AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Final rule with comment period.

SUMMARY:

This final rule with comment period implements statutory provisions that require Medicare, Medicaid, and Children's Health Insurance Program (CHIP) providers and suppliers to disclose certain current and previous affiliations with other providers and suppliers. In addition, it provides the agency with additional authority to deny or revoke a provider's or supplier's Medicare enrollment in certain specified circumstances. The provisions we are finalizing in this rule are necessary to address various program integrity issues and vulnerabilities by enabling CMS to take action against unqualified and potentially fraudulent entities and individuals, which in turn could deter other parties from engaging in improper behavior.

DATES:

Effective date: This final rule with comment period is effective on November 4, 2019.

Comment date: To be assured consideration, comments regarding sections II.A.1. and 2. of this final rule with comment period and §§ 424.519 and 455.107 must be received at one of the addresses provided below, no later than 5 p.m. on November 4, 2019.

ADDRESSES:

In commenting, please refer to file code CMS-6058-FC. Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission.

Comments, including mass comment submissions, must be submitted in one of the following three ways (please choose only one of the ways listed):

1. Electronically. You may submit electronic comments on this regulation to http://www.regulations.gov. Follow the “Submit a comment” instructions.

2. By regular mail. You may mail written comments to the following address only: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-6058-FC, P.O. Box 8013, Baltimore, MD 21244-8013.

Please allow sufficient time for mailed comments to be received before the close of the comment period.

3. By express or overnight mail. You may send written comments to the following address only: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-6058-FC, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.

For information on viewing public comments, see the beginning of the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT:

Frank Whelan, (410) 786-1302.

SUPPLEMENTARY INFORMATION:

I. Executive Summary and Background

A. Executive Summary

1. Purpose and Need for Regulatory Action

This final rule with comment period will implement a provision of the Social Security Act (the Act) that requires Medicare, Medicaid, and Children's Health Insurance Program (CHIP) providers and suppliers to disclose any current or previous direct or indirect affiliation with a provider or supplier that—(1) has uncollected debt; (2) has been or is subject to a payment suspension under a federal health care program; (3) has been or is excluded by the Office of Inspector General (OIG) from Medicare, Medicaid, or CHIP; or (4) has had its Medicare, Medicaid, or CHIP billing privileges denied or revoked. This provision permits the Secretary to deny enrollment based on such an affiliation when the Secretary determines that the affiliation poses an undue risk of fraud, waste, or abuse. Also, this final rule with comment period will revise various provider enrollment provisions in 42 CFR part 424, subpart P, and certain program integrity provisions in 42 CFR parts 405, 455, and 457. We proposed these provisions in a proposed rule published in the March 1, 2016 Federal Register (81 FR 10720) titled, “Medicare, Medicaid, and Children's Health Insurance Programs; Program Integrity Enhancements to the Provider Enrollment Process.”

As discussed in greater detail in section II. of this final rule with comment period, the provisions we are finalizing in this rule are necessary to address various program integrity issues and vulnerabilities. We believe that these provisions will help make certain that entities and individuals who pose risks to the Medicare and Medicaid programs and CHIP are removed from and kept out of these programs; this final rule with comment period will also assist in preventing providers and suppliers from circumventing Medicare requirements through name and identity changes, as well as through elaborate, inter-provider relationships. In short, this final rule with comment period will enable us to take action against unqualified and potentially fraudulent entities and individuals, which in turn could deter other parties from engaging in improper behavior.

The following are the principal legal authorities for our final provisions:

• Section 1902(kk)(3) of the Act,^[1] as amended by section 6401(b) of the Affordable Care Act, which mandates that states require providers and suppliers to comply with the same disclosure requirements established by the Secretary under section 1866(j)(5) of the Act.^[2]

• Section 2107(e)(1) of the Act, as amended by section 6401(c) of the Affordable Care Act, which makes the requirements of section 1902(kk) of the Act, including the disclosure requirements, applicable to CHIP.
• Section 1866(j) of the Act, which provides specific authority with respect to the enrollment process for providers and suppliers.
• Sections 1102 and 1871 of the Act, which provide general authority for the Secretary to prescribe regulations for the efficient administration of the Medicare program.

2. Summary of the Major Provisions

The major provisions of this final rule with comment period will do the following:

• Implement a provision of the Act that requires Medicare, Medicaid, and CHIP providers and suppliers to disclose any current or previous direct or indirect affiliation with a provider or supplier that has uncollected debt; has been or is subject to a payment suspension under a federal health care program; has been excluded from Medicare, Medicaid, or CHIP; or has had its Medicare, Medicaid, or CHIP billing privileges denied or revoked (all of which are hereafter occasionally referred to as “disclosable events”), and that permits the Secretary to deny enrollment based on such an affiliation when the Secretary determines that it poses an undue risk of fraud, waste, or abuse.

++ Define the terms “affiliation,” “disclosable event,” “uncollected debt,” and “undue risk” as they pertain to this provision of the Act.

• Provide CMS with the authority to do the following:

++ Deny or revoke a provider's or supplier's Medicare enrollment if CMS determines that the provider or supplier is currently revoked under a different name, numerical identifier, or business identity, and the applicable reenrollment bar period has not expired.

++ Revoke a provider's or supplier's Medicare enrollment—including all of the provider's or supplier's practice locations, regardless of whether they are part of the same enrollment—if the provider or supplier billed for services performed at, or items furnished from, a location that it knew or should reasonably have known did not comply with Medicare enrollment requirements.

++ Revoke a physician's or eligible professional's Medicare enrollment if he or she has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items, or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements.

++ Increase the maximum reenrollment bar from 3 to 10 years, with exceptions as stated in this rule.

++ Prohibit a provider or supplier from enrolling in the Medicare program for up to 3 years if its enrollment application is denied because the provider or supplier submitted false or misleading information on or with (or omitted information from) its application in order to gain enrollment in the Medicare program.

++ Revoke a provider's or supplier's Medicare enrollment if the provider or supplier has an existing debt that CMS refers to the United States Department of Treasury.

++ Deny a provider's or supplier's Medicare enrollment application if—(1) the provider or supplier is currently terminated or suspended (or otherwise barred) from participation in a state Medicaid program or any other federal health care program; or (2) the provider's or supplier's license is currently revoked or suspended in a state other than that in which the provider or supplier is enrolling.

3. Summary of Costs and Benefits

a. Costs

As explained in greater detail in sections IV. and V. of this final rule with comment period, we estimate an annual cost to providers and suppliers of $937,500 in each of the first 3 years of this rule. This cost involves the information collection burden associated with the requirement that Medicare, Medicaid, and CHIP providers and suppliers disclose certain current and prior affiliations.

b. Savings

As described further in section V. of this final rule with comment period, we project the following savings from our finalized provisions:'

• Our new revocation authorities will lead to approximately 2,600 new revocations per year, resulting in a 10-year savings of $4.16 billion (based on a projected per-revoked provider amount of $160,000).
• Our new reenrollment and reapplication bar provisions will apply to approximately 400 of CMS' revocations per year, resulting in an estimated 10-year actual savings of $1.79 billion (based on a projected per-revoked provider amount of $160,000) and a caused savings of $4.48 billion. “Caused savings” refers to the full amount of money that will be saved based on the new reenrollment and reapplication bars applied over 10 years; a large portion of the savings will be made after the first 10-year period of interest and will not be fully actualized until year 20. (Section IV of this final rule with comment period discusses the concept of “caused savings” in greater detail.)
• Concerning our affiliation provisions, over the last 5 years, $51.9 billion (with adjusted factors applied) has been paid to 2,097 entities with affiliations stemming from the revoked Medicare enrollment of an associated individual or other entity. Adjusted factors refer to adjustments made to gross billing, based on provider and supplier type, in relation to the percentage of services that are not transferred to a different provider or supplier after a revocation. There is a range across provider and supplier types of what percentage of services transfer to other practitioners or entities after a revocation—that is, they were legitimate services—versus what percentage of services do not transfer to another practitioner or entity—that is, the services were never rendered, were medically unnecessary, or for some other reason do not result in a transfer of services to another practitioner or entity. If the affiliations/undue risk revocation authority we are finalizing in this rule had been in place during that period, we project that CMS would have taken revocation action in approximately 40 percent of identified prior affiliation cases (or approximately 838 cases) based on a determination of undue risk of fraud, waste, or abuse. We accordingly would not have paid those problematic providers. As a result, over the last 5 years the program would have seen a resulting $20.7 billion in cost-avoidance savings, or an average of $4.14 billion per year. We recognize, though, that our 40 percent figure is merely an estimate. To accommodate the possibility of fluctuation, below are projections of savings based on figures of 20 percent, 40 percent, and 60 percent:

Given the foregoing savings estimates for revocations based on new authorities other than the affiliations authority, reenrollment and reapplication bars, and revocations stemming from the affiliations authority (using our median 40 percent figure), we project a total savings over a 10-year period of $47.35 billion.

B. General Overview

1. Medicare

The Medicare program (title XVIII of the Act) is the primary payer of health care for approximately 54 million enrolled beneficiaries. Under section 1802(a) of the Act, a beneficiary may obtain health care services from an individual or organization qualified to participate in the Medicare program. Qualifications to participate are specified in statute and in regulations (see, for example, sections 1814, 1815, 1819, 1833, 1834, 1842, 1861, 1866, and 1891 of the Act; and 42 CFR chapter IV, subchapter G, of the regulations, which concerns standards and certification requirements).

Providers and suppliers furnishing services must comply with the Medicare requirements stipulated in the Act and in our regulations. These requirements are meant to confirm compliance with applicable statutes as well as to promote the furnishing of high quality care. As Medicare program expenditures have grown, we have increased our efforts to make certain that only qualified individuals and organizations are allowed to enroll in and maintain their enrollment in Medicare.

2. Medicaid and CHIP

The Medicaid program (title XIX of the Act) is a joint federal and state health care program that covers nearly 70 million low-income individuals. States have considerable flexibility in how they administer their Medicaid programs within a broad federal framework, and programs vary from state to state. CHIP (title XXI of the Act) is a joint federal and state health care program that provides health care coverage to more than 8.4 million children. In operating Medicaid and CHIP, states historically have permitted the enrollment of providers who meet the state requirements for program enrollment as well as any applicable federal requirements (such as those in 42 CFR part 455). State enrollment requirements must be consistent with section 1902(a)(23) of the Act and implementing regulations at § 431.51, under which states may set reasonable standards relating to the qualifications of providers but may not restrict the right of beneficiaries to obtain services from any person or entity that is both qualified and willing to furnish such services.

C. General Background on the Enrollment Process

1. The 2006 Provider Enrollment Final Rule

In the April 21, 2006 Federal Register (71 FR 20754), we published a final rule titled, “Medicare Program; Requirements for Providers and Suppliers to Establish and Maintain Medicare Enrollment.” The final rule set forth certain requirements in 42 CFR part 424, subpart P, that providers and suppliers must meet to obtain and maintain Medicare billing privileges. We cited in that rule sections 1102 and 1871 of the Act as general authority for our establishment of these requirements, which were designed for the efficient administration of the Medicare program.

2. The 2011 Provider Enrollment Final Rule

In the February 2, 2011 Federal Register (76 FR 5861), we published a final rule with comment period titled, “Medicare, Medicaid, and Children's Health Insurance Programs; Additional Screening Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions and Compliance Plans for Providers and Suppliers.” This final rule with comment period implemented various provisions of the Act, including the following:

• Required submission of application fees by institutional providers and suppliers as part of the Medicare, Medicaid, and CHIP provider enrollment processes.
• Establishment of Medicare, Medicaid, and CHIP provider enrollment screening categories and corresponding screening requirements.
• Authorization of temporary moratoria on the enrollment of new Medicare, Medicaid, and CHIP providers and suppliers of a particular type (or the establishment of new practice locations of a particular type) in a geographic area when necessary to combat fraud, waste, or abuse.

3. Form CMS-855—Medicare Enrollment Application

Under § 424.510, a provider or supplier must complete, sign, and submit to its assigned Medicare contractor the appropriate Form CMS-855 (OMB Control No. 0938-0685) application in order to enroll in the Medicare program and obtain Medicare billing privileges. The Form CMS-855, which can be submitted via paper or electronically through the internet-based Provider Enrollment, Chain, and Ownership System (PECOS) process, captures information about the provider or supplier that is needed for CMS or its contractors to determine whether the provider or supplier meets all Medicare requirements. The enrollment process helps ensure that unqualified and potentially fraudulent individuals and entities do not bill Medicare and that the Medicare Trust Funds and Medicare beneficiaries are accordingly protected. Data collected during the enrollment process include but are not limited to—(1) general identifying information (for example, legal business name, tax identification number); (2) licensure data; (3) practice locations; and (4) information regarding the provider's or supplier's owning and managing individuals and organizations. The application is used for a variety of provider enrollment transactions, including the following:

• Initial enrollment—The provider or supplier is—(1) enrolling in Medicare for the first time; (2) enrolling in another Medicare contractor's jurisdiction; or (3) seeking to enroll in Medicare after having previously been enrolled.
• Change of ownership—The provider or supplier is reporting a change in its ownership.
• Revalidation—The provider or supplier is revalidating its Medicare enrollment information in accordance with § 424.515.
• Reactivation—The provider or supplier is seeking to reactivate its Medicare billing privileges after it was deactivated in accordance with § 424.540.
• Change of information—The provider or supplier is reporting a change in its existing enrollment information in accordance with § 424.516.

Besides the aforementioned 2006 and 2011 final rules, we have made several other regulatory changes to 42 CFR part 424, subpart P, to address various payment safeguard issues that have arisen.

D. Background on Disclosure of Affiliations for Medicare, Medicaid, and CHIP (Section 1866(j)(5) of the Act)

As previously mentioned, providers and suppliers must complete and submit (via paper or through internet-based PECOS) a Form CMS-855 application to their Medicare contractor in order to enroll or revalidate their enrollment in the Medicare program. The Form CMS-855 requires the provider or supplier to disclose certain information, such as general identifying data (for example, legal business name), the provider's or supplier's practice locations, and the provider's or supplier's owning and managing employees and organizations.

In operating Medicaid and CHIP, states may have somewhat different enrollment processes, although all states must comply with the federal requirements in 42 CFR part 455, subparts B and E, as well as the “free choice of provider” requirement in § 431.51. Under 42 CFR part 455, subpart B, providers and disclosing entities must furnish disclosures regarding ownership and control of the provider or disclosing entity, certain business transactions, and criminal convictions related to federal health care programs.

Section 1866(j)(5) of the Act, added by section 6401(a)(3) of the Affordable Care Act, states that a provider or supplier that submits an enrollment application or a revalidation application for Medicare, Medicaid, or CHIP shall disclose (in a form and manner and at such time as determined by the Secretary) any current or previous affiliation (directly or indirectly) with a provider or supplier that has uncollected debt; has been or is subject to a payment suspension under a federal health care program (as defined in section 1128B(f) of the Act); has been excluded from participation from Medicare, Medicaid, or CHIP; or has had its billing privileges denied or revoked. Under section 1866(j)(5)(B) of the Act, the Secretary may deny the application if the Secretary determines that the affiliation poses an undue risk of fraud, waste, or abuse.

Pursuant to section 1902(kk)(3) to the Act, states must require providers and suppliers to comply with the same disclosure requirements established by the Secretary under section 1866(j)(5) of the Act. Further, pursuant to section 2107(e)(1) of the Act, the requirements of section 1902(kk) of the Act, including the disclosure requirements, are applicable to CHIP.

II. Provisions of the Proposed Regulations and Analysis of and Responses to Public Comments

We received 87 timely pieces of correspondence in response to the March 1, 2016 proposed rule. A summary of the major issues raised and our responses thereto follow.

A. Disclosure of Affiliations

We proposed in the March 1, 2016 proposed rule to implement section 1866(j)(5) of the Act. We explained that, consistent with this statutory provision, the implementation of these disclosure provisions would help combat fraud, waste, and abuse by enabling CMS and the states to: (1) Better track current and past relationships between and among different providers and suppliers; and (2) identify and take action on affiliations among providers and suppliers that pose an undue risk to Medicare, Medicaid, and CHIP.

In November 2008, the OIG of the Department of Health and Human Services issued an Early Alert Memorandum titled “Payments to Medicare Suppliers and Home Health Agencies Associated with ‘Currently Not Collectible' Overpayments” (OEI-06-07-00080). The memorandum stated that anecdotal information from OIG investigators and Assistant United States Attorneys indicated that suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) with outstanding Medicare debts may inappropriately receive Medicare payments by, among other means, operating businesses that are publicly fronted by business associates, family members, or other individuals posing as owners. In its study, the OIG selected a random sample of 10 DMEPOS suppliers in Texas that each had Medicare debt of at least $50,000 deemed currently not collectible (CNC) by CMS during 2005 and 2006. The OIG found that 6 of the 10 reviewed DMEPOS suppliers were associated with 15 other DMEPOS suppliers or home health agencies (HHAs) that received Medicare payments totaling $58 million during 2002 through 2007. Most associated DMEPOS suppliers had lost their billing privileges by January 2005 and had accumulated a total of $6.2 million of their own CNC debt to Medicare. The OIG also found that most of the reviewed DMEPOS suppliers were connected to other DMEPOS suppliers and HHAs through shared owners or managers.

On March 2, 2011, the OIG testified before the Congress that fraud schemes in South Florida often rely on the use of networks of affiliations among fraudulent owners.^[3] In those schemes, Medicare providers and suppliers disguise their true ownership by the use of nominee owners to bill Medicare fraudulently on a temporary basis so as to evade detection. Providers and suppliers will—(1) hide their true ownership through the use of nominee owners; (2) bill the Medicare program for millions of dollars; and (3) close down, take over another company, and then repeat the process in another location. In addition to this information from the OIG, our own experience has shown that networks of individuals and entities can be behind widespread fraud schemes; in some instances, shared owners were behind multiple providers and suppliers engaging in improper billings.

We have long shared these and other concerns the OIG has expressed regarding individuals and entities that enroll in Medicare (or own or operate Medicare providers or suppliers), accumulate large debts or otherwise engage in inappropriate activities, and depart the Medicare program voluntarily or involuntarily, yet continue their behavior by—(1) reentering the program in some capacity (for instance, as an owner); and/or (2) shifting their activities to another enrolled Medicare provider or supplier with which they are affiliated. To illustrate, a provider or supplier may engage in inappropriate billing, exit Medicare prior to detection, and then change its name or business identity in order to reenroll in Medicare under this new identity. Another example involves an entity that owns or manages several Medicare providers and suppliers. One of the providers or suppliers may be involved in abusive behavior with the approval or at the instigation of that owner or managing entity. In this example, if the abusive provider's enrollment is revoked, the owning/managing entity shifts its behavior to another of its enrolled entities.

In such situations, and absent the owning or managing individual's or organization's (1) felony conviction, (2) exclusion from Medicare by the OIG, or (3) debarment from participating in any federal procurement or non-procurement program, CMS does not currently have a regulatory basis to prevent such individuals or entities from continuing their activities through other enrolled or newly enrolling providers and suppliers. Put another way, providers and suppliers currently can be denied, revoked, or terminated from participating in Medicare, Medicaid, or CHIP; but absent a felony conviction, exclusion, or debarment, their owners and managers can often remain as direct or indirect participants in these programs. Consider this example: Individual X owns 100 percent of three enrolled DMEPOS suppliers, each of which has submitted a revalidation application to Medicare. Individual X completes each application. He submits false information on one application in order to retain that supplier's existing Medicare enrollment but not on the other two applications. CMS revokes the first DMEPOS supplier's enrollment under § 424.535(a)(4). However, we cannot revoke the other two suppliers because false information was not submitted on their applications; this means that two Medicare suppliers whose owner has furnished false information to Medicare are still enrolled in the program.

CMS must have the capacity to address this and similar situations when necessary and appropriate. In many cases, the owners and managers of fraudulent entities hide behind the organizational structure itself when in fact they are, for purposes of their behavior, one and the same. This final rule with comment period will allow CMS to take immediate action against such persons and entities to ensure that they do not continue to use the provider or supplier organization as a shield for their conduct. This, in turn, will help protect the Medicare Trust Funds, the taxpayers, Medicare beneficiaries, and honest and legitimate Medicare providers and suppliers. The changes described later in this section II serve these goals by implementing section 1866(j)(5) of the Act.

We also proposed to apply these changes to Medicaid and CHIP, such that states must require providers and suppliers to comply with the same disclosure requirements established by the Secretary.

Many of the comments we received regarding this proposal—(1) covered multiple topics (for example, application of the undue risk standard and the proposed requirement to report new or changed information), and (2) did not indicate whether they applied to Medicare alone or to Medicare, Medicaid, and CHIP. Therefore, except as otherwise noted, we—(1) have organized the comments and our responses thereto within what we believe are the most appropriate sections (though there may be occasional overlap between sections); and (2) assume that the comments apply to all three federal programs (that is, while our responses may refer to the Medicare program, they should be presumed to apply equally to the disclosure of affiliation provisions in the Medicaid program and CHIP, unless otherwise noted). Comments that exclusively applied to Medicaid and CHIP are addressed in our discussion of the affiliation disclosure provisions for those programs.

1. Medicare

a. Definition of Affiliation

We proposed to define “affiliation” in § 424.502, for purposes of applying the affiliation disclosure provisions in § 424.519, as meaning any of the following:

• A 5 percent or greater direct or indirect ownership interest that an individual or entity has in another organization.
• A general or limited partnership interest (regardless of the percentage) that an individual or entity has in another organization.
• An interest in which an individual or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization (including, for purposes of § 424.519 only, sole proprietorships), either under contract or through some other arrangement, regardless of whether or not the managing individual or entity is a W-2 employee of the organization.
• An interest in which an individual is acting as an officer or director of a corporation.
• Any reassignment relationship under § 424.80.

The first four types of interests (5 percent or greater ownership, partnership interests, managing control, and corporate officer and director interests) are consistent with the definitions of—(1) “owner” and “managing employee” in § 424.502; and (2) “ownership or control interest” in section 1124(a)(3) of the Act. We also note that consistent with sections 1124 and 1124A of the Act, entities and individuals that have one or more of these four interests in an enrolling or enrolled Medicare provider or supplier must be reported on the provider's or supplier's Form CMS-855 enrollment application. Likewise, reassignment relationships must be reported to Medicare via the Form CMS-855R (OMB Control No. 0938-1179); this form facilitates the reassignment of benefits from a physician or non-physician practitioner to another Medicare provider or supplier. To make certain that there is uniformity with these other reporting requirements and that we are aware of prior and current relationships that could present risks of fraud, waste, or abuse, we proposed that the “affiliation” definition should include these five interests.

We explained in the proposed rule our belief that there is a sufficiently close relationship between a reassignor (the physician or non-physician practitioner) and a reassignee (the other provider or supplier) to warrant including reassignments within the definition of “affiliation.” Indeed, a W-2 employee or independent contractor may have a closer day-to-day relationship with the entity or person he or she works for and reassigns benefits to than, for instance, an indirect owner has with an entity in which he or she has a 5 percent ownership interest. We requested comment on the regularity of close reassignor and reassignee relationships and whether inclusion of these relationships is likely to lead to additional information that may prevent fraud, waste, and abuse. We also solicited comment on whether the types of disclosable affiliations should include additional ownership or managerial interests or other relationships.

We received the following comments regarding our proposed definition of “affiliation”:

Comment: A commenter questioned whether a physician director and a director of nursing must be reported as managing parties on the Form CMS-855A as part of the existing provider enrollment process and the proposed disclosure requirement. The commenter, as well as other commenters, also questioned whether the following parties and interests fall within the definition of “affiliation”: (1) Members of the board of trustees of a tax-exempt entity; (2) billing agencies and/or collection agencies; and (3) 5 percent or greater mortgage or security interests. Another commenter questioned whether general and limited partnerships include both direct and indirect interests for purposes of the definition of “affiliation.”

Response: As previously noted, our definition of “affiliation” incorporates concepts of ownership and managerial control from other program integrity and provider enrollment provisions. We interpret our definition of “affiliation” consistent with these other provisions. Accordingly, if the physician director or director of nursing in question falls within the definition of managing employee under § 424.502, he or she must be reported as part of the existing enrollment process and, if the requirements of § 424.519 are met (for example, the individual was previously a managing employee of another provider or supplier with a disclosable event), also falls within the purview of the latter provision.

Per CMS Publication 100-08, Program Integrity Manual (PIM), Chapter 15, members of a board of trustees are considered to be corporate directors for purposes of Form CMS-855 reporting. Hence, the definition of affiliation in § 424.502 encompasses such relationships.

Also per Chapter 15 of the PIM, 5 percent or greater mortgage and/or security interests are considered to be 5 percent or greater ownership interests for purposes of the Form CMS-855. They will be treated similarly with respect to our disclosure of affiliation provisions.

Concerning billing agencies and/or collection agencies, we believe the commenters were mentioning these parties in the context of managerial control over the provider or supplier. If the agency in question meets the definition of managing employee as it applies to organizations, it will fall within the previously mentioned “operational or managerial control” category of the “affiliation” definition.

Indirect partnership interests are not considered partnership interests under our definition of affiliation in § 424.502. However, the interest could qualify as an indirect ownership interest of at least 5 percent.

Comment: A commenter questioned whether an affiliation exists if a board of trustees or other governing body holds a 5 percent or greater direct or indirect ownership in another organization, a general or limited partnership interest in another organization, or exercises operational or managerial control in another organization. The commenter also questioned whether officers and directors of tax-exempt providers fall within the “affiliation” definition if they serve in similar capacities on other governing bodies or hold ownership interests or provide operational or managerial control in other organizations (tax-exempt or otherwise). The commenter cited the example of a local hospital administrator who serves as treasurer and member of the board of trustees of a local HHA; the commenter asked whether this individual's association with the hospital would be deemed an affiliation.

Response: Non-profit entities and officials thereof fall within the purview of the affiliation definition to the same extent as for-profit organizations and their officials; thus, for example, officers and directors of non-profit corporations come within the definition of affiliation, as do—(1) ownership, partnership, and managerial interests in non-profit entities; and (2) reassignment relationships with non-profit organizations.

Comment: A commenter stated that CMS should not consider an affiliation with a public company that owns 5 percent or more of an enrolling or reenrolling company to pose an “undue risk” to Medicare, Medicaid, or CHIP. Such companies, the commenter stated, are subject to adequate oversight of investors, the Securities and Exchange Commission, and the public, and the risks presented by a public company that owns a portion of another public company would be extremely limited.

Response: We do not believe that public companies should be automatically excluded from the purview of § 424.519, nor can we conclude that any affiliation with a public company with a disclosable event will never pose an undue risk. All factual scenarios are different, and we must retain the flexibility to address them on their own merits.

Comment: A commenter stated CMS should only require disclosure of affiliated managing individuals who are responsible in some way for actions relating to Medicare, Medicaid, or CHIP payment. Citing the example of laboratories, the commenter stated that managing individuals often have no responsibilities concerning payments for services. Rather, a managing employee who conducts the “day to day operations” of a laboratory facility often is in charge of maintaining the licensure of a laboratory facility, ensuring that the facility follows industry standards, evaluating information associated with laboratory procedures performed onsite, and overseeing the scientific integrity of the processes and protocols followed at the site. The commenter noted that laboratories necessarily are vigilant about the credentials and actions of those who are in charge of laboratory sites, for any hint of impropriety may put the site's entire operations at risk.

Response: We respectfully disagree with the commenter. We note that the statutory definition of managing employee in section 1126(b) of the Act, upon which the definition of managing employee in § 424.502 and the reference to managing parties in the definition of affiliation are based, includes all persons who directly or indirectly conduct the provider's day-to-day operations. It is not limited to parties involved in actions related to the payment of services. In other words, the test is the broader direct or indirect conduct of operations, not merely a relationship to the payment of services. Thus we believe that the inclusion within the definition of affiliation and the scope of § 424.519 of—(1) managerial interests for purposes of enrollment and (2) affiliations involving managing parties with disclosable events, should not be based strictly on the party's involvement with payment-related actions.

Comment: Several commenters stated that the minimum 5 percent ownership stake referenced in the “affiliation” definition should be higher. They generally stated that a party with a low ownership interest is unlikely to be involved in the day-to-day operations of the practice. Raising the required percentage of ownership, the commenters believed, would not only better safeguard the Medicare program but also substantially lower the regulatory burden on honest providers; with a higher required percentage, CMS could better identify affiliates that actually pose a danger to the Medicare program without being bogged down with information from providers and suppliers on harmless affiliations. They also cited the likely burden of tracking all 5 percent or greater ownership interests. Several commenters suggested a 25-percent threshold, while others suggested a 50-percent threshold or a majority interest.

Response: The affiliation definition's 5 percent threshold is consistent with our existing enrollment reporting requirements and with sections 1124 and 1124A of the Act, both of which reference a 5 percent standard. Further, it is conceivable that parties with a minority ownership interest as low as 5 percent could be involved in questionable activities, hence jeopardizing the integrity of the Medicare program. The fact that they may not actively control the provider's or supplier's daily operations should not exclude such parties and affiliations from scrutiny. We recognize, however, that certain levels of ownership interests may pose different risks than others and, as we proposed, will consider the degree and extent of the affiliation in determining whether an undue risk of fraud, waste, and abuse exists.

Comment: Several commenters stated that CMS should not automatically consider a general or limited partnership interest that an individual or entity has in another organization to be an affiliation. The commenters generally stated that a limited or general partner with only a minority interest is unlikely to influence the operations of the entity and, as such, likely would not pose a risk to the Medicare program. A commenter stated that CMS should consider the percentage of a party's general or limited partnership in determining whether the party is an affiliate; another commenter suggested a 25-percent threshold.

Response: Similar to our earlier statements regarding the 5 percent ownership threshold, we believe that parties with even small partnership interests can, depending on the scope and type of behavior involved, threaten the integrity of the Medicare program. However, we will consider the extent of the affiliation in determining whether an undue risk exists.

Comment: A commenter recommended that CMS add a “catch-all” provision to the affiliation definition stating that the provider or supplier report any affiliation (regardless of ownership or operational interest) where the affiliate has, for instance, uncollected Medicare debt, past exclusions or civil penalties. As examples, the commenter suggested adding phrases to the definition such as “association with,” “connection with/to,” “alliance with/to,” “alignment with,” “link with/to,” “incorporation into,” and “integration into.”

Response: While we appreciate this suggestion, we believe that the phrases the commenter proposes describe relationships that may be more vague than those contemplated in this final rule with comment period. To illustrate, a 5 percent ownership stake is a clear and determinable interest, whereas an “association” or “alignment” can be susceptible to a variety of interpretations. Therefore, we prefer to include within our definition of “affiliation” only those interests that are quantifiable (for example, limited partnership interests) or have been used in the provider enrollment context for many years (for example, managing employee) and with which the provider community is familiar. Moreover, we believe that the commenter's suggested relationships may be more distant and loose than those which we proposed and which, we believe, the statute contemplates; a 50 percent ownership interest, for instance, likely reflects a closer, clearer relationship than a mere “association” or “connection.”

Comment: Many commenters opposed the inclusion of reassignments within the definition of “affiliation.” Overall, they contended that—(1) reassignment relationships do not raise the same risks of fraud, waste, and abuse as other affiliations referenced in the definition; and (2) for large provider organizations and health systems, the burden of having to constantly track and disclose all of its reassignment relationships would be enormous. Several commenters added that the practitioner typically has no ownership or managerial interest in the reassignee and no direct or indirect influence over the reassignee's decision-making; the mere fact of a reassignment relationship without more, one of the commenters stated, does not result in the close relationship that CMS assumes.

Response: We continue to believe there is a sufficiently close relationship between a reassignor (the physician or non-physician practitioner) and reassignee (the provider or supplier) to warrant including reassignments within the definition of “affiliation.” Again, a W-2 employee or independent contractor may have a closer day-to-day relationship with the entity or person he or she works for and reassigns benefits to than, for instance, an indirect owner has with an entity in which he or she has a 5 percent ownership interest. We are therefore retaining reassignments within the definition of “affiliation.” Nonetheless, we recognize the potentially sizable burden on physician and practitioner organizations (and especially hospitals and large health plans) in researching, tracking and, if applicable, submitting disclosable affiliation data involving the individuals who reassign their benefits to them. In sections II.A.1.b. and II.A.1.e. of this final rule with comment period, we discuss means we are adopting to limit the burden on providers and suppliers.

Comment: A commenter stated that since both parties (the reassignor and reassignee) are already jointly responsible for claims and associated overpayment risk within their reassignment relationship, it is unnecessary to go further and define a reassignment relationship as an “affiliation.” Another commenter stated that because reassignors and reassignees must be enrolled in Medicare to facilitate a reassignment relationship, these parties have already (1) been properly vetted by Medicare and (2) submitted the data we referenced under our proposal. Several other commenters stated that including reassignments within the affiliation definition exceeds what the Congress intended and authorized.

Response: With respect to the first commenter, the closeness of the relationship that the commenter implies is precisely why we believe it is appropriate to include reassignments within the definition of “affiliation.”

We respectfully disagree with the second and third comments. While the individual Form CMS-855 applications for enrollment for the reassignor and reasignee are screened, there currently is no review of whether the relationship between these two parties presents an undue risk to the Medicare program, which is the precise issue that section 1866(j)(5) seeks to address. In addition, we note that section 1866(j)(5) does not define the term “affiliation,” and thus the scope of that term must be defined via regulation. We also have general rulemaking authority under sections 1102 and 1871 of the Act to include reassignments within the definition of “affiliation.”

Comment: In response to our request for comments on the subject, a commenter stated that no additional ownership or managerial interests or other relationships (beyond those in the proposed definition of “affiliation”) should be disclosed, in part because providers and suppliers currently provide a significant amount of information.

Response: We agree that no additional interests or relationships should be included within the definition of affiliation.

Comment: Several commenters urged CMS to remove indirect ownership interests from the definition of affiliation. They generally contended that—(1) it would be very difficult to obtain, track, and maintain this information, especially for providers and suppliers with complex ownership structures (such as chain organizations) involving many affiliates; (2) many indirect owners have very little involvement in or influence over the day-to-day operations of the provider or supplier; and (3) some providers and suppliers have up to five levels of indirect ownership. One commenter noted that an applicant would not only have to report its own indirect owners, but also identify all affiliation relationships held by the applicant's indirect owners. The applicant would then be required to determine whether any such affiliation is with a provider or supplier that has had a disclosable event. All of these steps, this commenter concluded, would be very burdensome for providers and suppliers.

Response: We disagree that indirect ownership interests should be excluded. It should not be assumed that indirect owners never exercise certain degrees of control over providers; in fact, a provider's direct owner may be a mere holding company with the indirect owner actually operating the provider. Given the vast variety of ownership arrangements among provider and supplier organizations, we must retain our flexibility to address particular situations. We further note that section 1866(j)(5) of the Act refers to any current or previous affiliation (directly or indirectly). We will consider the degree and extent of the indirect owner's affiliation in determining whether an undue risk exists.

Comment: A commenter stated that CMS should remove officers, directors, and managing employees from the definition of affiliation, citing the reporting burden.

Response: We respectfully disagree that these parties should be removed from the definition of affiliation, given their typical level of control over the provider's or supplier's operations. Yet we recognize that certain officials may have greater influence over said operations than others, and we will consider the degree and extent of the affiliation in our determination of whether an undue risk exists. Also, and as previously stated, we discuss in sections II.A.1.b. and II.A.1.e. of this final rule with comment period means by which we are limiting the burden on providers and suppliers.

Comment: Several commenters requested that the final rule provide clearer directions and guidance on reporting affiliations and histories. Some commenters stated that the definition of affiliation is confusing and impractical.

Response: Although we believe that the definition of affiliation is clear on its face, we may issue subregulatory guidance on this topic as necessary.

Comment: A commenter stated that the disclosure of “passive” investors (that is, non-health care investors such as large mutual or pension funds) could prove extremely difficult. These entities would need to—(1) identify for the provider or supplier all current and previous indirect ownership interests they have had in other health care providers and suppliers; and (2) further ascertain whether any of these affiliated providers and suppliers has or has had a disclosable event. Passive investors, the commenter stated, may not know of those providers and suppliers in which they have had an indirect ownership interest, nor have any mechanism to determine whether they have or have had any disclosable events.

Response: Under sections 1124 and 1124A of the Act, all parties with at least a 5 percent direct or indirect ownership must be disclosed as part of the enrollment process. These statutory provisions do not exempt “passive” investors, and we do not believe such parties should be exempt from the definition of affiliation or the purview of § 424.519. We again recognize, though, that it may prove difficult at times to obtain affiliation data related to such parties, which is why we proposed a knew or should reasonably have known standard for disclosure. We discuss this standard in more detail in section II.A.1.c. of this final rule with comment period.

Comment: A commenter stated that if the final rule includes indirect ownership interests within the affiliation definition, CMS should impose practical limitations or cut-offs at which such interests are excluded from the definition. Suggestions included exempting—(1) parties that have an ownership interest in another provider or supplier through a publicly-traded company, mutual fund, or other large investment vehicle; and (2) indirect ownership interests under 50 percent.

Response: We respectfully disagree. As previously indicated, there could be situations where an indirect owner, even one with less than a 50 percent interest, exercises some influence over the provider. We also reiterate that neither sections 1124 and 1124A of the Act, nor the current definition of owner in § 424.502, exclude public companies or investment interests from the purview of those provisions.

Comment: A commenter stated that CMS should define affiliation by those interests reported on all of the Form CMS-855 applications, rather than those reported on only some of the forms; otherwise, the commenter stated, CMS will be demanding that physicians disclose far more information than is currently required.

Response: Section 1866(j)(5) of the Act addresses a provider's or supplier's relationships with other parties; the focus, in other words, is on affiliations rather than on identifying data that is specific to the enrolling provider or supplier. Thus, physicians may be required under § 424.519 to furnish more data than they currently do.

Comment: A commenter stated that including 5 percent or greater direct or indirect ownership interests within the affiliation definition is problematic because the reporting burden associated therewith would—(1) discourage joint ventures and provider collaborations, which are necessary for the success of payment reform and alternate payment models; and (2) place chain organizations at a disadvantage.

Response: We respectfully disagree. Five percent or greater direct and indirect ownership interests, including those involving chain organizations, are currently disclosed as part of the regular provider enrollment process. However, we are unaware of any discouragement of joint ventures or provider collaborations or a disproportionately negative impact on chain organizations stemming therefrom.

Comment: A commenter stated that the Form CMS-855A requires disclosure of limited partnership interests that are at least 10 percent. The commenter questioned whether the Form CMS-855A and other enrollment applications will be modified to incorporate the disclosure of all limited partnership interests.

Response: We appreciate this comment and will consider whether the referenced change to the scope of reportable limited partnership interests on the Form CMS-855A is warranted.

Comment: A commenter stated that CMS should exclude from the definition of affiliation—(1) disclosed officers', directors', or managing employees' indirect operational or managerial control interests in other providers; and (2) officer, director, or operational or managing control positions of another provider's indirect owners and parent companies. The commenter stated that these are not individuals who fit within the current definition of a control interest in a provider or supplier; thus they are not individuals (absent some additional relationship with the provider or supplier) currently identified on the Form CMS-855 applications. The commenter added that these individuals generally are not involved in the day-to-day operations of the provider or suppliers, and that reporting them would be unduly burdensome and unlikely to result in a finding of undue risk.

Response: For reasons previously discussed, we are retaining managing employees, corporate officers, corporate directors, and 5 percent or greater indirect owners within the definition of affiliation. We note again that all of a provider's or supplier's managing employees, corporate officers and directors, and 5 percent or greater indirect owners currently must be disclosed as part of the Form CMS-855 provider enrollment process.

Comment: Several commenters stated that only direct owners, managing employees, and managing organizations (which the commenters described as “close affiliates”) should be included within the affiliation definition. Distant affiliates (described by a commenter as affiliates of close affiliations or affiliates that are not close affiliates) should not be included, with one commenter stating that CMS could review PECOS to ascertain distant affiliations. A commenter stated that CMS should limit disclosure of prior affiliations to close affiliates for which CMS can show it does not have available information. Another commenter suggested that CMS bifurcate the disclosure of affiliations into two parts—(1) affiliations reportable by providers directly (“reportable affiliations”); and (2) other affiliations on which CMS may rely in making a determination of undue risk, provided that CMS takes materiality into account. The commenter believed this would achieve an appropriate balance between the dual needs to reduce the burden on providers and suppliers and to ensure that CMS can take action to protect program integrity.

Response: We appreciate these comments but do not believe that affiliation disclosures should be bifurcated or restricted as suggested. While we acknowledge that some affiliations may pose greater risks than others (and some may pose little, if any, risk), it is possible that even certain “distant” affiliations could, depending on the particular facts of the case, threaten the integrity of Medicare, Medicaid, or CHIP. We consequently must retain the discretion to review each case on its own merits by carefully considering the factors outlined in § 424.519(f), which are discussed elsewhere in this final rule with comment period.

Comment: A commenter stated that suppliers should only have to disclose past affiliations for persons identified as 5 percent or greater owners on the Form CMS-855.

Response: We respectfully disagree. Parties such as managing employees and general partners can often have as much, if not more, influence over the daily operations of a provider or supplier than an owner. As such, we do not believe they should be excluded from the definition of affiliation.

After consideration of the comments received, we are finalizing our definition of affiliation as proposed.

b. Disclosable Events (§ 424.519)

In new § 424.519, we proposed in paragraph (b) that a provider or supplier that is submitting an initial or revalidating Form CMS-855 application must disclose whether it or any of its owning or managing employees or organizations (consistent with the terms “owner” and “managing employee” as defined in § 424.502) has or, within the previous 5 years, has had an affiliation with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that—

• Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of—(1) the amount of the debt; (2) whether the debt is currently being repaid (for example, as part of a repayment plan); or (3) whether the debt is currently being appealed. For purposes of § 424.519 only, and as stated in proposed § 424.519(a), we proposed that the term “uncollected debt” only applies to—

++ Medicare, Medicaid, or CHIP overpayments for which CMS or the state has sent notice of the debt to the affiliated provider or supplier;

++ Civil money penalties (CMP) (as defined in § 424.57(a)); and

++ Assessments (as defined in § 424.57(a)).

• Has been or is subject to a payment suspension under a federal health care program (as that term is defined in section 1128B(f) of the Act), regardless of when the payment suspension occurred or was imposed;
• Has been or is excluded by the OIG from participation in Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred or was imposed (we note that although section 1866(j)(5) of the Act uses the phrase “has been excluded,” we proposed to clarify that a current exclusion is also a disclosable event); or
• Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated, regardless of—(1) the reason for the denial, revocation, or termination; (2) whether the denial, revocation, or termination is currently being appealed; or (3) when the denial, revocation, or termination occurred or was imposed. For purposes of § 424.519 only, and as stated in proposed paragraph (a), we proposed that the terms revoked, revocation, terminated, and termination would include situations where the affiliated provider or supplier voluntarily terminated its Medicare, Medicaid, or CHIP enrollment to avoid a potential revocation or termination.

We stated in the proposed rule that the affiliated provider or supplier need not have been enrolled in Medicare, Medicaid, or CHIP when the disclosing party had its relationship with the affiliated provider or supplier. We cited the following illustration. Assume Provider A sold its 30 percent interest in an affiliated provider in January 2016. In March 2016, the affiliated provider enrolled in Medicare yet had its enrollment revoked in September 2016. In April 2017, Provider A applied for Medicare enrollment. If we limited the reporting of affiliations to periods when the affiliated provider was enrolled in Medicare, Medicaid, or CHIP, Provider A would not have to report—and we would perhaps not learn of—its relationship with a provider that was revoked only 8 months after the affiliation ended. We concluded in the proposed rule that such information would be valuable in helping us determine whether the affiliation poses an undue risk of fraud, waste, or abuse.

We also proposed that the disclosable event could have occurred or been imposed either before the affiliation began or after it ended. We stated that if disclosure of an affiliation were restricted to the time period of the disclosing party's relationship with the affiliated provider, we might remain unaware of situations where, for instance—(1) a disclosing party sells its majority interest in an affiliated provider or supplier that is terminated from Medicaid 2 months after the sale; and (2) a 40 percent owner of a Medicare-enrolled affiliated provider engages in questionable billing practices, sells its share, and seeks to separately enroll in Medicare, shortly after which the affiliated provider is notified that it has a large Medicare debt that must be repaid. We expressed particular concern about the latter scenario; as previously mentioned, we have seen instances where providers and suppliers with significant overpayments close down their businesses and attempt to enroll under other business identities.

Additionally, we proposed that the actions identified in § 424.519(b) applied regardless of whether an appeal is pending. We wanted to avoid situations where an initially enrolling provider or supplier would not have to disclose, for example, an affiliated provider that was revoked from Medicare 6 months ago (based on a felony conviction) because the revocation is under appeal; without this information, the provider or supplier in question might become enrolled in Medicare without CMS knowing of its relationship with a recently convicted affiliated provider or supplier. Conversely, we proposed that actions that have been overturned on appeal or otherwise reversed would not need to be reported.

We further proposed a look-back period of 5 years for previous affiliations. A sufficient look-back period was deemed necessary because a past affiliation could be an indicator of a disclosing party's future behavior. The look-back period would be the 5-year timeframe prior to the date on which the disclosing provider or supplier submits its Form CMS-855; thus at least part of the affiliation must have occurred within the 5-year period preceding the date on which the application is submitted. However, we did not propose to limit the look-back period for disclosable events (other than uncollected debts), meaning that said event could have occurred any time in the past to be subject to disclosure.

We proposed, too, that if the affiliated provider or supplier had its Medicare, Medicaid, or CHIP enrollment denied, revoked, or terminated, this must be reported regardless of the reason for the denial, revocation, or termination. Since all denial, revocation, and termination reasons are of concern to us, we did not believe certain reasons should be excluded from disclosure. Nevertheless, we solicited comment on whether disclosure should be restricted to particular denial, revocation, and termination reasons and, if so, what those reasons should be.

We also sought comment on the following issues regarding our proposed definition of uncollected debt: (1) Whether there should be a threshold for the level of debt that would need to be reported; (2) whether a provider or supplier should be exempt from reporting an uncollected debt if it is complying with a repayment plan; and (3) whether the level of reporting burden on the provider or supplier is low enough to merit collection of this information without any threshold or exemption.

We previously mentioned our proposal that the terms revoked, revocation, terminated, and termination (for purposes of disclosure under § 424.519) would include situations where the affiliated provider or supplier voluntarily terminated its Medicare, Medicaid, or CHIP enrollment to avoid a potential revocation or termination; this is referenced in proposed § 424.519(a). As explained in more detail in section II.B.10. of this final rule with comment period, we have seen instances where a provider or supplier engages in inappropriate behavior, recognizes that its enrollment may soon be revoked, and then voluntarily withdraws from Medicare prior to the imposition of a revocation so as to avoid the revocation and an associated reenrollment bar under § 424.535(c). (See section II.B.4. of this final rule with comment period for more information on reenrollment bars.) Since the provider or supplier is thus not revoked from Medicare, it could immediately reenroll in Medicare without having to wait until the reenrollment bar expires. We believed such behavior poses a risk to the Medicare program in that the provider or supplier is seeking to avoid Medicare rules and, in the process, possibly reenter the Medicare program to continue its improper activities. Accordingly, although we also address this concern in new § 424.535(j), which is discussed in section II.B.10. of this final rule with comment period, we stated our view that for purposes of § 424.519, such actions should be included within the category of revocations and terminations.

We further solicited comment on proposed § 424.519(b) regarding the following issues—

• Whether 5 years is an appropriate look-back period for affiliations;
• Whether exclusions, denials, and revocations that are being appealed should be exempt from disclosure.
• Whether there should be a limited look-back period for disclosable events and, if so, how long (for example, 15 years, 10 years, 7 years).

We note that, pursuant to §§ 424.502 and 424.519, an affiliation applies to both parties in the affiliation. This means that if the definition of affiliation is met with respect to a particular relationship, both parties have an affiliation. However, whether the affiliation must be disclosed will depend upon whether the requirements of § 424.519(b) are met. For example, suppose Enrolling Provider X has a 50 percent ownership interest in Enrolled Provider Y, which is currently under a Medicare payment suspension. X would have to disclose its relationship with Y. Yet Y would not have to disclose the affiliation pursuant to § 424.519(b) unless X has a disclosable event.

We received the following comments regarding proposed § 424.519(a) and (b).

Comment: Many commenters expressed general concern about the burden of researching, tracking, and reporting information under § 424.519(b). One commenter stated that the rule as a whole (including the affiliation provision) should be geared towards non-compliant providers and suppliers rather than burdening honest providers and suppliers. Another commenter noted that the entire rule (including the affiliation provision) would significantly increase regulatory burden without efficiently targeting enforcement toward higher-risk enrollees, with another commenter stating that the rule should be more focused on identifying and weeding out potentially fraudulent parties. Another commenter stated that—(1) random, untargeted program integrity measures can bring harm to Medicare beneficiaries and all other stakeholders, and (2) Medicare providers may be forced to incur unnecessary costs to comply with a new rule and respond to a new integrity effort when a broad-based action is taken to address the abusive, but isolated conduct of a few providers. Another commenter stated that CMS should reconsider some of the disclosure, timing, and reporting requirements to lessen the administrative burden on providers and suppliers.

Consistent with the suggestion to modify our proposed affiliation provision to target providers and suppliers potentially posing a threat to the Medicare program instead of burdening all providers and suppliers, a commenter noted the previously mentioned February 2, 2011 final rule with comment period, wherein we established categories of risk for provider and supplier types for purposes of enrollment screening. These screening requirements were specifically tailored based upon the level of risk that the category of provider/supplier posed to Medicare, Medicaid, and CHIP. The commenter stated that CMS should consider taking a similar approach with the disclosure of affiliations requirement. The commenter stated it is unlikely that CMS is concerned with the risk of fraud posed by, for example, a hospital that previously employed a physician as a managing employee who now seeks to work at a new hospital; if the goal is not to target these types of scenarios, the commenter added, CMS should consider implementing a narrower, more focused approach in the final rule.

Another commenter noted language in section 1866(j)(5) of the Act stating that the provider or supplier shall disclose the information referenced in section 1866(j)(5) of the Act in a form and manner and at such time as determined by the Secretary. The commenter believed this language permits CMS to consider “alternative approaches.”

Too, a number of commenters stated that CMS can already access much of a provider's or supplier's disclosable affiliation data through PECOS; therefore, it is duplicative and unnecessary to burden providers and suppliers with obtaining, maintaining, tracking, and submitting this information.

Response: We appreciate these comments and are sympathetic to the concerns raised by the commenters regarding the significant burden this rule could place on providers and suppliers. In response to these concerns, and given the statutory language requiring disclosures to be provided in a form and manner and at such time as determined by the Secretary, we have decided to adopt a “phased-in” approach to implementing § 424.519(b), beginning with a more targeted approach that will then be expanded following further rulemaking and a concomitant assessment of the progress of the phased-in approach. To this end, we are revising § 424.519(b) to, for now, require disclosure of affiliations only from those providers and suppliers that have one or more affiliations, as determined by CMS, that would trigger a disclosure in accordance with § 424.519. Such providers and suppliers will be required to report their disclosable affiliations upon request from CMS, as detailed later in this final rule with comment period. This requirement will become effective after CMS has revised the Form CMS-855 to accommodate the required disclosures. (For purposes of this policy, the term “Form CMS-855” includes, and will collectively refer to—(1) the applicable Form CMS-855 paper applications; and (2) the respective online enrollment applications submitted through PECOS. Thus, both the paper and online applications, which will be subject to notice-and-comment, will be revised prior to the commencement of any affiliation disclosure requests.)

In reviewing whether a particular provider or supplier has one or more applicable affiliations, CMS will, as applicable, research and consider data revealed through such sources as, but not limited to: (1) PECOS, which, as explained previously, contains provider enrollment information submitted by the provider or supplier (for instance, as part of an initial application submission, a change of information request, a revalidation application, or a reactivation application); and (2) other CMS databases and external, non-CMS databases that could indicate behavior (such as improper billing patterns) of concern to us. After reviewing all applicable data, CMS will request the disclosure of affiliations in accordance with § 424.519 from a provider or supplier if the provider or supplier, or any of its owning or managing employees or organizations may currently have or, within the previous 5 years, have had an affiliation with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that may have one or more of the following disclosable events:

++ Currently has an uncollected debt to Medicare, Medicaid, or CHIP.

++ Has been or is subject to a payment suspension under a federal health care program;

++ Has been or is excluded by the OIG from participation in Medicare, Medicaid, or CHIP.

++ Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated.

We believe that these four events are appropriate triggers for the requirement to report all affiliations specified in this rule. In addition to being consistent with the statutory language regarding the types of events to be disclosed, we believe that each of these events raises potential program integrity concerns and accordingly provides a basis to require the provider or supplier to disclose all applicable affiliations.

For now, providers and suppliers will not be required to disclose affiliations under § 424.519 unless CMS, after performing the research and analysis described earlier and determining that the provider or supplier may have at least one affiliation that includes any of the four disclosable events, specifically requests it to do so. We believe this will ease the burden on the provider community because CMS, rather than the provider or supplier, will be responsible for reviewing whether the disclosure requirement applies to the provider or supplier. However, should CMS find, that it does apply, the provider or supplier in question must then report any and all affiliations that come within the scope of § 424.519, not merely the one(s) on which CMS made its determination. This could require the provider or supplier to conduct research to determine whether additional disclosable affiliations exist, which would then need to be reported to CMS.

We stress that merely because a provider or supplier may have at least one affiliation with a disclosable event and must therefore report all such affiliations upon a CMS request does not mean that CMS has determined that the provider and/or its affiliations pose an undue risk of fraud, waste, or abuse as stated in section 1866(j)(5) of the Act. The disclosure requirement is entirely separate from any undue risk finding. Indeed, CMS must first carefully review and analyze all disclosed affiliations before determining whether the undue risk standard (described in more detail in section II.A.1.d of this final rule with comment period) has been met; CMS will, in every case, act with caution and prudence when determining whether an undue risk of fraud, waste, or abuse exists.

To summarize, once CMS updates its Form CMS-855 applications to include an affiliation disclosure section, a provider or supplier that may have at least one affiliation involving a disclosable event, as identified by CMS, will be required to report any and all affiliations upon initial enrollment or revalidation, as applicable, when CMS specifically requests such information from the particular provider or supplier. Submission via revalidation will be done through a provider's or supplier's periodic revalidation (every 3 years for DMEPOS suppliers per § 424.57(g); every 5 years for all other provider and supplier types per § 424.515) or an off-cycle revalidation per § 424.515(d). We estimate that this will affect only about 2,500 to 4,000 providers and suppliers per year, although this figure could vary. This means that well over 99 percent of prospective and currently enrolled providers and suppliers will not be required to research or disclose affiliation information in the first several years following the effective date of this rule.

Although we will initially be implementing a more targeted approach to the disclosure requirement, we recognize that section 1866(j)(5) of the Act requires every provider and supplier (regardless of the relative risk they may pose) to disclose affiliations upon initial enrollment and revalidation. While section 1866(j)(5) of the Act does give the Secretary some discretion in applying this provision in terms of form, manner, and timing, it does not permanently exempt any provider or supplier from its applicability; for example, section 1866(j)(5) of the Act does not permit the Secretary to establish an exception for physicians or hospitals or other specific provider or supplier types. Moreover, even if CMS already has, for instance, affiliation data in PECOS regarding a provider that is nearing the end of its 5-year revalidation cycle, section 1866(j)(5) of the Act still requires disclosure as part of the provider's upcoming revalidation. Consequently, CMS must eventually secure affiliation data from all initially enrolling and revalidating providers. In light of the very large universe of such providers and suppliers, which we project would be around 1.7 million, we seek public comment on potential approaches for obtaining affiliation information from this group in terms of timing, mechanism, and priority. After receiving and reviewing these comments, CMS will publish a notice of proposed rulemaking (NPRM) outlining the proposed handling of disclosures for these providers and suppliers, followed by the issuance of a final rule (hereafter occasionally referred to as “the subsequent final rule”) after consideration of the public comments received on the proposed rule.

The specific issues on which we seek public feedback are as follows:

• Whether CMS should adhere to a specific schedule in its requests, such as, for example, requesting 20,000 providers and suppliers to disclose affiliations in the first 12 months after the subsequent final rule's effective date; 30,000 providers and suppliers in the second year; 40,000 in the third year; and so forth.
• Whether CMS, beginning in the first year after the subsequent final rule's effective date, should stagger its requests based on:

++ The risk of fraud, waste, or abuse posed by the individual provider or supplier in question and how CMS should assess this risk.

++ The risk of fraud, waste, or abuse posed by provider and supplier type (for example, Provider Type A is considered the highest risk provider or supplier type in Medicare and should, therefore, be the first provider type to disclose affiliations).

++ Whether the provider or supplier is initially enrolling in Medicare or is revalidating their enrollment (that is, whether initially enrolling providers or, instead, revalidating providers should take precedence in CMS' disclosure requests.)

++ The size of the provider or supplier and/or likely number of affiliations (for instance, larger providers with presumably more affiliations should be required to disclose affiliations in the initial year following the subsequent final rule's effective date; small providers with few affiliations should receive disclosure requests only in future years).

++ Any combination of the previous criteria.

++ Any other consideration (for example, geographic location).

• The total length of time that CMS should take to complete its collection of affiliation data from the entire universe of providers and suppliers (for example, 2 years; 4 years; 7 years; 10 years; etc.)
• How and when a provider or supplier should be notified that it must or need not disclose affiliation information on its initial or revalidation application, such as, for example:

++ When a provider or supplier submits an initial enrollment application, whether it should—(1) receive prior notice (for instance, via the www.cms.gov website) as to whether it must complete the disclosure of affiliation section of the Form CMS-855; or (2) only be notified after submitting the application and after review by CMS or the Medicare contractor.

++ Whether the letter that a provider or supplier receives from CMS or the Medicare contractor requesting the submission of a revalidation application should indicate whether the provider or supplier needs to disclose its affiliations.

Comment: A number of commenters stated that CMS should establish a monetary threshold for reporting debts. They generally contended that—(1) small or nominal amounts of debts would not pose an undue risk to Medicare, Medicaid, or CHIP; and (2) obtaining specific data from other parties (for example, indirect owners; an outside entity for which one of the enrolling provider's board members serves as a managing employee) on such small amounts would be an enormous burden. Suggested minimum debt amounts included $1,000, $10,000, and $100,000; another commenter recommended $50,000 since this is the minimum amount required for DMEPOS surety bonds. Another commenter urged CMS to consider establishing a de minimis standard based upon a percentage of a provider's/supplier's gross billings.

Response: While we appreciate these comments and carefully considered them, we do not believe a monetary threshold should be formalized in this rule. Our preferred approach is to consider the debt's amount as a factor in determining whether the debt presents an undue risk of fraud, waste, or abuse. We recognize that smaller debts often will not pose the same degree of risk as larger debts. However, there could be isolated cases where a particular debt, though of a de minimis amount, presents an undue risk when all of the applicable factors are considered. In short, we believe that viewing the debt amount as one factor among several, rather than automatically excluding all smaller debts from consideration, will give us the necessary flexibility to address a variety of factual scenarios.

Comment: Several commenters stated that debts that are being repaid should be exempt from the scope of “uncollected debt.” They contended that this would reduce the reporting burden on providers and suppliers. Moreover, the commenters stated that parties that are repaying their debts are proving their good-faith and are very unlikely to pose an undue risk of fraud, waste, or abuse.

Response: We appreciate these comments. For reasons similar to our position regarding debt thresholds, however, we decline to exclude debts that are being repaid from the scope of this rule. We believe that consideration of the debt's repayment status as one of several factors in determining whether an undue risk exists is the sounder path. This will give us the flexibility to address a variety of factual scenarios. To illustrate, suppose Enrolling Medicare Provider X was until recently a 60 percent owner of Medicare Provider Y. Y has an outstanding Medicare debt of $2.5 million. Even if the debt is being repaid, we would have reason to be concerned about the amount of the debt, X's recent relationship with Y, and the potential risk posed to the Medicare program. We acknowledge that a debt that is being repaid might in some cases present less of a risk than one that is not. Yet this does not mean that a debt being repaid can never present concerns; indeed, other factors may indicate that an undue risk exists. We believe, in sum, that excluding all debts that are being repaid from disclosure could permit certain providers and suppliers with affiliations posing an undue risk to enroll or remain enrolled in Medicare. This would be inconsistent with our obligation to protect the Medicare program and the Trust Funds.

Comment: A commenter recommended that CMS broaden the scope of the Electronic Submission of Medical Documentation (“edMD”) tool to allow Medicare contractors, states, and CHIP programs to transmit documentation, notices, and letters to providers and suppliers electronically. This would facilitate efficient routing within an organization to those responsible for monitoring and acting on debt and overpayment notices; it also would allow for electronic receipt confirmation. The commenter, as well as several others, urged CMS to consider creating a centralized database through which providers and suppliers can monitor, identify, and address debt notices that CMS and state health care programs have issued; said database should include the information required to research and reconcile submitted claims and track recoupments and interest.

Response: We appreciate these comments but believe they are outside the scope of this rule.

Commenter: A number of commenters stated that debts that are being appealed should be exempt from the category of “uncollected debts.” In general, they contended that—(1) the appeals process can often take considerable time; (2) many overpayments are overturned on appeal; (3) obtaining, maintaining, and tracking information on debts that are being appealed would be overly burdensome for providers and suppliers; (4) debts that are being appealed (as well as the providers and suppliers availing themselves of the appeals process) lack any indicia or risk of fraud, waste, or abuse; and (5) the current backlog in the appeal process must be factored into consideration regarding the reporting of debt. A commenter stated that including debts under appeal is administratively burdensome and pressures providers to affirmatively pay Zone Program Integrity Contractors (ZPIC) and Additional Documentation Request (ADR) amounts, versus allowing the Medicare Administrative Contractor (MAC) to recoup the amount.

Response: We appreciate these comments. As with debts that are being repaid, however, we do not believe that debts under appeal should be automatically excluded from disclosure. Instead, we believe it is more appropriate to consider the appeal status of an affiliated party's debt as one of the factors in determining whether the affiliation presents an undue risk. In situations where, for instance, an enrolling provider or supplier has a close affiliation with another provider that has a very large overpayment, we believe that the existence of the overpayment, whether or not under appeal, could be an indication of risk. Thus, consistent with our obligation to protect the Medicare program and the Trust Funds, as well as with our authority under section 1866(j)(5) of the Act, we believe we should have the ability to determine whether the debt and the associated affiliation pose an undue risk regardless of whether the debt is being appealed. If we excluded such debts from disclosure, we might be compelled to enroll a provider or supplier that was at least indirectly involved in accumulating significant debt. In short, we continue to believe that—(1) we must have the discretion and flexibility to address a wide variety of situations; and (2) the exclusion of certain actions, such as debts being repaid or under appeal, would hinder us in detecting risks to Medicare.

Additionally, as a point of clarification, ZPICs are no longer operational. Uniform Program Integrity Contractors (UPICs) have taken over the functions that ZPICs previously performed. Furthermore, while on the topic of contractors, we note that affiliation disclosures also may support CMS contractor investigative efforts related to discovering networks of individuals and entities engaged in fraud, waste, or abuse (for example, information regarding new leads, new networks, or more extensive networks than previously known), in addition to revealing affiliations that pose an undue risk of fraud, waste, or abuse.

Comment: Several commenters stated that the phrase “notice of the debt to the provider, civil money penalties, or assessments” should not include audit requests or routine denial letters where refunds are made through remittance advices or claims corrections and the provider has otherwise been in good standing. Another commenter stated that the definition of uncollected debt should exclude certain recoveries, such as those associated with the Electronic Health Records (EHR) Incentive Program and reconciliations from alternative payment models, to prevent duplicative penalties for the same instance (which the commenter believed would effectively constitute double jeopardy). Another commenter stated that hospices routinely receive notices of debt for hospice cap overpayments and regular Periodic Interim Payment settlements. The commenter questioned whether such notices would trigger the disclosure requirement at § 424.519.

Response: We recognize that there are numerous types of Medicare, Medicaid, and CHIP debts. As applied to § 424.519, “uncollected debt” refers to any debt stemming from a Medicare, Medicaid, or CHIP overpayment for which CMS or the state has sent notice of the debt, such as a demand letter or other formal request for payment, to the affiliated provider or supplier and which has not been fully repaid.

Comment: A commenter suggested that the language regarding overpayments in the definition of uncollected debt be restricted to overpayments for which CMS or the state has sent notice of the debt to the affiliated provider or supplier and the due date for payment thereof has passed, subject to the following exceptions: (1) Debt for which the provider or supplier has filed a timely notice of appeal, until such time as a court or agency of competent jurisdiction has found the debt to be valid and no further appeals are available; or (2) debt that is subject to a repayment plan.

Response: For reasons previously stated, we are not exempting debts that are being either repaid or appealed from disclosure.

Comment: A commenter stated that there is a separate statutory and regulatory process in place (with separate requirements, timelines, and consequences for any failure to comply) for provider and supplier overpayments. The commenter stated that overpayments should be handled through this already well-defined and finalized process and not brought within the scope of this rule.

Another commenter stated that all overpayments should be—(1) excluded from the definition of uncollected debts; and (2) reviewed differently than CMPs and assessments. The commenter contended that the term “overpayment” in and of itself does not signify fraud or intentional harm but rather that payments were made erroneously. The commenter cited an example of when the components of a service are improperly documented and, as documented, do not justify the code for which the program was billed; the commenter stated that this is not indicative of intentional fraud. The commenter also stated that it can often be some time before overpayments are identified by an organization; as such, the overpayment amounts may be substantial, seriously affecting an individual's or organization's ability to quickly repay the amount, particularly in situations where significant interest has accrued. These situations may require negotiations and the development of repayment schedules.

Response: We respectfully disagree with these commenters. Section 1866(j)(5) of the Act specifically references uncollected debts, and we previously mentioned instances where providers and suppliers have accumulated large uncollected debts, closed their business, and reopened another provider or supplier organization to repeat their behavior. Therefore, we believe that including uncollected overpayments within § 424.519 is necessary.

Comment: A commenter stated that CMS should clarify whether its intent is only for CMPs and assessments imposed on DMEPOS suppliers to be disclosed or those imposed against any type of provider or supplier.

Response: We appreciate this comment. We will clarify in the final regulatory text that the scope of CMPs and assessments applies to all provider and supplier types by—(1) deleting the references to the definitions of CMPs and assessments in § 424.57(a), which are limited to DMEPOS suppliers; and (2) adding language that refers to any CMP and assessment imposed under title 42. We note that the latter includes, but is not limited to, OIG CMPs under Title XI of the Act that are referenced in title 42.

Comment: Many commenters expressed concern about the burden of obtaining, tracking, and maintaining debt information regarding affiliates (and the affiliates of the provider's or supplier's affiliates). Several contentions were made. First, Medicare contractors do not always send debt notices to the correct address, especially when the provider's administrative office is different from the provider's place of operations. Second, contractors sometimes have different procedures for notifying providers and suppliers of debts and for collecting such debts; issues presented by the first and second scenarios, a commenter stated, are particularly acute with respect to Medicaid debts and state Medicaid programs. Third, it would be difficult for large providers and suppliers with many locations to accumulate the debt information involving all of its sites.

Response: We appreciate these concerns. In light of our previously mentioned revision to § 424.519(b), the overwhelming majority of providers and suppliers will not have to report the information to which the commenters refer for several years. Also, CMS will closely monitor the progress of § 424.519(b)'s implementation; should limitations on the reporting of certain types of uncollected debts be necessary, CMS may consider additional rulemaking. We further note that we understand the concerns about a provider's or supplier's ability to obtain debt (and other) data from affiliates. We address this matter further in section II.A.1.c. of this final rule with comment period.

Comment: Several commenters stated that denials, revocations, and terminations should be deemed reportable only if they involved fraudulent activities (for example, a formal finding of fraud by the OIG, the Department of Justice, a Medicare contractor, or a court of law) or were imposed on otherwise serious grounds. One commenter stated that this is necessary because of the possibility of denials and revocations due to mistakes or technical misunderstandings. Other commenters stated that this limitation would reduce the regulatory burden.

Another commenter stated that termination reasons should be limited to fraudulent or wasteful behavior. The commenter cited the example of a provider terminated from Medicaid because he or she did not renew his or her Drug Enforcement Administration (DEA) certification in a timely manner; the commenter did not believe this behavior should be disclosed and scrutinized for possible Medicare termination. Another commenter stated that providers and suppliers should not be required to disclose denials for what the commenter deemed non-substantive reasons, such as minor typographical or similar errors that are not based on an assessment that the provider or supplier is ineligible to participate in the program. Another commenter requested that CMS distinguish between OIG exclusions based on fraud, waste, or abuse, and those based on what the commenter described as more innocuous reasons, such as a failure to repay student loans; the commenter did not believe the latter would affect a provider's or supplier's ability to furnish services to patients. An additional commenter stated that CMS should differentiate between denials, revocations and terminations that are “without fault” and “without cause” and those related to fraud, integrity or quality concerns. The commenter appeared to indicate that the former should be exempt from disclosure, such as instances where a provider's application is denied for failing to respond to a Medicare contractor's request for additional information. Yet another commenter stated that the reporting of payment suspensions should be limited to those imposed based on a determination of a credible allegation of fraud.

Response: We respectfully disagree with these commenters. All program denials, revocations, terminations, OIG exclusions, and payment suspensions are of concern to us. However, we understand that the facts and circumstances behind each action may differ and, consequently, pose different risks to Medicare, Medicaid, and CHIP. Rather than explicitly exempt certain types of these actions from disclosure, we believe the better approach is to carefully consider the factors we proposed in § 424.519 in determining whether an undue risk exists. This will give us the flexibility needed to address a variety of scenarios.

Comment: A number of commenters opposed including voluntary terminations within the scope of disclosable events. They stated that—(1) many voluntary terminations are for innocuous reasons and do not pose a risk to federal health care programs; and (2) including voluntary terminations as a disclosable event is inconsistent with congressional intent.

Response: Although we recognize the commenters' concerns, we explained previously our reasons for including voluntary terminations within the scope of § 424.519; specifically, there have been instances where providers and suppliers have voluntarily terminated their enrollment in order to avoid a revocation and subsequent reenrollment bar. To allow CMS to determine whether such a scenario occurred, we maintain that all voluntary terminations should be included within § 424.519, all the while understanding that there are voluntary terminations that are for legitimate reasons unrelated to a pending revocation and thus pose no risk to Medicare.

We wish to reiterate that simply because a particular affiliation must be disclosed does not automatically mean that it will result in a finding that the affiliation poses an undue risk of fraud, waste, or abuse. CMS will—(1) review each situation based on the totality of the circumstances at hand; and (2) exercise its discretion to deny or revoke in a cautious and prudent manner.

Comment: A commenter stated that section 1866(j)(5) of the Act does not require the disclosure of terminations; hence, terminations should be excluded as a disclosable event.

Response: Section 1866(j)(5) of the Act refers to Medicare, Medicaid, and CHIP denials and revocations. However, in Medicaid and CHIP terminology, providers are terminated, rather than revoked. Our reference to terminations in § 424.519 is thus intended to cover Medicaid and CHIP program actions.

Comment: A commenter questioned what is meant by the “to avoid a potential revocation or termination” standard and how it would be applied. The commenter also requested that CMS issue standards for distinguishing between affected and non-affected voluntary terminations.

Response: The phrase “to avoid a potential revocation or termination” means that the provider or supplier voluntarily terminated its enrollment to avoid being revoked by Medicare and subjected to a reenrollment bar. Regarding the establishment of standards as the commenter suggests, we will consider—(1) issuing subregulatory guidance concerning the reporting of voluntary terminations to assist providers and suppliers; and (2) the surrounding facts of the case in determining whether the voluntary termination falls within this category.

Comment: A commenter stated that the late filing of a cost report may trigger a payment suspension. The commenter questioned whether such a payment suspension would have to be reported at that time. Another commenter posed the same question regarding payment suspensions stemming from the late submission of a self-determined Medicare cap liability based on an inability to secure Provider Statistical and Reimbursement report (PS&R) information.

Response: As we proposed, all payment suspensions under a federal health care program, regardless of the specific regulatory basis involved, fall within the purview of § 424.519. This will enable us to examine the facts behind the payment suspension in determining whether an undue risk exists.

Comment: Several commenters recommended that CMS exempt from disclosure all disclosable events that are currently being appealed. They generally stated that this—(1) would ease the reporting burden on providers and suppliers; (2) eliminate any presumption that the disclosable event actually happened; (3) be consistent with due process; (4) prevent parties from being permanently harmed if the event is later overturned on appeal (for instance, it would not remain in CMS' records as a disclosable event); and (5) prevent providers, suppliers, CMS, and Medicare contractors from having to expend resources on premature reporting and undue risk determinations. Another commenter suggested that CMS add a provision to the final rule that allows for all appeals to be exhausted before a provider or supplier is required to report under § 424.519(b). Another commenter disagreed with CMS' stated concern in the proposed rule about the filing of frivolous appeals to avoid reporting disclosable events; the commenter urged CMS to exclude disclosable events that are being appealed.

Response: We respectfully decline to exempt denials, revocations, terminations, payment suspensions, and exclusions by the OIG that are being appealed from the purview of § 424.519. Such actions can involve significant transgressions, and we must be able to take prompt action to protect the Medicare program and the Trust Funds.

Comment: Several commenters stated that CMS should not require a provider or supplier to report if an affiliate had its Medicare, Medicaid, or CHIP enrollment denied, revoked, or terminated if said affiliate was not enrolled in Medicare, Medicaid, or CHIP at the time of the affiliation. One commenter stated that providers should only be required to disclose affiliations with other providers that were—(1) enrolled or attempted to enroll during the period in which the affiliation occurred; or (2) enrolled prior to the affiliation period. If the affiliate was not enrolled during or prior to the affiliation period, this commenter stated, the provider would have no reason to believe that it had a disclosable event and would not collect or monitor such information.

Response: We respectfully disagree with these commenters. Improper behavior within a health care provider or supplier can occur regardless of whether it is enrolled in a federal health care program. In other words, the crucial issue with respect to the scenario the commenters pose is more the behavior itself than the provider's or supplier's enrollment status. We thus believe that disclosable events should be reported even if the provider or supplier in question was not enrolled at the time of the affiliation.

Comment: Several commenters stated that a 5-year look-back period for affiliations is appropriate.

Response: We appreciate the commenters' support.

Comment: A number of commenters stated that our proposed 5-year look-back period is too long. They generally contended that—(1) requiring research, tracking, and disclosure over a 5-year period would be too burdensome for providers and suppliers; and (2) relationships occurring 4 or 5 years ago typically would not pose a risk of fraud, waste, or abuse. Commenters suggested a shorter period; among those mentioned were 3 years, 2 years, and 1 year. They stated that a shorter period would still permit CMS to take action against providers and suppliers with problematic affiliations without—(1) penalizing providers and suppliers for having affiliations with entities whose disclosable events have passed; and (2) imposing an unacceptable burden on providers and suppliers.

Response: We appreciate these comments and concerns. After careful consideration, though, we continue to believe that a 5-year period is warranted. A 5-year period will enable us to capture a sufficient extent of the provider's or supplier's disclosable event history without requiring the provider or supplier to research affiliations from many years prior. Put another way, we believe a 5-year period strikes a suitable balance between—(1) ensuring our ability to detect undue risks to the Medicare program and the Trust Funds and (2) restricting the burden of research and disclosure on providers and suppliers. We acknowledge that current or more recent affiliations may, depending on the facts of the case, present more concern than those that ended 4 or 5 years ago, and we will take into account when the affiliation occurred in determining whether an undue risk exists.

Comment: A commenter stated that the proposed 5-year look-back period for previous affiliations is longer than any of the look-back periods associated with related fraud and abuse statutes, such as the physician self-referral (Stark) law, the CMP provisions, or the anti-kickback statute. The commenter contended that CMS fails to provide any justification as to why 5 years is the appropriate timeframe.

Response: Our 5-year look-back period is based on the objectives of section 1866(j)(5) of the Act. It need not be predicated on look-back periods for other, unrelated statutes; indeed, the affiliation disclosure requirement is entirely different from these other statutes, and any disclosure period established therewith must be predicated on the particular objectives and circumstances of said requirement. Further, we explained in the proposed rule that a 5-year look-back period would divulge to us past situations that could present future concerns, while being less onerous than, for instance, a 10-year period. We also respectfully note that a 5-year lookback period for previous affiliations is shorter than the lookback periods associated with overpayment and fraud and abuse statutes to which the commenter referred.

Comment: A number of commenters recommended that CMS establish a look-back period for disclosable events. They essentially stated that—(1) the lack of a look-back period would impose an enormous burden on providers and suppliers because they would have to obtain, submit, and regularly monitor information from potentially decades ago, which could take resources away from patient care, and (2) disclosable events that occurred many years prior do not pose a significant, if any, risk to federal health care programs. Among the look-back periods they suggested for disclosable events were 5 years, 3 years, and 2 years. The commenters stated that such periods would be sufficient to remove problematic parties from Medicare, Medicaid, and CHIP without overly burdening providers and suppliers. One commenter stated that if there is no look-back period for disclosable events, the universe of organizations that will have experienced at least one disclosable event will increase dramatically year-to-year; eventually, it is conceivable that nearly all providers and suppliers will have experienced at least one disclosable event at some point in their existence. Other commenters noted that CMS has a 10-year reporting limit for felony convictions and suggested that—(1) any look-back period for disclosable events should not exceed 10 years for offenses equivalent in scope to a felony; and (2) CMS should strongly consider reducing the disclosure period for less severe actions (such as non-felony final adverse actions), which a commenter suggested should be 3 years.

Response: We appreciate these comments and understand the concerns regarding burden. However, after carefully considering them, we maintain our view that no look-back period for disclosable events should be established. While we recognize that disclosable events occurring many years previously often will not present the same level of concern as a more recent action, such events could still pose risks. Given our obligation to protect the Medicare program and the Trust Funds, we must retain the flexibility to address various factual scenarios. Yet we also reemphasize that, per our previously discussed revisions to § 424.519(b), many providers and suppliers will not have to research or report disclosable affiliations for at least several years after the effective date of this rule.

Comment: A commenter recommended a 7-year look-back period that would involve the submission of reports documenting disclosable events (including those for the potential billing service provider, the service owner or director, and accounts receivable personnel) that occurred during that timeframe. The commenter stated that such an assessment is necessary for the prevention of fraudulent activity. The commenter also stated that—(1) a 7-year timeframe is consistent with credit reporting; and (2) the Internal Revenue Service has a timeline of 7 years for documentation regarding a loss.

Response: We appreciate this suggestion. For reasons previously stated, however, we are not adopting a look-back period for disclosable events and are retaining our proposed 5-year period for disclosable affiliations.

Comment: Several commenters stated CMS should not require a provider or supplier to report any disclosable event imposed on a prior affiliate after the relationship between the provider or supplier and the affiliate is terminated. A commenter stated that while the statute requires reporting current and past affiliations with individuals or entities that have experienced certain events, it references past events by using the past perfect conjugation. The commenter believed that this indicates that the Congress did not intend for providers or suppliers to disclose information on events that occurred after the affiliation period. Such events, the commenter stated, would be in the future in terms of the relationship between the individuals or entities, thus making the events outside the scope of the requirement.

Response: We respectfully disagree with these commenters. Adoption of this suggestion could mean, for instance, that a party involved in improper activities could depart an affiliated provider immediately before any sanctions are imposed on the latter and purchase an enrolling provider, but CMS could take no action under § 424.519 to prevent said enrollment. We explained in the proposed rule our concern about parties that engage in inappropriate behavior in one forum and then move to another provider or supplier to repeat their activities. The structure and scope of our disclosure requirements are designed to prevent this. We believe we have the discretion to interpret section 1866(j)(5)(A) of the Act as not requiring the disclosable event to have occurred during the affiliation. Additionally, we have authority to include such situations within the scope of disclosable affiliations pursuant to our general rulemaking authority under sections 1102 and 1871 of the Act.

Comment: A commenter stated that any look-back period for disclosable events should not precede the date on which the provider or supplier established a covered affiliation with the relevant entity.

Response: It appears that the commenter is suggesting that disclosable events occurring prior to the establishment of the affiliation should not be included within the scope of § 424.519. We respectfully disagree. Depending on the particular facts of the case, we believe that affiliations established with parties that have some type of adverse history can still present risks. We believe we must retain the discretion to address such situations in order to protect the Medicare program and the Trust Funds.

Comment: A commenter stated that look-back periods for affiliations and disclosable events should be 2 to 3 years and limited to timeframes following the acquisition of an entity and prior to the sale of an entity.

Response: We appreciate this comment. However, for reasons stated earlier, we believe that a 5-year period is more appropriate for affiliations, with no look-back period for disclosable events. As we mentioned in the proposed rule, the 5-year timeframe extends back from the date on which the application is submitted; it is unrelated to the date of any relevant acquisition or sale.

Comment: Several commenters recommended that CMS only require the reporting of disclosable events that occurred during the affiliation; in other words, the disclosable event must have occurred during the affiliation, not before or after, to require disclosure. A commenter contended that an enrolling or revalidating provider may have no way to reasonably know about disclosable events occurring outside the period of their affiliation with another provider or supplier. Another commenter stated that if the look-back period for disclosable events is not coterminous with the affiliation reporting obligation, providers will have to track the activities of entities either pre- or post-affiliation. Another commenter stated that a provider typically would not (and should not be expected to) know of a disclosable event after an affiliation has ended. Several commenters added that providers and suppliers should only be required to report disclosable events that occurred before the end of an affiliation with a close affiliate. Another commenter stated that if CMS requires reporting of disclosable events occurring before or after an affiliation, such events should not be considered for purposes of determining undue risk.

Response: For reasons stated previously, we believe it is important that disclosable events occurring before or after an affiliation be included within the purview of § 424.519. It is possible that such an affiliation—even one involving parties that might not be considered “close” affiliates—could pose an undue risk; indeed, we previously cited the example of a party that associates with a provider, engages in improper conduct, and then ends the association prior to any imposition of an adverse action or before the determination that a large overpayment exists. We again recognize, though, as we have discussed in detail in this section II of this final rule with comment period, the burden that could be involved in ascertaining this information. We also have revised § 424.519(b) such that only a very small number of providers and suppliers will have to report affiliations in the initial years following the effective date of this final rule with comment period.

Comment: A commenter stated that with respect to past affiliations, providers should only be required to disclose whether the provider or the affiliate had a disclosable event during the affiliation period. Having to obtain information from past affiliates, the commenter stated, could be extremely difficult. Another commenter stated that providers and suppliers should not be required to report prior disclosable events of any other providers or suppliers with which it has or had an affiliation. The commenter stated that once a relationship with a close affiliate ends, the provider or supplier may have no way to know or obtain information about the individual's or entity's behavior and actions. Another commenter stated that requiring reporting disclosable events occurring after an affiliation ends would be extremely burdensome on providers and suppliers; it would mandate them to continue to perform due diligence on an organization with which they no longer do business. Once a financial relationship has been terminated, the commenter explained, there would be no plausible reason for either party to maintain contact and, moreover, it is unclear whether the former affiliate could be compelled to disclose whether, for instance, it had its enrollment denied, revoked, or terminated after the affiliation had ended; also, the former affiliate would have no incentive to be forthcoming with the provider or supplier because there would be no penalty for being untruthful. This would, the commenter stated, leave providers or suppliers who are acting in good faith in a precarious position.

Response: We understand the potential difficulty involved in obtaining data from past affiliates. However, we reiterate our belief that disclosable events occurring before or after an affiliation could present program integrity risks and that we must be able to take action to protect the Medicare program and the Trust Funds.

After consideration of the comments received, we are finalizing proposed § 424.519(a) and (b) with several exceptions and with a revision to § 424.502:

• In paragraph (a), we are doing the following:

++ Changing the language “(as defined in § 424.57(a))” to “imposed under this title.”

++ Adding the language “to the definition of disclosable event in § 424.502” to the end of the opening paragraph. This is to accommodate our revisions to §§ 424.502 and 424.519(b).

• In lieu of listing the four disclosable events that we proposed in § 424.519(b) within that paragraph, we are adding to § 424.502 a definition of “disclosable event” to encompass them. Doing so, we believe, will shorten § 424.519(b) to make it more concise and readable. Within this definition, we are also adding “by the OIG” immediately after the word “excluded” to clarify that we are referring to OIG exclusions.
• We are revising the entirety of § 424.519(b) to read as set out in the regulatory text.

In addition, and as mentioned previously, we solicit public comment on operational approaches (specifically with respect to timing, mechanism, and priority) for obtaining affiliation information from providers and suppliers other than those to which § 424.519(b) will apply.

c. Affiliation Data, Mechanism of Disclosure, and “Reasonableness” Standard

In § 424.519(c), we proposed to require the disclosure of the following information about the affiliation:

• General identifying data about the affiliated provider or supplier. This includes the following:

++ Legal name as reported to the Internal Revenue Service or the Social Security Administration (if the affiliated provider or supplier is an individual).

++ “Doing business as” name (if applicable).

++ Tax identification number.

++ NPI.

• Reason for disclosing the affiliated provider or supplier (for example, uncollected Medicare debt or Medicaid payment suspension).
• Specific data regarding the relationship between the affiliated provider or supplier and the disclosing party. Such data include the—(1) length of the relationship; (2) type of relationship (for instance, an owner of the initially enrolling provider or supplier was a managing employee of the affiliated provider or supplier); and (3) degree of affiliation (for example, percentage of ownership; whether the ownership interest was direct or indirect; the individual's specific managerial position; the scope of the individual's or entity's managerial duties; whether the partnership interest was general or limited).
• If the affiliation has ended, the reason for the termination.

We stated that the information in proposed § 424.519(c) is necessary to help us assess the risk of fraud, waste, or abuse that the affiliation poses.

In § 424.519(d), we proposed that the information required under § 424.519 be furnished to CMS or its contractors via the Form CMS-855 application (paper or the internet-based PECOS enrollment process). This is to ensure that all enrollment information continues to be reported via a single vehicle.

In § 424.519(e), we proposed that the disclosing provider's or supplier's failure to fully and completely furnish the information specified in § 424.519(b) and (c) when the provider or supplier knew or should reasonably have known of this information may result in either of the following:

• The denial of the provider's or supplier's initial enrollment application under § 424.530(a)(1) and, if applicable, § 424.530(a)(4).
• The revocation of the provider's or supplier's Medicare enrollment under § 424.535(a)(1) and, if applicable, § 424.535(a)(4).

Under our proposed “reasonableness” standard in § 424.519(e), we would require particular information to be reported only if the disclosing provider or supplier knew or should reasonably have known of said data. For instance, while a provider or supplier would typically know of a past affiliation, it may not necessarily know whether a § 424.519(b) action occurred or was imposed after the affiliation ceased. We stated that we would review each situation on a case-by-case basis in determining whether the disclosing entity knew or should have known of the information.

We also solicited comment regarding the following:

• Whether we should establish a “reasonableness” test, whereby we explain what constitutes a sufficient effort to obtain information in the context of the “should reasonably have known” standard.
• If we establish such a test, what its specific elements should be (for example, what constitutes a reasonable inquiry; the minimum steps that the provider must undertake in researching information).

We received the following comments regarding paragraphs (c), (d), and (e):

Commenter: A commenter questioned whether affiliations would have to be reported prior to updates to the Form CMS-855 to capture this information. In a similar vein, another commenter questioned whether, once the rule becomes final, organizations would immediately be required to collect data regarding ownership interests or other affiliations with Medicare providers and suppliers, or whether there would be a grace period to permit entities (especially large ones) to prepare for the affiliation disclosure requirements. Another commenter urged CMS to give providers and suppliers a reasonable implementation period to prepare for said requirements.

Response: Disclosable affiliations will not have to be reported until the Form CMS-855 applications are updated to collect this data; additionally, CMS will issue accompanying subregulatory guidance regarding the affiliation disclosure process, though this may or may not be issued before CMS' begins sending affiliation disclosure requests to providers and suppliers. Because disclosure will not be required until the applicable forms are revised, all stakeholders will have sufficient time to prepare for said requirements.

Comment: A commenter stated that an elaborate regulatory “reasonableness” test is unnecessary. Instead, the commenter suggested that—(1) the reasonableness standard should be based on the principle of good faith, and (2) physicians should be neither required nor expected to research information about disclosable events relevant to affiliations that they would not otherwise be aware of in the general course of business. The commenter stated that a presumption of good faith should be applied that takes account of the limited knowledge providers may possess regarding their affiliated entities, especially when the extent or duration of the affiliation is relatively minor. Several other commenters also recommended a “good-faith” basis for any reasonableness test, with another commenter stating that providers and suppliers should not be required or expected to research data about disclosable events relevant to prior affiliations that they would not be otherwise aware of in the overall course of business.

An additional commenter stated that setting a standard for a “reasonable” effort might inadvertently—(1) expose honest providers to a level of risk that this rule does not intend, and (2) offer a potential benchmark for questionable and fraudulent parties. With the former, the commenter stated that most medical practices would strive to meet any reasonableness standard, but that they may lack the resources to meet an excessive standard. Concerning the latter, the commenter stated that a clearly delineated standard would signal to parties engaged in fraudulent behavior exactly how “far away” to keep their information, thus increasing the chances that innocent providers are unknowingly associated with unethical entities. The commenter recommended that CMS base any reasonableness standard on the presumption of good faith and not a complex process.

Response: As previously stated in both this final rule with comment period and the proposed rule, we recognize that various data may be difficult to obtain. We intend to issue subregulatory guidance that will clarify our expectations regarding the level of effort that is required in securing the relevant affiliation information.

Comment: A number of commenters recommended that CMS—(1) more clearly define the “knew or should reasonably have known” standard; (2) develop criteria for said standard; (3) explain what constitutes a sufficient effort to obtain information; (4) specify how CMS will assess whether a provider or supplier knew or should reasonably have known of an affiliation or disclosable event; and (5) furnish examples of when and how the standard would and would not be applied. One commenter stated that CMS should provide illustrations of what would constitute a reasonable attempt to obtain certain information, similar to the Internal Revenue Service's “Rebuttable Presumption” standard. For example, the commenter stated, if a provider adheres to certain protocols, it should not be penalized if the information gathered pursuant to such protocols turns out to be false. The commenter believed this was equitable and would promote practical compliance.

An additional commenter stated that CMS should not institute a strict test for reasonableness but instead provide guidance on the steps that CMS expects providers and suppliers to take to meet the “should reasonably have known” standard. The commenter contended that an explicit test—(1) may be too administratively burdensome on providers and suppliers; and (2) might not be applicable to a variety of activities and relationships.

Response: We appreciate and understand the commenters' concerns. As stated previously, we plan to issue subregulatory guidance that will clarify our expectations regarding the level of effort providers and suppliers must expend when researching affiliations.

Comment: A commenter sought clarification as to the appropriate process for providers and suppliers to follow if they disagree with CMS' application of the “knew or should reasonably have known” standard in a particular case; the commenter asked whether the remedy is limited to a post-revocation appeal. The commenter recommended that if there is a dispute about whether the test has been met, no final enrollment action should be taken until all rights of appeal are exhausted. Another commenter stated that if the provider or supplier disagrees with any CMS application of the “knew or should reasonably have known” test that results in a denial or revocation, the provider or supplier can appeal CMS' denial or revocation. Another commenter stated that individuals often cannot be expected to discover a disclosable event when many of the affected parties are not in a sufficient position of control to obtain data regarding whether past, present, or future relationships may involve such an event; the commenter added that there is no comprehensive database of this information.

Response: We acknowledge the commenters' concerns and, as already stated, will issue appropriate subregulatory guidance concerning the “knew or should reasonably have known” standard. We note also that the provider or supplier may appeal a denial or revocation triggered by our affiliation disclosure provisions under 42 CFR part 498.

Comment: A commenter recommended that CMS require providers to report debts only for affiliates that they have reasonable knowledge to believe are over the established debt threshold. A reasonable knowledge standard, the commenter stated, would—(1) allow CMS to identify debtors that could pose a risk to the integrity of the Medicare program; and (2) ease the regulatory burden on providers because they would not have to investigate in-depth every current or past affiliate.

Response: We appreciate this comment and believe that our “knew or should reasonably have known” standard is not inconsistent therewith. However, we strongly reemphasize, that this does not mean that actual knowledge without any attempt to research affiliation data should be the test for compliance. Even with our “knew or should reasonably have known” standard, the provider or supplier must put forth a sufficient effort to research actual and possible affiliations.

We also reiterate that we are not establishing a debt threshold in this final rule with comment period.

Comment: Several commenters stated that a failure to report a disclosable event (either during initial enrollment, revalidation, or through changes in information) should not result in denial or revocation unless the omission was material and intentional, with some commenters adding that this policy is necessary because of the lack of clarity regarding what constitutes an affiliation. Some stated that denial or revocation would only harm legitimate providers and suppliers that are making honest efforts to report said data but that inadvertently neglect certain information or are unable to obtain it.

Response: We respectfully decline to establish a “material and intentional” standard, for this could give the impression that—(1) certain required data can be withheld without consequences; and (2) little effort is necessary so long as information is not purposely withheld. Nevertheless, we again recognize that some data could be difficult to secure, and we stress that we will only take denial or revocation action pursuant to § 424.519(e) after careful consideration of the facts and circumstances and not as a matter of course.

Comment: A commenter stated that by using certified mail to inform providers and suppliers of certain information, CMS will have a legally binding signed document with which to prove what an entity or person should reasonably have known. The commenter added that a searchable CMS program participant database that tracks this information could prevent fraudulent activity before payments are made.

Response: We appreciate these comments but believe they are outside the scope of this rule.

Comment: A commenter stated that a provider or supplier should only be required to complete steps in its research that are clearly outlined and can be accomplished through publicly available search mechanisms, such as the OIG exclusion list. The commenter added that DMEPOS suppliers are required to complete a fingerprinting process as part of enrollment and re-enrollment, which, the commenter believed, should suffice to meet the intent of background research on individual owners.

Response: While we believe that public database searches would prove useful in obtaining affiliation data, we do not believe the provider's or supplier's efforts should be automatically restricted to these means. Depending on the particular circumstances involved and recognizing that certain instances might necessitate greater degrees of research, this could require, for instance, a review of internal records and contacting affiliates. Such actions may yield data and information that is not otherwise available via public databases.

We note that DMEPOS suppliers are subject to our fingerprinting requirements only as prescribed in § 424.518.

Comment: A commenter suggested that CMS—(1) should establish a rebuttable presumption that the provider or supplier exercised sufficient diligence in gathering affiliation information; and (2) should not deny or revoke enrollment if the provider or supplier follows the appropriate procedure to obtain a rebuttable presumption. The commenter stated that this would promote compliance while recognizing that legitimate mistakes will be made in the data collection process.

Response: We respectfully disagree that we should automatically presume that every provider or supplier submitting affiliation data exercised sufficient diligence in gathering the required information. We will review each case on its own merits, while acknowledging, as previously stated, that certain data may be difficult to secure.

Comment: A commenter stated that CMS should explicitly state that hospitals and health systems may rely upon disclosures furnished by their affiliates, rather than being held to a “should reasonably have known” standard.

Response: We respectfully disagree. A provider's or supplier's reliance upon information furnished by its affiliates is a matter between those parties, and the provider or supplier itself is ultimately responsible for furnishing accurate data to CMS. This is no different from the current requirement to furnish correct ownership, managerial, and adverse history information on the Form CMS-855 as part of the regular enrollment process. As stated previously, we will review each case on its own merits with the understanding that certain data may be difficult to obtain.

After reviewing the comments received, we are finalizing § 424.519(c), (d), and (e) as proposed.

d. Undue Risk

We proposed in § 424.519(f) that upon receiving the information described in § 424.519(b) and (c) (and consistent with section 1866(j)(5)(B) of the Act), we would determine whether any of the disclosed affiliations poses an undue risk of fraud, waste, or abuse. The following factors would be considered:

• The duration of the disclosing party's relationship with the affiliated provider or supplier.
• Whether the affiliation still exists and, if not, how long ago it ended.
• The degree and extent of the affiliation (for example, percentage of ownership).
• If applicable, the reason for the termination of the affiliation.
• Regarding the disclosable event—

++ The type of action (for instance, payment suspension);

++ When the action occurred or was imposed;

++ Whether the affiliation existed when the action (for example, revocation) occurred or was imposed;

++ If the action is an uncollected debt—(1) the amount of the debt; (2) whether the affiliated provider or supplier is repaying the debt; and (3) to whom the debt is owed (for example, Medicare); and

++ If a denial, revocation, termination, exclusion, or payment suspension is involved, the reason for the action (for example, felony conviction; failure to submit complete information).

• Any other evidence that CMS deems relevant to its determination.

In summary, these factors would focus largely, though not exclusively, on—(1) the length and period of the affiliation; (2) the nature and extent of the affiliation; and (3) the type of disclosable event and when it occurred. We stated in the proposed rule that a closer, longer, and more recent affiliation involving, for instance, an excluded provider or a large uncollected debt might present a greater risk to the Medicare program than a brief affiliation that occurred 5 years ago. Yet we stressed that it should not be assumed that the latter situation would never pose an undue risk. We declined to make specific conclusions in the proposed rule regarding what would constitute an undue risk, for affiliations vary widely. We stated that we must retain the flexibility to deal with each situation on a case-by-case basis, utilizing the aforementioned factors. We also solicited comment on the following issues related to these factors:

• Whether additional factors should be considered.
• Which, if any, of the proposed factors should not be considered.
• Which, if any, factors should be given greater or lesser weight than others.

In § 424.519(g), we proposed that a CMS determination that a particular affiliation poses an undue risk of fraud, waste, or abuse would result in, as applicable, the denial of the provider's or supplier's initial enrollment application under new § 424.530(a)(13) or the revocation of the provider's or supplier's Medicare enrollment under new § 424.535(a)(19). We noted that an actual finding of fraud, waste, or abuse would not be necessary for § 424.519(g) to be invoked. Only a determination that an undue risk of fraud, waste, or abuse exists would be required.

We received the following comments regarding proposed § 424.519(f) and (g):

Comment: A commenter stated that CMS should include in its undue risk determinations the following factors—(1) whether the disclosing provider or supplier was involved with the disclosable event; and (2) whether the affiliated individual or organization plays a tangible role in the day-to-day management and operations of the disclosing provider or supplier. Another commenter stated that CMS should evaluate whether the disclosing provider or supplier had any involvement with or was otherwise implicated by the disclosable event.

Response: We believe that the commenter's second suggested factor falls within the scope of our proposed factor concerning the degree and extent of the affiliation. We do not believe that the commenter's first criterion should be explicitly listed as a factor in § 424.519(f). Section 1866(j)(5)(B) of the Act focuses on whether the affiliation poses an undue risk rather than on the provider's or supplier's actual or potential involvement in the adverse action. In other words, the relationship itself is the relevant issue. We are concerned that adding the suggested factor would imply that the provider or supplier must have been directly involved with the disclosable event (and for there to be clear evidence thereof) in order for an undue risk under § 424.519(f) to exist. We believe this would be inconsistent with the spirit of section 1866(j)(5)(B) of the Act and could hinder our efforts to protect Medicare against problematic provider relationships.

Consider the following illustration: Assume that a non-physician practitioner has been a one-third owner of three separate Medicare-enrolled group practices for the past 5 years. Two of the groups have their enrollments revoked; the third group has an outstanding overpayment of $300,000. The practitioner wants to open a separate practice of which she will be the sole owner. The practitioner's affiliations would certainly raise questions about whether an undue risk exists. However, if we included the commenter's suggested factor within § 424.519(f) and there is no firm proof directly tying the practitioner to the grounds for the revocations or the debt, we could be required to enroll the practitioner despite our legitimate concerns and the possible threat to the Medicare Trust Funds.

Notwithstanding this, we wish to make clear that we will exercise our denial or revocation authority under § 424.519(f) cautiously. We recognize that many disclosable affiliations may not pose an undue risk. Yet we must be able to take action to protect Medicare from those affiliations that do.

Comment: A commenter recommended that CMS—(1) furnish providers with a written explanation of why it determined that an undue risk exists, including credible evidence of its belief, before taking action under § 424.519(g); and (2) provide examples in the rule's preamble of types of disclosable events, how it plans to apply the undue risk factors, and what action CMS may take in response. Other commenters also requested such examples, with a commenter stating that the examples should be subject to public notice and comment before the rule is finalized. Overall, commenters requested greater clarification of what constitutes an undue risk including, perhaps, a concrete definition or, at a minimum, objective standards. The commenters expressed concern that—(1) CMS' desire to retain its flexibility to address situations on a case-by-case basis gives CMS too much discretion; and (2) several of the factors are too broad. An additional commenter stated that CMS must establish objective measures with clear correlation to consequences in determining undue risk.

Response: We appreciate the commenters' concerns and will include pertinent information regarding the reason(s) for the undue risk determination in the denial or revocation letter sent to the provider or supplier. Such information would be in the revocation or denial letter itself, not a pre-revocation or pre-denial notice, as suggested by one commenter. Furthermore, as we stated in the proposed rule, the determination of undue risk will be so dependent on the individual facts and circumstances involved that it is difficult to identify examples of what would and would not constitute an undue risk or to clearly define the term “undue risk.” Every case is different, and we must retain the discretion to address each based on its own merits and facts. In addition, we do not believe our factors are overly broad; we believe they are fairly specific, while simultaneously containing a measure of flexibility to deal with particular circumstances.

Comment: A commenter stated that CMS should not take action against the disclosing provider or supplier without credible evidence or information showing that there will be an undue risk of fraud, waste, or abuse. The commenter stated that without this limitation, large groups and chains of providers and suppliers might have their Medicare enrollments revoked due to loose, indirect affiliation relationships with parties that have had disclosable events unrelated to the disclosing entities.

Response: As stated earlier, we will only take action under § 424.519(f) after a very careful review of the aforementioned factors.

Comment: A commenter questioned—(1) how CMS would handle undue risk determinations when it only has partial information available; and (2) whether a decision would be based only on that partial data.

Response: Although the commenter's reference to “partial” information is somewhat unclear, we will make our determination based on the available information. If an undue risk is found and the provider's or supplier's enrollment is consequently denied or revoked, the provider or supplier may challenge the determination through an appeal of the denial or revocation.

Comment: A commenter requested that CMS furnish guidance in the rule as to when CMS will notify a provider or supplier of whether an affiliation poses an undue risk; the commenter suggested a 30-day decision period. The commenter stated that prompt notice is important so that if the provider or supplier has employment screening procedures, the hiring process is not hindered.

Response: Since the facts of each case will differ, we cannot conclusively specify the timeframe in which an undue risk determination will be made. If an undue risk is found and the enrollment is denied or revoked, the affected provider or supplier will be notified via letter.

Comment: A commenter stated that if Medicare contractors will make undue risk determinations, CMS must ensure that such determinations are made in a consistent manner; if CMS will perform the determinations, CMS must have sufficient staff to timely make these determinations and communicate them to the provider or supplier. Another commenter stated that CMS should clarify whether CMS Central Office, CMS' Regional Offices, or the MACs will perform undue risk determinations.

Response: We may issue subregulatory guidance concerning the process by which undue risk determinations will be made. In all cases, however, we will ensure that sufficient resources for implementing our disclosure of affiliation provisions are available.

Comment: A commenter stated that in determining undue risk, CMS should only rely upon disclosable events involving parties with at least 50 percent ownership, which the commenter referred to as “substantial owners” who are in a position to control or otherwise influence the provider's actions; alternatively, CMS should consider only those affiliations that occurred within 1 year or are currently in effect and are of a significant degree. The commenter stated that affiliations with parties other than these do not accurately reflect whether a provider poses an undue risk.

Response: For reasons mentioned previously, we do not believe that—(1) affiliations involving less than 50 percent ownership and (2) prior affiliations should be automatically excluded from disclosure or consideration regarding risk. Every disclosable affiliation will be reviewed under § 424.519, although the degree, extent, and timing of the affiliation will be among the factors considered in our undue risk determinations.

Comment: A commenter stated that CMS should establish clear factors by which disclosable events and undue risk are evaluated. In general, the commenter suggested criteria such as—(1) how recent the affiliation was; (2) the type of disclosable event; (3) how much control (or interest) the provider or supplier reporting the disclosable event has over the affiliated party; and (4) intent. The commenter cited an illustration of a current affiliation less than 1 year old with a party that is excluded by the OIG; the commenter stated that this poses a substantially higher risk than an affiliation of multiple years involving uncollected debt. The commenter also stated that a 5 percent ownership interest is less likely to involve significant influence over an affiliate than a significantly higher percentage.

Response: The first three factors are already included within § 424.519(f). Concerning intent, we are unclear as to whether the commenter is referring to the affiliation or the disclosable event. In either case, evidence of intentional wrongdoing would, of course, impact our determination, but the lack thereof would not dictate that there is no undue risk. All of the factors in § 424.519(f), including any evidence that is relevant to our decision, will be considered. However, we note that not all or even a majority of the factors would have to indicate risk in order for us to conclude that a denial or revocation is warranted.

The percentage of ownership will fall within our analysis of the degree and extent of the affiliation. While larger ownership shares could, depending on the facts involved, weigh more heavily towards a finding of undue risk, it should not be assumed that a 5 or 10 percent interest will never result in such a determination. Again, each case will be judged on its particular circumstances.

Comment: Several commenters stated that findings of undue risk should be restricted to egregious conduct. Another commenter stated that, except for uncollected debts, CMS should restrict undue risk determinations to cases involving intentional fraud or misconduct or exclusions.

Response: As stated previously, we will exercise our denial or revocation authority under § 424.519(f) carefully. However, we do not believe that the disclosable event must have involved intentional fraud or misconduct for an affiliation to present an undue risk. Other types of affiliations involving behavior that does not contain such elements can endanger federal health care programs. Again, we will carefully consider the circumstances of the disclosable event in making our undue risk determinations.

Comment: A commenter contended that the statute requires the affiliation to pose an undue risk by the provider or supplier.

Response: We are not entirely certain of the commenter's contention, but we believe it is that the statute requires the provider or supplier—rather than the affiliation—to pose an undue risk. We respectfully disagree. Section 1866(j)(5)(B) of the Act refers to the affiliation itself posing an undue risk of fraud, waste, or abuse, rather than such risk being posed by the provider or supplier.

Comment: A commenter stated that the lack of objective standards regarding undue risk creates a high potential for inconsistent determinations on comparable facts. To reduce subjectivity, the commenter suggested that CMS establish a decision matrix that includes decision “weights” regarding the relevant factors. Each undue risk criterion and “should reasonably have known” evaluation would be assigned a weight of importance, which would then create a score tied to a decision outcome. The commenter stated that CMS has used decision matrices in other areas, most recently with the CMP provisions of the home health intermediate sanction rules.

Response: We appreciate this suggestion but do not believe such a matrix is necessary or advisable. Given the vast variety of factual situations we will encounter, as stated previously, we must retain as much flexibility as possible in our undue risk determinations. We believe that elements such as “decision weights” would adversely impact our ability to fairly consider all of the facts, since it would effectively require that specific “scores” be given for certain criteria and circumstances.

After reviewing the comments received, we are finalizing § 424.519(f) and (g) as proposed with one exception. In § 424.519(f), we are changing the term “action” to “disclosable event.” This is to achieve greater consistency with our addition of the definition of “disclosable event” to § 424.502. In addition, we are changing the heading of § 424.530(a)(13) from “Affiliation that poses undue risk of fraud” to simply “Affiliation that poses an undue risk” in order to achieve consistency with the heading of § 424.535(a)(19).

e. Additional Affiliation Provisions

We proposed in § 424.519(h)(1) that providers and suppliers must report new or changed information regarding existing affiliations, consistent with our requirement in § 424.516 to submit changes in enrollment data; this would include the reporting of new affiliations. However, under paragraph (h)(2) providers and suppliers would not be required to report either of the following:

• New or changed information regarding past affiliations (except as part of a Form CMS-855 revalidation application) (paragraph (h)(2)(i)).
• Affiliation data in that portion of the Form CMS-855 that collects affiliation information if the same data is being reported in the “owning or managing control” (or its successor) section of the Form CMS-855 (paragraph (h)(2)(ii)).

We stated that requiring providers and suppliers to report new or changed information regarding past affiliations would impose an unnecessarily excessive burden; providers and suppliers would have to constantly monitor and track information changes involving parties with whom they, their owners, or their managers no longer have a relationship. Regarding the second exception, we believed this would limit duplicate reporting and ease the burden on providers and suppliers.

We received the following comments regarding this section:

Comment: Several commenters expressed concern about the requirement to report changes in affiliation data. They generally stated that—(1) the burden of continually monitoring, tracking, and reporting data on many possible affiliates would be enormous; and (2) the penalty of revocation for failing to timely a report a change is too severe, especially if a reenrollment bar is imposed as well, and could unfairly and substantially impact legitimate providers and suppliers. Given the substantial burden involved, some commenters stated that any changes should only be reported during the provider's or supplier's next revalidation, rather than requiring the constant reporting of new or changed information.

Response: We agree with the commenters' concerns regarding the potential burden and will not finalize proposed § 424.519(h)(1) and (h)(2)(i). As already discussed, affiliation data under § 424.519 will only be required in the limited circumstances described in revised § 424.519(b). However, we emphasize that providers and suppliers will still be required to report changes in ownership and management consistent with existing regulations.

Comment: A commenter stated that CMS has not outlined a plan for how it will track new or changed affiliation data and how this information should be reported. The commenter asked whether—(1) CMS staff will check and monitor such data; and (2) PECOS will recognize these changes. Another commenter stated that CMS should only require providers to report new or changed information on close affiliates.

Response: As stated in the previous response, we are not finalizing proposed § 424.519(h)(1) and (h)(2)(i) due to the potential burden of regularly tracking and reporting disclosable affiliation information.

After reviewing the comments submitted, we are deleting §§ 424.519(h)(1) and (h)(2)(i). Paragraph (h)(2)(ii) will be redesignated as paragraph (h).

In § 424.519(i), we proposed that CMS may apply proposed § 424.530(a)(13) or § 424.535(a)(19) (as applicable) to situations where a disclosable affiliation (as described in § 424.519(b) and (c)) presents an undue risk of fraud, waste, or abuse, but the provider or supplier has not yet disclosed or is not required at that time to disclose the affiliation to CMS. Although we received no specific comments on proposed § 424.519(i) and are therefore finalizing it, we received the following comment that we believe indirectly touches upon this provision:

Comment: A commenter posed a scenario where a provider (the first provider) is owned by five individuals, one of whom is associated with another provider (the second provider) that has an uncollected Medicare debt. The commenter asked whether the first provider would be denied or revoked if the aforementioned individual's ownership interests in the first provider are terminated prior to enrollment or revalidation.

Response: The first provider or supplier could be denied or revoked if the scenario meets the requirements of § 424.519(i) regarding undisclosed affiliations. In that case, if CMS learned of the first provider's affiliation prior to the individual in question terminating his or her ownership interest, CMS could make an undue risk determination under § 424.519(g). CMS could then elect to revoke the first provider under § 424.535(a)(19). However, this could only occur if CMS identified the affiliation while the individual owner was still in an ownership role with the first provider. In addition, if, when CMS evaluated the first provider, the individual owner was no longer in an ownership or other applicable role, with the second provider, no affiliation would be present; thus, no undue risk determination could be made.

From a disclosure perspective under § 424.519(b), CMS would not take action against the first provider at the time of an initial or revalidation application if the individual owner had already terminated his or her ownership interest with the first provider. Whether related to a disclosure or a CMS assessment, an owning or managing party must be in an ownership or managerial role with the provider in order for an affiliation to exist and an undue risk determination to be made.

2. Medicaid

Consistent with our discussion in section II.A.1.a. of this final rule with comment period and for the reasons stated therein, we proposed to revise the Medicaid provisions in 42 CFR part 455.

In § 455.101, we proposed to add the same definition of “affiliation” that we proposed to add to § 424.502, with the exception of the paragraph regarding “reassignment.” Section 424.80 only applies to Medicare. However, we proposed to include payment assignments under § 447.10(g) within the definition of “affiliation” in § 455.101. Under § 447.10(g), payment for services provided by an individual practitioner may be made to—

++ The employer of the practitioner, if the practitioner is required as a condition of employment to turn over his fees to the employer;

++ The facility in which the service is provided, if the practitioner has a contract under which the facility submits the claim; or

++ A foundation, plan, or similar organization operating an organized health care delivery system, if the practitioner has a contract under which the organization submits the claim.

As with Medicare reassignments, we stated in the proposed rule that the relationships described in § 447.10(g) are sufficiently close to warrant their inclusion within the definition of “affiliation” in § 455.101; again, a W-2 employee or independent contractor may have a closer day-to-day relationship with the individual or organization he or she works for than, for instance, an indirect owner has with an entity in which he or she has a 5 percent ownership interest. We also noted that these provisions are similar to those in § 424.80.

After considering the previously discussed comments we received regarding our Medicare definition of “affiliation,” we are finalizing our proposed definition of “affiliation” in § 455.101.

In revised § 455.103, we proposed that a state plan must provide that the requirements of §§ 455.104 through 455.107 are met. Section 455.103 currently only references §§ 455.104 through 455.106. Our revision included a reference to new § 455.107. We received no comments on this proposal and are, therefore, finalizing it.

In new § 455.107, we proposed several paragraphs.

(i) Discussion of § 455.107(a) and (b)

In paragraph (b), we proposed that a provider that is submitting an initial or revalidating Medicaid application must disclose whether it or any of its owning or managing employees or organizations (consistent with the definitions of “person with an ownership or control interest” and “managing employee” in § 455.101) has or, within the previous 5 years, has had an affiliation with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that—

• Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of—(1) the amount of the debt; (2) whether the debt is currently being repaid (for example, as part of a repayment plan); or (3) whether the debt is currently being appealed. For purposes of § 455.107 only, and as stated in proposed § 455.107(a), the term “uncollected debt” would only apply to—

++ Medicare, Medicaid, or CHIP overpayments for which CMS or the state has sent notice of the debt to the affiliated provider or supplier;

++ CMPs (as defined in § 424.57(a)); and

++ Assessments (as defined in § 424.57(a));

• Has been or is subject to a payment suspension under a federal health care program (as that latter term is defined in section 1128B(f) of the Act), regardless of when the payment suspension occurred or was imposed;
• Has been or is excluded from participation in Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred or was imposed; or
• Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated, regardless of—(1) the reason for the denial, revocation, or termination; (2) whether the denial, revocation, or termination is currently being appealed; or (3) when the denial, revocation, or termination occurred or was imposed. For purposes of § 455.107 only, the terms “revoked,” “revocation,” “terminated,” and “termination” would include situations where the affiliated provider or supplier voluntarily terminated its Medicare, Medicaid, or CHIP enrollment to avoid a potential revocation or termination. This clarification is included in proposed § 455.107(a).

After considering the previously discussed comments regarding the related Medicare provisions at § 424.519(a) and (b), we are finalizing proposed § 455.107(a) with two exceptions. First, we are changing the language “(as defined in § 424.57(a))” to “imposed under this title.” Second, we are adding the following language to the end of the opening paragraph of § 455.107(a): “to the definition of disclosable event in § 455.101:”

Similar to our previously referenced change to § 424.502, we are also adding a definition of “disclosable event” to § 455.101 to encapsulate the four aforementioned events (that is, uncollected debt, payment suspension, OIG exclusion, enrollment denial/revocation/termination) that will trigger an affiliation disclosure under § 455.107. We believe this will help simplify and shorten the text of § 455.107(b). In addition, we are adding “by the OIG” immediately after the word “excluded” in our “disclosable event” definition” to clarify that we are referring to OIG exclusions.

With respect to paragraph (b), and for reasons akin to those concerning our changes to § 424.519(b), we are making a number of revisions to incorporate a “phased-in” approach. However, there are some differences between how the “phased-in” approach will be conducted under § 424.519 for Medicare providers and suppliers and how the approach will be conducted under § 455.107 for Medicaid providers.

(A) Implementation Approaches for Medicaid and CHIP—Background

Under revised § 455.107(b), each state will, in consultation with CMS, select one of two options for the implementation of the affiliation disclosure requirement. The option chosen will be in effect until we engage in further rulemaking regarding this requirement; states will not be able to switch options prior to such additional rulemaking. Under the first option, disclosures must be submitted by all newly enrolling or revalidating Medicaid and/or CHIP providers that are not enrolled in Medicare. Under the second and more targeted option, disclosures must be submitted only upon request by the state. Specifically, the states that choose this second option will request disclosures from those Medicaid and/or CHIP enrolled providers that are not enrolled in Medicare and that the state, in consultation with CMS, determines meets certain criteria, discussed further below.

(1) First Option

In states that select the first option, a provider that is not enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment information) must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “person with an ownership or control interest” and “managing employee” as defined in § 455.101) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 455.101).

(2) Second Option

In states that select the second option, upon request from the state, a provider that is not enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment information) must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “person with an ownership or control interest” and “managing employee” as defined in § 455.101) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a “disclosable event” (as defined in § 455.101). The state will request such disclosures when it, in consultation with CMS, has determined that the initially enrolling or revalidating provider may have at least one such affiliation.

(A) Characteristics of Each Option

There are several similarities between the two options.

First, under either option, only those providers that are not enrolled in Medicare would be required to disclose affiliations. This is because the states will, as applicable, be able to rely on CMS' review of actual or potential affiliation data for dually-enrolled providers (that is, providers enrolled in both Medicare and Medicaid or CHIP). In contrast, Medicare and PECOS would not have affiliation information for Medicaid-only or CHIP-only providers; thus, the state would be unable to rely upon any affiliation data that Medicare may have on file for these providers. The limiting of the disclosure requirement to providers not enrolled in Medicare would therefore eliminate duplicative efforts by CMS and the states.

Second, the disclosable events pertaining to each option mirror not only each other but also the disclosable events applicable to Medicare enrollment as defined in § 424.502 and in section 1866(j)(5) of the Act. We believe this will help ensure consistency with Medicare and with the statute. In addition, and as previously discussed, the relationships described in section 1866(j)(5) of the Act are of concern to CMS and the states from a program integrity perspective. Including them within the scope of § 455.107(b) will assist our efforts in deterring fraud, waste, and abuse.

Third, with both options, any provider required to submit a disclosure of affiliations must report any and all affiliations that come within the scope of § 455.107. Even if the state selects the second option and, for a particular provider, identifies only one affiliation that triggers a request for the provider to submit a disclosure of affiliations, that provider must disclose all applicable affiliations regardless of whether the state may already have information on these relationships.

Fourth, a provider's disclosure of affiliations, irrespective of which option is selected, does not automatically mean that the state, in consultation with CMS, has determined or will determine that all or any of the disclosed affiliations pose an undue risk of fraud, waste, or abuse.

Fifth, providers will not be required to report all applicable affiliation information to the state under either option until the applicable state has revised its relevant enrollment application(s) to accommodate the disclosure of affiliations requirement. However, per § 455.107(h) and as addressed in more detail later in this section, if a state determines that a provider has an affiliation(s)—via a source(s) other than provider reporting—and determines, in consultation with CMS, that one or more affiliations of that provider represent an undue risk of fraud, waste, or abuse, the state may deny or terminate the provider's enrollment in the state Medicaid program even before the state's applications (or other means of capturing affiliation information, whether in physical or electronic form) have been updated with an affiliation disclosure section.

Despite the parallels between the two options, there is one critical difference, in that the first option is significantly broader than the second. Excluding Medicare-enrolled providers and suppliers, the former option applies to all newly enrolling and revalidating providers without exception, whereas the second option only requires the submission of affiliation data upon a state request. On a broader level, the first option does not involve a gradual, incremental enforcement such as that which we are adopting with Medicare providers and suppliers in § 424.519(b). The second option, however, largely duplicates the “phased-in” approach of § 424.519(b), under which the states will conduct internal research to determine whether a disclosable affiliation under § 455.107 may exist and then request a disclosure of all applicable affiliations. We believe that affording the states more than one alternative will permit them greater flexibility in implementing the affiliation requirement.

We note that section 1866(j)(5) of the Act requires every provider and supplier (regardless of the relative risk they may pose) to disclose affiliations upon initial enrollment and revalidation. All states that choose the second option will therefore eventually be required to collect affiliation disclosures from their providers upon the submission of each initial and revalidation application. Future rulemaking will address the next phases of the Medicaid and CHIP affiliations disclosure process. We would appreciate feedback from the public on the possible content of this rulemaking, particularly with respect to the same general topics on which we have requested comments regarding the Medicare affiliation process (for example, priority of disclosure requests).

States will notify CMS, via a process outlined in future subregulatory guidance, as to which of the two options they are choosing. CMS subregulatory guidance will also provide instruction to the states as to how to inform the necessary stakeholders, such as the relevant health care provider community, about which option it has selected so that Medicaid-only and CHIP-only providers know if they are automatically required to furnish affiliations disclosures upon initial enrollment or revalidation or if they must do so only upon request. After a state notifies both CMS and necessary stakeholders about which option it selected, the state will then begin to collect affiliation disclosures in a manner consistent with that option.

(ii) Discussion of § 455.107(c), (d), and (e)

In paragraph (c), we proposed that the following information about the affiliation must be disclosed:

• General identifying data about the affiliated provider or supplier. This would include the following:

++ Legal name as reported to the Internal Revenue Service or the Social Security Administration (if the affiliated provider or supplier is an individual).

++ “Doing business as” name (if applicable).

++ Tax identification number.

++ NPI.

++ Reason for disclosing the affiliated provider or supplier (for example, uncollected CHIP debt; payment suspension).

++ Specific data regarding the affiliation relationship. Such data would include the—(1) length of the relationship; (2) type of relationship; and (3) degree of affiliation.

++ If the affiliation has ended, the reason for the termination.

In paragraph (d), we proposed that the information described in § 455.107(b) and (c) must be furnished to the state in a manner prescribed by the state.

In paragraph (e), we proposed that the disclosing provider's failure to fully and completely furnish the information in § 455.107(b) and (c) when the provider knew or should reasonably have known of this information may result in—

• The denial of the provider's initial enrollment application; or
• The termination of the provider's Medicaid or CHIP enrollment.

Based on the previously discussed comments we received regarding the general contents of § 424.519(c) through (e), we are finalizing § 455.107(c), (d), and (e) as proposed with one exception. We are adding the language “in consultation with the Secretary” to the end of § 455.107(d). Section 1866(j)(5) of the Act, as explained earlier, specifies that affiliation disclosures are to be furnished “in a form and manner and at such time as determined by the Secretary.” To comply with this requirement, we believe that states should consult with CMS as to the “form and manner” of said disclosures. We will communicate with the states regarding this consultation requirement and issue subregulatory outlining the parameters thereof.

(iii) Discussion of § 455.107(f), (g), (h), and (i)

In paragraph (f), we proposed that upon receiving the information described in § 455.107(b) and (c), the state, in consultation with CMS, would determine whether any of the disclosed affiliations poses an undue risk of fraud, waste, or abuse. The state, in consultation with CMS, would consider the following factors in its determination:

• The duration of the disclosing party's relationship with the affiliated provider or supplier.
• Whether the affiliation still exists and, if not, how long ago it ended.
• The degree and extent of the affiliation.
• If applicable, the reason for the termination of the affiliation.
• Regarding the affiliated provider's or supplier's disclosable event—

++ The type of action;

++ When the action occurred or was imposed; and

++ Whether the affiliation existed when the action occurred or was imposed.

++ If the action is an uncollected debt—(1) the amount of the debt; (2) whether the affiliated provider or supplier is repaying the debt; and (3) to whom the debt is owed (for example, Medicare);

• If a denial, revocation, termination, exclusion, or payment suspension is involved, the reason for the action; and
• Any other evidence that the state, in consultation with CMS, deems relevant to its determination.

In paragraph (g), we proposed that a determination by the State, in consultation with CMS, that a particular affiliation poses an undue risk of fraud, waste, or abuse results in, as applicable, the denial of the provider's initial enrollment application or the termination of the provider's Medicaid or CHIP enrollment.

We received the following comments that were specific to proposed § 455.107(f) and (g):

Comment: A commenter stated that there is no current federal requirement that a state Medicaid agency consult with CMS in making enrollment determinations. The commenter recommended that CMS—(1) permit greater discretion regarding the required consultation with CMS; (2) furnish clarification and guidance to states concerning this process; (3) establish timeframes by which CMS, under this provision, must respond to the state in order to avoid delays in application processing; and (4) permit states to rely upon any CMS undue risk determinations involving Medicare-enrolled providers or providers enrolled with another state Medicaid agency. Concerning the final recommendation, the commenter believed there would be no need for the state to consult CMS on a matter that CMS has already reviewed. Another commenter stated that CMS should eliminate the requirement that the state consult with CMS on undue risk determinations, contending that the rule does not address the possibility of disagreement or delays in reaching a determination. If the requirement is retained, the commenter stated that the rule should establish a clear and expedited process for making such determinations. This should include a provision that all state recommendations are automatically affirmed after 15 days, which would ensure that determinations are promptly made.

Response: While we appreciate these comments, we respectfully decline to remove the consultation language, for consultation is necessary to satisfy the statutory requirement that the Secretary determine “undue risk.” However, we will work closely with the states in developing a subregulatory process by which there is adequate guidance and efficient communication between the states and CMS, while recognizing the traditional flexibility given to states in their enrollment determinations. We note that the two previously mentioned options under § 455.107(b) will apply only to providers that are not enrolled in Medicare because, as we explained, states will be able to rely on CMS' review of Medicare-enrolled providers and suppliers in the matter of affiliation disclosures.

Comment: A commenter requested that CMS provide clear guidance regarding a state agency's responsibility under our proposal, specifically (1) the degree to which a state must establish that a provider seeking Medicaid enrollment has accurately disclosed affiliations under § 455.107; (2) the required extent of the state's consultation with CMS, provider outreach and education, and ongoing documentation of information outlined in § 455.107; and (3) the length of time that states will have to implement § 455.107. Another commenter suggested that the final rule contain a provision making the rule effective no sooner than 6 months from the end of the state's legislative session that begins after the rule's publication date. This will help states ensure that—(1) state law reflects the rule's requirements; and (2) providers are fully informed of said requirements. Another commenter requested that CMS consider allowing sufficient time to implement the rule, suggesting a 12-month period that, the commenter believed, would enable providers to prepare for and be compliant at the onset of these changes.

Response: We will work closely with the states and disseminate sufficient guidance to them in implementing our affiliation disclosure provisions. The three issues the first commenter raised may be addressed in such guidance.

Consistent with our position regarding § 424.519, states will not be expected to implement § 455.107—and Medicaid and CHIP providers will not have to disclose affiliation data under this provision—until each state's pertinent Medicaid and/or CHIP initial and/or revalidation applications are updated to collect this information. Further, CMS will issue accompanying subregulatory guidance to the states regarding the operationalization of § 455.107 (although said guidance may or may not be issued before some states send out their initial affiliation disclosure requests). The timing of the updates to each state's Medicaid and/or CHIP applications will vary from state to state; it is not possible, of course, to predict how long it will take each state to update its applications because of the numerous variables involved. Regardless, we believe that the need for each state to revise its applications and discuss with CMS those aspects of this process where such consultation is required will give stakeholders sufficient time to prepare for these requirements.

After reviewing the comments received, we are finalizing § 455.107(f) and (g) as proposed with one exception. In § 455.107(f), we are changing the term “action” to “disclosable event.” This is to achieve greater consistency with our addition of the definition of “disclosable event” to § 455.101.

In paragraph (h), we proposed the following:

• Providers would be required to report new or changed information regarding existing affiliations. This would include reporting any new affiliations.
• Providers would not be required to report new or changed information regarding past affiliations (except as part of a revalidation application).

We received the following comment regarding § 455.107(h):

Comment: A commenter questioned whether providers would have to furnish this new or changed data to Medicaid or CHIP within a CMS-specified time period, or whether the state has the discretion to establish the time period.

Response: For the same reasons behind our revision of proposed § 424.519(h), we have decided not to finalize proposed § 455.107(h).

In paragraph (i), we proposed that the state, in consultation with CMS, may apply paragraph (g) to situations where a reportable affiliation poses an undue risk of fraud, waste, or abuse, but the provider has not yet disclosed or is not required at that time to disclose the affiliation to the state. We received no comments specifically referencing § 455.107(i) and are, therefore, finalizing it as proposed, with one exception: we are re-designating § 455.107(i) as § 455.107(h) due to our previously mentioned decision not to finalize proposed § 455.107(h).

c. CHIP

Section 2107(e) of the Act states that sections 1902(a)(77) and (kk) of the Act (which relate to Medicaid provider screening, oversight, and reporting requirements) apply to CHIP to the same extent that they apply to Medicaid. We thus proposed to apply our proposed Medicaid affiliation disclosure requirements to CHIP providers for two principal reasons. First, section 1866(j)(5) of the Act specifically references the need to disclose current and prior affiliations with CHIP providers. We believe it logically follows that CHIP providers should have to disclose similar affiliation information. Second, and for reasons previously explained, the disclosure of affiliation information would assist efforts in deterring fraud, waste, and abuse in CHIP.

Section 457.990(a) states that part 455, subpart E, applies to a state under Title XXI in the same manner as it applies to a state under Title XIX. We proposed to revise § 457.990(a) such that § 455.107 would also apply to Title XXI. Paragraph (a) would thus read: Section 455.107.

We received no comments on our proposed revision to § 457.990(a), therefore we are finalizing it as proposed.

3. Miscellaneous Comments

We received the following miscellaneous comments on our affiliation disclosure proposal. They pertain more to the proposal in general than to specific provisions in §§ 424.519 and 455.107.

Comment: A commenter stated that to ensure that providers and suppliers have sufficient notice to begin preparing for this new requirement (for example, to begin acquiring and tracking affiliation data), CMS should only apply the reporting requirement to existing affiliations or to those established on or after the implementation date of the final rule.

Response: We disagree. We believe that any affiliation covered under § 424.519, including those that existed prior to the rule's implementation date, should be reported. We must be able to take action to protect the Medicare program and the Trust Funds against undue risks.

Comment: A commenter stated that the DMEPOS industry seeks clear guidance on how different infractions will impact their supplier number(s). The commenter stated that the rule does not specify how—(1) each type of reported affiliation will affect impact the enrolling supplier; and (2) a reported affiliation that results in a revocation would be applied to other NPIs associated with the enrollee. The commenter recommended that affiliations be reported based on the NPI.

Response: Denials and revocations pursuant to § 424.519 will be applied no differently than how other denials and revocations are currently applied. As for the commenter's recommendation, affiliations will be reported in accordance with the requirements of this rule irrespective of the particular NPI enumeration involved.

Comment: A commenter stated that CMS should delay the implementation of the look-back requirements for at least the length of the look-back period. This will allow providers and suppliers to identify all existing affiliations as of the rule's effective date and monitor them prospectively for disclosable events.

Response: We do not believe that the implementation of § 424.519 should be delayed 5 years. It is important that we be able to take prompt action to protect Medicare and the Trust Funds against undue risks.

Comment: Several commenters questioned whether this proposal would be effective in addressing CMS' program integrity concerns. They contended that—(1) dishonest providers and suppliers that CMS is concerned about will not disclose affiliations to CMS, much less to other providers and suppliers with which it competes; and (2) only well-intentioned providers and suppliers, who pose little if any risk, will report this data yet will ultimately bear the significant administrative and cost burdens of doing so. In other words, the commenters stated, honest providers and suppliers, rather than dishonest ones, would be penalized under this proposal. They added that the rule as a whole should be geared towards non-compliant providers and suppliers instead of burdening honest parties.

Response: We recognize that many providers and suppliers have and have had affiliations that pose little if no risk, and we have taken steps in this rule to reduce the reporting burden on these parties. However, dishonest providers and suppliers that deliberately withhold information must understand that we will, through our examination of internal data—(1) be able to determine whether such providers and suppliers have or have had a disclosable affiliation; and (2) take appropriate administrative action as needed.

Comment: Several commenters stated that the proposal would effectively require providers and suppliers to become investigative bodies; that is, they would have to expend considerable resources (including, perhaps, hiring additional personnel and outside parties) to investigate other providers and suppliers. Such resources, they maintained, would be better used towards patient care. Another commenter stated that CMS should recognize that certain affiliates may be reluctant for various reasons to furnish data to the provider or supplier. The commenter added that CMS should avoid imposing requirements that could place current or former affiliates in untenable positions or create conflicts of interest.

Response: As stated earlier, we recognize the potential researching and reporting burden involved and that certain data may be difficult to obtain. As one step toward reducing said burden, we have removed the requirement to disclose new or changed affiliations (except as part of a revalidation). Moreover, CMS will review each affiliation disclosure situation on its own merits, acknowledging that there may be cases where a provider or supplier simply cannot secure particular information even after making a substantial effort to do so. We anticipate that future subregulatory guidance will address the research and reporting process for affiliations.

Comment: Several commenters stated that many providers and suppliers already closely screen their owners, managers, physicians, health care personnel, etc., before including them within their organization; this may consist of, for instance, reviews of the individual's malpractice and medical discipline record via the National Practitioner Data Bank (NPDB).

Response: We appreciate the efforts of these providers and suppliers in screening their owners, managers, and personnel. However, consistent with section 1866(j)(5)(b) of the Act, we believe that CMS and the states, in consultation with CMS, must be able to make their own undue risk determinations independent of any internal screening the provider or supplier undertakes.

Comment: A commenter stated that CMS should rescind the proposed rule and craft a new rulemaking that is more narrowly focused.

Response: We respectfully disagree that the proposed rule should be rescinded. We believe that these new disclosure provisions will be valuable tools in our program integrity efforts, especially with respect to inter-provider schemes.

Comment: A commenter stated that a disclosable affiliation that occurred prior to the rule's effective date should not have to be reported.

Response: We respectfully disagree. We believe that previous disclosable affiliations, even those ending prior to this final rule with comment period, can be germane to a determination of whether an undue risk exists and should be considered, assuming they occurred within the prior 5 years.

Comment: Several commenters stated that there is no publicly available federal database that instantly updates all disclosable events, such as debts and revocations; this could lead to innocent provider and supplier errors in disclosure or an inability to furnish certain information, with resulting revocations and appeals. They urged the establishment of such a database.

Response: We appreciate this comment and may explore means of increasing the public availability of certain data.

Comment: A commenter asked why the proposed affiliation provision did not include section 1877 of the Act, which addresses various financial and ownership relationships.

Response: Our focus in this rule was on addressing the relationships referenced in section 1866(j)(5) of the Act.

Comment: A commenter questioned—(1) whether CMS and/or its contractors would review every application in detail; (2) if not, how they would determine which applications to focus on; and (3) whether CMS and its contractors actually have enough personnel with sufficient expertise to review all submitted data and to detect any omissions of information.

Response: All disclosures will be closely reviewed, and we intend to have sufficient personnel available to carry out this function. We may issue subregulatory guidance concerning the process by which undue risk determinations will be made.

Comment: A commenter indicated that CMS' recent amendment to the appeals process (via a manual revision) requiring providers and suppliers to perfect their appeals at the reconsideration level without the ability to add additional evidence beyond this stage could negatively impact a provider's or supplier's ability to effectively appeal a denial or revocation under § 424.519.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter questioned whether any Form CMS-855 changes resulting from our proposed disclosure requirements would be subject to public notice and comment prior to finalization.

Response: All Form CMS-855 changes are subject to public notice and comment under the Paperwork Reduction Act. This will also be the case with our revisions to the Form CMS-855 to capture affiliation information.

Comment: A commenter stated that there should be no exemptions for complete disclosure. The commenter believed that full disclosure would demonstrate the integrity of the individual who is applying for CMS enrollment.

Response: Although we appreciate this comment, we have modified certain aspects of our disclosure requirements to reduce the overall reporting burden while simultaneously ensuring that we can detect risks to the Medicare program and the Trust Funds.

Comment: A commenter stated that a revocation resulting in the maximum reenrollment bar should always be disclosed regardless of age. For all other actions, however, the commenter contended that “expanded documentation” at CMS should be sufficient for the agency to capture information on other disclosable events.

Response: We appreciate this suggestion and believe that there should be no look-back period for disclosable events, including revocations involving a maximum reenrollment bar. As for internal CMS documentation, we earlier recognized that CMS may have much of the required affiliation data in PECOS and other systems. Section 1866(j)(5) of the Act, however, is clear that such information must be furnished upon initial enrollment and revalidation in a form and manner and at such time as determined by the Secretary.

Comment: A commenter stated that when a health care organization (such as a hospital) submits and/or obtains affiliation data on behalf of a physician it employs, the legal responsibility for this should shift to the physician, for the hospital is dependent on the physician to furnish accurate information; in other words, the individual physician should be held accountable for providing accurate enrollment information. The commenter further recommended that there be—(1) an opportunity for the health care entity to work with the physician to correct the information, and (2) an appeals process for denials.

Response: The provider or supplier is solely responsible for ensuring the accuracy and completeness of enrollment data it furnishes to Medicare, Medicaid, or CHIP under parts 424 and 455. It cannot shift this burden to another party. This is current CMS policy and will remain so with respect to § 424.519. We also believe that the provider and supplier should work with the affiliate to confirm the accuracy of the information prior to submitting it, although the provider or supplier may appeal any subsequent denial or revocation under part 498.

Comment: A commenter stated that the proposed rule was an excellent way to discourage fraud and waste in the health care system through a stricter Medicare enrollment process. The commenter stated that our proposals regarding the denial or revocation of enrollment before making payments could prevent fraudulent activities and abuses from occurring, which can be more efficient than later tracking down false claims and fraudulent providers. While expressing support for the rule, the commenter stated that it—(1) could impose a massive burden on doctors and providers; and (2) should include clear directions, guidance, and resources for identifying, evaluating and reporting partnership histories.

Response: We appreciate this comment, which we believe pertains largely to our affiliation provisions. We recognize that there may be operational concerns associated with our affiliation policies, and we will provide subregulatory guidance to address the matters raised in the commenter's final sentence.

Comment: A commenter believed that § 424.519 would require a change to the Disclosure of Ownership and Control Interest forms that Medicaid Managed Care Organizations (MCO) must send to their providers through the MCO contracts' flow-through of the federal provision. The commenter recommended that the proposal be for the proactive collection of information only during the initial credentialing or re-credentialing process. The commenter also requested CMS' support in encouraging states to share their collected information with MCOs, when applicable.

Response: We will work with the states and MCOs to ensure the effective implementation of this rule as it pertains to Medicaid.

Comment: A commenter sought clarification regarding—(1) the types of verifications that would be required when providers disclose affiliations with organizations other than hospitals and clinics; (2) how often a provider would be required to notify all of its affiliate organizations that it has a new interest or ownership in another Medicare or Medicaid provider or supplier; (3) whether entities would be required to disclose to other organizations that they do not have any current CMS sanctions or actions against them; (4) what would constitute sufficient documentation of the provider's enrollment status (that is, in “good-standing” or not) of an organization or affiliated entity; and (5) what information, if any, would organizations be required to provide to each other for purposes of verifying current or past affiliations to ensure that provider enrollment applications are completed correctly.

Response: The specific means of securing such data will depend on the surrounding circumstances, the provider's or supplier's operations, and the likely number of affiliations to research, although such means could include reviewing internal records and contacting affiliates. These are mechanisms that providers and suppliers currently use in acquiring information about, for instance, indirect owners and corporate directors.

This rule does not require the regular exchange or updating of information between providers and suppliers and their affiliates. It only requires the provider's or supplier's disclosure of data upon initial enrollment and revalidation.

Comment: A commenter requested that CMS include language in the final rule (presumably in the regulatory text) to clearly confirm that providers would not have to report new or changed information regarding past affiliations except as part of a revalidation application.

Response: As stated earlier, we are removing proposed §§ 424.519(h)(1) and (h)(2)(i) and 455.107(h) in this final rule with comment period.

Comment: A commenter suggested the following alternative to our disclosure provisions (1) providers and suppliers (and all applicable owners, partners, officers, directors, and managing employees) must report whether they have had any disclosable events, though this disclosure would not extend to other providers and suppliers when an initial or revalidation application is submitted; (2) CMS and/or the states would review the information disclosed, confirm its accuracy, and determine whether it raises an undue risk of fraud, waste, or abuse—either for the disclosing provider or supplier or any other provider or supplier with which they may be affiliated; and (3) if an undue risk is found, CMS could query the disclosing provider or supplier for additional information about their affiliation relationships. The commenter stated that this would meet the requirements of section 1866(j)(5) while eliminating the need for providers and suppliers to continuously monitor their affiliations and those of their owners, officers, directors, partners, and managing employees for potential disclosable events. Another commenter stated that if CMS determines that a provider or supplier failed to report a disclosable affiliation, CMS should, before taking any action—(1) notify the provider or supplier of the disclosable event; and (2) give it the opportunity to explain the basis for the failure to disclose.

Response: We appreciate these comments. We note that we have removed proposed §§ 424.519(h)(1) and (h)(2)(i) and 455.107(h) from this final rule with comment period, which we believe will eliminate much of the burden of regularly tracking and reporting new or changed information. We disagree, however, with suggestions that we should never take action prior to querying the provider or supplier about a detected undue risk or a failure to report a disclosable affiliation. We believe we must be able to act promptly to protect Medicare, Medicaid, and CHIP against threats to these programs. We reiterate, though, that the provider or supplier may appeal any denial or revocation; moreover, failure to report a disclosable affiliation will not automatically result in a denial or revocation if, for instance—(1) the affiliation poses no undue risk; and (2) the failure to disclose was based on an honest inability to obtain the relevant information.

Comment: Several commenters believed that our proposal violates basic constitutional principles because it implies “guilt by association.” One commenter stated that due process requires that those accused of a crime have the opportunity to respond to those allegations before guilt or innocence is pronounced and sanctions are imposed. The commenter stated that—(1) mere affiliation with those who have been found guilty of criminal behavior is not enough and that they themselves must have also been found guilty of such behavior; (2) the proposed regulation assumes that all individuals or organizations associated with parties that have violated the law or engaged in suspicious behavior have themselves also violated the law. Another commenter contended that CMS is “punishing” providers based on the parties with whom they choose to affiliate yet over whom they have no control. The commenter stated that it would be impossible for CMS to ensure that enrollees are accurately reporting their affiliations and disclosable events, short of “spying” on enrollees and tracking their public accounts; to ensure compliance with this provision, the commenter continued, CMS would have to employ means that trespass upon the privacy of providers and suppliers and approach unconstitutional practices. Other commenters contended that it would be unfair to punish parties who may have only had marginal relationships with other parties that have or had disclosable events, with several commenters questioning the constitutionality of this and the impact on due process.

Response: We respectfully disagree that our proposal implies guilt by association. We believe that section 1866(j)(5) of the Act and §§ 424.519 and 455.107 of the regulations are clear that the core issue is whether the affiliation itself, rather than the enrolling or enrolled provider or supplier, poses an undue risk of fraud, waste, or abuse. In other words, these provisions focus on whether certain relationships present risks; they do not automatically ascribe nefarious behavior to the provider or supplier. Our recognition that most affiliations may not pose such risks is reflected in our earlier statement that we will only take action under § 424.519 or § 455.107 after careful consideration of the facts and circumstances. We have further acknowledged that some data may be difficult to secure. Given that we have also taken steps to reduce the reporting burden on providers and suppliers and that denied or revoked enrollments may be appealed, we believe that our disclosure provisions contain sufficient due process and fairness safeguards for providers and suppliers.

Comment: A commenter expressed concern that our proposal could discourage co-ownership arrangements between health care entities and providers, which could negatively impact team-based delivery of health care.

Response: We do not believe our affiliation provisions will discourage co-ownership arrangements, particularly since we have stated that the denial, revocation, or termination authority under § 424.519 or § 455.107 will be invoked only after careful consideration. We also note that providers and suppliers are currently required to report certain ownership and managerial relationships and any associated adverse action history.

Comment: A commenter recommended that CMS exempt referral-dependent specialties from our proposal, stating that such providers would have to obtain, maintain, and submit information regarding many relationships. Another commenter suggested that the disclosure requirements be tailored toward higher-risk provider and supplier categories, similar to the screening requirements in § 424.518.

Response: We do not believe that certain provider and supplier types should be automatically exempt from § 424.519. Affiliations can pose risks regardless of the provider or supplier type involved. Further, excluding particular provider or supplier types would, in our view, be inconsistent with the statute, which we interpret as applying to all providers and suppliers submitting an initial or revalidation application. As mentioned previously, however, we have revised § 424.519(b) such that we will undertake a “phased-in” approach that initially (though not exclusively or permanently) targets potentially high risk providers or suppliers, for which CMS believes that at least one affiliation could apply.

Comment: A commenter expressed concern that—(1) CMS, its contractors, and Medicaid, and CHIP state programs would apply aspects of our proposal inconsistently, and (2) the affiliation requirement would greatly increase the number of applications submitted to these entities, resulting in processing delays and errors. The commenter urged CMS to issue clear guidance to all stakeholders regarding the processing of such applications and how the disclosure and risk factors would be applied.

Response: CMS and the states will take steps to ensure that undue risk determinations are made consistently and that sufficient guidance is disseminated to relevant stakeholders.

Comment: A commenter stated that radiologists are commonly involved in reassignment agreements involving imaging facilities and referring providers. The commenter expressed concern that the proposed rule could cause sweeping changes to these agreements.

Response: We respectfully disagree with this comment, which we believe pertains to our affiliation provisions. Nothing in this rule prohibits providers and suppliers from engaging in reassignment relationships. Insofar as the definition of “affiliation” in § 424.502 includes reassignments, we do not believe that the reporting requirements in revised § 424.519(b) will significantly alter reassignment relationships. This is particularly true given that CMS requests for disclosable affiliation data will be made only—(1) upon initial enrollment and revalidation; and (2) to providers and suppliers that CMS has determined may have one or more disclosable affiliations.

Comment: A commenter contended that CMS exceeded its statutory authority under section 1866(j)(5) by proposing to—(1) revoke providers and suppliers under § 424.519; and (2) require the submission of new or changed data. Another commenter stated that the mandate in section 1866(j)(5) was exceeded because the latter only requires a provider to report an affiliation with a provider that has a reportable event; that is, the statute only requires that a provider disclose whether its close affiliates have had a disclosable event.

Response: Concerning revocations, as we stated in the proposed rule, section 1866(j)(5)(A) of the Act references a revalidation application, which can only be submitted by an enrolled provider or supplier. Having the ability to revoke the enrollment of providers or suppliers with affiliations posing an undue risk is necessary to protect the integrity of the Medicare program. Thus, we interpret the statute as applying to both enrolled providers and suppliers and those applying for enrollment. As for new or changed information, we have removed proposed §§ 424.519(h)(1) and (h)(2)(i) and 455.107(h) so as to limit the burden on providers and suppliers. Regarding the suggestion that the statute only requires disclosures with respect to “close affiliates,” we note that section 1866(j)(5)(A) of the Act expressly applies to both direct and indirect affiliations. In sum, we believe that §§ 424.519 and 455.107 are consistent with section 1866(j)(5) as well as our general rulemaking authority under sections 1102 and 1871 of the Act.

Comment: A commenter questioned whether a provider that is revalidating its enrollment in 2017 and has an affiliated provider that had a 2015 debt that has been repaid would be required to report the debt, since the affiliation existed within the previous 5 years.

Response: This scenario would not involve a disclosable affiliation because the debt has been repaid. It is no longer an uncollected debt for purposes of our affiliation requirements.

Comment: Several commenters stated that CMS should consider the potential impact that this rule's reporting burden would have on beneficiary access to care.

Response: We believe that our previously referenced modification to § 424.519(h) and removal of proposed § 455.107(h) will alleviate any concerns regarding access to care by limiting the burden on providers and suppliers, hence allowing more time to treat patients. Rather than having to regularly track, monitor, and report new and changed affiliation data, providers and suppliers will only need to disclose affiliation information in the limited circumstances outlined in § 424.519(b) or § 455.107(b).

Comment: Several commenters expressed concern that providers and suppliers may have to establish new employment screening processes to help identify and determine whether its physicians, managing employees, etc., may have disclosable affiliations. One commenter questioned whether providers will be afforded any protection in the reporting process when such individuals or organizations furnish false or incomplete representations to the provider. Another commenter stated the affiliations proposal could negatively impact managers of providers by effectively requiring them to examine prospective employees well beyond what normal procedures would mandate.

Response: Our affiliation provisions do not require providers and suppliers to undertake or increase employment screening practices. Any decision to do so lies solely within the provider's or supplier's discretion. The provider or supplier is ultimately responsible for furnishing accurate information to CMS or the state irrespective of the source of the data.

Comment: A commenter requested clarification that—(1) disclosures are only required when submitting an initial or revalidating Form CMS-855 application; and (2) disclosures are not required when a change of information or change of ownership is reported on the Form CMS-855.

Response: Disclosures are only required—(1) upon initial enrollment and revalidation; (2) if § 424.519(b) or § 455.107(b) applies to the provider or supplier; and (3) if CMS or a state asks the provider or supplier to disclose affiliation information. Also, for reasons explained previously, we are not finalizing proposed §§ 424.519(h)(1) and (h)(2)(i) and 455.107(h).

Comment: A commenter recommended that emergency physicians be excluded from our affiliation disclosure provisions. The commenter stated that many emergency medicine practices are very large with multiple affiliations, most of which are unbeknown to the individual emergency physicians on staff. The commenter recommended that if CMS does not exempt emergency physicians from the affiliation provisions, CMS should clarify the following issues: (1) Whether an emergency physician who leaves one emergency medicine practice to join another such practice is required to know the affiliations of his or her former employer; (2) if the answer to the first question is yes, how the physician would learn of the former employer's affiliations in order to disclose them; (3) what mechanisms exist to require the physician's former employer to disclose its affiliations to the physician; and (4) which party—the physician or the new practice he or she is joining—would be liable if the physician's former employer had affiliations that were not disclosed and reported on the physician's enrollment application.

Response: As stated previously, we do not believe certain provider or supplier types should be automatically and permanently exempt from § 424.519. Regarding the remaining comments, and as already explained, it is the provider's or supplier's responsibility to report all affiliations pursuant to § 424.519(b). We stress, though, that only the provider's or supplier's affiliations would need to be disclosed, not the affiliations of an unrelated party.

Comment: A commenter stated that any previous affiliation with a Medicare, Medicaid, or CHIP provider should be disclosed to CMS for review and approval. If CMS determines that one of the associated providers previously committed fraud while employed as a managing partner, owner, or stakeholder, the provider should not be allowed to furnish CMS-covered services in the future.

Response: We appreciate this comment and believe that our finalized affiliation provisions will assist us in protecting Medicare, Medicaid, and CHIP against the behavior and relationships the commenter describes.

B. Other Proposed Provisions Affecting the Medicare Program Only

Except as noted otherwise, the legal authorities for our proposed provisions in section II.B. of this final rule with comment period are as follows. First, section 1866(j) of the Act states that the Secretary shall establish by regulation a process for the enrollment of providers of services and suppliers. Second, sections 1102 and 1871 of the Act give the Secretary the authority to establish requirements for the efficient administration of the Medicare program.

1. Revoked Under Different Name, Numerical Identifier, or Business Identity

We proposed in new § 424.530(a)(12) that CMS may deny a provider's or supplier's Medicare enrollment application if CMS determines that the provider or supplier is currently revoked under a different name, numerical identifier, or business identity, and the applicable reenrollment bar period has not expired. Likewise, we proposed in new § 424.535(a)(18) that CMS may revoke a provider's or supplier's Medicare enrollment if CMS determines that the provider or supplier is revoked under a different name, numerical identifier, or business identity.

As discussed in section II.A.1.a. of the proposed rule, we have identified instances where a provider or supplier has its Medicare enrollment revoked but tries to evade the revocation and reenrollment bar by opening a new provider or supplier organization to effectively “replace” the revoked entity. In the previously mentioned November 2008 OIG Early Alert Memorandum, the OIG indicated that some providers and suppliers operate “fronts,” whereby associates, family members, or other individuals pose as owners or managers of the entity on behalf of the persons who actually operate, run, or profit from the business. We proposed to add new §§ 424.530(a)(12) and 424.535(a)(18) to address this type of behavior.

In determining whether a provider or supplier is in fact a currently revoked provider or supplier under a different name, numerical identifier, or business identity, CMS proposed to investigate the degree of commonality by considering the following factors:

• Owning and managing employees and organizations, regardless of whether they have been disclosed on the Form CMS-855 application (since the definitions of “owner” and “managing employee” in § 424.502 do not require the individual or organization to be listed on the Form CMS-855 in order to qualify as such).
• Geographic location (for example, same city or county).
• Provider or supplier type (for example, same provider type).
• Business structure.
• Any evidence indicating that the two parties are similar or that the provider or supplier was created to circumvent the revocation or the reenrollment bar.

We stated that it should not be assumed that having different owners, locations, or business structures would automatically result in a finding that the two are not the same. CMS would consider any evidence indicating that the entities are effectively identical or that the new entity was established to avoid the revocation or reenrollment bar. Thus, even if several factors suggest that the entities may be distinct, we would reserve the right to apply § 424.530(a)(12) or § 424.535(a)(18) if we find evidence of evasion.

We further stated that we would invoke the latter two provisions without requiring a separate finding that the revoked entity, the newly enrolling entity, or the currently enrolled entity (as applicable) poses an undue risk of fraud, waste, or abuse. This is because—(1) we were not relying upon section 1866(j)(5) of the Act as authority for these two provisions, and (2) we believe that behavior designed to evade the reenrollment bar poses an inherent risk. We instead relied upon our general rulemaking authority in sections 1102 and 1871 as well as section 1866(j) of the Act, which provides specific authority concerning the enrollment process for providers and suppliers.

We received the following comments regarding our proposal:

Comment: A commenter asked whether—(1) an “attempt to evade” standard regarding parties that open a new provider organization to replace a revoked entity actually applies; or (2) it is automatically determined that if the two involved businesses meet the “commonality” test, the new provider is attempting to evade the revocation or enrollment bar.

Response: As indicated in the factors listed in §§ 424.530(a)(12) and 424.535(a)(18), evidence of deliberate circumvention will be only one of several criteria we will consider in determining the degree of commonality. Depending upon the specific facts of the case, we may still determine that the two parties are sufficiently similar if the other factors suggest as much.

Comment: A commenter contended that CMS must carefully evaluate situations where a supplier is reorganizing its business and not automatically determine that the supplier intends to commit fraud. The commenter stated that suppliers may add new locations or consolidate locations to better manage their business.

Response: We agree with the commenter, and in each case we will review all of the circumstances in determining whether action under § 424.530(a)(12) or § 424.535(a)(18) is warranted.

After consideration of the comments received, we are finalizing § 424.530(a)(12) and § 424.535(a)(18) as proposed.

2. Non-Compliant Practice Location

We proposed in new § 424.535(a)(20) that we may revoke a provider's or supplier's Medicare enrollment—including all of the provider's or supplier's practice locations, regardless of whether they are part of the same enrollment—if the provider or supplier billed for services performed at or items furnished from a location that it knew or should reasonably have known did not comply with Medicare enrollment requirements.

As explained in the proposed rule, we have identified examples of providers and suppliers operating from multiple practice locations (either as part of the same enrollment or, for DMEPOS suppliers and independent diagnostic testing facilities (IDTFs), through separately enrolled locations) of which one or more of the locations does not meet Medicare enrollment requirements. For instance, a particular location may not be operational, fails to comply with certain DMEPOS or IDTF supplier standards, or is otherwise noncompliant. The provider or supplier, however, continues to perform services at or furnish items from this location (or claims to do so) when it knows or should know that the location does not meet Medicare enrollment requirements. We have seen this with providers and suppliers operating locations that either do not exist or are false storefronts, meaning that the location appears legitimate from the outside but is in fact a vacant site or a nonmedical business.

We have conducted site visits uncovering several similar situations, and revocations of providers and suppliers locations have accordingly ensued. Yet we stressed in the proposed rule that more must be done. Providers and suppliers must realize that if they submit claims for services or items furnished at or from non-compliant locations, they risk not only the revocation of that site but also of their other locations. As an illustration, assume that a DMEPOS supplier has four separately enrolled locations. The supplier shifts one of its locations without notifying Medicare, and the new site is a false storefront. The supplier furnishes no items from this location, but it submits bills for DME allegedly provided from the site. Under our proposal, CMS could revoke this location as well as the three other sites. Even if the other sites had different numerical identifiers, legal business names, or ownership, we could take action against them if there is evidence to suggest that they are effectively under the control of similar parties. This is to ensure that providers and suppliers do not attempt to circumvent § 424.535(a)(20) by opening locations under different identities or with different “front men” (such as family members).

We proposed to consider the following factors when determining whether and how many of the provider's or supplier's other locations should be revoked:

• The reason(s) for and facts behind the location's non-compliance (for example, false storefront; otherwise non-operational; other violation of supplier standards).
• The number of additional locations involved.
• Whether the provider or supplier has any history of final adverse actions (as that term is defined in § 424.502) or Medicare or Medicaid payment suspensions.
• The degree of risk that the location's continuance poses to the Medicare Trust Funds (specifically, the other location(s), rather than the non-compliant location).
• The length of time that the non-compliant location was non-compliant.
• The amount that was billed for services performed at or items furnished from the non-compliant location.
• Any other evidence that we deem relevant to our determination.

We received the following comments regarding this proposal:

Comment: Several commenters stated that CMS already has the authority to revoke enrollment based on the grounds indicated in proposed § 424.535(a)(20). The commenters contended that CMS should rely upon existing protocols (such as fines, recoupments, and revocations) rather than create new revocation mechanisms.

Response: The circumstances addressed in § 424.535(a)(20) go beyond the mere non-compliance of a single practice location or single Medicare enrollment. For instance, suppose a provider has four practice locations (A, B, C, and D) under four separate enrollments. The provider knows that Location D is non-compliant yet bills for services performed there. While § 424.535(a)(5) permits the revocation of the enrollment associated with Location D, it does not explicitly address the potential revocation of the provider's other three enrollments associated with Locations A, B, or C, respectively. However, § 424.535(a)(20) will emphasize that the provider and all of its locations can be revoked (in other words, all of the enrollments associated with the practice locations). In short, we do not believe our existing regulations sufficiently address this type of arrangement and that additional clarification is needed.

Comment: Several commenters expressed concern about CMS' proposed ability under § 424.535(a)(20) to revoke the provider's other locations if there is evidence to suggest that they are effectively under the control of similar parties. Two of the commenters stated that this disregards corporate formalities without evidence of wrongdoing by the providers. Two other commenters suggested that CMS apply the proposed undue risk standard in determining whether other locations should be revoked under § 424.535(a)(20).

Response: We do not believe a provider should be able to avoid the revocation of its other locations under § 424.535(a)(20) simply because they are, for instance, under different tax identification numbers. CMS must be able to take action against the provider's other or associated locations if truly warranted under the circumstances in order to protect the Medicare program. We emphasize, however, that CMS will carefully consider the factors outlined in § 424.535(a)(20) in determining whether and/or which other locations should be terminated. As previously described, this will include reviewing the degree of risk that a particular location's continuance poses to the Trust Funds.

Comment: A few commenters stated that § 424.535(a)(20)'s application should be restricted to cases where the provider has actual knowledge of non-compliance or, one of the commenters stated, demonstrated gross negligence in failing to monitor the location.

Response: Providers are responsible for closely monitoring and ensuring the compliance of all of their locations at all times. Establishing an “actual knowledge” or “gross negligence” standard would, in our view, effectively permit providers to avoid this responsibility and the potential application of § 424.535(a)(20).

Comment: Opposing the proposal as written, a commenter stated that the proposed regulatory text did not include language from the preamble regarding CMS' intent on stopping providers and suppliers from knowingly operating fictitious or otherwise non-compliant locations to circumvent CMS policies. The commenter added that a revocation could become a permanent blemish (and potentially render an affected practitioner virtually unemployable). The commenter recommended that CMS revise the regulatory text to limit the authority to revoke multiple locations to egregious, fraudulent transgressions.

Response: We do not believe that language such as “egregious, fraudulent transgressions” is appropriate for regulatory text. However, we reiterate that this provision will be applied in cases where the maintenance of the provider's or supplier's other enrollments would jeopardize the Medicare Trust Funds.

Comment: A commenter stated that CMS currently may revoke Medicare enrollment under § 424.535(a)(1) if the provider is determined to not be in compliance with the enrollment requirements applicable for its provider or supplier type, and has not submitted a plan of corrective action as outlined in part 488 of this chapter. The commenter stated that by adding more revocation authorities, CMS seeks to circumvent the existing regulatory scheme, which permits providers to submit a plan of correction for violations of Medicare requirements.

Response: The addition of § 424.535(a)(20) and other revocation reasons in the rule are not intended to circumvent part 488. Nothing in § 424.535(a) prohibits a certified provider or certified supplier from submitting a part 488 plan of correction under the provisions of that part. This does not mean, however, that we cannot take revocation action even if such plan is submitted (except as stated in § 424.535(a)(1)). Moreover, providers and suppliers are ensured due process through their right to appeal any revocation under part 498.

Comment: A commenter stated that CMS should clarify that it can only take action against different legal entities under paragraph (a)(20) if it determines that the sites are exercising a circumvention scheme.

Response: We respectfully disagree because § 424.535(a)(20) is not primarily focused on the issue of schemes designed to circumvent revocations and reenrollment bars. Rather, § 424.535(a)(20) concerns billing for services furnished at or from a non-compliant location and whether any of the provider's other locations should be revoked as a result.

Comment: While stating that the proposed factors are reasonable considerations, a commenter expressed concern about the possible revocation of many or all of a provider's practice locations for minor technical instances of non-compliance in a single location. The commenter urged CMS to include in the regulatory text the language from the proposed rule's preamble indicating that this provision is designed primarily to stop providers and suppliers that knowingly operate fictitious or otherwise non-compliant locations in order to circumvent CMS policies.

Response: Language that outlines the underlying purpose of (or rationale for) a particular regulatory provision is generally not included in regulatory text; the latter is typically limited to outlining specific requirements or standards. We thus respectfully decline to insert the commenter's requested verbiage. Regardless, we note again that this provision concerns billing for services furnished at or from a non-compliant location and whether any of the provider's other locations should be revoked as a result.

After consideration of the comments received, we are finalizing § 424.535(a)(20) as proposed, with the exception of modifying the first two sentences of the paragraph. We believe it is necessary to clarify that a revocation occurs at the enrollment level, rather than the practice location level. We are concerned that paragraph (a)(20), as currently written, could be construed as indicating that practice locations themselves can be revoked. Accordingly, the first two sentences of paragraph (a)(20) will be slightly revised to read as set out in the regulatory text.

3. Improper Ordering, Certifying, Referring, or Prescribing of Part A or B Services, Items, or Drugs

In a final rule published in the Federal Register on December 5, 2014 titled “Medicare Program; Requirements for the Medicare Incentive Reward Program and Provider Enrollment” (72 FR 72499), we finalized § 424.535(a)(8)(ii). Under this provision, CMS may revoke a provider's or supplier's Medicare billing privileges if the provider or supplier has a pattern or practice of submitting claims that fail to meet Medicare requirements such as, but not limited to, the requirement that the service be reasonable and necessary. The provision is intended to place providers and suppliers on notice that they have a legal obligation to submit correct and accurate claims; the provider's or supplier's repeated failure to do so, we concluded, poses a risk to the Medicare Trust Funds.

We also published a final rule in the Federal Register (79 FR 29843) on May 23, 2014, titled “Medicare Program; Contract Year 2015 Policy and Technical Changes to the Medicare Advantage and the Medicare Prescription Drug Benefit Programs.” Under § 424.535(a)(14), which was finalized in that rule, we may revoke a physician's or eligible professional's Medicare billing and prescribing privileges if we determine that he or she has a pattern or practice of prescribing Part D drugs that fall into one of the following categories:

• The pattern or practice is abusive, represents a threat to the health and safety of Medicare beneficiaries, or both.
• The pattern or practice of prescribing fails to meet Medicare requirements.

In the January 10, 2014 proposed rule (79 FR 1917), which resulted in the aforementioned May 23, 2014 final rule, we expressed our view that the concept behind proposed § 424.535(a)(8)(ii) should extend to revoking Medicare enrollment for Part D prescribers who engage in abusive prescribing practices. We explained that if a physician or eligible professional consistently fails to exercise reasonable judgment in his or her prescribing practices, we should be able to remove such individuals from the Medicare program in order to protect beneficiaries' safety and health, as well as the Medicare Trust Funds.

Notwithstanding these new safeguards, neither § 424.535(a)(14) nor § 424.535(a)(8)(ii) address the improper ordering or certifying of Medicare services and items or the prescribing of Part B drugs. We have received numerous reports of physicians and eligible professionals engaging in abusive or otherwise inappropriate ordering. While the particular circumstances of each case have varied, they frequently fall within one or more of the following categories—(1) the ordered item or service was not reasonable, not necessary, or both; or (2) the physician or eligible professional misrepresented his or her diagnosis to justify the service or test.

Such behavior increases the risk of improper payment for inappropriate items or services or Part B drugs. It also endangers Medicare beneficiaries by unnecessarily exposing them to potentially harmful services and tests. As with the threats that abusive prescribing and billing pose, we believe that the risks of improper ordering, certifying, and referring, as well as the prescribing of Part B drugs, must be stemmed in order to protect the Medicare program.

Accordingly, we proposed in new § 424.535(a)(21) that CMS may revoke a physician's or eligible professional's Medicare enrollment (as the term “enrollment” is defined in § 424.502) if he or she has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements. Recognizing that not all patterns or practices involve inappropriate behavior, we stated in the proposed rule that we would consider the following factors in determining whether a pattern or practice of improper ordering, certifying, referring, or Part B drug prescribing exists:

• Whether the physician's or eligible professional's diagnoses support the orders, certifications, referrals, or prescriptions in question.
• Whether there are instances where the necessary evaluation of the patient for whom the service, item, or drug was ordered, certified, referred, or prescribed could not have occurred (for example, the patient was deceased or out of state at the time of the alleged office visit).
• The number and type(s) of disciplinary actions taken against the physician or eligible professional by the licensing body or medical board for the state or states in which he or she practices, and the reason(s) for the action(s).
• Whether the physician or eligible professional has any history of final adverse actions (as that term is defined in § 424.502).
• The length of time over which the pattern or practice has continued.
• How long the physician or eligible professional has been enrolled in Medicare.
• The number and type(s) of malpractice suits that have been filed against the physician or eligible professional related to ordering, certifying, referring, or prescribing that have resulted in a final judgment against the physician or eligible professional or in which the physician or eligible professional has paid a settlement to the plaintiff(s) (to the extent this can be determined).
• Whether any state Medicaid program or any other public or private health insurance program has restricted, suspended, revoked, or terminated the physician's or eligible professional's ability to practice medicine, and the reason(s) for any such restriction, suspension, revocation, or termination.
• Any other information that we deem relevant to our determination.

We received the following comments regarding our proposal:

Comment: A commenter expressed support for our proposed addition of § 424.535(a)(21).

Response: We appreciate the commenter's support.

Comment: A commenter opposed our proposal, stating that it—(1) duplicates current safety mechanisms; (2) interferes with the long history of states regulating the licensure process; and (3) adds another layer of bureaucracy and administrative costs to the program. The commenter added that CMS is inappropriately suggesting that a medical liability lawsuit is somehow equivalent to liability without regard for the lawsuit's outcome. The commenter stated that—(1) there are many ways in which physicians could be named in a medical liability suit, regardless of whether there is any evidence of negligence; and (2) many liability insurers settle cases with little to no merit.

Response: We respectfully disagree with the commenter's contentions. First, § 424.535(a)(21) does not duplicate any existing Medicare safety mechanisms. Unlike with abusive billing (§ 424.535(a)(8)(ii)) and abusive prescribing of Part D drugs (§ 424.535(a)(14)), we currently lack the authority to take enrollment action against patterns or practices of abusive ordering or certifying of Medicare items and services or Part B drugs. This is behavior we have seen and against which we must protect the Medicare program. Second, we recognize the role of state medical boards in monitoring the practice of medicine. Such bodies, however, operate independently of CMS. They play no role in overseeing the Medicare program, a responsibility that rests with CMS. As such, we must be able to rapidly take protective measures without having to wait for possible action by state licensing boards or other bodies.

We do not believe this provision adds layers of bureaucracy. It is simply a further regulatory protection for the Medicare program. Concerning medical liability lawsuits, we currently consider this criterion in determining whether a revocation under § 424.535(a)(14) is warranted, and we are duplicating this factor in § 424.535(a)(21). We emphasize, however, that it is only one of several factors we will consider in our determination; it is not alone dispositive.

After consideration of the comments received, we are finalizing § 424.535(a)(21) as proposed.

4. Reenrollment and Reapplication Bar Period

a. Reenrollment Bar

Under § 424.535(c), if a provider, supplier, owner, or managing employee has their billing privileges revoked, they are barred from participating in Medicare from the date of the revocation until the end of the reenrollment bar. The reenrollment bar begins 30 days after CMS or its contractor mails notice of the revocation. It lasts a minimum of 1 year, but not greater than 3 years, depending on the severity of the basis for revocation.

We proposed the following changes to § 424.535(c):

First, we proposed to incorporate the existing version of § 424.535(c) into a new paragraph (c)(1) that would increase the current maximum reenrollment bar from 3 years to 10 years (excluding the situations described in new paragraphs (c)(2) and (3), discussed later in this section of this final rule with comment period). We stated in the proposed rule that it would be reasonable in certain cases to prevent a provider or supplier from participating in Medicare for longer than 3 years. Indeed, certain behavior could prove so harmful to Medicare, its beneficiaries, and/or the Trust Funds that a very lengthy bar from Medicare is warranted. We believed that a 10-year maximum timeframe is appropriate, both to—(1) ensure that providers and suppliers engaging in such activities are kept out of Medicare; and (2) deter others from potentially duplicating this behavior. We chose 10 years because there is precedent for this period; under § 424.535(a)(3)(iii), it constitutes the minimum revocation timeframe for providers that have been convicted of multiple felonies. However, we did not expect to impose longer reenrollment bars for certain existing revocation reasons. Revocations that currently involve only a 1-year reenrollment bar, for instance, would not necessarily result in a longer period under new § 424.535(c)(1).

Second, we proposed in new § 424.535(c)(2) that CMS may add up to 3 more years to the provider's or supplier's reenrollment bar (even if such period exceeds the maximum otherwise allowable under paragraph (c)(1)) if CMS determines that the provider or supplier is attempting to circumvent its existing reenrollment bar by enrolling in Medicare under a different name, numerical identifier, or business identity. We stated that such efforts to avoid Medicare rules warrant the provider's or supplier's Medicare revocation being for a longer timeframe than was originally imposed.

We noted that the affected provider or supplier could appeal CMS' imposition of additional years to the provider's or supplier's existing reenrollment bar under § 424.535(c)(2). These appeal rights would be governed by 42 CFR part 498. However, they would not extend to the imposition of the original reenrollment bar under § 424.535(c)(1); they would be limited to the additional years imposed under § 424.535(c)(2).

Third, we proposed in new § 424.535(c)(3) that CMS may impose a reenrollment bar of up to 20 years if the provider or supplier is being revoked from Medicare for the second time. Multiple revocations indicate that the provider or supplier cannot be considered a reliable partner of the Medicare program. The reenrollment bar under paragraph (c)(3) would be in lieu of the reenrollment bar described in paragraph (c)(1). We proposed to determine the bar's length by considering the following factors—(1) the reasons for the revocations; (2) the length of time between the revocations; (3) whether the provider or supplier has any history of final adverse actions (other than Medicare revocations) or Medicare or Medicaid payment suspensions; and (4) any other information that CMS deems relevant to its determination. In addition, we proposed to apply paragraph (c)(3) even if the two revocations occurred under different names, numerical identifiers, or business identities so long as we can determine that the two actions effectively involved the same provider or supplier.

Fourth, we proposed in new § 424.535(c)(4) that a reenrollment bar would apply to a provider or supplier under any of its current, former, or future business names, numerical identifiers, or business identities. We explained that this would help ensure that revoked providers and suppliers do not attempt to circumvent a revocation and reenrollment bar by changing their name, identity, business structure, etc.

We emphasized in the proposed rule that our sole objective was to make certain that unscrupulous providers and suppliers are kept out of Medicare for as long as possible.

b. Reapplication Bar

We also proposed in new § 424.530(f) that CMS may prohibit a prospective provider or supplier from enrolling in Medicare for up to 3 years if its enrollment application is denied because the provider or supplier submitted false or misleading information on or with (or omitted information from) its application in order to gain enrollment in Medicare. This reapplication bar would apply to the individual or organization under any current, former, or future name, numerical identifier, or business identity.

The purpose of this proposal was to keep untrustworthy providers and suppliers from entering the Medicare program and to forestall future efforts to enroll. We explained that the submission of false information or the withholding of information relevant to the provider's or supplier's enrollment eligibility represents a significant program integrity risk. For this reason, and to provide consequences for such behavior, we stated that our proposed reapplication bar was warranted. When determining the reapplication bar's length, we proposed to consider the following factors—(1) the materiality of the information in question; (2) whether there is evidence to suggest that the provider or supplier purposely furnished false or misleading information or deliberately withheld information; (3) whether the provider or supplier has any history of final adverse actions or Medicare or Medicaid payment suspensions; and (4) any other information that we deem relevant to our determination.

c. Comments Received

We received the following comments regarding our reenrollment bar and reapplication bar proposals:

Comment: A number of commenters opposed our proposed—(1) expansion of the maximum reenrollment bar from 3 years to 10 years; and (2) establishment of a maximum reenrollment bar of 20 years for a second revocation. They believed the proposed bars were excessive and overly punitive. Several of them urged CMS to retain the existing 3-year reenrollment bar.

Response: As explained in the proposed rule, we believe it is reasonable in certain cases to prevent a provider or supplier from participating in Medicare for longer than 3 years. Certain behavior could prove so harmful to Medicare, its beneficiaries, and/or the Trust Funds that a longer bar from Medicare is justified. Again, we believe that the 10-year and 20-year maximum periods are appropriate to—(1) make sure that abusive parties are kept out of Medicare; and (2) deter others from mirroring such behavior. We emphasize, though, that 10-year and 20-year bars (as well as other longer bars) will typically be reserved for more serious conduct and not be imposed unless determined to be warranted after careful consideration of all of the required factors.

With respect to the maximum 20-year bar for individuals or entities that have been revoked a second time, CMS believes that the standard appeals process at Part 498 should allow for the resolution of “mistaken identity” cases regarding the first revocation. In other words, if a provider or supplier to which CMS applies § 424.535(c)(3) correctly claims on appeal that a different individual or entity was, in fact, the subject of the first revocation, CMS will be able modify the re-enrollment bar length such that it only applies to the second revocation, pursuant to § 424.535(c)(1). As explained below, we are modifying § 498.3(b)(17) to afford appeal rights in this scenario.

Comment: A commenter stated that the proposed rule does not clarify the lengths of the reenrollment bars that will be applied to different offenses, meaning that reenrollment bars would be determined arbitrarily. The commenter, as well as others, urged CMS to provide guidelines as to what offenses would merit bans of certain time periods. They added that said guidance should be narrowly defined to target egregious cases and hold harmless reputable providers.

Response: We respectfully decline to specify in regulation the precise reenrollment bar lengths that will be imposed for particular acts. Each case could vary widely, and we must continue to have the discretion and flexibility to (consistent with current practice) consider all relevant facts, including circumstances that mitigate against a longer reenrollment bar.

Comment: A commenter suggested—(1) a maximum reenrollment bar of 5 years instead of 10 years; and (2) a bar for a second revocation of 10 years rather than 20. Another commenter urged a maximum reenrollment bar of 6 years with exceptions.

Response: We appreciate these recommendations. As indicated earlier, we believe that the seriousness of certain conduct warrants a longer maximum re-enrollment bar. A 5-year or 6-year bar may be insufficient to protect the Medicare program in some instances. We believe that our 10-year and 20-year maximum bars enable us to address various factual situations, including particularly improper or fraudulent behavior.

Comment: Some commenters supported our proposed reenrollment bar provisions in § 424.535(c).

Response: We appreciate the commenters' support.

Comment: A commenter contended that barring a provider for 10 years would only be justified in extreme cases of fraud. Another commenter stated that any reenrollment bar should only be imposed when there—(1) is sufficient evidence that serves a program integrity goal; and (2) are robust due process and appeal rights for the affected provider or supplier.

Response: While we respectfully disagree that a 10-year bar should only be warranted in extreme instances of fraud, 10-year timeframes will generally be restricted to serious behavior. Concerning the second commenter, we believe that every reenrollment bar aids our program integrity objectives by prohibiting revoked parties from effectively circumventing the revocation by immediately submitting an application to reenroll. We note also that providers and suppliers may appeal a revocation under § 498.3, thus ensuring due process.

Comment: A commenter cited CMS's statement in the proposed rule's preamble concerning precedent for the 10-year reenrollment bar in existing § 424.535(a)(3)(ii) (specifically, a 10-year bar for multiple felony convictions). The commenter stated that felony convictions involve substantially more due process than the largely administrative adjudications addressed under § 424.535(c). The commenter contended that § 424.535(a)(3)(ii) is not a precedent for the proposed reenrollment bar. Rather, it is a cautionary note about the degree of due process that should be afforded to providers before such a lengthy ban is imposed. The commenter added that CMS' assurance that longer bars would only apply to egregious cases is an inadequate substitute for a finding of criminal guilt beyond a reasonable doubt by a court of law. Another commenter stated that under 48 CFR 9.406-4, the period of debarment for a government contractor generally should not exceed 3 years unless there is a violation of the Drug-Free Workplace Act of 1988; even in the latter situation, the debarment may not exceed 5 years.

Response: The reference to § 424.535(a)(3)(ii) was strictly intended to demonstrate a precedent for a 10-year timeframe, not to equate felony convictions with all other actions covered under § 424.535(a). Regardless, we note that serious misconduct can occur without a criminal conviction. In fact, many of our revocation reasons in § 424.535(a) neither involve criminal behavior nor require a judgment of guilt. We reiterate our view that an extended reenrollment bar (that is, longer than 3 years) may sometimes be warranted, depending upon the facts, circumstances, and scope of the provider's or supplier's conduct. Moreover, we—(1) do not believe that significantly longer bars should be restricted to felony convictions; and (2) are not bound by 48 CFR 9.406-4 and have the discretion to establish a reenrollment bar specific to Medicare.

Comment: A commenter stated that expanding the reenrollment bar beyond 3 years may be appropriate under certain limited circumstances for program integrity reasons. However, the commenter was concerned about the reenrollment bar's application to any current, former or future business names, identifiers or business identities. The commenter stated that this could lead to an overly broad application to well-intentioned and compliant providers and suppliers. The commenter urged that CMS—(1) not impose a reenrollment bar across multiple providers or suppliers that may be affiliated with a provider or supplier, but which had no knowledge of the behavior leading to the bar; and (2) allow flexibility in extenuating circumstances that appropriately balances program integrity risk with community need.

Response: Section 424.535(c)(4) is designed to prevent situations where a provider or supplier is revoked and under a reenrollment bar, and then changes its name to circumvent both sanctions. In cases where, for instance, a provider or supplier is revoked based on an affiliation with another revoked provider or supplier, each revocation is treated separately. Both revoked providers, moreover, should be subject to a reenrollment bar to prevent an immediate reenrollment and consequent circumvention of their revocation, though it should not be assumed that both bars will be the same length. We will carefully review the circumstances of each revocation on its own merits and facts in determining the appropriate bar for that provider; as the commenter suggests in its second comment, we will balance various considerations in establishing bars.

Comment: A commenter opposed the extension of the maximum re-enrollment bar if the affiliation disclosure provisions are finalized. The commenter stated that a 10-year reenrollment bar is too drastic given the extreme difficulty of complying with the reporting requirements in certain circumstances.

Response: We have stated in this final rule with comment period our rationale for the 10- and 20-year reenrollment bars. We will make certain, however, that the length of the imposed re-enrollment bar is proper for the behavior involved by considering all relevant facts and circumstances.

Comment: A commenter recommended that CMS establish a specific reenrollment bar for each revocation reason. Citing examples, the commenter stated that if a site survey found the supplier to be non-compliant and the supplier is appealing the revocation, 3 or 5 years would be an appropriate period; if an owner of the supplier is found guilty of a felony, the commenter stated, a 10-year period would be more appropriate.

Response: We appreciate the commenter's suggestions and examples. As previously stated, however, each case may differ widely. We must have the flexibility to consider every situation on its own merits rather than be compelled to impose certain reenrollment bar lengths for particular actions.

Comment: Several commenters stated that—(1) a 3-year reenrollment or reapplication bar is adequate only in egregious cases of intentional fraud, submission of false claims, or other instances that CMS specifically identifies; (2) any bar should be removed or shortened if the provider eliminates its affiliation with an organization or individual that had a disclosable event; and (3) CMS should only bar reenrollment and reapplication if a provider's actions or omissions were intentional and material.

Response: We respectfully disagree with the commenters' first and third contentions regarding reenrollment bars. A 3-year reenrollment bar for the conduct described may often be too short. Such providers and suppliers should not be permitted to reenter Medicare to potentially repeat their behavior after such a comparatively brief timeframe; the Medicare Trust Funds and Medicare beneficiaries must be protected for as long as possible. Further, as already mentioned, any failure to impose a reenrollment bar for a revocation would undercut the latter action since the provider could otherwise immediately resubmit an application for reenrollment. As for the second contention, we note that a provider or supplier under § 424.535(e) may avoid a revocation and associated reenrollment bar if it terminates (and submits proof that it has terminated) its business relationship with the applicable party within 30 days of the revocation notification. If said affiliation relationship does not fall within the confines of § 424.535(e), CMS considers the scope of the relationship in determining whether an undue risk exists under § 424.519(f) and, by extension, the appropriate length of any reenrollment bar.

Regarding the reapplication bar, evidence of intent and the information's materiality are factors that we will consider in our determination. Certainly, evidence of purposeful falsification of crucial data will warrant a longer reapplication bar. Given the various factual scenarios that could arise and the need for flexibility in our determinations, however, we believe it is imprudent to explicitly require evidence of intent and materiality before a bar is imposed.

After consideration of the comments received, we are finalizing our proposed reenrollment bar and reapplication bar provisions. However, we believe that two minor technical edits to §§ 405.800 and 498.3(b)(17) are necessary to ensure that appeal rights are available under Part 498 regarding additional years applied under § 424.535(c)(2)(i) to any existing reenrollment bar.

First, we are adding a new paragraph (c) to § 405.800 that discusses notification to the provider or supplier of additional years applied to a provider's or supplier's existing reenrollment bar under § 424.535(c)(2)(i). Said notice per § 405.800(c)(1) will include the following:

• The reason for the application of additional years in sufficient detail to allow the provider or supplier to understand the nature of the action.
• The right to appeal in accordance with part 498 of this chapter.
• The address to which the written appeal must be mailed.

In § 405.800(c)(2), we specify that paragraph (c)(1) applies only to the years added to the existing reenrollment bar under § 424.535(c)(2)(i) and not to the original length of the reenrollment bar, which is not subject to appeal.

The language concerning written notice and the contents thereof is consistent with that used in § 405.800(a) and (b) regarding denials and revocations of enrollment. It is designed to ensure that the provider or supplier receives sufficient information regarding the action taken. Paragraph (c)(2) is necessary to clarify that the original length of the reenrollment bar is not appealable.

Second, § 498.3(b) outlines matters on which CMS makes initial determinations. Paragraph (b)(17) lists among them the determination as to whether to deny or revoke a provider or supplier's Medicare enrollment in accordance with § 424.530 or § 424.535. To clarify the availability of appeal rights, we are reorganizing and revising paragraph (b)(17) as follows:

• The existing version of paragraph (b)(17) will be redesignated as paragraph (b)(17)(i).
• New paragraph (b)(17)(ii) will state: “Whether, under § 424.535(c)(2)(i) of this chapter, to add years to a provider's or supplier's existing reenrollment bar;”
• New paragraph (b)(17)(iii) will state: “Whether, under § 424.535(c)(3) of this chapter, an individual or entity other than the provider or supplier that is the subject of the second revocation was the actual subject of the first revocation.”

5. Referral of Debt to the United States Department of Treasury

The Debt Collection Improvement Act of 1996 requires federal agencies to refer eligible delinquent debt to the United States Department of Treasury-designated Debt Collection Center (DCC) for cross-servicing and offset. CMS must refer all eligible debt over 120 days delinquent for cross-servicing and offset. Prior to sending a debt to the Department of Treasury, CMS attempts to recoup it via the procedures outlined in CMS Publication 100-06, chapter 4. Generally speaking, we refer a debt to the Department of Treasury only if we cannot fully recover the debt through our existing procedures. In all cases, though, a provider or supplier is given adequate opportunity to repay the debt or make arrangements to do so (for example, if eligible for an extended repayment plan) before the debt is sent to the Department of Treasury.

We stated in the proposed rule that referral to the Department of Treasury may indicate the provider's or supplier's unwillingness to repay a debt, which brings into doubt whether the provider or supplier can be a reliable partner of the Medicare program. Accordingly, we proposed in new § 424.535(a)(17) that CMS may revoke a provider's or supplier's Medicare enrollment if the provider or supplier has an existing debt that CMS refers to the Department of Treasury. In determining whether a revocation is appropriate, we proposed to consider the following factors:

• The reason(s) for the failure to fully repay the debt (to the extent this can be determined).
• Whether the provider or supplier has attempted to repay the debt.
• Whether the provider or supplier has responded to our request(s) for payment.
• Whether the provider or supplier has any history of final adverse actions or Medicare or Medicaid payment suspensions.
• The amount of the debt.
• Any other information that we deem relevant to our determination.

We received the following comments regarding this proposal:

Comment: A commenter requested that CMS eliminate proposed § 424.535(a)(17) from the final rule.

Response: We respectfully disagree. We believe that this provision is based upon sound fiscal policy and will help ensure that providers and suppliers repay their debts to the Medicare program.

Comment: A commenter stated that there have been instances where a referral of a debt to Treasury occurred—(1) when the debt has been or was in the process of repayment through an agreed-upon repayment plan; or (2) regarding an individual when a corporate debt had not been timely repaid. The commenter requested that CMS clarify when the Treasury referral applies to the enrollment determination and to identify the remedy for erroneous referrals.

Response: We appreciate this comment. If a provider's or supplier's debt is referred to the Department of Treasury, we may invoke § 424.535(a)(17) after a careful consideration of the factors stated therein. The provider or supplier may appeal the revocation under part 498. CMS recognizes, however, that some debts could indeed, as the commenter suggests, be referred to Treasury incorrectly. We are therefore adding the word “appropriately” before “refers” in § 424.535(a)(17). This will clarify that only debts that have been referred to Treasury correctly will constitute a ground for revocation under § 424.535(a)(17).

After consideration of the comments received, we are finalizing § 424.535(a)(17) as proposed with two exceptions. First, as just explained, we are adding the word “appropriately” before “refers”. Second, we are adding the language “(to the extent this can be determined)” to the end of the factors enumerated in § 424.535(a)(17)(ii) (concerning attempts to repay) and (iii) (regarding responses to request for repayment). This is to account for the possibility that it may occasionally prove difficult to ascertain and acquire this information.

6. Failure to Report

Existing § 424.535(a)(9) permits CMS to revoke the Medicare enrollment of a physician, non-physician practitioner, physician group, or non-physician practitioner group if the supplier fails to comply with § 424.516(d)(1)(ii) or (iii), which requires the supplier to report a change in its practice location or final adverse action status within 30 days of the change.

We proposed to expand § 424.535(a)(9) in two ways. First, we proposed that CMS may apply § 424.535(a)(9) to all of the reporting requirements in § 424.516(d), not merely those in § 424.516(d)(1)(ii) and (iii). We could thus revoke the Medicare enrollment of a physician, non-physician practitioner, physician group, or non-physician practitioner group if the supplier fails to report either of the following:

• A change of ownership, final adverse action, or practice location within 30 days of the change (as required under § 424.516(d)(1)(i), (ii), and (iii), respectively).
• Any other change in enrollment data within 90 days of the change (as required under § 424.516(d)(2)).

Second, we proposed that CMS may apply § 424.535(a)(9) to the reporting requirements in § 410.33(g)(2) (pertaining to IDTFs), § 424.57(c)(2) (pertaining to DMEPOS suppliers), and § 424.516(e) (pertaining to all other provider and supplier types). This means we could revoke a provider or supplier under § 424.535(a)(9) if any of the following occur:

• An IDTF fails to report a change in ownership, location, general supervision, or final adverse action within 30 days of the change or fails to report any other change in its enrollment data within 90 days of the change.
• A DMEPOS supplier fails to submit any change in its enrollment information within 30 days of the change.
• A provider or supplier other than a physician, non-physician practitioner, physician group, non-physician practitioner group, IDTF, or DMEPOS supplier fails to report any of the following:

++ A change in ownership or control within 30 days of the change.

++ A revocation or suspension of a federal or state license or certification within 30 days of the revocation or suspension.

++ Any other change in its enrollment data within 90 days of the change.

We contended that our revocation authority under § 424.535(a)(9) should not be restricted to certain provider and supplier types that have omitted reporting a change in practice location or final adverse action. Any failure to report changed enrollment data, regardless of the provider or supplier type involved, is of concern to us. We must have complete and accurate data on each provider and supplier to help confirm that the provider or supplier still meets all Medicare requirements and that Medicare payments are made correctly. Inaccurate or outdated information puts the Medicare Trust Funds at risk.

While we stated that we would retain the discretion to revoke a provider's or supplier's enrollment for any failure to meet the reporting requirements in § 424.516(d) or (e), § 410.33(g)(2), or § 424.57(c)(2), our proposal was focused on significant cases of non-reporting. For instance, a provider's belated omission to report a ZIP code change until 120 days after the change does not represent an equivalent level of program integrity risk as a complete failure to report a new practice location. We proposed to consider the following factors in determining whether a § 424.535(a)(9) revocation is appropriate (1) whether the data in question was reported; (2) if the data was reported, how belatedly; (3) the materiality of the data in question; and (4) any other information that we deem relevant to our determination.

We received the following comments regarding our proposal:

Comment: Several commenters expressed concern regarding our proposed revision to § 424.535(a)(9). They stated that the proposal could allow CMS to revoke providers and suppliers for inadvertent or innocent errors or oversights, even if no federal health care program reimbursement was involved with the enrollment change that was not reported. They added that many reporting failures are mere oversights and not indicative of fraud or abuse. They recommended that CMS rescind its proposal, believing that revocation in such instances is an overly severe penalty.

Response: We note that we already have the authority to revoke providers and suppliers under § 424.535(a)(1) for failing to timely report changes of information under, as applicable, §§ 424.516(d), 410.33(g)(2), and 424.57(c)(2). Our revision to § 424.535(a)(9) simply establishes a dedicated paragraph in § 424.535(a) to address all information changes, not merely those in § 424.516(d)(ii) and (iii). In other words, we have always had general authority to revoke for failing to report changes, and this rule expands upon that existing authority. The expansion of § 424.535(a)(9), however, is focused largely on significant cases of non-reporting, and we will carefully consider several factors, such as the data's materiality, in determining whether a revocation is appropriate. Yet we must emphasize that we still retain the right to revoke under § 424.535(a)(9) for any failure to timely report informational changes.

Comment: A commenter suggested that CMS require advance notice and an opportunity for information correction or rebuttal of allegations of noncompliance prior to imposing a revocation for a failure to timely report a practice location change.

Response: We believe that a failure to report a practice location is a serious matter, especially considering that practice location data has a material effect on the accuracy of Medicare payments. Thus, we do not believe that advance notice and an opportunity to correct is appropriate and stress that the provider or supplier may appeal any revocation under part 498. We note further that advance notice and a correction opportunity could remove any incentive for providers and suppliers to timely report information changes. The provider or supplier could simply wait until receiving such notice (assuming that CMS even learns of the new or changed data) to disclose the information via the Form CMS-855.

Comment: A commenter stated that while our proposed factors under § 424.535(a)(9) were reasonable considerations, they were inadequate to protect against the revocation of a provider for trivial reasons. The commenter recommended that CMS add to the regulatory text the language from the proposed rule's preamble indicating that a decision to revoke would be focused on “egregious” cases of non-reporting. Another commenter stated that revoking Medicare enrollments under § 424.535(a)(9) should only occur in egregious cases.

Response: We believe that our proposed factors sufficiently ensure that—(1) we will carefully consider all circumstances of the case before taking action; and (2) any decision to revoke will not be taken lightly. Also, we believe that the language regarding “egregious” non-reporting is inappropriate for regulatory text.

Comment: A commenter stated that revocation under § 424.535(a)(9) should extend only to instances where the unreported information was material and the non-disclosure intentional. Materiality would thus be the threshold question as opposed to a mere factor for consideration. The commenter suggested that materiality could be based on whether the failure to report would result in “undue risk” (as articulated in section 1866(j)(5)) or otherwise would have changed the provider's enrollment status. The commenter also requested that CMS provide additional examples of what constitutes egregious cases of non-reporting.

Response: We do not believe that materiality should be the threshold question, for this would imply that certain information need never be reported to CMS. In other words, providers and suppliers might assume that they need not comply with our reporting requirements in many cases because they would only be revoked for instances involving material data. We emphasize that providers and suppliers have a continuing obligation to report changes in their enrollment information via the Form CMS-855 regardless of the data's relative materiality. In addition, we respectfully decline to set forth examples of significant non-reporting. The facts of each case may vary greatly, and we must retain our flexibility to address and consider particular circumstances.

After consideration of the comments received, we are finalizing our proposed revisions to § 424.535(a)(9).

7. Payment Suspensions

Section 424.530(a)(7) permits the denial of a provider's or supplier's Medicare enrollment application if the current owner, physician, or non-physician practitioner has been placed under a Medicare payment suspension in accordance with §§ 405.370 through 405.372. Under § 405.371, a Medicare payment suspension may be imposed if CMS determines that a credible allegation of fraud against a provider or supplier exists. The general purpose of a payment suspension based upon a credible allegation of fraud is to temporarily halt the payment of Medicare Trust Fund dollars to a provider or supplier pending the resolution of a particular investigation concerning, for instance, whether the provider or supplier has engaged in fraudulent activity. CMS also has the authority to impose a payment suspension based upon reliable information that an overpayment exists. The goal of this type of suspension is to temporarily halt Medicare payments while CMS performs subsequent action to determine the existence of an overpayment.

We proposed several revisions to § 424.530(a)(7) and one revision to § 405.371.

First, we proposed to expand the applicability of § 424.530(a)(7) to—(1) all provider and supplier types; and (2) any owning or managing employee or organization of the provider or supplier. We stated that the existing scope of § 424.530(a)(7), which is limited to owners, physicians, and non-physician practitioners, does not address the continuum of program vulnerabilities in this area. Indeed, providers and suppliers other than physicians and non-physician practitioners are currently not prohibited from enrolling in Medicare based on a payment suspension. We note further that a managing individual or entity often has as much (or more) day-to-day control over a provider or supplier as an owner. In our view, automatically allowing a provider or supplier to enroll in Medicare even though one of its managing officials or organizations is under a payment suspension poses a risk to Medicare and its beneficiaries.

Second, we proposed to include Medicaid payment suspensions within the purview of § 424.530(a)(7). Under § 455.23, the state Medicaid agency must suspend all Medicaid payments to a provider or supplier after the agency determines that there is a credible allegation of fraud for which a Medicaid investigation is pending (unless the agency has good cause to not suspend payments). We contended that there was no significant difference between Medicare and Medicaid payment suspensions in terms of the threat posed to federal health care program integrity; potentially fraudulent behavior in the Medicaid program could be repeated in the Medicare program. We thus proposed to be able to prevent such providers and suppliers from entering Medicare.

Third, we proposed to incorporate these revised provisions into a new § 424.530(a)(7)(i).

Fourth, we proposed to establish a new § 424.530(a)(7)(ii) that would permit CMS to apply § 424.530(a)(7) to the following:

• Any of the provider's or supplier's or owning or managing employee's or organization's current or former names, numerical identifiers, or business identities.
• Any of the provider's or supplier's existing enrollments.

This reflected our previously discussed desire to ensure that questionable parties are unable to reenter the Medicare program (be it as a provider, supplier, owner, or manager) by using alternate identifiers. We were also concerned about situations where the provider or supplier has multiple enrollments, including those under different names, tax identification numbers, or other identifiers or business structures.

We proposed to consider the following factors in determining whether a denial is appropriate:

• The specific behavior in question.
• Whether the provider or supplier is the subject of other similar investigations.
• Any other information that we deem relevant to our determination.

Fifth, we proposed to expand § 405.371 to state that a Medicare payment suspension may be imposed if a state Medicaid program suspends payment pursuant to § 455.23(a)(1). Again, we expressed concern that possible fraudulent behavior in Medicaid might be repeated in Medicare.

We received the following comments regarding these proposals:

Comment: Regarding our proposal to expand the application of § 424.530(a)(7), a commenter questioned whether this authority applies if the payment suspension is later lifted or reversed.

Response: Under existing policy, if a Medicare enrollment application is denied under § 424.530(a)(7) because of a current payment suspension, the application denial is not reversed if the payment suspension is later lifted or reversed. Once the suspension ends, however, the provider or supplier may submit another initial application for enrollment.

Comment: A commenter expressed concern about denials based on terminations or suspensions that are under appeal because the latter actions can be caused by administrative or other error. The commenter recommended that CMS allow the appeals process to run its course before denying an application, stating that—(1) this would be consistent with due process; and (2) CMS would retain the ability to revoke the provider's enrollment if the appeal is unsuccessful.

Response: We respectfully disagree. If a provider or supplier has potentially engaged in questionable behavior, we should not be required to enroll the provider or supplier pending the completion of the appeals process or, in the case of payment suspensions, the rebuttal process under § 405.374. We must be able to take steps at the beginning of the enrollment process to protect the Medicare program, the Trust Funds, and beneficiaries from such risks.

After consideration of the comments received, we are finalizing our proposed changes to §§ 424.530(a)(7) and 405.371.

8. Other Federal Program Termination

To further protect Medicare from inappropriate activities occurring in other programs, we proposed two changes regarding denials and revocations.

a. Denials

We proposed in new § 424.530(a)(14) that CMS may deny a provider's or supplier's Medicare enrollment application if:

• The provider or supplier is currently terminated or suspended (or otherwise barred) from participation in a state Medicaid program or any other federal health care program; or
• The provider's or supplier's license is currently revoked or suspended in a state other than that in which the provider or supplier is enrolling.

Section 455.416(c) states that a Medicaid state agency must deny enrollment or terminate the enrollment of any provider that is terminated on or after January 1, 2011, under Medicare or the Medicaid program or CHIP of any other state. We explained in the proposed rule that § 424.530(a)(14) would facilitate consistency with the framework of § 455.416(c). Again, a provider's or supplier's improper behavior in another federal health care program may be duplicated in Medicare. Likewise, a Medicare provider's or supplier's actions that led to a license revocation or suspension in one state could be repeated with respect to its prospective enrollment in another state.

We stated in the proposed rule that a relevant program or license suspension warrants additional scrutiny, for the conduct behind the suspension could raise questions concerning the prospective provider's or supplier's ability to be a dependable Medicare participant. We recognized that license and federal program suspensions are generally temporary rather than permanent actions. Under certain conditions, however, license suspensions may be imposed for extended periods and involve serious transgressions. We believed that in circumstances triggering significant program integrity concerns, we should consider such conduct and determine the risk it poses before allowing the provider or supplier to enroll.

We stated that § 424.530(a)(14) could apply regardless of whether any appeals are pending. We acknowledge that, under current § 424.535(a)(12)(ii), we may not revoke a provider's or supplier's Medicare enrollment based on a Medicaid termination unless the provider or supplier has exhausted all applicable appeal rights regarding the Medicaid termination. Yet we did not believe a similar clause should apply to § 424.530(a)(14). As discussed earlier regarding license or federal program suspensions, Medicaid or other program terminations may be indicators of serious transgressions. We thus deemed it inappropriate to permit a Medicaid-terminated provider or supplier (or a provider or supplier terminated under any federal program) into Medicare simply because that party had not yet exhausted its appeal rights. In fact, such a clause might encourage the provider or supplier to file a frivolous appeal in order to enroll in Medicare prior to the exhaustion of its appeal rights.

In determining whether to invoke § 424.530(a)(14) in a particular case, we proposed to consider the following factors:

• The reason(s) for the termination, revocation, or suspension.
• Whether, as applicable, the provider or supplier:

++ Is currently terminated or suspended (or otherwise barred) from more than one program (for example, more than one state's Medicaid program);

++ Has been subject to any other sanctions during its participation in other programs or by any other state licensing boards; or

++ Has had any other final adverse actions imposed against it.

• Any other information that we deem relevant to our determination.

Consistent with our previously discussed rationale, we further proposed that § 424.530(a)(14) would apply to the provider or supplier under any of its current or former names, numerical identifiers, or business identities.

b. Revocations

Under existing § 424.535(a)(12), Medicare may revoke a provider's or supplier's enrollment if a state Medicaid agency terminates the provider's or supplier's Medicaid enrollment. Similar to our discussion concerning § 424.530(a)(14), we proposed to expand § 424.535(a)(12)(i) such that CMS may revoke a provider's or supplier's Medicare enrollment if the provider or supplier is terminated or revoked (or otherwise barred) from participation in any other federal health care program. In determining whether a revocation is appropriate, we proposed to consider the following factors:

• The reason(s) for the termination or revocation.
• Whether the provider or supplier:

++ Is currently terminated, revoked, or otherwise barred from more than one program (for example, more than one state's Medicaid program); or

++ Has been subject to any other sanctions during its participation in other programs.

• Any other information that we deem relevant to our determination.

Section 424.535(a)(12)(ii) states that Medicare may not terminate a provider's or supplier's enrollment unless and until a provider or supplier has exhausted all applicable appeal rights. We did not propose to modify this provision. We would not revoke a provider's or supplier's enrollment under paragraph (a)(12)(i) unless all applicable appeal rights relating to the termination have been exhausted.

In addition, and for reasons previously explained, we proposed to add new § 424.535(a)(12)(iii). This would enable us to apply § 424.535(a)(12)(i) to the provider or supplier under any of its current or former names, numerical identifiers, or business identities.

c. Comments Received

We received the following comments regarding these denial and revocation proposals:

Comment: A commenter stated that CMS should apply penalties only after a termination or suspension is final and not while it is being appealed. The commenter stated that this is similar to how CMS treats revocations.

Response: We respectfully disagree. As already stated, if a provider or supplier has perhaps engaged in questionable behavior, we should not be required to enroll the provider or supplier pending the completion of the appeals process. We must be able to protect the Medicare program, the Trust Funds, and beneficiaries from such risks at the beginning of the enrollment process. Waiting to take action until the end of a possibly lengthy appeals process could permit the provider or supplier to continue its behavior for an extended period. We also note that Medicare revocations may be and have been imposed prior to the expiration of the applicable Medicare appeals process.

Comment: A commenter supported our proposal to deny or revoke enrollment if the provider or supplier is currently terminated from a Medicaid or other federal health care program under any of its current or former names, numerical identifiers, or business entities. However, the commenter opposed the proposal to deny or revoke enrollment if the provider's or supplier's license is revoked in a state other than that in which the provider or supplier is enrolled or enrolling.

Response: We appreciate the commenter's support for our proposal addressing program terminations. Concerning out-of-state license terminations, we note that these denial and revocation authorities are discretionary and will only be exercised after a careful consideration of the specified factors. We add that these authorities regarding out-of-state license terminations are necessary because, once again, potentially improper conduct in one state can be repeated in another state.

After consideration of the comments received, we are finalizing new § 424.530(a)(14) and revised § 424.535(a)(12) as proposed with several exceptions. In § 424.530(a)(14), we are changing the phrase “particular State Medicaid program” to “State Medicaid program”. We believe that elimination of the term “particular” will help clarify that the provisions refer to any state Medicaid program rather than a specific one. In the same section, we are adding “(as that term is defined in § 424.502)” to § 424.530(a)(14)(i)(B) as a reference to the regulatory definition of final adverse actions. As for § 424.535(a)(12), we are changing “particular Medicaid program” to “State Medicaid program” for the same reason described above. Also, we are changing the term “terminate” to “revoke” in § 424.535(a)(12)(ii) to clarify that CMS revokes enrollments.

9. Extension of Revocation

We proposed in new § 424.535(i) that CMS may revoke any and all of a provider's or supplier's Medicare enrollments—including those under (1) different names, numerical identifiers, or business identities, and (2) different types (for example, an entity is enrolled as a group practice via the Form CMS-855B and a DMEPOS supplier via the Form CMS-855S—if the provider or supplier is revoked under § 424.535(a). This proposal was designed to make certain that parties that are revoked for inappropriate behavior are not permitted to remain enrolled in Medicare in any capacity. Consider the following examples:

• A physician's State X enrollment is revoked because his license in X was revoked. Under § 424.535(i), we also could revoke the physician's State Y enrollment even if he is still licensed in Y.
• An entity has two enrollments: One via the Form CMS-855A as a certified supplier, another via the Form CMS-855B as a group practice. The entity's Form CMS-855A enrollment is revoked under § 424.535(a)(4). Under § 424.535(i), CMS could also revoke the organization's Form CMS-855B enrollment, even if that enrollment is in another state.
• A non-physician practitioner is enrolled via the Form CMS-855I (OMB Control No. 0938-0685)) as an individual supplier and as a DMEPOS supplier via the Form CMS-855S. The individual's Form CMS-855I enrollment is revoked for abusive billing practices. Under § 424.535(i), CMS could also revoke her Form CMS-855S enrollment.

In determining whether to revoke a provider's or supplier's other enrollments under § 424.535(i), we proposed to consider the following factors:

• The reason for the revocation and the facts of the case.
• Whether any final adverse actions have been imposed against the provider or supplier regarding its other enrollments (for example, licensure suspensions imposed by the state, prior revocations, and/or payment suspensions).
• The number and type(s) of other enrollments (for instance, Form CMS-855B).
• Any other information that we deem relevant to our determination.

We stated that this provision would not be an “all or nothing” provision; that is, we would not be required to automatically revoke all of the provider's or supplier's other enrollments if we chose to invoke § 424.535(i). We would instead apply the previously listed factors to each enrollment in determining whether it should be revoked.

We received the following comments concerning this proposal:

Comment: A commenter contended that a separate justification for extending an enrollment/reactivation bar to related entities should be required. This should include, the commenter stated, a requirement that the secondary entities be found to pose an undue risk beyond the fact that the entity is related to a party that is subject to a warranted enrollment/reactivation bar. The commenter added that there should be no extension of an enrollment/reactivation bar until all appeals by the primary affected entity are concluded.

Response: We stated in the proposed rule that the factors outlined in § 424.535(i) would be individually applied to each location and enrollment. We still hold this position. However, we disagree with explicitly requiring an undue risk standard for other locations and enrollments. Secondary locations and enrollments, in our view, can pose as much (or even more) of a threat to the Medicare program as the principal ones. Accordingly, they should not be held to a different standard (via the undue risk threshold) than the primary locations and enrollments. We also do not believe that we should be required to wait until all appeals involving the principal location and enrollment have been exhausted before taking action against the secondary ones. CMS must retain the ability to take immediate steps to protect the Medicare program, the Trust Funds, and beneficiaries. Delaying action for a potentially lengthy period due to an ongoing appeals process would hinder this objective.

After consideration of the comments received, we are finalizing § 424.535(i) as proposed.

10. Voluntary Termination Pending Revocation

As we explained in section II.A. of the proposed rule, we have seen instances of providers and suppliers failing to meet Medicare requirements or otherwise engaging in improper behavior, and then voluntarily terminating their Medicare enrollment to avoid a potential revocation of their enrollment and a consequent reenrollment bar. For instance, assume that we perform a site visit of a provider's lone location. The site does not comply with our requirements. Knowing that its Medicare enrollment may soon be revoked, the provider submits a Form CMS-855 to voluntarily terminate its enrollment; the purpose, again, is to depart Medicare to avoid a formal revocation and reenrollment bar and any other consequences stemming therefrom.

We contended in the proposed rule that such attempts to circumvent the revocation process represent a risk to the Medicare program. Not only do they reflect dishonesty on the provider's or supplier's part, but also that the provider or supplier may be deliberately taking advantage of program vulnerabilities because no reenrollment bar has been imposed. To this end, we proposed in new § 424.535(j)(1) that we may revoke a provider's or supplier's Medicare enrollment if we determine that the provider or supplier voluntarily terminated its Medicare enrollment in order to avoid a revocation under § 424.535(a) that CMS would have imposed had the provider or supplier remained enrolled in Medicare. This would prevent the provider or supplier from avoiding a re-enrollment bar.

In making our determination, we proposed to consider the following factors:

• If there is evidence to suggest that the provider knew or should have known that it was or would be out of compliance with Medicare requirements.
• If there is evidence to suggest that the provider knew or should have known that its Medicare enrollment would be revoked.
• If there is evidence to suggest that the provider voluntarily terminated its Medicare enrollment in order to circumvent such revocation.
• Any other evidence or information that CMS deems relevant to its determination.

In new paragraph (j)(2), we proposed that a revocation under § 424.535(j)(1) would be effective the day before the Medicare contractor receives the provider's or supplier's Form CMS-855 voluntary termination application. We believed this date was appropriate because the provider's or supplier's submission of the voluntary termination application is the basis for the paragraph (j)(1) revocation. Procedurally, the voluntary termination would be reversed (if the Medicare contractor processed the application to completion) and the provider's or supplier's enrollment would then be revoked.

Although we received several comments regarding voluntary terminations in the context of our proposed affiliation disclosure requirements (see section II.A of this final rule with comment period), we received no comments specifically pertaining to § 424.535(j). Therefore, we are finalizing this proposal.

11. Enrollment for Ordering/Certifying/Referring/Prescribing of All Part A and B Services, Items, and Drugs; Maintenance of Documentation

a. Background of Part A and B Enrollment Proposal

Section 6405(c) of the Affordable Care Act gives the Secretary the authority to extend the requirements of section 6405(a) and (b) of the Affordable Care Act to all other categories of items or services under title XVIII of the Act (including covered Part D drugs) that are ordered, prescribed, or referred by a physician or eligible professional enrolled under section 1866(j) of the Act. Under this authority, existing § 424.507(a) and (b) collectively state that to receive payment for ordered imaging services, clinical laboratory services, DMEPOS items, or home health services, the service or item must have been ordered or certified by a physician or, when permitted, an eligible professional who—(1) is enrolled in Medicare in an approved status; or (2) has a valid opt-out affidavit on file with an Part A/B MAC.

Section 424.507(a) and (b) were implemented via an April 27, 2012 final rule titled “Medicare and Medicaid Programs; Changes in Provider and Supplier Enrollment, Ordering and Referring, and Documentation Requirements; and Changes in Provider Agreements” (77 FR 25284). Also, in the previously mentioned May 23, 2014 final rule (79 FR 29843), we finalized provisions under which the prescriptions of a physician or eligible professional who is not enrolled in Medicare and does not have a valid opt-out affidavit on file with an A/B MAC would not be covered under the Part D program.

The purpose of the provider enrollment process is to ensure that providers and suppliers that furnish services and items to Medicare beneficiaries meet all Medicare requirements. We stated in the proposed rule that the importance of confirming that all physicians and eligible professionals who order, certify, refer, or prescribe Part A or B services, items, or drugs (and not simply those services and items described in § 424.507) are qualified to do so dictated that we expand the purview of § 424.507. To this end, we proposed the following changes to § 424.507(a) and (b):

The heading to paragraph (a) currently reads—“Conditions for payment of claims for ordered covered imaging and clinical laboratory services and items of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS).” We proposed to change this to state: “Conditions for payment of claims for ordered, certified, referred, or prescribed covered Part A or B services, items, or drugs.”

The heading to existing paragraph (a)(1) reads—“Ordered covered imaging, clinical laboratory services, and DMEPOS item claims.” We proposed to change this to state: “Ordered, certified, referred, or prescribed covered Part A or B services, items or drugs.”

The opening sentence in paragraph (a)(1) currently states in part: “To receive payment for ordered imaging, clinical laboratory services, and DMEPOS items (excluding home health services described in § 424.507(b), and Part B drugs)”. We proposed to change this language to read: “To receive payment for ordered, certified, referred, or prescribed covered Part A or B services, items or drugs”.

Paragraph (a)(1)(i) states in part: “The ordered covered imaging, clinical laboratory services, and DMEPOS items (excluding home health services described in paragraph (b) of this section, and Part B drugs) must have been ordered by”. We proposed to change this language to: “The ordered, certified, referred, or prescribed covered Part A or B service, item, or drug must have been ordered, certified, referred, or prescribed by”.

In paragraph (a)(2), we proposed to change the heading from “Part B beneficiary claims” to “Part A and B beneficiary claims.” We also proposed to change the language that states “To receive payment for ordered covered items and services listed at § 424.507(a)” to “To receive payment for ordered, certified, referred, or prescribed covered Part A or B services, items or drugs”.

In paragraphs (a)(1)(ii) and (iii), and (a)(2)(i), we proposed to change the language that reads “who ordered the item or service” to “who ordered, certified, referred, or prescribed the Part A or B service, item, or drug”.

We proposed to change the existing language in paragraphs (a)(1)(iv) and (a)(2)(ii) that reads “If the item or service is ordered by” to “If the Part A or B service, item, or drug is ordered, certified, referred, or prescribed by”.

We proposed to revise the existing language in paragraphs (a)(1)(iv)(A)(1) and (a)(2)(ii)(A)(1) from “As the ordering supplier” to “As the ordering, certifying, referring or prescribing supplier”.

We proposed to change the current language in paragraphs (a)(1)(iv)(B) and (a)(2)(ii)(B) that reads “order such items and services” to “order, certify, refer, or prescribe such services, items, and drugs”.

In paragraphs (a)(1)(iv)(B)(1) and (a)(2)(ii)(B)(1), we proposed to replace the word “order” with “order, certify, refer, or prescribe”.

We proposed to delete the existing version of paragraph (b), which deals with home health services. Such services would be addressed in revised paragraph (a). We proposed to redesignate current paragraph (c) as revised paragraph (b). We also proposed in this paragraph to—

• Change the language that reads “covered items and services” to “ordered, certified, referred, or prescribed Part A or B services, items or drugs;”
• Delete “or (b)” and “and (b)”, since the existing version of paragraph (b) would be replaced;
• Change “paragraphs (a)(1)” to “paragraph (a)(1)”; and
• Delete “respectively.”

We proposed to redesignate current paragraph (d) as revised paragraph (c). We also proposed in this paragraph to:

• Change the language that reads “covered items or services” to “ordered, certified, referred, or prescribed covered Part A or B services, items or drugs”.
• Change the language that states “paragraphs (a) and (b)” to “paragraph (a).”
• Delete paragraph (d).

Our proposal included drugs that are covered under Part B. We believed that this, combined with § 423.120(c), would help confirm that all prescribers of Medicare drugs are thoroughly vetted for compliance with Medicare requirements.

We also proposed that our changes to § 424.507 would become effective on January 1, 2018 to give sufficient time for—(1) providers and suppliers to complete the enrollment or opt-out process; (2) stakeholders (including CMS and its contractors) to prepare for, operationalize, and implement these requirements; and (3) provider and beneficiary education.

In the April 27, 2012 final rule (77 FR 25291), we agreed with commenters that there were a number of operational issues associated with a requirement that services of a specialist be ordered or referred. We thus removed that requirement. However, with the successful implementation of the current version of § 424.507, we stated in the proposed rule that the expansion of § 424.507 to include other services can be fully operationalized.

b. Preclusion List for Medicare Advantage (MA) and Part D

In the previously mentioned May 23, 2014 final rule, we finalized provisions that would require Medicare Part D prescribers to enroll in or opt-out of the Medicare program in order to prescribe Part D drugs to Medicare beneficiaries. In a similar vein, we established provisions in a November 15, 2016 final rule (81 FR 80170) titled “Medicare Program; Revisions to Payment Policies Under the Physician Fee Schedule and Other Revisions to Part B for CY 2017; Medicare Advantage Bid Pricing Data Release; Medicare Advantage and Part D Medical Loss Ratio Data Release; Medicare Advantage Provider Network Requirements; Expansion of Medicare Diabetes Prevention Program Model; Medicare Shared Savings Program Requirements” requiring Medicare Advantage (MA) providers to enroll in Medicare in order to furnish MA services and items to Medicare beneficiaries. These provisions were intended to supplement those in § 424.507 by expanding the enrollment requirement to include MA and Part D, thereby strengthening the payment safeguard elements of the latter two programs.

During our preparations to implement the Part D and MA enrollment provisions by the January 1, 2019 effective date, several provider organizations expressed concerns about our forthcoming requirements. With respect to Part D, these organizations stated that—(1) most prescribers pose no risk to the Medicare program; (2) certain types of physicians and eligible professionals prescribe Part D drugs only very infrequently; and (3) the burden to the prescriber community would outweigh the program integrity benefits of the Part D enrollment requirement. Regarding MA, some stakeholders were, too, concerned about the burden of having to enroll in Medicare, particularly considering that MA organizations enrolling in Medicare must also undergo credentialing by their respective health plans. While enrolling such prescribers and providers gives Medicare a greater degree of scrutiny in determining a prescriber's or provider's qualifications, we noted that the perceived burden associated with this process could cause some prescribers and providers not to enroll in Medicare, thus possibly leading to access to care issues if such providers left MA networks as a result. As of early 2018, approximately 420,000 Part D prescribers and 120,000 MA providers remained unenrolled in Medicare.

Given these concerns, on April 16, 2018 we published in the Federal Register a final rule titled, “Medicare Program; Contract Year 2019 Policy and Technical Changes to the Medicare Advantage, Medicare Cost Plan, Medicare Fee-for-Service, the Medicare Prescription Drug Benefit Programs, and the PACE Program” (83 FR 16440) (hereafter referred to as the April 16, 2018 final rule). In that rule, we removed the MA and Part D enrollment requirements outlined in the May 23, 2014 and November 15, 2016 final rules, respectively. They were replaced with a payment-oriented (rather than an enrollment-based) approach by which we would focus on prescribers and providers that present an elevated risk to Medicare beneficiaries and the Trust Funds. Rather than require the enrollment of MA providers and Part D prescribers regardless of the level of risk they might pose, we would prevent payment for MA items or services and Part D drugs that are, as applicable, furnished or prescribed by demonstrably problematic prescribers and providers. To this end, the April 16, 2018 rule stated that—(1) such problematic parties would be placed on a “preclusion list”; and (2) payment for Part D drugs and MA services and items prescribed or furnished by these individuals and entities would be rejected or denied, as applicable. The implementation of the MA and Part D preclusion list policies began in late 2018.

c. Comments Received on Proposed Changes to § 424.507

We received a number of comments regarding our proposed changes to § 424.507. They focused on several matters. First, commenters expressed concern about the burden that would be involved in enrolling in Medicare to order, certify, refer, or prescribe Part A or B services, items, or drugs. Second, several stated that our proposal would negatively impact beneficiaries who seek care and treatment in emergency departments for acute illnesses or acute exacerbations of a chronic condition. Third, commenters requested that the proposed January 1, 2018 effective date was much too soon to enable stakeholders to prepare for these requirements and should be significantly pushed back.

Given the adoption of the preclusion list approach in lieu of MA and Part D enrollment and our interest in reducing burden on the provider and supplier community, we have decided not to finalize our proposed changes to § 424.507.

d. Maintenance of Documentation

In the November 19, 2008 Federal Register, we published a final rule titled, “Medicare Program; Payment Policies Under the Physician Fee Schedule and Other Revisions to Part B for CY 2009; E-Prescribing Exemption for Computer-Generated Facsimile Transmissions; and Payment for Certain Durable Medical Equipment, Prosthetics, Orthotics, and Supplies” (73 FR 69726). In that rule, we established § 424.516(f) stating that—(1) a provider or supplier is required to maintain ordering and referring documentation, including the NPI, received from a physician or eligible non-physician practitioner for 7 years from the date of service; and (2) physicians and non-physician practitioners are required to maintain written ordering and referring documentation for 7 years from the date of service.

Section 1866(a)(1) of the Act, which was amended by section 6406(b)(3) of the Affordable Care Act, require that providers and suppliers maintain and, upon request, provide to the Secretary access to written or electronic documentation relating to written orders or requests for payment for durable medical equipment, certifications for home health services, or referrals for other items or services written or ordered by the provider as specified by the Secretary. Under section 1842(h) of the Act, which was amended by section 6406(a) of the Affordable Care Act, the Secretary may revoke a physician's or supplier's enrollment if the physician or supplier fails to maintain and, upon request of the Secretary, provide access to documentation relating to written orders or requests for payment for durable medical equipment, certifications for home health services, or referrals for other items or services written or ordered by such physician or supplier, as specified by the Secretary.

Consistent with the authority given to the Secretary in sections 1866(a)(1) and 1842(h) of the Act, we revised § 424.516(f) in the previously referenced April 27, 2012 final rule to specify the following:

• Under paragraph (f)(1), a provider or supplier that furnishes covered ordered items of DMEPOS, clinical laboratory, imaging services, or covered ordered/certified home health services is required to maintain documentation for 7 years from the date of service, and provide access to that documentation upon the request of CMS or a Medicare contractor.
• Under paragraph (f)(2), a physician who orders/certifies home health services and the physician or, when permitted, other eligible professional who orders items of DMEPOS or clinical laboratory or imaging services is required to maintain documentation for 7 years from the date of service, and provide access to that documentation upon the request of CMS or a Medicare contractor.

The documentation in paragraphs (f)(1) and (2) includes written and electronic documents (including the NPI of the physician who ordered/certified the home health services and the NPI of the physician or, when permitted, other eligible professional who ordered items of DMEPOS or clinical laboratory or imaging services) relating to written orders and certifications and requests for payments for items of DMEPOS and clinical laboratory, imaging, and home health services.

We proposed to expand these requirements in § 424.516(f) to include all Part A and Part B services, items, and drugs that are ordered, certified, referred, or prescribed by a physician or, when permitted, eligible professional. Thus, the provider or supplier furnishing the Part A or B service, item, or drug, as well as the physician or, when permitted, eligible professional who ordered, certified, referred, or prescribed the service, item or drug, would have to maintain documentation for 7 years from the date of the service and furnish access to that documentation upon a CMS or Medicare contractor request. The documentation would include written and electronic documents (including the NPI of the ordering/certifying/referring/prescribing physician or, when permitted, eligible professional) relating to written orders, certifications, referrals, prescriptions, and requests for payments for a Part A or B service, item, or drug.

We stated in the proposed rule that it is important that payments for Part A and B services, items, and drugs be made correctly. Without being able to review the documentation addressed in § 424.516(f), we may be unable to confirm that the order, certification, referral, or prescription was proper and that the ordering, certifying, referring or prescribing individual was qualified. We further noted in the proposed rule our belief in the importance of revising § 424.516(f) to be consistent with our proposed changes to § 424.507. We stated that to require all persons who order, certify, refer, and prescribe Part A and B services, items, or drugs to enroll in Medicare without requiring them (or the billing provider) to retain supporting documentation would undercut the effectiveness of § 424.507. Although, as already mentioned, we are not finalizing our proposed changes to § 424.507, we maintain this view. We must be able to verify that the—(1) order, certification, referral, or prescription was appropriate; (2) ordering, certifying, referring or prescribing individual was qualified; and (3) payment at issue was correctly made.

We received the following comments regarding this proposal:

Comment: A commenter stated that the proposed 7-year documentation requirement was onerous, with seemingly no basis for such lengthy documentation retention. The commenter recommended that the proposed timeframe be reduced to 3 years, while recognizing that providers and suppliers may choose or be required (under state law) to maintain such documentation for longer periods.

Response: We believe that a 7-year period is appropriate and note that this timeframe has been in place in § 424.516(f) since its enactment in the previously mentioned November 19, 2008 final rule. We continue to believe that the timeframe must be of sufficient length to ensure that we can confirm the accuracy and legitimacy of prior orders, certifications, referrals, and prescriptions and the payments stemming therefrom. A 3-year period, in our view, would remove from our requirement certain documents that could help us execute this function.

Comment: A commenter concurred that the ordering provider should maintain the clinical justification for the imaging study. The commenter added that a radiology group—(1) need only maintain the documentation it receives from the ordering physician or non-physician practitioner; and (2) must ensure that the submitted information on the claim accurately reflects the information it received from the ordering physician or non-physician practitioner. Further, the commenter agreed that it is the ordering professional's responsibility to provide the documentation associated with the imaging order to CMS or a Medicare contractor.

Response: Portions of this comment are outside the scope of this final rule with comment period, but we appreciate the commenter's support.

Comment: A commenter sought clarification regarding—(1) the penalty for a physician who fails to maintain documentation under § 424.516(f); and (2) whether there is any penalty for the provider that supplied the care that the physician ordered, certified, or referred.

Response: Section 424.516(f) includes document retention requirements for — (1) the ordering, certifying, referring, or prescribing physician or eligible professional; and (2) the provider or supplier furnishing the service. Currently, failure to comply with these requirements may result in the revocation of the responsible party's enrollment under § 424.535(a)(1).

Comment: A commenter was concerned that certain dentists, such as locum tenens dentists or those who were formerly employed by a government agency or group dental practice, may be unable to comply with this proposal because they do not have control over the relevant documents. The commenter recommended that CMS place the burden for any recordkeeping compliance solely on the individual or entity who controls such records.

Response: Consistent with long-standing CMS policy, the physician for whom the locum tenens physician is substituting is responsible for retaining and furnishing the application documentation under § 424.516(f).

After consideration of the comments received, and for reasons stated previously, we are finalizing our revisions to § 424.516(f) as proposed notwithstanding the non-finalization of our proposal to revise § 424.507.

12. Opt-Out Physicians and Practitioners

As previously referenced, no Medicare payment (either directly or indirectly) will be made for services furnished by opt-out physicians or practitioners, except as permitted in accordance with §§ 405.435(c) and 405.440. The effects of opting-out are described in § 405.425. Section 405.425(i) states that an opt-out physician or practitioner who has not been excluded under sections 1128, 1156 or 1892 of the Act may order, certify the need for, or refer a beneficiary for Medicare-covered items and services, provided he or she is not paid directly or indirectly for such services (except as provided in § 405.440). Under § 405.425(j), an excluded physician or practitioner may not order, prescribe, or certify the need for Medicare-covered items and services, except as provided in 42 CFR 1001.1901, and must otherwise comply with the terms of the exclusion in accordance with 42 CFR 1001.1901.

We proposed to revise § 405.425(i) and (j) by including opt-out physicians and practitioners who are revoked under § 424.535. Thus, a revoked opt-out physician or practitioner would be unable to order, prescribe, and certify the need for or refer a beneficiary for Medicare-covered services and items except as otherwise provided in those paragraphs. We expressed concern that revoked physicians and practitioners who have opted-out could, through inappropriate ordering and certifying practices, pose a risk to Medicare beneficiaries. Our concern is heightened because opt-out physicians and practitioners are not subject to the same stringent enrollment and verification processes that enrolled physicians and practitioners are. Therefore, we believed that these proposed changes were necessary.

We received the following comment regarding our proposal:

Comment: A commenter expressed concern that there is no publicly available list of revocations and that, other than receiving a claim denial, it is unclear how the recipient of an order, prescription, certification, or referral would be able to identify an opt-out provider's revocation status. The commenter stated that CMS should not hold hospitals to this standard until there is a viable way to determine which ordering physicians have been revoked.

Response: We appreciate the commenter's concerns. While we are finalizing this provision, we may examine means to expand the scope of revocation data that is available to the public.

After reviewing the comment received, we are finalizing our proposal with three exceptions.

First, the opening language of § 405.425(j) states: “The physician or practitioner who is excluded . . . or whose Medicare enrollment is revoked under §  424.535 of this chapter may not order, prescribe or certify the need for Medicare-covered items and services except . . . ” We are changing the language “items and services” to “items, services, and drugs . . . ” The addition of the term “drugs” is meant to correspond with our addition of “prescribe” to § 405.425(j). To ensure consistency with this addition, we are also changing the language in § 405.425(i) that reads “may order, certify the need for, prescribe, or refer a beneficiary for Medicare-covered items and services” to “may order, certify the need for, prescribe, or refer a beneficiary for Medicare-covered items, services, and drugs”.

Second, the closing language of § 405.425(j) reads, ” . . . except as provided in § 1001.1901 of this title, and must otherwise comply with the terms of the exclusion in accordance with § 1001.1901 effective with the date of the exclusion.” Because § 1001.1901 of this title only applies to excluded individuals and entities, we are clarifying that the references to § 1001.1901 in § 405.425(j) are inapplicable to revocations. We are therefore revising § 405.425(j) to read, ” . . . except, with respect to exclusions, as provided in § 1001.1901 of this title, and must otherwise comply with the terms of any exclusion in accordance with § 1001.1901 effective with the date of the exclusion.”

Third, the opening language of § 405.425(i) specifies that: “The physician or practitioner who has not been excluded under sections 1128, 1156 or 1892 of Social Security Act or whose Medicare enrollment is not revoked under § 424.535 of this chapter may order, certify the need for, prescribe. . . .” We are changing the phrase “or whose Medicare enrollment” to “and whose Medicare enrollment.” This is to clarify our intention that a physician or practitioner must be neither excluded nor revoked in order to conduct the activities addressed in paragraph (i).

13. Moratoria

Under § 424.570(a), CMS may impose a temporary moratorium on the enrollment of new Medicare providers and suppliers of a particular type or the establishment of new practice locations of a particular type in a particular geographic area. Per § 424.570(a)(2)(i), a moratorium is imposed when CMS determines that there is a significant potential for fraud, waste, or abuse with respect to a particular provider or supplier type, a particular geographic area, or both. Consistent with this authority, we have published several Federal Register documents announcing the imposition of temporary moratoria on the enrollment of HHAs and certain ambulance suppliers. (See, for example, the July 31, 2013 (78 FR 46339) and February 4, 2014 (79 FR 6475) Federal Registers.)

We proposed several changes to § 424.570(a).

a. Change in Practice Location

Section 424.570(a)(1)(iii) states that a temporary moratorium does not apply to changes in practice locations, changes in provider or supplier information (such as phone numbers), or changes in ownership (except changes in ownership of HHAs that would require an initial enrollment under § 424.550)).

We proposed three revisions to § 424.570(a)(1)(iii).

The first proposal divided the current version of § 424.570(a)(1)(iii) into paragraphs (a)(1)(iii)(A), (B), and (C) so that each requirement mentioned in paragraph (a)(1)(iii) could be addressed individually.

Secondly, we clarified in paragraph (a)(1)(iii)(A) (which would address practice locations) that a temporary moratorium applies to situations in which a provider or supplier is changing a practice location from a location outside the moratorium area to a location inside the moratorium area. We saw no difference between this situation and one in which a provider or supplier is opening a brand new practice location in the moratorium area. In both cases, an additional site is being established in the moratorium area, something the moratorium is designed to prevent. We thus believed this change was necessary.

Lastly, we proposed to clarify the existing policy in paragraph (a)(1)(iii)(C) by removing the language “under § 424.550”. Under § 489.18(c), if an HHA changes ownership as specified in § 489.18(a), the existing provider agreement is automatically assigned to the new owner. However, if the new owner declines to accept the assets and liabilities of the HHA and refuses assignment of the provider agreement, § 489.18(c) does not apply and the HHA must enroll as a new provider via an initial enrollment. The existing reference to § 424.550 in paragraph (a)(1)(iii) may have caused some confusion on this point. Accordingly, we proposed to remove this reference in order to clarify current policy.

b. Application of Moratorium

Section 424.570(a)(1)(iv) currently states that a temporary enrollment moratorium does not apply to any enrollment application that has been approved by the enrollment contractor but not yet entered into PECOS at the time the moratorium is imposed. We proposed to revise this paragraph to state that a temporary moratorium does not apply to any enrollment application received by the Medicare contractor prior to the date the moratorium is imposed.

In the moratoria that have been imposed, some providers and suppliers have spent significant resources to prepare for enrollment only to have their Form CMS-855 applications denied near the end of the enrollment process because of the sudden imposition of a moratorium. This has been especially problematic for HHAs—(1) whose Form CMS-855A applications, at the time a moratorium is imposed, have been recommended for approval by the contractor; (2) that have successfully completed a state survey; and (3) whose applications and survey results have been forwarded by the state to a CMS Regional Office for final review. This entire process, much of which occurs after an application is received by the contractor but before the application is finally approved by the contractor, can take a substantial amount of time, and the considerable resources the provider or supplier may have expended by this point are effectively lost when CMS imposes a moratorium.

We stated that this has been an unintended consequence of the moratoria. In our view, the overall objective of the moratoria—the need to reduce the potential for fraud, waste, or abuse in certain geographic areas—can be equally satisfied by not applying a moratorium to applications submitted before the moratorium is imposed, irrespective of whether they have been approved. Therefore, we believed that our proposed “prior to the moratorium date” threshold was an appropriate balance between limiting provider burden and protecting the integrity of the Medicare program and the Trust Funds.

We also proposed in § 424.570(a)(1)(iv) to change the term “enrollment contractor” to “Medicare contractor.” We believed the latter term is more consistent with CMS' use of MACs.

We received the following comments regarding our proposed revisions to § 424.570.

Comment: A few commenters supported our proposed addition of § 424.570(a)(1)(iv).

Response: We appreciate the commenters' support.

Commenter: A commenter opposed our proposed revision to § 424.570(a)(1)(iii), stating that it would prevent an entity from relocating its office into the moratoria area while maintaining its existing service area. As a result, the moratoria would erect unnecessary barriers to enhancement of care quality and block the cost efficiencies that relocation could bring. The commenter recommended that CMS permit a practice location change from outside the moratoria area to inside the area when a provider can demonstrate that it currently has the moratoria area as a service area.

Response: We respectfully disagree with this recommendation. As we stated in the proposed rule, we see no difference between the relocation of an office into a moratorium area and the opening of a brand new practice location in the moratorium area. In both cases, an additional site is being established in the moratorium area, something the moratorium is designed to prevent. We also stress that § 424.570 is and has been focused on the specific location of the office site itself rather than on the larger area that the provider services. Therefore, we believe this change is necessary and vital to protecting the integrity of the Medicare program.

Comment: A commenter stated, for CMS' consideration, that the current prohibitions against (1) the establishment of new HHA branch offices and (2) allowing established provider organizations outside the moratorium area to expand into the moratorium area can lock in some of the providers that CMS seeks to address through its program integrity initiatives. In other words, the commenter explained, the prohibitions in some ways maintain the status quo rather than producing the desired change. . The commenter added that it could also restrict the opportunity for patients and referral sources to choose a more compliant provider organization.

Response: We appreciate the commenter's suggestion. For reasons previously stated, however, we believe that our revision of § 424.570(a)(1)(iii) is consistent with the purpose of a temporary enrollment moratorium and is warranted in order to protect the integrity of the Medicare program.

After consideration of these comments, we are finalizing our proposed revisions to § 424.570.

14. Surety Bonds

Since 2009, certain DMEPOS suppliers have been required under § 424.57(d) to obtain, submit, and maintain a surety bond in an amount of at least $50,000 as a condition of enrollment. Paragraph (d)(5)(i) states that the surety bond must guarantee that the surety will—within 30 days of receiving written notice from CMS containing sufficient evidence to establish the surety's liability under the bond of unpaid claims, CMPs, or assessments—pay CMS a total of up to the full penal amount of the bond in the following amounts: (1) The amount of any unpaid claim, plus accrued interest, for which the DMEPOS supplier is responsible; and (2) the amount of any unpaid claims, CMPs, or assessments imposed by CMS or the OIG on the DMEPOS supplier, plus accrued interest. Paragraph (d)(5)(ii), meanwhile, states that the surety bond must provide that the surety is liable for unpaid claims, CMPs, or assessments that occur during the term of the bond.

We have specific procedures for collecting monies from sureties in accordance with § 424.57(d)(5) and have recouped several million dollars via these procedures. However, we have encountered instances where the surety has failed to submit payment to CMS, notwithstanding its obligation to do so under both § 424.57(d)(5) and the surety bond's terms. We stated in the proposed rule that CMS should not permit a DMEPOS supplier to use that particular surety when the latter has not fulfilled its legal responsibilities to us as the obligee under the surety bond. We thus proposed in new § 424.57(d)(16) that CMS may reject an enrolling or enrolled DMEPOS supplier's new or existing surety bond if the surety that issued the bond has failed to make a required payment to CMS in accordance with § 424.57(d). This means that we could reject any and all surety bonds furnished by the surety to enrolling or enrolled DMEPOS suppliers under § 424.57(d), not just the surety bond(s) on which the surety refused to make payment. If we reject a surety bond under proposed § 424.57(d)(16), the enrolling or enrolled DMEPOS supplier would have to obtain a bond from a new surety in order to enroll in or maintain its enrollment in Medicare.

We illustrated how § 424.57(d)(16) would operate with this example. Suppose a surety has issued surety bonds for DMEPOS Suppliers W, X, Y, and Z, all of which are enrolled in Medicare. CMS sought to collect from the surety on the bond issued for Supplier X, but the surety failed to make payment. We would have the discretion to—(1) reject the bonds for W, X, Y, and Z, thus requiring the suppliers to obtain new bonds from a different surety; and (2) refuse to accept future bonds issued to DMEPOS suppliers by the non-compliant surety.

In making a determination under items (1) and (2) in the previous sentence, we proposed to consider the following factors:

• The total number of Medicare-enrolled DMEPOS suppliers to which the surety has issued surety bonds.
• The total number of instances in which the surety has failed to make payment to CMS.
• The reason(s) for the surety's failure(s) to pay.
• The percentage of instances in which the surety has failed to pay.
• The total amount of money that the surety has failed to pay.
• Any other information that CMS deems relevant to its determination.

Although CMS would reserve the right to reject all of a surety's existing bonds with Medicare-enrolled DMEPOS suppliers if the surety failed to make even one required payment, CMS would take into account the circumstances surrounding the surety and its failure to make payment per the aforementioned factors.

Comment: A commenter opposed our proposed addition of § 424.57(d)(16) on several grounds. First, the commenter contended that the proposal changes the surety bond requirement under § 424.57(d) from a conditional obligation for the surety (that is, the surety must currently pay only if, for instance, (1) the DMEPOS supplier's non-payment of the claim; and (2) sufficient evidence to establish liability being presented to the surety) to a demand obligation. The commenter stated that the threat of rejection under § 424.57(d)(16) as a means of coercing sureties to pay legitimately disputed claims effectively converts the bond to a demand obligation.

Second, the commenter stated that the surety should have an opportunity before an impartial tribunal to present its defenses (and those of the DMEPOS supplier) and explain why payment is not due. Sureties are not supposed to advocate for the supplier but merely pay the bond. The imposition of § 424.57(d)(16) requires due process for the surety.

Third, the commenter stated that sureties would respond to the increased risk that § 424.57(d)(16) poses by tightening its underwriting requirements, meaning that fewer DMEPOS suppliers would be able to obtain bonds.

Fourth, the commenter explained that § 424.57(d)(16) would effectively amount to a debarment of the surety; debarment authority, however, is vested in the Department of Treasury.

Fifth, the commenter stated that § 424.57(d)(16) does not comply with the requirements of 31 CFR 223.17, which permits an agency to refuse future bonds from a surety “for cause”; this includes failing to pay an administratively final bond obligation. Some of the commenters contentions included—(1) CMS does not articulate its procedures and “for cause” standards for declining to accept bonds in an agency regulation or for declining bonds in specific cases; (2) the provision does not define when a bond obligation becomes administratively final under agency procedures, establish advance notice, or give the surety an opportunity to cure or rebut; (3) the provision does not allow the surety an opportunity to be heard, to confront and cross-examine witnesses, to be represented by for counsel, to submit evidence, or to have an impartial decision-maker.

Sixth, the commenter contended that there is a strong presumption of judicial review of administrative actions; with respect to prohibiting sureties from providing bonds, Congress has actually required judicial involvement. The commenter stated that § 9305(e) prohibits a surety from providing further bonds if it has failed to pay a final judgment. The commenter concluded because the proposed regulation does not comply with 31 CFR 223.17, including rudimentary due process protection, CMS may not exercise any authority to reject bonds.

Response: We appreciate the commenter's concerns. After reviewing these comments, and given the complexity of certain operational aspects of our proposal, we are not finalizing proposed § 424.57(d)(16) in this rule.

Comment: A commenter stated that CMS should not implement § 424.57(d)(16) without several prerequisites. First, CMS must create tools to help sureties understand a supplier's history and also develop a process for issuing claims against sureties. Second, the commenter believed that since sureties likely have not seen or commented on this proposal, CMS should issue a proposed rule specific to the surety bond issues under discussion; this should include a process for filing a claim against a surety. Third, the GAO should complete a study on the entire surety bond process and its guidelines before CMS institutes the policies addressed in this final rule. Fourth, CMS should clarify that one bond can cover the requirement for both Medicare and Medicaid programs for a particular location. The commenter stated that many state Medicaid programs will not accept a supplier's bond if it shows CMS as the Obligee but will require the supplier to obtain a second bond showing Medicaid as the Obligee. Since the bonds are required to be under the Obligee of CMS, the commenter stated, one bond should cover the requirements for both programs.

Response: As previously stated, we are not finalizing proposed § 424.57(d)(16).

After consideration of the comments received, we are not finalizing proposed § 424.57(d)(16).

15. Reactivation

Under § 424.540(a), a provider's or supplier's Medicare billing privileges may be deactivated if the provider or supplier fails to—(1) submit any Medicare claims for 12 consecutive calendar months; (2) report a change to its Medicare enrollment information within 90 calendar days (or, for changes in ownership or control, within 30 days); or (3) furnish complete and accurate information and all supporting documentation within 90 calendar days of receipt of notification from CMS to submit an enrollment application and supporting documentation, or to resubmit and certify the accuracy of its enrollment information. To reactivate its billing privileges, the provider or supplier must follow the requirements of § 424.540(b). Specifically—

• Paragraph (b)(1) states that if the provider or supplier is deactivated for any reason other than non-submission of a claim, the provider or supplier must submit a new enrollment application or, when deemed appropriate, recertify that the enrollment information currently on file with Medicare is correct; and
• Paragraph (b)(2) states that if the provider or supplier is deactivated for non-submission of a claim, it must recertify that the enrollment information currently on file with Medicare is correct and furnish any missing information as appropriate.

We proposed to revise paragraph (b) in two ways. Paragraph (b)(1) would state that in order for a deactivated provider or supplier to reactivate its Medicare billing privileges, it must recertify that its enrollment information currently on file with Medicare is correct and furnish any missing information as appropriate. Paragraph (b)(2) would state that notwithstanding paragraph (b)(1), CMS may for any reason require a deactivated provider or supplier to submit a complete Form CMS-855 application as a prerequisite for reactivating its billing privileges.

There were several reasons for these proposed changes. First, the existing language in § 424.540(b)(1) had been a source of confusion for providers and suppliers because it does not articulate what the phrase “when deemed appropriate” means. There also is some repetition between paragraphs (b)(1) and (2), for both indicate that a recertification is acceptable. Our proposed version of paragraph (b)(1), which combined parts of existing paragraphs (b)(1) and (2), clarified that a provider or supplier may use recertification—regardless of the deactivation reason—as a means of reactivation.

Second, we believed that CMS should have the discretion to require at any time the submission of a complete Form CMS-855 reactivation application irrespective of the deactivation reason. The Form CMS-855 captures information about the provider or supplier that, in the case of a reactivation, would help us determine whether the provider or supplier is still in compliance with Medicare enrollment requirements. A recertification, meanwhile, generally only consists of a statement from the provider or supplier that the information on file is correct and, if necessary, the submission of Form CMS-855 pages containing updated information. Therefore, the Form CMS-855 collects more information than the recertification submission, and there may be situations where CMS determines that a complete application must be submitted. These could include, but are not limited to, the following:

• The provider or supplier was deactivated for failing to submit a claim for 12 consecutive months and has been deactivated for at least 6 months.
• The provider or supplier does not have access to internet-based PECOS.
• The provider or supplier was deactivated for failing to report a change of information.

In these circumstances, respectively, the provider or supplier—(1) has not submitted a claim for at least 18 months; (2) cannot view its existing enrollment data and thus may be unable to determine the accuracy of this information; and (3) previously failed to comply with Medicare requirements by not timely reporting changed enrollment data. Such instances, in our view, raise questions as to the validity of the provider's or supplier's current enrollment information and possibly its compliance with existing Medicare requirements, thus warranting a complete Form CMS-855 if we deem it necessary. We stressed that we could request a complete application in any reactivation situation, not simply those outlined in this section. We solicited comment on whether we should restrict the reasons for which CMS may request a complete reactivation application and, if so, what those reasons should be.

While we proposed to revise § 424.540(b)(1) and (2) as previously described, we did not propose any changes to § 424.540(b)(3).

We received no comments regarding our proposed changes to § 424.540 and are therefore finalizing them.

16. Changes to Definition of Enrollment

We proposed several additional changes to 42 CFR part 424 to address the general concept of enrollment as it pertains to the Form CMS-855O (OMB Control No. 0938-1135). This form is used by physicians and eligible professionals seeking to enroll in Medicare solely to order and certify certain items or services and/or prescribe Part D drugs.

We received no comments on any of the proposals outlined in this section II.B.16. Given, however, our above-referenced non-finalization of our revisions to § 424.507 and our elimination of the Part D enrollment requirement, we believe that many of these section II.B.16 proposed changes may be unnecessary. We are therefore finalizing, modifying, and/or not finalizing these provisions as follows.

a. Definition of “Enroll/Enrollment” (§ 424.502)

We proposed several revisions of the existing definition of “Enroll/Enrollment” in § 424.502.

First, the opening sentence of the definition currently specifies that enroll/enrollment means the process that Medicare uses to establish eligibility to submit claims for Medicare-covered items and services, and the process that Medicare uses to establish eligibility to order or certify Medicare-covered items and services. We proposed to change this definition to specify that enroll/enrollment means the process that Medicare uses to establish eligibility to submit claims for Medicare-covered items and services, and the process that Medicare uses to establish eligibility to order, certify, refer, or prescribe Medicare-covered Part A or B services, items or drugs or to prescribe Part D drugs.” There were two reasons for this proposed change. One was to align this definition with the language in our proposed revisions to § 424.507(a) and (b). (See section II.A.12. of this final rule with comment period.) The second was to address in this definition the enrollment provisions in § 423.120(c)(6) relating to Part D drugs.

Second, the current version of paragraph (2) of the definition of “Enroll/Enrollment” specifies that except for those suppliers that complete the Form CMS-855O form, CMS-identified equivalent, successor form or process for the sole purpose of obtaining eligibility to order or certify Medicare-covered items and services, validating the provider or supplier's eligibility to provide items or services to Medicare beneficiaries. We proposed to change this to provide that except for those suppliers that complete the Form CMS-855O, CMS-identified equivalent, successor form or process for the sole purpose of obtaining eligibility to order, certify, refer, or prescribe Medicare-covered Part A or B services, items or drugs or to prescribe Part D drugs, validating the provider's or supplier's eligibility to provide items or services to Medicare beneficiaries. This revision was to clarify that a supplier's completion of the Form CMS-855O solely to obtain eligibility to order, certify, refer, or prescribe Medicare-covered Part A or B services, items or drugs or to prescribe Part D drugs, does not convey Medicare billing privileges to the supplier.

Third, and for reasons similar to those involving our proposed change to paragraph (2) of the definition of “Enroll/Enrollment,” we proposed to revise paragraph (4) thereof. The new version of paragraph (4) would specify that except for those suppliers that complete the Form CMS-855O, CMS-identified equivalent, successor form or process for the sole purpose of obtaining eligibility to order, certify, refer, or prescribe Medicare-covered Part A or B services, items or drugs or to prescribe Part D drugs, granting the Medicare provider or supplier Medicare billing privileges.

As we are not finalizing our proposed revisions to § 424.507 and in light of the rescission of the Part D enrollment requirement, we do not believe these proposed changes to the definition of “Enroll/Enrollment” in § 424.502 are necessary. We therefore decline to finalize them.

b. Revision to § 424.505

We also proposed to replace the language in § 424.505 that states “to order or certify Medicare-covered items and services” with “to order, certify, refer, or prescribe Medicare-covered Part A or B services, items or drugs or to prescribe Part D drugs.”

This was to clarify that completion of the Form CMS-855O does not convey Medicare billing privileges to the supplier. For the same reasons behind our non-finalization of our proposed revisions to the “Enroll/Enrollment” definition in § 424.502, we are not finalizing our proposed change to § 424.505.

c. Revision to § 424.510(a)(3)

Section 424.510(a)(3) currently specifies that to be enrolled solely to order and certify Medicare items or services, a physician or non-physician practitioner must meet the requirements specified in paragraph (d) except for paragraphs (d)(2)(iii)(B), (d)(2)(iv), (d)(3)(ii), and (d)(5), (6), and (9). We proposed to revise this to specify that to be enrolled solely to order, certify, refer, or prescribe Medicare-covered Part A or B services, items or drugs or to prescribe Part D drugs, a physician or non-physician practitioner must meet the requirements specified in paragraph (d) except for paragraphs (d)(2)(iii)(B), (d)(2)(iv), (d)(3)(ii), and (d)(5), (6), and (9). This proposal was intended to include within the purview of § 424.510(a)(3) those suppliers who are enrolling via the Form CMS-855O pursuant to § 423.120(c)(6) or pursuant to our proposed revisions to § 424.507(a) and (b).

However, for reasons similar to those discussed previously, we are not finalizing this change.

d. Revision to § 424.535(a)

We also proposed to change the term “billing privileges” in the opening paragraph of § 424.535(a) to “enrollment.” The paragraph would thus read: “CMS may revoke a currently enrolled provider's or supplier's Medicare enrollment and any corresponding provider agreement or supplier agreement for the following reasons”. This was to clarify that the revocation reasons in § 424.535(a) apply to all enrolled parties, including suppliers who are enrolled solely to order, certify, refer, or prescribe Medicare-covered Part A or B services, items, or drugs, or to prescribe Part D drugs; the reasons are not limited to providers and suppliers that have Medicare billing privileges. Thus, for instance, a Part D prescriber's Medicare enrollment may be revoked if one of the revocation reasons in § 424.535(a) applies.

We note also that the opening paragraph of § 424.530(a), which deals with denials, uses the term “enrollment” as well. Our change to § 424.535(a) would achieve consistency with § 424.530(a) in this regard.

Notwithstanding the non-finalization of the proposed changes to § 424.507 and the removal of the Part D enrollment requirement, we believe that this proposed clarification to § 424.535(a) remains necessary. This is because some providers and suppliers (for example, DMEPOS suppliers; physicians who certify home health services) are still required under § 424.507(a) to enroll in Medicare to order or certify certain Medicare items or services. We are thus finalizing this revision.

In addition, we are removing the phrase “or supplier agreement” from § 424.535(a). We believe that the reference to “supplier agreement” in this paragraph has caused confusion.

17. Miscellaneous Comments

We also received the following miscellaneous comments:

Comment: A commenter questioned whether a prescriber whose enrollment has been denied or revoked and has been terminated on the Medicare Individual Provider List will still qualify for provisional fills and, if not, how they will be identified.

Response: This comment is outside the scope of this rule.

Comment: A commenter stated that there must be stricter requirements that individuals must meet before being approved for Medicare, Medicaid, or CHIP. The commenter stated that—(1) there should be a marketing committee established to go into low-income neighborhoods to educate individuals about government health insurance assistance programs and to work to enroll individuals who meet the requirements; and (2) after these individuals are enrolled into a qualified health insurance program, there should be a follow-up conducted every 3 months to ensure that the individual still meets the requirements and that there is no increase in his or her income. The commenter added that conducting daily license and background monitoring will help individuals who are misusing their access to these federal health insurance assistance programs. Moreover, the commenter stated that there should be a fine for individuals who commit fraud relating to a failure to report changes that have been made to their income or even if they no longer need the assistance of their federal health insurance.

Response: This comment is outside the scope of this rule.

Comment: A commenter commended CMS for continuing work on anti-fraud issues in the proposed rule and recommended that the agency emphasize the use of cost-effective anesthesia care provided by certified registered nurse anesthetists (CRNAs). Anesthesiologist medical direction reimbursement models, the commenter stated, contribute to increased healthcare system costs without improving access or quality. They also present fraud risk when medical direction requirements are not met by the anesthesiologist submitting a claim for such services. The commenter stated that CMS should—(1) direct Medicare, Medicaid and CHIP programs to consider such costs in developing and carrying out their systems for anesthesia reimbursement, and to favor reimbursement systems that support the most cost-effective and safe anesthesia delivery models, such as for non-medically directed CRNA services; and (2) direct states to eliminate from their Medicaid plans such requirements for medical direction of CRNA services.

Response: This comment is outside the scope of this rule.

Comment: A commenter stated that the proposed rule does not specify how long CMS might suspend payments to wrongly accused providers. The commenter requested further clarification on the timeline CMS envisions for due process in cases where payments are suspended due to suspected fraud.

Response: This comment is outside the scope of this rule.

Comment: A commenter expressed concern about providers and suppliers repeatedly changing their names and identities to avoid sanctions. The commenter suggested that if the provider is about to be revoked due to a questionable situation, it should be allowed 30 days to change its practices or procedures. If it fails to comply with CMS regulations—(1) its enrollment should be revoked; and (2) the revoked status should apply to the name of the provider as well as everyone in management, billing, and any other identifications regarding that business. This would prevent the owners from filing for a new federal employee identification number (FEIN), a new business license from the state, and “opening” a new business in the same location. If CMS could develop this ability, the commenter stated, it could track this type of fraudulent activity and prevent such situations from happening.

Response: We appreciate these suggestions and will take them into consideration as we continue to explore additional means of protecting the Trust Funds from improper behavior.

Comment: A commenter stated that when seeking enrollment in Medicare, a provider should furnish supporting documentation to establish its identity and the business that it is conducting. This could include—(1) documentation of state licensure to practice and/or state business licensure; (2) federal payroll information proving that the provider has employees or is paying payroll taxes; (3) receipts of sales for services to customers that are not being billed through CMS; (4) any and all legal matters that are being investigated for fraud or misrepresentation; (5) for practicing physicians, a copy of his or her malpractice insurance, and a report of the number of malpractice cases pending or settled on his or her behalf; and (6) a background report from the OIG on all employees and managing partners that will be involved in the billing process. The commenter stated that by providing this additional information, CMS can more easily determine the nature and character of the individual or business applying for enrollment.

Response: We appreciate these suggestions and will take them into consideration as we continue to explore additional means of protecting the Trust Funds from improper behavior.

Comment: A commenter stated that the high burden of the proposed rule could force innocent providers and suppliers to downscale or close their practices altogether, which could cause access to care issues. Another commenter stated that the final rule should focus on organizations with historical integrity issues versus a “wide swath” approach.

Response: We appreciate these concerns. As previously explained, however, we have, among other things—(1) modified our affiliation disclosure provisions; and (2) consistently emphasized in this final rule with comment period that we will exercise our denial and revocation authorities in a cautious, careful, and judicious manner, and not as a routine matter of course.

Comment: A commenter expressed concern about the disclosure of SSNs as part of the enrollment process, citing the need to protect providers and suppliers and their owners and managers against identity theft. The commenter suggested that CMS—(1) consider the need to eliminate SSN disclosure; (2) work with key stakeholders to integrate Medicare/Medicaid/NPI enrollment into PECOS, thereby reducing the need for multiple submissions of SSNs to different programs and eliminating duplicative work for providers, CMS, contractors and the states; and/or (3) consider establishing a pseudo-identifier in lieu of the NPI.

Response: We appreciate these suggestions and will take them into consideration as we continue to explore additional means of protecting the Trust Funds from improper behavior.

Comment: A commenter stated that, with more than 60,000 DMEPOS suppliers enrolled in Medicare, CMS should discontinue its practice of allowing Medicare beneficiaries to submit claims for DMEPOS services.

Response: This comment is outside the scope of this rule.

Comment: A commenter requested that CMS clarify which NPI is entered into the ordering and referring field of the 837P by a locum tenens physician.

Response: This comment is outside the scope of this rule.

Comment: A commenter recommended that CMS discontinue permitting physicians and other practitioners who have their Medicare billing privileges suspended from ordering, certifying, or prescribing in the Medicare program during the period of said suspension.

Response: This comment is outside the scope of this rule. We also note that, under current policy, Medicare billing privileges are not “suspended” but are instead either denied or revoked. However, Medicare payments may be suspended under § 405.371.

Comment: A commenter recommended that CMS implement the necessary edits within its claims processing systems to link a claim with a Medicare order or certification for DMEPOS or lab services with the name and NPI of the practitioner who furnished the service. The commenter believed that this change would prevent suppliers from submitting a claim with the name and NPI of a physician that has not seen the patient.

Response: This comment is outside the scope of this rule.

Comment: A commenter requested clarification regarding the rationale for allowing Medicare beneficiaries to submit—(1) DMEPOS claims from suppliers that are not accredited; and (2) the CMS-1490 without the name and NPI of the ordering physician. With the latter, the commenter requested an explanation for why CMS does not have policies for its contractors to request that name and NPI of the physician, recommended that contractors require beneficiaries to submit this information, and that contractors verify this information before paying a Medicare claim.

Response: This comment is outside the scope of this rule.

Comment: A commenter requested clarification as to whether a beneficiary can submit a claim for a DMEPOS item when the DMEPOS supplier is not enrolled in Medicare. The commenter stated that CMS permits this practice.

Response: This comment is outside the scope of this rule.

Comment: A commenter sought clarification regarding—(1) whether a beneficiary can be paid for DMEPOS when the item or service is obtained from a non-Medicare supplier or is ordered or referred from an unenrolled physician; (2) how contractors verify whether the ordering physician is Medicare-enrolled when the information about the ordering physician is not on the Medicare beneficiary claim form; (3) whether Medicare will pay a beneficiary for services when the DMEPOS supplier does not have a valid supplier number; (4) the number of beneficiary DMEPOS claims paid in 2015; and (5) whether CMS' new policies for Medicare beneficiaries will prevent beneficiaries from submitting claims for off-the-shelf DMEPOS or items purchased at a store that does not participate in Medicare.

Response: These comments are outside the scope of this rule.

Comment: A commenter urged CMS and its contractors to structure their teams to measure and promote continuity with provider organizations. The commenter stated that it is important for CMS and its contractors to build solid working relationships with local providers and organizations that serve Medicare beneficiaries.

Response: This comment is outside the scope of this rule.

Comment: A commenter stated that the proposed rule unfairly penalizes all providers and suppliers even when there is no risk of fraud, abuse and waste. Specifically, the proposal—(1) increases the administrative burden and complexity of the enrollment process; (2) severely penalizes providers for inadvertent errors without any recourse for them; (3) potentially exceeds and contravenes the statutory authority granted to CMS through the Affordable Care Act; (4) allows CMS to pierce to corporate veil and ignore corporate formalities; and (5) creates a de facto exclusion with no accompanying due process. In particular, the commenter stated that due process for a denied or revoked provider or supplier under the rule is impossible within the existing appeals process. The commenter contended that the current appeals process furnishes too short a timeframe for providers and suppliers to compile and submit evidence of compliance, does not permit expedited appeals (which could severely hurt cash flow), and contains no process for timely restoring a provider's or supplier's enrollment and for reversing any concomitant overpayment demand or recalling any debt referral. The commenter made two specific recommendations concerning the appeals process. First, CMS should modify its existing appeals processes so that providers and suppliers can effectively appeal denials and revocations. Second, in the case of an overpayment demand for services billed from the retroactive effective date of a revocation, the overpayment obligation should be stayed to allow providers and suppliers to utilize the appeals process.

Response: This comment is outside the scope of this rule.

Comment: A commenter recommended that CMS eliminate the 36-month rule under § 424.550(b). The commenter stated that this would enable compliance-oriented providers to make business decisions that are in the best interests of their operations, their patients and communities, and in some instances, their institutional connections.

Response: This comment is outside the scope of this rule.

Comment: A commenter stated that it strongly supported the proposed rule. The commenter explained that CMS must ensure that only qualified providers and suppliers that meet and maintain compliance with the program's participation requirements are enrolled. The screening and enrollment processes now in place because of the Affordable Care Act, the commenter added, help serve that goal, and the enhanced policies, authorities, and requirements described in the proposed rule would do even more to enhance these processes.

Response: We appreciate the commenter's support.

Comment: A commenter recommended that CMS consider sharing information with other public and private payers concerning the actions taken under this rule. For example, if CMS revokes or denies an enrollment based on a risk of fraud, waste, or abuse, it should share that information with other payers, including Medicare Part C or D contractors, state Medicaid managed care programs, and private health insurers. Such information-sharing, the commenter stated, is critical to the effective and timely prevention of health care fraud and abuse throughout America's health care system.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter stated that the only factor CMS should use to determine whether an individual or organization is eligible to participate in Medicare is verifiable proof of that party's fraudulent or criminal activity.

Response: We respectfully disagree. We must take steps to protect the Medicare program, its beneficiaries, and the Trust Funds against wasteful and abusive behavior and potential threats (which can eventually materialize into very serious harm) to the same extent we do against actual fraudulent and criminal activity.

Comment: A commenter stated that this and other regulations will continue to discourage physicians from wanting to see Medicare and Medicaid patients. The commenter added that so long as physicians “follow the rules,” they should not have to report their personal investments to the public.

Response: We respectfully disagree that this rule will discourage physicians from seeing Medicare and Medicaid patients. We have issued other provider enrollment regulations in previous years, yet the number of enrolled physicians continues to increase. Although we are unclear which rules and personal investments the commenter is referring to, we believe that our new authorities in this final rule with comment period will aid our program integrity efforts without unduly burdening the vast majority of honest and legitimate providers and suppliers.

Comment: A commenter encouraged the streamlining of the process through which MA plans are notified about providers who are excluded, sanctioned, or opted-out of Medicare. The commenter believed this will help ensure that MA plans are not paying or including these providers in their networks. The commenter made several other recommendations. First, CMS should amend its look-back periods for both participating and non-participating providers. Participating providers should have a 1 year look-back period due to contracting constraints; non-participating providers be given a 3-year look-back period. The commenter believed these changes would replace the current 7-year look-back period. Second, if a provider opted-out of Medicare or Medicaid (or both), a private fee agreement between the provider and member should be mandated for a provider to bill the member for any services rendered. Third, CMS should make clear that a provider opting out of Medicare or Medicaid cannot otherwise bill the member without a private fee agreement and that there will consequences for doing so.

Response: This comment is outside the scope of this rule.

Comment: A commenter stated that CMS' proposed provider enrollment standards are mostly proper and effective program integrity measures, though the commenter added several recommendations and observations. First, any program integrity measure must be targeted to the fraud matter at issue; random, untargeted measures could harm to Medicare beneficiaries and all other stakeholders. Second, anti-fraud initiatives should be evidence-based with a demonstrated return on investment. Third, stakeholder support is essential to achieving success in program integrity; program integrity measures should be developed in a transparent manner that allows for public input. Fourth, there must be clear legal authority for any program integrity activity. Fifth, anti-fraud measures should not erect a barrier to appropriate health care access. Sixth, any program integrity initiative should properly distinguish fraud from unintentional noncompliance. Finally, the outcome of program integrity measures should be reliable with no “innocent victims” resulting.

Response: We appreciate these suggestions and observations and will consider them as we continue our efforts to further strengthen Medicare program integrity.

Comment: CMS refers to denials, revocations, and terminations of enrollment in the rule. A commenter questioned whether these include actions that have been reversed on appeal and/or informal review. The commenter recommended that such actions be limited to those that are final and/or those that CMS has not reversed.

Response: We are unclear as to the specific provisions to which the commenter is referring, though we believe the reference is to § 424.519. For reasons previously discussed, we believe that denials, revocations, and terminations qualify as disclosable events even if they are under appeal.

Comment: A commenter noted that CMS referred in the proposed rule to § 424.535(a)(8)(ii), which permits revocation if the provider “has a pattern or practice of submitting claims that fail to meet Medicare requirements.” The commenter requested that CMS define a “pattern” of submitting noncompliant claims.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period. We refer the commenter to our discussion of this provision in the previously mentioned December 5, 2014 final rule, which finalized § 424.535(a)(8)(ii).

Comment: A commenter requested that CMS furnish guidance on how rejected Form CMS-855 applications will be treated as opposed to Form CMS-855 application denials. The commenter did not believe that an inadvertent clerical error in leaving a data element on the Form CMS-855 incomplete should be considered a denied enrollment.

Response: We believe this comment is outside the scope of this rule, though we note that existing procedures regarding rejected and denied applications can be found in CMS Publication 100-08, Program Integrity Manual, Chapter 15.

Comment: A commenter stated that CMS should establish processes to ensure that providers and suppliers—(1) promptly receive notice of uncollected debt (for example, sending the notices to multiple addresses in the provider's or supplier's enrollment record or creating a database that providers and suppliers can query to determine whether CMS believes an uncollected debt is owed to CMS or a state Medicaid agency); and (2) are given a reasonable amount of time to repay a debt (for example, 60 days) and that the debt need not be reported as uncollected debt until that time period has elapsed.

Response: We appreciate these suggestions and observations and will consider them as we continue our efforts to further strengthen Medicare program integrity.

Comment: A commenter stated that CMS should avoid broadly painting clinicians as perpetrators of fraud, for this fundamentally damages the clinician-patient relationship. It also makes it difficult to ensure that patients will follow through on recommendations provided by their treating professional.

Response: While we appreciate this comment, we have an obligation to protect Medicare, its beneficiaries, and the Trust Funds against improper activities. This rule is, accordingly, directed towards parties that engage in such behavior.

Comment: A commenter stated that CMS should revoke all of a supplier's NPIs if an owner is convicted of fraud in a court of law.

Response: We appreciate this comment and note that several of our finalized provisions will permit CMS to expand a revocation to a provider's or supplier's other locations and enrollments.

Comment: A commenter stated that CMS should—(1) automatically terminate a supplier that has not submitted a claim in 18 months; and (2) consider requiring suppliers to maintain all enrollment records electronically via PECOS. The commenter believed that the latter would better enable suppliers to periodically review their enrollment records to ensure their accuracy.

Response: We appreciate these suggestions and observations and will consider them as we continue our efforts to further strengthen Medicare program integrity.

Comment: A commenter stated that while making certain that suppliers maintain accurate enrollment information, CMS should be similarly required to ensure that PECOS records are up to date. The commenter recommended that a timeframe (preferably 30 days) be established in which CMS must confirm that online records are up to date and accurate.

Response: We appreciate these suggestions and observations and will consider them as we continue our efforts to further strengthen Medicare program integrity.

Comment: A commenter recommended that the effective date of enrollment be the date the supplier meets accreditation and licensure requirements for a particular location. The commenter stated that because this rule may significantly increase the volume of Form CMS-855S applications received, CMS should ensure that any delays resulting therefrom are considered in establishing a date.

Response: We believe that the commenter's first comment is outside the scope of this final rule with comment period. Regarding the second comment, we understand the concerns about workload, and we will take steps to ensure that applications are processed as promptly as possible.

Commenter: A commenter stated that CMS and its contractors should have a defined timeframe in which various processes related to enrollment applications must be completed; the commenter cited, as examples, a new application being processed within 60 days and a change of information or ownership being processed in 90 days. The commenter stated that such requirements should extend to Medicaid programs, adding that—(1) some state Medicaid programs take up to 9 months to process a change of address; and (2) suppliers are not usually notified that their application has been processed and approved and that state programs should be required to do this.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter stated that CMS should (1) clarify how it will treat health care professionals whose Medicare payments were improperly suspended because they did not actually commit fraud; and (2) make certain that health care professionals whose Medicare enrollment is revoked or denied have the opportunity to discuss their matter with CMS.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter stated that the costs associated with implementing and forcing adherence to the proposed rule outweigh the potential benefits to CMS. The vast majority of information will be useless to CMS, the commenter contended, and not worth the time it takes for CMS to review the data. The commenter added that the rule's requirements—(1) could push more physicians away from CMS; and (2) are impossible to comply with, difficult to enforce, and most likely unconstitutional.

Response: We disagree that the costs associated with this rule will outweigh the benefits to CMS. CMS has an obligation to protect the Medicare program, the Trust Funds, and beneficiaries, and we believe this rule will go far towards achieving these objectives. Also, and for reasons stated previously, we do not believe this rule—(1) will discourage physicians from enrolling and remaining in Medicare; or (2) lack legal authority. As we are unclear which provisions the commenter believes are impossible to comply with and difficult to enforce, we are unable to address this particular comment.

Comment: A commenter recommended that CMS either—(1) incorporate data collected by the Council for Affordable Quality Healthcare (CAQH) ProView portal system for enrollment; or (2) adopt a system that has usability similar to the CAQH portal. CMS could use the CAQH data as a starting point (subject to review by the physician and a CMS credential verification contractor) to reduce the amount of information doctors must provide to CMS. The commenter stated that CMS' adoption of such a system would—(1) enable physicians and their practices to spend less time and resources on enrollment, focus more on accurately disclosing information that may help CMS discover fraud and abuse, and spend more time treating patients; and (2) improve the overall enrollment process by simplifying and increasing the usability of the current enrollment system.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter stated that the proposed rule did not specify whom within CMS or its contractors will apply the outlined factors and, if applicable, deny or revoke enrollment. Given the potential consequences of a denial or revocation, the commenter continued, CMS should require contractors to escalate cases to the CMS Regional Office for assessment of the factors and final denial or revocation actions.

Response: We appreciate the commenter's concern. This information may be issued via subregulatory guidance.

Comment: A commenter stated that there should be a “phase-in period” or a stay on edits within CMS' systems to enable providers to come into compliance with the proposed requirements.

Response: We respectfully disagree that the implementation of this rule's provisions should be delayed beyond the timeframes prescribed therein. This is particularly true concerning our new denial and revocation reasons, which are necessary for the protection for the Medicare program, its beneficiaries, and the Trust Funds.

Comment: A commenter stated that CMS should clarify—(1) which penalties would apply to specific types of offenses; and (2) the amount of time a potential ban from the Medicare program would be.

Response: We are unable to provide such specifics in this final rule with comment period. The imposition of a denial, revocation, or termination and the length of any subsequent reenrollment bar will depend upon the particular facts of the situation.

Comment: A commenter stated that it agreed that some of the proposed denial and revocation reasons regarding affiliations may be appropriate, but urged CMS implement a materiality threshold to avoid denials and revocations for immaterial deficiencies that do not adversely affect program integrity.

Response: We are unclear as to the specific denial and revocation reasons to which the commenter believes a materiality standard should be applied. Nonetheless, we emphasize that many of our existing and proposed denial and revocation reasons contained regulatory-prescribed criteria that CMS must carefully take into account before taking action; generally speaking, the degree of the provider's or supplier's conduct is considered in each case.

Comment: Several commenters stated that if CMS plans to use contractors to implement this rule, it should avoid creating a “bounty system” that inappropriately incentivizes contractors (for example, based on the volume or percentage of providers whose enrollments or revalidations they deny or revoke).

Response: CMS contractors are not rewarded or otherwise given financial contractual incentives for denying or revoking provider or supplier enrollments or a percentage thereof.

Comment: A commenter stated that publicly-traded companies should not be required to report any direct or indirect ownership interests held by mutual funds or other large investment or stock-holding vehicles on the Form CMS-855. Since the exact percentage of such interests can fluctuate daily and because this data can be very difficult to obtain, it is unreasonable and burdensome for publicly-traded providers or suppliers to track and report such changes.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter recommended that CMS consider implementing similar reporting obligations under Medicare and Medicaid. The commenter believed that consistency between the Medicare and Medicaid programs would—(1) help ensure that the enhanced program integrity protections in this rule apply to both programs; and (2) reduce providers' compliance burden through uniform reporting requirements, even if said requirements reflects the regulatory schemes of the more stringent state Medicaid agencies.

Response: We appreciate this comment but believe it is outside the scope of this final rule with comment period.

Comment: A commenter suggested that CMS specifically include notification given to the state confirming the provider's compliance with the conditions of participation as a mitigating circumstance in determining whether a revocation under § 424.535 is warranted. Inclusion of this factor would reduce the concerns of compliant home care organizations regarding the proposed rule.

Response: We appreciate this comment but believe it is outside the scope of this rule.

III. Provisions of the Final Rule With Comment Period

This final rule with comment period incorporates the provisions of the proposed rule. Those provisions of this final rule with comment period that differ from the proposed rule are as follows:

• We are not finalizing our proposed changes to §§ 424.505, 424.507, 424.510, or to the definition of Enroll/enrollment in § 424.502.
• Changes to “Disclosure of affiliations” (Medicare § 424.519 and Medicaid § 455.107):

++ We are adding a definition of “disclosable event” to §§ 424.502 and 455.101 that will apply to, respectively, §§ 424.519 and 455.107. A “disclosable event” under these definitions means any of the following:

—Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of: the amount of the debt; whether the debt is currently being repaid (for example, as part of a repayment plan); or whether the debt is currently being appealed;

—Has been or is subject to a payment suspension under a federal health care program (as that latter term is defined in section 1128B(f) of the Act), regardless of when the payment suspension occurred or was imposed;

—Has been or is excluded by the OIG from participation in Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred or was imposed; or

—Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated, regardless of: (i) The reason for the denial, revocation, or termination; (ii) whether the denial, revocation, or termination is currently being appealed; or (iii) when the denial, revocation, or termination occurred or was imposed.

++ We are adding the following language to the end of the opening paragraph of § 424.519(a): “to the definition of disclosable event in § 424.502:” We are making a similar change to the opening paragraph of § 455.107(a) with respect to § 455.101.

++ Proposed §§ 424.519(a)(1)(ii) and 455.107(a)(1)(ii) are being finalized as “Civil money penalties imposed under this title”.

++ Proposed §§ 424.519(a)(1)(iii) and 455.107(a)(1)(iii) are being finalized as “Assessments imposed under this title.”

++ We are revising the entirety of § 424.519(b) to now read as set out in the regulatory text.

—In §§ 424.519(f) and 455.107(f), we are changing the term “action” to “disclosable event.”

—We are not finalizing proposed § 424.519(h)(1) and (h)(2)(i).

—Proposed § 424.519(h)(2)(ii) is being finalized as new paragraph (h) “Duplicate data”.

++ We are revising 455.107(b) to specify the following:

++ Under paragraph (b)(1)(i), a state, in consultation with CMS, must select one of the two options identified in paragraph (b)(2) for requiring the disclosure of affiliation information.

++ Under paragraph (b)(1)(ii), a state may not change its selection under paragraph (b) after it has been made.

++ Paragraph (b)(2)(i) describes the first option. Specifically, in a state that has selected this option, a provider that is not enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment information) must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “person with an ownership or control interest” and “managing employee” as defined in § 455.101) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 455.101).—

++ Paragraph (b)(2)(ii) describes the second option. Specifically, in a state that has selected this option, upon request by the state, a provider that is not enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment information) must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “person with an ownership or control interest” and “managing employee” as defined in § 455.101) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 455.101). The state will request such disclosures when it, in consultation with CMS, has determined that the initially enrolling or revalidating provider may have at least one such affiliation.

++ In § 455.107(d), we are adding the language “in consultation with the Secretary” at the end thereof.

++ We are not finalizing proposed § 455.107(h) and are redesignating § 455.107(i) as § 455.107(h). We are changing the heading of § 424.530(a)(13) from “Affiliation that poses undue risk of fraud” to simply “Affiliation that poses an undue risk”.

• In § 424.530(a)(14), we are changing the phrase “particular State Medicaid program” to “State Medicaid program”. We are also adding “(as that term is defined in § 424.502)” to § 424.530(a)(14)(i)(B) as a reference to the regulatory definition of final adverse actions.
• In § 424.535(a)(12), we are changing “particular Medicaid program” to “State Medicaid program”. Also, we are changing the term “terminate” to “revoke” in § 424.535(a)(12)(ii) to clarify that CMS revokes enrollments.
• In § 424.535(a)(17), we are adding the word “appropriately” before “refers”. Also, we are adding the language “(to the extent this can be determined)” to the end of the factors enumerated in § 424.535(a)(17)(ii) and (iii).
• In § 424.535(a)(20), we are modifying the beginning of the section to read as set out in the regulatory text.
• We are revising § 405.425(i) to state that the physician or practitioner who has not been excluded under sections 1128, 1156 or 1892 of the Act and whose Medicare enrollment is not revoked under § 424.535 of this chapter may order, certify the need for, prescribe, or refer a beneficiary for Medicare-covered items, services, and drugs, provided the physician or practitioner is not paid, directly or indirectly, for such services (except as provided in § 405.440).
• In § 405.425(j), we are changing the language “items and services” to “items, services, and drugs”. Also, we are revising the closing language of § 405.425(j) by revising the last clause of the paragraph to clarify the compliance with and the effective date of the exclusion.
• We are not finalizing proposed § 424.57(d)(16).
• We are adding a new paragraph (c) to § 405.800 that discusses additional years applied to a provider's or supplier's existing reenrollment bar under § 424.535(c)(2)(i) and the notification requirements associated therewith. These requirements apply only to the years added to the existing reenrollment bar under § 424.535(c)(2)(i) and not to the original length of the reenrollment bar, which is not subject to appeal.
• We are revising § 498.3(b)(17) as follows:

++ The existing version of paragraph (b)(17) will be redesignated as paragraph (17)(i).

++ New paragraph (b)(17)(ii) will address the addition of years to a provider's or supplier's existing reenrollment bar;

++ New paragraph (b)(17)(iii) will address appeals concerning § 424.535(c)(3).

IV. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995, we are required to provide 60-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 requires that we solicited comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

In the proposed rule, we estimated a total information collection burden of $285 million in each of the first 3 years of this rule. Most of this cost stemmed from our affiliation proposal (§§ 424.519 and 455.107), the principal burden of which would come from—(1) all initially enrolling and revalidating providers and suppliers having to completion of the applicable enrollment application sections; and (2) the time involved in researching data. We solicited public comment and feedback regarding these burdens.

This collection of information section will address the costs associated with this rule. The regulatory impact analysis section of this final rule with comment period will analyze the rule's savings.

A. ICRs Related to Affiliations (§§ 424.519 and 455.107)

Proposed §§ 424.519 and 455.107 required that a Medicare, Medicaid, or CHIP provider or supplier disclose information about present and past affiliations with certain currently or formerly enrolled Medicare, Medicaid, or CHIP providers and suppliers. Medicare providers and suppliers will furnish this information via the paper or internet-based version of the Form CMS-855 applications, which will be updated to collect this data.

Though the specific vehicle for collecting affiliation information a from Medicaid and CHIP providers and suppliers is left to the state's discretion, we anticipate that the information will be provided on an existing enrollment form or through a separate form created by the state. The principal burden involved with this collection will be the time and effort needed to—(1) obtain this information; and (2) complete and submit the appropriate section of the applicable form.

We proposed that the data would be submitted upon initial enrollment and revalidation; new affiliations and changes in current affiliations would also have to be reported. As discussed in section II.A. of this final rule with comment period, and with the exception of the first option under § 455.107(b), we are now restricting the reporting requirements to instances where CMS or the state, as applicable, requests the information. The following estimates in section V.A. of this final rule with comment period reflect our final policies for §§ 424.519 and 455.107.

1. Medicare

We estimated in the proposed rule that it would take each provider or supplier an average of 10 hours to obtain and furnish this information. Although some commenters, as described later in section, expressed concern with the 10-hour estimate for obtaining and furnishing this data after a CMS request, we are retaining our estimate of 10 hours. We believe that a typical provider or supplier's effort to secure the data, coupled with furnishing the information on the appropriate Form CMS-855 application, will require, on average, 10 hours or less in most cases. It is true that for large providers or suppliers, the average time expenditure may be higher than 10 hours; for small providers and suppliers, however, the average time expenditure will likely be considerably less than 10 hours. Therefore, we believe that 10 hours remains a reasonable estimate for purposes of the information collection requirement (ICR) cost burden projection.

We cannot conclusively predict the number of instances in which CMS will request the reporting of disclosable affiliations under § 424.519 in each of the first 3 years of the rule. However, for purposes of this information collection request only, and as we indicated previously in this rule, we believe that average of 2,500 requests per year is a reasonable projection. This results in an estimated annual hour burden of 25,000 hours.

Per our experience, we believe that the reporting provider's or supplier's administrative staff (for example, officer managers and support staff) will be responsible for securing and listing affiliation data on the Form CMS-855. According to the most recent wage data provided by the Bureau of Labor Statistics (BLS) for May 2018, the mean hourly wage for the general category of “Office and Administrative Support Occupations” is $18.75 per hour (see http://www.bls.gov/​oes/​current/​oes_​nat.htm#430000). With fringe benefits and overhead, the per hour rate is $37.50. Given the foregoing, and using this per hour rate, we estimate the annual ICR burden for initially enrolling and revalidating providers and suppliers from § 424.519 to be 25,000 hours (2,500 requests × 10 hours) at a cost of $937,500 (25,000 hours × $37.50).

2. Medicaid and CHIP

We cannot project the number of instances in which states will request the reporting of disclosable affiliations under § 455.107. This is particularly true given that, under revised § 455.107(b)—(1) states will have two options for requesting affiliation information, and we do not know which states will select which alternatives; and (2) we do not know when each state will update its applicable data collection mechanism to reflect the § 455.107(b) requirements.

3. Collection of Information From States

As we stated in the proposed rule, it is possible that states may eventually be required to report to CMS certain information regarding its processing of data submitted under § 455.107. This may include, for example, the number of applications in which an affiliation was reported and the number of cases in which the state determined that an affiliation posed an undue risk. However, we are unable to estimate the possible ICR burden because we do not know whether, to what extent, and by what vehicle data concerning § 455.107 will be reported to CMS.

4. Total Burden

We estimate a total annual ICR burden of our affiliation disclosure requirements of 25,000 hours at a cost of $937,500.

B. ICRs Related to Our Proposed and Finalized Denial Reasons in § 424.530 and Revocation Reasons in § 424.535

We do not anticipate any collection burden resulting from our revisions to the denial authorities in § 424.530 or the revocation authorities in § 424.535. An appeal from a denial of enrollment or an appeal from a revocation of enrollment are both exempt from the PRA. There are no other potential sources of ICR that would result from the final rule's changes to the denial or revocation authorities.

C. ICRs Related to Changes in Maximum Reenrollment Bars (§ 424.535(c)) and the Establishment of Reapplication Bars (§ 424.530(f))

We do not anticipate any collection burden resulting from our revisions to § 424.535(c). The burden, in fact, may actually decrease because certain providers and suppliers may be barred from Medicare for a longer period of time and thus will submit Form CMS-855 applications less frequently. In addition, we do not anticipate any collection burden resulting from our addition of § 424.530(f). Additional applications will not be submitted because of this provision.

D. Documentation

We revised § 424.516(f) to state that a provider or supplier furnishing a Part A or B service, item, or drug, as well as the physician or, when permitted, eligible professional who ordered, certified, referred, or prescribed the Part A or B service, item, or drug must maintain documentation for 7 years from the date of the service and furnish access to that documentation upon a CMS or Medicare contractor request.

The burden associated with the requirements in § 424.516(f) will be the time and effort necessary to both maintain documentation on file and to furnish the information upon request to CMS or a Medicare contractor. While the requirement is subject to the PRA, we believe the associated burden is negligible. As discussed in the previously referenced November 19, 2008 final rule (73 FR 69915) and the April 27, 2012 final rule (77 FR 25313), we believe the burden associated with maintaining documentation and furnishing it upon request is a usual and customary business practice.

E. ICRs Related to Temporary Moratorium (§ 424.570)

We were unable in the proposed rule to estimate the number of applications that will be approved or denied as a result of our changes to § 424.570, for we had insufficient data on which to base a precise projection. To enhance our ability to formulate such an estimate, we solicited comment on—(1) whether an annual figure of 2,000 potentially impacted providers and suppliers could serve as a reasonable approximation; and (2) the potential cost burden to providers and suppliers. We received no specific comments on either issue and remain unable to provide a reasonable estimate because we do not have adequate information with which to do so.

F. ICRs Related to Reactivations (§ 424.540(b))

We were unable in the proposed rule to project the number of certifications that will be submitted versus the number of complete Form CMS-855 applications. To enhance our ability to formulate a projection of the ICR burden associated with this provision, we solicited comment on—(1) whether an annual figure of 10,000 instances in which a Form CMS-855 will be requested could serve as a reasonable approximation; and (2) the potential cost burden to providers and suppliers. We received no comments and remain unable to formulate a reasonable estimate due to the lack of sufficient data.

G. Revision to Definition of Enrollment (§ 424.535(a))

As this revision is primarily technical in nature, we do not foresee an associated ICR burden.

H. Total ICR Overall Burden

Based on the foregoing, we estimate an annual ICR burden over each of the first 3 years of the rule of 25,000 hours at a cost of $937,500. These costs are limited to our affiliation provisions, for, as discussed above, we do not anticipate costs associated with any of our other provisions. We note that the annual ICR burden in this final rule with comment period is significantly less than the predicted $285 million dollar annual ICR burden in the proposed rule based on our election to pursue a phased-in approach for Medicare, Medicaid, and CHIP affiliation disclosures.

I. Comments Received on Our ICR Estimates in the Proposed Rule

The following is a summary of the comments we received on our ICR estimates in the proposed rule:

Comment: Several commenters contended that the $289.8 million cost estimate and the 10-hour estimate in the proposed rule associated with reporting disclosable affiliations were too low. They generally stated that these projections did not account for lost productivity to physician practices, including diversion of staff from clinical and related duties that directly impact and support patient care. A commenter stated that the rule's cost does not justify the value of any benefits accruing from the rule.

Response: We disagree. As stated previously, we will be taking a phased-in approach with the affiliations provisions. The overwhelming majority of enrolling and revalidating providers will not be requested to provide affiliations disclosures upon the effective date of this rule. Accordingly, consistent with our earlier discussion, the annual costs over the first 3 years of this rule will be less than $1 million because far fewer providers and suppliers than estimated in the proposed rule will be required to disclose affiliation data.

The 10-hour estimate, which formed the basis of our initial $289.8 projection in the proposed rule, accounts for the fact that many providers and suppliers are small in nature (for example, solo practitioners and small group practices) and will accordingly have few, if any, affiliations. It is true that larger providers and suppliers may need to spend more than 10 hours in researching affiliation information. Insofar as any diversion from patient care, we do not believe that reporting affiliation data upon initial enrollment and once every 3 or 5 years thereafter (depending on provider or supplier type) will negatively impact beneficiary services. Finally, and as shown in Table 2, we believe that the prevention of problematic providers and suppliers from accessing the Trust Funds will more than offset the costs associated with this rule.

Comment: A commenter stated that providers and suppliers would need to (1) develop systems to track and monitor all identified affiliation relationships; and (2) rely on higher paid, more sophisticated employees or an outside consultant or attorney, at a rate substantially higher than $34 per hour.

Response: We disagree. We believe that our removal of proposed §§ 424.519(h)(1) and (h)(2)(i) and 455.107(h) will effectively eliminate the burden of regularly tracking disclosable affiliation data. Also, it has been our experience that the researching and reporting of ownership and managerial information on the Form CMS-855 is typically performed by the provider's or supplier's administrative staff. We believe that providers and suppliers will use this same approach with disclosable affiliation data.

Comment: Several commenters stated that the 30-minute estimate for reporting a new affiliation or a change to an existing affiliation is too low.

Response: As previously stated, we are not finalizing proposed §§ 424.519(h)(1) and (h)(2)(i) and 455.107(h).

Comment: A commenter stated that CMS (1) underestimated the time necessary to complete the Form CMS-855O, (2) underestimated the value of the doctors' time at $93.74 (or $187.48 with fringe benefits and overhead), (3) did not account for the cost to patients and society of diverting so many hours of doctors' time away from patient care for the completion of government forms, and (4) unrealistically limited the ICR cost to the rule's first 3 years.

Response: We disagree with these comments. Our estimated time for completing the Form CMS-855O is consistent with our prior public projections as well as with feedback we have received from the provider community. Also, our projection regarding physician wages and our use of the 3-year ICR estimate are consistent with policies established by the Office of Management and Budget. Regarding the third comment, and as alluded to earlier, we do not believe that—(1) reporting affiliation data upon initial enrollment and once every 3 or 5 years thereafter; or (2) completing the Form CMS-855O will negatively affect patient care. However, we note that we are not finalizing our proposed changes to § 424.507, which we believe would alleviate further the burden on the physician community.

If you comment on these information collection and recordkeeping requirements, please do either of the following:

1. Submit your comments electronically as specified in the ADDRESSES section of this final rule with comment period; or

2. Submit your comments to the Office of Information and Regulatory Affairs, Office of Management and Budget,

Attention: CMS Desk Officer, CMS-6058-P

Fax: (202) 395-6974; or

Email: OIRA_submission@omb.eop.gov

V. Regulatory Impact Analysis

A. Statement of Need

As previously stated, this final rule with comment period is necessary to implement sections 1866(j)(5) and 1902(kk)(3) of the Act, which require providers and suppliers to disclose information related to any current or previous affiliation with a provider or supplier that has uncollected debt; has been or is subject to a payment suspension under a federal health care program; has been excluded from participation under Medicare, Medicaid, or CHIP; or has had its billing privileges denied or revoked. This final rule with comment period is also necessary to address other program integrity issues that have arisen. We believe that our finalized provisions will—(1) enable CMS and the states to better track current and past relationships involving different providers and suppliers; and (2) assist our efforts to stem fraud, waste, and abuse, hence protecting the Medicare Trust Funds. Failure to publish this rule, we believe, would continue to enable certain parties engaging in fraud, waste, and abuse to bill the Medicare program, endangering both the Trust Funds and Medicare beneficiaries.

B. Savings and Impact

1. Background

We have examined the impacts of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4) and Executive Order 13132 on Federalism (August 4, 1999) and the Congressional Review Act (5 U.S.C. 804(2)) and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017).

Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Section 3(f) of Executive Order 12866 defines a “significant regulatory action” as an action that is likely to result in a rule—(1) having an annual effect on the economy of $100 million or more in any 1 year, or adversely and materially affecting a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or state, local or tribal governments or communities (also referred to as “economically significant”); (2) creating a serious inconsistency or otherwise interfering with an action taken or planned by another agency; (3) materially altering the budgetary impacts of entitlement grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raising novel legal or policy issues arising out of legal mandates, the President's priorities or the principles set forth in the Executive Order.

A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). We explained in section IV. of this final rule with comment period that the costs of our provisions will not exceed $100 million in any of the first 3 years of this final rule with comment period. However, as discussed we expect that annual federal budget savings over this 3-year period will exceed $100 million. Therefore, we estimate that this rulemaking is economically significant as measured by the $100 million threshold and thus is a major rule under the Congressional Review Act. We have accordingly prepared this RIA.

2. Savings

a. Affiliations (§§ 424.519 and 455.107)

As explained in Section I. of this rule, over the last 5 years, $51.9 billion dollars (with adjusted factors applied) has been paid to 2,097 entities with affiliations stemming from the revoked Medicare enrollment of an associated individual or other entity. If the affiliations/undue risk revocation authority we are finalizing had been in place during that period, we project that CMS would have taken revocation action in approximately 40 percent of identified prior affiliation cases (or approximately 838 cases) based on a determination of undue risk of fraud, waste, or abuse. Accordingly, we would not have paid those problematic providers who we know are at the core of the ongoing fraud risk we face. As a result, over the last 5 years the program would have seen a resulting $20.7 billion in cost-avoidance savings, or an average of $4.14 billion per year. We project for purposes of this final rule with comment period that similar savings could be achieved once our affiliation provisions become effective.

We believe it is appropriate, however, to outline a range of savings estimates for our affiliation provisions, given the potential for fluctuations. We thus restate the projections we outlined in Table 1, based on figures of 20 percent, 40 percent, and 60 percent:

We plan to begin updating our enrollment applications within 1 year of publication of the final rule with comment. Once all of the enrollment forms are completed and have gone through the PRA process (during which we will solicit public comment on our burden estimates for completing and submitting affiliation data via the Form CMS-855), and subregulatory guidance has been disseminated to the states regarding phase one, we will begin the process of entering phase two of the affiliations disclosure process. As we have stated throughout this rule, the initial period of the affiliation requirement will enable CMS to carefully monitor and analyze the progress and operational components of the phased-in approach in preparation for the subsequent future rulemaking.

b. New Denial Reasons in § 424.530 and Revocation Reasons in § 424.535

In section IV. of the proposed rule, we explained the difficulty in predicting the number of denials and revocations that would result from our proposed revisions. Considering that these would be new provisions, there were no historical statistics upon which we could base adequate estimates. Nonetheless, we outlined the following tentative estimates strictly for purposes of soliciting public comment on the number of denials or revocations that CMS was likely to undertake each year:

We received no comments on these estimates. After careful consideration, and for several reasons, we believe that said projections were too high and that a smaller, uniform number encompassing all of the denial and revocation reasons listed earlier is more appropriate. First, and as we explain throughout this final rule with comment period, we do not intend to deny and revoke providers and suppliers as a routine matter of course. We recognize the legal significance of such actions and the effect it can have on the provider or supplier in question. We reiterate that we will only exercise our authority under these new denial and revocations very cautiously and only after the most careful and thorough consideration of—(1) the regulatorily-outlined factors associated with each reason; and (2) the circumstances surrounding the particular case. This warrants, in our view, significantly smaller estimates than what we proposed for public comment. Second, while we made tentative estimates in the proposed rule for comment solicitation purposes, we made clear that we did not, and indeed could not, know how many instances in which each denial and revocation authority would be exercised. These were entirely new provisions for which there was no historical data upon which to base reasonable estimates. We continue to hold this view and accordingly believe that the best approach for projecting the number of denials and revocations is to establish a single figure encompassing all of the authorities identified in Table 1.

We project that our new revocation authorities will lead to 2,600 new revocations per year, which we believe is a conservative and, as explained previously, a necessarily cautious estimate. This will result in 10-year savings to the federal government of $4.16 billion, a figure predicated on internal CMS data indicating a per provider annual payment amount of $160,000 (2,600 × $160,000). The average annual savings to the federal government will thus be $416 million.

c. Maximum Reenrollment Bars (§ 424.535(c)) and the Establishment of Reapplication Bars (§ 424.530(f))

We estimate that our reenrollment and reapplication bar provisions will annually impact 400 Medicare revocations, leading to savings above and beyond that which CMS experiences today based on the current three-year maximum reenrollment bar.

We project that this would result in estimated actual savings of $1.79 billion over 10 years based on our earlier project per provider amount of $160,000. The following example illustrates the rationale behind this calculation. The year 1 batch of 400 revocations would have 7 years of actualized savings during the first 10 year period. The first 3 years would not generate new savings because the previous maximum reenrollment bar was 3 years. Thus, savings from this rule would begin in year 4 and run through year 10 yielding a savings of $448 million for the year 1 batch of revocations ($160,000 × 400 × 7). Additionally, the year 2 batch of 400 revocations would have 6 years of actualized savings during the first 10 year period. In year 1 these entities were not revoked and years 2 through 4 did not generate new savings. Thus, savings for the year 2 batch of 400 revocations would begin in year 5 and run through year 10 resulting in a savings of $384 million ($160 × 400 × 6). This pattern would continue for each year's batch of 400 revocations. The total 10 year savings is, accordingly, anticipated to be $1.79 billion.

Furthermore, we project that this would result in a “caused savings” of $4.48 billion based on our earlier projected per provider amount of $160,000 (400 × 10 × 7 × $160,000). As noted above, “caused savings” refers to the full amount of money that will be saved based on the new reenrollment and reapplication bars over a 10-year period; a large portion of the savings will be made after the first 10-year period of interest and will not be fully actualized until year 20.

The following example illustrates the rationale behind this calculation. In year 1, 400 revocations would occur. Currently, and until the provisions in this rule are effective, CMS may impose a reenrollment bar of 1 to 3 years. Thus, the year 1 batch of 400 revocations mentioned earlier will not have actualized savings derived from this rule until year 4 in the 10-year period following revocation. The 7 years of savings associated with the year 1 batch of 400 revocations would be actualized over the next 10 years, with all 7 of those years falling within the initial 10-year period. Additionally, the average annual actualized savings during the initial 10-year period would be $179 million (the total actualized savings during the first 10-year period of interest would be $1.79 billion). This is because each year's batch of 400 revocations will have 1 less year of actualized savings during the first 10-year period. For instance, the year 1 batch of 400 revocations will have all 7 years of savings actualized within the first 10-year period, the year 2 batch will only have 6 of its 7 years of savings actualized within the first 10-year period, etc.

d. Totals

Table 4 outlines the projected annual savings to the federal government for the applicable provisions described previously. (For affiliations, we are using the aforementioned 40 percent figure, which we believe is the most accurate notwithstanding our establishment of a projected range in Tables 1 and 2).

Given, therefore, our annual savings estimates for affiliation-based revocations (using our median 40 percent figure), revocations from other new authorities, and reenrollment and reapplication bars, we project a total savings over a 10-year period of $47.35 billion.

2. Impact

We believe there will be three principal impacts associated with our finalized provisions. First, denied and revoked suppliers could incur costs associated with potential lost billings due to denials and revocations. Second, we estimate that the denial, revocation, reenrollment bar, and reapplication bar provisions described earlier will result in approximately $4.735 billion dollars of annual savings to the federal government and, by extension, the Medicare Trust Funds and the taxpayers. Third, we believe that CMS, Medicare contractors, and the states may incur costs, in implementing and enforcing our affiliation disclosure provision. These could include information technology system changes and provider education. We estimate total costs of $937,500 in each year following implementation of the proposed rule.

Executive Order 13771, titled Reducing Regulation and Controlling Regulatory Costs, was issued on January 30, 2017. It requires that the costs associated with significant new regulations shall, to the extent permitted by law, be offset by the elimination of existing costs associated with at least two prior regulations. This final rule with comment period is considered an E.O. 13771 regulatory action. We estimate that this rule generates $0.73 million in annualized costs in 2016 dollars, discounted at 7 percent relative to year 2016, over a perpetual time horizon. Details on the estimated costs of this rule can be found in the preceding analyses.

In accordance with the provisions of Executive Order 12866, this rule was reviewed by the Office of Management and Budget.

Finally, we do not anticipate any significant impact on beneficiary access to care from the provisions in this final rule with comment period. Only a minute fraction of providers and suppliers, when compared to the entire population of providers and suppliers enrolled in Medicare, will be revoked or denied as a result of these new and revised revocation and denial authorities.

C. Anticipated Effects

The RFA requires agencies to analyze options for regulatory relief of small businesses. For purposes of the RFA, small entities include small businesses, nonprofit organization, and small governmental jurisdictions. Most entities and most other providers and suppliers are small entities, either by nonprofit status or by having revenues less than $7.5 million to $38.5 million in any 1 year. Individuals and states are not included in the definition of a small entity.

For several reasons, we do not believe that this final rule with comment period will have a significant economic impact on a substantial number of small businesses. First, the furnishing of affiliation data will be required very infrequently, for example, once every 5 years for non-DMEPOS suppliers. The cost burden per provider or supplier (10 hours for affiliation data) will likely be less than $1,000, which should not be a significant burden on a provider or supplier. Second, it is true that some small businesses could be denied enrollment or have their enrollments revoked under our provisions. Yet the number of denials and revocations per year is currently—and will continue to be under our new provisions —very small when compared to the total number of enrolled providers and suppliers nationwide. Therefore, we do not believe that our new denial and revocation reasons will have a significant impact on a substantial number of small businesses.

D. Effects on Small Rural Hospitals

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a metropolitan statistical area and has fewer than 100 beds. We are not preparing an analysis for section 1102(b) of the Act because we have determined, and therefore the Secretary has determined, that this final rule with comment period will not have a significant impact on the operations of a substantial number of small rural hospitals.

E. Unfunded Mandates

Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. In 2018, that is approximately $150 million. This rule does not mandate any requirements for state, local or tribal governments or for the private sector.

F. Executive Order 13132

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law or otherwise has federalism implications. Since this regulation does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.

G. Accounting Statement and Table

As required by OMB Circular A-4 (available at http://www.whitehouse.gov/​omb/​circulars/​a0004/​a-4/​pdf), in Table 5 we have prepared an accounting statement showing estimates, over the first 3 years of the rule's implementation, of the total cost burden to providers and suppliers for reporting data using, respectively, 7 percent and 3 percent annualized discount rates.

H. Alternatives Considered

We considered and have finalized several alternatives to reduce the overall burden of our provisions.

First, we contemplated a 10-year timeframe for the affiliation lookback period but proposed to limit the timeframe to 5 years. We believed this would ease the burden on Medicare, Medicaid, and CHIP providers and suppliers by restricting the volume of information that must be reported. Similarly, we proposed that changed data regarding past affiliations need not be reported. We have finalized the 5-year lookback period and have eliminated altogether the requirement to report new and changed affiliations as part of a change of information request. Although we are unable to calculate the financial savings that would accrue to providers and suppliers from not having to (1) research and report affiliation data from 6 to 10 years ago, and (2) regularly monitor and disclose new or changed affiliation information, we believe that the burden on providers and suppliers would be reduced.

Second, and more generally, we have incorporated a phased-in approach for our affiliation disclosure requirements. As previously explained, this would dramatically reduce the annual costs to providers and suppliers over the first three years of this rule to less than $1 million. We believe that a phased-in approach is a sounder alternative than an immediate, full-blown implementation not only because of the burden reduction but also because it would: (1) Give the provider and supplier community at large more time to prepare for our affiliation provisions; and (2) enable CMS to carefully monitor and analyze the progress and operational components of the phased-in approach in preparation for the subsequent future rulemaking.

Third, and for reasons already discussed, we have elected not to finalize our proposed changes to § 424.507. We estimated in the proposed rule that the annual cost burden to affected providers and suppliers of these changes (over the first 3 years of the rule) would be approximately $4.5 million. Our non-finalization of these changes will eliminate said costs.

Fourth, regarding our extension of the maximum re-enrollment bar to 10 years, we considered shorter alternative timeframes. However, we settled on 10 years because we believe it was imperative to keep demonstrably problematic providers and suppliers out of the Medicare program for an extended period. We believe similarly with respect to the maximum 20-year period for twice-revoked providers and suppliers. Although we contemplated briefer maximum periods, repeated improper conduct potentially warranted, in our view, a very long bar.

List of Subjects

42 CFR Part 405

• Administrative practice and procedure
• Health facilities
• Health professions
• Kidney diseases
• Medical devices
• Medicare Reporting and recordkeeping requirements
• Rural areas
• X-rays

42 CFR Part 424

• Emergency medical services
• Health facilities
• Health professions
• Medicare
• Reporting and recordkeeping requirements

42 CFR Part 455

• Fraud
• Grant programs—health
• Health facilities
• Health professions
• Investigations
• Medicaid Reporting and recordkeeping requirements

42 CFR Part 457

• Administrative practice and procedure
• Grant programs—health
• Health insurance
• Reporting and recordkeeping requirements

42 CFR Part 498

• Appeals

For the reasons stated in the preamble of this final rule with comment period, the Centers for Medicare & Medicaid Services amends 42 CFR chapter IV as follows:

PART 405—FEDERAL HEALTH INSURANCE FOR THE AGED AND DISABLED

1. The authority for part 405 is revised to read as follows:

Authority: 42 U.S.C. 263a, 405(a), 1302, 1320b-12, 1395x, 1395y(a), 1395ff, 1395hh, 1395kk, 1395rr, and 1395ww(k).

2. Section 405.371 is amended-—

a. By revising paragraph (a) introductory text;

b. In paragraph (a)(1) by removing the semicolon at the end of the paragraph and adding in its place a period.

c. In paragraph (a)(2) by removing “; or” at the end of paragraph and adding in its place a period; and

d. By adding paragraph (a)(4).

The revision and addition read as follows.

3. Section 405.425 is amended by revising paragraphs (i) and (j) to read as follows:

4. Section 405.800 is amended by adding paragraph (c) to read as follows:

PART 424—CONDITIONS FOR MEDICARE PAYMENT

5. The authority for part 424 continues to read as follows:

Authority: 42 U.S.C. 1302 and 1395hh.

6. Section 424.502 is amended by adding the definitions for “Affiliation”, “Disclosable event”, “NPI”, and “PECOS” in alphabetical order to read as follows:

7. Section 424.516 is amended by revising paragraphs (f)(1)(i) introductory text, (f)(1)(ii), (f)(2)(i) introductory text, and (f)(2)(ii) to read as follows:

8. Section 424.519 is added to read as follows:

9. Section 424.530 is amended by revising paragraph (a)(7) and adding paragraphs (a)(12) through (14) and (f) to read as follows:

10. Section 424.535 is amended—

a. In paragraph (a) introductory text, by removing the term “billing privileges” and adding in its place the word “enrollment”;

b. By revising paragraphs (a)(9) and (12);

c. By adding reserved paragraphs (a)(15) and (16);

d. By adding paragraphs (a)(17) through (21);

e. By revising paragraph (c); and

f. By adding paragraphs (i) and (j).

The additions and revisions read as follows:

11. Section 424.540 is amended by revising paragraphs (b)(1) and (2) to read as follows:

12. Section 424.570 is amended by revising paragraphs (a)(1)(iii) and (iv) to read as follows:

PART 455—PROGRAM INTEGRITY: MEDICAID

13. The authority citation for part 455 is revised to read as follows:

Authority: 42 U.S.C. 1302.

14. Section 455.101 is amended by adding the definitions for “Affiliation” and Disclosable event” in alphabetical order to read as follows:

15. Section 455.103 is revised to read as follows:

16. Section 455.107 is added to subpart B to read as follows:

PART 457—ALLOTMENTS AND GRANTS TO STATES

17. The authority citation for part 457 is revised to read as follows:

Authority: 42 U.S.C. 1302.

18. Section 457.990 is amended by redesignating paragraphs (a) and (b) as paragraphs (b) and (c) and adding a new paragraph (a) to read as follows:

PART 498—APPEALS PROCEDURES FOR DETERMINATIONS THAT AFFECT PARTICIPATION IN THE MEDICARE PROGRAM AND FOR DETERMINATIONS THAT AFFECT THE PARTICIPATION OF ICFs/IID AND CERTAIN NFs IN THE MEDICAID PROGRAM

19. The authority citation for part 498 is revised to read as follows:

Authority: 42 U.S.C. 1302, 1320a-7j, and 1395hh.

20. Section 498.3 is amended by revising paragraph (b)(17) to read as follows:

Footnotes