Health Care Alert: Medicare and Medicaid Providers to Face New “Affiliation” Reporting Requirements, Expanded Revocation Authorities

On September 10, 2019, the Centers for Medicare & Medicaid Services (CMS) published a final rule with comment period establishing new requirements for Medicare- and Medicaid providers to disclose “affiliations” with other providers and suppliers.  The new rule also authorizes CMS to deny or revoke a provider’s enrollment if a reported affiliation “poses an undue risk of fraud, waste, or abuse.”

The rule implements Section 1866(j)(5) of the Social Security Act, which (as amended by the Affordable Care Act) requires that Medicare and Medicaid providers disclose “any current or previous affiliation,” direct or indirect, with another provider or supplier that (1) has “uncollected debt”; (2) has been or is subject to a payment suspension imposed by a federal health care program; (3) has been excluded from participation in Medicare, Medicaid, or the Children’s Health Insurance Program (CHIP); or (4) has had its billing privileges denied or revoked. 

Per the new regulatory provisions, CMS has defined the term “affiliation” to mean:

• A 5 percent or greater direct or indirect ownership interest in another organization;
• A general or limited partnership interest in another organization, regardless of the percentage;
• An interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization;
• An interest in which an individual is acting as an officer or director[1] of a corporation; or
• Any reassignment relationship under 42 C.F.R. § 424.80.

The rule limits a provider’s obligation to disclose its affiliations to a 5-year lookback period, calculated from the submission of the provider’s application for enrollment or renewal.  However, CMS declined to impose a lookback period for “disclosable events,” meaning that it could potentially find an “undue risk of fraud, waste, or abuse” based on an incident that occurred at any point in an affiliate’s history, no matter how remote.  Further, CMS declined to establish a minimum threshold of “uncollected debt” – which includes Medicare, Medicaid, or CHIP overpayments, civil money penalties (CMPs), and assessments – and maintained its position that such debts constitute disclosable events even if they are currently being repaid or appealed. 

Instead, CMS indicates that it will consider whether a particular affiliation poses an “undue risk of fraud, waste, or abuse” on a case-by-case basis, based on factors such as the duration of the disclosing party's relationship with the affiliated provider or supplier; whether the affiliation still exists and, if not, how long ago it ended; the degree and extent of the affiliation (for example, percentage of ownership); and the type, timing, and basis of the disclosable event.

Effective Date and Implementation

Although the final rule becomes effective November 4, 2019, CMS clarified in its preamble that Medicare providers are not required to make any new disclosures until CMS updates its enrollment form, Form CMS-855, to include an “affiliation disclosure section.”  Once the revised form (which will be subject to public notice and comment) is available, Medicare providers are required to disclose their affiliations only if CMS (1) determines, based on its own research and analysis, that the provider may have one or more affiliations that includes a disclosable event; and (2) specifically requests the provider’s affiliation information.  Based on its initial experiences and additional public comments, CMS will then engage in additional rulemaking to fulfill its statutory mandate to “secure affiliation data from all initially enrolling and revalidating providers.”    

For purposes of the Medicaid program, States will be permitted to choose one of two approaches: either (1) all newly-enrolling Medicaid and/or CHIP providers who are not enrolled in Medicare will be required to disclose their affiliations; or (2) Medicaid providers will be required to disclose their affiliations only upon the State’s request.  A State Medicaid program will not be able to change its elected approach until CMS’ subsequent rulemaking is complete.   

The Federal Register notice discussing the new rule is available in full here.  To ensure consideration, comments must be submitted by 5:00 p.m., November 4, 2019.

If you have questions about the new rule or about Medicare or Medicaid enrollment and revalidation generally, please contact Jolie Havens, Matt Albers, Mairi Mull, or your Vorys attorney. 

______________

[1] The rule indicates that this provision covers the members of a board of trustees.