Medicare, Medicaid, and Children's Health Insurance Programs; Additional Screening Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions and Compliance Plans for Providers and Suppliers, 5862-5971 [2011-1686]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of Inspector General

[Federal Register Volume 76, Number 22 (Wednesday, February 2, 2011)]
[Rules and Regulations]
[Pages 5862-5971]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-1686]



[[Page 5861]]

Vol. 76

Wednesday,

No. 22

February 2, 2011

Part II





Department of Health and Human Services





-----------------------------------------------------------------------



Centers for Medicare & Medicaid Services



-----------------------------------------------------------------------



42 CFR Parts 405, 424, 447 et al.



-----------------------------------------------------------------------



Office of Inspector General



-----------------------------------------------------------------------

42 CFR Part 1007



Medicare, Medicaid, and Children's Health Insurance Programs; 
Additional Screening Requirements, Application Fees, Temporary 
Enrollment Moratoria, Payment Suspensions and Compliance Plans for 
Providers and Suppliers; Final Rule

Federal Register / Vol. 76 , No. 22 / Wednesday, February 2, 2011 / 
Rules and Regulations

[[Page 5862]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Parts 405, 424, 447, 455, 457, and 498

Office of Inspector General

42 CFR Part 1007

[CMS-6028-FC]
RIN 0938-AQ20


Medicare, Medicaid, and Children's Health Insurance Programs; 
Additional Screening Requirements, Application Fees, Temporary 
Enrollment Moratoria, Payment Suspensions and Compliance Plans for 
Providers and Suppliers

AGENCY: Centers for Medicare & Medicaid Services (CMS); Office of 
Inspector General (OIG), HHS.

ACTION: Final rule with comment period.

-----------------------------------------------------------------------

SUMMARY: This final rule with comment period will implement provisions 
of the ACA that establish: Procedures under which screening is 
conducted for providers of medical or other services and suppliers in 
the Medicare program, providers in the Medicaid program, and providers 
in the Children's Health Insurance Program (CHIP); an application fee 
imposed on institutional providers and suppliers; temporary moratoria 
that may be imposed if necessary to prevent or combat fraud, waste, and 
abuse under the Medicare and Medicaid programs, and CHIP; guidance for 
States regarding termination of providers from Medicaid and CHIP if 
terminated by Medicare or another Medicaid State plan or CHIP; guidance 
regarding the termination of providers and suppliers from Medicare if 
terminated by a Medicaid State agency; and requirements for suspension 
of payments pending credible allegations of fraud in the Medicare and 
Medicaid programs. This final rule with comment period also discusses 
our earlier solicitation of comments regarding provisions of the ACA 
that require providers of medical or other items or services or 
suppliers within a particular industry sector or category to establish 
compliance programs.
    We have identified specific provisions surrounding our 
implementation of fingerprinting for certain providers and suppliers 
for which we may make changes if warranted by the public comments 
received. We expect to publish our response to those comments, 
including any possible changes to the rule made as a result of them, as 
soon as possible following the end of the comment period. Furthermore, 
we clarify that we are finalizing the adoption of fingerprinting 
pursuant to the terms and conditions set forth herein.

DATES: Effective date: These regulations are effective on March 25, 
2011. Comment date: We will consider public comments only on the 
Fingerprinting Requirements, contained in Sec. Sec.  424.518 and 
455.434 and discussed in section II.A.5. of the preamble of this 
document, if we receive them at one of the addresses provided below, no 
later than 5 p.m. on April 4, 2011.

ADDRESSES: In commenting, please refer to file code CMS-6028-FC. 
Because of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    You may submit comments in one of four ways (please choose only one 
of the ways listed):
    1. Electronically. You may submit electronic comments on this 
regulation to https://www.regulations.gov. Follow the instructions for 
``submitting a comment.''
    2. By regular mail. You may mail written comments to the following 
address ONLY: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-6028-FC, P.O. Box 8013, 
Baltimore, MD 21244-8013.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address ONLY: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-6028-FC, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    4. By hand or courier. If you prefer, you may deliver (by hand or 
courier) your written comments before the close of the comment period 
to either of the following addresses: a. For delivery in Washington, 
DC--Centers for Medicare & Medicaid Services, Department of Health and 
Human Services, Room 445-G, Hubert H. Humphrey Building, 200 
Independence Avenue, SW., Washington, DC 20201.
    (Because access to the interior of the Hubert H. Humphrey Building 
is not readily available to persons without Federal government 
identification, commenters are encouraged to leave their comments in 
the CMS drop slots located in the main lobby of the building. A stamp-
in clock is available for persons wishing to retain a proof of filing 
by stamping in and retaining an extra copy of the comments being 
filed.)
    b. For delivery in Baltimore, MD--Centers for Medicare & Medicaid 
Services, Department of Health and Human Services, 7500 Security 
Boulevard, Baltimore, MD 21244-1850.
    If you intend to deliver your comments to the Baltimore address, 
please call telephone number (410) 786-9994 in advance to schedule your 
arrival with one of our staff members.
    Comments mailed to the addresses indicated as appropriate for hand 
or courier delivery may be delayed and received after the comment 
period.

FOR FURTHER INFORMATION CONTACT: Frank Whelan (410) 786-1302 for 
Medicare enrollment issues. Claudia Simonson (312) 353-2115 for 
Medicaid and CHIP enrollment issues. Lori Bellan (410) 786-2048 for 
Medicaid payment suspension issues and Medicaid termination issues. 
Joseph Strazzire (410) 786-2775 for Medicare payment suspension issues. 
Laura Minassian-Kiefel (410) 786-4641 for compliance program issues.

SUPPLEMENTARY INFORMATION: Due to the many organizations and terms to 
which we refer by acronym in this final rule with comment period, we 
are listing these acronyms and their corresponding terms in 
alphabetical order below. In addition, we are providing a table of 
contents which follows the list of acronyms to assist readers in 
referencing sections contained in this preamble.

Acronyms

ABC American Board for Certification in Orthotics and Prosthetics
A/B MAC Part A or Part B Medicare Administrative Contractor
ACA ``Affordable Care Act''
APD Advance planning document
ASC Ambulatory surgical center
BBA Balanced Budget Act of 1997 (Pub. L. 105-33)
BIPA Medicare Medicaid, and SCHIP Benefits Improvement Protection 
Act of 2000 (Pub. L. 106-544)
CAH Critical access hospital
CAP Competitive acquisition program
CBA Competitive bidding area
CFR Code of Federal Regulations
CHIP Children's Health Insurance Program
CJIS Criminal Justice Information Services
CLIA Clinical laboratory improvement amendments
CMHC Community mental health centers
CMS Centers for Medicare & Medicaid Services
CON Certificate of Need
CoP Condition of participation
CORF Comprehensive outpatient rehabilitation facility
CPI-U Consumer price index for all urban consumers
DAB Department Appeal Board

[[Page 5863]]

DEA Drug Enforcement Agency
DHUD Department of Housing and Urban Development
DME Durable medical equipment
DMEPOS Durable medical equipment prosthetics, orthotics, and 
supplies
DOB Dates of birth
DOJ Department of Justice
EIN Employer Identification Number
EMTALA Emergency Medical Treatment and Active Labor Act
VIN Vehicle Identifier Number
ESRD End-stage renal disease
EPLS General Service Administration's Excluded Parties List System
FBI Federal Bureau of Investigation
FFP Federal Financial Participation
FFS Medicare fee-for-service program
FQHC Federally qualified health center
GAO Government Accountability Office
HHAs Home health agencies
HHS [Department of] Health and Human Services
HIO Health insuring organization
IAFIS Integrated Automated Fingerprint Identification System
ICF/MR Intermediate care facilities for persons with mental 
retardation
IDTF Independent diagnostic testing facility
IHCIA Indian Health Care Improvement Act
IHS Indian Health Service
IHSS In-home supportive services
IPF Inpatient psychiatric facility
IRF Inpatient rehabilitation facility
ISDEAA Indian Self-Determination and Education Assistance Act
LEIE List of Excluded Individuals/Entities
MCEs Managed care entities
MFCU Medicaid fraud control unit
MAO Medicare Advantage organizations
MMA Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003 (Pub. L. 108-173)
NASDAQ National Association of Securities Dealers Automated 
Quotation System
NF Nursing facility
NPI National Provider Identifier
NPPES National Plan and Provider Enumeration System
NSC National Supplier Clearinghouse
NTIS National Technical Information Service
NPDB National Practitioner Data Bank
NYSE New York Stock Exchange
OIG Office of Inspector General
OMB Office of Management and Budget
OPO Organ procurement organization
PAHP Prepaid ambulatory health plan
PECOS Provider Enrollment, Chain, and Ownership System
PIHP Prepaid inpatient health plan
PSC Program Safeguard Contractors
PTAN Provider transaction account number
RFA Regulatory Flexibility Act
RHC Rural health clinic
RNHCI Religious nonmedical health care institution
SEC Securities and Exchange Commission
SMP Senior Medicare Patrol
SNFs Skilled nursing facilities
SPIA State Program Integrity Assessment
SSA Social Security Administration
SSA DMF Social Security Administration Death Master File
SSN Social Security Number
TTAG Tribal Technical Advisory Group
WAN [FBI CJIS Division's] Wide Area Network
ZPIC Zone Program Integrity Contractors

Table of Contents

I. Background
II. Proposed Provisions and Responses to Public Comments
    A. Provider Screening Under Medicare, Medicaid, and CHIP
    1. Statutory Changes
    2. Summary of Existing Screening Measures
    a. Licensure Requirements--Medicare and Medicaid
    b. Site Visits--Medicare
    c. Database Checks--Medicare
    d. Criminal Background Checks--Medicare
    e. Medicare MAO Requirements
    f. Fingerprinting--Medicare
    g. Screening--Medicaid and CHIP
    3. General Screening of Providers--Medicare
    a. Proposed Screening Requirements
    (1) Limited
    (2) Moderate
    (3) High
    b. Analysis of and Responses to Public Comment on Medicare 
Screening Categories
    c. Final Screening Provision--Medicare
    4. General Screening of Providers--Medicaid and CHIP: Proposed 
Provisions and Analysis of and Responses to Public Comments
    a. Database Checks--Medicaid and CHIP
    b. Unscheduled and Unannounced Site Visits--Medicaid and CHIP
    c. Provider Enrollment and Provider Termination--Medicaid and 
CHIP
    d. Criminal Background Checks and Fingerprinting--Medicaid and 
CHIP
    e. Deactivation and Reactivation of Provider Enrollment--
Medicaid and CHIP
    f. Enrollment and NPI of Ordering or Referring Providers--
Medicaid and CHIP
    g. Other State Screening--Medicaid and CHIP
    h. Final Screening Provisions--Medicaid and CHIP
    5. Solicitation of Additional Comments Regarding the 
Implementation of the
    Fingerprinting Requirements
    B. Application Fee--Medicare, Medicaid, and CHIP
    1. Statutory Changes
    2. Proposed Application Fee Provisions
    C. Temporary Moratoria on Enrollment of Medicare Providers and 
Suppliers, Medicaid and CHIP Providers
    1. Statutory Changes
    2. Proposed Temporary Moratoria Provisions
    a. Medicare
    b. Medicaid and CHIP
    3. Analysis of and Responses to Public Comment
    4. Final Temporary Moratoria on Enrollment of Medicare Providers 
and Suppliers, Medicaid and CHIP Provisions
    D. Suspension of Payments
    1. Medicare
    a. Background
    b. Previous Medicare Regulations
    c. Proposed Medicare Suspension of Payments Requirements
    2. Medicaid
    a. Background
    b. Previous Medicaid Regulations
    c. Proposed Medicaid Suspension of Payments Requirements
    E. Proposed Approach and Solicitation of Comments for Sections 
6102 and 6401(a) of the Affordable Care Act--Ethics and Compliance 
Program
    1. Statutory Changes
    2. Proposed Ethics and Compliance Program Provisions
    3. Analysis of and Responses to Public Comment
    4. Final Provisions--Ethics and Compliance Program
    F. Termination of Provider Participation Under the Medicaid 
Program and CHIP if Terminated Under the Medicare Program or Another 
State Medicaid Program or CHIP
    1. Statutory Change
    2. Proposed Provisions for Termination of Provider Participation 
Under the Medicaid Program and CHIP if Terminated Under the Medicare 
Program or Another State Medicaid Program or CHIP
    3. Analysis of and Responses to Public Comment
    4. Final Provisions for Termination of Provider Participation 
Under the Medicaid Program and CHIP if Terminated Under the Medicare 
Program or Another State Medicaid Program or CHIP
    G. Additional Medicare Provider Enrollment Provisions
    1. Statutory Changes
    2. Proposed Provisions for Additional Medicare Provider 
Enrollment
    3. Analysis of and Response to Public Comments
    4. Final Provisions for Additional Medicare Provider Enrollment
    H. Technical and General Comments
III. Collection of Information Requirements
    A. ICRs Regarding Medicare Application Fee Hardship Exception 
(Sec.  424.514)
    B. ICRs Regarding Medicare Fingerprinting Requirement (Sec.  
424.518)
    C. ICRs Regarding Medicaid Fingerprinting Requirement (Sec.  
455.434)
    D. ICRs Regarding Suspension of Payments in Cases of Fraud or 
Willful Misrepresentation (Sec.  455.23)
    E. ICRs Regarding Collection of SSNs and DOBs for Medicaid and 
CHIP providers (Sec.  455.104)
    F. ICRs Regarding Site Visits for Medicaid-Only or CHIP-Only 
Providers (Sec.  455.450)
    G. ICRs Regarding the Rescreening of Medicaid Providers Every 5 
Years (Sec.  455.414).
IV. Response to Comments
V. Regulatory Impact Analysis
    A. Statement of Need
    B. Overall Impact
    C. Anticipated Effects
    1. Medicare
    a. Enhanced Screening Procedures--Medicare
    b. Application Fee--Medicare

[[Page 5864]]

    c. General Enrollment Framework
    (1) New Enrollment
    (2) Revalidation
    2. Medicaid
    a. Enhanced Screening Procedures
    b. Application Fee--Medicaid
    c. General Enrollment Framework
    (1) New Enrollments
    (2) Re-enrollment
    3. Medicare and Medicaid
    a. Moratoria on Enrollment of New Medicare Providers and 
Suppliers and Medicaid Providers
    b. Suspension of Payments in Medicare and Medicaid
    D. Accounting Statement and Table
    1. Medicare
    2. Medicaid
    E. Alternatives Considered
    1. General Burden Minimization Efforts
    2. Fingerprinting
    3. Other Suggested Alternatives
    F. Conclusion
    Regulations Text

I. Background

    The Medicare program (title XVIII of the Social Security Act (the 
Act)) is the primary payer of health care for 47 million enrolled 
beneficiaries. Under section 1802 of the Act, a beneficiary may obtain 
health services from an individual or an organization qualified to 
participate in the Medicare program. Qualifications to participate are 
specified in statute and in regulations (see, for example, sections 
1814, 1815, 1819, 1833, 1834, 1842, 1861, 1866, and 1891 of the Act; 
and 42 CFR Chapter IV, subchapter G, which concerns standards and 
certification requirements).
    Providers and suppliers furnishing services must comply with the 
Medicare requirements stipulated in the Act and in our regulations. 
These requirements are meant to ensure compliance with applicable 
statutes, as well as to promote the furnishing of high quality care. As 
Medicare program expenditures have grown, we have increased our efforts 
to ensure that only qualified individuals and organizations are allowed 
to enroll or maintain their Medicare billing privileges.
    The Medicaid program (title XIX of the Act) is a joint Federal and 
State health care program for eligible low-income individuals providing 
coverage to more than 51 million people. States have considerable 
flexibility in how they administer their Medicaid programs within a 
broad Federal framework and programs vary from State to State.
    The Children's Health Insurance Program (CHIP) (title XXI of the 
Act) is a joint Federal and State health care program that provides 
health care coverage to more than 7.7 million otherwise uninsured 
children.
    Historically, States, in operating Medicaid and CHIP, have 
permitted the enrollment of providers who meet the State requirements 
for program enrollment.
    The Patient Protection and Affordable Care Act (Pub. L. 111-148), 
as amended by the Health Care and Education Reconciliation Act of 2010 
(Pub. L. 111-152) (collectively known as the Affordable Care Act or 
ACA) makes a number of changes to the Medicare and Medicaid programs 
and CHIP that enhance the provider and supplier enrollment process to 
improve the integrity of the programs to reduce fraud, waste, and abuse 
in the programs.
    The following is an overview of some of the statutory authority 
relevant to enrollment in Medicare, Medicaid, and CHIP:
     Sections 1102 and 1871 of the Act provide general 
authority for the Secretary of Health and Human Services (the 
Secretary) to prescribe regulations for the efficient administration of 
the Medicare program. Section 1102 of the Act also provides general 
authority for the Secretary to prescribe regulations for the efficient 
administration of the Medicaid program and CHIP.
     Section 4313 of the Balanced Budget Act of 1997 (BBA) 
(Pub. L. 105-33) amended sections 1124(a)(1) and 1124A of the Act to 
require disclosure of both the Employer Identification Number (EIN) and 
Social Security Number (SSN) of each provider or supplier, each person 
with ownership or control interest in the provider or supplier, any 
subcontractor in which the provider or supplier directly or indirectly 
has a 5 percent or more ownership interest, and any managing employees 
including directors and officers of corporations and non-profit 
organizations and charities. The ``Report to Congress on Steps Taken to 
Assure Confidentiality of Social Security Account Numbers as required 
by the Balanced Budget Act'' was signed by the Secretary and sent to 
the Congress on January 26, 1999. This report outlines the provisions 
of a mandatory collection of SSNs and EINs effective on or after April 
26, 1999.
     Section 936(a)(2) of the Medicare Prescription Drug, 
Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173) 
amended the Act to require the Secretary to establish a process for the 
enrollment of providers of services and suppliers. We are authorized to 
collect information on the Medicare enrollment application (that is, 
the CMS-855, (Office of Management and Budget (OMB) approval number 
0938-0685)) to ensure that correct payments are made to providers and 
suppliers under the Medicare program as established by title XVIII of 
the Act.
     Section 1902(a)(27) of the Act provides general authority 
for the Secretary to require provider agreements under the Medicaid 
State Plans with every person or institution providing services under 
the State plan. Under these agreements, the Secretary may require 
information regarding any payments claimed by such person or 
institution for providing services under the State plan.
     Section 2107(e) of the Act, which provides that certain 
title XIX and title XI provisions apply to States under title XXI, 
including 1902(a)(4)(C) of the Act, relating to conflict of interest 
standards.
     Section 1903(i)(2) of the Act relating to limitations on 
payment.
     Section 1124 of the Act relating to disclosure of 
ownership and related information.
     Sections 6401, 6402, 6501, and 10603 of the ACA and 1304 
of the Health Care and Education Reconciliation Act (Pub. L. 111-152) 
amended the Act by establishing: (1) Procedures under which screening 
is conducted for providers of medical or other services and suppliers 
in the Medicare program, providers in the Medicaid program, and 
providers in the CHIP; (2) an application fee to be imposed on 
providers and suppliers; (3) temporary moratoria that the Secretary may 
impose if necessary to prevent or combat fraud, waste, and abuse under 
the Medicare and Medicaid programs and CHIP; (4) requirements that 
State Medicaid agencies must terminate any provider that is terminated 
by Medicare or another State plan; (5) requirements for suspensions of 
payments pending credible allegations of fraud in both the Medicare and 
Medicaid programs.

II. Proposed Provisions and Responses to Public Comments

    We received approximately 300 timely pieces of correspondence 
containing multiple comments on the Additional Screening Requirements, 
Application Fees, Temporary Enrollment Moratoria, Payment Suspensions 
and Compliance Plans for Providers and Suppliers proposed rule 
published September 23, 2010 (75 FR 58204). We note that we received 
some comments that were outside the scope of the proposed rule. These 
comments are not addressed in this final rule with comment period. 
Summaries of the public comments that are within the scope of the 
proposals and our responses to those comments are set forth in the 
various sections of this final rule with comment period under the 
appropriate headings.

[[Page 5865]]

A. Provider Screening Under Medicare, Medicaid, and CHIP

1. Statutory Changes
    Section 6401(a) of the ACA, as amended by section 10603 of the ACA, 
amends section 1866(j) of the Act to add a new paragraph, paragraph 
``(2) Provider Screening.'' Section 1866(j)(2)(A) of the Act requires 
the Secretary, in consultation with the Department of Health of Human 
Services' Office of the Inspector General (HHS OIG), to establish 
procedures under which screening is conducted with respect to providers 
of medical or other items or services and suppliers under Medicare, 
Medicaid, and CHIP. Section 1866(j)(2)(B) of the Act requires the 
Secretary to determine the level of screening to be conducted according 
to the risk of fraud, waste, and abuse with respect to the category of 
provider of medical or other items or services or supplier. The 
provision states that the screening shall include a licensure check, 
which may include such checks across State lines; and the screening 
may, as the Secretary determines appropriate based on the risk of 
fraud, waste, and abuse, include a criminal background check; 
fingerprinting; unscheduled or unannounced site visits, including pre-
enrollment site visits; database checks, including such checks across 
State lines; and such other screening as the Secretary determines 
appropriate. Section 1866(j)(2)(C) of the Act requires the Secretary to 
impose a fee on each institutional provider of medical or other items 
or services or supplier that would be used by the Secretary for program 
integrity efforts including to cover the cost of screening and to carry 
out the provisions of sections 1866(j) and 1128J of the Act. We 
discussed the fee in section II.B. of the proposed rule.
    Section 6401(b) of the ACA amends section 1902 of the Act to add 
new paragraph (a)(77) and (ii), which requires States to comply with 
the process for screening providers and suppliers as established by the 
Secretary under 1866(j)(2) of the Act.\1\ Note that section 6401(b) of 
the ACA erroneously added a duplicate section 1902(ii) to the Act. 
Therefore, in the Medicare and Medicaid Extenders Act of 2010 (Pub. L. 
111-309), the Congress enacted a technical correction to redesignate 
the section 1902(ii) of the Act added by section 6401(b) of ACA as 
section 1902(kk) of the Act. In this regulation, we therefore reference 
section 1902(kk) of the Act when referring to the provisions added by 
section 6401(b) of the ACA.
---------------------------------------------------------------------------

    \1\ We believe that the reference to section 1886(j)(2) of the 
Act in section 6401(b)(1) of the ACA is a scrivener's error. We 
believe the Congress intended to refer to section 1866(j)(2) of the 
Act, which, as amended by section 6401(a) of the ACA, requires the 
Secretary to establish a process for screening providers and 
suppliers. Because the drafting error is apparent, and a literal 
reading of the reference to section 1886(j)(2) of the Act would 
produce absurd results, we interpret the cross-reference to section 
1886(j)(2) in the new section 1902(kk) of the Act as if the 
reference were to section 1866(j)(2).
---------------------------------------------------------------------------

    We noted in the proposed rule that the statute uses the terms 
``providers of medical or other items or services,'' ``institutional 
providers,'' and ``suppliers.'' The Medicare program enrolls a variety 
of providers and suppliers, some of which are referred to as 
``providers of services,'' ``institutional providers,'' ``certified 
providers,'' ``certified suppliers,'' and ``suppliers.'' In Medicare, 
the term ``providers of services'' under section 1861(u) of the Act 
means health care entities that furnish services primarily payable 
under Part A of Medicare, such as hospitals, home health agencies 
(including home health agencies providing services under Part B), 
hospices, and skilled nursing facilities. The term ``suppliers'' 
defined in section 1861(d) of the Act refers to health care entities 
that furnish services primarily payable under Part B of Medicare, such 
as independent diagnostic testing facilities (IDTFs), durable medical 
equipment prosthetics, orthotics, and supplies (DMEPOS) suppliers, and 
eligible professionals, which refers to health care suppliers who are 
individuals, that is, physicians and the other professionals listed in 
section 1848(k)(3)(B) of the Act. For Medicaid and CHIP, we use the 
terms ``providers'' or ``Medicaid providers'' or ``CHIP providers'' 
when referring to all Medicaid or CHIP health care providers, including 
individual practitioners, institutional providers, and providers of 
medical equipment or goods related to care. The term ``supplier'' has 
no meaning in the Medicaid program or CHIP.
    The new screening procedures implemented pursuant to new section 
1866(j)(2) of the Act are applicable to newly enrolling providers and 
suppliers, including eligible professionals, beginning on March 25, 
2011. These new procedures are applicable to currently enrolled 
Medicare, Medicaid, and CHIP providers, suppliers, and eligible 
professionals beginning on March 23, 2012. These new screening 
procedures implemented pursuant to new section 1866(j)(2) of the Act 
are applicable beginning on March 25, 2011 for those providers and 
suppliers currently enrolled in Medicare, Medicaid, and CHIP who 
revalidate their enrollment information. Within Medicare, the March 25, 
2011 implementation date will impact those current providers and 
suppliers whose 5-year revalidation cycle (or 3-year revalidation cycle 
for DMEPOS suppliers) results in revalidation occurring on or after 
March 25, 2011 and before March 23, 2012.
    The requirements for revalidation are discussed in Sec.  424.515. 
It is important to note that revalidation--for purposes of both 
provider enrollment in general and this final rule with comment 
period--does not include routine changes of information as described in 
Sec.  424.516(d) and (e), such as address changes or changes in phone 
number.
2. Summary of Existing Screening Measures
    Before we outline the new measures we are finalizing under the ACA, 
it may be helpful to provide a summary of some of the screening 
measures already being utilized in Medicare, Medicaid, and CHIP. 
Pursuant to other authority, but with the notable exception of 
background checks and fingerprinting, Medicare, generally through 
private contractors, already employs a number of the screening 
practices described in section 1866(j)(2)(B) of the Act to determine if 
a provider or supplier is in compliance with Federal and State 
requirements to enroll or to maintain enrollment in the Medicare 
program.
    We also believe it important to note that nothing in this rule is 
intended to abridge our established screening authority under existing 
statutes and regulations or to diminish the screening that providers 
and suppliers currently undergo. To the contrary; the provisions 
specified in this final rule with comment period are intended to 
enhance our existing authority. This rule's provisions, in other words, 
set ``floors''--not ceilings--on enrollment requirements for each 
screening level.
a. Licensure Requirements--Medicare and Medicaid
    Over the past several years, we have taken a number of steps to 
strengthen our ability to deny or revoke Medicare billing privileges 
when providers or suppliers do not have or do not maintain the 
applicable State licensure requirements for their provider or supplier 
type or profession. We established reporting responsibilities for all 
providers, suppliers, and eligible professionals in earlier regulations 
at Sec.  424.516(b) through (e). To ensure that only qualified 
providers and suppliers remain in the Medicare fee-for-service (FFS) 
program, we require that Medicare

[[Page 5866]]

contractors review State licensing board data on a monthly basis to 
determine if providers and suppliers remain in compliance with State 
licensure requirements. Medicare billing privileges would be revoked 
for those providers and suppliers who do not report a final adverse 
action (for example, license revocation or suspension, felony 
conviction) within the applicable reporting period, as required in 
Sec.  424.516(b) through (e). Medicare suppliers of DMEPOS and IDTFs 
are already subject to similar provisions in Sec.  424.57(c) and Sec.  
410.33(g), respectively. DMEPOS suppliers are also subject to 
additional requirements including accreditation and surety bonding, 
pursuant to Sec.  424.57(c)(22) through (26) and Sec.  424.57(d).
    Medicare Advantage organizations (MAOs) are required to verify 
licensure of providers and suppliers, including physicians and other 
health care professionals, in accordance with Sec.  422.204.
    For Medicaid and CHIP, most States do some checking of in-State 
provider licenses, but the extent of scrutiny varies. For example, in 
some States, the existence of the license may be verified, but little 
attention might be given to any restrictions on the license.
b. Site Visits--Medicare
    Pursuant to Sec.  424.517, Medicare conducts the following site 
visits and takes the following actions, generally through private 
contractors under CMS direction:
     The National Supplier Clearinghouse (NSC) Medicare 
Administrative Contractor (the Medicare contractor that processes 
enrollment applications for suppliers of DMEPOS) conducts pre-
enrollment site visits to DMEPOS suppliers that are not associated with 
a chain supplier of DMEPOS (a chain supplier of DMEPOS is a supplier 
with 25 or more distinct practice locations.)
     The NSC also conducts unannounced post-enrollment site 
visits to DMEPOS suppliers for which CMS or the NSC believes there is a 
likelihood of fraudulent or abusive activities to ensure those DMEPOS 
suppliers remain in compliance with the supplier standards found at 
Sec.  424.57(c). CMS at times exercises its right to--
     Have the NSC conduct ad hoc pre- and post-enrollment site 
visits to any DMEPOS supplier;
     Have Medicare contractors conduct pre-enrollment site 
visits to all IDTFs; and
     Conduct ad hoc pre-and post enrollment site visits to any 
prospective Medicare provider and supplier or any enrolled Medicare 
provider or supplier.
    In addition, under 42 CFR parts 488 and 489, a State survey agency 
or an approved national accreditation organization with deeming 
authority conducts pre-enrollment surveys for certified providers and 
suppliers to determine whether they meet the applicable Federal 
conditions and requirements for their provider or supplier type before 
they can participate in the Medicare program.
    We note that the site visits discussed here and elsewhere within 
this preamble and the final regulations are separate and apart from the 
site visits that are conducted pursuant to the Clinical Laboratory 
Improvement Amendments (CLIA). We will work with our State survey 
agency partners in coordinating these site visits so as to avoid 
duplication and burden on providers.
c. Database Checks--Medicare
    Under existing regulation, Medicare contractors employ database 
checks of eligible professionals, owners, authorized officials, 
delegated officials, managing employees, medical directors, and 
supervising physicians (at IDTFs and laboratories) as part of the 
Medicare provider and supplier enrollment process. These include 
database checks with the Social Security Administration (SSA) (to 
verify an individual's SSN), the National Plan and Provider Enumeration 
System (NPPES) to verify the National Provider Identifier (NPI) of an 
eligible professional, and State licensing board checks to determine if 
an eligible professional is appropriately licensed to furnish medical 
services within a given State. These checks also include checking a 
provider or supplier against the HHS OIG's List of Excluded 
Individuals/Entities (LEIE) and the General Service Administration's 
Excluded Parties List System (EPLS). All of the database checks have 
been used to assess the eligibility and qualifications of providers and 
suppliers to enroll in the Medicare program, to confirm the identity of 
an eligible professional to ensure that he or she may be considered for 
enrollment in the Medicare program.
    Also, on a monthly basis, CMS' Medicare contractors systematically 
compare enrolled providers, suppliers, and eligible professionals 
against the information in the Medicare Exclusions Database. The 
Medicare Exclusions Database identifies providers, suppliers, and 
eligible professionals who have been excluded from the Medicare and 
Medicaid programs by the HHS OIG. When a match is found, the HHS OIG 
exclusion information is systematically noted in the Medicare 
enrollment record of the provider, supplier, or eligible professional. 
In the Medicare program, we deny or revoke the billing privileges of 
providers, suppliers, and eligible professionals who have been excluded 
by the HHS OIG. If the HHS OIG lifts the exclusion, the provider, 
supplier or eligible professional must reapply for enrollment in the 
Medicare program. In addition, Medicare contractors also review State 
licensure Web sites on a monthly basis to ensure that eligible 
professionals continue to meet State licensing requirements.
    In addition, since January 2009, we have compared date of death 
information obtained from the Social Security Administration Death 
Master File (SSA DMF) with the information maintained in the National 
Plan and Provider Enumeration System (NPPES), the system that assigns 
an NPI to individuals and organizations. Based on this comparison and 
the subsequent verification, we have deactivated the NPIs of more than 
11,500 individuals who were previously assigned a type 1 (individual) 
NPI. We automatically transfer this information from NPPES to the 
Provider Enrollment, Chain, and Ownership System (PECOS), CMS' national 
Medicare enrollment repository to deactivate a deceased individual's 
Medicare billing privileges. In addition, Medicare contractors are 
required to review and act upon monthly files that contain a list of 
non-practitioner individuals enrolled in the Medicare program who have 
been reported to the SSA as deceased. These individuals include: 
Owners, authorized officials, and delegated officials.
    MAOs, as required by Sec.  422.204, generally use database checks 
to verify licensure and licensure sanctions and limitations with State 
licensing boards and the Federation of State Medical Boards, DEA 
certificates with the National Technical Information Service (NTIS), 
history of adverse professional review actions and malpractice from the 
National Practitioner Data Bank (NPDB), accreditation status of 
institutional providers and suppliers with national accrediting boards, 
such as The Joint Commission (TJC), and search for HHS OIG exclusions 
using the HHS OIG Web site https://oig.hhs.gov/fraud/exclusions/exclusions_list.asp.
d. Criminal Background Checks--Medicare
    Section 6401(a) of the ACA amended Section 1866(j) of the Act 
authorized the Secretary to perform criminal background checks. As 
described in Sec.  424.530(a) and Sec.  424.535(a), CMS or its

[[Page 5867]]

designated Medicare contractor may deny or revoke the Medicare billing 
privileges of the owner of a provider or supplier, a physician or non-
physician practitioner, and terminate any corresponding provider or 
supplier agreement for a number of reasons, including an exclusion from 
the Medicare, Medicaid, and any other Federal health care program, a 
felony within the preceding 10 years that is considered detrimental to 
the Medicare program, and/or submission of false or misleading 
information on the Medicare enrollment application. While we require 
our Medicare contractors to verify data submitted on, and as part of, 
the Medicare provider/supplier enrollment application, our contractors 
are not able to verify information that may have been purposefully 
omitted or changed in a manner to obfuscate any previous criminal 
activity. A 2005 report issued by the National Task Force on the 
Criminal Backgrounding of America, sponsored by the Bureau of Justice 
Statistics and the U.S. Department of Justice, defined a Criminal 
History Record Check as a check that returns records from official 
criminal repositories (meaning State repositories and the Federal 
Bureau of Investigations (FBI) Interstate Identification Index that 
links Federal and State criminal record systems), and the FBI uses the 
same terminology. For purposes of responding to comments in this 
document we use the term criminal history record check to mean criminal 
background checks when referring to such fingerprint-based checks. 
Criminal History Record Checks have not been historically used in the 
FFS Medicare enrollment screening process.
e. Medicare MAO Requirements
    As mentioned earlier in this section, MAOs already employ a number 
of screening procedures in accordance with regulations and CMS manual 
instructions. Specifically, under Sec.  422.204(b)(3) in the case of 
providers meeting the definition of ``provider of services'' in section 
1861(u) of the Act, basic benefits may only be provided through 
providers if they have a provider agreement with us permitting them to 
furnish services under original Medicare. With respect to other 
entities like suppliers, Sec.  422.204(b)(3) requires that they ``meet 
the applicable requirements of title XVIII and Part A of title XI of 
the Act.'' Given these requirements we considered to what extent MAOs 
would be required to apply the identical screening requirements we 
proposed for the original Medicare program or whether substantively 
similar alternative approaches adopted by MAOs would be acceptable. 
Accordingly, we solicited public comments on whether or to what extent 
MAOs should be required to implement the same enhanced screening 
requirements for providers, suppliers and physicians that we proposed 
for the original Medicare program.
f. Fingerprinting--Medicare
    Previous to this final rule with comment period fingerprinting and 
fingerprint-based criminal history record information from the FBI was 
not used in the Medicare enrollment screening process.
g. Screening--Medicaid and CHIP
    States vary in the degree to which they employ screening methods 
such as unscheduled and unannounced site visits and database checks, 
including such checks across State lines, criminal background checks, 
and fingerprinting. However, at least a few States utilize each of 
those methods.
    States also varied in what they require their managed care entities 
(MCEs) \2\ to do in terms of screening network-level providers that are 
not also enrolled in the Medicaid program as FFS providers. We 
considered to what extent States must require their MCEs to apply the 
identical screening requirements we proposed for the States or whether 
substantively similar alternative approaches adopted by MCEs are 
acceptable. Accordingly, we solicited public comments on whether or to 
what extent MCEs should be required to implement the same enhanced 
screening requirements for Medicaid and CHIP providers that we proposed 
for State Medicaid and CHIP programs.
---------------------------------------------------------------------------

    \2\ For purposes of this preamble and the final regulations, 
``managed care entity'' and ``MCE'' will have the meaning Medicaid 
managed care organization (MCO), primary care case manager (PCCM), 
prepaid inpatient health plan (PIHP), prepaid ambulatory health plan 
(PAHP), and health insuring organization (HIO). This definition 
differs from the meaning in section 1932(a)(1)(B) of the Social 
Security Act, which limits MCEs to Medicaid MCOs and PCCMs. We are 
using a more inclusive definition for the regulation so that all 
those entities in States' managed care programs will provide 
disclosure information.
---------------------------------------------------------------------------

    We again stress that the provider enrollment verification tools 
that we are currently using--including, but not limited to, those 
described previously--will not in any way be diminished as a result of 
this final rule with comment period. In other words, the validation 
techniques in this rule do not supplant those that are presently in 
use.
3. General Screening of Providers--Medicare
a. Proposed Screening Requirements
    Section 1866(j)(2)(B) of the Act requires the Secretary to 
determine the level of screening applicable to providers and suppliers 
according to the risk of fraud, waste, and abuse the Secretary 
determines is posed by particular provider and supplier categories.
    In considering how to establish consistent screening standards, we 
proposed to designate provider and supplier categories that are subject 
to certain screening procedures based on CMS' assessment of fraud, 
waste and abuse risk of the provider or supplier category, taking into 
consideration a variety of factors. These factors include our own 
experience with claims data used to identify fraudulent billing 
practices as well as the expertise developed by our contractors charged 
with investigating and identifying instances of Medicare fraud across a 
broad spectrum of providers. In addition, CMS has relied on insights 
gained from numerous studies conducted by the HHS-OIG, GAO, and other 
sources. We have designated categories of providers or suppliers (for 
example, ``newly enrolling DME suppliers'' or ``currently enrolled home 
health agencies'') that are subject to screening procedures based on 
our assessment of the level of screening based on the risk presented by 
the category of provider. There are three levels of screening and 
associated risk: ``limited,'' ``moderate'' and ``high,'' and each 
provider/supplier category is assigned to one of these three screening 
levels. The categories described below and associated risk levels 
assigned are designed to identify those categories of providers and 
suppliers that pose a risk of fraud, waste, and abuse.
    The screening procedures applicable to each screening level are set 
by us and are included in this final rule with comment period. Under 
this approach, the relevant Medicare contractor (for example, fiscal 
intermediary, regional home health intermediary, carriers, Part A or 
Part B Medicare Administrative Contractor (A/B MAC), or the NSC 
Administrative Contractor) would utilize the screening tools mandated 
by us for the screening level assigned to a particular provider or 
supplier category.
    We solicited comments on the proposed assignment of specific 
provider and supplier types to the proposed risk screening levels, 
including what criteria should be considered in making such 
assignments, whether such assignments should be

[[Page 5868]]

released publicly, whether they should be subject to agency review and 
updated according to an established schedule (that is, annually, bi-
annually), and the extent to which they should be updated according to 
evolving risks. We also solicited comments on any additional database 
checks that we should consider as a type of screening.
    Based on the level of screening assigned, we proposed that the 
Medicare contractors would establish and conduct the following 
categorical screenings.

     Table 1--Proposed Screening Levels and Procedures for Medicare Physicians, Non-Physician Practitioners,
                                            Providers, and Suppliers
----------------------------------------------------------------------------------------------------------------
                  Type of screening required                       Limited          Moderate           High
----------------------------------------------------------------------------------------------------------------
Verification of any provider/supplier[dash]specific                         X                X                X
 requirements established by Medicare........................
Conduct license verifications, (may include licensure checks                X                X                X
 across States)..............................................
Database Checks (to verify Social Security Number (SSN), the                X                X                X
 National Provider Identifier (NPI), the National
 Practitioner Data Bank (NPDB) licensure, an OIG exclusion;
 taxpayer identification number; tax delinquency; death of
 individual practitioner, owner, authorized official,
 delegated official, or supervising physician)...............
Unscheduled or Unannounced Site Visits.......................  ...............               X                X
Criminal Background Check....................................  ...............  ...............               X
Fingerprinting...............................................  ...............  ...............               X
----------------------------------------------------------------------------------------------------------------

    As described previously, we already require Medicare contractors to 
ensure that every provider or supplier meets any applicable Federal 
regulations or State requirements, including applicable licensure 
requirements \3\ for the provider or supplier type prior to making an 
enrollment determination. In addition, we also require that Medicare 
contractors conduct monthly reviews of State licensing board actions to 
determine if an individual practitioner, such as a physician or non-
physician practitioner continues to meet State licensing requirements. 
In the case of organizational entities, we also require our Medicare 
contractors to conduct monthly or periodic checks to determine if an 
organizational entity continues to meet the Federal and State 
requirements for its provider or supplier type. Such verifications help 
ensure that a prospective provider or supplier is eligible to 
participate in the Medicare program or that an existing provider or 
supplier is eligible to maintain its Medicare billing privileges.
---------------------------------------------------------------------------

    \3\ We note that under section 408 of the reauthorized Indian 
Health Care Improvement Act, ``[a]ny requirement for participation 
as a provider of health care services under a Federal health care 
program that an entity be licensed or recognized under the State or 
local law where the entity is located to furnish health care 
services shall be deemed to have been met in the case of an entity 
operated by the [Indian Health] Service, an Indian tribe, tribal 
organization, or urban Indian organization if the entity meets all 
the applicable standards for such licensure or recognition, 
regardless of whether the entity obtains a license or other 
documentation under such State or local law.'' 25 U.S.C. 1647a.
---------------------------------------------------------------------------

    Previous to this final rule with comment period, in the Medicare 
program, DMEPOS suppliers were required to re-enroll every 3 years, and 
other providers were required to revalidate their enrollment every 5 
years. The terms revalidation and re-enrollment were often used 
interchangeably, but are actually specific to these provider types. To 
eliminate any confusion about which term applies to which provider or 
supplier, we proposed language at Sec.  424.57(e) to change all 
references from re-enroll or re-enrollment to revalidate or 
revalidation. In addition, the ACA requires that no provider or 
supplier shall be allowed to enroll in Medicare or revalidate its 
enrollment in Medicare after March 23, 2013 without being screened 
pursuant to the authorities covered by this final rule with comment 
period. To assist us in assuring that the statutory effective date is 
met, we proposed at Sec.  424.515 to permit us to require that a 
provider or supplier revalidate its enrollment at any time. After the 
revalidation, the current cycle for revalidation (3 years for DMEPOS, 
and 5 years for all other providers) would apply.
(1) Limited
    Based on our own analysis of historical trends and our own 
experience with provider screening and enrollment we proposed that, as 
a category, the following providers and suppliers pose a limited risk 
to the Medicare program: Physician or non-physician practitioners and 
medical groups or clinics; providers or suppliers that are publicly 
traded on the NYSE or NASDAQ; ambulatory surgical centers (ASCs); end-
stage renal disease (ERSD) facilities; Federally qualified health 
centers (FQHCs); histocompatibility laboratories; hospitals, including 
critical access hospitals (CAHs); Indian Health Service (IHS) 
facilities; mammography screening centers; organ procurement 
organizations (OPOs); mass immunization roster billers, portable x-ray 
suppliers; religious nonmedical health care institutions (RNHCIs); 
rural health clinics (RHCs); radiation therapy centers; skilled nursing 
facilities (SNFs), and public or government-owned ambulance services 
suppliers.
    In Sec.  424.518(a), we proposed that the following screening tools 
will apply to providers and suppliers in categories designated as 
limited risk: (1) Verification that a provider or supplier meets any 
applicable Federal regulations, or State requirements for the provider 
or supplier type prior to making an enrollment determination; (2) 
verification that a provider or supplier meets applicable licensure 
requirements; and (3) database checks on a pre- and post-enrollment 
basis to ensure that providers and suppliers continue to meet the 
enrollment criteria for their provider/supplier type.
    To assist readers in understanding the type of providers and 
suppliers that we proposed to include in the limited risk screening 
level, we are providing the following table.

   Table 2--Proposed Medicare Providers and Suppliers Designated as a
           ``Limited'' Categorical Risk for Screening Purposes
------------------------------------------------------------------------
                       Provider/supplier category
-------------------------------------------------------------------------
Physician or non[dash]physician practitioners and medical groups or
 clinics.
Providers or suppliers that are publicly traded on the NYSE or NASDAQ.

[[Page 5869]]

 
Ambulatory surgical centers, end[dash]stage renal disease facilities,
 Federally qualified health centers, histocompatibility laboratories,
 hospitals, including critical access hospitals, Indian Health Service
 facilities, mammography screening centers, organ procurement
 organizations, mass immunization roster billers, portable x[dash]ray
 supplier, religious non[dash]medical health care institutions, rural
 health clinics, radiation therapy centers, skilled nursing facilities,
 and public or government[dash]owned or [dash]affiliated ambulance
 service suppliers.
------------------------------------------------------------------------

(2) Moderate
    Based on our experience, we proposed that community mental health 
centers (CMHCs); comprehensive outpatient rehabilitation facilities 
(CORFs); hospice organizations; independent diagnostic testing 
facilities (IDTFs); independent clinical laboratories; and non-public, 
non-government owned or affiliated ambulance services suppliers pose a 
moderate risk to the Medicare program. However, we provided that any 
such provider or supplier that is publicly traded on the NYSE or NASDAQ 
would be considered limited risk. Furthermore, we proposed that 
currently enrolled (revalidating) home health agencies would be 
considered ``moderate'' risk, except any such provider that is publicly 
traded on the NYSE or NASDAQ would be considered limited risk. Finally, 
we proposed that currently enrolled (re-validating) suppliers of DMEPOS 
pose a moderate risk, except that any such supplier that is publicly 
traded on the NYSE or NASDAQ would be considered ``limited'' risk. We 
provide our rationale for these categories in this section below.
    For those provider and supplier categories in the ``moderate'' 
screening level, we proposed that Medicare contractors would conduct 
unannounced pre- and/or post-enrollment site visits in addition to 
those screening tools applicable to the limited level of screening. 
Based on the success of pre-and/or post enrollment site visits 
conducted by the NSC during the enrollment process for suppliers of 
DMEPOS and a similar process established by carriers and A/B MACs 
during the enrollment of IDTFs, we believe that unscheduled and 
unannounced pre-and post-enrollment site visits help ensure that 
suppliers are operational and meet applicable supplier standards or 
performance standards. In addition, we believe that unscheduled and 
unannounced pre-and post-enrollment site visits are an essential tool 
in determining whether a provider or supplier is in compliance with its 
reporting responsibilities, including the requirement in Sec.  424.516 
to notify the Medicare contractor of any change of practice location.
    Moreover, Sec.  424.530(a)(5) and Sec.  424.535(a)(5) give us the 
authority to deny or revoke Medicare billing privileges for providers 
and suppliers if the provider or supplier is not operational or the 
provider does not maintain the established provider or supplier 
performance standards. And while we do not believe that unscheduled or 
unannounced site visits are necessary for all providers and suppliers, 
we do believe that a number of businesses, like the ones mentioned 
below, pose an increased risk to the Medicare program, due at least in 
part to the lack of individual professional licensure.
    In addition, as discussed below, we have found that certain types 
of providers and suppliers that easily enter a line or business without 
clinical or business experience--for example, by leasing minimal office 
space and equipment--present a higher risk of possible fraud to our 
programs. As such, we believe that because these types of providers 
pose an increased risk of fraud they should be subject to substantial 
scrutiny before being permitted to enroll and bill Medicare, Medicaid, 
or CHIP. This type of pre-enrollment scrutiny will help us move away 
from the ``pay and chase'' approach.
    Most of the provider and supplier categories in the moderate 
screening level are generally highly dependent on Medicare, Medicaid, 
or CHIP to pay their salaries and other operating expenses and are 
subject to less additional government or professional oversight than 
the providers and suppliers in the limited risk screening level. 
Accordingly, we believe it is appropriate and necessary to conduct 
unscheduled and unannounced pre-enrollment site visits to ensure that 
these prospective providers and suppliers meet our enrollment 
requirements prior to enrolling in the Medicare program. Moreover, we 
believe that post-enrollment site visits are also important to ensure 
that the enrolled provider or supplier remains a viable health care 
provider or supplier in the Medicare program.
    Accordingly, we proposed in Sec.  424.518(b) that in addition to 
the categorical screening tools used with respect to limited risk 
providers and suppliers, Medicare contractors would conduct unannounced 
and unscheduled site visits prior to enrolling the providers and 
suppliers assigned to the moderate risk screening level, as set forth 
earlier in this Section.
    In the proposed rule, we set forth our rationale for the assessment 
of risk ascribed to the providers and suppliers assigned to the 
``moderate'' level of screening. First, we noted that HHS OIG and GAO 
have issued studies indicating that several of the provider and 
supplier types cited previously pose an elevated risk of fraud, waste 
and abuse to the Medicare and Medicare programs and CHIP. In an October 
2007 report titled, ``Growth in Advanced Imaging Paid under the 
Medicare Physician Fee Schedule'' (OEI-01-06-00260), the HHS OIG 
recommended that CMS consider conducting site visits to monitor IDTFs' 
compliance with Medicare requirements.'' In addition, in an April 2007 
report titled, ``Medicare Hospices: Certification and Centers for 
Medicare & Medicaid Services Oversight'' (OEI-06-05-00260), the HHS OIG 
recommended that CMS seek legislation to establish additional 
enforcement remedies for poor hospice performance. In response to this 
recommendation, CMS stated that it was considering whether to pursue 
new enforcement remedies for poor hospice performance. While the 
Medicare enrollment process is not designed to verify the conditions of 
participation, we do believe that more frequent onsite visits may help 
identify those hospice organizations that are no longer operational at 
the practice location identified on the Medicare enrollment 
application.
    In a January 2006 report titled, ``Medicare Payments for Ambulance 
Transports'' (OEI-05-02-000590), the HHS OIG found that ``25 percent of 
ambulance transports did not meet Medicare's program requirements, 
resulting in an estimated $402 million in improper payments.''
    In an August 2004 report titled, ``Comprehensive Outpatient 
Rehabilitation Facilities: High Medicare Payments in Florida Raise 
Program Integrity Concerns'' (GAO-04-709), the GAO concluded that, 
``[s]izeable disparities between Medicare therapy payments per patient 
to Florida CORFs and other facility-based outpatient therapy providers 
in 2002--with no clear indication of differences in patient needs--
raise questions about the appropriateness of CORF billing practices. 
After finding high rates of medically unnecessary therapy services to 
CORFs, CMS's claims administration

[[Page 5870]]

contractor for Florida took steps to ensure appropriate claim payments 
for a small, targeted group of CORF patients. Despite its limited 
success, billing irregularities continued among some CORFs and many 
CORFs continued to receive relatively high payments the following year. 
This suggests that the contractor's efforts were too limited in scope 
to be effective with all CORF providers.''
    In addition to GAO and HHS OIG studies and reports, a number of 
Zone Program Integrity Contractors (ZPIC) and Program Safeguard 
Contractors (PSC) used by CMS in helping to fight fraud in Medicare, 
have taken a number of administrative actions including payment 
suspensions and increased medical review, for the provider and supplier 
types shown previously. For example, the Zone 7 ZPIC contractor in 
South Florida has conducted onsite reviews at 62 CORFs since January 
2010 and recommended revocation for 51 CORFs, or 82 percent of the 
CORFS in the area. The same contractor has conducted an onsite reviews 
at 38 CMHCs located in Dade, Broward, and Palm Beach County since 
January 2010, and recommended that 30 CMHCs be revoked for 
noncompliance (79 percent of the CMHCs in the area). In each instance 
where the ZPIC requested a revocation, the CMHC was also placed on 
prepay review. We have also conducted an analysis of IDTF licensure 
requirements and have found several circumstances that indicate 
irregularity and potential risk of fraud. Although independent clinical 
laboratories are subject to survey against CLIA requirements, there are 
nonetheless a number of potentials for fraud, not the least of which is 
the sheer volume of service and associated billing generated by these 
entities.
    We believe that there is ample evidence to support the use of post-
enrollment site visits as a reliable and effective tool to ensure that 
a current supplier of DMEPOS remains operational and continues to meet 
the supplier standards found in Sec.  424.57(c). In a March 2007 report 
titled, ``Medical Equipment Suppliers Compliance with Medicare 
Enrollment Requirements'' (OEI-04-05-00380), the HHS OIG concluded 
that, ``By helping to ensure the legitimacy of DMEPOS suppliers, out-
of-cycle site visits may help to prevent fraud, waste, and abuse in the 
Medicare program. CMS may want to consider the findings of our study as 
they determine how and to what extent out-of-cycle site visits of 
DMEPOS suppliers will occur.'' Today, the NSC MAC utilizes post-
enrollment site visits as the primary screening to determine ongoing 
compliance with the enrollment criteria set forth in Sec.  424.57(c). 
Therefore, we have included currently enrolled DMEPOS suppliers in the 
``moderate'' category.
    We also noted that, in addition to the new screening measures 
proposed in the proposed rule under the existing regulation at Sec.  
424.517, a Medicare contractor may conduct an unannounced or 
unscheduled site visit at any time for any provider or supplier type 
prior to enrolling a prospective provider or supplier or for any 
existing provider or supplier enrolled in the Medicare program. While 
the primary purpose of an unannounced and unscheduled site visit is to 
ensure that a provider or supplier is operational at the practice 
location found on the Medicare enrollment application, a Medicare 
contractor may also verify established supplier standards or 
performance standards other than conditions of participation (CoP) 
subject to survey and certification by the State Survey agency, where 
applicable, to ensure that the supplier remains in compliance with 
program requirements.
    To assist readers in understanding the type of providers and 
suppliers that we proposed to be in the ``moderate'' risk screening 
level, we are providing the following table.

   Table 3--Proposed Medicare Providers and Suppliers Designated as a
          ``Moderate'' Categorical Risk for Screening Purposes
------------------------------------------------------------------------
                       Provider/supplier category
-------------------------------------------------------------------------
Community mental health centers; comprehensive outpatient rehabilitation
 facilities; hospice organizations; independent diagnostic testing
 facilities; independent clinical laboratories; and non-public, non-
 government owned or affiliated ambulance services suppliers. (Except
 that any such provider or supplier that is publicly traded on the NYSE
 or NASDAQ is considered ``limited'' risk.)
Currently enrolled (revalidating) home health agencies. (Except that any
 such provider that is publicly traded on the NYSE or NASDAQ is
 considered ``limited'' risk.)
Currently enrolled (re[dash]validating) suppliers of DMEPOS. (Except
 that any such supplier that is publicly traded on the NYSE or NASDAQ is
 considered ``limited'' risk.)
---------------------------------------------