Medicare and Medicaid Enrollment: The Times They are a Changin’

On September 5, 2019, the Center for Medicare and Medicaid Services (CMS) issued a final rule entitled “Program Integrity Enhancements to the Provider Enrollment Process.  It went into effect on November 4, 2019.  This final rule “strengthens the agency’s ability to stop fraud before it happens by keeping unscrupulous providers out of federal health insurance programs.  CMS Announces New Enforcement Authorities to Reduce Criminal Behavior in Medicare, Medicaid, and CHIP (accessible at https://www.cms.gov/newsroom/press-releases/cms-announces-new-enforcement-authorities-reduce-criminal-behavior-medicare-medicaid-and-chip).  The final rule is one of CMS’s response to end “pay and chase methods to protect taxpayer dollars and to protect the integrity of the Medicare and Medicaid programs.

This final rule creates new revocation and denial authorities to stop waste, fraud, and abuse.   Additionally, this rule allows CMS to “identify individuals and organizations that pose an undue risk of fraud, waste or abuse based on their relationships with other previously sanctioned entities.  Id.  For example, if a currently enrolled organization has an owner or manager that is affiliated with a previously revoked organization, that current organization can have its enrollment revoked.  Historically, some enrolled providers and suppliers were able to avoid federal healthcare integrity programs by changing their names or entering into “complex entity relationships.  CMS Final Rule Strengthens Integrity of Medicare Provider Enrollment Process, The Nat’l L. Rev., https://www.natlawreview.com/article/cms-final-rule-strengthens-integrity-medicare-provider-enrollment-process.  Prior to the implementation of this rule, CMS was on the defensive when trying to stop the unscrupulous from taking advantage of Medicaid and Medicare.  See CMS Announces New Enforcement Authorities to Reduce Criminal Behavior in Medicare, Medicaid, and CHIIP. 

In addition to denying enrollment to applicants that are affiliated with a previously revoked organization, CMS has added language that would allow authorities to deny or revoke Medicare enrollment when the following “disclosable events occur: “(1) a provider or supplier tries to ‘reinvent’ itself by using a different name; (2) a provider or supplier bills for services from non-compliant locations; (3) a provider or supplier exhibits a pattern of ‘abusive ordering or certifying of Medicare Part A or Part B items, services, or drugs;’ or  (4) ‘a provider or supplier has an outstanding debt to CMS from an overpayment that was referred to the Treasury Department.’  Id; see also CMS Final Rule Strengthens Integrity of Medicare Provider Enrollment Process. 

When Medicare, Medicaid, and Children’s Health Insurance Programs providers and suppliers are initially enrolling or reenrolling, they must disclose if any of its owning or managing employees have, or within the previous five years, an affiliation with the one of the previously mentioned “disclosable events.  Id.  An “affiliation under Medicare enrollment disclosure requirements includes:

A 5% or greater direct or indirect ownership interest in another organization; [a] general or limited partnership interest in an entity, regardless of the ownership interest; [t]he exercise of operational or managerial control, or directly or indirectly conducting the day-to-day operations of another organization; [a]cting as an officer or director of a corporation; and [a]ny reassignment relationship under 42 C.F.R. §424.80. 

42 C.F.R. §455.101.

In order to avoid placing a burden on CMS to track “disclosable events, current providers and suppliers will only be required to disclose affiliations upon specific request by CMS.  See CMS Final Rule Strengthens Integrity of Medicare Provider Enrollment Process.  If CMS determines that a provider or supplier failed to fully and completely disclose any affiliations with individuals or entities that have a disclosable event, CMS may deny or revoke a provider’s enrollment.  Additionally, if CMS determines that any disclosed affiliations pose an ‘undue risk’ of fraud, waste or abuse, CMS may deny or revoke an enrollment.  Id.  When determining if a disclosed affiliation poses a risk, CMS will consider multiple factors. The first factor is the duration and length of the affiliation.  This includes a review of the percentage of ownership.  CMS will also look at whether the affiliation still exists or if it ended and the reason behind the termination.  Furthermore, CMS will investigate when the disclosable event occurred and whether an affiliation existed at that time.  In cases where there is uncollected debt, CMS will examine the amount, if any steps were taken towards repayment, and to whom the debt is owed.  If there was a previous denial, revocation, termination, exclusions, or payment suspensions, CMS will investigate.  Lastly, CMS will consider any other evidence it deemed relevant.  An affiliation will not automatically result in a finding that the affiliation poses an undue risk of fraud.  Each affiliation will be evaluated on the totality of the circumstances. 

Under this final rule, if an applicant was found to have submitted false or misleading information in its initial enrollment application, CMS can prevent that applicant from enrolling for up to three years.  See CMS Announces New Enforcement Authorities to Reduce Criminal Behavior in Medicare, Medicaid, and CHIP.  Additionally, providers that were fraudulent or problematic are barred from re-entering the Medicare program and CMS can block providers who were revoked from re-entering the program for up to 10 years.  This was increased from three years.   Furthermore, if CMS determines that the provider is trying to reenroll under a different name or identifier, CMS can extend the bar another three years, in addition to the 10 years already imposed.  See CMS Final Rule Strengthens Integrity of Medicare Provider Enrollment Process.  If a provider is revoked from Medicare for a second time, it can be blocked from re-enrolling for up to 20 years.  See CMS Announces New Enforcement Authorities to Reduce Criminal Behavior in Medicare, Medicaid, and CHIP.  When determining the length of the reenrollment bar, CMS will look at the totality of the circumstances, including the reason for the revocation, the time between the reenrollment bar, and whether the provider has previous adverse actions.  See CMS Final Rule Strengthens Integrity of Medicare Provider Enrollment Process. 

The new changes to the provider enrollment process applies to the regulation of state Medicaid programs.  Each state will have to choose between two options, in consultation with CMS.  See CMS-6058-FC.  Once an option is chosen, that state cannot change options until there are further rules issued by CMS.  Under the first option, a provider that is not enrolled in Medicare, but is initially enrolled in Medicaid or CHIP, or is revalidating their Medicaid or CHIP enrollment must disclose all affiliations that it or any of its owning or managing employees or organizations currently has or had in the past five years with a Medicare, Medicaid or CHIP provider that had a disclosable event.  Id.  The second option permits a state to request from a provider that is not enrolled in Medicare, but is initially enrolling in Medicaid or CHIP, or is revalidating its enrollment information, the disclosure of any affiliations it or any of its owning or managing employees or organizations currently has or had within the past five years with a provider that had a disclosable event.  Id.

Under both options, providers that are not enrolled in Medicare are required to disclose affiliations.  The Federal Register also explains that even if a state were to choose option two, if a provider only identifies one affiliation, this will trigger a state’s request of a disclosure of affiliations.  The first option is broader than the second because providers under the second option only need to submit affiliation data upon a state’s request, whereas under option one, providers must submit affiliation data upon application or reenrollment.  While providers will not be required to report all applicable affiliation information under either option until the applicable state has revised its relevant reenrollment application, a state may deny or terminate a provider’s enrollment in the state Medicaid program if the state, in consultation with CMS, receives information that the provider has an affiliation.

With the implementation of “Program Integrity Enhancements to the Provider Enrollment Process, CMS hopes to protect both patients and the financial integrity of the Medicare and Medicaid programs.  It is intended to allow CMS to stop fraudsters from taking advantage of the Medicare and Medicaid systems and reenrolling through new entities by requiring providers to disclose certain events and affiliations.  It expands CMS’s authority to deny or revoke a provider’s ability to participate in Medicare, Medicaid, and CHIP based on that provider’s relationship with a previously sanctioned entity; a critical step in CMS’s fight to “stop[] fraudsters before they get paid.  See CMS Announces New Enforcement Authorities to Reduce Criminal Behavior in Medicare, Medicaid, and CHIP.

If you have any questions and wish to speak to an attorney, please contact David R. Ross, Senior Shareholder, at (518) 312-0167 or via e-mail at dross@oalaw.com. This article was written by Marina Wai Yee Chu, a Law Clerk awaiting admission.