied essentially on a unilateral basis even before an affected provider or supplier has noticed they may be in jeopardy of having their enrollment revoked. Health care is already regulated in a way that gives a lot of prosecutorial and regulatory discretion to enforcement agencies, and this is adding layers to that."
Horton added that appealing the agency's decision to revoke or deny a provider's or supplier's enrollment likely will be difficult, because it will be framed around whether CMS followed the appropriate procedures rather than whether the agency made the correct determination.
Mark Silberman, a partner at the law firm Benesch, said the final rule could alienate and penalize providers who have to demonstrate they have not committed any abuse or fraud. "When the government picks the right data points, they absolutely can use analytics in a preventative way that will weed out and minimize the risk of fraud. But when they choose the wrong data points, they end up snaring too many good providers along with the bad," Silberman said. He added, "While rooting out the fraudsters could be an important step to bringing providers like this back, misapplying this rule could usher further good providers out the door" (King, FierceHealthcare, 9/5; Kacik, "Transformation Hub," Modern Healthcare, 9/5; CMS release, 9/5; Romoser, Inside Health Policy, 9/5 [subscription required]).