CMS Tightens Rules Governing Reporting on Affiliated Parties

CMS wants to identify bad actors -– even if they are or have been affiliated with a legitimate provider.

On Sept. 5, the Centers for Medicare & Medicaid Services (CMS) issued a new final rule. There was not really a proposed rule to which comments and suggestions could be made; there were Federal Register entries on April 21, 2006, and Feb. 2, 2011. 

The comment period and implementation date for the new final rule are both set at Nov. 4, 2019. This is a bit unusual even for CMS, in that we have new rules and regulations within §424 for the Code of Federal Regulations (CFR) to which we must adhere. Broadly, this is the Conditions for Payment section of the CFR, and among other things, this is the location for guidance for the various CMS-855 forms, along with enrollment in the Medicare and associated Medicaid and CHIP (Children’s Health Insurance Program) programs.

While these changes, mainly additions, to the CFR are aimed at reducing fraud and abuse, almost all healthcare providers involved with Medicare will be affected. What CMS is going after is information on affiliated entities and individuals. CMS wants to identify the bad actors – even if they are or have been affiliated with a legitimate provider. Everyone that is involved in Medicare enrollment and the revalidation process should be considering the following:

1. How will this affect the various CMS-855 forms?
2. How will CMS collect information about these affiliated entities or individuals?
3. What information is to be collected?
4. What preparation should be made for these changes?

The basic answer to the fourth question is to stand by. Even though these changes take place as of Nov. 4, 2019, most of the action steps that must be taken will be with CMS, and probably will come through various forms of sub-regulatory guidance.

First let us start with §424.502, Definitions. The following are new.

• Affiliation refers to:
  • A 5 percent or greater direct or indirect ownership interest;
  • A general or limited partnership interest, regardless of the percentage ownership;
  • Operational or managerial control;
  • Serving as an officer or director; and
  • Any reassignment relationship.

For those who have worked with the various CM-855 forms, all of these are no doubt quite familiar, with the exception of the reassignment relationship. Apparently, someone like a practitioner who is reassigning Medicare payments may be of interest, relative to affiliations. The question then becomes, who is responsible for reporting such affiliations (that is, the practitioner or the organization to which the practitioner is reassigning Medicare benefits)?

• Disclosable event refers to:
  • Uncollected debt regardless of
    • The amount of debt;
    • Current repayment plan; or
    • The appeal of debt.
  • Subject to payment suspension;
  • Excluded by the U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) from participation; or
  • Enrollment denied, revoked, or terminated, regardless of:
    • Reason for denial, revocation, or termination;
    • The appeal of denial, revocation, or termination; or
    • When the denial, revocation or termination occurred.

Just from the definitions, it is fairly clear that CMS is serious about reporting anything that is even potentially bad. 

• §424.59, Disclosure of affiliations, is new. Here is §424.519(b):

“Upon a CMS request, an initially enrolling or revalidating provider or supplier must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “owner” and “managing employee,” as defined in § 424.502) has or, within the previous five years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 424.502). CMS will request such disclosures when it has determined that the initially enrolling or revalidating provider or supplier may have at least one such affiliation.”

Note that this statement starts out with, “upon a CMS request…” The last statement in the section indicates that CMS will request such disclosures when there is or may have been an affiliation with an entity or individual during the past five years, relating to a disclosable event. How is CMS even going to know that there was some sort of affiliation? How will this request be made?

The information that must be provided is in §424.519(c):

“The provider or supplier must disclose the following information about each reported affiliation:

1. General identifying data about the affiliated provider or supplier. This includes the following:
   1. Legal name, as reported to the Internal Revenue Service or the Social Security Administration (if the affiliated provider or supplier is an individual)
   2. “Doing business as” name (if applicable)
   3. Tax identification number
   4. National Provider Number (NPI)
2. Reason for disclosing the affiliated provider or supplier
3. Specific data regarding the affiliation relationship, including the following:
   1. Length of the relationship;
   2. Type of relationship; and
   3. Degree of affiliation.
4. If the affiliation has ended, the reason for the termination.”

Nothing appears out of order in this informational request. Some question might be raised concerning the reason for disclosing, but this would appear to go to the type of problem (debt, suspension, exclusion, etc.) of the affiliated party.

The mechanism for reporting is found at §424.519(e):

“The information required to be disclosed under paragraphs (b) and (c) of this section must be furnished to CMS or its contractors via the Form CMS-855 application (paper or the Internet-based PECOS (Provider Enrollment, Chain, and Ownership System) enrollment process).”

Now this is interesting! Apparently, all of the CMS-855 forms will need updating, and/or some sort of supplemental form will need developing. The CMS-855-R will probably not need changing or any addition, because the affiliation information would be filed with the CMS-855-I for an individual practitioner. The CMS-855-O for ordering and referring practitioners will probably need the additional information, presuming that CMS is interested in any affiliations that an ordering or referring practitioner has or might have had.

CMS is concerned about undue risk with any affiliations. The main concerns have arisen over the duration of the affiliation, whether the affiliation continues, the degree and extent of the affiliation, and disclosable events. This is fully delineated in §424.519(f). Obviously, if CMS determines that there is undue risk of fraud, waste, or abuse, then revocation of enrollment will occur.

CMS does address duplicate data at §414.519(h):

“A provider or supplier is not required to report affiliation data in that portion of the Form CMS-855 application that collects affiliation information if the same data is being reported in the ‘owning or managing control’ (or its successor) section of the Form CMS-855 application.”

While there is a need not to perform duplicate reporting, the fact that the CMS-855 forms are the vehicle for gathering this affiliation information is clear.

This is a long Federal Register entry that requires close study. There are 269 pages in the examination format, of which 28 are devoted to changes (mainly additions) to the CFR. All those who are involved in filing and maintaining the CMS-855 forms will need to carefully study these changes. Note that while we are given some opportunity to comment, this is a final Federal Register. Thus, any weaknesses or omissions will need consideration over time. Anticipate significant subregulatory guidance.

Programming Note:

Listen to Duane Abbey report this story live during Monitor Monday, Sept. 16, 10-10:30 a.m. EST.