CMS Greatly Expands Its Authority to Deny and Revoke Providers' and Suppliers' Medicare Enrollment

II.     Background

Section 1866(j) of the Social Security Act (Act)⁵ was enacted as part of the Medicare Prescription Drug, Improvement, and Modernization Act (MMA) of 2003.⁶  This section of the law directed the Secretary of the Department of Health and Human Services (HHS) to adopt a regulatory process for Medicare enrollment.  On April 21, 2006, CMS published a final rule implementing the MMA’s provisions related to enrollment, setting forth the requirements for providers and suppliers to obtain and maintain Medicare enrollment (2006 Final Rule).⁷  The requirements are codified in 42 C.F.R. Part 424, Subpart P.  The intent of the 2006 Final Rule was “to protect beneficiaries and the Medicare Trust Funds by preventing unqualified, fraudulent, or excluded providers and suppliers from providing items or services to Medicare beneficiaries or billing the Medicare program or its beneficiaries.”⁸  Subsequently, the regulations have been updated from time to time to address payment safeguard issues.⁹

The enrollment regulations require that, in order to enroll in the Medicare program and obtain billing privileges, providers and suppliers must submit an applicable Medicare enrollment application (i.e., the applicable version of the CMS-855).¹⁰  The application may be submitted on paper or electronically via the Provider Enrollment, Chain and Ownership System (PECOS).¹¹  Data collected at the time of Medicare enrollment includes, but is not limited to, the following provider or supplier information: (1) identifying information; (2) licensure data; (3) practice locations; (4) any adverse actions taken against the provider or supplier; and (5) information regarding the provider’s or supplier’s owners and managing individuals and organizations (including any adverse actions taken against them).¹²  Enrollment information must be submitted to CMS upon the following occurrences: initial enrollment; if there is a change in ownership; if there is a change of information; and revalidation and/or reactivation.¹³

III.     Affiliations and Disclosable Events

Section 1866(j)(5) of the Act¹⁴ was added by Section 6401(a)(3) of the Patient Protection and Affordable Care Act, and requires that a provider or supplier submitting an enrollment application or enrollment revalidation application for Medicare, Medicaid, or CHIP disclose any current or prior direct or indirect affiliation with a provider or supplier that:

• Has an uncollected debt; or
• Has been or is subject to a payment suspension under a federal healthcare program; or
• Has been excluded from Medicare, Medicaid or CHIP; or
• Has had its billing privileges denied or revoked.

If the Secretary determines that any such affiliation poses an undue risk of fraud, waste or abuse, the provider’s or supplier’s enrollment application may be denied.¹⁵  The Final Rule codifies these statutory provisions.¹⁶

A.     Affiliation

The Final Rule defines the term “affiliation” as part of 42 C.F.R. § 424.502, as follows:

(1)   A 5 percent or greater direct or indirect ownership interest that an individual or entity has in another organization.

(2)   A general or limited partnership interest (regardless of the percentage) that an individual or entity has in another organization.¹⁷

(3)   An interest in which an organization or entity exercises operational or managerial control over, or directly or indirectly conducts, the day-to-day operations of another organization.

(4)   An interest in which an individual is acting as an officer or director of a corporation.

(5)   Any reassignment relationship under § 424.80.

Prior to the effective date of the Final Rule, providers and suppliers already were required to disclose the relationships described above.  Interests described in items (1) through (4) above are consistent with the definitions of “owner,”¹⁸ “managing employee”¹⁹ and “ownership or control interest,”²⁰ which were, and remain, required to be disclosed on all of the CMS-855 enrollment forms.  With respect to item (5), reassignment relationships were, and remain, required to be disclosed on CMS-855R, which is the form completed when a provider or supplier is reassigning, or terminating a prior reassignment of, his/her/its right to bill the Medicare program and receive Medicare payments for services rendered to Medicare beneficiaries.²¹

In order to reduce provider and supplier burden associated with identifying affiliated interests, CMS imposed a five year lookback period for reporting affiliations.²²  Calculated from the date of submission of an enrollment application, providers and suppliers must disclose any affiliation relationship that occurred within the preceding five years (even if such relationship has ended), if the affiliated provider or supplier experienced a disclosable event.²³

B.     Disclosable Event

The Final Rule defines “disclosable event” in 42 C.F.R. § 424.502 as follows:

Disclosable event means, for purposes of § 424.519,²⁴ any of the following:

(1)   Currently has an uncollected debt to Medicare, Medicaid, or CHIP, regardless of—
       (i)  The amount of the debt;²⁵
       (ii)  Whether the debt is currently being repaid (for example, as part of a repayment         plan); or
     (iii)  Whether the debt is currently being appealed;

(2)   Has been or is subject to a payment suspension under a federal health care program (as that latter term is defined in section 1128B(f) of the Act), regardless of when the payment suspension occurred or was imposed;

(3)   Has been or is excluded by the [Department of Health and Human Services Office of Inspector General] OIG from participation in Medicare, Medicaid, or CHIP, regardless of whether the exclusion is currently being appealed or when the exclusion occurred or was imposed; or

(4)   Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or terminated, regardless of –
        (i)  The reason for the denial, revocation or termination;²⁶
        (ii)  Whether the denial, revocation or termination is currently being appealed; or
        (iii)  When the denial, revocation or termination occurred or was imposed.

Because providers and suppliers already were required to disclose affiliation relationships as part of the CMS-855 enrollment application(s), it may not prove overly burdensome for providers or suppliers to comply with the Final Rule to identify their affiliation relationships.  However, researching and reporting the affiliated entities’ disclosable events may be another story.  Consider, for example, a large health system with many reassignment relationships.  Under the Final Rule, the health system must research and submit data to CMS involving any disclosable event of any provider or supplier with a reassignment relationship with the health system.  In the Final Rule, CMS acknowledges this “potentially sizeable burden,”²⁷ but ultimately chose to retain reassignment relationships within the definition of affiliation and require disclosure of such affiliated entities’ disclosable events.²⁸  It is important to remember that a physician or other practitioner may have multiple reassignments with various entities (such as physician group practices) enrolled under the CMS-855B, and thus, under the Final Rule, one entity could have its application denied or its billing privileges revoked because of some issue involving a reassigning practitioner that arose in connection with some other, unrelated entity to which the practitioner also reassigned benefits.

Importantly, the Final Rule does not establish a lookback period for disclosable events.²⁹  Therefore, if a current affiliated entity of a provider or supplier, or if a prior affiliated entity of a provider or supplier within the preceding five years, experienced a disclosable event at any time, this must be reported to CMS.  If such disclosable events are not reported, CMS may deny or revoke a provider’s or supplier’s Medicare enrollment if it determines that the provider or supplier knew or should reasonably have known about the disclosable event.³⁰

C.     Disclosure

When disclosure is required, a provider or supplier must disclose to CMS the following data on the applicable CMS-855 enrollment form:

• General identifying information about the affiliated entity;
• A description of the affiliated entity’s disclosable event;
• Information regarding the nature and scope of the relationship between the provider or supplier and its affiliate;
• Information regarding the length of the relationship between the provider or supplier and the affiliated entity; and if the affiliation relationship ended, the reasons for same.³¹

In the Final Rule, CMS does not detail its expectations regarding the extent of research a provider or supplier must undertake in order to determine whether an affiliated entity has a history of a disclosable event.  Instead, CMS imposes a “reasonableness” standard.  Pursuant to 42 C.F.R. § 424.519 (e), CMS may deny or revoke a provider’s or supplier’s Medicare enrollment if it “knew or should reasonably have known” information concerning a disclosable event of an affiliate, and it did not disclose such event to CMS.³²  Consistent with longstanding practice, providers and suppliers are not afforded pre-revocation due process protection.³³

The Final Rule lacks specificity regarding the “reasonableness standard.”  In the commentary to the Final Rule, CMS states its intent to issue sub-regulatory guidance in the future that will clarify its “expectations regarding the level of effort that is required in securing the relevant affiliation information.”³⁴  Until such sub-regulatory guidance is issued outlining with specificity CMS’s expectations, providers and suppliers must make good faith efforts to secure information concerning an affiliated entity’s disclosable events.  In the commentary to the Final Rule, CMS cautions providers and suppliers that, “we strongly reemphasize … actual knowledge without any attempt to research affiliation data” is insufficient to demonstrate compliance.³⁵  CMS notes that the required amount of research might include searching publicly available databases, reviewing internal records, and contacting the affiliated entities.³⁶  Importantly, researching publicly-available databases alone also will be insufficient to comply, because information surrounding all disclosable events is not publicly available.  For example, there is no publicly available database which lists providers or suppliers with existing Medicare debts.³⁷  Therefore, providers and suppliers will be reliant on their affiliates to provide accurate and complete information related to disclosable events.

Until CMS issues its sub-regulatory guidance providing greater clarity as to its expectations, at a minimum providers and suppliers should document all attempts to obtain such information from their affiliates.  If CMS were to identify a non-disclosed, disclosable event of an affiliation of a provider or supplier and deny or revoke a provider’s or supplier’s Medicare enrollment as a result, such documentation could be used in the appeals process to establish that the provider or supplier did not know or have reason to know of the event. 

D.     Undue Risk

After receiving information concerning a provider’s or supplier’s affiliates’ disclosable events, CMS will determine whether any of the affiliations poses an undue risk of fraud, waste or abuse.³⁸  In making this determination, CMS will consider “(1) the length and period of the affiliation; (2) the nature and extent of the affiliation; and (3) the type of disclosable event and when it occurred.”³⁹  However, in the Final Rule CMS declines to set forth specific thresholds that would establish undue risk, stating, “we must retain the flexibility to deal with the situation(s) on a case-by-case basis.”⁴⁰

E.     Phased-In Compliance

There are approximately 1.7 million providers and suppliers enrolled in Medicare, Medicaid and/or CHIP.⁴¹  For CMS to secure affiliation data from all providers and suppliers is a monumental undertaking.  Further, as noted above, CMS has acknowledged the administrative burdens attached to compliance with the Final Rule from the provider and supplier perspective.  Accordingly, at least “for now,” not all providers and suppliers will be required to research and disclose affiliation data.  Rather:

• For Medicare, (1) after CMS has updated its CMS-855 enrollment application forms to include an affiliation disclosure section; and (2) if CMS identifies⁴² at least one affiliation involving a disclosable event and requests that a provider or supplier report any and all affiliations; then (3) upon initial enrollment or revalidation (as applicable) the provider or supplier will be required to report all affiliations that have had a disclosable event.⁴³  In the Final Rule, CMS seeks public comment regarding potential approaches for securing affiliation data from all providers and suppliers.⁴⁴  Comments were due November 4, 2019.⁴⁵
• For Medicaid and CHIP, as with the Medicare phase-in approach, reporting to Medicaid and CHIP will not be required until after a state has revised its relevant enrollment applications to include an affiliation disclosure section.⁴⁶  Only providers and suppliers that are not enrolled in Medicare will be required to report to the state any affiliations that have a disclosable event.⁴⁷ Under the Final Rule, states may choose one of two options for the implementation of the affiliation disclosure requirement.⁴⁸  Once chosen, states are prohibited from changing their selections until after CMS engages in additional rulemaking.⁴⁹

1.      Option One:  All newly enrolling or revalidating Medicaid and/or CHIP providers must disclose data related to affiliations with disclosable events.⁵⁰
2.      Option Two:  Only after a state requests that a provider or supplier disclose an affiliation with disclosable events must the provider or supplier disclose data.  The disclosed data must not be limited only to data involving the affiliate identified by the state; instead, the provider or supplier will be required to submit data regarding all affiliations with disclosable events.⁵¹

IV.     Implications

There is no question that CMS has granted itself significant flexibility to determine whether an affiliation poses an undue risk of fraud, waste or abuse, which flexibility has the potential for arbitrary and capricious actions.  In the Final Rule, CMS attempts to assuage providers’ and suppliers’ concerns related to perceived unfettered discretion through repeated assertions that it will make determinations in a careful manner.  For example:

While we acknowledge that some affiliations may pose greater risks than others (and some may pose little, if any, risk), it is possible that even certain ‘‘distant’’ affiliations could, depending on the particular facts of the case, threaten the integrity of Medicare, Medicaid, or CHIP. We consequently must retain the discretion to review each case on its own merits by carefully considering the factors outlined in § 424.519(f)…⁵²

The disclosure requirement is entirely separate from any undue risk finding.  Indeed, CMS must first carefully review and analyze all disclosed affiliations before determining whether the undue risk standard…has been met; CMS will, in every case, act with caution and prudence and caution when determining whether an undue risk of fraud, waste, or abuse exists… ⁵³

[W]e stress that we will only take denial or revocation action pursuant to § 424.519(e) after careful consideration of the facts and circumstances and not as a matter of course…⁵⁴

As stated previously, we will exercise our denial or revocation authority under § 424.519(f) carefully.  However, we do not believe that the disclosable event must have involved intentional fraud or misconduct for an affiliation to present an undue risk.  Other types of affiliations involving behavior that does not contain such elements can endanger federal health care programs.  Again, we will carefully consider the circumstances of the disclosable event in making our undue risk determinations…⁵⁵

Providers and suppliers will soon learn how judicious CMS will be with its denial and revocation authority under the new regulation.  Providers, suppliers, and their legal counsel are well-advised to closely review the Final Rule and keep close watch for forthcoming sub-regulatory guidance.

V.     Provisions Affecting Medicare Only

The Final Rule also expands CMS’s denial and revocation authority under 42 C.F.R. §§ 424.530 and 424.535.⁵⁶  There are 10 main provisions of the Final Rule related to Medicare enrollment, which are discussed in detail below: (1) Revoked under Different Name, Identifier or Business Identity; (2) Non-Compliant Practice Location; (3) Improper Ordering, Certifying, Referring or Prescribing; (4) Referral of Debt to the United States Department of Treasury; (5) Failure to Report; (6) Payment Suspensions; (7) Other Federal Program Termination; (8) Extension of Revocation, (9) Voluntary Termination Pending Revocation; and (10) Extension of Reenrollment Bar and Reapplication Period. 

A.     Revoked under Different Name, Identifier or Business Identity

CMS and the OIG have identified numerous scenarios in which a provider or supplier has its Medicare enrollment revoked, and prior to the expiration of a reenrollment bar, the provider or supplier opens a new organization to replace the revoked one.  In such situations, family members or other individuals may pose or “front” as owners or managers on the entity, when in truth it is the revoked provider or supplier that is operating and profiting from the business.⁵⁷

To address these concerns, the Final Rule revises 42 C.F.R. §§ 424.530 (a) (12) and 424.535 (a) (18) to allow CMS to deny or revoke a provider’s or supplier’s Medicare enrollment if it determines that the provider or supplier is currently revoked under a different name, numerical identifier or business identity.⁵⁸  In making such a determination, CMS will consider the following:

• The owners and managing employees and organizations, even if such persons or entities are not identified on the CMS-855 enrollment application;
• Location (e.g., same city or county);
• Provider or supplier type;
• Business structure; and
• Any other evidence of similarity between the two parties.⁵⁹

CMS reserves the right to invoke its denial or revocation authority even if the two parties have different owners, locations or business structures, if other evidence suggests that a provider or supplier is attempting to evade a reenrollment bar.⁶⁰

B.     Non-Compliant Practice Location

Providers and suppliers with multiple practice locations, which may be separately enrolled with Medicare, raise additional program integrity considerations.  Consider the following illustration:

[A]ssume that a DMEPOS supplier has four separately enrolled locations.  The supplier shifts one of its locations without notifying Medicare, and the new site is a false storefront.  The supplier furnishes no items from this location, but it submits and bills for DME allegedly provided from this site.  Under our proposal, CMS could revoke this location as well as the three other sites.  Even if the other sites had different numerical identifiers, legal business names, or ownership, we could take action against them if there is evidence to suggest that they are effectively under the control of similar parties.  This is to ensure that providers and suppliers do not attempt to circumvent § 424.535 (a) (20) by opening locations under different identities or with different “front men” (such as family members).⁶¹

Prior to the effective date of the Final Rule, CMS did not have this authority.

To address situations where a provider or supplier bills for services or supplies rendered from locations that are non-compliant with Medicare enrollment requirements, the Final Rule adopts a new 42 C.F.R. § 424.535 (a) (20), expanding CMS’s revocation authority.  Under this provision, CMS may revoke a provider’s or supplier’s Medicare enrollment(s), including all of the provider’s or supplier’s locations, if it “billed for services performed at or items furnished from a location that it knew or should have known did not comply with Medicare enrollment requirements.”⁶²

The language contained in 42 C.F.R. § 424.535 (a) (20) is permissive; CMS may revoke any or all of provider’s or supplier’s Medicare enrollments if it determines that one practice location is noncompliant with Medicare’s requirements.  In making such a determination, CMS will consider the following factors:

• The type of non-compliance (e.g., whether the location constitutes a false storefront, is non-operational, etc.);
• The number of locations involved;
• The provider’s or supplier’s history of final adverse action(s) or Medicare or Medicaid payment suspensions;
• Whether allowing the other locations to remain enrolled in Medicare places the Medicare Trust Funds at risk;
• The length of time of non-compliance;
• The amount billed from the non-compliant location; and
• Any other evidence CMS deems relevant.

C.     Improper Ordering, Certifying, Referring or Prescribing

Under 42 C.F.R. § 424.535 (a) (8) (ii) (in place prior to implementation of the Final Rule), CMS may revoke a provider’s or supplier’s Medicare privileges if the provider or supplier has a pattern or practice of submitting claims that fail to meet Medicare requirements.  In addition, under 42 C.F.R. § 424.535 (a) (14) (also in place prior to implementation of the Final Rule), CMS may revoke a physician’s or eligible professional’s Medicare billing privileges if he or she has demonstrated a pattern or practice of prescribing Part D drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements.  However, prior to implementation of the Final Rule, there was no authority for CMS to revoke a provider’s or supplier’s Medicare privileges for ordering, certifying, referring or prescribing Medicare Part A or B items or services that fail to meet Medicare requirements.⁶³

Therefore, the Final Rule adopts a new 42 C.F.R. § 424.535 (a) (21), which grants CMS the authority to revoke a physician’s or eligible professional’s enrollment if he or she “has a pattern or practice of ordering, certifying, referring, or prescribing Medicare Part A or B services, items or drugs that is abusive, represents a threat to the health and safety of Medicare beneficiaries, or otherwise fails to meet Medicare requirements.”  To determine whether a pattern or practice constitutes improper behavior, CMS will consider the following factors: 

• Whether the physician’s or eligible professional’s order contained a diagnosis to support coverage for the services or supplies at issue;
• Whether it was impossible for an evaluation to have taken place to support the order at issue (e.g., if the patient was deceased);
• Whether the physician or eligible professional had been subject to disciplinary action(s) taken by a licensing body or the medical board for the state(s) in which the physician or eligible professional practiced;
• ·Whether the physician or eligible professional had a history of final adverse actions;
• The duration of the pattern or practice at issue;
• How long the physician or eligible practitioner had been enrolled in Medicare;
• ·Whether the physician or eligible professional had ever been a defendant in a malpractice action related to his or her ordering behaviors that resulted in  a final judgment against the physician or eligible professional or where the physician or eligible professional paid a settlement to the plaintiffs; 
• Whether any state Medicaid program or any other public or private health insurance program had taken action against the physician’s or eligible professional’s ability to practice medicine and the reasons for same; and
• Any other information CMS deems to be relevant.⁶⁴

D.     Referral of Debt to the United States Department of Treasury

Pursuant to the Debt Collection Improvement Act of 1996 (Public Law 104-134, April 26, 1996), federal agencies must refer eligible⁶⁵ delinquent debts to the United States Department of Treasury designated Debt Collection Center for cross-servicing and offset.⁶⁶  Eligible debts that are delinquent over 120 days are referred for cross-servicing and offset.⁶⁷  Prior to referring debts to the Department of Treasury, CMS attempts to recoup the debt under the procedures set forth in Chapter 4 of the Medicare Financial Management Manual (such procedures include recoupment by withholding payments and allowing a provider or supplier to enter into an extended repayment schedule).⁶⁸

CMS believes that if a provider or supplier has a delinquent debt that is eligible for referral to the Department of Treasury, this illustrates that the provider or supplier is unwilling to repay the debt, justifying revocation of the provider’s or supplier’s Medicare enrollment.  Therefore, the Final Rule creates a new 42 C.F.R. § 424.535 (a) (17), which serves to implement Section 1866(j)(5) of the Act and authorizes CMS to revoke a provider’s or supplier’s enrollment if he/she/it has an existing debt that is appropriately referred to the Department of Treasury.  In determining whether revocation is appropriate, CMS will consider the following factors:

• The reasons the debt has not been fully repaid;
• Whether the provider or supplier had tried to repay the debt;
• Whether the provider or supplier responded to CMS’ attempts to collect the debt;
• Whether the provider or supplier had a history of final adverse actions or Medicare or Medicaid payment suspensions;
• The amount of the debt; and
• Any other information that CMS deems to be relevant.⁶⁹

E.     Failure to Report

Prior to implementation of the Final Rule, 42 C.F.R. § 424.535 (a) (9) authorized CMS to revoke the Medicare enrollment of a physician, non-physician practitioner, physician group, or non-physician practitioner group for failure to comply with § 424.516 (d) (1) (ii) or (iii) (i.e., for failure to report a change in practice location or final adverse action within 30 days).  In the Final Rule, CMS expands 42 C.F.R. § 424.535 (a) (9) to apply to all of the reporting requirements in § 424.516 (d), and not only those codified in subsections (d) (1) (ii) and (iii).⁷⁰  This means that CMS may revoke the Medicare enrollment of a physician, non-physician practitioner, physician group, or non-physician practitioner group for failing to report a change in ownership, final adverse action, or practice location change within 30 days and all other changes in enrollment information within 90 days.⁷¹  In addition, the Final Rule expands the applicability of 42 C.F.R. § 424.535 (a) (9) to independent diagnostic testing facilities (IDTFs) and DMEPOS suppliers.⁷²  In determining whether revocation is appropriate, CMS will consider whether the data was eventually reported; when the data was reported (if it was reported); the materiality of the data; and any other information CMS deems to be relevant.⁷³

F.     Payment Suspensions

Prior to the effective date of the Final Rule, 42 C.F.R. § 424.530 (a) (7) authorized CMS to deny a provider’s or supplier’s Medicare enrollment application if a current owner, physician, or non-physician practitioner had been placed under a Medicare suspension.  The Final Rule implements Section 1866(j)(5) of the Act and expands the applicability of 42 C.F.R. § 424.530 (a) (7) to all provider and supplier types, and to Medicare and Medicaid payment suspensions imposed on any owner or any managing employee or managing organization of the provider or supplier (under any current or former name, numerical identifier, or business identity).⁷⁴  The Final Rule also authorizes CMS to impose a Medicare payment suspension if a provider or supplier is subject to a state Medicaid payment suspension.⁷⁵

G.     Other Federal Program Termination

In the Final Rule, CMS expands its denial and revocation authority involving state Medicaid program terminations and licensure actions.  CMS expressed concern that a provider’s or supplier’s behavior in a state Medicaid program could be easily replicated in the Medicare program, creating program integrity risk.⁷⁶

Under new 42 C.F.R. § 424.530 (a) (14) (i), CMS may deny a provider’s or supplier’s Medicare enrollment if:

The provider or supplier is currently terminated or suspended (or otherwise barred) from participation in a State Medicaid program or any other federal health care program, or the provider’s or supplier’s license is currently revoked or suspended in the State other than that in which the provider or supplier is enrolling.⁷⁷

These provisions apply even if an appeal is pending.⁷⁸

Under 42 C.F.R. § 424.535 (a) (12), CMS is authorized to revoke a provider’s or supplier’s Medicare enrollment if a state Medicaid agency terminates the provider’s or supplier’s state Medicaid enrollment.⁷⁹  Under the Final Rule, CMS’s authority to revoke a provider’s or supplier’s Medicare enrollment is broadened to include situations where the provider or supplier is terminated or revoked from participation in any other federal healthcare program.⁸⁰  CMS may not revoke a provider’s or supplier’s Medicare enrollment under this regulation unless and until all applicable appeal rights are exhausted.⁸¹

In determining whether to deny or revoke a provider’s or supplier’s Medicare enrollment under 42 C.F.R. § 424.530 (a) (14) or 42 C.F.R. § 424.535 (a) (12), CMS will evaluate the following:

• The reason(s) for the termination or revocation.
• Whether the provider or supplier:

*Is currently terminated, revoked, or otherwise barred from more than one program (for example, more than one state’s Medicaid program); or
*Has been subject to any other sanctions during its participation in other programs.

• Any other information that [CMS] deem[s] relevant to [its] determination.⁸²

H.     Extension of Revocation

It is a goal of CMS to ensure that if a provider or supplier is revoked for engaging in improper conduct, that provider or supplier may not remain in the Medicare program in any capacity.  Accordingly, in the Final Rule, CMS adds a new regulation, codified at 42 C.F.R. § 424.535 (i), to permit CMS to revoke all of a provider’s or supplier’s Medicare enrollments, including those under different names, numerical identifiers, or business identities, and including different provider and supplier types, if the provider or supplier faces Medicare revocation pursuant to 42 C.F.R. § 424.535 (a).⁸³  In making this determination, CMS will consider the following factors:

• The facts of the case and why the provider or supplier faced revocation;
• Whether the provider or supplier had a history of other final adverse actions;
• The number and type of other enrollments; and
• Any other information CMS deems to be relevant.⁸⁴

I.                   Voluntary Termination Pending Revocation

Prior to the implementation of the Final Rule, CMS observed scenarios in which a provider or supplier failed to comply with Medicare’s enrollment requirements and then voluntarily terminated his/her/its Medicare enrollment to avoid a potential revocation of that provider’s or supplier’s Medicare enrollment and corresponding reenrollment bar.⁸⁵  CMS views such actions as dishonest and a circumvention of the intent of the Medicare enrollment requirements.⁸⁶  The Final Rule addresses this program vulnerability.

Under the Final Rule, new 42 C.F.R. § 424.535 (j) (1) permits CMS to revoke a provider’s or supplier’s Medicare enrollment if it determines the provider or supplier voluntarily terminated its Medicare enrollment to avoid a revocation.⁸⁷  In making the determination, CMS will consider the following:

• Whether the provider or supplier knew or should have known that it was, or would become, out of compliance with Medicare enrollment requirements; and therefore whether the provider or supplier knew or should have known that it may be subject to revocation of its Medicare enrollment;
• Whether the provider or supplier voluntarily terminated its Medicare enrollment to circumvent such revocation; and
• Any other information CMS deems relevant.

J.     Reenrollment Bar and Reapplication Period

In addition to expanding CMS’s denial and revocation authority, the Final Rule also significantly extends the maximum reenrollment bar following revocation of a provider’s or supplier’s Medicare enrollment.  Prior to the Final Rule’s implementation, the maximum reenrollment bar following a revocation of a provider’s or supplier’s Medicare enrollment was three years.⁸⁸  The Final Rule revised 42 C.F.R. § 424.535 (c) as follows:

(1)   After a provider or supplier has had their [sic] enrollment revoked, they [sic] are barred from participating in the Medicare program from the effective date of the revocation until the end of the reenrollment bar.  The reenrollment bar –

     (i)  Begins 30 days after CMS or its contractor mails notice of the revocation and lasts a minimum of 1 year, but not greater than 10 years (except for the situation described in paragraphs (c) (2) and (3) of this section), depending on the severity of the basis for revocation.
     (ii)  Does not apply in the event a revocation of Medicare enrollment is imposed under paragraph (a) (1) of this section based on a provider’s or supplier’s failure to respond timely to a revalidation request or other request for information.

(2)   (i)  CMS may add up to 3 more years to the provider’s or supplier’s reenrollment bar (even if such period exceeds the 10-year period identified in paragraph (c) (1) of this section) if it determines that the provider or supplier is attempting to circumvent its existing reenrollment bar by enrolling in Medicare under a different name, numerical identifier or business identity…⁸⁹

(3)   CMS may impose a reenrollment bar of up to 20 years on a provider or supplier if the provider or supplier is being revoked from Medicare for the second time.  In determining the length of the reenrollment bar under this paragraph (c) (3), CMS considers the following factors:

     (i)  The reasons for the revocations.
     (ii)  The length of time between the revocations.
     (iii)  Whether the provider or supplier has any history of final adverse actions (other than revocations) or Medicare or Medicaid payment suspensions.
     (iv)  Any other information that CMS deems relevant to its determination.

(4)   A reenrollment bar applies to a provider or supplier under any of its current, former or future names, numerical identifiers or business identities.⁹⁰

In reply to commenters’ concerns that the expanded reenrollment periods were “excessive and overly punitive,” CMS responds that such maximums are necessary, first, to ensure that abusive providers and suppliers are kept out of the Medicare program, and second, as a deterrent to others from engaging in abusive conduct. ⁹¹  Declining to specify reenrollment bar lengths for particular acts, CMS provides the vague assurance that 10-year reenrollment bars would “generally be restricted to serious behavior.”⁹²  CMS also cautions that “serious misconduct” could take place without a criminal conviction.⁹³  Time will tell what actions CMS will deem to constitute “serious misconduct.”  At times, CMS has viewed administrative oversights to constitute actions serious enough to invoke the maximum reenrollment bar.  For example, prior to implementation of the Final Rule, CMS routinely doled out three-year reenrollment bars for a provider’s or supplier’s failure to report a change of information within the required timeframe(s).  Again, it is important to remember that CMS does not afford a due process right to respond to a proposed revocation.

The Final Rule also implements new 42 C.F.R. § 424.530 (f), prohibiting a prospective provider or supplier from enrolling in Medicare for up to three years if the prospective provider’s or supplier’s enrollment application is denied because the applicant submitted false or misleading information on, or if it omitted information from, its CMS-855 application.  In determining a reapplication bar’s length, CMS will consider:

• The materiality of the information;
• The prospective provider’s or supplier’s intent (i.e., whether it purposely submitted false or misleading information or purposely withheld information);
• Whether the prospective provider or supplier has a history of final adverse actions; and
• Any other information CMS deems relevant.⁹⁴

VI.     Conclusion

The illustrations provided within the Final Rule highlight CMS’s concerns related to the behaviors of certain providers and suppliers engaging in acts that jeopardize the integrity of the Medicare Trust Funds (e.g., sham store fronts, providers and suppliers with clear program integrity issues attempting to circumnavigate CMS’s authority to revoke their billing privileges and impose re-enrollment bars by voluntarily terminating their Medicare enrollments prior to revocation, etc.).  It is laudable to address these program vulnerabilities.  Despite CMS’s statements that it will carefully consider all relevant facts and circumstances prior to denying or revoking a provider’s or supplier’s Medicare enrollment, there have been occasions where providers and suppliers have been subject to revocation of their billing privileges for inadvertent administrative oversights.  Given CMS’s expanded program integrity authority, the stakes have never been higher for compliance.  Attorneys representing providers and suppliers must be more diligent than ever in helping clients ensure compliance with the Medicare enrollment regulations.

1. This article supplements two articles that previously appeared in The Health Lawyer:
   *“Medicare Enrollment:  CMS’s Most Potent Program Integrity Tool becomes Even Stronger,” by Donald H. Romano, Esq., Adrienne Dresevic, Esq. and Jessica L. Gustafson, Esq., The Health Lawyer, Vol. 28, No. 3, February 2016.
   *“The Medicare Enrollment Process – CMS’ Most Potent Program Integrity Tool,” Adrienne Dresevic, Esq. and Donald H. Romano, Esq., The Health Lawyer, Vol. 23, No. 4, April 2011.
   
   The authors would like to thank Donald H. Romano, Esq. for his assistance with this article.
2. 84 Fed. Reg. 47794 (September 10, 2019), available at https://www.govinfo.gov/content/pkg/FR-2019-09-10/pdf/2019-19208.pdf.
3. Comments to the Final Rule also were due November 4, 2019. 
4. 84 Fed. Reg. at 47794.
5. 42 U.S.C. § 1395cc.
6. Pub. L. No. 108-173, § 936(a)(2). 
7. 71 Fed. Reg. 20754 (April 21, 2006).
8. Id.
9. https://www.ecfr.gov/cgi-bin/text-idx?SID=bf5aec9e53de3c3ba54589689223cc51&mc=true&node=pt42.3.424&rgn=div5#sp42.3.424.p.
10. 42 C.F.R. § 424.510.
11. The paper CMS-855 enrollment applications are available here: https://www.cms.gov/medicare/provider-enrollment-and-certification/medicareprovidersupenroll/enrollmentapplications.html. 
    The PECOS system is available here:  https://pecos.cms.hhs.gov/pecos/login.do#headingLv1.
12. 84 Fed. Reg. at 47796 and 42 C.F.R. § 424.510.
13. 84 Fed. Reg. at 47796 and 42 C.F.R. §§ 424.515 and 424.516.
14. 42 U.S.C. § 1395cc.
15. Section 1902(kk)(3) of the Act requires states to require Medicaid providers and suppliers to comply with Section 1866(j)(5) of the Act..
    
    Section 2107(e) of the Act makes Section 1902(kk)(3) of the Act applicable to CHIP.
16. See 42 C.F.R. § 424.519 (b), which requires the following:
    
    Upon a CMS request, an initially enrolling or revalidating provider or supplier must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “owner” and “managing employee” as defined in § 424.502) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid or CHIP provider or supplier that has a disclosable event (as defined in § 424.502).  CMS will request such disclosures when it has determined the initially enrolling or revalidating provider or supplier may have at least one such affiliation.
    
    84 Fed. Reg. at 47853.  See also Appendix A, which sets forth the text of 42 C.F.R. § 424.519 as implemented.
    
    Corresponding requirements related to disclosure to Medicaid are set forth at 42 C.F.R. § 455.107.  Requirements related to disclosures to CHIP are set forth at 42 C.F.R. § 457.990. 
17. Indirect partnership interests do not fall within the definition of partnership interests for the purposes of the regulation.  84 Fed. Reg. at 47799.
18. 42 C.F.R. § 424.502.
19. Id.
20. See Section 1124 (a) (3) of the Act.
21. See 84 Fed. Reg. 47800. 
22. Id. at 47802 and 42 C.F.R. § 424.519.
23. Id. and 84 Fed. Reg. at 47808.
24. Under the Final Rule, 42 C.F.R. § 424.519 (b) requires the following:
    
    Upon a CMS request, an initially enrolling or revalidating provider or supplier must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “owner” and “managing employee” as defined in § 424.502) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid or CHIP provider or supplier that has a disclosable event (as defined in § 424.502).  CMS will request such disclosures when it has determined the initially enrolling or revalidating provider or supplier may have at least one such affiliation.
    
    See 84 Fed. Reg. at 47853.
25. After soliciting comments regarding whether there should be a monetary threshold for mandating reporting of uncollected debts, CMS declined to establish one.  In particular, CMS stated, “Our preferred approach is to consider the debt’s amount as a factor in determining whether the debt presents an undue risk of fraud, waste, or abuse….In short, we believe that viewing the debt amount as one factor among several, rather than automatically excluding all smaller debts from consideration, will give us the necessary flexibility to address a variety of factual scenarios.”  Id. at 47805.  Declining to establish a monetary threshold for reporting uncollected debts leaves CMS discretion to deny or revoke a provider’s or supplier’s enrollment that has an affiliate with an uncollected Medicare debt that could be of de minimis value.  Id.
26. Many commenters disagreed with including voluntary terminations within the scope of disclosable events.  These commenters argued that including voluntary terminations was contrary to congressional intent, and further noted that many voluntary terminations are innocent and pose no program integrity risks.  84 Fed. Reg. at 47808.  CMS disagreed with these commenters.  In particular, CMS determined that including voluntary terminations within the scope of disclosable events is necessary to prevent situations where a provider or supplier voluntarily terminates his/her/its Medicare enrollment in order to avoid a revocation and reenrollment bar.  Id.
27. Id. at 47800.
28. Id. at 47801.
29. Id. at 47802. 
30. 84 Fed. Reg. at 47811, citing 42 C.F.R. § 424.519 (e).
31. 84 Fed. Reg. at 47810 and 42 C.F.R. §§ 424.519 (c) and (d). 
    
    See also 84 Fed. Reg. at 47817 and 42 C.F.R. § 455.107 (c) involving Medicaid claims.  For purposes of disclosure to Medicaid, the Final Rule provides that, “affiliation disclosures are to be furnished ‘in a form and manner and at such time as determined by the Secretary.’ To comply with this requirement, we believe that states should consult with CMS as to the ‘form and manner’ of said disclosures.”
32. 84 Fed. Reg. at 47811. 
33. See Unlawful, Unfair and Unwise: Constitutional and Rulemaking Infirmities In CMS’s Enrollment Revocation Regulations and  How to Challenge Them,” Donald H. Romano Esq., The Health Lawyer, Vol. 31, No. 6, August  2019 (taking the position that the lack of a right to respond pre-revocation is both illegal and unfair, and contrary to how the OIG runs its exclusion process).
34. 84 Fed. Reg. at 47811. 
35. Id.
36. Id.
37. In commentary to the Final Rule, CMS notes, “we understand the concerns about a provider’s or supplier’s ability to obtain debt (and other) data from affiliates.”  Id. Although CMS may understand providers’ and suppliers’ concerns, the Final Rule does not provide leniency with respect to the disclosure requirements for events that a provider or supplier is unable to independently research.
38. Id. at 47812 and 42 C.F.R. § 424.519 (f). 
    
    See also 84 Fed. Reg. at 47817 and 42 C.F.R. § 424.107 (f).  In the situations involving Medicaid, the state, in consultation with CMS, will determine whether there is undue risk of fraud, waste or abuse. 
39. 84 Fed. Reg. at 47812.
40. Id. In response to a commenter’s expressed concern that “the lack of objective standards regarding undue risk creates a high potential for inconsistent determinations on comparable facts,” and suggestion that CMS adopt a decision matrix weighting relevant factors, CMS stated the following:
    
    Response.  We appreciate this suggestion but do not believe such a matrix is necessary or advisable.  Given the vast variety of factual situations we will encounter, as stated previously, we must retain as much flexibility as possible in our undue risk determinations.  We believe that elements such as “decision weights” would adversely impact our ability to fairly consider all of the facts, since it would effectively require that specific “scores” be given for certain criteria and circumstances.
    
    Id. at 47814.
41. Id. at 47804.
42. CMS will review PECOS data, other CMS databases and “external, non-CMS databases” to determine whether a provider or supplier has an affiliation with a provider or supplier with a disclosable event.  Specifically, CMS will research whether an affiliate
    
    ++ Currently has an uncollected debt to Medicare, Medicaid or CHIP.
    ++ Has been or is subject to a payment suspension under a federal healthcare program.
    ++ Has been or is excluded by the OIG for participation in Medicare, Medicaid or CHIP.
    ++ Has had its Medicare, Medicaid or CHIP enrollment denied, revoked or terminated. 
    
    Id.  From the point of view of CMS, these events raise potential program integrity concerns of such significance to justify disclosure of all applicable affiliations.  Id.
43. Id. and 42 C.F.R. § 424.519 (b).  Despite the compliance phase-in, CMS retains the right to deny or revoke a provider’s or supplier’s Medicare enrollment based on that provider’s or supplier’s affiliation relationship before reporting is required under the regulations.  See 42 C.F.R. § 424.519 (i). 
44. 84 Fed. Reg. at 47804.
45. Id. at 47794.
46. Id. at 47816 and 42 C.F.R. § 455.107 (b).  However, CMS makes clear in its Final Rule that a state may deny or terminate a provider’s or supplier’s Medicaid or CHIP enrollment based on the provider’s or supplier’s affiliation relationships even before reporting is required under the regulations:
    
    [P]er § 455.107 (h) and as addressed in more detail later in this section, if a state determines that a provider has an affiliation(s) – via a source(s) other than provider reporting – and determines, in consultation with CMS, that one or more affiliations of that provider represent an undue risk of fraud, waste, or abuse, the state may deny or terminate the provider’s enrollment in the state Medicaid program even before the state’s applications (or other means of capturing affiliation information, whether in physical or electronic form) have been updated with an affiliation disclosure section.  
47. Id. at 47816.
48. Id.
49. Id.
50. Id.
51. Id. 
52. Id. at 47801-47802.
53. Id. at 47804.
54. Id. at 47811.
55. Id. at 47814
56. Appendix B includes the text of 42 C.F.R. § 424.530 prior to the implementation date of the Final Rule compared with the text of 42 C.F.R. § 424.530 as revised and supplemented by the Final Rule.  Appendix C includes the text of 42 C.F.R. § 424.535 prior to the implementation date of the Final Rule compared with the text of 42 C.F.R. § 424.535 as revised and supplemented by the Final Rule.
57. Id. at 47822, referencing a 2008 OIG Early Alert Memorandum, available here:  https://oig.hhs.gov/oei/reports/oei-06-07-00080.pdf.
58. 84 Fed. Reg. at 47822-47823.
59. Id.
60. Id.
61. Id. at 47823.  “DMEPOS” refers to durable medical equipment, prosthetics, orthotics and supplies.
62. Id. and 42 C.F.R. § 424.535 (a) (20).  
63. Id. at 47825.
64. Id.
65. A debt is legally enforceable only if there has been a final agency determination with respect to the obligation and there are no legal bars to collection action.  The Medicare Financial Management Manual (CMS Internet-Only Publication 100-06), Chapter 4, Section 70.6, clarifies that overpayments “in appeal status (pending at any level)” constitute debts ineligible for referral.  Therefore, if a provider or supplier receives an overpayment demand and submits an appeal of the initial determination, that “debt” is ineligible for referral until the appeals process has concluded.
66. Id. at 47828.
67. Id.
68. Id.  See also Chapter 4 of the Medicare Financial Management Manual (CMS Internet-Only Publication 100-06), available at https://www.cms.gov/Regulations-and-Guidance/Guidance/Manuals/Downloads/fin106c04.pdf.
69. 84 Fed. Reg. at 47828-47829.
70. Id. at 47829.
71. Id.
72. Id.
73. Id.
74. Id. at 47830.
75. Id. at 47831.  See also 42 C.F.R. § 405.371.
76. Id. at 47831.
77. Id. at 47854.
78. Id. at 47831.
79. Id.
80. Id.
81. Id. at 47832.
82. Id. at 47831.
83. Id. at 47832.
84. Id.
85. Id. at 47833.
86. Id.
87. Id.
88. Id. at 47826.
89. If CMS determines that it is appropriate to impose an additional three-year reenrollment bar under this section, a provider or supplier may appeal this determination.  The appeal would be limited to the additional three-year period; it would not extend to the original reenrollment bar.  Id.
90. Emphasis added. 
91. 84 Fed. Reg. at 47826.
92. Id. at 47827.
93. Id.
94. 84 Fed. Reg. at 47826.
    

About the Authors

Jessica L. Gustafson is a founding shareholder with the healthcare law firm of The Health Law Partners, P.C. Ms. Gustafson co-leads the firm’s Recovery Audit (RAC) and Medicare appeals practice group, and specializes in a number of areas, including Medicare, Medicaid and other payor audit appeals; healthcare regulatory matters; compliance matters; reimbursement; and contracting matters. She is a member of the editorial board of the ABA Health eSource, the American Bar Association Health Law Section’s monthly online magazine. She can be reached at [email protected].

Adrienne Dresevic is a founding shareholder of The Health Law Partners, P.C. Ms. Dresevic practices in all areas of healthcare law and devotes a substantial portion of her practice to providing clients with counsel and analysis regarding Compliance and Stark and fraud and abuse. She is a published author and regular speaker on matters relating to Compliance, Stark and Fraud and Abuse at industry and professional conferences. Ms. Dresevic is an instructor for the University of Florida, teaching the Pharmaceutical Fraud and Abuse Online program for three years.  Ms. Dresevic is a member of the American Bar Association (ABA), American Health Lawyers Association, State Bar of Michigan, and State Bar of New York. She serves as the Budget Officer of the ABA Health Law Section and has also served as the past co-Chair of the Section’s Physicians Legal Issues Conference.  Ms. Dresevic can be reached at [email protected].