Medicare Program; Surety Bond Requirement for Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS), 166-200 [E8-30802]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 74, Number 1 (Friday, January 2, 2009)]
[Rules and Regulations]
[Pages 166-200]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E8-30802]



[[Page 165]]

-----------------------------------------------------------------------

Part II





Department of Health and Human Services





-----------------------------------------------------------------------



Centers for Medicare & Medicaid Services



-----------------------------------------------------------------------



42 CFR Part 424



Medicare Program; Surety Bond Requirement for Suppliers of Durable 
Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS); Final 
Rule

Federal Register / Vol. 74, No. 1 / Friday, January 2, 2009 / Rules 
and Regulations

[[Page 166]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 424

[CMS-6006-F]
RIN 0938-AO84


Medicare Program; Surety Bond Requirement for Suppliers of 
Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
(DMEPOS)

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: Consistent with section 4312(a) of the Balanced Budget Act of 
1997 (BBA), this final rule implements section 1834(a)(16) of the 
Social Security Act (the Act) by requiring certain Medicare suppliers 
of durable medical equipment, prosthetics, orthotics and supplies 
(DMEPOS) to furnish CMS with a surety bond.

DATES: Effective Date: These regulations are effective on March 3, 
2009.

FOR FURTHER INFORMATION CONTACT: Frank Whelan, (410) 786-1302.

SUPPLEMENTARY INFORMATION:

I. Background

A. General and Legislative History

    Medicare services are furnished by two types of entities--providers 
and suppliers. At Sec.  400.202, ``provider'' is defined as a hospital, 
a critical access hospital (CAH), a skilled nursing facility, a 
comprehensive outpatient rehabilitation facility, a home health agency 
(HHA), or a hospice that has in effect an agreement to participate in 
Medicare, or a clinic, a rehabilitation agency, or a public health 
agency that has in effect a similar agreement but only to furnish 
outpatient physical therapy or speech pathology services, or a 
community mental health center that has in effect a similar agreement 
but only to furnish partial hospitalization services. The term 
``provider'' is also defined in sections 1861(u) and 1866(e) of the 
Social Security Act (the Act).
    The term ``supplier'' is defined at section 1861(d) of the Act and 
includes an entity that furnishes durable medical equipment, 
prosthetics, orthotics, and suppliers (DMEPOS). Other supplier 
categories may include, for example, physicians, nurse practitioners 
(NPs), and physical therapists. The term ``DMEPOS'' encompasses the 
types of items included in the definition of medical equipment and 
supplies found at section 1834(j)(5) of the Act. As used in this final 
rule, the term ``supplier'' refers only to a supplier of DMEPOS.
    For purposes of the DMEPOS supplier standards, the term ``DMEPOS 
supplier'' is defined in Sec.  424.57(a) as an entity or individual, 
including a physician or Part A provider, that sells or rents Part B 
covered DMEPOS items to Medicare beneficiaries and that meets the 
DMEPOS supplier standards. Those individuals or entities that do not 
furnish DMEPOS items but furnish other types of health care services 
only (for example, physician services or NP services) would not be 
subject to this requirement.

B. Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
(DMEPOS)

1. Durable Medical Equipment
    The term DME is defined at section 1861(n) of the Act. This 
definition, in part, excludes from coverage as DME those items 
furnished in skilled nursing facilities and hospitals (equipment 
furnished in those facilities is paid for as part of their routine or 
ancillary costs). Also, the term ``DME'' is included in the definition 
of ``medical and other health services'' found at section 1861(s)(6) of 
the Act. Furthermore, the term is defined in Sec.  414.202 as equipment 
furnished by a supplier or a HHA that--
    (1) Can withstand repeated use;
    (2) Is primarily and customarily used to serve a medical purpose;
    (3) Generally is not useful to an individual in the absence of an 
illness or injury; and
    (4) Is appropriate for use in the home.

Examples of DMEPOS supplies include items such as blood glucose 
monitors, hospital beds, nebulizers, oxygen delivery systems, and 
wheelchairs.
2. Prosthetic Devices
    Prosthetic devices are included in the definition of ``medical and 
other health services'' under section 1861(s)(8) of the Act. Prosthetic 
devices are defined in this section of the Act as ``devices (other than 
dental) which replace all or part of an internal body organ (including 
colostomy bags and supplies directly related to colostomy care), 
including replacement of such devices, and including one pair of 
conventional eyeglasses or contact lenses furnished subsequent to each 
cataract surgery with insertion of an intraocular lens.'' Other 
examples of prosthetic devices include cardiac pacemakers, cochlear 
implants, electrical continence aids, electrical nerve stimulators, and 
tracheostomy speaking valves. Under section 1834(h)(4)(B) of the Act, 
prosthetic devices do not include parenteral and enteral nutrition 
nutrients and implantable items payable under section 1833(t) of the 
Act.
3. Orthotics and Prosthetics
    Section 1861(s)(9) of the Act provides for the coverage of ``leg, 
arm, back, and neck braces, and artificial legs, arms, and eyes, 
including replacements if required because of a change in the patient's 
physical condition.'' As indicated by section 1834(h)(4)(C) of the Act, 
these items are often referred to as ``orthotics and prosthetics.''
4. Supplies
    Section 1861(s)(5) of the Act includes ``surgical dressings, 
splints, casts, and other devices used for reduction of fractures and 
dislocation'' as one of the ``medical and other health services'' that 
is covered by Medicare. Other items that may be furnished by suppliers 
would include (among others):
     Prescription drugs used in immunosuppressive therapy 
furnished to an individual who receives an organ transplant for which 
payment is made under this title, and that are furnished within a 
certain time period after the date of the transplant procedure as noted 
at section 1861(s)(2)(j) of the Act.
     Extra-depth shoes with inserts or custom molded shoes with 
inserts for an individual with diabetes as listed at section 
1861(s)(12) of the Act.
     Home dialysis supplies and equipment, self-care home 
dialysis support services, and institutional dialysis services and 
supplies included at section 1861(s)(2)(F) of the Act.
     Oral drugs prescribed for use as an anticancer therapeutic 
agent as specified in section 1861(s)(2)(Q) of the Act.
     Self-administered erythropoietin as described in section 
1861(s)(2)(O) of the Act.

C. The January 20, 1998 Proposed Rule

    In the Medicare Program; Additional Supplier Standards proposed 
rule published in the January 20, 1998 Federal Register (63 FR 2926), 
we proposed to reflect the changes made to section 1834 of the Act by 
section 4312(a) of the Balanced Budget Act of 1997 (BBA) (Pub. L. 105-
33). (Section 4312(a) of the BBA amended section 1834(a) of the Act by 
adding paragraph (a)(16)(B), which requires a DME supplier to provide 
us, on a continuing basis, with a surety bond of at least $50,000, as a 
condition of the issuance or renewal of a provider number. Section 
1834(a)(16) of the Act, as amended by section 4312(c) of the BBA, 
further provides that we may also

[[Page 167]]

require a surety bond from some or all providers or suppliers who 
furnish items or services under Medicare Part A or Part B.) In the 
January 20, 1998 proposed rule, we also proposed that for each tax 
identification number (TIN) for which a supplier billing number is 
issued, a DMEPOS supplier must obtain a surety bond in an amount not 
less than $50,000.
    On October 11, 2000, we published a final rule titled, ``Medicare 
Program; Additional Supplier Standards (HCFA-6004-FC)'' in the Federal 
Register (65 FR 60366). However, as we stated in the October 11, 2000 
final rule with comment that we decided not to incorporate the 
provisions related to surety bonds into this final rule with comment, 
but rather issue the surety bond provisions as a proposed rule at a 
future date.
    In 2003, the Congress enacted section 902 of the Medicare 
Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 
108-173) (MMA) which prohibits the Secretary from finalizing a proposed 
rule related to Title 18 that was published more than 3 years earlier 
except under exceptional circumstances. In light of section 902 of MMA 
and our previous decision to issue a proposed rule, we published a 
proposed rule titled, ``Medicare Program; Surety Bond Requirement for 
Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and 
Supplies'' (DMEPOS) (CMS-6006-P) in the Federal Register (72 FR 42001) 
on August 1, 2007.

II. Provisions of the Proposed Regulations

    In the August 1, 2007 Federal Register (72 FR 42001), we proposed 
to implement the statutory surety bond requirement set forth in section 
1834(a)(16)(B) of the Act.
    Given the lapse in time between the statutory effective date (that 
is, section 1834 of the Act was amended by section 4312(a) of the BBA 
enacted on August 5, 1997) and the date of the proposed rule, we 
proposed to adjust the amount of the surety bond from $50,000 in 1997 
by the Consumer Price Index (CPI) resulting in a higher surety bond 
amount. In doing so, we proposed to adjust the initial surety bond 
amount of $50,000 by the CPI and calculated that a $50,000 surety bond 
in 1997 would equate to a surety bond value of $64,907.17 in 2007. 
Further, we rounded the calculated value of $64,907.17 to the nearest 
thousand to derive a surety bond amount of $65,000. We proposed that 
establishing a $65,000 surety bond for DMEPOS suppliers would: (1) 
Limit the Medicare program risk to fraudulent DME suppliers; (2) 
enhance the Medicare enrollment process to help ensure that only 
legitimate DME suppliers are enrolled or are allowed to remain enrolled 
in the Medicare program; (3) ensure that the Medicare program recoups 
erroneous payments that result from fraudulent or abusive billing 
practices by allowing CMS or its designated contractor to seek payments 
from a surety up to the penal sum; and (4) help ensure that Medicare 
beneficiaries receive products and services that are considered 
reasonable and necessary from legitimate DME suppliers.
    In Sec.  424.57(a), we proposed to define the following terms as 
they are used throughout the regulation in the context of the surety 
bond requirements:
     Assessment.
     Authorized Surety.
     Civil money penalty.
     Government-Operated Suppliers.
     National Supplier Clearinghouse (NSC).
     Penal Sum.
     Rider.
     Sufficient evidence.
     Surety bond.
     Unauthorized Surety.
     Unpaid claim.
    Although we proposed to define ``unauthorized surety'', we 
clarified that we did not envision that we would need to declare a 
surety to be unauthorized except on rare occasions. We anticipate that 
virtually every surety would provide us, upon written request, 
information needed to verify the identity of a bondholder, the 
effective date of the bond, and proof that the surety issued the bond 
as represented by the supplier. However, if a surety fails to comply 
with our request for this information, we would consider that surety as 
unauthorized to provide bonds to DMEPOS suppliers seeking enrollment in 
the Medicare program. We believe that without this provision, some 
sureties may not be inclined to provide information we need on a timely 
basis.
    Furthermore, a surety is unauthorized if it had previously failed 
to comply with a reasonable request from us for payment against a bond. 
An example of a reasonable request would be a request in writing, 
signed by an official of CMS or its representatives, or documentation 
about the amount payable by the supplier. This provision would allow us 
to take action to prevent a surety from issuing a bond to a Medicare 
DMEPOS supplier in cases where we have determined that the surety 
failed to meet its obligations to the Medicare program.
    In Sec.  424.57, we proposed to add new (c)(26). Specifically, we 
proposed that--
     Section 424.57(c)(26) would specify the requirements for a 
DMEPOS supplier seeking to become a Medicare-enrolled DMEPOS supplier.
     Section 424.57(c)(26)(i) would clarify the minimum 
requirements for a DMEPOS supplier. We specified that each Medicare-
enrolled DMEPOS supplier must obtain a surety bond for each National 
Provider Identifier (NPI) from an authorized surety. The surety bond or 
government security would have had to be in the amount of $65,000 and 
in the form specified by the Secretary. While we proposed to adjust the 
amount of the surety bond from $50,000 in 1997 by the CPI and calculate 
a higher surety bond amount of $65,000 in 2007, we did not propose to 
adjust the base surety bond amount by the CPI annually thereafter. 
However, we would consider whether any additional adjustments (increase 
or decrease) in the base bond amount are necessary through a future 
rulemaking effort.
     Section 424.57(c)(26)(i)(A) would specify that a DMEPOS 
supplier must submit a surety bond with its initial paper or electronic 
Medicare enrollment application (CMS-855S, OMB Number 0938-0685) or 
with its paper or electronic revalidation or reenrollment application.
     Section 424.57(c)(26)(i)(B) would specify how a change of 
ownership interest affects the DMEPOS supplier.
     Section 424.57(c)(26)(i)(C) would specify that a DMEPOS 
supplier seeking to enroll a new location must obtain a new surety bond 
for this new location since this new location is also required to be 
enumerated with a unique NPI.
     Section 457.57(c)(26)(ii) would establish an exception to 
the bond requirement for a DMEPOS supplier operated by a Federal, 
State, local, or tribal government agency if the DME supplier has 
provided CMS with a comparable surety bond required under State law and 
if the supplier does not have any unpaid claims, civil money penalties 
(CMPs), or assessments. However, a government-operated supplier that 
did not qualify for an exception would have to submit a surety bond. We 
have determined that an exception to the surety bond requirement for 
government-operated suppliers extends only to those suppliers that have 
a good history of paying their Medicare debts. The basis for this 
exception is principally that government-operated suppliers have the 
power to tax; therefore, it is unlikely that these DMEPOS suppliers 
will be

[[Page 168]]

unable to pay their Medicare debts. Thus, government-operated DMEPOS 
suppliers, by their public nature, furnish a comparable or greater 
guarantee of payment than would be afforded us by a surety bond issued 
by a private surety.
    Also, a supplier operating under a contract with a government 
agency but not owned and staffed by the government would not qualify 
for this exception. Our experience with previously published rules 
suggests that a government-operated entity would timely pay their 
Medicare debts (see the HHA surety bond final rule published in the 
Federal Register on January 5, 1998 (63 FR 315); amended by a final 
rule published in the Federal Register on March 4, 1998 (63 FR 10731); 
a final rule published in the Federal Register on June 1, 1998 (63 FR 
29656); and a final rule published in the Federal Register on July 21, 
1998 (63 FR 41171)).
     We solicited comments on whether to establish exceptions 
for certain types of suppliers. Specifically, we solicited the 
following comments:
    + Whether we should consider establishing an exception to the 
surety bond requirement for certain physicians and nonphysician 
practitioners (NPPs), such as those that occasionally furnish DMEPOS 
items for the convenience of their patients. While we sought comments 
about establishing an exception for physicians and NPPs, we were not 
certain about the scope of the exception that should be established for 
physicians and NPPs. As such, we solicited comments on how to identify 
whether a physician or NPP should be given an exception to the surety 
bond requirement. We also solicited comments on any other appropriate 
criteria that we should use when considering the establishment of an 
exception to this requirement for certain physicians and NPPs.
    + Whether we should establish an exception to the surety bond 
requirement for licensed pharmacists who furnish DMEPOS items for the 
convenience of their patients and any other appropriate criteria that 
we should consider in establishing an exception to this requirement for 
licensed pharmacists.
    + Any other appropriate criteria that we should consider in 
establishing an exception to this requirement for these types of 
suppliers.
    + Whether we should establish an exception to the surety bond 
requirement for large, publicly traded chain suppliers of DMEPOS and on 
any appropriate criteria that we should consider in waiving this 
requirement for these types of suppliers.
    + The appropriate criteria that we may use for establishing 
exceptions for other types of DMEPOS suppliers from the requirement to 
purchase a surety bond.
     Section 424.57(c)(26)(iii) would specify the terms of a 
bond submitted by a DMEPOS supplier.
     Section 424.57(c)(26)(iv) would specify additional DMEPOS 
supplier bond requirements and would specify the surety's liability 
under the bond for unpaid claims, CMPs, or assessments that the surety 
is liable to us, up to a total of the full penal amount of the bond. 
Thus, since we proposed that surety bonds be issued in an amount equal 
to $65,000, the surety is liable to us for up to $65,000.
     Section 424.57(c)(26)(v) would specify the requirements to 
cancel a surety bond. Specifically, this section would allow a DMEPOS 
supplier to terminate or cancel a bond upon proper notice to the NSC. 
If another bond is submitted and there is a lapse in bond coverage, 
Medicare would not pay for items or services furnished during the gap 
in coverage, and the DMEPOS supplier would be held liable for the items 
or services (that is, the DMEPOS supplier would not be permitted to 
charge the beneficiary for the items or services). Failure by the 
DMEPOS supplier to submit another bond would result in the revocation 
of the DMEPOS supplier's Medicare billing privileges. The supplier 
would be required to refund the beneficiary any amounts collected for 
services or supplies furnished during the gap in the surety bond 
coverage. Finally, a supplier or surety may not make amendment to a 
conforming bond that will limit the scope or term of the bond in a 
manner resulting in the bond no longer conforming to the provisions of 
this regulation. Any attempt to do so may result in the revocation of 
the DMEPOS supplier's billing privileges and a determination that the 
surety is an unauthorized surety.
     Section 424.57(c)(26)(vi) would specify that the bond must 
provide that actions under the surety bond may be brought by our 
contractors or us.
     Section 424.57(c)(26)(vii) would specify that the surety 
must provide information regarding its physical location including its 
name, street address, city, state, and zip code and, if different, its 
mailing address, including name, post office box, city, state, and zip 
code.
     Section 424.57(c)(26)(viii) would specify the submission 
date and the term of the DMEPOS supplier bond.
     Section 424.57(c)(26)(viii)(A) would specify that each 
enrolled DMEPOS supplier that does not meet the criteria for an 
exception must submit to the NSC an initial surety bond before (60 days 
following the publication date of the final rule).
     Section 424.57(c)(26)(viii)(B) would specify the type of 
bond required to be submitted by a DMEPOS supplier under this subpart 
must be either a continuous bond or an annual bond, with the exception 
of the initial bond which may differ as specified in this section.
     Section 424.57(c)(26)(ix) would specify the loss of a 
DMEPOS supplier exception. A DMEPOS supplier that no longer qualifies 
for an exception as a government-operated DMEPOS supplier must submit a 
surety bond to the NSC within 60 days after it receives notice that it 
no longer meets the criteria for an exception.
     Section 424.57(c)(26)(x) would specify the conditions 
under which a DMEPOS supplier changes a surety.
     Section 424.57(c)(26)(xi) would specify who the parties 
are to the bond.
     Section 424.57(c)(26)(xii) would specify the effect of a 
DMEPOS supplier's failure to obtain and maintain a surety bond.
     Section 424.57(c)(26)(xii)(A) would specify that we may 
revoke the DMEPOS supplier's billing privileges if an enrolled supplier 
fails to obtain, file timely, and maintain a surety bond as specified 
in this subpart and as instructed by us. The revocation is effective 
with the date the bond lapsed, and any payments for items or services 
furnished on or after that date must be repaid to us by the DMEPOS 
supplier.
     Section 424.57(c)(26)(xii)(B) would specify that we refuse 
to issue billing privileges to the DMEPOS supplier if a DMEPOS supplier 
seeking to become an enrolled DMEPOS supplier fails to obtain and file 
timely a surety bond as specified in this subpart and our instructions.
     Section 424.57(c)(26)(xiii) would specify the 
documentation that a DMEPOS supplier must have to be in compliance with 
these requirements and that we may require a supplier to produce 
documentation demonstrating that it has a bond and that it meets the 
requirements of this section.
     Section 424.57(c)(26)(xiv) would specify the effect of 
subsequent DMEPOS supplier payments paid to us. If a surety has paid an 
amount to us on the basis of liability incurred under a bond and we 
subsequently collect from the DMEPOS supplier, in whole or in part, on 
the unpaid claims, CMPs, or assessments that were the basis for the 
surety's liability, we would reimburse

[[Page 169]]

the surety the amount that we collected from the DMEPOS supplier, up to 
the amount paid by the surety to us, provided the surety has no other 
liability to us under the bond.
     Section 424.57(c)(26)(xv) would specify the effect of a 
review reversing an appealed determination. We would refund to the 
DMEPOS supplier the amount that the DMEPOS supplier paid us, to the 
extent that the amount relates to the matter that was successfully 
appealed, provided all review, including judicial review, has been 
completed on the matter.
    In addition, DMEPOS suppliers have the right to appeal any adverse 
decisions with respect to unpaid claims, CMPs or assessments. DMEPOS 
suppliers must use the following applicable appeals provisions 
specified in 42 CFR associated with each adverse determination: Part 
405, subpart I (claims appeals); Part 1003 (civil money penalties); and 
Part 498 (Medicare participation and enrollment).
    We believe that the appeals processes as they apply to DMEPOS 
suppliers and sureties should be addressed through a private contract 
between the parties. Specifically, we believe that sureties should 
consider requiring DMEPOS suppliers to agree to repay the surety any 
payments made by a Medicare contractor resulting from a DMEPOS 
supplier's appeal of any adverse decisions with respect to unpaid 
claims, CMPs, or assessments. Any such contract must be consistent with 
the applicable appeals processes referenced above. In determining 
whether a private contract is necessary, we suggest that the sureties 
and DMEPOS suppliers consider the following types of provisions: 
Appointment of representative, repayment of any bonding amounts paid to 
the DMEPOS supplier that were already paid by the surety and the 
potential cost of pursuing administrative appeals.
    Furthermore, we solicited comments on requiring DMEPOS suppliers to 
obtain a surety bond of more than $65,000 if the DMEPOS supplier poses 
a significantly higher than average risk to the Medicare Trust Funds. 
Specifically, we solicited comments on how to establish elevated 
amounts of surety bonds for higher risk DMEPOS suppliers. We proposed 
to consider the option of establishing elevated amounts of the surety 
bond at a rate of $65,000 per high risk factor. Also, we solicited 
comments on determining the high risk factors that should be used. We 
suggested several potential high risk factors, and solicited comments 
on these factors, as well as suggestions for additional factors.
    We proposed to consider a $65,000 increase in the surety bond 
amount for each occurrence when a DMEPOS supplier has an adverse action 
as specified in section 221(g)(1)(A) of the Health Insurance 
Portability and Accountability Act of 1996 (Pub. L. 104-191) (HIPAA). 
Examples of adverse actions include, but are not limited to, Federal 
and State criminal convictions related to the delivery of a health care 
item or service; formal or official actions, such as the revocation or 
suspension of a license; and exclusion from participation in Federal or 
State health care programs. The following is an example of how high-
risk criteria would be used to increase the bond amount by $65,000 per 
occurrence.
     We proposed, for example, a DMEPOS supplier would be 
required to obtain a surety bond in the amount of $130,000, an increase 
of $65,000 from the base surety bond amount of $65,000, if the DMEPOS 
supplier or any of its owners, authorized officials, or delegated 
officials had their billing privileges revoked within the last 10 
years. If the DMEPOS supplier or any of its owners, authorized 
officials, or delegated officials had more than one revocation in the 
last 10 years, then the amount of the surety bond the DMEPOS supplier 
would be required to obtain would increase $65,000 per occurrence. We 
proposed, for example, that a DMEPOS supplier with three different 
revocations during the preceding 10 years would be required to obtain a 
surety bond in the amount of $260,000; $65,000 for the base surety 
amount and $195,000 (3 x $65,000) for the multiple revocations.
    In addition to the elevated risk-based model described above, we 
solicited comments regarding the establishment of elevated bond amounts 
by classifying DMEPOS suppliers into two or three general categories 
such as--
     New DMEPOS supplier applicants that have no prior billing 
history with the Medicare program that also would be required to secure 
a surety bond;
     Current Medicare enrolled DMEPOS suppliers that do not 
have any prior history of criminal, civil or administrative sanctions 
for billing-related problems; and,
     Current Medicare enrolled DMEPOS supplier with a prior 
``adverse history'' of criminal, civil or administrative sanctions for 
billing-related problems for which the regulation would elevate the 
amount of the required bond by an appropriate amount per prior 
sanction.
    We solicited comments regarding the appropriate elevated amounts of 
the surety bond using this categorical approach.
    We also solicited comments on whether we should establish an 
exception for rural DMEPOS suppliers and the appropriate criteria that 
we should consider in establishing an exception for rural DMEPOS 
suppliers.
    Finally, we solicited comments on the appropriate period of time 
for which a DMEPOS supplier should be required to maintain a higher 
surety bond amount. Given the higher level of risk associated with 
DMEPOS suppliers that have one or more risk factors, we proposed to 
establish a timeframe of 5 years.

III. Analysis of and Responses to Public Comments

    We received approximately 200 timely public comments in response to 
the August 1, 2007 proposed rule. The following is a summary of the 
comments received and our responses.

    (Note: In order to clarify the regulations regarding surety 
bonds, we have made some technical changes to our proposals.)

    Table 1 is provided to assist the reader in cross-referencing the 
proposed provision with its revised section. (For a more detailed 
explanation of the technical changes made to this final rule, please 
see section IV. of this final rule.)

                            Table 1--Redesignations From Proposed Rule to Final Rule
----------------------------------------------------------------------------------------------------------------
         Subject heading                        Proposed rule                            Final rule
----------------------------------------------------------------------------------------------------------------
Definitions......................  Sec.   424.57(a)                        Sec.   424.57(a)
Effective date...................  Sec.   424.57(c)(26)                    Sec.   424.57(d)(1)
Minimum requirements for a DMEPOS  Sec.   424.57(c)(26)(i)                 Sec.   424.57(d)(2)
 supplier.
Exception to the surety bond       Sec.   424.57(c)(26)(ii)                Sec.   424.57(d)(15)
 requirement.
Terms of the surety bond.........  Sec.   424.57(c)(26)(iii)               Sec.   424.57(d)(4)
Specific surety bond requirements  Sec.   424.57(c)(26)(iv)                Sec.   424.57(d)(5)
Cancellation of a bond and lapse   Sec.   424.57(c)(26)(v)                 Sec.   424.57(d)(6)
 of surety bond coverage.

[[Page 170]]

 
Actions under the surety bond....  Sec.   424.57(c)(26)(vi)                Sec.   424.57(d)(7)
Required surety information on     Sec.   424.57(c)(26)(vii)               Sec.   424.57(d)(8)
 the surety bond.
Submission date..................  Sec.   424.57(c)(26)(viii)              Sec.   424.57(d)(1)
Type of bond.....................  Sec.   424.57(c)(26)(viii)              Sec.   424.57(d)(4)
Loss of DMEPOS supplier exception  Sec.   424.57(c)(26)(ix)                Sec.   424.57(d)(15(ii))
Change of surety.................  Sec.   424.57(c)(26)(x)                 Sec.   424.57(d)(9)
Parties to the bond..............  Sec.   424.57(c)(26)(xi)                Sec.   424.57(d)(10)
Effect of DMEPOS supplier's        Sec.   424.57(c)(26)(xii)               Sec.   424.57(d)(11)
 failure to obtain, maintain, and
 timely file a surety bond.
Evidence of DMEPOS supplier's      Sec.   424.57(c)(26)(xiii)              Sec.   424.57(d)(12)
 compliance.
Effect of subsequent DMEPOS        Sec.   424.57(c)(26)(xiv)               Sec.   424.57(d)(13)
 supplier payment.
Effect of review reversing         Sec.   424.57(c)(26)(xv)                Sec.   424.57(d)(14)
 determination.
----------------------------------------------------------------------------------------------------------------

A. General Comments

    Comment: Numerous commenters opposed the surety bond requirement. 
Commenters stated that the surety bond requirement would create an 
additional and unnecessary burden on DMEPOS suppliers. Commenters 
indicated that DMEPOS suppliers have already been burdened with, among 
other things, continued reductions in Medicare reimbursement, 
competitive bidding, and accreditation. In addition, commenters stated 
that there is no need to impose the surety bond requirement on DMEPOS 
suppliers since these suppliers represent a small fraction of Medicare 
spending.
    Response: We recognize that we have recently implemented a number 
of program integrity measures designed to strengthen the enrollment 
process and improve quality of products and services. As the commenter 
notes, one such initiative is accreditation. Section 302 of the MMA 
added section 1834(a)(20) to the Act, which mandates the establishment 
and implementation of quality standards for DMEPOS suppliers. All 
suppliers that furnish such items or services under section 
1834(a)(20)(D) of the Act, as the Secretary determines appropriate, 
must comply with the quality standards in order to obtain and maintain 
Medicare billing privileges. The Medicare Improvements for Patients and 
Providers Act of 2008 (Pub. L. 110-275) (MIPPA) required all DMEPOS 
suppliers to meet quality standards for Medicare accreditation by 
October 1, 2009. In addition, section 154 of the MIPPA stated that 
certain professionals and persons do not have to meet this deadline 
unless quality standards are developed specific to these professionals 
and persons. Section 154(b) of the MIPPA, added a new subparagraph (F) 
to section 1834(a)(20) of the Act. This subparagraph states that 
eligible professionals and other persons are exempt from meeting the 
October 1, 2009 accreditation deadline unless CMS determines that the 
quality standards are specifically designed to apply to such 
professionals and persons. Eligible professionals under section 
1834(a)(20)(F) of the Act include physicians (as defined in section 
1861(r) of the Act), physical therapists, occupational therapists, 
qualified speech-language pathologists, physician assistants, nurse 
practitioners, clinical nurse specialists, certified registered nurse 
anesthetists, certified nurse-midwives, clinical social workers, 
clinical psychologists, registered dietitians, and nutritional 
professionals. We have designated certain individuals as falling within 
the category of ``other persons'' under the statute; these individuals 
include orthotists, prosthetists, opticians, and audiologists. We will 
work in collaboration with the medical and professional groups to 
develop specific quality standards.
    We believe that the accreditation process will assure that Medicare 
beneficiaries receive quality supplies and services from eligible 
suppliers.
    Nevertheless, we do not believe that the implementation of 
accreditation and other program integrity initiatives obviates the need 
to establish a surety bond requirement for DMEPOS suppliers, something 
that will help ensure that DMEPOS suppliers meet minimum financial 
requirements in order to participate in Medicare.
    Comment: Many commenters stated that a surety bond would offer 
little or no additional protection to CMS since the accreditation 
process for DMEPOS suppliers is already providing a greater level of 
security. The commenters indicated that the quality standards in the 
accreditation process include stringent provisions that limit the risk 
of Medicare fraud. As a result, some of the commenters described the 
surety bond requirement as redundant, duplicative, unnecessary, costly, 
and extreme. Another commenter stated that it believes its licensure 
and certification status as a hand therapist and our accreditation 
process are sufficient evidence of both its competence and ethical 
behavior. Yet another commenter stated that both initiatives should be 
analyzed, coordinated, and reconciled before implementation.
    Response: We disagree with the commenters that a surety bond would 
offer little or no protection because we are in the process of 
implementing the accreditation requirements for DMEPOS suppliers. As 
already indicated, while accreditation will ensure that a DMEPOS 
supplier meets certain quality standards, a surety bond will ensure 
that DMEPOS suppliers that do not qualify for an exception to the 
bonding requirement meet enhanced financial requirements. Moreover, 
only surety bonds can be used to repay any incurred overpayments. We 
believe that these efforts, when combined, will have a significant 
impact on both the quality of products and services provided to 
Medicare beneficiaries, but also increase our efforts to ensure that 
only qualified suppliers are eligible to enroll or remain enrolled in 
the Medicare program.
    We understand that many DMEPOS suppliers are concerned with the 
cumulative effect that several different statutory changes will have on 
suppliers of DMEPOS. We have taken this effect into consideration, and 
the revised impact analysis contained in this final rule accounts for 
the cumulative impact.
    Comment: A commenter stated that it is a waste of American 
citizens' money to require DMEPOS suppliers that bill $25,000 a year or 
less to obtain surety bonds.
    Response: We disagree with the commenter. The surety bond for 
DMEPOS suppliers is designed to reduce the amount of money that is lost 
due to fraudulent or abusive billing schemes perpetrated by individuals 
and organizations. In addition, we do not believe that prior billing is 
necessarily proof of future actions.
    Comment: One commenter believes that the surety bond requirement 
will not substantively strengthen program

[[Page 171]]

integrity. The commenter stated that, although requiring suppliers to 
obtain a surety bond as a condition of Medicare enrollment may deter 
some of the more simplistic criminal fraud schemes, it is unrealistic 
for CMS to expect that the requirement will eliminate the most 
insidious type of fraudulent supplier, which is the DMEPOS supplier 
that initially appears to meet the minimum indicia of a legitimate 
business. The commenter stated that this is the type of criminal 
element that has consistently evaded our oversight and enforcement 
initiatives. Other commenters stated that the surety bond requirement 
is only a repayment mechanism for the Medicare program and not a true 
deterrent to criminal or abusive billing practices. The commenters also 
stated that anyone with a criminal intent, and the means to effectuate 
it, can bill and get paid for fraudulent claims before we have 
identified the fraud.
    Response: We believe that the surety bond requirement is an 
important tool that, when used in conjunction with other efforts to 
reduce fraudulent or abusive behavior, will assist us in protecting the 
Medicare Trust Funds. While we recognize that implementing a surety 
bond requirement for certain DMEPOS suppliers will not deter all types 
of fraud and abuse perpetrated by individuals and organizations intent 
on committing such actions, we believe that this statutorily mandated 
requirement will greatly assist us in our efforts to reduce fraud and 
abuse by some suppliers of DMEPOS and to identify more sophisticated 
instances of fraudulent behavior.
    Comment: One commenter stated that if fraud is located primarily in 
urban areas, such as Miami, Florida, and involves DMEPOS suppliers that 
conduct a large volume of business, then the August 1, 2007 proposed 
rule is misdirected because it penalizes suppliers that conduct a small 
volume of business in other parts of the country, such as the Midwest.
    Response: We understand the concerns of the commenter, but we also 
recognize that fraudulent schemes are portable and can be perpetuated 
in any part of the country, not just urban areas. The surety bond 
requirement will help to ensure that certain newly enrolling DMEPOS 
suppliers meet financial solvency standards, as well as our established 
conditions for enrollment and payment.
    Comment: One commenter stated that we should not impose additional 
costs through the surety bond requirement but should instead focus our 
resources on those suppliers it can readily find committing Medicare 
fraud and abuse.
    Response: We are expanding our effort to identify, detect, and 
revoke the billing privileges of those DMEPOS suppliers who fail to 
meet the supplier standards found at Sec.  424.57. By establishing a 
surety bond requirement for newly enrolling DMEPOS suppliers as well as 
existing DMEPOS suppliers, we believe that we will improve the quality 
of services received by Medicare beneficiaries, as well as establish 
additional program safeguards for the Medicare program.

B. Legislative Authority

    Comment: One commenter stated that we have no legislative authority 
to implement the surety bond requirement. The commenter noted that 
section 902 of the MMA prohibits the Secretary from finalizing a 
proposed rule related to Title 18 that was published more than 3 years 
earlier except under exceptional circumstances. The commenter indicated 
that we did not finalize the January 20, 1998 proposed rule within the 
prescribed timeframe. As a result, the commenter believes that we have 
no specific statutory authority to implement the surety bond 
requirement.
    Response: While the commenter is correct that we did not finalize 
the January 20, 1998 proposed rule in the allotted amount of time as 
required by section 902 of the MMA, we did repropose the surety bond 
provisions in the August 1, 2007 proposed rule and have 3 years from 
that date to finalize the regulation as required by the MMA. Therefore, 
we believe that we are within our statutory authority for finalizing 
this rule.
    Comment: Some commenters questioned the need for the surety bond 
requirement by noting that the surety bond requirement specified in the 
BBA of 1997 reflected a different era when there were fewer 
requirements to become a DMEPOS supplier. For example, one commenter 
observed that DMEPOS suppliers are now required to become accredited, 
and most are about to be subject to additional scrutiny and cost 
controls via the DMEPOS competitive bidding program. Another commenter 
stated that the NSC did not routinely perform onsite inspections before 
issuing billing numbers. Commenters stated the NSC is now required to 
perform an onsite inspection for every DMEPOS supplier that seeks to 
obtain a Medicare billing number.
    Response: While these commenters are correct in that we have 
implemented significant programmatic changes--such as the routine 
performance of onsite visits--we note that the problems that led to the 
enactment of section 4312 of the BBA are still prevalent in the DMEPOS 
industry now. Indeed, the Office of Inspector General (OIG) continues 
to identify questionable conduct in the DMEPOS arena, as reflected in 
its recent report entitled, ``Los Angeles County Suppliers' Compliance 
with Medicare Standards: Results from Unannounced Visits; OEI-09-07-
00550.''
    We further note that on July 15, 2008, the Congress enacted the 
MIPPA which delayed the implementation of the DMEPOS Competitive 
Bidding Program. This, in our view, enhances the importance of the 
implementation of the surety bond requirement; with the delay in 
competitive bidding, we need to utilize the remaining tools at our 
disposal to prevent fraudulent activity in the DMEPOS arena. The onsite 
audits of every DMEPOS supplier serves as an important tool in ensuring 
that the NSC grants billing privileges to legitimate suppliers.

C. Bond Amount

    Comment: Several commenters disagreed with our proposal to increase 
the amount of the surety bond from $50,000 to $65,000 based on the 
Consumer Price Index (CPI). One commenter stated that the proposal is 
flawed because it is not based on risk to the Medicare program or 
Medicare reimbursement levels, and that the amount should be adjusted 
downward to reflect reduced Medicare reimbursement to DMEPOS suppliers 
(that is, commenters noted that Medicare reimbursement to many DMEPOS 
suppliers has decreased, remained the same, or only minimally increased 
since 1997.) In addition, several commenters believe that we should 
assess whether our proposal to increase the surety bond amount, which 
would raise the annual cost of the surety bond requirement from $150 
million to approximately $198 million, would have any appreciable 
increase in benefit. Other commenters stated that nothing in the surety 
bond requirement set forth in section 1834(a)(16)(B) of the Act or its 
history indicates that Congress ever contemplated inflation 
adjustments, or that the surety bond amount should be higher than 
$50,000.
    Response: We disagree with these comments for the following 
reasons. First, section 4312(a)(16)(B) of the BBA states that the bond 
amount must be ``in an amount that is not less than $50,000.'' The 
phrase ``not less than'' makes it clear that we have the authority to 
impose a bond amount higher than $50,000. Second, nowhere in the 
statute or the legislative history did the Congress indicate that the 
bond amount should be tied to the reimbursement

[[Page 172]]

levels of the provider or supplier type in question. To the contrary, 
we believe that the Congress intended for the key factor in determining 
the bond amount to be the risk of fraudulent activity posed by that 
class of provider or supplier.
    Having said this, we nevertheless have elected to reduce the base 
surety bond amount from $65,000 to $50,000 for two reasons. First, we 
wish to preclude an additional regulatory impact associated with 
implementing section 4312(a) of the BBA. This is especially true with 
respect to small, rural DMEPOS suppliers, as discussed in section G of 
the Regulatory Impact Analysis. Second, we believe that $50,000 is an 
appropriate starting point for the bond requirement. Using the 
statutory minimum amount will, in our view, allow us to better gauge 
whether a higher surety bond amount is needed to protect the Medicare 
Trust Funds.
    However, we are establishing a surety bond amount higher than 
$50,000 for those DMEPOS suppliers that pose a significantly higher 
risk to the Medicare program. In addition, we will evaluate the impact 
of this $50,000 surety bond amount requirement for certain DMEPOS 
suppliers before considering any increase in the base surety bond 
amount.
    Comment: Commenters stated there was no need to impose a tiered 
approach to determine what bond amount to impose on a DMEPOS supplier 
based on past conduct. For established DMEPOS suppliers, commenters 
believed that CMS and the OIG have significant administrative remedies 
to address misconduct, including excluding the supplier from the 
Medicare program. Commenters maintained that we should limit the bond 
requirement to new suppliers, which is consistent with the Congress' 
original intent under the BBA.
    Response: We do not agree with the commenters that there is no need 
to establish elevated surety bond amounts for DMEPOS suppliers that 
pose additional risk to the Medicare program, nor do we agree with the 
commenters' statement that the Congress intended to limit the surety 
bond requirement to only new DMEPOS suppliers. As for the former 
comment, we believe that elevated bond amounts are necessary to protect 
the Medicare Trust Fund and Medicare beneficiaries. Furthermore, we 
note that section 4312(a) of the BBA expressly states that ``the 
Secretary shall not provide for the issuance (or renewal) of a provider 
number * * *'' unless the supplier furnishes a surety bond of not less 
than $50,000. (Emphasis added.) Use of the term ``renewal'' evidences a 
congressional intention to apply the surety bond requirement to those 
DMEPOS suppliers already in the Medicare program.
    It is true that CMS and the OIG have various administrative 
remedies to address fraudulent or abusive conduct by DMEPOS suppliers 
after they have enrolled to participate in Medicare; however, we 
believe that the Congress intended to require that suppliers of DMEPOS 
meet financial solvency requirements and to ensure that Medicare could 
recoup some, if not all, of the improper payments made to suppliers of 
DMEPOS.
    Comment: One commenter stated that the preamble to the August 1, 
2007 proposed rule factually ``misdescribes'' the January 20, 1998 
proposed rule. The commenter indicated that the January 20, 1998 
proposed rule did not propose a $65,000 surety bond level, but instead 
proposed a sliding scale approach starting at $50,000 and rising to 15 
percent of reimbursement.
    Response: We agree that the January 20, 1998 proposed rule included 
a minimum $50,000 surety bond amount. We note that the $65,000 figure 
in the August 1, 2007 proposed rule has been reduced in this final rule 
to $50,000, except in the case of high-risk suppliers. We consider any 
DMEPOS supplier with at least one adverse legal action within the 10 
years preceding enrollment, revalidation, or reenrollment to be a 
``high-risk'' supplier.
    Comment: Several commenters maintained that we should have sought 
public comment on the reasonableness of increasing the surety bond 
amount from $50,000 to $65,000. The commenters stated that this change 
represents an increase of 25 percent over the original $50,000 surety 
bond requirement proposed in the January 20, 1998 proposed rule.
    Response: In the August 1, 2007 proposed rule, we solicited public 
comments on the amount of the surety bond for DMEPOS suppliers and, as 
already noted, we have chosen to reduce the minimum surety bond amount 
to $50,000.
    Comment: One commenter stated that, although we justified our 
proposal to increase the amount of the surety bond from $50,000 to 
$65,000 based on the CPI, expecting a DMEPOS supplier to obtain a 
surety bond that far exceeds the value of the supplier's annual claims 
seems unreasonable.
    Response: As already discussed, neither section 4312(a) of the BBA 
nor its legislative history indicate that the Congress intended for the 
bond amount to be tied to the level of reimbursement a supplier 
receives from the Medicare program. The regulatory impact section of 
the proposed rule (72 FR 42008) stated that, ``We estimate that as many 
as 15,000 DMEPOS suppliers, or 23 percent of the 65,984 entities and 15 
percent (or 17,471) of the 116,471 individual suppliers currently 
enrolled in Medicare could decide to cease providing items to Medicare 
beneficiaries if this proposed rule is implemented.'' While we are 
reducing the amount of the surety bond from $65,000 to $50,000, the 
lowest amount allowable under section 4312(a)(16)(B) of the BBA, and 
limiting its impact to certain DMEPOS suppliers, we understand that the 
implementation of this rule will require some DMEPOS suppliers to 
reconsider their participation in the Medicare program because of the 
added cost of the bond.
    Comment: A commenter stated that the surety bond requirement may 
increase costs for small DMEPOS suppliers and reduce costs for large 
DMEPOS suppliers. The commenter stated that the January 20, 1998 
proposed rule provided for a sliding scale approach to the bond 
requirement for DMEPOS suppliers in that the surety bond started at 
$50,000 and rose to 15 percent of Medicare reimbursement (capped at $3 
million). Many commenters stated that a tiered system would be more 
equitable.
    Response: We do not believe that establishing a sliding scale 
approach is appropriate because of the operational complexity 
associated with establishing and maintaining this approach. Moreover, 
it is important to note that 4312(a) of the BBA requires that we 
establish a surety bond in an amount of not less than $50,000. 
Accordingly, by statute, the lowest amount that we can establish for a 
DMEPOS surety bond is $50,000, and based on the public concerns about 
higher bond amounts, we have decided to implement higher surety bond 
amounts only for those individuals or organizations that pose a higher 
risk to the Medicare program.
    Comment: A commenter stated that the financial soundness of DMEPOS 
suppliers will be a factor in the price of surety bonds. The commenter 
maintained that the financial soundness of a DMEPOS may result in 
DMEPOS suppliers not being able to obtain surety bonds. The commenter 
stated that this is one reason for keeping the amount of the surety 
bond low and for allowing sufficient time for a competitive market to 
be formed for surety bonds.
    Response: We agree that financial soundness will be a key 
determinant in whether a DMEPOS supplier will be able to secure a 
surety bond and the

[[Page 173]]

amount that the DMEPOS supplier will have to pay for the bond. To 
reduce cost associated with obtaining a bond, we have reduced the 
amount of surety bond from $65,000 bond to $50,000. In addition, we 
have delayed the implementation of this regulation.
    Comment: One commenter maintained that we did not adequately 
outline the rationale for adjusting the amount of the surety bond in 
the August 1, 2007 proposed rule. The commenter noted that the 
inflation adjusted bond will be 25 percent higher than the $50,000 bond 
originally contemplated by the Congress. The commenter stated that, 
since it appears that our only rationale for increasing the bond amount 
is based on the passage of time, imposing this additional financial and 
administrative burden on suppliers is arbitrary.
    Response: We note that this final rule has been revised to reduce 
the proposed $65,000 surety bond amount to $50,000, the minimum 
allowable under the statute.
    Comment: One commenter stated that the proposed surety bond amount 
of $65,000 is realistic, and that establishing a bond requirement for 
the majority of DMEPOS suppliers is consistent with standard 
suretyship.
    Response: We appreciate this comment. However, this final rule has 
been revised to require a $50,000 surety bond (the minimum allowable 
under the statute) for certain DMEPOS suppliers.

D. Timeframe for Implementation

    Comment: Several commenters requested that we give DMEPOS suppliers 
at least 120 days to comply with this final rule instead of 60 days 
following publication of this rule.
    Response: We agree with the commenters and have revised Sec.  
424.57(d)(1) (proposed Sec.  424.57(c)(26)) to require existing 
suppliers (that is, DMEPOS suppliers already enrolled in the Medicare 
as of the publication date of this final rule in the Federal Register) 
of DMEPOS to obtain a surety bond no later than 9 months after the 
effective date of this final rule. Moreover, beginning 120 days after 
the effective date of this final rule, DMEPOS suppliers, who are 
seeking to enroll in the Medicare program and are subject to the 
provisions of this final rule, are required to furnish to the NSC a 
surety bond of at least $50,000 from an authorized surety for each 
assigned NPI for which the DMEPOS supplier is seeking to obtain 
Medicare billing privileges. Accordingly, any DMEPOS supplier, except 
those specified in Sec.  424.57(d)(15) (proposed Sec.  
424.57(c)(26)(ii)), seeking to enroll a new practice location or to 
change the ownership of an existing DMEPOS supplier after the 
publication date of this rule is required to submit to the NSC a surety 
bond of at least $50,000 beginning 120 days after the effective date of 
this final rule. The DMEPOS supplier must submit a surety bond of at 
least $50,000 with its enrollment application on the date of filing.
    Comment: Several commenters suggested that we delay implementing 
this final rule. The commenters stated that we should wait to see if 
our accreditation process reduces the level of Medicare fraud in the 
DMEPOS industry. Another commenter stated that we should consider 
granting a transition or ``grace period'' that gives suppliers an 
opportunity to, among other things, assess the availability of surety 
bonds and learn how to obtain surety bonds before requiring them to 
comply with any surety bond requirement. The commenter also urged us to 
grant this transition or ``grace period'' to allow time for a robust 
market for DMEPOS supplier surety bonds to develop.
    Response: We agree with the commenters and we have delayed the 
requirement of a surety bond for certain existing DMEPOS suppliers 
until 9 months after the effective date of this final rule, and 120 
days after the effective date of this final rule for certain new DMEPOS 
suppliers. These delays will give existing suppliers an opportunity to 
assess and determine whether they will continue to participate in the 
Medicare program during the accreditation implementation without 
incurring additional costs associated with a surety bond.

E. Definitions

    Comment: Several commenters noted that Sec.  424.57(a) of the 
August 1, 2007 proposed rule stated that paragraph (3) of the proposed 
definition of ``unauthorized surety'' means, among other things, a 
surety that ``[f]ails to pay CMS in full the amount requested, up to 
the penal sum of the bond when presented with a request for payment 
within 30 days of written notification.'' The commenters stated that 
there is no requirement that the request for payment be supported by 
sufficient evidence, and recommended that we revise paragraph (3) as 
follows: ``Fails to pay CMS any amount owed, up to the penal sum of the 
bond, within 30 days of receipt of a request for payment and sufficient 
evidence to support the request.''
    Response: We have removed the proposed definition of an 
``unauthorized surety'' from this final rule.
    Comment: One commenter stated that it is unclear whether there will 
be any ramifications if a DMEPOS supplier purchases a bond from a 
surety that becomes an ``unauthorized surety.'' The commenter believes 
that requiring the supplier to obtain a replacement bond without 
receiving a refund of the premium would penalize the wrong party.
    Response: We believe it is essential that DMEPOS suppliers select 
surety bond companies that will honor their commitments to pay the bond 
amount when presented with sufficient evidence by CMS or the NSC that a 
debt is owed by the DMEPOS supplier.
    Comment: One commenter suggested that we revise the definition of a 
``penal sum'' from, ``a sum to be paid (up to the value of the bond) by 
the surety as a penalty under the terms of the surety bond when a loss 
has occurred'' to ``a sum in the amount of the bond and the maximum 
obligation of the surety if a loss occurs.'' The commenter stated that 
the penal sum is not a penalty to be paid; rather, it represents the 
surety's obligation to pay what the principal owes up to the penal sum.
    Another commenter suggested that we revise the definition of 
``sufficient evidence'' from ``means the documentation that CMS may 
supply to the surety in order to establish that a DMEPOS supplier had 
received Medicare funds in excess of amounts due and payable under the 
statute and regulations'' to ``means documents CMS supplied to the 
surety that established both the amount of Medicare funds a DMEPOS 
supplier received in excess of amounts due and payable under applicable 
statutes and regulations and that this amount was an obligation of the 
surety.''
    Response: In response to these comments, we have revised the 
definitions of ``penal sum'' and ``sufficient evidence'' in Sec.  
424.57(a).
    Comment: A commenter stated that the definition of ``chain 
suppliers of DMEPOS'' should include chain pharmacies.
    Response: We agree that publicly traded chain suppliers of DMEPOS 
include chain pharmacies as long as there are 25 or more distinct 
practice locations under common ownership.
    Comment: One commenter stated that our definition of a ``small 
supplier'' is inconsistent and problematic. The commenter maintained 
that we made an arbitrary decision in the Medicare Program; Competitive 
Acquisition for Certain Durable Medical Equipment, Prosthetics, 
Orthotics, and Supplies (DMEPOS) and Other Issues; Final Rule (April 
10, 2007, 72 FR 17992) to define

[[Page 174]]

a small supplier as a supplier that generates gross revenue of $3.5 
million or less in annual receipts, but did not discuss why it chose 
$3.5 million as the ceiling as opposed to some other figure (for 
example, the commenter noted the SBA defines a small business as a 
business that has less than $6.5 million in annual receipts). The 
commenter stated that we should adopt SBA's definition of a small 
business.
    Response: During the development of the April 10, 2007 final rule 
(72 FR 17992), we adopted a $3.5 million revenue or less standard for 
DMEPOS suppliers. This standard was developed in consultation with the 
SBA during the development of the DMEPOS competitive bidding final 
regulation. To ensure consistency with both the April 10, 2007 rule and 
the guidance furnished by the SBA, we will continue to define a small 
supplier as a supplier that generates gross revenue of $3.5 million or 
less in annual receipts, including Medicare and non-Medicare revenue.

F. Payment and Liability

    Comment: A commenter stated that proposed Sec.  424.57(c)(26)(iii) 
indicates that we will revoke or deny a DMEPOS supplier's billing 
privileges based on submission of a bond that does not reflect the 
requirements of that section. The commenter stated that because, in its 
view, DMEPOS suppliers may experience difficulty obtaining surety bonds 
in the marketplace, we should recognize situations where DMEPOS 
suppliers have made a good faith effort to secure a surety bond that 
meets our requirements if the market will not provide such a product. 
The commenter suggested that we add language to proposed Sec.  
424.57(c)(26)(iii) that recognizes a DMEPOS supplier's good faith 
effort to obtain a surety bond that satisfies the surety bond 
requirement.
    Response: We believe that the delay in the implementation of this 
final rule will allow a surety bond market to develop for prospective 
DMEPOS suppliers as well as existing DMEPOS suppliers enrolled in the 
Medicare program. Therefore, we are not revising Sec.  424.57(d)(4) 
(proposed Sec.  424.57(c)(26)(iii)).
    Comment: One commenter stated that proposed Sec.  
424.57(c)(26)(iv)(C) appears to conflict with Sec.  
424.57(c)(26)(iv)(B). The commenter noted that Sec.  
424.57(c)(26)(iv)(C) states that ``the surety remains liable for unpaid 
claims, CMPs, or assessments that * * * took place during the term of 
the bond or rider * * *,'' and Sec.  424.57(c)(26)(iv)(B) states that 
``[t]he surety is liable for unpaid claims, CMPs, or assessments that 
are presented to the surety for payment when the surety bond is in 
effect, regardless of when the payment, overpayment, or other event 
giving rise to the claim, CMPs, or assessment occurred * * *.'' 
(Emphasis added.) The commenter suggested revising Sec.  
424.57(c)(26)(iv)(B) to place liability on the surety whose bond was in 
effect at the time of each respective default as provided by Sec.  
424.57(c)(26)(iv)(C).
    Response: We agree that the provisions discussed above are in 
conflict and have revised Sec.  424.57(d)(5) in this final rule 
(proposed Sec.  424.57(c)(26)(iv)) accordingly.
    Comment: A commenter stated that we need to clearly spell out the 
process and timeframes by which we would request payment from the 
surety.
    Response: We believe that the provisions of this final rule contain 
sufficient information on both the process and the timeframes involved 
in our payment requests.
    Comment: A commenter stated that it is unclear whether the original 
application and documentation for approval of the surety bond should be 
submitted to the NSC or the U.S. Department of Health and Human 
Services (HHS). The commenter maintained that the surety bond, all 
riders, and notices of cancellation should be filed with HHS to avoid 
any confusion or loss of data should HHS change contractors.
    Response: Since the NSC is our designated contractor responsible 
for establishing DMEPOS billing privileges, all documentation (for 
example, bond approval, riders, and notices of cancellation) associated 
with the surety bond should be sent to the NSC.
    Comment: Several commenters maintained that a default on the surety 
bond should be based on a finding of wrongdoing, not merely on the 
existence of debt, which may be disputed and subject to the Medicare 
appeals process. The commenters stated that a surety's liability should 
be triggered only when there has been a final determination of an 
assessment for fraud or other misconduct against a DMEPOS supplier and 
the time to file an appeal has expired. Commenters also stated that 
there is no valid rationale to impose liability under the bond before a 
final determination has been made because the bond, by its terms, 
guarantees payment of the assessment. Another commenter stated that 
underwriters should not be required to reimburse CMS for any 
overpayment until the DMEPOS supplier exercises its Medicare appeal 
rights, supplier liability for the claim is firmly established, and the 
supplier is past due on repayment.
    Response: We do not agree that we should be prohibited from seeking 
payment from a surety until all supplier appeals have been exhausted. 
In addition, we believe that it is appropriate for the surety to pay 
CMS a total of up to the full penal amount of the bond when sufficient 
evidence is presented. We note that in