Proactively Protecting the Public Purse: New Medicare and Medicaid Enrollment Rules Finalized

Article Date: Wednesday, May 18, 2011

Written By: Richard P. Church & Darlene S. Davis

HEAT, RAC, MIP, MIC, MAC, PSC, ZPIC, CERT, MFCU – over the past several years, the health care industry has been inundated with a veritable alphabet soup of governmental entities and contractors that review claims on a post-payment basis and root out fraud and abuse by providers participating in government health care programs. Increasingly, the focus has also turned to pre-payment and even pre-enrollment review.  Accordingly, in congressional testimony leading up to the passage of the Patient Protection and Affordable Care Act (“ACA”), Daniel Levinson, Department of Health and Human Services’ Inspector General, argued that item No. 1 in the Office of the Inspector General’s (“OIG”) fraud-fighting approach was tightening Medicare and Medicaid enrollment.

Medicare and Medicaid provider
enrollment standards and screening
should be strengthened, making
participation in Federal health care
programs as a provider or supplier a
privilege, not a right. It is more efficient
and effective to protect the programs and
beneficiaries from unqualified,
fraudulent, or abusive providers and
suppliers up front than to try to recover
payments or redress fraud or abuse after it
occurs. Greater transparency in the
enrollment process will help the
Government know with whom it is doing
business.

D. Levinson, Testimony before House Subcommittee on Health, Health Care Reform; Opportunities to Address Waste, Fraud and Abuse (June 25, 2009). Congress responded to this testimony through ACA with a number of significant changes to the process by which providers and suppliers enroll and maintain participation in Medicare, Medicaid, and the Children’s Health Insurance Program (“CHIP”).

Accordingly, the Centers for Medicare & Medicaid Services (“CMS”) substantially expanded the powers of two members of the fraud and abuse alphabet soup, Medicare Administrative Contractors (“MACs,” formerly fiscal intermediaries and carriers) and the National Supplier Clearinghouse (“NSC”) with the publication of a final rule on Feb. 2, 2011. Medicare, Medicaid, and the Children’s Health Insurance Programs; Additional Screening Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions and Compliance Plans for Providers and Suppliers, 76 Fed. Reg. 5862 (Feb. 2, 2011) (hereinafter the “Rule”).  The Rule adopts various enrollment and related regulations granting CMS and its contractors that review and approve Form CMS-855 filings the power to suspend enrollment of whole classes of providers, suspend payments, and subject providers and suppliers to increased scrutiny prior to permitting them to enroll and upon revalidating their enrollment in Medicare, Medicaid, and CHIP. In follow-up to the Rule, CMS also recently issued changes to Chapter 15 of the Medicare Program Integrity Manual (“PIM”) instructing contractors on the implementation of certain of these requirements. CMS Transmittal 371, Implementation of Provider Enrollment Provisions in CMS-6028-FC (Change Request 7350, March 23, 2011). This article summarizes the Rule, taking into account the guidance in the PIM, and its implications for providers and suppliers.

Temporary Enrollment Moratoria (42 C.F.R. §§ 424.570, 455.470)
The Rule permits CMS to impose a temporary moratorium on enrollment of certain provider or supplier types or the establishment of additional practice locations, even by existing enrolled providers/suppliers, in a given geographic area.  Under the Rule, such an enrollment moratorium will not affect the ability of a provider or supplier to file changes of information, changes of practice location, or changes of ownership, except for those home health agency changes of ownership that require an initial enrollment under the so-called “36-Month Rule.” See 42 C.F.R. § 424.550(b).  A moratorium will apply even to applications that have been submitted but are still pending with the contractor as of the effective date, unless those applications have been approved by the applicable Medicare contractor. CMS will not give advance notice due to concerns that it would precipitate a flood of applications. See 76 Fed. Reg. at 5919. General reasons for which CMS might impose a moratorium are identified in the Rule.  While a provider or supplier is permitted to appeal denial of an enrollment based on application of a temporary moratorium to that particular provider or supplier, providers and suppliers cannot appeal CMS’s decision to impose a moratorium in the first instance. See 42 C.F.R. § 498.5; 76 Fed. Reg. at 5925.  

Generally, state Medicaid agencies are also required to prohibit enrollment of a provider type for which a Medicare moratorium has been imposed, unless the state determines that beneficiary access would be adversely impacted. See 76 Fed. Reg. at 5918-19. Prior to imposing a moratorium, the Secretary is required to consult with the affected state or states so they can seek an exemption, if warranted.

Additionally, a state Medicaid agency can choose to impose a moratorium, numerical caps, or other limits on providers that the Secretary has identified as high risk for fraud, waste, or abuse (under the screening categories set forth in Table 1 below) if it finds that the enrollment limitation would not adversely impact beneficiary access and the Secretary agrees to the moratorium. The duration of a state-imposed moratorium is six months with possible extensions of six months. Nothing in the regulatory text would indicate that state-imposed moratoria would prohibit Medicare enrollment of affected providers/suppliers in that state absent additional action by CMS to impose a Medicare moratorium.

Enhanced Medicare Payment Suspension Powers (42 C.F.R. §§ 405.370 - 405.372)
The Rule permits CMS and its contractors to suspend payments to a Medicare provider or supplier if the provider or supplier is the subject of “credible allegations of fraud,” unless a good cause exception applies. CMS can determine good cause exists to not impose or to end an ongoing suspension based on the following: a request from OIG or the Department of Justice (“DOJ”) indicating that a suspension would jeopardize or compromise an investigation; the suspension would jeopardize beneficiary access to the point of causing a danger to life or health; CMS or its contractors take other actions that more quickly or effectively mitigate the risk to Medicare funds; or the suspension is not in the best interests of the Medicare program.

Allegations of fraud can be from any source and are “credible” if they have “indicia of reliability,” which is not further defined. CMS notes in commentary that such determination would be made on “a case-by-case basis by looking at all the factors, circumstances, and issues at hand.” See 76 Fed. Reg. at 5929. Prior to suspending payments, CMS or the applicable Medicare contractor must first consult with OIG and, as appropriate, DOJ, to determine if the allegation of fraud is credible. The suspension will continue until the allegations are resolved (i.e., legal action is terminated by settlement, dismissal, or judgment, or the investigation is halted due to insufficient evidence) unless other bases for continued suspension exist (i.e., overpayments or incorrect payments).  Additionally, every 180 days, CMS will determine whether good cause exists for ending the suspension and will request confirmation from OIG or other applicable law enforcement agencies that an investigation is still pending. After 18 months, “good cause” to end the suspension is deemed to exist unless there is a pending administrative action or OIG is considering taking administrative action or the DOJ makes a written request based on its intent to pursue civil or criminal action or there is such an action pending, which request identifies the provider or supplier, the additional amount of time the suspension should continue, and the potential adverse effect of ending the suspension.

State Medicaid/CHIP Payment Suspension Powers (42 C.F.R. §§ 447.90, 455.2, 455.23)
In contrast to the Medicare payment suspension authority, which is permissive, a state Medicaid agency is required under the Rule to suspend payments in whole or in part based on credible allegations of fraud for which an investigation is pending, unless a good cause exception applies.  In commentary, CMS indicates that “credible allegations of fraud” replaces, and reflects a lower threshold than, the existing standard for Medicaid suspensions related to fraud allegations of “receipt of reliable evidence.” See 76 Fed. Reg. at 5932. This lower threshold, coupled with the fact that federal financial participation (“FFP”) is not available if the state Medicaid agency does not suspend payments to a provider subject to a pending investigation of a credible allegation of fraud (unless there is good cause or the FFP is claimed for certain emergency items or services) will likely lead to increased numbers of suspensions, as CMS recognizes in commentary. See 76 Fed. Reg. at 5932.

In addition to having “indicia of reliability,” to be considered credible, the state Medicaid agency must “review[] the allegations, facts, and evidence carefully and act[] judiciously on a case-by-case basis.”  The procedures associated with imposition of a Medicaid payment suspension are more complex than those applicable to Medicare. While the state is not required to provide advance notice of a payment suspension, unless delayed by law enforcement, the provider must be informed within five days after a suspension is imposed in a writing that describes, among other things, the general nature of the allegations, the types of claims or provider business unit(s) to which the suspension applies, applicable appeal rights, and an indication that the provider may submit written evidence as to why the suspension should be ended. The regulation also imposes certain documentation and reporting requirements on the state Medicaid agency.

Upon initiation of a Medicaid payment suspension, the state Medicaid agency must refer the matter in a writing meeting certain requirements to its state Medicaid Fraud Control Unit (“MFCU”) or an appropriate law enforcement agency, if the state does not have a MFCU. This referral must be made regardless of whether the state finds good cause not to impose the suspension. If, however, the MFCU (or law enforcement agency) decides not to investigate the referral, the suspension must be ended, unless the state Medicaid agency has other statutory or regulatory authority for continuing the suspension or refers the matter to another law enforcement agency. The Rule includes changes to OIG regulations at 42 C.F.R. Part 1007 governing the relationship between state Medicaid agencies and MFCUs to facilitate this coordination.

Good cause exceptions to Medicaid payment suspension are similar to Medicare, with the notable additions of a determination to end the suspension based on: written evidence submitted by the provider; or a finding that the suspension would jeopardize recipient access because the provider is the sole community physician or sole source of essential specialized services or provides services for a large number of recipients in a medically underserved area.

Provider Termination (42 C.F.R. §§ 424.535, 455.101, 455.416)
The Rule amends the existing regulation governing revocation of Medicare billing privileges to permit, among other things, revocation of Medicare privileges in the event of termination of a provider’s Medicaid number after exhaustion or expiration of appeal rights. In contrast, effective Jan. 1, 2011, state Medicaid agencies are required to terminate a provider’s billing privileges or deny the provider’s enrollment if Medicare, another state Medicaid agency, or CHIP agency has terminated the provider and appeal rights are exhausted or expired. See 76 Fed. Reg. at 5943. The Rule includes a number of other grounds for termination or denial of enrollment in Medicaid, many of which are also mandatory.  See 42 C.F.R. § 455.416.

Limited-Moderate-High: Enhanced Medicare Provider Screening Requirements (42 C.F.R. § 424.518)
The Rule’s basic approach to screening assigns each Medicare provider and supplier type to one of three categories of risk (limited, moderate, and high) based on CMS’s assessment of its potential for fraud, waste, and abuse and then assigns commensurate screening requirements as a provider/supplier type moves up CMS’s risk continuum. The following table summarizes CMS’s categorization of provider and supplier types and the associated screening requirements.

Many of these screening procedures, with the exception of fingerprints and background checks, are already in use by contractors as part of the application review process. See 76 Fed. Reg. at 5865. Currently, CMS is limiting the fingerprint requirement to individuals with a 5 percent or more direct or indirect ownership interest, but indicates that it will expand the requirement to other individuals if needed. See 76 Fed. Reg. at 5882.  However, CMS has delayed implementation of the fingerprint-based background check. In commentary, CMS indicates that it expects to issue guidance on this requirement “shortly after” the publication of the Rule, and that the requirement would be implemented 60 days after the issuance of such sub-regulatory guidance. See, e.g., 76 Fed. Reg. at 5889. However, to date, such additional sub-regulatory guidance has not been forthcoming.

Regarding the site visit requirement for providers and suppliers in the moderate and high risk categories, CMS has provided detailed instructions to contractors on the timing of the site visit based on the type of application. See PIM, Ch. 15, Sec. 15.19.2.1.  These site visits are separate and apart from certification surveys conducted by state regulators or accrediting agencies with deemed accreditation authority.  It is not clear if CMS contractors will perform the site visits or, in turn, subcontract this function.  

CMS expressly notes that completing the site visit will require the contractor to enter the business location, as opposed to performing only an external inspection. Criteria for a successful site visit include a determination that the facility is open, staffed with personnel, and, if applicable, serving customers, and appears operational. If the provider/supplier does not pass the site visit, the contractor must deny its enrollment or revoke its billing privileges, as applicable. See PIM, Ch. 15, Sec. 15.19.2.2.

The Rule is effective now as to providers and suppliers seeking to enroll, revalidate their enrollment, or add a practice location on or after March 25, 2011. However, the effective date for currently enrolled providers and suppliers is March 23, 2012. See 76 Fed. Reg. at 5865. Thus, if an existing provider or supplier’s regular revalidation cycle occurs between March 25, 2011 and March 23, 2012, it will be required to undergo all applicable screening procedures. As to other providers and suppliers, CMS cites the statutory effective date of March 23, 2013 as the impetus for the regulatory change at 42 C.F.R. § 424.515 permitting additional off-cycle revalidations. See 76 Fed. Reg. at 5893. In this regard, CMS appears to intend to revalidate all providers and suppliers in the high and moderate risk categories at that time (unless they are newly enrolled or have been revalidated under the new screening requirements pursuant to their regular revalidation cycle prior to March 23, 2013). CMS suggests it “may perform an elevated number of revalidations” for institutional providers and suppliers between calendar year 2012 and calendar year 2015, estimating (while declining to state definitively) that 111,000 revalidations would be performed in calendar year 2012 and 87,000 in each of calendar years 2013, 2014, and 2015. See 76 Fed. Reg. at 5955-56. These same effective dates apply to the Medicaid and CHIP requirements summarized below.

State Medicaid/CHIP Screening Requirements (42 C.F.R. §§ 455.450 - 450.452)
Under the Rule, the Medicare screening requirements outlined above set a floor for the screening of providers that states must implement as to providers enrolling in Medicaid and CHIP. However, state Medicaid agencies are permitted to rely on the screening performed by Medicare or other state Medicaid agencies.  As such, under the Rule, one would only expect states to be conducting their own screening to provider types not recognized by Medicare.  While the Medicare requirements set forth above establish the floor, states are permitted to require additional screening procedures or place providers in a higher risk screening level than assigned by Medicare. CMS expects states to assign Medicaid-only provider types a risk category using similar factors as Medicare.  See 76 Fed. Reg. at 5895-96.

Additionally, under the Rule, states must also require ordering and referring physicians and non-physician practitioners (NPPs) to enroll and undergo screening even if such referring providers do not intend to bill Medicaid themselves, unless they only provide referrals through risk-based managed care entities. See 42 C.F.R. § 455.410; 76 Fed. Reg. at 5904.  

As is generally required in the Medicare program, the Rule now also requires that states revalidate Medicaid providers every five years, at a minimum. See 42 C.F.R. § 455.414. In commentary, CMS indicates that states should perform a revalidation of 20 percent of providers a year beginning in 2011, so that all providers will have been subject to revalidation under the new screening requirements by 2015. See 76 Fed. Reg. at 5901.  

Application Fees on Institutional Providers (42 C.F.R. § 424.514)
Also effective March 25, 2011, institutional providers (defined as all providers and suppliers except individual practitioners and physician and non-physician organizations, unless enrolling as a DMEPOS supplier) who are initially enrolling in Medicare, revalidating their existing enrollment, or adding a practice location to an existing Medicare number are required to submit an application fee.  Pursuant to PIM guidance, however, only one application fee would be required in regard to an 855 filing adding multiple new practice locations pursuant to a single filing. See PIM, Ch. 15, Sec. 15.19.1.F.CMS clarifies that the fee does not apply to changes of information, changes of ownership (unless the provider/supplier submitting a Form CMS-855A is required to enroll as a new provider/supplier), or reactivations. See 76 Fed. Reg. at 5913; PIM, Ch. 15, Sec. 15.19.1.F.  The stated purpose of the fee is to fund program integrity activities, including the cost of screening activities outlined above. See 76 Fed. Reg. at 5907.  CMS estimates the fees generated will be equal to $304.5 million between March 2011 and Dec. 31, 2015. See 76 Fed. Reg. at 5956.

The application fee for calendar year 2011 is $505 and will be updated on an annual basis based on the percentage change in the consumer price index for all urban consumers. See 42 C.F.R. § 424.514; Medicare, Medicaid, and Children’s Health Insurance Programs; Provider Enrollment Application Fee for 2011, 76 Fed. Reg. 16,422 (notice March 23, 2011). According to CMS guidance, providers and suppliers are expected to use Pay.gov to pay the application fee.  Contractors are not permitted to accept any other method of payment (e.g., paper checks). While not required, providers and suppliers are “strongly encouraged” to submit their receipt from Pay.gov with their paper application or, in the case of a web-based enrollment, certification statement. MLN Matters Article, Implementation of Provider Enrollment Provisions in CMS-6028-FC (MM7350, March 23, 2011).  Generally, CMS indicates that an application fee will not be refunded even if enrollment is denied. Reasons for a fee refund are limited to: the approval of a hardship waiver, the rejection of an application before the start of screening (e.g., application submitted with missing signature), or denial of enrollment due to the imposition of a temporary moratorium.

If the required application fee is not submitted or the payment is not able to be deposited due to insufficient funds or otherwise, the Medicare contractor may deny an application submitted by a new provider or revoke the billing privileges of a currently enrolled provider (i.e., in the context of a revalidation).   Providers and suppliers whose numbers are revoked for this reason are then subject to a minimum one year and potentially up to three year bar on re-enrolling, which may, but is not required to, be waived by CMS.  See 42 C.F.R. § 424.535(c).  However, before taking either of these actions, the contractor must give the provider an opportunity to submit the fee within 30 days. A provider may request a hardship waiver through the submission of a letter explaining the hardship and why the waiver should be granted. The waiver request must be submitted together with the application. Providers requesting waivers will likely face enrollment delays, however, as the Medicare contractor is prohibited from beginning to process the application until CMS makes a determination as to whether the hardship waiver should be granted. In order to minimize application processing delays, a provider or supplier requesting a waiver may concurrently submit the application fee in the event the waiver request is denied. See 76 Fed. Reg. at 5913. The contractor may begin processing the application while CMS is considering the waiver request. See PIM, Ch. 15, Sec. 15.19.1.D. CMS has 60 days to make this determination, which is appealable.

CMS indicates that providers and suppliers must “make a strong argument” as to why the application fee should be waived, including submitting “comprehensive documentation” such as historical cost reports, recent financial reports including balance sheets and income statements, cash flow statements, and tax returns. This supporting documentation must be submitted at the time of making the waiver request, implying CMS will not allow a provider to supplement the documentation supporting a waiver request subsequent to making the request.  In assessing the likelihood of obtaining a waiver, providers should note that CMS’s regulatory impact statement assumes 2.5 percent of all enrollments otherwise subject to the fee will be waived. See 76 Fed. Reg. at 5955.

State Medicaid/CHIP Enrollment Fees (42 C.F.R. § 455.460)
Effective March 25, 2011, states are also required to collect an application fee from enrolling or revalidating providers, except for (a) individual practitioners, or (b) providers that have already enrolled in and paid the Medicare or another state Medicaid or CHIP program fee. Thus, a dually-participating provider would only be subject to one application fee by Medicare, so that effectively, states would only be collecting fees from Medicaid-only or CHIP-only providers. See 76 Fed. Reg. at 5908, 5916. CMS states that it will address the coordination of this process in sub-regulatory guidance. See 76 Fed. Reg. at 5916. States can request that CMS waive the application fee for certain providers upon demonstration that its impact would adversely affect beneficiary access. If the costs of screening are less than the amount a state collects in application fees, it is required to return the excess funds to the federal government. As such, states are incentivized to engage in additional permissive enhanced screening measures up to at least the full value of the enrollment fees.

Ethics and Compliance Programs
While CMS sought comments on the ACA requirement that entities enrolling in Medicare must maintain a compliance program, the regulations related to the same were not finalized in the Rule. CMS expressed its intent to publish a separate notice of proposed rule making in the future on this subject. See 76 Fed. Reg. at 5941-43.

Implications
In light of the Rule, new and already enrolled providers and suppliers should expect increased focus on the accuracy of their enrollment data as enrollment is no longer deemed a ministerial function, but is now part of the fraud and abuse alphabet soup.  In particular, providers and suppliers should expect a particular focus on the proper reporting of their ownership and control group and for high risk providers and suppliers, fingerprinting and criminal background checks on the same.

Therefore, providers and suppliers may wish to consider the following:    
• Consider increasing the frequency of background checks of owners, directors, officers, and managing employees and instituting an annual disclosure form for such key personnel, if one is not already in place;
• Educate board members regarding the new requirements and the need for their personal identifying information if serving in an ownership or director position so that owners and board members understand why their personal information will need to be disclosed upon revalidation;
• Timely update enrollment information, including changes in provider leadership (owners, directors, officers, and managing employees, whether W-2 or contracted) in accordance with Medicare and Medicaid requirements;
• Consider incorporating enrollment status reviews into the provider’s compliance program to ensure that timely enrollment updates are being made;
• Expect Medicare and Medicaid revalidation requests at least every five years (or every three years if a DMEPOS supplier) and upon the March 23, 2012 trigger date discussed above; and
• Prepare for potential increased timeframes for the processing of Medicare and Medicaid applications, especially for provider and supplier types assigned to the moderate and high screening levels.

Church and Davis are members of the health care team in the Research Triangle Park of K&L Gates LLP.

Views and opinions expressed in articles published herein are the authors' only and are not to be attributed to this newsletter, the section, or the NCBA unless expressly stated. Authors are responsible for the accuracy of all citations and quotations.