Medicare, Medicaid, and Children's Health Insurance Programs; Program Integrity Enhancements to the Provider Enrollment Process, 47794-47857 [2019-19208]

Agencies

• Centers for Medicare & Medicaid Services
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 84, Number 175 (Tuesday, September 10, 2019)]
[Rules and Regulations]
[Pages 47794-47857]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-19208]



[[Page 47793]]

Vol. 84

Tuesday,

No. 175

September 10, 2019

Part III





Department of Health and Human Services





-----------------------------------------------------------------------





Centers for Medicare & Medicaid Services





-----------------------------------------------------------------------





42 CFR Parts 405, 424, et al.





Medicare, Medicaid, and Children's Health Insurance Programs; Program 
Integrity Enhancements to the Provider Enrollment Process; Final Rule

Federal Register / Vol. 84 , No. 175 / Tuesday, September 10, 2019 / 
Rules and Regulations

[[Page 47794]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Parts 405, 424, 455, 457, and 498

[CMS-6058-FC]
RIN 0938-AS84


Medicare, Medicaid, and Children's Health Insurance Programs; 
Program Integrity Enhancements to the Provider Enrollment Process

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Final rule with comment period.

-----------------------------------------------------------------------

SUMMARY: This final rule with comment period implements statutory 
provisions that require Medicare, Medicaid, and Children's Health 
Insurance Program (CHIP) providers and suppliers to disclose certain 
current and previous affiliations with other providers and suppliers. 
In addition, it provides the agency with additional authority to deny 
or revoke a provider's or supplier's Medicare enrollment in certain 
specified circumstances. The provisions we are finalizing in this rule 
are necessary to address various program integrity issues and 
vulnerabilities by enabling CMS to take action against unqualified and 
potentially fraudulent entities and individuals, which in turn could 
deter other parties from engaging in improper behavior.

DATES: Effective date: This final rule with comment period is effective 
on November 4, 2019.
    Comment date: To be assured consideration, comments regarding 
sections II.A.1. and 2. of this final rule with comment period and 
Sec. Sec.  424.519 and 455.107 must be received at one of the addresses 
provided below, no later than 5 p.m. on November 4, 2019.

ADDRESSES: In commenting, please refer to file code CMS-6058-FC. 
Because of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    Comments, including mass comment submissions, must be submitted in 
one of the following three ways (please choose only one of the ways 
listed):
    1. Electronically. You may submit electronic comments on this 
regulation to https://www.regulations.gov. Follow the ``Submit a 
comment'' instructions.
    2. By regular mail. You may mail written comments to the following 
address only: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-6058-FC, P.O. Box 8013, 
Baltimore, MD 21244-8013.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address only: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-6058-FC, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT: Frank Whelan, (410) 786-1302.

SUPPLEMENTARY INFORMATION: 

I. Executive Summary and Background

A. Executive Summary

1. Purpose and Need for Regulatory Action
    This final rule with comment period will implement a provision of 
the Social Security Act (the Act) that requires Medicare, Medicaid, and 
Children's Health Insurance Program (CHIP) providers and suppliers to 
disclose any current or previous direct or indirect affiliation with a 
provider or supplier that--(1) has uncollected debt; (2) has been or is 
subject to a payment suspension under a federal health care program; 
(3) has been or is excluded by the Office of Inspector General (OIG) 
from Medicare, Medicaid, or CHIP; or (4) has had its Medicare, 
Medicaid, or CHIP billing privileges denied or revoked. This provision 
permits the Secretary to deny enrollment based on such an affiliation 
when the Secretary determines that the affiliation poses an undue risk 
of fraud, waste, or abuse. Also, this final rule with comment period 
will revise various provider enrollment provisions in 42 CFR part 424, 
subpart P, and certain program integrity provisions in 42 CFR parts 
405, 455, and 457. We proposed these provisions in a proposed rule 
published in the March 1, 2016 Federal Register (81 FR 10720) titled, 
``Medicare, Medicaid, and Children's Health Insurance Programs; Program 
Integrity Enhancements to the Provider Enrollment Process.''
    As discussed in greater detail in section II. of this final rule 
with comment period, the provisions we are finalizing in this rule are 
necessary to address various program integrity issues and 
vulnerabilities. We believe that these provisions will help make 
certain that entities and individuals who pose risks to the Medicare 
and Medicaid programs and CHIP are removed from and kept out of these 
programs; this final rule with comment period will also assist in 
preventing providers and suppliers from circumventing Medicare 
requirements through name and identity changes, as well as through 
elaborate, inter-provider relationships. In short, this final rule with 
comment period will enable us to take action against unqualified and 
potentially fraudulent entities and individuals, which in turn could 
deter other parties from engaging in improper behavior.
    The following are the principal legal authorities for our final 
provisions:
     Section 1902(kk)(3) of the Act,\1\ as amended by section 
6401(b) of the Affordable Care Act, which mandates that states require 
providers and suppliers to comply with the same disclosure requirements 
established by the Secretary under section 1866(j)(5) of the Act.\2\
---------------------------------------------------------------------------

    \1\ Because section 6401(b) of the Affordable Care Act 
erroneously added a duplicate section 1902(ii) of the Act, the 
Congress enacted a technical correction in the Medicare and Medicaid 
Extenders Act of 2010 (MMEA) (Pub. L. 111-309) to redesignate 
section 1902(ii) of the Act as section 1902(kk) of the Act, a 
designation we will use in this final rule with comment period.
    \2\ Section 1304 of the Health Care and Education Reconciliation 
Act (Pub. L. 111-152) added a new paragraph (j)(4) to section 1866 
of the Act, thus re-designating the subsequent paragraphs. 
Accordingly, we are interpreting the reference in section 
1902(kk)(3) of the Act to ``disclosure requirements established by 
the Secretary under section 1866(j)(4)'' of the Act to mean the 
disclosure requirements described in section 1866(j)(5) of the Act.
---------------------------------------------------------------------------

     Section 2107(e)(1) of the Act, as amended by section 
6401(c) of the Affordable Care Act, which makes the requirements of 
section 1902(kk) of the Act, including the disclosure requirements, 
applicable to CHIP.
     Section 1866(j) of the Act, which provides specific 
authority with respect to the enrollment process for providers and 
suppliers.
     Sections 1102 and 1871 of the Act, which provide general 
authority for the Secretary to prescribe regulations for the efficient 
administration of the Medicare program.
2. Summary of the Major Provisions
    The major provisions of this final rule with comment period will do 
the following:
     Implement a provision of the Act that requires Medicare, 
Medicaid, and CHIP providers and suppliers to disclose any current or 
previous direct or indirect affiliation with a provider or supplier 
that has uncollected debt; has been or is subject to a payment 
suspension under a federal health care program; has been excluded from

[[Page 47795]]

Medicare, Medicaid, or CHIP; or has had its Medicare, Medicaid, or CHIP 
billing privileges denied or revoked (all of which are hereafter 
occasionally referred to as ``disclosable events''), and that permits 
the Secretary to deny enrollment based on such an affiliation when the 
Secretary determines that it poses an undue risk of fraud, waste, or 
abuse.
    ++ Define the terms ``affiliation,'' ``disclosable event,'' 
``uncollected debt,'' and ``undue risk'' as they pertain to this 
provision of the Act.
     Provide CMS with the authority to do the following:
    ++ Deny or revoke a provider's or supplier's Medicare enrollment if 
CMS determines that the provider or supplier is currently revoked under 
a different name, numerical identifier, or business identity, and the 
applicable reenrollment bar period has not expired.
    ++ Revoke a provider's or supplier's Medicare enrollment--including 
all of the provider's or supplier's practice locations, regardless of 
whether they are part of the same enrollment--if the provider or 
supplier billed for services performed at, or items furnished from, a 
location that it knew or should reasonably have known did not comply 
with Medicare enrollment requirements.
    ++ Revoke a physician's or eligible professional's Medicare 
enrollment if he or she has a pattern or practice of ordering, 
certifying, referring, or prescribing Medicare Part A or B services, 
items, or drugs that is abusive, represents a threat to the health and 
safety of Medicare beneficiaries, or otherwise fails to meet Medicare 
requirements.
    ++ Increase the maximum reenrollment bar from 3 to 10 years, with 
exceptions as stated in this rule.
    ++ Prohibit a provider or supplier from enrolling in the Medicare 
program for up to 3 years if its enrollment application is denied 
because the provider or supplier submitted false or misleading 
information on or with (or omitted information from) its application in 
order to gain enrollment in the Medicare program.
    ++ Revoke a provider's or supplier's Medicare enrollment if the 
provider or supplier has an existing debt that CMS refers to the United 
States Department of Treasury.
    ++ Deny a provider's or supplier's Medicare enrollment application 
if--(1) the provider or supplier is currently terminated or suspended 
(or otherwise barred) from participation in a state Medicaid program or 
any other federal health care program; or (2) the provider's or 
supplier's license is currently revoked or suspended in a state other 
than that in which the provider or supplier is enrolling.
3. Summary of Costs and Benefits
a. Costs
    As explained in greater detail in sections IV. and V. of this final 
rule with comment period, we estimate an annual cost to providers and 
suppliers of $937,500 in each of the first 3 years of this rule. This 
cost involves the information collection burden associated with the 
requirement that Medicare, Medicaid, and CHIP providers and suppliers 
disclose certain current and prior affiliations.
b. Savings
    As described further in section V. of this final rule with comment 
period, we project the following savings from our finalized 
provisions:'
     Our new revocation authorities will lead to approximately 
2,600 new revocations per year, resulting in a 10-year savings of $4.16 
billion (based on a projected per-revoked provider amount of $160,000).
     Our new reenrollment and reapplication bar provisions will 
apply to approximately 400 of CMS' revocations per year, resulting in 
an estimated 10-year actual savings of $1.79 billion (based on a 
projected per-revoked provider amount of $160,000) and a caused savings 
of $4.48 billion. ``Caused savings'' refers to the full amount of money 
that will be saved based on the new reenrollment and reapplication bars 
applied over 10 years; a large portion of the savings will be made 
after the first 10-year period of interest and will not be fully 
actualized until year 20. (Section IV of this final rule with comment 
period discusses the concept of ``caused savings'' in greater detail.)
     Concerning our affiliation provisions, over the last 5 
years, $51.9 billion (with adjusted factors applied) has been paid to 
2,097 entities with affiliations stemming from the revoked Medicare 
enrollment of an associated individual or other entity. Adjusted 
factors refer to adjustments made to gross billing, based on provider 
and supplier type, in relation to the percentage of services that are 
not transferred to a different provider or supplier after a revocation. 
There is a range across provider and supplier types of what percentage 
of services transfer to other practitioners or entities after a 
revocation--that is, they were legitimate services--versus what 
percentage of services do not transfer to another practitioner or 
entity--that is, the services were never rendered, were medically 
unnecessary, or for some other reason do not result in a transfer of 
services to another practitioner or entity. If the affiliations/undue 
risk revocation authority we are finalizing in this rule had been in 
place during that period, we project that CMS would have taken 
revocation action in approximately 40 percent of identified prior 
affiliation cases (or approximately 838 cases) based on a determination 
of undue risk of fraud, waste, or abuse. We accordingly would not have 
paid those problematic providers. As a result, over the last 5 years 
the program would have seen a resulting $20.7 billion in cost-avoidance 
savings, or an average of $4.14 billion per year. We recognize, though, 
that our 40 percent figure is merely an estimate. To accommodate the 
possibility of fluctuation, below are projections of savings based on 
figures of 20 percent, 40 percent, and 60 percent:

 Table 1--Range of Projected Savings Related to Affiliations Provisions
------------------------------------------------------------------------
                                        5-year              Annual
           Percentage                affiliations        affiliations
                                    authority total     authority total
------------------------------------------------------------------------
60% of the 5-year adjusted        $31.1 billion over  $6.22 billion.
 factor total of $51.9 billion.    5 years.
40% of the 5-year adjusted        $20.7 billion over  $4.14 billion.
 factor total of $51.9 billion.    5 years.
20% of the 5-year adjusted        $10.3 billion over  $2.06 billion.
 factor total of $51.9 billion.    5 years.
------------------------------------------------------------------------

    Given the foregoing savings estimates for revocations based on new 
authorities other than the affiliations authority, reenrollment and 
reapplication bars, and revocations stemming from the affiliations 
authority (using our median 40 percent figure), we project a total 
savings over a 10-year period of $47.35 billion.

[[Page 47796]]

B. General Overview

1. Medicare
    The Medicare program (title XVIII of the Act) is the primary payer 
of health care for approximately 54 million enrolled beneficiaries. 
Under section 1802(a) of the Act, a beneficiary may obtain health care 
services from an individual or organization qualified to participate in 
the Medicare program. Qualifications to participate are specified in 
statute and in regulations (see, for example, sections 1814, 1815, 
1819, 1833, 1834, 1842, 1861, 1866, and 1891 of the Act; and 42 CFR 
chapter IV, subchapter G, of the regulations, which concerns standards 
and certification requirements).
    Providers and suppliers furnishing services must comply with the 
Medicare requirements stipulated in the Act and in our regulations. 
These requirements are meant to confirm compliance with applicable 
statutes as well as to promote the furnishing of high quality care. As 
Medicare program expenditures have grown, we have increased our efforts 
to make certain that only qualified individuals and organizations are 
allowed to enroll in and maintain their enrollment in Medicare.
2. Medicaid and CHIP
    The Medicaid program (title XIX of the Act) is a joint federal and 
state health care program that covers nearly 70 million low-income 
individuals. States have considerable flexibility in how they 
administer their Medicaid programs within a broad federal framework, 
and programs vary from state to state. CHIP (title XXI of the Act) is a 
joint federal and state health care program that provides health care 
coverage to more than 8.4 million children. In operating Medicaid and 
CHIP, states historically have permitted the enrollment of providers 
who meet the state requirements for program enrollment as well as any 
applicable federal requirements (such as those in 42 CFR part 455). 
State enrollment requirements must be consistent with section 
1902(a)(23) of the Act and implementing regulations at Sec.  431.51, 
under which states may set reasonable standards relating to the 
qualifications of providers but may not restrict the right of 
beneficiaries to obtain services from any person or entity that is both 
qualified and willing to furnish such services.

C. General Background on the Enrollment Process

1. The 2006 Provider Enrollment Final Rule
    In the April 21, 2006 Federal Register (71 FR 20754), we published 
a final rule titled, ``Medicare Program; Requirements for Providers and 
Suppliers to Establish and Maintain Medicare Enrollment.'' The final 
rule set forth certain requirements in 42 CFR part 424, subpart P, that 
providers and suppliers must meet to obtain and maintain Medicare 
billing privileges. We cited in that rule sections 1102 and 1871 of the 
Act as general authority for our establishment of these requirements, 
which were designed for the efficient administration of the Medicare 
program.
2. The 2011 Provider Enrollment Final Rule
    In the February 2, 2011 Federal Register (76 FR 5861), we published 
a final rule with comment period titled, ``Medicare, Medicaid, and 
Children's Health Insurance Programs; Additional Screening 
Requirements, Application Fees, Temporary Enrollment Moratoria, Payment 
Suspensions and Compliance Plans for Providers and Suppliers.'' This 
final rule with comment period implemented various provisions of the 
Act, including the following:
     Required submission of application fees by institutional 
providers and suppliers as part of the Medicare, Medicaid, and CHIP 
provider enrollment processes.
     Establishment of Medicare, Medicaid, and CHIP provider 
enrollment screening categories and corresponding screening 
requirements.
     Authorization of temporary moratoria on the enrollment of 
new Medicare, Medicaid, and CHIP providers and suppliers of a 
particular type (or the establishment of new practice locations of a 
particular type) in a geographic area when necessary to combat fraud, 
waste, or abuse.
3. Form CMS-855--Medicare Enrollment Application
    Under Sec.  424.510, a provider or supplier must complete, sign, 
and submit to its assigned Medicare contractor the appropriate Form 
CMS-855 (OMB Control No. 0938-0685) application in order to enroll in 
the Medicare program and obtain Medicare billing privileges. The Form 
CMS-855, which can be submitted via paper or electronically through the 
internet-based Provider Enrollment, Chain, and Ownership System (PECOS) 
process, captures information about the provider or supplier that is 
needed for CMS or its contractors to determine whether the provider or 
supplier meets all Medicare requirements. The enrollment process helps 
ensure that unqualified and potentially fraudulent individuals and 
entities do not bill Medicare and that the Medicare Trust Funds and 
Medicare beneficiaries are accordingly protected. Data collected during 
the enrollment process include but are not limited to--(1) general 
identifying information (for example, legal business name, tax 
identification number); (2) licensure data; (3) practice locations; and 
(4) information regarding the provider's or supplier's owning and 
managing individuals and organizations. The application is used for a 
variety of provider enrollment transactions, including the following:
     Initial enrollment--The provider or supplier is--(1) 
enrolling in Medicare for the first time; (2) enrolling in another 
Medicare contractor's jurisdiction; or (3) seeking to enroll in 
Medicare after having previously been enrolled.
     Change of ownership--The provider or supplier is reporting 
a change in its ownership.
     Revalidation--The provider or supplier is revalidating its 
Medicare enrollment information in accordance with Sec.  424.515.
     Reactivation--The provider or supplier is seeking to 
reactivate its Medicare billing privileges after it was deactivated in 
accordance with Sec.  424.540.
     Change of information--The provider or supplier is 
reporting a change in its existing enrollment information in accordance 
with Sec.  424.516.
    Besides the aforementioned 2006 and 2011 final rules, we have made 
several other regulatory changes to 42 CFR part 424, subpart P, to 
address various payment safeguard issues that have arisen.

D. Background on Disclosure of Affiliations for Medicare, Medicaid, and 
CHIP (Section 1866(j)(5) of the Act)

    As previously mentioned, providers and suppliers must complete and 
submit (via paper or through internet-based PECOS) a Form CMS-855 
application to their Medicare contractor in order to enroll or 
revalidate their enrollment in the Medicare program. The Form CMS-855 
requires the provider or supplier to disclose certain information, such 
as general identifying data (for example, legal business name), the 
provider's or supplier's practice locations, and the provider's or 
supplier's owning and managing employees and organizations.

[[Page 47797]]

    In operating Medicaid and CHIP, states may have somewhat different 
enrollment processes, although all states must comply with the federal 
requirements in 42 CFR part 455, subparts B and E, as well as the 
``free choice of provider'' requirement in Sec.  431.51. Under 42 CFR 
part 455, subpart B, providers and disclosing entities must furnish 
disclosures regarding ownership and control of the provider or 
disclosing entity, certain business transactions, and criminal 
convictions related to federal health care programs.
    Section 1866(j)(5) of the Act, added by section 6401(a)(3) of the 
Affordable Care Act, states that a provider or supplier that submits an 
enrollment application or a revalidation application for Medicare, 
Medicaid, or CHIP shall disclose (in a form and manner and at such time 
as determined by the Secretary) any current or previous affiliation 
(directly or indirectly) with a provider or supplier that has 
uncollected debt; has been or is subject to a payment suspension under 
a federal health care program (as defined in section 1128B(f) of the 
Act); has been excluded from participation from Medicare, Medicaid, or 
CHIP; or has had its billing privileges denied or revoked. Under 
section 1866(j)(5)(B) of the Act, the Secretary may deny the 
application if the Secretary determines that the affiliation poses an 
undue risk of fraud, waste, or abuse.
    Pursuant to section 1902(kk)(3) to the Act, states must require 
providers and suppliers to comply with the same disclosure requirements 
established by the Secretary under section 1866(j)(5) of the Act. 
Further, pursuant to section 2107(e)(1) of the Act, the requirements of 
section 1902(kk) of the Act, including the disclosure requirements, are 
applicable to CHIP.

II. Provisions of the Proposed Regulations and Analysis of and 
Responses to Public Comments

    We received 87 timely pieces of correspondence in response to the 
March 1, 2016 proposed rule. A summary of the major issues raised and 
our responses thereto follow.

A. Disclosure of Affiliations

    We proposed in the March 1, 2016 proposed rule to implement section 
1866(j)(5) of the Act. We explained that, consistent with this 
statutory provision, the implementation of these disclosure provisions 
would help combat fraud, waste, and abuse by enabling CMS and the 
states to: (1) Better track current and past relationships between and 
among different providers and suppliers; and (2) identify and take 
action on affiliations among providers and suppliers that pose an undue 
risk to Medicare, Medicaid, and CHIP.
    In November 2008, the OIG of the Department of Health and Human 
Services issued an Early Alert Memorandum titled ``Payments to Medicare 
Suppliers and Home Health Agencies Associated with `Currently Not 
Collectible' Overpayments'' (OEI-06-07-00080). The memorandum stated 
that anecdotal information from OIG investigators and Assistant United 
States Attorneys indicated that suppliers of durable medical equipment, 
prosthetics, orthotics, and supplies (DMEPOS) with outstanding Medicare 
debts may inappropriately receive Medicare payments by, among other 
means, operating businesses that are publicly fronted by business 
associates, family members, or other individuals posing as owners. In 
its study, the OIG selected a random sample of 10 DMEPOS suppliers in 
Texas that each had Medicare debt of at least $50,000 deemed currently 
not collectible (CNC) by CMS during 2005 and 2006. The OIG found that 6 
of the 10 reviewed DMEPOS suppliers were associated with 15 other 
DMEPOS suppliers or home health agencies (HHAs) that received Medicare 
payments totaling $58 million during 2002 through 2007. Most associated 
DMEPOS suppliers had lost their billing privileges by January 2005 and 
had accumulated a total of $6.2 million of their own CNC debt to 
Medicare. The OIG also found that most of the reviewed DMEPOS suppliers 
were connected to other DMEPOS suppliers and HHAs through shared owners 
or managers.
    On March 2, 2011, the OIG testified before the Congress that fraud 
schemes in South Florida often rely on the use of networks of 
affiliations among fraudulent owners.\3\ In those schemes, Medicare 
providers and suppliers disguise their true ownership by the use of 
nominee owners to bill Medicare fraudulently on a temporary basis so as 
to evade detection. Providers and suppliers will--(1) hide their true 
ownership through the use of nominee owners; (2) bill the Medicare 
program for millions of dollars; and (3) close down, take over another 
company, and then repeat the process in another location. In addition 
to this information from the OIG, our own experience has shown that 
networks of individuals and entities can be behind widespread fraud 
schemes; in some instances, shared owners were behind multiple 
providers and suppliers engaging in improper billings.
---------------------------------------------------------------------------

    \3\ https://oig.hhs.gov/testimony/docs/2011/perez_testimony_03022011.pdf.
---------------------------------------------------------------------------

    We have long shared these and other concerns the OIG has expressed 
regarding individuals and entities that enroll in Medicare (or own or 
operate Medicare providers or suppliers), accumulate large debts or 
otherwise engage in inappropriate activities, and depart the Medicare 
program voluntarily or involuntarily, yet continue their behavior by--
(1) reentering the program in some capacity (for instance, as an 
owner); and/or (2) shifting their activities to another enrolled 
Medicare provider or supplier with which they are affiliated. To 
illustrate, a provider or supplier may engage in inappropriate billing, 
exit Medicare prior to detection, and then change its name or business 
identity in order to reenroll in Medicare under this new identity. 
Another example involves an entity that owns or manages several 
Medicare providers and suppliers. One of the providers or suppliers may 
be involved in abusive behavior with the approval or at the instigation 
of that owner or managing entity. In this example, if the abusive 
provider's enrollment is revoked, the owning/managing entity shifts its 
behavior to another of its enrolled entities.
    In such situations, and absent the owning or managing individual's 
or organization's (1) felony conviction, (2) exclusion from Medicare by 
the OIG, or (3) debarment from participating in any federal procurement 
or non-procurement program, CMS does not currently have a regulatory 
basis to prevent such individuals or entities from continuing their 
activities through other enrolled or newly enrolling providers and 
suppliers. Put another way, providers and suppliers currently can be 
denied, revoked, or terminated from participating in Medicare, 
Medicaid, or CHIP; but absent a felony conviction, exclusion, or 
debarment, their owners and managers can often remain as direct or 
indirect participants in these programs. Consider this example: 
Individual X owns 100 percent of three enrolled DMEPOS suppliers, each 
of which has submitted a revalidation application to Medicare. 
Individual X completes each application. He submits false information 
on one application in order to retain that supplier's existing Medicare 
enrollment but not on the other two applications. CMS revokes the first 
DMEPOS supplier's enrollment under Sec.  424.535(a)(4). However, we 
cannot revoke the other two suppliers because false information was not 
submitted on their applications; this means that two Medicare suppliers

[[Page 47798]]

whose owner has furnished false information to Medicare are still 
enrolled in the program.
    CMS must have the capacity to address this and similar situations 
when necessary and appropriate. In many cases, the owners and managers 
of fraudulent entities hide behind the organizational structure itself 
when in fact they are, for purposes of their behavior, one and the 
same. This final rule with comment period will allow CMS to take 
immediate action against such persons and entities to ensure that they 
do not continue to use the provider or supplier organization as a 
shield for their conduct. This, in turn, will help protect the Medicare 
Trust Funds, the taxpayers, Medicare beneficiaries, and honest and 
legitimate Medicare providers and suppliers. The changes described 
later in this section II serve these goals by implementing section 
1866(j)(5) of the Act.
    We also proposed to apply these changes to Medicaid and CHIP, such 
that states must require providers and suppliers to comply with the 
same disclosure requirements established by the Secretary.
    Many of the comments we received regarding this proposal--(1) 
covered multiple topics (for example, application of the undue risk 
standard and the proposed requirement to report new or changed 
information), and (2) did not indicate whether they applied to Medicare 
alone or to Medicare, Medicaid, and CHIP. Therefore, except as 
otherwise noted, we--(1) have organized the comments and our responses 
thereto within what we believe are the most appropriate sections 
(though there may be occasional overlap between sections); and (2) 
assume that the comments apply to all three federal programs (that is, 
while our responses may refer to the Medicare program, they should be 
presumed to apply equally to the disclosure of affiliation provisions 
in the Medicaid program and CHIP, unless otherwise noted). Comments 
that exclusively applied to Medicaid and CHIP are addressed in our 
discussion of the affiliation disclosure provisions for those programs.
1. Medicare
a. Definition of Affiliation
    We proposed to define ``affiliation'' in Sec.  424.502, for 
purposes of applying the affiliation disclosure provisions in Sec.  
424.519, as meaning any of the following:
     A 5 percent or greater direct or indirect ownership 
interest that an individual or entity has in another organization.
     A general or limited partnership interest (regardless of 
the percentage) that an individual or entity has in another 
organization.
     An interest in which an individual or entity exercises 
operational or managerial control over, or directly or indirectly 
conducts, the day-to-day operations of another organization (including, 
for purposes of Sec.  424.519 only, sole proprietorships), either under 
contract or through some other arrangement, regardless of whether or 
not the managing individual or entity is a W-2 employee of the 
organization.
     An interest in which an individual is acting as an officer 
or director of a corporation.
     Any reassignment relationship under Sec.  424.80.
    The first four types of interests (5 percent or greater ownership, 
partnership interests, managing control, and corporate officer and 
director interests) are consistent with the definitions of--(1) 
``owner'' and ``managing employee'' in Sec.  424.502; and (2) 
``ownership or control interest'' in section 1124(a)(3) of the Act. We 
also note that consistent with sections 1124 and 1124A of the Act, 
entities and individuals that have one or more of these four interests 
in an enrolling or enrolled Medicare provider or supplier must be 
reported on the provider's or supplier's Form CMS-855 enrollment 
application. Likewise, reassignment relationships must be reported to 
Medicare via the Form CMS-855R (OMB Control No. 0938-1179); this form 
facilitates the reassignment of benefits from a physician or non-
physician practitioner to another Medicare provider or supplier. To 
make certain that there is uniformity with these other reporting 
requirements and that we are aware of prior and current relationships 
that could present risks of fraud, waste, or abuse, we proposed that 
the ``affiliation'' definition should include these five interests.
    We explained in the proposed rule our belief that there is a 
sufficiently close relationship between a reassignor (the physician or 
non-physician practitioner) and a reassignee (the other provider or 
supplier) to warrant including reassignments within the definition of 
``affiliation.'' Indeed, a W-2 employee or independent contractor may 
have a closer day-to-day relationship with the entity or person he or 
she works for and reassigns benefits to than, for instance, an indirect 
owner has with an entity in which he or she has a 5 percent ownership 
interest. We requested comment on the regularity of close reassignor 
and reassignee relationships and whether inclusion of these 
relationships is likely to lead to additional information that may 
prevent fraud, waste, and abuse. We also solicited comment on whether 
the types of disclosable affiliations should include additional 
ownership or managerial interests or other relationships.
    We received the following comments regarding our proposed 
definition of ``affiliation'':
    Comment: A commenter questioned whether a physician director and a 
director of nursing must be reported as managing parties on the Form 
CMS-855A as part of the existing provider enrollment process and the 
proposed disclosure requirement. The commenter, as well as other 
commenters, also questioned whether the following parties and interests 
fall within the definition of ``affiliation'': (1) Members of the board 
of trustees of a tax-exempt entity; (2) billing agencies and/or 
collection agencies; and (3) 5 percent or greater mortgage or security 
interests. Another commenter questioned whether general and limited 
partnerships include both direct and indirect interests for purposes of 
the definition of ``affiliation.''
    Response: As previously noted, our definition of ``affiliation'' 
incorporates concepts of ownership and managerial control from other 
program integrity and provider enrollment provisions. We interpret our 
definition of ``affiliation'' consistent with these other provisions. 
Accordingly, if the physician director or director of nursing in 
question falls within the definition of managing employee under Sec.  
424.502, he or she must be reported as part of the existing enrollment 
process and, if the requirements of Sec.  424.519 are met (for example, 
the individual was previously a managing employee of another provider 
or supplier with a disclosable event), also falls within the purview of 
the latter provision.
    Per CMS Publication 100-08, Program Integrity Manual (PIM), Chapter 
15, members of a board of trustees are considered to be corporate 
directors for purposes of Form CMS-855 reporting. Hence, the definition 
of affiliation in Sec.  424.502 encompasses such relationships.
    Also per Chapter 15 of the PIM, 5 percent or greater mortgage and/
or security interests are considered to be 5 percent or greater 
ownership interests for purposes of the Form CMS-855. They will be 
treated similarly with respect to our disclosure of affiliation 
provisions.

[[Page 47799]]

    Concerning billing agencies and/or collection agencies, we believe 
the commenters were mentioning these parties in the context of 
managerial control over the provider or supplier. If the agency in 
question meets the definition of managing employee as it applies to 
organizations, it will fall within the previously mentioned 
``operational or managerial control'' category of the ``affiliation'' 
definition.
    Indirect partnership interests are not considered partnership 
interests under our definition of affiliation in Sec.  424.502. 
However, the interest could qualify as an indirect ownership interest 
of at least 5 percent.
    Comment: A commenter questioned whether an affiliation exists if a 
board of trustees or other governing body holds a 5 percent or greater 
direct or indirect ownership in another organization, a general or 
limited partnership interest in another organization, or exercises 
operational or managerial control in another organization. The 
commenter also questioned whether officers and directors of tax-exempt 
providers fall within the ``affiliation'' definition if they serve in 
similar capacities on other governing bodies or hold ownership 
interests or provide operational or managerial control in other 
organizations (tax-exempt or otherwise). The commenter cited the 
example of a local hospital administrator who serves as treasurer and 
member of the board of trustees of a local HHA; the commenter asked 
whether this individual's association with the hospital would be deemed 
an affiliation.
    Response: Non-profit entities and officials thereof fall within the 
purview of the affiliation definition to the same extent as for-profit 
organizations and their officials; thus, for example, officers and 
directors of non-profit corporations come within the definition of 
affiliation, as do--(1) ownership, partnership, and managerial 
interests in non-profit entities; and (2) reassignment relationships 
with non-profit organizations.
    Comment: A commenter stated that CMS should not consider an 
affiliation with a public company that owns 5 percent or more of an 
enrolling or reenrolling company to pose an ``undue risk'' to Medicare, 
Medicaid, or CHIP. Such companies, the commenter stated, are subject to 
adequate oversight of investors, the Securities and Exchange 
Commission, and the public, and the risks presented by a public company 
that owns a portion of another public company would be extremely 
limited.
    Response: We do not believe that public companies should be 
automatically excluded from the purview of Sec.  424.519, nor can we 
conclude that any affiliation with a public company with a disclosable 
event will never pose an undue risk. All factual scenarios are 
different, and we must retain the flexibility to address them on their 
own merits.
    Comment: A commenter stated CMS should only require disclosure of 
affiliated managing individuals who are responsible in some way for 
actions relating to Medicare, Medicaid, or CHIP payment. Citing the 
example of laboratories, the commenter stated that managing individuals 
often have no responsibilities concerning payments for services. 
Rather, a managing employee who conducts the ``day to day operations'' 
of a laboratory facility often is in charge of maintaining the 
licensure of a laboratory facility, ensuring that the facility follows 
industry standards, evaluating information associated with laboratory 
procedures performed onsite, and overseeing the scientific integrity of 
the processes and protocols followed at the site. The commenter noted 
that laboratories necessarily are vigilant about the credentials and 
actions of those who are in charge of laboratory sites, for any hint of 
impropriety may put the site's entire operations at risk.
    Response: We respectfully disagree with the commenter. We note that 
the statutory definition of managing employee in section 1126(b) of the 
Act, upon which the definition of managing employee in Sec.  424.502 
and the reference to managing parties in the definition of affiliation 
are based, includes all persons who directly or indirectly conduct the 
provider's day-to-day operations. It is not limited to parties involved 
in actions related to the payment of services. In other words, the test 
is the broader direct or indirect conduct of operations, not merely a 
relationship to the payment of services. Thus we believe that the 
inclusion within the definition of affiliation and the scope of Sec.  
424.519 of--(1) managerial interests for purposes of enrollment and (2) 
affiliations involving managing parties with disclosable events, should 
not be based strictly on the party's involvement with payment-related 
actions.
    Comment: Several commenters stated that the minimum 5 percent 
ownership stake referenced in the ``affiliation'' definition should be 
higher. They generally stated that a party with a low ownership 
interest is unlikely to be involved in the day-to-day operations of the 
practice. Raising the required percentage of ownership, the commenters 
believed, would not only better safeguard the Medicare program but also 
substantially lower the regulatory burden on honest providers; with a 
higher required percentage, CMS could better identify affiliates that 
actually pose a danger to the Medicare program without being bogged 
down with information from providers and suppliers on harmless 
affiliations. They also cited the likely burden of tracking all 5 
percent or greater ownership interests. Several commenters suggested a 
25-percent threshold, while others suggested a 50-percent threshold or 
a majority interest.
    Response: The affiliation definition's 5 percent threshold is 
consistent with our existing enrollment reporting requirements and with 
sections 1124 and 1124A of the Act, both of which reference a 5 percent 
standard. Further, it is conceivable that parties with a minority 
ownership interest as low as 5 percent could be involved in 
questionable activities, hence jeopardizing the integrity of the 
Medicare program. The fact that they may not actively control the 
provider's or supplier's daily operations should not exclude such 
parties and affiliations from scrutiny. We recognize, however, that 
certain levels of ownership interests may pose different risks than 
others and, as we proposed, will consider the degree and extent of the 
affiliation in determining whether an undue risk of fraud, waste, and 
abuse exists.
    Comment: Several commenters stated that CMS should not 
automatically consider a general or limited partnership interest that 
an individual or entity has in another organization to be an 
affiliation. The commenters generally stated that a limited or general 
partner with only a minority interest is unlikely to influence the 
operations of the entity and, as such, likely would not pose a risk to 
the Medicare program. A commenter stated that CMS should consider the 
percentage of a party's general or limited partnership in determining 
whether the party is an affiliate; another commenter suggested a 25-
percent threshold.
    Response: Similar to our earlier statements regarding the 5 percent 
ownership threshold, we believe that parties with even small 
partnership interests can, depending on the scope and type of behavior 
involved, threaten the integrity of the Medicare program. However, we 
will consider the extent of the affiliation in determining whether an 
undue risk exists.
    Comment: A commenter recommended that CMS add a ``catch-all'' 
provision to the affiliation definition stating that the provider or 
supplier report any affiliation (regardless of ownership or operational

[[Page 47800]]

interest) where the affiliate has, for instance, uncollected Medicare 
debt, past exclusions or civil penalties. As examples, the commenter 
suggested adding phrases to the definition such as ``association 
with,'' ``connection with/to,'' ``alliance with/to,'' ``alignment 
with,'' ``link with/to,'' ``incorporation into,'' and ``integration 
into.''
    Response: While we appreciate this suggestion, we believe that the 
phrases the commenter proposes describe relationships that may be more 
vague than those contemplated in this final rule with comment period. 
To illustrate, a 5 percent ownership stake is a clear and determinable 
interest, whereas an ``association'' or ``alignment'' can be 
susceptible to a variety of interpretations. Therefore, we prefer to 
include within our definition of ``affiliation'' only those interests 
that are quantifiable (for example, limited partnership interests) or 
have been used in the provider enrollment context for many years (for 
example, managing employee) and with which the provider community is 
familiar. Moreover, we believe that the commenter's suggested 
relationships may be more distant and loose than those which we 
proposed and which, we believe, the statute contemplates; a 50 percent 
ownership interest, for instance, likely reflects a closer, clearer 
relationship than a mere ``association'' or ``connection.''
    Comment: Many commenters opposed the inclusion of reassignments 
within the definition of ``affiliation.'' Overall, they contended 
that--(1) reassignment relationships do not raise the same risks of 
fraud, waste, and abuse as other affiliations referenced in the 
definition; and (2) for large provider organizations and health 
systems, the burden of having to constantly track and disclose all of 
its reassignment relationships would be enormous. Several commenters 
added that the practitioner typically has no ownership or managerial 
interest in the reassignee and no direct or indirect influence over the 
reassignee's decision-making; the mere fact of a reassignment 
relationship without more, one of the commenters stated, does not 
result in the close relationship that CMS assumes.
    Response: We continue to believe there is a sufficiently close 
relationship between a reassignor (the physician or non-physician 
practitioner) and reassignee (the provider or supplier) to warrant 
including reassignments within the definition of ``affiliation.'' 
Again, a W-2 employee or independent contractor may have a closer day-
to-day relationship with the entity or person he or she works for and 
reassigns benefits to than, for instance, an indirect owner has with an 
entity in which he or she has a 5 percent ownership interest. We are 
therefore retaining reassignments within the definition of 
``affiliation.'' Nonetheless, we recognize the potentially sizable 
burden on physician and practitioner organizations (and especially 
hospitals and large health plans) in researching, tracking and, if 
applicable, submitting disclosable affiliation data involving the 
individuals who reassign their benefits to them. In sections II.A.1.b. 
and II.A.1.e. of this final rule with comment period, we discuss means 
we are adopting to limit the burden on providers and suppliers.
    Comment: A commenter stated that since both parties (the reassignor 
and reassignee) are already jointly responsible for claims and 
associated overpayment risk within their reassignment relationship, it 
is unnecessary to go further and define a reassignment relationship as 
an ``affiliation.'' Another commenter stated that because reassignors 
and reassignees must be enrolled in Medicare to facilitate a 
reassignment relationship, these parties have already (1) been properly 
vetted by Medicare and (2) submitted the data we referenced under our 
proposal. Several other commenters stated that including reassignments 
within the affiliation definition exceeds what the Congress intended 
and authorized.
    Response: With respect to the first commenter, the closeness of the 
relationship that the commenter implies is precisely why we believe it 
is appropriate to include reassignments within the definition of 
``affiliation.''
    We respectfully disagree with the second and third comments. While 
the individual Form CMS-855 applications for enrollment for the 
reassignor and reasignee are screened, there currently is no review of 
whether the relationship between these two parties presents an undue 
risk to the Medicare program, which is the precise issue that section 
1866(j)(5) seeks to address. In addition, we note that section 
1866(j)(5) does not define the term ``affiliation,'' and thus the scope 
of that term must be defined via regulation. We also have general 
rulemaking authority under sections 1102 and 1871 of the Act to include 
reassignments within the definition of ``affiliation.''
    Comment: In response to our request for comments on the subject, a 
commenter stated that no additional ownership or managerial interests 
or other relationships (beyond those in the proposed definition of 
``affiliation'') should be disclosed, in part because providers and 
suppliers currently provide a significant amount of information.
    Response: We agree that no additional interests or relationships 
should be included within the definition of affiliation.
    Comment: Several commenters urged CMS to remove indirect ownership 
interests from the definition of affiliation. They generally contended 
that--(1) it would be very difficult to obtain, track, and maintain 
this information, especially for providers and suppliers with complex 
ownership structures (such as chain organizations) involving many 
affiliates; (2) many indirect owners have very little involvement in or 
influence over the day-to-day operations of the provider or supplier; 
and (3) some providers and suppliers have up to five levels of indirect 
ownership. One commenter noted that an applicant would not only have to 
report its own indirect owners, but also identify all affiliation 
relationships held by the applicant's indirect owners. The applicant 
would then be required to determine whether any such affiliation is 
with a provider or supplier that has had a disclosable event. All of 
these steps, this commenter concluded, would be very burdensome for 
providers and suppliers.
    Response: We disagree that indirect ownership interests should be 
excluded. It should not be assumed that indirect owners never exercise 
certain degrees of control over providers; in fact, a provider's direct 
owner may be a mere holding company with the indirect owner actually 
operating the provider. Given the vast variety of ownership 
arrangements among provider and supplier organizations, we must retain 
our flexibility to address particular situations. We further note that 
section 1866(j)(5) of the Act refers to any current or previous 
affiliation (directly or indirectly). We will consider the degree and 
extent of the indirect owner's affiliation in determining whether an 
undue risk exists.
    Comment: A commenter stated that CMS should remove officers, 
directors, and managing employees from the definition of affiliation, 
citing the reporting burden.
    Response: We respectfully disagree that these parties should be 
removed from the definition of affiliation, given their typical level 
of control over the provider's or supplier's operations. Yet we 
recognize that certain officials may have greater influence over said 
operations than others, and we will consider the degree and extent of 
the affiliation in our determination of whether an undue risk exists. 
Also, and as previously stated, we discuss in

[[Page 47801]]

sections II.A.1.b. and II.A.1.e. of this final rule with comment period 
means by which we are limiting the burden on providers and suppliers.
    Comment: Several commenters requested that the final rule provide 
clearer directions and guidance on reporting affiliations and 
histories. Some commenters stated that the definition of affiliation is 
confusing and impractical.
    Response: Although we believe that the definition of affiliation is 
clear on its face, we may issue subregulatory guidance on this topic as 
necessary.
    Comment: A commenter stated that the disclosure of ``passive'' 
investors (that is, non-health care investors such as large mutual or 
pension funds) could prove extremely difficult. These entities would 
need to--(1) identify for the provider or supplier all current and 
previous indirect ownership interests they have had in other health 
care providers and suppliers; and (2) further ascertain whether any of 
these affiliated providers and suppliers has or has had a disclosable 
event. Passive investors, the commenter stated, may not know of those 
providers and suppliers in which they have had an indirect ownership 
interest, nor have any mechanism to determine whether they have or have 
had any disclosable events.
    Response: Under sections 1124 and 1124A of the Act, all parties 
with at least a 5 percent direct or indirect ownership must be 
disclosed as part of the enrollment process. These statutory provisions 
do not exempt ``passive'' investors, and we do not believe such parties 
should be exempt from the definition of affiliation or the purview of 
Sec.  424.519. We again recognize, though, that it may prove difficult 
at times to obtain affiliation data related to such parties, which is 
why we proposed a knew or should reasonably have known standard for 
disclosure. We discuss this standard in more detail in section 
II.A.1.c. of this final rule with comment period.
    Comment: A commenter stated that if the final rule includes 
indirect ownership interests within the affiliation definition, CMS 
should impose practical limitations or cut-offs at which such interests 
are excluded from the definition. Suggestions included exempting--(1) 
parties that have an ownership interest in another provider or supplier 
through a publicly-traded company, mutual fund, or other large 
investment vehicle; and (2) indirect ownership interests under 50 
percent.
    Response: We respectfully disagree. As previously indicated, there 
could be situations where an indirect owner, even one with less than a 
50 percent interest, exercises some influence over the provider. We 
also reiterate that neither sections 1124 and 1124A of the Act, nor the 
current definition of owner in Sec.  424.502, exclude public companies 
or investment interests from the purview of those provisions.
    Comment: A commenter stated that CMS should define affiliation by 
those interests reported on all of the Form CMS-855 applications, 
rather than those reported on only some of the forms; otherwise, the 
commenter stated, CMS will be demanding that physicians disclose far 
more information than is currently required.
    Response: Section 1866(j)(5) of the Act addresses a provider's or 
supplier's relationships with other parties; the focus, in other words, 
is on affiliations rather than on identifying data that is specific to 
the enrolling provider or supplier. Thus, physicians may be required 
under Sec.  424.519 to furnish more data than they currently do.
    Comment: A commenter stated that including 5 percent or greater 
direct or indirect ownership interests within the affiliation 
definition is problematic because the reporting burden associated 
therewith would--(1) discourage joint ventures and provider 
collaborations, which are necessary for the success of payment reform 
and alternate payment models; and (2) place chain organizations at a 
disadvantage.
    Response: We respectfully disagree. Five percent or greater direct 
and indirect ownership interests, including those involving chain 
organizations, are currently disclosed as part of the regular provider 
enrollment process. However, we are unaware of any discouragement of 
joint ventures or provider collaborations or a disproportionately 
negative impact on chain organizations stemming therefrom.
    Comment: A commenter stated that the Form CMS-855A requires 
disclosure of limited partnership interests that are at least 10 
percent. The commenter questioned whether the Form CMS-855A and other 
enrollment applications will be modified to incorporate the disclosure 
of all limited partnership interests.
    Response: We appreciate this comment and will consider whether the 
referenced change to the scope of reportable limited partnership 
interests on the Form CMS-855A is warranted.
    Comment: A commenter stated that CMS should exclude from the 
definition of affiliation--(1) disclosed officers', directors', or 
managing employees' indirect operational or managerial control 
interests in other providers; and (2) officer, director, or operational 
or managing control positions of another provider's indirect owners and 
parent companies. The commenter stated that these are not individuals 
who fit within the current definition of a control interest in a 
provider or supplier; thus they are not individuals (absent some 
additional relationship with the provider or supplier) currently 
identified on the Form CMS-855 applications. The commenter added that 
these individuals generally are not involved in the day-to-day 
operations of the provider or suppliers, and that reporting them would 
be unduly burdensome and unlikely to result in a finding of undue risk.
    Response: For reasons previously discussed, we are retaining 
managing employees, corporate officers, corporate directors, and 5 
percent or greater indirect owners within the definition of 
affiliation. We note again that all of a provider's or supplier's 
managing employees, corporate officers and directors, and 5 percent or 
greater indirect owners currently must be disclosed as part of the Form 
CMS-855 provider enrollment process.
    Comment: Several commenters stated that only direct owners, 
managing employees, and managing organizations (which the commenters 
described as ``close affiliates'') should be included within the 
affiliation definition. Distant affiliates (described by a commenter as 
affiliates of close affiliations or affiliates that are not close 
affiliates) should not be included, with one commenter stating that CMS 
could review PECOS to ascertain distant affiliations. A commenter 
stated that CMS should limit disclosure of prior affiliations to close 
affiliates for which CMS can show it does not have available 
information. Another commenter suggested that CMS bifurcate the 
disclosure of affiliations into two parts--(1) affiliations reportable 
by providers directly (``reportable affiliations''); and (2) other 
affiliations on which CMS may rely in making a determination of undue 
risk, provided that CMS takes materiality into account. The commenter 
believed this would achieve an appropriate balance between the dual 
needs to reduce the burden on providers and suppliers and to ensure 
that CMS can take action to protect program integrity.
    Response: We appreciate these comments but do not believe that 
affiliation disclosures should be bifurcated or restricted as 
suggested. While we acknowledge that some affiliations may pose greater 
risks than others (and some may pose little, if any, risk), it is 
possible that even certain ``distant'' affiliations could, depending on 
the particular facts of the case,

[[Page 47802]]

threaten the integrity of Medicare, Medicaid, or CHIP. We consequently 
must retain the discretion to review each case on its own merits by 
carefully considering the factors outlined in Sec.  424.519(f), which 
are discussed elsewhere in this final rule with comment period.
    Comment: A commenter stated that suppliers should only have to 
disclose past affiliations for persons identified as 5 percent or 
greater owners on the Form CMS-855.
    Response: We respectfully disagree. Parties such as managing 
employees and general partners can often have as much, if not more, 
influence over the daily operations of a provider or supplier than an 
owner. As such, we do not believe they should be excluded from the 
definition of affiliation.
    After consideration of the comments received, we are finalizing our 
definition of affiliation as proposed.
b. Disclosable Events (Sec.  424.519)
    In new Sec.  424.519, we proposed in paragraph (b) that a provider 
or supplier that is submitting an initial or revalidating Form CMS-855 
application must disclose whether it or any of its owning or managing 
employees or organizations (consistent with the terms ``owner'' and 
``managing employee'' as defined in Sec.  424.502) has or, within the 
previous 5 years, has had an affiliation with a currently or formerly 
enrolled Medicare, Medicaid, or CHIP provider or supplier that--
     Currently has an uncollected debt to Medicare, Medicaid, 
or CHIP, regardless of--(1) the amount of the debt; (2) whether the 
debt is currently being repaid (for example, as part of a repayment 
plan); or (3) whether the debt is currently being appealed. For 
purposes of Sec.  424.519 only, and as stated in proposed Sec.  
424.519(a), we proposed that the term ``uncollected debt'' only applies 
to--
    ++ Medicare, Medicaid, or CHIP overpayments for which CMS or the 
state has sent notice of the debt to the affiliated provider or 
supplier;
    ++ Civil money penalties (CMP) (as defined in Sec.  424.57(a)); and
    ++ Assessments (as defined in Sec.  424.57(a)).
     Has been or is subject to a payment suspension under a 
federal health care program (as that term is defined in section 
1128B(f) of the Act), regardless of when the payment suspension 
occurred or was imposed;
     Has been or is excluded by the OIG from participation in 
Medicare, Medicaid, or CHIP, regardless of whether the exclusion is 
currently being appealed or when the exclusion occurred or was imposed 
(we note that although section 1866(j)(5) of the Act uses the phrase 
``has been excluded,'' we proposed to clarify that a current exclusion 
is also a disclosable event); or
     Has had its Medicare, Medicaid, or CHIP enrollment denied, 
revoked or terminated, regardless of--(1) the reason for the denial, 
revocation, or termination; (2) whether the denial, revocation, or 
termination is currently being appealed; or (3) when the denial, 
revocation, or termination occurred or was imposed. For purposes of 
Sec.  424.519 only, and as stated in proposed paragraph (a), we 
proposed that the terms revoked, revocation, terminated, and 
termination would include situations where the affiliated provider or 
supplier voluntarily terminated its Medicare, Medicaid, or CHIP 
enrollment to avoid a potential revocation or termination.
    We stated in the proposed rule that the affiliated provider or 
supplier need not have been enrolled in Medicare, Medicaid, or CHIP 
when the disclosing party had its relationship with the affiliated 
provider or supplier. We cited the following illustration. Assume 
Provider A sold its 30 percent interest in an affiliated provider in 
January 2016. In March 2016, the affiliated provider enrolled in 
Medicare yet had its enrollment revoked in September 2016. In April 
2017, Provider A applied for Medicare enrollment. If we limited the 
reporting of affiliations to periods when the affiliated provider was 
enrolled in Medicare, Medicaid, or CHIP, Provider A would not have to 
report--and we would perhaps not learn of--its relationship with a 
provider that was revoked only 8 months after the affiliation ended. We 
concluded in the proposed rule that such information would be valuable 
in helping us determine whether the affiliation poses an undue risk of 
fraud, waste, or abuse.
    We also proposed that the disclosable event could have occurred or 
been imposed either before the affiliation began or after it ended. We 
stated that if disclosure of an affiliation were restricted to the time 
period of the disclosing party's relationship with the affiliated 
provider, we might remain unaware of situations where, for instance--
(1) a disclosing party sells its majority interest in an affiliated 
provider or supplier that is terminated from Medicaid 2 months after 
the sale; and (2) a 40 percent owner of a Medicare-enrolled affiliated 
provider engages in questionable billing practices, sells its share, 
and seeks to separately enroll in Medicare, shortly after which the 
affiliated provider is notified that it has a large Medicare debt that 
must be repaid. We expressed particular concern about the latter 
scenario; as previously mentioned, we have seen instances where 
providers and suppliers with significant overpayments close down their 
businesses and attempt to enroll under other business identities.
    Additionally, we proposed that the actions identified in Sec.  
424.519(b) applied regardless of whether an appeal is pending. We 
wanted to avoid situations where an initially enrolling provider or 
supplier would not have to disclose, for example, an affiliated 
provider that was revoked from Medicare 6 months ago (based on a felony 
conviction) because the revocation is under appeal; without this 
information, the provider or supplier in question might become enrolled 
in Medicare without CMS knowing of its relationship with a recently 
convicted affiliated provider or supplier. Conversely, we proposed that 
actions that have been overturned on appeal or otherwise reversed would 
not need to be reported.
    We further proposed a look-back period of 5 years for previous 
affiliations. A sufficient look-back period was deemed necessary 
because a past affiliation could be an indicator of a disclosing 
party's future behavior. The look-back period would be the 5-year 
timeframe prior to the date on which the disclosing provider or 
supplier submits its Form CMS-855; thus at least part of the 
affiliation must have occurred within the 5-year period preceding the 
date on which the application is submitted. However, we did not propose 
to limit the look-back period for disclosable events (other than 
uncollected debts), meaning that said event could have occurred any 
time in the past to be subject to disclosure.
    We proposed, too, that if the affiliated provider or supplier had 
its Medicare, Medicaid, or CHIP enrollment denied, revoked, or 
terminated, this must be reported regardless of the reason for the 
denial, revocation, or termination. Since all denial, revocation, and 
termination reasons are of concern to us, we did not believe certain 
reasons should be excluded from disclosure. Nevertheless, we solicited 
comment on whether disclosure should be restricted to particular 
denial, revocation, and termination reasons and, if so, what those 
reasons should be.
    We also sought comment on the following issues regarding our 
proposed definition of uncollected debt: (1) Whether there should be a 
threshold for the level of debt that would need to be reported; (2) 
whether a provider or supplier should be exempt from

[[Page 47803]]

reporting an uncollected debt if it is complying with a repayment plan; 
and (3) whether the level of reporting burden on the provider or 
supplier is low enough to merit collection of this information without 
any threshold or exemption.
    We previously mentioned our proposal that the terms revoked, 
revocation, terminated, and termination (for purposes of disclosure 
under Sec.  424.519) would include situations where the affiliated 
provider or supplier voluntarily terminated its Medicare, Medicaid, or 
CHIP enrollment to avoid a potential revocation or termination; this is 
referenced in proposed Sec.  424.519(a). As explained in more detail in 
section II.B.10. of this final rule with comment period, we have seen 
instances where a provider or supplier engages in inappropriate 
behavior, recognizes that its enrollment may soon be revoked, and then 
voluntarily withdraws from Medicare prior to the imposition of a 
revocation so as to avoid the revocation and an associated reenrollment 
bar under Sec.  424.535(c). (See section II.B.4. of this final rule 
with comment period for more information on reenrollment bars.) Since 
the provider or supplier is thus not revoked from Medicare, it could 
immediately reenroll in Medicare without having to wait until the 
reenrollment bar expires. We believed such behavior poses a risk to the 
Medicare program in that the provider or supplier is seeking to avoid 
Medicare rules and, in the process, possibly reenter the Medicare 
program to continue its improper activities. Accordingly, although we 
also address this concern in new Sec.  424.535(j), which is discussed 
in section II.B.10. of this final rule with comment period, we stated 
our view that for purposes of Sec.  424.519, such actions should be 
included within the category of revocations and terminations.
    We further solicited comment on proposed Sec.  424.519(b) regarding 
the following issues--
     Whether 5 years is an appropriate look-back period for 
affiliations;
     Whether exclusions, denials, and revocations that are 
being appealed should be exempt from disclosure.
     Whether there should be a limited look-back period for 
disclosable events and, if so, how long (for example, 15 years, 10 
years, 7 years).
    We note that, pursuant to Sec. Sec.  424.502 and 424.519, an 
affiliation applies to both parties in the affiliation. This means that 
if the definition of affiliation is met with respect to a particular 
relationship, both parties have an affiliation. However, whether the 
affiliation must be disclosed will depend upon whether the requirements 
of Sec.  424.519(b) are met. For example, suppose Enrolling Provider X 
has a 50 percent ownership interest in Enrolled Provider Y, which is 
currently under a Medicare payment suspension. X would have to disclose 
its relationship with Y. Yet Y would not have to disclose the 
affiliation pursuant to Sec.  424.519(b) unless X has a disclosable 
event.
    We received the following comments regarding proposed Sec.  
424.519(a) and (b).
    Comment: Many commenters expressed general concern about the burden 
of researching, tracking, and reporting information under Sec.  
424.519(b). One commenter stated that the rule as a whole (including 
the affiliation provision) should be geared towards non-compliant 
providers and suppliers rather than burdening honest providers and 
suppliers. Another commenter noted that the entire rule (including the 
affiliation provision) would significantly increase regulatory burden 
without efficiently targeting enforcement toward higher-risk enrollees, 
with another commenter stating that the rule should be more focused on 
identifying and weeding out potentially fraudulent parties. Another 
commenter stated that--(1) random, untargeted program integrity 
measures can bring harm to Medicare beneficiaries and all other 
stakeholders, and (2) Medicare providers may be forced to incur 
unnecessary costs to comply with a new rule and respond to a new 
integrity effort when a broad-based action is taken to address the 
abusive, but isolated conduct of a few providers. Another commenter 
stated that CMS should reconsider some of the disclosure, timing, and 
reporting requirements to lessen the administrative burden on providers 
and suppliers.
    Consistent with the suggestion to modify our proposed affiliation 
provision to target providers and suppliers potentially posing a threat 
to the Medicare program instead of burdening all providers and 
suppliers, a commenter noted the previously mentioned February 2, 2011 
final rule with comment period, wherein we established categories of 
risk for provider and supplier types for purposes of enrollment 
screening. These screening requirements were specifically tailored 
based upon the level of risk that the category of provider/supplier 
posed to Medicare, Medicaid, and CHIP. The commenter stated that CMS 
should consider taking a similar approach with the disclosure of 
affiliations requirement. The commenter stated it is unlikely that CMS 
is concerned with the risk of fraud posed by, for example, a hospital 
that previously employed a physician as a managing employee who now 
seeks to work at a new hospital; if the goal is not to target these 
types of scenarios, the commenter added, CMS should consider 
implementing a narrower, more focused approach in the final rule.
    Another commenter noted language in section 1866(j)(5) of the Act 
stating that the provider or supplier shall disclose the information 
referenced in section 1866(j)(5) of the Act in a form and manner and at 
such time as determined by the Secretary. The commenter believed this 
language permits CMS to consider ``alternative approaches.''
    Too, a number of commenters stated that CMS can already access much 
of a provider's or supplier's disclosable affiliation data through 
PECOS; therefore, it is duplicative and unnecessary to burden providers 
and suppliers with obtaining, maintaining, tracking, and submitting 
this information.
    Response: We appreciate these comments and are sympathetic to the 
concerns raised by the commenters regarding the significant burden this 
rule could place on providers and suppliers. In response to these 
concerns, and given the statutory language requiring disclosures to be 
provided in a form and manner and at such time as determined by the 
Secretary, we have decided to adopt a ``phased-in'' approach to 
implementing Sec.  424.519(b), beginning with a more targeted approach 
that will then be expanded following further rulemaking and a 
concomitant assessment of the progress of the phased-in approach. To 
this end, we are revising Sec.  424.519(b) to, for now, require 
disclosure of affiliations only from those providers and suppliers that 
have one or more affiliations, as determined by CMS, that would trigger 
a disclosure in accordance with Sec.  424.519. Such providers and 
suppliers will be required to report their disclosable affiliations 
upon request from CMS, as detailed later in this final rule with 
comment period. This requirement will become effective after CMS has 
revised the Form CMS-855 to accommodate the required disclosures. (For 
purposes of this policy, the term ``Form CMS-855'' includes, and will 
collectively refer to--(1) the applicable Form CMS-855 paper 
applications; and (2) the respective online enrollment applications 
submitted through PECOS. Thus, both the paper and online applications, 
which will be subject to notice-and-comment, will be revised prior to 
the commencement of any affiliation disclosure requests.)

[[Page 47804]]

    In reviewing whether a particular provider or supplier has one or 
more applicable affiliations, CMS will, as applicable, research and 
consider data revealed through such sources as, but not limited to: (1) 
PECOS, which, as explained previously, contains provider enrollment 
information submitted by the provider or supplier (for instance, as 
part of an initial application submission, a change of information 
request, a revalidation application, or a reactivation application); 
and (2) other CMS databases and external, non-CMS databases that could 
indicate behavior (such as improper billing patterns) of concern to us. 
After reviewing all applicable data, CMS will request the disclosure of 
affiliations in accordance with Sec.  424.519 from a provider or 
supplier if the provider or supplier, or any of its owning or managing 
employees or organizations may currently have or, within the previous 5 
years, have had an affiliation with a currently or formerly enrolled 
Medicare, Medicaid, or CHIP provider or supplier that may have one or 
more of the following disclosable events:
    ++ Currently has an uncollected debt to Medicare, Medicaid, or 
CHIP.
    ++ Has been or is subject to a payment suspension under a federal 
health care program;
    ++ Has been or is excluded by the OIG from participation in 
Medicare, Medicaid, or CHIP.
    ++ Has had its Medicare, Medicaid, or CHIP enrollment denied, 
revoked or terminated.
    We believe that these four events are appropriate triggers for the 
requirement to report all affiliations specified in this rule. In 
addition to being consistent with the statutory language regarding the 
types of events to be disclosed, we believe that each of these events 
raises potential program integrity concerns and accordingly provides a 
basis to require the provider or supplier to disclose all applicable 
affiliations.
    For now, providers and suppliers will not be required to disclose 
affiliations under Sec.  424.519 unless CMS, after performing the 
research and analysis described earlier and determining that the 
provider or supplier may have at least one affiliation that includes 
any of the four disclosable events, specifically requests it to do so. 
We believe this will ease the burden on the provider community because 
CMS, rather than the provider or supplier, will be responsible for 
reviewing whether the disclosure requirement applies to the provider or 
supplier. However, should CMS find, that it does apply, the provider or 
supplier in question must then report any and all affiliations that 
come within the scope of Sec.  424.519, not merely the one(s) on which 
CMS made its determination. This could require the provider or supplier 
to conduct research to determine whether additional disclosable 
affiliations exist, which would then need to be reported to CMS.
    We stress that merely because a provider or supplier may have at 
least one affiliation with a disclosable event and must therefore 
report all such affiliations upon a CMS request does not mean that CMS 
has determined that the provider and/or its affiliations pose an undue 
risk of fraud, waste, or abuse as stated in section 1866(j)(5) of the 
Act. The disclosure requirement is entirely separate from any undue 
risk finding. Indeed, CMS must first carefully review and analyze all 
disclosed affiliations before determining whether the undue risk 
standard (described in more detail in section II.A.1.d of this final 
rule with comment period) has been met; CMS will, in every case, act 
with caution and prudence when determining whether an undue risk of 
fraud, waste, or abuse exists.
    To summarize, once CMS updates its Form CMS-855 applications to 
include an affiliation disclosure section, a provider or supplier that 
may have at least one affiliation involving a disclosable event, as 
identified by CMS, will be required to report any and all affiliations 
upon initial enrollment or revalidation, as applicable, when CMS 
specifically requests such information from the particular provider or 
supplier. Submission via revalidation will be done through a provider's 
or supplier's periodic revalidation (every 3 years for DMEPOS suppliers 
per Sec.  424.57(g); every 5 years for all other provider and supplier 
types per Sec.  424.515) or an off-cycle revalidation per Sec.  
424.515(d). We estimate that this will affect only about 2,500 to 4,000 
providers and suppliers per year, although this figure could vary. This 
means that well over 99 percent of prospective and currently enrolled 
providers and suppliers will not be required to research or disclose 
affiliation information in the first several years following the 
effective date of this rule.
    Although we will initially be implementing a more targeted approach 
to the disclosure requirement, we recognize that section 1866(j)(5) of 
the Act requires every provider and supplier (regardless of the 
relative risk they may pose) to disclose affiliations upon initial 
enrollment and revalidation. While section 1866(j)(5) of the Act does 
give the Secretary some discretion in applying this provision in terms 
of form, manner, and timing, it does not permanently exempt any 
provider or supplier from its applicability; for example, section 
1866(j)(5) of the Act does not permit the Secretary to establish an 
exception for physicians or hospitals or other specific provider or 
supplier types. Moreover, even if CMS already has, for instance, 
affiliation data in PECOS regarding a provider that is nearing the end 
of its 5-year revalidation cycle, section 1866(j)(5) of the Act still 
requires disclosure as part of the provider's upcoming revalidation. 
Consequently, CMS must eventually secure affiliation data from all 
initially enrolling and revalidating providers. In light of the very 
large universe of such providers and suppliers, which we project would 
be around 1.7 million, we seek public comment on potential approaches 
for obtaining affiliation information from this group in terms of 
timing, mechanism, and priority. After receiving and reviewing these 
comments, CMS will publish a notice of proposed rulemaking (NPRM) 
outlining the proposed handling of disclosures for these providers and 
suppliers, followed by the issuance of a final rule (hereafter 
occasionally referred to as ``the subsequent final rule'') after 
consideration of the public comments received on the proposed rule.
    The specific issues on which we seek public feedback are as 
follows:
     Whether CMS should adhere to a specific schedule in its 
requests, such as, for example, requesting 20,000 providers and 
suppliers to disclose affiliations in the first 12 months after the 
subsequent final rule's effective date; 30,000 providers and suppliers 
in the second year; 40,000 in the third year; and so forth.
     Whether CMS, beginning in the first year after the 
subsequent final rule's effective date, should stagger its requests 
based on:
    ++ The risk of fraud, waste, or abuse posed by the individual 
provider or supplier in question and how CMS should assess this risk.
    ++ The risk of fraud, waste, or abuse posed by provider and 
supplier type (for example, Provider Type A is considered the highest 
risk provider or supplier type in Medicare and should, therefore, be 
the first provider type to disclose affiliations).
    ++ Whether the provider or supplier is initially enrolling in 
Medicare or is revalidating their enrollment (that is, whether 
initially enrolling providers or, instead, revalidating providers 
should take precedence in CMS' disclosure requests.)
    ++ The size of the provider or supplier and/or likely number of 
affiliations (for instance, larger

[[Page 47805]]

providers with presumably more affiliations should be required to 
disclose affiliations in the initial year following the subsequent 
final rule's effective date; small providers with few affiliations 
should receive disclosure requests only in future years).
    ++ Any combination of the previous criteria.
    ++ Any other consideration (for example, geographic location).
     The total length of time that CMS should take to complete 
its collection of affiliation data from the entire universe of 
providers and suppliers (for example, 2 years; 4 years; 7 years; 10 
years; etc.)
     How and when a provider or supplier should be notified 
that it must or need not disclose affiliation information on its 
initial or revalidation application, such as, for example:
    ++ When a provider or supplier submits an initial enrollment 
application, whether it should--(1) receive prior notice (for instance, 
via the www.cms.gov website) as to whether it must complete the 
disclosure of affiliation section of the Form CMS-855; or (2) only be 
notified after submitting the application and after review by CMS or 
the Medicare contractor.
    ++ Whether the letter that a provider or supplier receives from CMS 
or the Medicare contractor requesting the submission of a revalidation 
application should indicate whether the provider or supplier needs to 
disclose its affiliations.
    Comment: A number of commenters stated that CMS should establish a 
monetary threshold for reporting debts. They generally contended that--
(1) small or nominal amounts of debts would not pose an undue risk to 
Medicare, Medicaid, or CHIP; and (2) obtaining specific data from other 
parties (for example, indirect owners; an outside entity for which one 
of the enrolling provider's board members serves as a managing 
employee) on such small amounts would be an enormous burden. Suggested 
minimum debt amounts included $1,000, $10,000, and $100,000; another 
commenter recommended $50,000 since this is the minimum amount required 
for DMEPOS surety bonds. Another commenter urged CMS to consider 
establishing a de minimis standard based upon a percentage of a 
provider's/supplier's gross billings.
    Response: While we appreciate these comments and carefully 
considered them, we do not believe a monetary threshold should be 
formalized in this rule. Our preferred approach is to consider the 
debt's amount as a factor in determining whether the debt presents an 
undue risk of fraud, waste, or abuse. We recognize that smaller debts 
often will not pose the same degree of risk as larger debts. However, 
there could be isolated cases where a particular debt, though of a de 
minimis amount, presents an undue risk when all of the applicable 
factors are considered. In short, we believe that viewing the debt 
amount as one factor among several, rather than automatically excluding 
all smaller debts from consideration, will give us the necessary 
flexibility to address a variety of factual scenarios.
    Comment: Several commenters stated that debts that are being repaid 
should be exempt from the scope of ``uncollected debt.'' They contended 
that this would reduce the reporting burden on providers and suppliers. 
Moreover, the commenters stated that parties that are repaying their 
debts are proving their good-faith and are very unlikely to pose an 
undue risk of fraud, waste, or abuse.
    Response: We appreciate these comments. For reasons similar to our 
position regarding debt thresholds, however, we decline to exclude 
debts that are being repaid from the scope of this rule. We believe 
that consideration of the debt's repayment status as one of several 
factors in determining whether an undue risk exists is the sounder 
path. This will give us the flexibility to address a variety of factual 
scenarios. To illustrate, suppose Enrolling Medicare Provider X was 
until recently a 60 percent owner of Medicare Provider Y. Y has an 
outstanding Medicare debt of $2.5 million. Even if the debt is being 
repaid, we would have reason to be concerned about the amount of the 
debt, X's recent relationship with Y, and the potential risk posed to 
the Medicare program. We acknowledge that a debt that is being repaid 
might in some cases present less of a risk than one that is not. Yet 
this does not mean that a debt being repaid can never present concerns; 
indeed, other factors may indicate that an undue risk exists. We 
believe, in sum, that excluding all debts that are being repaid from 
disclosure could permit certain providers and suppliers with 
affiliations posing an undue risk to enroll or remain enrolled in 
Medicare. This would be inconsistent with our obligation to protect the 
Medicare program and the Trust Funds.
    Comment: A commenter recommended that CMS broaden the scope of the 
Electronic Submission of Medical Documentation (``edMD'') tool to allow 
Medicare contractors, states, and CHIP programs to transmit 
documentation, notices, and letters to providers and suppliers 
electronically. This would facilitate efficient routing within an 
organization to those responsible for monitoring and acting on debt and 
overpayment notices; it also would allow for electronic receipt 
confirmation. The commenter, as well as several others, urged CMS to 
consider creating a centralized database through which providers and 
suppliers can monitor, identify, and address debt notices that CMS and 
state health care programs have issued; said database should include 
the information required to research and reconcile submitted claims and 
track recoupments and interest.
    Response: We appreciate these comments but believe they are outside 
the scope of this rule.
    Commenter: A number of commenters stated that debts that are being 
appealed should be exempt from the category of ``uncollected debts.'' 
In general, they contended that--(1) the appeals process can often take 
considerable time; (2) many overpayments are overturned on appeal; (3) 
obtaining, maintaining, and tracking information on debts that are 
being appealed would be overly burdensome for providers and suppliers; 
(4) debts that are being appealed (as well as the providers and 
suppliers availing themselves of the appeals process) lack any indicia 
or risk of fraud, waste, or abuse; and (5) the current backlog in the 
appeal process must be factored into consideration regarding the 
reporting of debt. A commenter stated that including debts under appeal 
is administratively burdensome and pressures providers to affirmatively 
pay Zone Program Integrity Contractors (ZPIC) and Additional 
Documentation Request (ADR) amounts, versus allowing the Medicare 
Administrative Contractor (MAC) to recoup the amount.
    Response: We appreciate these comments. As with debts that are 
being repaid, however, we do not believe that debts under appeal should 
be automatically excluded from disclosure. Instead, we believe it is 
more appropriate to consider the appeal status of an affiliated party's 
debt as one of the factors in determining whether the affiliation 
presents an undue risk. In situations where, for instance, an enrolling 
provider or supplier has a close affiliation with another provider that 
has a very large overpayment, we believe that the existence of the 
overpayment, whether or not under appeal, could be an indication of 
risk. Thus, consistent with our obligation to protect the Medicare 
program and the Trust Funds, as well as with our authority under 
section 1866(j)(5) of the Act, we believe we should have the ability to 
determine whether the debt and the associated affiliation pose an

[[Page 47806]]

undue risk regardless of whether the debt is being appealed. If we 
excluded such debts from disclosure, we might be compelled to enroll a 
provider or supplier that was at least indirectly involved in 
accumulating significant debt. In short, we continue to believe that--
(1) we must have the discretion and flexibility to address a wide 
variety of situations; and (2) the exclusion of certain actions, such 
as debts being repaid or under appeal, would hinder us in detecting 
risks to Medicare.
    Additionally, as a point of clarification, ZPICs are no longer 
operational. Uniform Program Integrity Contractors (UPICs) have taken 
over the functions that ZPICs previously performed. Furthermore, while 
on the topic of contractors, we note that affiliation disclosures also 
may support CMS contractor investigative efforts related to discovering 
networks of individuals and entities engaged in fraud, waste, or abuse 
(for example, information regarding new leads, new networks, or more 
extensive networks than previously known), in addition to revealing 
affiliations that pose an undue risk of fraud, waste, or abuse.
    Comment: Several commenters stated that the phrase ``notice of the 
debt to the provider, civil money penalties, or assessments'' should 
not include audit requests or routine denial letters where refunds are 
made through remittance advices or claims corrections and the provider 
has otherwise been in good standing. Another commenter stated that the 
definition of uncollected debt should exclude certain recoveries, such 
as those associated with the Electronic Health Records (EHR) Incentive 
Program and reconciliations from alternative payment models, to prevent 
duplicative penalties for the same instance (which the commenter 
believed would effectively constitute double jeopardy). Another 
commenter stated that hospices routinely receive notices of debt for 
hospice cap overpayments and regular Periodic Interim Payment 
settlements. The commenter questioned whether such notices would 
trigger the disclosure requirement at Sec.  424.519.
    Response: We recognize that there are numerous types of Medicare, 
Medicaid, and CHIP debts. As applied to Sec.  424.519, ``uncollected 
debt'' refers to any debt stemming from a Medicare, Medicaid, or CHIP 
overpayment for which CMS or the state has sent notice of the debt, 
such as a demand letter or other formal request for payment, to the 
affiliated provider or supplier and which has not been fully repaid.
    Comment: A commenter suggested that the language regarding 
overpayments in the definition of uncollected debt be restricted to 
overpayments for which CMS or the state has sent notice of the debt to 
the affiliated provider or supplier and the due date for payment 
thereof has passed, subject to the following exceptions: (1) Debt for 
which the provider or supplier has filed a timely notice of appeal, 
until such time as a court or agency of competent jurisdiction has 
found the debt to be valid and no further appeals are available; or (2) 
debt that is subject to a repayment plan.
    Response: For reasons previously stated, we are not exempting debts 
that are being either repaid or appealed from disclosure.
    Comment: A commenter stated that there is a separate statutory and 
regulatory process in place (with separate requirements, timelines, and 
consequences for any failure to comply) for provider and supplier 
overpayments. The commenter stated that overpayments should be handled 
through this already well-defined and finalized process and not brought 
within the scope of this rule.
    Another commenter stated that all overpayments should be--(1) 
excluded from the definition of uncollected debts; and (2) reviewed 
differently than CMPs and assessments. The commenter contended that the 
term ``overpayment'' in and of itself does not signify fraud or 
intentional harm but rather that payments were made erroneously. The 
commenter cited an example of when the components of a service are 
improperly documented and, as documented, do not justify the code for 
which the program was billed; the commenter stated that this is not 
indicative of intentional fraud. The commenter also stated that it can 
often be some time before overpayments are identified by an 
organization; as such, the overpayment amounts may be substantial, 
seriously affecting an individual's or organization's ability to 
quickly repay the amount, particularly in situations where significant 
interest has accrued. These situations may require negotiations and the 
development of repayment schedules.
    Response: We respectfully disagree with these commenters. Section 
1866(j)(5) of the Act specifically references uncollected debts, and we 
previously mentioned instances where providers and suppliers have 
accumulated large uncollected debts, closed their business, and 
reopened another provider or supplier organization to repeat their 
behavior. Therefore, we believe that including uncollected overpayments 
within Sec.  424.519 is necessary.
    Comment: A commenter stated that CMS should clarify whether its 
intent is only for CMPs and assessments imposed on DMEPOS suppliers to 
be disclosed or those imposed against any type of provider or supplier.
    Response: We appreciate this comment. We will clarify in the final 
regulatory text that the scope of CMPs and assessments applies to all 
provider and supplier types by--(1) deleting the references to the 
definitions of CMPs and assessments in Sec.  424.57(a), which are 
limited to DMEPOS suppliers; and (2) adding language that refers to any 
CMP and assessment imposed under title 42. We note that the latter 
includes, but is not limited to, OIG CMPs under Title XI of the Act 
that are referenced in title 42.
    Comment: Many commenters expressed concern about the burden of 
obtaining, tracking, and maintaining debt information regarding 
affiliates (and the affiliates of the provider's or supplier's 
affiliates). Several contentions were made. First, Medicare contractors 
do not always send debt notices to the correct address, especially when 
the provider's administrative office is different from the provider's 
place of operations. Second, contractors sometimes have different 
procedures for notifying providers and suppliers of debts and for 
collecting such debts; issues presented by the first and second 
scenarios, a commenter stated, are particularly acute with respect to 
Medicaid debts and state Medicaid programs. Third, it would be 
difficult for large providers and suppliers with many locations to 
accumulate the debt information involving all of its sites.
    Response: We appreciate these concerns. In light of our previously 
mentioned revision to Sec.  424.519(b), the overwhelming majority of 
providers and suppliers will not have to report the information to 
which the commenters refer for several years. Also, CMS will closely 
monitor the progress of Sec.  424.519(b)'s implementation; should 
limitations on the reporting of certain types of uncollected debts be 
necessary, CMS may consider additional rulemaking. We further note that 
we understand the concerns about a provider's or supplier's ability to 
obtain debt (and other) data from affiliates. We address this matter 
further in section II.A.1.c. of this final rule with comment period.
    Comment: Several commenters stated that denials, revocations, and 
terminations should be deemed reportable only if they involved 
fraudulent activities (for example, a formal finding of fraud by the 
OIG, the Department of Justice, a Medicare

[[Page 47807]]

contractor, or a court of law) or were imposed on otherwise serious 
grounds. One commenter stated that this is necessary because of the 
possibility of denials and revocations due to mistakes or technical 
misunderstandings. Other commenters stated that this limitation would 
reduce the regulatory burden.
    Another commenter stated that termination reasons should be limited 
to fraudulent or wasteful behavior. The commenter cited the example of 
a provider terminated from Medicaid because he or she did not renew his 
or her Drug Enforcement Administration (DEA) certification in a timely 
manner; the commenter did not believe this behavior should be disclosed 
and scrutinized for possible Medicare termination. Another commenter 
stated that providers and suppliers should not be required to disclose 
denials for what the commenter deemed non-substantive reasons, such as 
minor typographical or similar errors that are not based on an 
assessment that the provider or supplier is ineligible to participate 
in the program. Another commenter requested that CMS distinguish 
between OIG exclusions based on fraud, waste, or abuse, and those based 
on what the commenter described as more innocuous reasons, such as a 
failure to repay student loans; the commenter did not believe the 
latter would affect a provider's or supplier's ability to furnish 
services to patients. An additional commenter stated that CMS should 
differentiate between denials, revocations and terminations that are 
``without fault'' and ``without cause'' and those related to fraud, 
integrity or quality concerns. The commenter appeared to indicate that 
the former should be exempt from disclosure, such as instances where a 
provider's application is denied for failing to respond to a Medicare 
contractor's request for additional information. Yet another commenter 
stated that the reporting of payment suspensions should be limited to 
those imposed based on a determination of a credible allegation of 
fraud.
    Response: We respectfully disagree with these commenters. All 
program denials, revocations, terminations, OIG exclusions, and payment 
suspensions are of concern to us. However, we understand that the facts 
and circumstances behind each action may differ and, consequently, pose 
different risks to Medicare, Medicaid, and CHIP. Rather than explicitly 
exempt certain types of these actions from disclosure, we believe the 
better approach is to carefully consider the factors we proposed in 
Sec.  424.519 in determining whether an undue risk exists. This will 
give us the flexibility needed to address a variety of scenarios.
    Comment: A number of commenters opposed including voluntary 
terminations within the scope of disclosable events. They stated that--
(1) many voluntary terminations are for innocuous reasons and do not 
pose a risk to federal health care programs; and (2) including 
voluntary terminations as a disclosable event is inconsistent with 
congressional intent.
    Response: Although we recognize the commenters' concerns, we 
explained previously our reasons for including voluntary terminations 
within the scope of Sec.  424.519; specifically, there have been 
instances where providers and suppliers have voluntarily terminated 
their enrollment in order to avoid a revocation and subsequent 
reenrollment bar. To allow CMS to determine whether such a scenario 
occurred, we maintain that all voluntary terminations should be 
included within Sec.  424.519, all the while understanding that there 
are voluntary terminations that are for legitimate reasons unrelated to 
a pending revocation and thus pose no risk to Medicare.
    We wish to reiterate that simply because a particular affiliation 
must be disclosed does not automatically mean that it will result in a 
finding that the affiliation poses an undue risk of fraud, waste, or 
abuse. CMS will--(1) review each situation based on the totality of the 
circumstances at hand; and (2) exercise its discretion to deny or 
revoke in a cautious and prudent manner.
    Comment: A commenter stated that section 1866(j)(5) of the Act does 
not require the disclosure of terminations; hence, terminations should 
be excluded as a disclosable event.
    Response: Section 1866(j)(5) of the Act refers to Medicare, 
Medicaid, and CHIP denials and revocations. However, in Medicaid and 
CHIP terminology, providers are terminated, rather than revoked. Our 
reference to terminations in Sec.  424.519 is thus intended to cover 
Medicaid and CHIP program actions.
    Comment: A commenter questioned what is meant by the ``to avoid a 
potential revocation or termination'' standard and how it would be 
applied. The commenter also requested that CMS issue standards for 
distinguishing between affected and non-affected voluntary 
terminations.
    Response: The phrase ``to avoid a potential revocation or 
termination'' means that the provider or supplier voluntarily 
terminated its enrollment to avoid being revoked by Medicare and 
subjected to a reenrollment bar. Regarding the establishment of 
standards as the commenter suggests, we will consider--(1) issuing 
subregulatory guidance concerning the reporting of voluntary 
terminations to assist providers and suppliers; and (2) the surrounding 
facts of the case in determining whether the voluntary termination 
falls within this category.
    Comment: A commenter stated that the late filing of a cost report 
may trigger a payment suspension. The commenter questioned whether such 
a payment suspension would have to be reported at that time. Another 
commenter posed the same question regarding payment suspensions 
stemming from the late submission of a self-determined Medicare cap 
liability based on an inability to secure Provider Statistical and 
Reimbursement report (PS&R) information.
    Response: As we proposed, all payment suspensions under a federal 
health care program, regardless of the specific regulatory basis 
involved, fall within the purview of Sec.  424.519. This will enable us 
to examine the facts behind the payment suspension in determining 
whether an undue risk exists.
    Comment: Several commenters recommended that CMS exempt from 
disclosure all disclosable events that are currently being appealed. 
They generally stated that this--(1) would ease the reporting burden on 
providers and suppliers; (2) eliminate any presumption that the 
disclosable event actually happened; (3) be consistent with due 
process; (4) prevent parties from being permanently harmed if the event 
is later overturned on appeal (for instance, it would not remain in 
CMS' records as a disclosable event); and (5) prevent providers, 
suppliers, CMS, and Medicare contractors from having to expend 
resources on premature reporting and undue risk determinations. Another 
commenter suggested that CMS add a provision to the final rule that 
allows for all appeals to be exhausted before a provider or supplier is 
required to report under Sec.  424.519(b). Another commenter disagreed 
with CMS' stated concern in the proposed rule about the filing of 
frivolous appeals to avoid reporting disclosable events; the commenter 
urged CMS to exclude disclosable events that are being appealed.
    Response: We respectfully decline to exempt denials, revocations, 
terminations, payment suspensions, and exclusions by the OIG that are 
being appealed from the purview of Sec.  424.519. Such actions can 
involve significant transgressions, and we must be able to take prompt 
action to protect the Medicare program and the Trust Funds.

[[Page 47808]]

    Comment: Several commenters stated that CMS should not require a 
provider or supplier to report if an affiliate had its Medicare, 
Medicaid, or CHIP enrollment denied, revoked, or terminated if said 
affiliate was not enrolled in Medicare, Medicaid, or CHIP at the time 
of the affiliation. One commenter stated that providers should only be 
required to disclose affiliations with other providers that were--(1) 
enrolled or attempted to enroll during the period in which the 
affiliation occurred; or (2) enrolled prior to the affiliation period. 
If the affiliate was not enrolled during or prior to the affiliation 
period, this commenter stated, the provider would have no reason to 
believe that it had a disclosable event and would not collect or 
monitor such information.
    Response: We respectfully disagree with these commenters. Improper 
behavior within a health care provider or supplier can occur regardless 
of whether it is enrolled in a federal health care program. In other 
words, the crucial issue with respect to the scenario the commenters 
pose is more the behavior itself than the provider's or supplier's 
enrollment status. We thus believe that disclosable events should be 
reported even if the provider or supplier in question was not enrolled 
at the time of the affiliation.
    Comment: Several commenters stated that a 5-year look-back period 
for affiliations is appropriate.
    Response: We appreciate the commenters' support.
    Comment: A number of commenters stated that our proposed 5-year 
look-back period is too long. They generally contended that--(1) 
requiring research, tracking, and disclosure over a 5-year period would 
be too burdensome for providers and suppliers; and (2) relationships 
occurring 4 or 5 years ago typically would not pose a risk of fraud, 
waste, or abuse. Commenters suggested a shorter period; among those 
mentioned were 3 years, 2 years, and 1 year. They stated that a shorter 
period would still permit CMS to take action against providers and 
suppliers with problematic affiliations without--(1) penalizing 
providers and suppliers for having affiliations with entities whose 
disclosable events have passed; and (2) imposing an unacceptable burden 
on providers and suppliers.
    Response: We appreciate these comments and concerns. After careful 
consideration, though, we continue to believe that a 5-year period is 
warranted. A 5-year period will enable us to capture a sufficient 
extent of the provider's or supplier's disclosable event history 
without requiring the provider or supplier to research affiliations 
from many years prior. Put another way, we believe a 5-year period 
strikes a suitable balance between--(1) ensuring our ability to detect 
undue risks to the Medicare program and the Trust Funds and (2) 
restricting the burden of research and disclosure on providers and 
suppliers. We acknowledge that current or more recent affiliations may, 
depending on the facts of the case, present more concern than those 
that ended 4 or 5 years ago, and we will take into account when the 
affiliation occurred in determining whether an undue risk exists.
    Comment: A commenter stated that the proposed 5-year look-back 
period for previous affiliations is longer than any of the look-back 
periods associated with related fraud and abuse statutes, such as the 
physician self-referral (Stark) law, the CMP provisions, or the anti-
kickback statute. The commenter contended that CMS fails to provide any 
justification as to why 5 years is the appropriate timeframe.
    Response: Our 5-year look-back period is based on the objectives of 
section 1866(j)(5) of the Act. It need not be predicated on look-back 
periods for other, unrelated statutes; indeed, the affiliation 
disclosure requirement is entirely different from these other statutes, 
and any disclosure period established therewith must be predicated on 
the particular objectives and circumstances of said requirement. 
Further, we explained in the proposed rule that a 5-year look-back 
period would divulge to us past situations that could present future 
concerns, while being less onerous than, for instance, a 10-year 
period. We also respectfully note that a 5-year lookback period for 
previous affiliations is shorter than the lookback periods associated 
with overpayment and fraud and abuse statutes to which the commenter 
referred.
    Comment: A number of commenters recommended that CMS establish a 
look-back period for disclosable events. They essentially stated that--
(1) the lack of a look-back period would impose an enormous burden on 
providers and suppliers because they would have to obtain, submit, and 
regularly monitor information from potentially decades ago, which could 
take resources away from patient care, and (2) disclosable events that 
occurred many years prior do not pose a significant, if any, risk to 
federal health care programs. Among the look-back periods they 
suggested for disclosable events were 5 years, 3 years, and 2 years. 
The commenters stated that such periods would be sufficient to remove 
problematic parties from Medicare, Medicaid, and CHIP without overly 
burdening providers and suppliers. One commenter stated that if there 
is no look-back period for disclosable events, the universe of 
organizations that will have experienced at least one disclosable event 
will increase dramatically year-to-year; eventually, it is conceivable 
that nearly all providers and suppliers will have experienced at least 
one disclosable event at some point in their existence. Other 
commenters noted that CMS has a 10-year reporting limit for felony 
convictions and suggested that--(1) any look-back period for 
disclosable events should not exceed 10 years for offenses equivalent 
in scope to a felony; and (2) CMS should strongly consider reducing the 
disclosure period for less severe actions (such as non-felony final 
adverse actions), which a commenter suggested should be 3 years.
    Response: We appreciate these comments and understand the concerns 
regarding burden. However, after carefully considering them, we 
maintain our view that no look-back period for disclosable events 
should be established. While we recognize that disclosable events 
occurring many years previously often will not present the same level 
of concern as a more recent action, such events could still pose risks. 
Given our obligation to protect the Medicare program and the Trust 
Funds, we must retain the flexibility to address various factual 
scenarios. Yet we also reemphasize that, per our previously discussed 
revisions to Sec.  424.519(b), many providers and suppliers will not 
have to research or report disclosable affiliations for at least 
several years after the effective date of this rule.
    Comment: A commenter recommended a 7-year look-back period that 
would involve the submission of reports documenting disclosable events 
(including those for the potential billing service provider, the 
service owner or director, and accounts receivable personnel) that 
occurred during that timeframe. The commenter stated that such an 
assessment is necessary for the prevention of fraudulent activity. The 
commenter also stated that--(1) a 7-year timeframe is consistent with 
credit reporting; and (2) the Internal Revenue Service has a timeline 
of 7 years for documentation regarding a loss.
    Response: We appreciate this suggestion. For reasons previously 
stated, however, we are not adopting a look-back period for disclosable 
events and are retaining our proposed 5-year period for disclosable 
affiliations.
    Comment: Several commenters stated CMS should not require a 
provider or supplier to report any disclosable event

[[Page 47809]]

imposed on a prior affiliate after the relationship between the 
provider or supplier and the affiliate is terminated. A commenter 
stated that while the statute requires reporting current and past 
affiliations with individuals or entities that have experienced certain 
events, it references past events by using the past perfect 
conjugation. The commenter believed that this indicates that the 
Congress did not intend for providers or suppliers to disclose 
information on events that occurred after the affiliation period. Such 
events, the commenter stated, would be in the future in terms of the 
relationship between the individuals or entities, thus making the 
events outside the scope of the requirement.
    Response: We respectfully disagree with these commenters. Adoption 
of this suggestion could mean, for instance, that a party involved in 
improper activities could depart an affiliated provider immediately 
before any sanctions are imposed on the latter and purchase an 
enrolling provider, but CMS could take no action under Sec.  424.519 to 
prevent said enrollment. We explained in the proposed rule our concern 
about parties that engage in inappropriate behavior in one forum and 
then move to another provider or supplier to repeat their activities. 
The structure and scope of our disclosure requirements are designed to 
prevent this. We believe we have the discretion to interpret section 
1866(j)(5)(A) of the Act as not requiring the disclosable event to have 
occurred during the affiliation. Additionally, we have authority to 
include such situations within the scope of disclosable affiliations 
pursuant to our general rulemaking authority under sections 1102 and 
1871 of the Act.
    Comment: A commenter stated that any look-back period for 
disclosable events should not precede the date on which the provider or 
supplier established a covered affiliation with the relevant entity.
    Response: It appears that the commenter is suggesting that 
disclosable events occurring prior to the establishment of the 
affiliation should not be included within the scope of Sec.  424.519. 
We respectfully disagree. Depending on the particular facts of the 
case, we believe that affiliations established with parties that have 
some type of adverse history can still present risks. We believe we 
must retain the discretion to address such situations in order to 
protect the Medicare program and the Trust Funds.
    Comment: A commenter stated that look-back periods for affiliations 
and disclosable events should be 2 to 3 years and limited to timeframes 
following the acquisition of an entity and prior to the sale of an 
entity.
    Response: We appreciate this comment. However, for reasons stated 
earlier, we believe that a 5-year period is more appropriate for 
affiliations, with no look-back period for disclosable events. As we 
mentioned in the proposed rule, the 5-year timeframe extends back from 
the date on which the application is submitted; it is unrelated to the 
date of any relevant acquisition or sale.
    Comment: Several commenters recommended that CMS only require the 
reporting of disclosable events that occurred during the affiliation; 
in other words, the disclosable event must have occurred during the 
affiliation, not before or after, to require disclosure. A commenter 
contended that an enrolling or revalidating provider may have no way to 
reasonably know about disclosable events occurring outside the period 
of their affiliation with another provider or supplier. Another 
commenter stated that if the look-back period for disclosable events is 
not coterminous with the affiliation reporting obligation, providers 
will have to track the activities of entities either pre- or post-
affiliation. Another commenter stated that a provider typically would 
not (and should not be expected to) know of a disclosable event after 
an affiliation has ended. Several commenters added that providers and 
suppliers should only be required to report disclosable events that 
occurred before the end of an affiliation with a close affiliate. 
Another commenter stated that if CMS requires reporting of disclosable 
events occurring before or after an affiliation, such events should not 
be considered for purposes of determining undue risk.
    Response: For reasons stated previously, we believe it is important 
that disclosable events occurring before or after an affiliation be 
included within the purview of Sec.  424.519. It is possible that such 
an affiliation--even one involving parties that might not be considered 
``close'' affiliates--could pose an undue risk; indeed, we previously 
cited the example of a party that associates with a provider, engages 
in improper conduct, and then ends the association prior to any 
imposition of an adverse action or before the determination that a 
large overpayment exists. We again recognize, though, as we have 
discussed in detail in this section II of this final rule with comment 
period, the burden that could be involved in ascertaining this 
information. We also have revised Sec.  424.519(b) such that only a 
very small number of providers and suppliers will have to report 
affiliations in the initial years following the effective date of this 
final rule with comment period.
    Comment: A commenter stated that with respect to past affiliations, 
providers should only be required to disclose whether the provider or 
the affiliate had a disclosable event during the affiliation period. 
Having to obtain information from past affiliates, the commenter 
stated, could be extremely difficult. Another commenter stated that 
providers and suppliers should not be required to report prior 
disclosable events of any other providers or suppliers with which it 
has or had an affiliation. The commenter stated that once a 
relationship with a close affiliate ends, the provider or supplier may 
have no way to know or obtain information about the individual's or 
entity's behavior and actions. Another commenter stated that requiring 
reporting disclosable events occurring after an affiliation ends would 
be extremely burdensome on providers and suppliers; it would mandate 
them to continue to perform due diligence on an organization with which 
they no longer do business. Once a financial relationship has been 
terminated, the commenter explained, there would be no plausible reason 
for either party to maintain contact and, moreover, it is unclear 
whether the former affiliate could be compelled to disclose whether, 
for instance, it had its enrollment denied, revoked, or terminated 
after the affiliation had ended; also, the former affiliate would have 
no incentive to be forthcoming with the provider or supplier because 
there would be no penalty for being untruthful. This would, the 
commenter stated, leave providers or suppliers who are acting in good 
faith in a precarious position.
    Response: We understand the potential difficulty involved in 
obtaining data from past affiliates. However, we reiterate our belief 
that disclosable events occurring before or after an affiliation could 
present program integrity risks and that we must be able to take action 
to protect the Medicare program and the Trust Funds.
    After consideration of the comments received, we are finalizing 
proposed Sec.  424.519(a) and (b) with several exceptions and with a 
revision to Sec.  424.502:
     In paragraph (a), we are doing the following:
    ++ Changing the language ``(as defined in Sec.  424.57(a))'' to 
``imposed under this title.''
    ++ Adding the language ``to the definition of disclosable event in 
Sec.  424.502'' to the end of the opening

[[Page 47810]]

paragraph. This is to accommodate our revisions to Sec. Sec.  424.502 
and 424.519(b).
     In lieu of listing the four disclosable events that we 
proposed in Sec.  424.519(b) within that paragraph, we are adding to 
Sec.  424.502 a definition of ``disclosable event'' to encompass them. 
Doing so, we believe, will shorten Sec.  424.519(b) to make it more 
concise and readable. Within this definition, we are also adding ``by 
the OIG'' immediately after the word ``excluded'' to clarify that we 
are referring to OIG exclusions.
     We are revising the entirety of Sec.  424.519(b) to read 
as set out in the regulatory text.
    In addition, and as mentioned previously, we solicit public comment 
on operational approaches (specifically with respect to timing, 
mechanism, and priority) for obtaining affiliation information from 
providers and suppliers other than those to which Sec.  424.519(b) will 
apply.
c. Affiliation Data, Mechanism of Disclosure, and ``Reasonableness'' 
Standard
    In Sec.  424.519(c), we proposed to require the disclosure of the 
following information about the affiliation:
     General identifying data about the affiliated provider or 
supplier. This includes the following:
    ++ Legal name as reported to the Internal Revenue Service or the 
Social Security Administration (if the affiliated provider or supplier 
is an individual).
    ++ ``Doing business as'' name (if applicable).
    ++ Tax identification number.
    ++ NPI.
     Reason for disclosing the affiliated provider or supplier 
(for example, uncollected Medicare debt or Medicaid payment 
suspension).
     Specific data regarding the relationship between the 
affiliated provider or supplier and the disclosing party. Such data 
include the--(1) length of the relationship; (2) type of relationship 
(for instance, an owner of the initially enrolling provider or supplier 
was a managing employee of the affiliated provider or supplier); and 
(3) degree of affiliation (for example, percentage of ownership; 
whether the ownership interest was direct or indirect; the individual's 
specific managerial position; the scope of the individual's or entity's 
managerial duties; whether the partnership interest was general or 
limited).
     If the affiliation has ended, the reason for the 
termination.
    We stated that the information in proposed Sec.  424.519(c) is 
necessary to help us assess the risk of fraud, waste, or abuse that the 
affiliation poses.
    In Sec.  424.519(d), we proposed that the information required 
under Sec.  424.519 be furnished to CMS or its contractors via the Form 
CMS-855 application (paper or the internet-based PECOS enrollment 
process). This is to ensure that all enrollment information continues 
to be reported via a single vehicle.
    In Sec.  424.519(e), we proposed that the disclosing provider's or 
supplier's failure to fully and completely furnish the information 
specified in Sec.  424.519(b) and (c) when the provider or supplier 
knew or should reasonably have known of this information may result in 
either of the following:
     The denial of the provider's or supplier's initial 
enrollment application under Sec.  424.530(a)(1) and, if applicable, 
Sec.  424.530(a)(4).
     The revocation of the provider's or supplier's Medicare 
enrollment under Sec.  424.535(a)(1) and, if applicable, Sec.  
424.535(a)(4).
    Under our proposed ``reasonableness'' standard in Sec.  424.519(e), 
we would require particular information to be reported only if the 
disclosing provider or supplier knew or should reasonably have known of 
said data. For instance, while a provider or supplier would typically 
know of a past affiliation, it may not necessarily know whether a Sec.  
424.519(b) action occurred or was imposed after the affiliation ceased. 
We stated that we would review each situation on a case-by-case basis 
in determining whether the disclosing entity knew or should have known 
of the information.
    We also solicited comment regarding the following:
     Whether we should establish a ``reasonableness'' test, 
whereby we explain what constitutes a sufficient effort to obtain 
information in the context of the ``should reasonably have known'' 
standard.
     If we establish such a test, what its specific elements 
should be (for example, what constitutes a reasonable inquiry; the 
minimum steps that the provider must undertake in researching 
information).
    We received the following comments regarding paragraphs (c), (d), 
and (e):
    Commenter: A commenter questioned whether affiliations would have 
to be reported prior to updates to the Form CMS-855 to capture this 
information. In a similar vein, another commenter questioned whether, 
once the rule becomes final, organizations would immediately be 
required to collect data regarding ownership interests or other 
affiliations with Medicare providers and suppliers, or whether there 
would be a grace period to permit entities (especially large ones) to 
prepare for the affiliation disclosure requirements. Another commenter 
urged CMS to give providers and suppliers a reasonable implementation 
period to prepare for said requirements.
    Response: Disclosable affiliations will not have to be reported 
until the Form CMS-855 applications are updated to collect this data; 
additionally, CMS will issue accompanying subregulatory guidance 
regarding the affiliation disclosure process, though this may or may 
not be issued before CMS' begins sending affiliation disclosure 
requests to providers and suppliers. Because disclosure will not be 
required until the applicable forms are revised, all stakeholders will 
have sufficient time to prepare for said requirements.
    Comment: A commenter stated that an elaborate regulatory 
``reasonableness'' test is unnecessary. Instead, the commenter 
suggested that--(1) the reasonableness standard should be based on the 
principle of good faith, and (2) physicians should be neither required 
nor expected to research information about disclosable events relevant 
to affiliations that they would not otherwise be aware of in the 
general course of business. The commenter stated that a presumption of 
good faith should be applied that takes account of the limited 
knowledge providers may possess regarding their affiliated entities, 
especially when the extent or duration of the affiliation is relatively 
minor. Several other commenters also recommended a ``good-faith'' basis 
for any reasonableness test, with another commenter stating that 
providers and suppliers should not be required or expected to research 
data about disclosable events relevant to prior affiliations that they 
would not be otherwise aware of in the overall course of business.
    An additional commenter stated that setting a standard for a 
``reasonable'' effort might inadvertently--(1) expose honest providers 
to a level of risk that this rule does not intend, and (2) offer a 
potential benchmark for questionable and fraudulent parties. With the 
former, the commenter stated that most medical practices would strive 
to meet any reasonableness standard, but that they may lack the 
resources to meet an excessive standard. Concerning the latter, the 
commenter stated that a clearly delineated standard would signal to 
parties engaged in fraudulent behavior exactly how ``far away'' to keep 
their information, thus increasing the chances that innocent providers 
are unknowingly associated with unethical entities. The commenter 
recommended that CMS base any reasonableness

[[Page 47811]]

standard on the presumption of good faith and not a complex process.
    Response: As previously stated in both this final rule with comment 
period and the proposed rule, we recognize that various data may be 
difficult to obtain. We intend to issue subregulatory guidance that 
will clarify our expectations regarding the level of effort that is 
required in securing the relevant affiliation information.
    Comment: A number of commenters recommended that CMS--(1) more 
clearly define the ``knew or should reasonably have known'' standard; 
(2) develop criteria for said standard; (3) explain what constitutes a 
sufficient effort to obtain information; (4) specify how CMS will 
assess whether a provider or supplier knew or should reasonably have 
known of an affiliation or disclosable event; and (5) furnish examples 
of when and how the standard would and would not be applied. One 
commenter stated that CMS should provide illustrations of what would 
constitute a reasonable attempt to obtain certain information, similar 
to the Internal Revenue Service's ``Rebuttable Presumption'' standard. 
For example, the commenter stated, if a provider adheres to certain 
protocols, it should not be penalized if the information gathered 
pursuant to such protocols turns out to be false. The commenter 
believed this was equitable and would promote practical compliance.
    An additional commenter stated that CMS should not institute a 
strict test for reasonableness but instead provide guidance on the 
steps that CMS expects providers and suppliers to take to meet the 
``should reasonably have known'' standard. The commenter contended that 
an explicit test--(1) may be too administratively burdensome on 
providers and suppliers; and (2) might not be applicable to a variety 
of activities and relationships.
    Response: We appreciate and understand the commenters' concerns. As 
stated previously, we plan to issue subregulatory guidance that will 
clarify our expectations regarding the level of effort providers and 
suppliers must expend when researching affiliations.
    Comment: A commenter sought clarification as to the appropriate 
process for providers and suppliers to follow if they disagree with 
CMS' application of the ``knew or should reasonably have known'' 
standard in a particular case; the commenter asked whether the remedy 
is limited to a post-revocation appeal. The commenter recommended that 
if there is a dispute about whether the test has been met, no final 
enrollment action should be taken until all rights of appeal are 
exhausted. Another commenter stated that if the provider or supplier 
disagrees with any CMS application of the ``knew or should reasonably 
have known'' test that results in a denial or revocation, the provider 
or supplier can appeal CMS' denial or revocation. Another commenter 
stated that individuals often cannot be expected to discover a 
disclosable event when many of the affected parties are not in a 
sufficient position of control to obtain data regarding whether past, 
present, or future relationships may involve such an event; the 
commenter added that there is no comprehensive database of this 
information.
    Response: We acknowledge the commenters' concerns and, as already 
stated, will issue appropriate subregulatory guidance concerning the 
``knew or should reasonably have known'' standard. We note also that 
the provider or supplier may appeal a denial or revocation triggered by 
our affiliation disclosure provisions under 42 CFR part 498.
    Comment: A commenter recommended that CMS require providers to 
report debts only for affiliates that they have reasonable knowledge to 
believe are over the established debt threshold. A reasonable knowledge 
standard, the commenter stated, would--(1) allow CMS to identify 
debtors that could pose a risk to the integrity of the Medicare 
program; and (2) ease the regulatory burden on providers because they 
would not have to investigate in-depth every current or past affiliate.
    Response: We appreciate this comment and believe that our ``knew or 
should reasonably have known'' standard is not inconsistent therewith. 
However, we strongly reemphasize, that this does not mean that actual 
knowledge without any attempt to research affiliation data should be 
the test for compliance. Even with our ``knew or should reasonably have 
known'' standard, the provider or supplier must put forth a sufficient 
effort to research actual and possible affiliations.
    We also reiterate that we are not establishing a debt threshold in 
this final rule with comment period.
    Comment: Several commenters stated that a failure to report a 
disclosable event (either during initial enrollment, revalidation, or 
through changes in information) should not result in denial or 
revocation unless the omission was material and intentional, with some 
commenters adding that this policy is necessary because of the lack of 
clarity regarding what constitutes an affiliation. Some stated that 
denial or revocation would only harm legitimate providers and suppliers 
that are making honest efforts to report said data but that 
inadvertently neglect certain information or are unable to obtain it.
    Response: We respectfully decline to establish a ``material and 
intentional'' standard, for this could give the impression that--(1) 
certain required data can be withheld without consequences; and (2) 
little effort is necessary so long as information is not purposely 
withheld. Nevertheless, we again recognize that some data could be 
difficult to secure, and we stress that we will only take denial or 
revocation action pursuant to Sec.  424.519(e) after careful 
consideration of the facts and circumstances and not as a matter of 
course.
    Comment: A commenter stated that by using certified mail to inform 
providers and suppliers of certain information, CMS will have a legally 
binding signed document with which to prove what an entity or person 
should reasonably have known. The commenter added that a searchable CMS 
program participant database that tracks this information could prevent 
fraudulent activity before payments are made.
    Response: We appreciate these comments but believe they are outside 
the scope of this rule.
    Comment: A commenter stated that a provider or supplier should only 
be required to complete steps in its research that are clearly outlined 
and can be accomplished through publicly available search mechanisms, 
such as the OIG exclusion list. The commenter added that DMEPOS 
suppliers are required to complete a fingerprinting process as part of 
enrollment and re-enrollment, which, the commenter believed, should 
suffice to meet the intent of background research on individual owners.
    Response: While we believe that public database searches would 
prove useful in obtaining affiliation data, we do not believe the 
provider's or supplier's efforts should be automatically restricted to 
these means. Depending on the particular circumstances involved and 
recognizing that certain instances might necessitate greater degrees of 
research, this could require, for instance, a review of internal 
records and contacting affiliates. Such actions may yield data and 
information that is not otherwise available via public databases.
    We note that DMEPOS suppliers are subject to our fingerprinting 
requirements only as prescribed in Sec.  424.518.
    Comment: A commenter suggested that CMS--(1) should establish a 
rebuttable presumption that the

[[Page 47812]]

provider or supplier exercised sufficient diligence in gathering 
affiliation information; and (2) should not deny or revoke enrollment 
if the provider or supplier follows the appropriate procedure to obtain 
a rebuttable presumption. The commenter stated that this would promote 
compliance while recognizing that legitimate mistakes will be made in 
the data collection process.
    Response: We respectfully disagree that we should automatically 
presume that every provider or supplier submitting affiliation data 
exercised sufficient diligence in gathering the required information. 
We will review each case on its own merits, while acknowledging, as 
previously stated, that certain data may be difficult to secure.
    Comment: A commenter stated that CMS should explicitly state that 
hospitals and health systems may rely upon disclosures furnished by 
their affiliates, rather than being held to a ``should reasonably have 
known'' standard.
    Response: We respectfully disagree. A provider's or supplier's 
reliance upon information furnished by its affiliates is a matter 
between those parties, and the provider or supplier itself is 
ultimately responsible for furnishing accurate data to CMS. This is no 
different from the current requirement to furnish correct ownership, 
managerial, and adverse history information on the Form CMS-855 as part 
of the regular enrollment process. As stated previously, we will review 
each case on its own merits with the understanding that certain data 
may be difficult to obtain.
    After reviewing the comments received, we are finalizing Sec.  
424.519(c), (d), and (e) as proposed.
d. Undue Risk
    We proposed in Sec.  424.519(f) that upon receiving the information 
described in Sec.  424.519(b) and (c) (and consistent with section 
1866(j)(5)(B) of the Act), we would determine whether any of the 
disclosed affiliations poses an undue risk of fraud, waste, or abuse. 
The following factors would be considered:
     The duration of the disclosing party's relationship with 
the affiliated provider or supplier.
     Whether the affiliation still exists and, if not, how long 
ago it ended.
     The degree and extent of the affiliation (for example, 
percentage of ownership).
     If applicable, the reason for the termination of the 
affiliation.
     Regarding the disclosable event--
    ++ The type of action (for instance, payment suspension);
    ++ When the action occurred or was imposed;
    ++ Whether the affiliation existed when the action (for example, 
revocation) occurred or was imposed;
    ++ If the action is an uncollected debt--(1) the amount of the 
debt; (2) whether the affiliated provider or supplier is repaying the 
debt; and (3) to whom the debt is owed (for example, Medicare); and
    ++ If a denial, revocation, termination, exclusion, or payment 
suspension is involved, the reason for the action (for example, felony 
conviction; failure to submit complete information).
     Any other evidence that CMS deems relevant to its 
determination.
    In summary, these factors would focus largely, though not 
exclusively, on--(1) the length and period of the affiliation; (2) the 
nature and extent of the affiliation; and (3) the type of disclosable 
event and when it occurred. We stated in the proposed rule that a 
closer, longer, and more recent affiliation involving, for instance, an 
excluded provider or a large uncollected debt might present a greater 
risk to the Medicare program than a brief affiliation that occurred 5 
years ago. Yet we stressed that it should not be assumed that the 
latter situation would never pose an undue risk. We declined to make 
specific conclusions in the proposed rule regarding what would 
constitute an undue risk, for affiliations vary widely. We stated that 
we must retain the flexibility to deal with each situation on a case-
by-case basis, utilizing the aforementioned factors. We also solicited 
comment on the following issues related to these factors:
     Whether additional factors should be considered.
     Which, if any, of the proposed factors should not be 
considered.
     Which, if any, factors should be given greater or lesser 
weight than others.
    In Sec.  424.519(g), we proposed that a CMS determination that a 
particular affiliation poses an undue risk of fraud, waste, or abuse 
would result in, as applicable, the denial of the provider's or 
supplier's initial enrollment application under new Sec.  
424.530(a)(13) or the revocation of the provider's or supplier's 
Medicare enrollment under new Sec.  424.535(a)(19). We noted that an 
actual finding of fraud, waste, or abuse would not be necessary for 
Sec.  424.519(g) to be invoked. Only a determination that an undue risk 
of fraud, waste, or abuse exists would be required.
    We received the following comments regarding proposed Sec.  
424.519(f) and (g):
    Comment: A commenter stated that CMS should include in its undue 
risk determinations the following factors--(1) whether the disclosing 
provider or supplier was involved with the disclosable event; and (2) 
whether the affiliated individual or organization plays a tangible role 
in the day-to-day management and operations of the disclosing provider 
or supplier. Another commenter stated that CMS should evaluate whether 
the disclosing provider or supplier had any involvement with or was 
otherwise implicated by the disclosable event.
    Response: We believe that the commenter's second suggested factor 
falls within the scope of our proposed factor concerning the degree and 
extent of the affiliation. We do not believe that the commenter's first 
criterion should be explicitly listed as a factor in Sec.  424.519(f). 
Section 1866(j)(5)(B) of the Act focuses on whether the affiliation 
poses an undue risk rather than on the provider's or supplier's actual 
or potential involvement in the adverse action. In other words, the 
relationship itself is the relevant issue. We are concerned that adding 
the suggested factor would imply that the provider or supplier must 
have been directly involved with the disclosable event (and for there 
to be clear evidence thereof) in order for an undue risk under Sec.  
424.519(f) to exist. We believe this would be inconsistent with the 
spirit of section 1866(j)(5)(B) of the Act and could hinder our efforts 
to protect Medicare against problematic provider relationships.
    Consider the following illustration: Assume that a non-physician 
practitioner has been a one-third owner of three separate Medicare-
enrolled group practices for the past 5 years. Two of the groups have 
their enrollments revoked; the third group has an outstanding 
overpayment of $300,000. The practitioner wants to open a separate 
practice of which she will be the sole owner. The practitioner's 
affiliations would certainly raise questions about whether an undue 
risk exists. However, if we included the commenter's suggested factor 
within Sec.  424.519(f) and there is no firm proof directly tying the 
practitioner to the grounds for the revocations or the debt, we could 
be required to enroll the practitioner despite our legitimate concerns 
and the possible threat to the Medicare Trust Funds.
    Notwithstanding this, we wish to make clear that we will exercise 
our denial or revocation authority under Sec.  424.519(f) cautiously. 
We recognize that many disclosable affiliations may not pose an undue 
risk. Yet we must be

[[Page 47813]]

able to take action to protect Medicare from those affiliations that 
do.
    Comment: A commenter recommended that CMS--(1) furnish providers 
with a written explanation of why it determined that an undue risk 
exists, including credible evidence of its belief, before taking action 
under Sec.  424.519(g); and (2) provide examples in the rule's preamble 
of types of disclosable events, how it plans to apply the undue risk 
factors, and what action CMS may take in response. Other commenters 
also requested such examples, with a commenter stating that the 
examples should be subject to public notice and comment before the rule 
is finalized. Overall, commenters requested greater clarification of 
what constitutes an undue risk including, perhaps, a concrete 
definition or, at a minimum, objective standards. The commenters 
expressed concern that--(1) CMS' desire to retain its flexibility to 
address situations on a case-by-case basis gives CMS too much 
discretion; and (2) several of the factors are too broad. An additional 
commenter stated that CMS must establish objective measures with clear 
correlation to consequences in determining undue risk.
    Response: We appreciate the commenters' concerns and will include 
pertinent information regarding the reason(s) for the undue risk 
determination in the denial or revocation letter sent to the provider 
or supplier. Such information would be in the revocation or denial 
letter itself, not a pre-revocation or pre-denial notice, as suggested 
by one commenter. Furthermore, as we stated in the proposed rule, the 
determination of undue risk will be so dependent on the individual 
facts and circumstances involved that it is difficult to identify 
examples of what would and would not constitute an undue risk or to 
clearly define the term ``undue risk.'' Every case is different, and we 
must retain the discretion to address each based on its own merits and 
facts. In addition, we do not believe our factors are overly broad; we 
believe they are fairly specific, while simultaneously containing a 
measure of flexibility to deal with particular circumstances.
    Comment: A commenter stated that CMS should not take action against 
the disclosing provider or supplier without credible evidence or 
information showing that there will be an undue risk of fraud, waste, 
or abuse. The commenter stated that without this limitation, large 
groups and chains of providers and suppliers might have their Medicare 
enrollments revoked due to loose, indirect affiliation relationships 
with parties that have had disclosable events unrelated to the 
disclosing entities.
    Response: As stated earlier, we will only take action under Sec.  
424.519(f) after a very careful review of the aforementioned factors.
    Comment: A commenter questioned--(1) how CMS would handle undue 
risk determinations when it only has partial information available; and 
(2) whether a decision would be based only on that partial data.
    Response: Although the commenter's reference to ``partial'' 
information is somewhat unclear, we will make our determination based 
on the available information. If an undue risk is found and the 
provider's or supplier's enrollment is consequently denied or revoked, 
the provider or supplier may challenge the determination through an 
appeal of the denial or revocation.
    Comment: A commenter requested that CMS furnish guidance in the 
rule as to when CMS will notify a provider or supplier of whether an 
affiliation poses an undue risk; the commenter suggested a 30-day 
decision period. The commenter stated that prompt notice is important 
so that if the provider or supplier has employment screening 
procedures, the hiring process is not hindered.
    Response: Since the facts of each case will differ, we cannot 
conclusively specify the timeframe in which an undue risk determination 
will be made. If an undue risk is found and the enrollment is denied or 
revoked, the affected provider or supplier will be notified via letter.
    Comment: A commenter stated that if Medicare contractors will make 
undue risk determinations, CMS must ensure that such determinations are 
made in a consistent manner; if CMS will perform the determinations, 
CMS must have sufficient staff to timely make these determinations and 
communicate them to the provider or supplier. Another commenter stated 
that CMS should clarify whether CMS Central Office, CMS' Regional 
Offices, or the MACs will perform undue risk determinations.
    Response: We may issue subregulatory guidance concerning the 
process by which undue risk determinations will be made. In all cases, 
however, we will ensure that sufficient resources for implementing our 
disclosure of affiliation provisions are available.
    Comment: A commenter stated that in determining undue risk, CMS 
should only rely upon disclosable events involving parties with at 
least 50 percent ownership, which the commenter referred to as 
``substantial owners'' who are in a position to control or otherwise 
influence the provider's actions; alternatively, CMS should consider 
only those affiliations that occurred within 1 year or are currently in 
effect and are of a significant degree. The commenter stated that 
affiliations with parties other than these do not accurately reflect 
whether a provider poses an undue risk.
    Response: For reasons mentioned previously, we do not believe 
that--(1) affiliations involving less than 50 percent ownership and (2) 
prior affiliations should be automatically excluded from disclosure or 
consideration regarding risk. Every disclosable affiliation will be 
reviewed under Sec.  424.519, although the degree, extent, and timing 
of the affiliation will be among the factors considered in our undue 
risk determinations.
    Comment: A commenter stated that CMS should establish clear factors 
by which disclosable events and undue risk are evaluated. In general, 
the commenter suggested criteria such as--(1) how recent the 
affiliation was; (2) the type of disclosable event; (3) how much 
control (or interest) the provider or supplier reporting the 
disclosable event has over the affiliated party; and (4) intent. The 
commenter cited an illustration of a current affiliation less than 1 
year old with a party that is excluded by the OIG; the commenter stated 
that this poses a substantially higher risk than an affiliation of 
multiple years involving uncollected debt. The commenter also stated 
that a 5 percent ownership interest is less likely to involve 
significant influence over an affiliate than a significantly higher 
percentage.
    Response: The first three factors are already included within Sec.  
424.519(f). Concerning intent, we are unclear as to whether the 
commenter is referring to the affiliation or the disclosable event. In 
either case, evidence of intentional wrongdoing would, of course, 
impact our determination, but the lack thereof would not dictate that 
there is no undue risk. All of the factors in Sec.  424.519(f), 
including any evidence that is relevant to our decision, will be 
considered. However, we note that not all or even a majority of the 
factors would have to indicate risk in order for us to conclude that a 
denial or revocation is warranted.
    The percentage of ownership will fall within our analysis of the 
degree and extent of the affiliation. While larger ownership shares 
could, depending on the facts involved, weigh more heavily towards a 
finding of undue risk, it should not be assumed that a 5 or 10 percent 
interest will never result in such a determination. Again, each case 
will

[[Page 47814]]

be judged on its particular circumstances.
    Comment: Several commenters stated that findings of undue risk 
should be restricted to egregious conduct. Another commenter stated 
that, except for uncollected debts, CMS should restrict undue risk 
determinations to cases involving intentional fraud or misconduct or 
exclusions.
    Response: As stated previously, we will exercise our denial or 
revocation authority under Sec.  424.519(f) carefully. However, we do 
not believe that the disclosable event must have involved intentional 
fraud or misconduct for an affiliation to present an undue risk. Other 
types of affiliations involving behavior that does not contain such 
elements can endanger federal health care programs. Again, we will 
carefully consider the circumstances of the disclosable event in making 
our undue risk determinations.
    Comment: A commenter contended that the statute requires the 
affiliation to pose an undue risk by the provider or supplier.
    Response: We are not entirely certain of the commenter's 
contention, but we believe it is that the statute requires the provider 
or supplier--rather than the affiliation--to pose an undue risk. We 
respectfully disagree. Section 1866(j)(5)(B) of the Act refers to the 
affiliation itself posing an undue risk of fraud, waste, or abuse, 
rather than such risk being posed by the provider or supplier.
    Comment: A commenter stated that the lack of objective standards 
regarding undue risk creates a high potential for inconsistent 
determinations on comparable facts. To reduce subjectivity, the 
commenter suggested that CMS establish a decision matrix that includes 
decision ``weights'' regarding the relevant factors. Each undue risk 
criterion and ``should reasonably have known'' evaluation would be 
assigned a weight of importance, which would then create a score tied 
to a decision outcome. The commenter stated that CMS has used decision 
matrices in other areas, most recently with the CMP provisions of the 
home health intermediate sanction rules.
    Response: We appreciate this suggestion but do not believe such a 
matrix is necessary or advisable. Given the vast variety of factual 
situations we will encounter, as stated previously, we must retain as 
much flexibility as possible in our undue risk determinations. We 
believe that elements such as ``decision weights'' would adversely 
impact our ability to fairly consider all of the facts, since it would 
effectively require that specific ``scores'' be given for certain 
criteria and circumstances.
    After reviewing the comments received, we are finalizing Sec.  
424.519(f) and (g) as proposed with one exception. In Sec.  424.519(f), 
we are changing the term ``action'' to ``disclosable event.'' This is 
to achieve greater consistency with our addition of the definition of 
``disclosable event'' to Sec.  424.502. In addition, we are changing 
the heading of Sec.  424.530(a)(13) from ``Affiliation that poses undue 
risk of fraud'' to simply ``Affiliation that poses an undue risk'' in 
order to achieve consistency with the heading of Sec.  424.535(a)(19).
e. Additional Affiliation Provisions
    We proposed in Sec.  424.519(h)(1) that providers and suppliers 
must report new or changed information regarding existing affiliations, 
consistent with our requirement in Sec.  424.516 to submit changes in 
enrollment data; this would include the reporting of new affiliations. 
However, under paragraph (h)(2) providers and suppliers would not be 
required to report either of the following:
     New or changed information regarding past affiliations 
(except as part of a Form CMS-855 revalidation application) (paragraph 
(h)(2)(i)).
     Affiliation data in that portion of the Form CMS-855 that 
collects affiliation information if the same data is being reported in 
the ``owning or managing control'' (or its successor) section of the 
Form CMS-855 (paragraph (h)(2)(ii)).
    We stated that requiring providers and suppliers to report new or 
changed information regarding past affiliations would impose an 
unnecessarily excessive burden; providers and suppliers would have to 
constantly monitor and track information changes involving parties with 
whom they, their owners, or their managers no longer have a 
relationship. Regarding the second exception, we believed this would 
limit duplicate reporting and ease the burden on providers and 
suppliers.
    We received the following comments regarding this section:
    Comment: Several commenters expressed concern about the requirement 
to report changes in affiliation data. They generally stated that--(1) 
the burden of continually monitoring, tracking, and reporting data on 
many possible affiliates would be enormous; and (2) the penalty of 
revocation for failing to timely a report a change is too severe, 
especially if a reenrollment bar is imposed as well, and could unfairly 
and substantially impact legitimate providers and suppliers. Given the 
substantial burden involved, some commenters stated that any changes 
should only be reported during the provider's or supplier's next 
revalidation, rather than requiring the constant reporting of new or 
changed information.
    Response: We agree with the commenters' concerns regarding the 
potential burden and will not finalize proposed Sec.  424.519(h)(1) and 
(h)(2)(i). As already discussed, affiliation data under Sec.  424.519 
will only be required in the limited circumstances described in revised 
Sec.  424.519(b). However, we emphasize that providers and suppliers 
will still be required to report changes in ownership and management 
consistent with existing regulations.
    Comment: A commenter stated that CMS has not outlined a plan for 
how it will track new or changed affiliation data and how this 
information should be reported. The commenter asked whether--(1) CMS 
staff will check and monitor such data; and (2) PECOS will recognize 
these changes. Another commenter stated that CMS should only require 
providers to report new or changed information on close affiliates.
    Response: As stated in the previous response, we are not finalizing 
proposed Sec.  424.519(h)(1) and (h)(2)(i) due to the potential burden 
of regularly tracking and reporting disclosable affiliation 
information.
    After reviewing the comments submitted, we are deleting Sec. Sec.  
424.519(h)(1) and (h)(2)(i). Paragraph (h)(2)(ii) will be redesignated 
as paragraph (h).
    In Sec.  424.519(i), we proposed that CMS may apply proposed Sec.  
424.530(a)(13) or Sec.  424.535(a)(19) (as applicable) to situations 
where a disclosable affiliation (as described in Sec.  424.519(b) and 
(c)) presents an undue risk of fraud, waste, or abuse, but the provider 
or supplier has not yet disclosed or is not required at that time to 
disclose the affiliation to CMS. Although we received no specific 
comments on proposed Sec.  424.519(i) and are therefore finalizing it, 
we received the following comment that we believe indirectly touches 
upon this provision:
    Comment: A commenter posed a scenario where a provider (the first 
provider) is owned by five individuals, one of whom is associated with 
another provider (the second provider) that has an uncollected Medicare 
debt. The commenter asked whether the first provider would be denied or 
revoked if the aforementioned individual's ownership interests in the 
first provider are terminated prior to enrollment or revalidation.

[[Page 47815]]

    Response: The first provider or supplier could be denied or revoked 
if the scenario meets the requirements of Sec.  424.519(i) regarding 
undisclosed affiliations. In that case, if CMS learned of the first 
provider's affiliation prior to the individual in question terminating 
his or her ownership interest, CMS could make an undue risk 
determination under Sec.  424.519(g). CMS could then elect to revoke 
the first provider under Sec.  424.535(a)(19). However, this could only 
occur if CMS identified the affiliation while the individual owner was 
still in an ownership role with the first provider. In addition, if, 
when CMS evaluated the first provider, the individual owner was no 
longer in an ownership or other applicable role, with the second 
provider, no affiliation would be present; thus, no undue risk 
determination could be made.
    From a disclosure perspective under Sec.  424.519(b), CMS would not 
take action against the first provider at the time of an initial or 
revalidation application if the individual owner had already terminated 
his or her ownership interest with the first provider. Whether related 
to a disclosure or a CMS assessment, an owning or managing party must 
be in an ownership or managerial role with the provider in order for an 
affiliation to exist and an undue risk determination to be made.
2. Medicaid
    Consistent with our discussion in section II.A.1.a. of this final 
rule with comment period and for the reasons stated therein, we 
proposed to revise the Medicaid provisions in 42 CFR part 455.
    In Sec.  455.101, we proposed to add the same definition of 
``affiliation'' that we proposed to add to Sec.  424.502, with the 
exception of the paragraph regarding ``reassignment.'' Section 424.80 
only applies to Medicare. However, we proposed to include payment 
assignments under Sec.  447.10(g) within the definition of 
``affiliation'' in Sec.  455.101. Under Sec.  447.10(g), payment for 
services provided by an individual practitioner may be made to--
    ++ The employer of the practitioner, if the practitioner is 
required as a condition of employment to turn over his fees to the 
employer;
    ++ The facility in which the service is provided, if the 
practitioner has a contract under which the facility submits the claim; 
or
    ++ A foundation, plan, or similar organization operating an 
organized health care delivery system, if the practitioner has a 
contract under which the organization submits the claim.
    As with Medicare reassignments, we stated in the proposed rule that 
the relationships described in Sec.  447.10(g) are sufficiently close 
to warrant their inclusion within the definition of ``affiliation'' in 
Sec.  455.101; again, a W-2 employee or independent contractor may have 
a closer day-to-day relationship with the individual or organization he 
or she works for than, for instance, an indirect owner has with an 
entity in which he or she has a 5 percent ownership interest. We also 
noted that these provisions are similar to those in Sec.  424.80.
    After considering the previously discussed comments we received 
regarding our Medicare definition of ``affiliation,'' we are finalizing 
our proposed definition of ``affiliation'' in Sec.  455.101.
    In revised Sec.  455.103, we proposed that a state plan must 
provide that the requirements of Sec. Sec.  455.104 through 455.107 are 
met. Section 455.103 currently only references Sec. Sec.  455.104 
through 455.106. Our revision included a reference to new Sec.  
455.107. We received no comments on this proposal and are, therefore, 
finalizing it.
    In new Sec.  455.107, we proposed several paragraphs.
(i) Discussion of Sec.  455.107(a) and (b)
    In paragraph (b), we proposed that a provider that is submitting an 
initial or revalidating Medicaid application must disclose whether it 
or any of its owning or managing employees or organizations (consistent 
with the definitions of ``person with an ownership or control 
interest'' and ``managing employee'' in Sec.  455.101) has or, within 
the previous 5 years, has had an affiliation with a currently or 
formerly enrolled Medicare, Medicaid, or CHIP provider or supplier 
that--
     Currently has an uncollected debt to Medicare, Medicaid, 
or CHIP, regardless of--(1) the amount of the debt; (2) whether the 
debt is currently being repaid (for example, as part of a repayment 
plan); or (3) whether the debt is currently being appealed. For 
purposes of Sec.  455.107 only, and as stated in proposed Sec.  
455.107(a), the term ``uncollected debt'' would only apply to--
    ++ Medicare, Medicaid, or CHIP overpayments for which CMS or the 
state has sent notice of the debt to the affiliated provider or 
supplier;
    ++ CMPs (as defined in Sec.  424.57(a)); and
    ++ Assessments (as defined in Sec.  424.57(a));
     Has been or is subject to a payment suspension under a 
federal health care program (as that latter term is defined in section 
1128B(f) of the Act), regardless of when the payment suspension 
occurred or was imposed;
     Has been or is excluded from participation in Medicare, 
Medicaid, or CHIP, regardless of whether the exclusion is currently 
being appealed or when the exclusion occurred or was imposed; or
     Has had its Medicare, Medicaid, or CHIP enrollment denied, 
revoked or terminated, regardless of--(1) the reason for the denial, 
revocation, or termination; (2) whether the denial, revocation, or 
termination is currently being appealed; or (3) when the denial, 
revocation, or termination occurred or was imposed. For purposes of 
Sec.  455.107 only, the terms ``revoked,'' ``revocation,'' 
``terminated,'' and ``termination'' would include situations where the 
affiliated provider or supplier voluntarily terminated its Medicare, 
Medicaid, or CHIP enrollment to avoid a potential revocation or 
termination. This clarification is included in proposed Sec.  
455.107(a).
    After considering the previously discussed comments regarding the 
related Medicare provisions at Sec.  424.519(a) and (b), we are 
finalizing proposed Sec.  455.107(a) with two exceptions. First, we are 
changing the language ``(as defined in Sec.  424.57(a))'' to ``imposed 
under this title.'' Second, we are adding the following language to the 
end of the opening paragraph of Sec.  455.107(a): ``to the definition 
of disclosable event in Sec.  455.101:''
    Similar to our previously referenced change to Sec.  424.502, we 
are also adding a definition of ``disclosable event'' to Sec.  455.101 
to encapsulate the four aforementioned events (that is, uncollected 
debt, payment suspension, OIG exclusion, enrollment denial/revocation/
termination) that will trigger an affiliation disclosure under Sec.  
455.107. We believe this will help simplify and shorten the text of 
Sec.  455.107(b). In addition, we are adding ``by the OIG'' immediately 
after the word ``excluded'' in our ``disclosable event'' definition'' 
to clarify that we are referring to OIG exclusions.
    With respect to paragraph (b), and for reasons akin to those 
concerning our changes to Sec.  424.519(b), we are making a number of 
revisions to incorporate a ``phased-in'' approach. However, there are 
some differences between how the ``phased-in'' approach will be 
conducted under Sec.  424.519 for Medicare providers and suppliers and 
how the approach will be conducted under Sec.  455.107 for Medicaid 
providers.

[[Page 47816]]

(A) Implementation Approaches for Medicaid and CHIP--Background
    Under revised Sec.  455.107(b), each state will, in consultation 
with CMS, select one of two options for the implementation of the 
affiliation disclosure requirement. The option chosen will be in effect 
until we engage in further rulemaking regarding this requirement; 
states will not be able to switch options prior to such additional 
rulemaking. Under the first option, disclosures must be submitted by 
all newly enrolling or revalidating Medicaid and/or CHIP providers that 
are not enrolled in Medicare. Under the second and more targeted 
option, disclosures must be submitted only upon request by the state. 
Specifically, the states that choose this second option will request 
disclosures from those Medicaid and/or CHIP enrolled providers that are 
not enrolled in Medicare and that the state, in consultation with CMS, 
determines meets certain criteria, discussed further below.
(1) First Option
    In states that select the first option, a provider that is not 
enrolled in Medicare but is initially enrolling in Medicaid or CHIP (or 
is revalidating its Medicaid or CHIP enrollment information) must 
disclose any and all affiliations that it or any of its owning or 
managing employees or organizations (consistent with the terms ``person 
with an ownership or control interest'' and ``managing employee'' as 
defined in Sec.  455.101) has or, within the previous 5 years, had with 
a currently or formerly enrolled Medicare, Medicaid, or CHIP provider 
or supplier that has a disclosable event (as defined in Sec.  455.101).
(2) Second Option
    In states that select the second option, upon request from the 
state, a provider that is not enrolled in Medicare but is initially 
enrolling in Medicaid or CHIP (or is revalidating its Medicaid or CHIP 
enrollment information) must disclose any and all affiliations that it 
or any of its owning or managing employees or organizations (consistent 
with the terms ``person with an ownership or control interest'' and 
``managing employee'' as defined in Sec.  455.101) has or, within the 
previous 5 years, had with a currently or formerly enrolled Medicare, 
Medicaid, or CHIP provider or supplier that has a ``disclosable event'' 
(as defined in Sec.  455.101). The state will request such disclosures 
when it, in consultation with CMS, has determined that the initially 
enrolling or revalidating provider may have at least one such 
affiliation.
(A) Characteristics of Each Option
    There are several similarities between the two options.
    First, under either option, only those providers that are not 
enrolled in Medicare would be required to disclose affiliations. This 
is because the states will, as applicable, be able to rely on CMS' 
review of actual or potential affiliation data for dually-enrolled 
providers (that is, providers enrolled in both Medicare and Medicaid or 
CHIP). In contrast, Medicare and PECOS would not have affiliation 
information for Medicaid-only or CHIP-only providers; thus, the state 
would be unable to rely upon any affiliation data that Medicare may 
have on file for these providers. The limiting of the disclosure 
requirement to providers not enrolled in Medicare would therefore 
eliminate duplicative efforts by CMS and the states.
    Second, the disclosable events pertaining to each option mirror not 
only each other but also the disclosable events applicable to Medicare 
enrollment as defined in Sec.  424.502 and in section 1866(j)(5) of the 
Act. We believe this will help ensure consistency with Medicare and 
with the statute. In addition, and as previously discussed, the 
relationships described in section 1866(j)(5) of the Act are of concern 
to CMS and the states from a program integrity perspective. Including 
them within the scope of Sec.  455.107(b) will assist our efforts in 
deterring fraud, waste, and abuse.
    Third, with both options, any provider required to submit a 
disclosure of affiliations must report any and all affiliations that 
come within the scope of Sec.  455.107. Even if the state selects the 
second option and, for a particular provider, identifies only one 
affiliation that triggers a request for the provider to submit a 
disclosure of affiliations, that provider must disclose all applicable 
affiliations regardless of whether the state may already have 
information on these relationships.
    Fourth, a provider's disclosure of affiliations, irrespective of 
which option is selected, does not automatically mean that the state, 
in consultation with CMS, has determined or will determine that all or 
any of the disclosed affiliations pose an undue risk of fraud, waste, 
or abuse.
    Fifth, providers will not be required to report all applicable 
affiliation information to the state under either option until the 
applicable state has revised its relevant enrollment application(s) to 
accommodate the disclosure of affiliations requirement. However, per 
Sec.  455.107(h) and as addressed in more detail later in this section, 
if a state determines that a provider has an affiliation(s)--via a 
source(s) other than provider reporting--and determines, in 
consultation with CMS, that one or more affiliations of that provider 
represent an undue risk of fraud, waste, or abuse, the state may deny 
or terminate the provider's enrollment in the state Medicaid program 
even before the state's applications (or other means of capturing 
affiliation information, whether in physical or electronic form) have 
been updated with an affiliation disclosure section.
    Despite the parallels between the two options, there is one 
critical difference, in that the first option is significantly broader 
than the second. Excluding Medicare-enrolled providers and suppliers, 
the former option applies to all newly enrolling and revalidating 
providers without exception, whereas the second option only requires 
the submission of affiliation data upon a state request. On a broader 
level, the first option does not involve a gradual, incremental 
enforcement such as that which we are adopting with Medicare providers 
and suppliers in Sec.  424.519(b). The second option, however, largely 
duplicates the ``phased-in'' approach of Sec.  424.519(b), under which 
the states will conduct internal research to determine whether a 
disclosable affiliation under Sec.  455.107 may exist and then request 
a disclosure of all applicable affiliations. We believe that affording 
the states more than one alternative will permit them greater 
flexibility in implementing the affiliation requirement.
    We note that section 1866(j)(5) of the Act requires every provider 
and supplier (regardless of the relative risk they may pose) to 
disclose affiliations upon initial enrollment and revalidation. All 
states that choose the second option will therefore eventually be 
required to collect affiliation disclosures from their providers upon 
the submission of each initial and revalidation application. Future 
rulemaking will address the next phases of the Medicaid and CHIP 
affiliations disclosure process. We would appreciate feedback from the 
public on the possible content of this rulemaking, particularly with 
respect to the same general topics on which we have requested comments 
regarding the Medicare affiliation process (for example, priority of 
disclosure requests).
    States will notify CMS, via a process outlined in future 
subregulatory guidance, as to which of the two options

[[Page 47817]]

they are choosing. CMS subregulatory guidance will also provide 
instruction to the states as to how to inform the necessary 
stakeholders, such as the relevant health care provider community, 
about which option it has selected so that Medicaid-only and CHIP-only 
providers know if they are automatically required to furnish 
affiliations disclosures upon initial enrollment or revalidation or if 
they must do so only upon request. After a state notifies both CMS and 
necessary stakeholders about which option it selected, the state will 
then begin to collect affiliation disclosures in a manner consistent 
with that option.
(ii) Discussion of Sec.  455.107(c), (d), and (e)
    In paragraph (c), we proposed that the following information about 
the affiliation must be disclosed:
     General identifying data about the affiliated provider or 
supplier. This would include the following:
    ++ Legal name as reported to the Internal Revenue Service or the 
Social Security Administration (if the affiliated provider or supplier 
is an individual).
    ++ ``Doing business as'' name (if applicable).
    ++ Tax identification number.
    ++ NPI.
    ++ Reason for disclosing the affiliated provider or supplier (for 
example, uncollected CHIP debt; payment suspension).
    ++ Specific data regarding the affiliation relationship. Such data 
would include the--(1) length of the relationship; (2) type of 
relationship; and (3) degree of affiliation.
    ++ If the affiliation has ended, the reason for the termination.
    In paragraph (d), we proposed that the information described in 
Sec.  455.107(b) and (c) must be furnished to the state in a manner 
prescribed by the state.
    In paragraph (e), we proposed that the disclosing provider's 
failure to fully and completely furnish the information in Sec.  
455.107(b) and (c) when the provider knew or should reasonably have 
known of this information may result in--
     The denial of the provider's initial enrollment 
application; or
     The termination of the provider's Medicaid or CHIP 
enrollment.
    Based on the previously discussed comments we received regarding 
the general contents of Sec.  424.519(c) through (e), we are finalizing 
Sec.  455.107(c), (d), and (e) as proposed with one exception. We are 
adding the language ``in consultation with the Secretary'' to the end 
of Sec.  455.107(d). Section 1866(j)(5) of the Act, as explained 
earlier, specifies that affiliation disclosures are to be furnished 
``in a form and manner and at such time as determined by the 
Secretary.'' To comply with this requirement, we believe that states 
should consult with CMS as to the ``form and manner'' of said 
disclosures. We will communicate with the states regarding this 
consultation requirement and issue subregulatory outlining the 
parameters thereof.
(iii) Discussion of Sec.  455.107(f), (g), (h), and (i)
    In paragraph (f), we proposed that upon receiving the information 
described in Sec.  455.107(b) and (c), the state, in consultation with 
CMS, would determine whether any of the disclosed affiliations poses an 
undue risk of fraud, waste, or abuse. The state, in consultation with 
CMS, would consider the following factors in its determination:
     The duration of the disclosing party's relationship with 
the affiliated provider or supplier.
     Whether the affiliation still exists and, if not, how long 
ago it ended.
     The degree and extent of the affiliation.
     If applicable, the reason for the termination of the 
affiliation.
     Regarding the affiliated provider's or supplier's 
disclosable event--
    ++ The type of action;
    ++ When the action occurred or was imposed; and
    ++ Whether the affiliation existed when the action occurred or was 
imposed.
    ++ If the action is an uncollected debt--(1) the amount of the 
debt; (2) whether the affiliated provider or supplier is repaying the 
debt; and (3) to whom the debt is owed (for example, Medicare);
     If a denial, revocation, termination, exclusion, or 
payment suspension is involved, the reason for the action; and
     Any other evidence that the state, in consultation with 
CMS, deems relevant to its determination.
    In paragraph (g), we proposed that a determination by the State, in 
consultation with CMS, that a particular affiliation poses an undue 
risk of fraud, waste, or abuse results in, as applicable, the denial of 
the provider's initial enrollment application or the termination of the 
provider's Medicaid or CHIP enrollment.
    We received the following comments that were specific to proposed 
Sec.  455.107(f) and (g):
    Comment: A commenter stated that there is no current federal 
requirement that a state Medicaid agency consult with CMS in making 
enrollment determinations. The commenter recommended that CMS--(1) 
permit greater discretion regarding the required consultation with CMS; 
(2) furnish clarification and guidance to states concerning this 
process; (3) establish timeframes by which CMS, under this provision, 
must respond to the state in order to avoid delays in application 
processing; and (4) permit states to rely upon any CMS undue risk 
determinations involving Medicare-enrolled providers or providers 
enrolled with another state Medicaid agency. Concerning the final 
recommendation, the commenter believed there would be no need for the 
state to consult CMS on a matter that CMS has already reviewed. Another 
commenter stated that CMS should eliminate the requirement that the 
state consult with CMS on undue risk determinations, contending that 
the rule does not address the possibility of disagreement or delays in 
reaching a determination. If the requirement is retained, the commenter 
stated that the rule should establish a clear and expedited process for 
making such determinations. This should include a provision that all 
state recommendations are automatically affirmed after 15 days, which 
would ensure that determinations are promptly made.
    Response: While we appreciate these comments, we respectfully 
decline to remove the consultation language, for consultation is 
necessary to satisfy the statutory requirement that the Secretary 
determine ``undue risk.'' However, we will work closely with the states 
in developing a subregulatory process by which there is adequate 
guidance and efficient communication between the states and CMS, while 
recognizing the traditional flexibility given to states in their 
enrollment determinations. We note that the two previously mentioned 
options under Sec.  455.107(b) will apply only to providers that are 
not enrolled in Medicare because, as we explained, states will be able 
to rely on CMS' review of Medicare-enrolled providers and suppliers in 
the matter of affiliation disclosures.
    Comment: A commenter requested that CMS provide clear guidance 
regarding a state agency's responsibility under our proposal, 
specifically (1) the degree to which a state must establish that a 
provider seeking Medicaid enrollment has accurately disclosed 
affiliations under Sec.  455.107; (2) the required extent of the 
state's consultation with CMS, provider outreach and education, and 
ongoing documentation of information outlined in Sec.  455.107; and (3) 
the length of time that states will have to implement Sec.  455.107. 
Another commenter

[[Page 47818]]

suggested that the final rule contain a provision making the rule 
effective no sooner than 6 months from the end of the state's 
legislative session that begins after the rule's publication date. This 
will help states ensure that--(1) state law reflects the rule's 
requirements; and (2) providers are fully informed of said 
requirements. Another commenter requested that CMS consider allowing 
sufficient time to implement the rule, suggesting a 12-month period 
that, the commenter believed, would enable providers to prepare for and 
be compliant at the onset of these changes.
    Response: We will work closely with the states and disseminate 
sufficient guidance to them in implementing our affiliation disclosure 
provisions. The three issues the first commenter raised may be 
addressed in such guidance.
    Consistent with our position regarding Sec.  424.519, states will 
not be expected to implement Sec.  455.107--and Medicaid and CHIP 
providers will not have to disclose affiliation data under this 
provision--until each state's pertinent Medicaid and/or CHIP initial 
and/or revalidation applications are updated to collect this 
information. Further, CMS will issue accompanying subregulatory 
guidance to the states regarding the operationalization of Sec.  
455.107 (although said guidance may or may not be issued before some 
states send out their initial affiliation disclosure requests). The 
timing of the updates to each state's Medicaid and/or CHIP applications 
will vary from state to state; it is not possible, of course, to 
predict how long it will take each state to update its applications 
because of the numerous variables involved. Regardless, we believe that 
the need for each state to revise its applications and discuss with CMS 
those aspects of this process where such consultation is required will 
give stakeholders sufficient time to prepare for these requirements.
    After reviewing the comments received, we are finalizing Sec.  
455.107(f) and (g) as proposed with one exception. In Sec.  455.107(f), 
we are changing the term ``action'' to ``disclosable event.'' This is 
to achieve greater consistency with our addition of the definition of 
``disclosable event'' to Sec.  455.101.
    In paragraph (h), we proposed the following:
     Providers would be required to report new or changed 
information regarding existing affiliations. This would include 
reporting any new affiliations.
     Providers would not be required to report new or changed 
information regarding past affiliations (except as part of a 
revalidation application).
    We received the following comment regarding Sec.  455.107(h):
    Comment: A commenter questioned whether providers would have to 
furnish this new or changed data to Medicaid or CHIP within a CMS-
specified time period, or whether the state has the discretion to 
establish the time period.
    Response: For the same reasons behind our revision of proposed 
Sec.  424.519(h), we have decided not to finalize proposed Sec.  
455.107(h).
    In paragraph (i), we proposed that the state, in consultation with 
CMS, may apply paragraph (g) to situations where a reportable 
affiliation poses an undue risk of fraud, waste, or abuse, but the 
provider has not yet disclosed or is not required at that time to 
disclose the affiliation to the state. We received no comments 
specifically referencing Sec.  455.107(i) and are, therefore, 
finalizing it as proposed, with one exception: we are re-designating 
Sec.  455.107(i) as Sec.  455.107(h) due to our previously mentioned 
decision not to finalize proposed Sec.  455.107(h).
c. CHIP
    Section 2107(e) of the Act states that sections 1902(a)(77) and 
(kk) of the Act (which relate to Medicaid provider screening, 
oversight, and reporting requirements) apply to CHIP to the same extent 
that they apply to Medicaid. We thus proposed to apply our proposed 
Medicaid affiliation disclosure requirements to CHIP providers for two 
principal reasons. First, section 1866(j)(5) of the Act specifically 
references the need to disclose current and prior affiliations with 
CHIP providers. We believe it logically follows that CHIP providers 
should have to disclose similar affiliation information. Second, and 
for reasons previously explained, the disclosure of affiliation 
information would assist efforts in deterring fraud, waste, and abuse 
in CHIP.
    Section 457.990(a) states that part 455, subpart E, applies to a 
state under Title XXI in the same manner as it applies to a state under 
Title XIX. We proposed to revise Sec.  457.990(a) such that Sec.  
455.107 would also apply to Title XXI. Paragraph (a) would thus read: 
Section 455.107.
    We received no comments on our proposed revision to Sec.  
457.990(a), therefore we are finalizing it as proposed.
3. Miscellaneous Comments
    We received the following miscellaneous comments on our affiliation 
disclosure proposal. They pertain more to the proposal in general than 
to specific provisions in Sec. Sec.  424.519 and 455.107.
    Comment: A commenter stated that to ensure that providers and 
suppliers have sufficient notice to begin preparing for this new 
requirement (for example, to begin acquiring and tracking affiliation 
data), CMS should only apply the reporting requirement to existing 
affiliations or to those established on or after the implementation 
date of the final rule.
    Response: We disagree. We believe that any affiliation covered 
under Sec.  424.519, including those that existed prior to the rule's 
implementation date, should be reported. We must be able to take action 
to protect the Medicare program and the Trust Funds against undue 
risks.
    Comment: A commenter stated that the DMEPOS industry seeks clear 
guidance on how different infractions will impact their supplier 
number(s). The commenter stated that the rule does not specify how--(1) 
each type of reported affiliation will affect impact the enrolling 
supplier; and (2) a reported affiliation that results in a revocation 
would be applied to other NPIs associated with the enrollee. The 
commenter recommended that affiliations be reported based on the NPI.
    Response: Denials and revocations pursuant to Sec.  424.519 will be 
applied no differently than how other denials and revocations are 
currently applied. As for the commenter's recommendation, affiliations 
will be reported in accordance with the requirements of this rule 
irrespective of the particular NPI enumeration involved.
    Comment: A commenter stated that CMS should delay the 
implementation of the look-back requirements for at least the length of 
the look-back period. This will allow providers and suppliers to 
identify all existing affiliations as of the rule's effective date and 
monitor them prospectively for disclosable events.
    Response: We do not believe that the implementation of Sec.  
424.519 should be delayed 5 years. It is important that we be able to 
take prompt action to protect Medicare and the Trust Funds against 
undue risks.
    Comment: Several commenters questioned whether this proposal would 
be effective in addressing CMS' program integrity concerns. They 
contended that--(1) dishonest providers and suppliers that CMS is 
concerned about will not disclose affiliations to CMS, much less to 
other providers and suppliers with which it competes; and (2) only 
well-intentioned providers and suppliers, who pose little if any risk,

[[Page 47819]]

will report this data yet will ultimately bear the significant 
administrative and cost burdens of doing so. In other words, the 
commenters stated, honest providers and suppliers, rather than 
dishonest ones, would be penalized under this proposal. They added that 
the rule as a whole should be geared towards non-compliant providers 
and suppliers instead of burdening honest parties.
    Response: We recognize that many providers and suppliers have and 
have had affiliations that pose little if no risk, and we have taken 
steps in this rule to reduce the reporting burden on these parties. 
However, dishonest providers and suppliers that deliberately withhold 
information must understand that we will, through our examination of 
internal data--(1) be able to determine whether such providers and 
suppliers have or have had a disclosable affiliation; and (2) take 
appropriate administrative action as needed.
    Comment: Several commenters stated that the proposal would 
effectively require providers and suppliers to become investigative 
bodies; that is, they would have to expend considerable resources 
(including, perhaps, hiring additional personnel and outside parties) 
to investigate other providers and suppliers. Such resources, they 
maintained, would be better used towards patient care. Another 
commenter stated that CMS should recognize that certain affiliates may 
be reluctant for various reasons to furnish data to the provider or 
supplier. The commenter added that CMS should avoid imposing 
requirements that could place current or former affiliates in untenable 
positions or create conflicts of interest.
    Response: As stated earlier, we recognize the potential researching 
and reporting burden involved and that certain data may be difficult to 
obtain. As one step toward reducing said burden, we have removed the 
requirement to disclose new or changed affiliations (except as part of 
a revalidation). Moreover, CMS will review each affiliation disclosure 
situation on its own merits, acknowledging that there may be cases 
where a provider or supplier simply cannot secure particular 
information even after making a substantial effort to do so. We 
anticipate that future subregulatory guidance will address the research 
and reporting process for affiliations.
    Comment: Several commenters stated that many providers and 
suppliers already closely screen their owners, managers, physicians, 
health care personnel, etc., before including them within their 
organization; this may consist of, for instance, reviews of the 
individual's malpractice and medical discipline record via the National 
Practitioner Data Bank (NPDB).
    Response: We appreciate the efforts of these providers and 
suppliers in screening their owners, managers, and personnel. However, 
consistent with section 1866(j)(5)(b) of the Act, we believe that CMS 
and the states, in consultation with CMS, must be able to make their 
own undue risk determinations independent of any internal screening the 
provider or supplier undertakes.
    Comment: A commenter stated that CMS should rescind the proposed 
rule and craft a new rulemaking that is more narrowly focused.
    Response: We respectfully disagree that the proposed rule should be 
rescinded. We believe that these new disclosure provisions will be 
valuable tools in our program integrity efforts, especially with 
respect to inter-provider schemes.
    Comment: A commenter stated that a disclosable affiliation that 
occurred prior to the rule's effective date should not have to be 
reported.
    Response: We respectfully disagree. We believe that previous 
disclosable affiliations, even those ending prior to this final rule 
with comment period, can be germane to a determination of whether an 
undue risk exists and should be considered, assuming they occurred 
within the prior 5 years.
    Comment: Several commenters stated that there is no publicly 
available federal database that instantly updates all disclosable 
events, such as debts and revocations; this could lead to innocent 
provider and supplier errors in disclosure or an inability to furnish 
certain information, with resulting revocations and appeals. They urged 
the establishment of such a database.
    Response: We appreciate this comment and may explore means of 
increasing the public availability of certain data.
    Comment: A commenter asked why the proposed affiliation provision 
did not include section 1877 of the Act, which addresses various 
financial and ownership relationships.
    Response: Our focus in this rule was on addressing the 
relationships referenced in section 1866(j)(5) of the Act.
    Comment: A commenter questioned--(1) whether CMS and/or its 
contractors would review every application in detail; (2) if not, how 
they would determine which applications to focus on; and (3) whether 
CMS and its contractors actually have enough personnel with sufficient 
expertise to review all submitted data and to detect any omissions of 
information.
    Response: All disclosures will be closely reviewed, and we intend 
to have sufficient personnel available to carry out this function. We 
may issue subregulatory guidance concerning the process by which undue 
risk determinations will be made.
    Comment: A commenter indicated that CMS' recent amendment to the 
appeals process (via a manual revision) requiring providers and 
suppliers to perfect their appeals at the reconsideration level without 
the ability to add additional evidence beyond this stage could 
negatively impact a provider's or supplier's ability to effectively 
appeal a denial or revocation under Sec.  424.519.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter questioned whether any Form CMS-855 changes 
resulting from our proposed disclosure requirements would be subject to 
public notice and comment prior to finalization.
    Response: All Form CMS-855 changes are subject to public notice and 
comment under the Paperwork Reduction Act. This will also be the case 
with our revisions to the Form CMS-855 to capture affiliation 
information.
    Comment: A commenter stated that there should be no exemptions for 
complete disclosure. The commenter believed that full disclosure would 
demonstrate the integrity of the individual who is applying for CMS 
enrollment.
    Response: Although we appreciate this comment, we have modified 
certain aspects of our disclosure requirements to reduce the overall 
reporting burden while simultaneously ensuring that we can detect risks 
to the Medicare program and the Trust Funds.
    Comment: A commenter stated that a revocation resulting in the 
maximum reenrollment bar should always be disclosed regardless of age. 
For all other actions, however, the commenter contended that ``expanded 
documentation'' at CMS should be sufficient for the agency to capture 
information on other disclosable events.
    Response: We appreciate this suggestion and believe that there 
should be no look-back period for disclosable events, including 
revocations involving a maximum reenrollment bar. As for internal CMS 
documentation, we earlier recognized that CMS may have much of the 
required affiliation data in PECOS

[[Page 47820]]

and other systems. Section 1866(j)(5) of the Act, however, is clear 
that such information must be furnished upon initial enrollment and 
revalidation in a form and manner and at such time as determined by the 
Secretary.
    Comment: A commenter stated that when a health care organization 
(such as a hospital) submits and/or obtains affiliation data on behalf 
of a physician it employs, the legal responsibility for this should 
shift to the physician, for the hospital is dependent on the physician 
to furnish accurate information; in other words, the individual 
physician should be held accountable for providing accurate enrollment 
information. The commenter further recommended that there be--(1) an 
opportunity for the health care entity to work with the physician to 
correct the information, and (2) an appeals process for denials.
    Response: The provider or supplier is solely responsible for 
ensuring the accuracy and completeness of enrollment data it furnishes 
to Medicare, Medicaid, or CHIP under parts 424 and 455. It cannot shift 
this burden to another party. This is current CMS policy and will 
remain so with respect to Sec.  424.519. We also believe that the 
provider and supplier should work with the affiliate to confirm the 
accuracy of the information prior to submitting it, although the 
provider or supplier may appeal any subsequent denial or revocation 
under part 498.
    Comment: A commenter stated that the proposed rule was an excellent 
way to discourage fraud and waste in the health care system through a 
stricter Medicare enrollment process. The commenter stated that our 
proposals regarding the denial or revocation of enrollment before 
making payments could prevent fraudulent activities and abuses from 
occurring, which can be more efficient than later tracking down false 
claims and fraudulent providers. While expressing support for the rule, 
the commenter stated that it--(1) could impose a massive burden on 
doctors and providers; and (2) should include clear directions, 
guidance, and resources for identifying, evaluating and reporting 
partnership histories.
    Response: We appreciate this comment, which we believe pertains 
largely to our affiliation provisions. We recognize that there may be 
operational concerns associated with our affiliation policies, and we 
will provide subregulatory guidance to address the matters raised in 
the commenter's final sentence.
    Comment: A commenter believed that Sec.  424.519 would require a 
change to the Disclosure of Ownership and Control Interest forms that 
Medicaid Managed Care Organizations (MCO) must send to their providers 
through the MCO contracts' flow-through of the federal provision. The 
commenter recommended that the proposal be for the proactive collection 
of information only during the initial credentialing or re-
credentialing process. The commenter also requested CMS' support in 
encouraging states to share their collected information with MCOs, when 
applicable.
    Response: We will work with the states and MCOs to ensure the 
effective implementation of this rule as it pertains to Medicaid.
    Comment: A commenter sought clarification regarding--(1) the types 
of verifications that would be required when providers disclose 
affiliations with organizations other than hospitals and clinics; (2) 
how often a provider would be required to notify all of its affiliate 
organizations that it has a new interest or ownership in another 
Medicare or Medicaid provider or supplier; (3) whether entities would 
be required to disclose to other organizations that they do not have 
any current CMS sanctions or actions against them; (4) what would 
constitute sufficient documentation of the provider's enrollment status 
(that is, in ``good-standing'' or not) of an organization or affiliated 
entity; and (5) what information, if any, would organizations be 
required to provide to each other for purposes of verifying current or 
past affiliations to ensure that provider enrollment applications are 
completed correctly.
    Response: The specific means of securing such data will depend on 
the surrounding circumstances, the provider's or supplier's operations, 
and the likely number of affiliations to research, although such means 
could include reviewing internal records and contacting affiliates. 
These are mechanisms that providers and suppliers currently use in 
acquiring information about, for instance, indirect owners and 
corporate directors.
    This rule does not require the regular exchange or updating of 
information between providers and suppliers and their affiliates. It 
only requires the provider's or supplier's disclosure of data upon 
initial enrollment and revalidation.
    Comment: A commenter requested that CMS include language in the 
final rule (presumably in the regulatory text) to clearly confirm that 
providers would not have to report new or changed information regarding 
past affiliations except as part of a revalidation application.
    Response: As stated earlier, we are removing proposed Sec. Sec.  
424.519(h)(1) and (h)(2)(i) and 455.107(h) in this final rule with 
comment period.
    Comment: A commenter suggested the following alternative to our 
disclosure provisions (1) providers and suppliers (and all applicable 
owners, partners, officers, directors, and managing employees) must 
report whether they have had any disclosable events, though this 
disclosure would not extend to other providers and suppliers when an 
initial or revalidation application is submitted; (2) CMS and/or the 
states would review the information disclosed, confirm its accuracy, 
and determine whether it raises an undue risk of fraud, waste, or 
abuse--either for the disclosing provider or supplier or any other 
provider or supplier with which they may be affiliated; and (3) if an 
undue risk is found, CMS could query the disclosing provider or 
supplier for additional information about their affiliation 
relationships. The commenter stated that this would meet the 
requirements of section 1866(j)(5) while eliminating the need for 
providers and suppliers to continuously monitor their affiliations and 
those of their owners, officers, directors, partners, and managing 
employees for potential disclosable events. Another commenter stated 
that if CMS determines that a provider or supplier failed to report a 
disclosable affiliation, CMS should, before taking any action--(1) 
notify the provider or supplier of the disclosable event; and (2) give 
it the opportunity to explain the basis for the failure to disclose.
    Response: We appreciate these comments. We note that we have 
removed proposed Sec. Sec.  424.519(h)(1) and (h)(2)(i) and 455.107(h) 
from this final rule with comment period, which we believe will 
eliminate much of the burden of regularly tracking and reporting new or 
changed information. We disagree, however, with suggestions that we 
should never take action prior to querying the provider or supplier 
about a detected undue risk or a failure to report a disclosable 
affiliation. We believe we must be able to act promptly to protect 
Medicare, Medicaid, and CHIP against threats to these programs. We 
reiterate, though, that the provider or supplier may appeal any denial 
or revocation; moreover, failure to report a disclosable affiliation 
will not automatically result in a denial or revocation if, for 
instance--(1) the affiliation poses no undue risk; and (2) the failure 
to disclose was based on an honest inability to obtain the relevant 
information.

[[Page 47821]]

    Comment: Several commenters believed that our proposal violates 
basic constitutional principles because it implies ``guilt by 
association.'' One commenter stated that due process requires that 
those accused of a crime have the opportunity to respond to those 
allegations before guilt or innocence is pronounced and sanctions are 
imposed. The commenter stated that--(1) mere affiliation with those who 
have been found guilty of criminal behavior is not enough and that they 
themselves must have also been found guilty of such behavior; (2) the 
proposed regulation assumes that all individuals or organizations 
associated with parties that have violated the law or engaged in 
suspicious behavior have themselves also violated the law. Another 
commenter contended that CMS is ``punishing'' providers based on the 
parties with whom they choose to affiliate yet over whom they have no 
control. The commenter stated that it would be impossible for CMS to 
ensure that enrollees are accurately reporting their affiliations and 
disclosable events, short of ``spying'' on enrollees and tracking their 
public accounts; to ensure compliance with this provision, the 
commenter continued, CMS would have to employ means that trespass upon 
the privacy of providers and suppliers and approach unconstitutional 
practices. Other commenters contended that it would be unfair to punish 
parties who may have only had marginal relationships with other parties 
that have or had disclosable events, with several commenters 
questioning the constitutionality of this and the impact on due 
process.
    Response: We respectfully disagree that our proposal implies guilt 
by association. We believe that section 1866(j)(5) of the Act and 
Sec. Sec.  424.519 and 455.107 of the regulations are clear that the 
core issue is whether the affiliation itself, rather than the enrolling 
or enrolled provider or supplier, poses an undue risk of fraud, waste, 
or abuse. In other words, these provisions focus on whether certain 
relationships present risks; they do not automatically ascribe 
nefarious behavior to the provider or supplier. Our recognition that 
most affiliations may not pose such risks is reflected in our earlier 
statement that we will only take action under Sec.  424.519 or Sec.  
455.107 after careful consideration of the facts and circumstances. We 
have further acknowledged that some data may be difficult to secure. 
Given that we have also taken steps to reduce the reporting burden on 
providers and suppliers and that denied or revoked enrollments may be 
appealed, we believe that our disclosure provisions contain sufficient 
due process and fairness safeguards for providers and suppliers.
    Comment: A commenter expressed concern that our proposal could 
discourage co-ownership arrangements between health care entities and 
providers, which could negatively impact team-based delivery of health 
care.
    Response: We do not believe our affiliation provisions will 
discourage co-ownership arrangements, particularly since we have stated 
that the denial, revocation, or termination authority under Sec.  
424.519 or Sec.  455.107 will be invoked only after careful 
consideration. We also note that providers and suppliers are currently 
required to report certain ownership and managerial relationships and 
any associated adverse action history.
    Comment: A commenter recommended that CMS exempt referral-dependent 
specialties from our proposal, stating that such providers would have 
to obtain, maintain, and submit information regarding many 
relationships. Another commenter suggested that the disclosure 
requirements be tailored toward higher-risk provider and supplier 
categories, similar to the screening requirements in Sec.  424.518.
    Response: We do not believe that certain provider and supplier 
types should be automatically exempt from Sec.  424.519. Affiliations 
can pose risks regardless of the provider or supplier type involved. 
Further, excluding particular provider or supplier types would, in our 
view, be inconsistent with the statute, which we interpret as applying 
to all providers and suppliers submitting an initial or revalidation 
application. As mentioned previously, however, we have revised Sec.  
424.519(b) such that we will undertake a ``phased-in'' approach that 
initially (though not exclusively or permanently) targets potentially 
high risk providers or suppliers, for which CMS believes that at least 
one affiliation could apply.
    Comment: A commenter expressed concern that--(1) CMS, its 
contractors, and Medicaid, and CHIP state programs would apply aspects 
of our proposal inconsistently, and (2) the affiliation requirement 
would greatly increase the number of applications submitted to these 
entities, resulting in processing delays and errors. The commenter 
urged CMS to issue clear guidance to all stakeholders regarding the 
processing of such applications and how the disclosure and risk factors 
would be applied.
    Response: CMS and the states will take steps to ensure that undue 
risk determinations are made consistently and that sufficient guidance 
is disseminated to relevant stakeholders.
    Comment: A commenter stated that radiologists are commonly involved 
in reassignment agreements involving imaging facilities and referring 
providers. The commenter expressed concern that the proposed rule could 
cause sweeping changes to these agreements.
    Response: We respectfully disagree with this comment, which we 
believe pertains to our affiliation provisions. Nothing in this rule 
prohibits providers and suppliers from engaging in reassignment 
relationships. Insofar as the definition of ``affiliation'' in Sec.  
424.502 includes reassignments, we do not believe that the reporting 
requirements in revised Sec.  424.519(b) will significantly alter 
reassignment relationships. This is particularly true given that CMS 
requests for disclosable affiliation data will be made only--(1) upon 
initial enrollment and revalidation; and (2) to providers and suppliers 
that CMS has determined may have one or more disclosable affiliations.
    Comment: A commenter contended that CMS exceeded its statutory 
authority under section 1866(j)(5) by proposing to--(1) revoke 
providers and suppliers under Sec.  424.519; and (2) require the 
submission of new or changed data. Another commenter stated that the 
mandate in section 1866(j)(5) was exceeded because the latter only 
requires a provider to report an affiliation with a provider that has a 
reportable event; that is, the statute only requires that a provider 
disclose whether its close affiliates have had a disclosable event.
    Response: Concerning revocations, as we stated in the proposed 
rule, section 1866(j)(5)(A) of the Act references a revalidation 
application, which can only be submitted by an enrolled provider or 
supplier. Having the ability to revoke the enrollment of providers or 
suppliers with affiliations posing an undue risk is necessary to 
protect the integrity of the Medicare program. Thus, we interpret the 
statute as applying to both enrolled providers and suppliers and those 
applying for enrollment. As for new or changed information, we have 
removed proposed Sec. Sec.  424.519(h)(1) and (h)(2)(i) and 455.107(h) 
so as to limit the burden on providers and suppliers. Regarding the 
suggestion that the statute only requires disclosures with respect to 
``close affiliates,'' we note that section 1866(j)(5)(A) of the Act 
expressly applies to both direct and

[[Page 47822]]

indirect affiliations. In sum, we believe that Sec. Sec.  424.519 and 
455.107 are consistent with section 1866(j)(5) as well as our general 
rulemaking authority under sections 1102 and 1871 of the Act.
    Comment: A commenter questioned whether a provider that is 
revalidating its enrollment in 2017 and has an affiliated provider that 
had a 2015 debt that has been repaid would be required to report the 
debt, since the affiliation existed within the previous 5 years.
    Response: This scenario would not involve a disclosable affiliation 
because the debt has been repaid. It is no longer an uncollected debt 
for purposes of our affiliation requirements.
    Comment: Several commenters stated that CMS should consider the 
potential impact that this rule's reporting burden would have on 
beneficiary access to care.
    Response: We believe that our previously referenced modification to 
Sec.  424.519(h) and removal of proposed Sec.  455.107(h) will 
alleviate any concerns regarding access to care by limiting the burden 
on providers and suppliers, hence allowing more time to treat patients. 
Rather than having to regularly track, monitor, and report new and 
changed affiliation data, providers and suppliers will only need to 
disclose affiliation information in the limited circumstances outlined 
in Sec.  424.519(b) or Sec.  455.107(b).
    Comment: Several commenters expressed concern that providers and 
suppliers may have to establish new employment screening processes to 
help identify and determine whether its physicians, managing employees, 
etc., may have disclosable affiliations. One commenter questioned 
whether providers will be afforded any protection in the reporting 
process when such individuals or organizations furnish false or 
incomplete representations to the provider. Another commenter stated 
the affiliations proposal could negatively impact managers of providers 
by effectively requiring them to examine prospective employees well 
beyond what normal procedures would mandate.
    Response: Our affiliation provisions do not require providers and 
suppliers to undertake or increase employment screening practices. Any 
decision to do so lies solely within the provider's or supplier's 
discretion. The provider or supplier is ultimately responsible for 
furnishing accurate information to CMS or the state irrespective of the 
source of the data.
    Comment: A commenter requested clarification that--(1) disclosures 
are only required when submitting an initial or revalidating Form CMS-
855 application; and (2) disclosures are not required when a change of 
information or change of ownership is reported on the Form CMS-855.
    Response: Disclosures are only required--(1) upon initial 
enrollment and revalidation; (2) if Sec.  424.519(b) or Sec.  
455.107(b) applies to the provider or supplier; and (3) if CMS or a 
state asks the provider or supplier to disclose affiliation 
information. Also, for reasons explained previously, we are not 
finalizing proposed Sec. Sec.  424.519(h)(1) and (h)(2)(i) and 
455.107(h).
    Comment: A commenter recommended that emergency physicians be 
excluded from our affiliation disclosure provisions. The commenter 
stated that many emergency medicine practices are very large with 
multiple affiliations, most of which are unbeknown to the individual 
emergency physicians on staff. The commenter recommended that if CMS 
does not exempt emergency physicians from the affiliation provisions, 
CMS should clarify the following issues: (1) Whether an emergency 
physician who leaves one emergency medicine practice to join another 
such practice is required to know the affiliations of his or her former 
employer; (2) if the answer to the first question is yes, how the 
physician would learn of the former employer's affiliations in order to 
disclose them; (3) what mechanisms exist to require the physician's 
former employer to disclose its affiliations to the physician; and (4) 
which party--the physician or the new practice he or she is joining--
would be liable if the physician's former employer had affiliations 
that were not disclosed and reported on the physician's enrollment 
application.
    Response: As stated previously, we do not believe certain provider 
or supplier types should be automatically and permanently exempt from 
Sec.  424.519. Regarding the remaining comments, and as already 
explained, it is the provider's or supplier's responsibility to report 
all affiliations pursuant to Sec.  424.519(b). We stress, though, that 
only the provider's or supplier's affiliations would need to be 
disclosed, not the affiliations of an unrelated party.
    Comment: A commenter stated that any previous affiliation with a 
Medicare, Medicaid, or CHIP provider should be disclosed to CMS for 
review and approval. If CMS determines that one of the associated 
providers previously committed fraud while employed as a managing 
partner, owner, or stakeholder, the provider should not be allowed to 
furnish CMS-covered services in the future.
    Response: We appreciate this comment and believe that our finalized 
affiliation provisions will assist us in protecting Medicare, Medicaid, 
and CHIP against the behavior and relationships the commenter 
describes.

B. Other Proposed Provisions Affecting the Medicare Program Only

    Except as noted otherwise, the legal authorities for our proposed 
provisions in section II.B. of this final rule with comment period are 
as follows. First, section 1866(j) of the Act states that the Secretary 
shall establish by regulation a process for the enrollment of providers 
of services and suppliers. Second, sections 1102 and 1871 of the Act 
give the Secretary the authority to establish requirements for the 
efficient administration of the Medicare program.
1. Revoked Under Different Name, Numerical Identifier, or Business 
Identity
    We proposed in new Sec.  424.530(a)(12) that CMS may deny a 
provider's or supplier's Medicare enrollment application if CMS 
determines that the provider or supplier is currently revoked under a 
different name, numerical identifier, or business identity, and the 
applicable reenrollment bar period has not expired. Likewise, we 
proposed in new Sec.  424.535(a)(18) that CMS may revoke a provider's 
or supplier's Medicare enrollment if CMS determines that the provider 
or supplier is revoked under a different name, numerical identifier, or 
business identity.
    As discussed in section II.A.1.a. of the proposed rule, we have 
identified instances where a provider or supplier has its Medicare 
enrollment revoked but tries to evade the revocation and reenrollment 
bar by opening a new provider or supplier organization to effectively 
``replace'' the revoked entity. In the previously mentioned November 
2008 OIG Early Alert Memorandum, the OIG indicated that some providers 
and suppliers operate ``fronts,'' whereby associates, family members, 
or other individuals pose as owners or managers of the entity on behalf 
of the persons who actually operate, run, or profit from the business. 
We proposed to add new Sec. Sec.  424.530(a)(12) and 424.535(a)(18) to 
address this type of behavior.
    In determining whether a provider or supplier is in fact a 
currently revoked provider or supplier under a different name, 
numerical identifier, or business identity, CMS proposed to investigate 
the degree of commonality by considering the following factors:
     Owning and managing employees and organizations, 
regardless of whether

[[Page 47823]]

they have been disclosed on the Form CMS-855 application (since the 
definitions of ``owner'' and ``managing employee'' in Sec.  424.502 do 
not require the individual or organization to be listed on the Form 
CMS-855 in order to qualify as such).
     Geographic location (for example, same city or county).
     Provider or supplier type (for example, same provider 
type).
     Business structure.
     Any evidence indicating that the two parties are similar 
or that the provider or supplier was created to circumvent the 
revocation or the reenrollment bar.
    We stated that it should not be assumed that having different 
owners, locations, or business structures would automatically result in 
a finding that the two are not the same. CMS would consider any 
evidence indicating that the entities are effectively identical or that 
the new entity was established to avoid the revocation or reenrollment 
bar. Thus, even if several factors suggest that the entities may be 
distinct, we would reserve the right to apply Sec.  424.530(a)(12) or 
Sec.  424.535(a)(18) if we find evidence of evasion.
    We further stated that we would invoke the latter two provisions 
without requiring a separate finding that the revoked entity, the newly 
enrolling entity, or the currently enrolled entity (as applicable) 
poses an undue risk of fraud, waste, or abuse. This is because--(1) we 
were not relying upon section 1866(j)(5) of the Act as authority for 
these two provisions, and (2) we believe that behavior designed to 
evade the reenrollment bar poses an inherent risk. We instead relied 
upon our general rulemaking authority in sections 1102 and 1871 as well 
as section 1866(j) of the Act, which provides specific authority 
concerning the enrollment process for providers and suppliers.
    We received the following comments regarding our proposal:
    Comment: A commenter asked whether--(1) an ``attempt to evade'' 
standard regarding parties that open a new provider organization to 
replace a revoked entity actually applies; or (2) it is automatically 
determined that if the two involved businesses meet the ``commonality'' 
test, the new provider is attempting to evade the revocation or 
enrollment bar.
    Response: As indicated in the factors listed in Sec. Sec.  
424.530(a)(12) and 424.535(a)(18), evidence of deliberate circumvention 
will be only one of several criteria we will consider in determining 
the degree of commonality. Depending upon the specific facts of the 
case, we may still determine that the two parties are sufficiently 
similar if the other factors suggest as much.
    Comment: A commenter contended that CMS must carefully evaluate 
situations where a supplier is reorganizing its business and not 
automatically determine that the supplier intends to commit fraud. The 
commenter stated that suppliers may add new locations or consolidate 
locations to better manage their business.
    Response: We agree with the commenter, and in each case we will 
review all of the circumstances in determining whether action under 
Sec.  424.530(a)(12) or Sec.  424.535(a)(18) is warranted.
    After consideration of the comments received, we are finalizing 
Sec.  424.530(a)(12) and Sec.  424.535(a)(18) as proposed.
2. Non-Compliant Practice Location
    We proposed in new Sec.  424.535(a)(20) that we may revoke a 
provider's or supplier's Medicare enrollment--including all of the 
provider's or supplier's practice locations, regardless of whether they 
are part of the same enrollment--if the provider or supplier billed for 
services performed at or items furnished from a location that it knew 
or should reasonably have known did not comply with Medicare enrollment 
requirements.
    As explained in the proposed rule, we have identified examples of 
providers and suppliers operating from multiple practice locations 
(either as part of the same enrollment or, for DMEPOS suppliers and 
independent diagnostic testing facilities (IDTFs), through separately 
enrolled locations) of which one or more of the locations does not meet 
Medicare enrollment requirements. For instance, a particular location 
may not be operational, fails to comply with certain DMEPOS or IDTF 
supplier standards, or is otherwise noncompliant. The provider or 
supplier, however, continues to perform services at or furnish items 
from this location (or claims to do so) when it knows or should know 
that the location does not meet Medicare enrollment requirements. We 
have seen this with providers and suppliers operating locations that 
either do not exist or are false storefronts, meaning that the location 
appears legitimate from the outside but is in fact a vacant site or a 
nonmedical business.
    We have conducted site visits uncovering several similar 
situations, and revocations of providers and suppliers locations have 
accordingly ensued. Yet we stressed in the proposed rule that more must 
be done. Providers and suppliers must realize that if they submit 
claims for services or items furnished at or from non-compliant 
locations, they risk not only the revocation of that site but also of 
their other locations. As an illustration, assume that a DMEPOS 
supplier has four separately enrolled locations. The supplier shifts 
one of its locations without notifying Medicare, and the new site is a 
false storefront. The supplier furnishes no items from this location, 
but it submits bills for DME allegedly provided from the site. Under 
our proposal, CMS could revoke this location as well as the three other 
sites. Even if the other sites had different numerical identifiers, 
legal business names, or ownership, we could take action against them 
if there is evidence to suggest that they are effectively under the 
control of similar parties. This is to ensure that providers and 
suppliers do not attempt to circumvent Sec.  424.535(a)(20) by opening 
locations under different identities or with different ``front men'' 
(such as family members).
    We proposed to consider the following factors when determining 
whether and how many of the provider's or supplier's other locations 
should be revoked:
     The reason(s) for and facts behind the location's non-
compliance (for example, false storefront; otherwise non-operational; 
other violation of supplier standards).
     The number of additional locations involved.
     Whether the provider or supplier has any history of final 
adverse actions (as that term is defined in Sec.  424.502) or Medicare 
or Medicaid payment suspensions.
     The degree of risk that the location's continuance poses 
to the Medicare Trust Funds (specifically, the other location(s), 
rather than the non-compliant location).
     The length of time that the non-compliant location was 
non-compliant.
     The amount that was billed for services performed at or 
items furnished from the non-compliant location.
     Any other evidence that we deem relevant to our 
determination.
    We received the following comments regarding this proposal:
    Comment: Several commenters stated that CMS already has the 
authority to revoke enrollment based on the grounds indicated in 
proposed Sec.  424.535(a)(20). The commenters contended that CMS should 
rely upon existing protocols (such as fines, recoupments, and 
revocations) rather than create new revocation mechanisms.

[[Page 47824]]

    Response: The circumstances addressed in Sec.  424.535(a)(20) go 
beyond the mere non-compliance of a single practice location or single 
Medicare enrollment. For instance, suppose a provider has four practice 
locations (A, B, C, and D) under four separate enrollments. The 
provider knows that Location D is non-compliant yet bills for services 
performed there. While Sec.  424.535(a)(5) permits the revocation of 
the enrollment associated with Location D, it does not explicitly 
address the potential revocation of the provider's other three 
enrollments associated with Locations A, B, or C, respectively. 
However, Sec.  424.535(a)(20) will emphasize that the provider and all 
of its locations can be revoked (in other words, all of the enrollments 
associated with the practice locations). In short, we do not believe 
our existing regulations sufficiently address this type of arrangement 
and that additional clarification is needed.
    Comment: Several commenters expressed concern about CMS' proposed 
ability under Sec.  424.535(a)(20) to revoke the provider's other 
locations if there is evidence to suggest that they are effectively 
under the control of similar parties. Two of the commenters stated that 
this disregards corporate formalities without evidence of wrongdoing by 
the providers. Two other commenters suggested that CMS apply the 
proposed undue risk standard in determining whether other locations 
should be revoked under Sec.  424.535(a)(20).
    Response: We do not believe a provider should be able to avoid the 
revocation of its other locations under Sec.  424.535(a)(20) simply 
because they are, for instance, under different tax identification 
numbers. CMS must be able to take action against the provider's other 
or associated locations if truly warranted under the circumstances in 
order to protect the Medicare program. We emphasize, however, that CMS 
will carefully consider the factors outlined in Sec.  424.535(a)(20) in 
determining whether and/or which other locations should be terminated. 
As previously described, this will include reviewing the degree of risk 
that a particular location's continuance poses to the Trust Funds.
    Comment: A few commenters stated that Sec.  424.535(a)(20)'s 
application should be restricted to cases where the provider has actual 
knowledge of non-compliance or, one of the commenters stated, 
demonstrated gross negligence in failing to monitor the location.
    Response: Providers are responsible for closely monitoring and 
ensuring the compliance of all of their locations at all times. 
Establishing an ``actual knowledge'' or ``gross negligence'' standard 
would, in our view, effectively permit providers to avoid this 
responsibility and the potential application of Sec.  424.535(a)(20).
    Comment: Opposing the proposal as written, a commenter stated that 
the proposed regulatory text did not include language from the preamble 
regarding CMS' intent on stopping providers and suppliers from 
knowingly operating fictitious or otherwise non-compliant locations to 
circumvent CMS policies. The commenter added that a revocation could 
become a permanent blemish (and potentially render an affected 
practitioner virtually unemployable). The commenter recommended that 
CMS revise the regulatory text to limit the authority to revoke 
multiple locations to egregious, fraudulent transgressions.
    Response: We do not believe that language such as ``egregious, 
fraudulent transgressions'' is appropriate for regulatory text. 
However, we reiterate that this provision will be applied in cases 
where the maintenance of the provider's or supplier's other enrollments 
would jeopardize the Medicare Trust Funds.
    Comment: A commenter stated that CMS currently may revoke Medicare 
enrollment under Sec.  424.535(a)(1) if the provider is determined to 
not be in compliance with the enrollment requirements applicable for 
its provider or supplier type, and has not submitted a plan of 
corrective action as outlined in part 488 of this chapter. The 
commenter stated that by adding more revocation authorities, CMS seeks 
to circumvent the existing regulatory scheme, which permits providers 
to submit a plan of correction for violations of Medicare requirements.
    Response: The addition of Sec.  424.535(a)(20) and other revocation 
reasons in the rule are not intended to circumvent part 488. Nothing in 
Sec.  424.535(a) prohibits a certified provider or certified supplier 
from submitting a part 488 plan of correction under the provisions of 
that part. This does not mean, however, that we cannot take revocation 
action even if such plan is submitted (except as stated in Sec.  
424.535(a)(1)). Moreover, providers and suppliers are ensured due 
process through their right to appeal any revocation under part 498.
    Comment: A commenter stated that CMS should clarify that it can 
only take action against different legal entities under paragraph 
(a)(20) if it determines that the sites are exercising a circumvention 
scheme.
    Response: We respectfully disagree because Sec.  424.535(a)(20) is 
not primarily focused on the issue of schemes designed to circumvent 
revocations and reenrollment bars. Rather, Sec.  424.535(a)(20) 
concerns billing for services furnished at or from a non-compliant 
location and whether any of the provider's other locations should be 
revoked as a result.
    Comment: While stating that the proposed factors are reasonable 
considerations, a commenter expressed concern about the possible 
revocation of many or all of a provider's practice locations for minor 
technical instances of non-compliance in a single location. The 
commenter urged CMS to include in the regulatory text the language from 
the proposed rule's preamble indicating that this provision is designed 
primarily to stop providers and suppliers that knowingly operate 
fictitious or otherwise non-compliant locations in order to circumvent 
CMS policies.
    Response: Language that outlines the underlying purpose of (or 
rationale for) a particular regulatory provision is generally not 
included in regulatory text; the latter is typically limited to 
outlining specific requirements or standards. We thus respectfully 
decline to insert the commenter's requested verbiage. Regardless, we 
note again that this provision concerns billing for services furnished 
at or from a non-compliant location and whether any of the provider's 
other locations should be revoked as a result.
    After consideration of the comments received, we are finalizing 
Sec.  424.535(a)(20) as proposed, with the exception of modifying the 
first two sentences of the paragraph. We believe it is necessary to 
clarify that a revocation occurs at the enrollment level, rather than 
the practice location level. We are concerned that paragraph (a)(20), 
as currently written, could be construed as indicating that practice 
locations themselves can be revoked. Accordingly, the first two 
sentences of paragraph (a)(20) will be slightly revised to read as set 
out in the regulatory text.
3. Improper Ordering, Certifying, Referring, or Prescribing of Part A 
or B Services, Items, or Drugs
    In a final rule published in the Federal Register on December 5, 
2014 titled ``Medicare Program; Requirements for the Medicare Incentive 
Reward Program and Provider Enrollment'' (72 FR 72499), we finalized 
Sec.  424.535(a)(8)(ii). Under this provision, CMS may revoke a 
provider's or supplier's Medicare billing privileges if the provider or 
supplier has a pattern or practice of submitting claims that fail to 
meet Medicare requirements such as, but not limited to, the requirement 
that the service be reasonable and necessary.

[[Page 47825]]

The provision is intended to place providers and suppliers on notice 
that they have a legal obligation to submit correct and accurate 
claims; the provider's or supplier's repeated failure to do so, we 
concluded, poses a risk to the Medicare Trust Funds.
    We also published a final rule in the Federal Register (79 FR 
29843) on May 23, 2014, titled ``Medicare Program; Contract Year 2015 
Policy and Technical Changes to the Medicare Advantage and the Medicare 
Prescription Drug Benefit Programs.'' Under Sec.  424.535(a)(14), which 
was finalized in that rule, we may revoke a physician's or eligible 
professional's Medicare billing and prescribing privileges if we 
determine that he or she has a pattern or practice of prescribing Part 
D drugs that fall into one of the following categories:
     The pattern or practice is abusive, represents a threat to 
the health and safety of Medicare beneficiaries, or both.
     The pattern or practice of prescribing fails to meet 
Medicare requirements.
    In the January 10, 2014 proposed rule (79 FR 1917), which resulted 
in the aforementioned May 23, 2014 final rule, we expressed our view 
that the concept behind proposed Sec.  424.535(a)(8)(ii) should extend 
to revoking Medicare enrollment for Part D prescribers who engage in 
abusive prescribing practices. We explained that if a physician or 
eligible professional consistently fails to exercise reasonable 
judgment in his or her prescribing practices, we should be able to 
remove such individuals from the Medicare program in order to protect 
beneficiaries' safety and health, as well as the Medicare Trust Funds.
    Notwithstanding these new safeguards, neither Sec.  424.535(a)(14) 
nor Sec.  424.535(a)(8)(ii) address the improper ordering or certifying 
of Medicare services and items or the prescribing of Part B drugs. We 
have received numerous reports of physicians and eligible professionals 
engaging in abusive or otherwise inappropriate ordering. While the 
particular circumstances of each case have varied, they frequently fall 
within one or more of the following categories--(1) the ordered item or 
service was not reasonable, not necessary, or both; or (2) the 
physician or eligible professional misrepresented his or her diagnosis 
to justify the service or test.
    Such behavior increases the risk of improper payment for 
inappropriate items or services or Part B drugs. It also endangers 
Medicare beneficiaries by unnecessarily exposing them to potentially 
harmful services and tests. As with the threats that abusive 
prescribing and billing pose, we believe that the risks of improper 
ordering, certifying, and referring, as well as the prescribing of Part 
B drugs, must be stemmed in order to protect the Medicare program.
    Accordingly, we proposed in new Sec.  424.535(a)(21) that CMS may 
revoke a physician's or eligible professional's Medicare enrollment (as 
the term ``enrollment'' is defined in Sec.  424.502) if he or she has a 
pattern or practice of ordering, certifying, referring, or prescribing 
Medicare Part A or B services, items or drugs that is abusive, 
represents a threat to the health and safety of Medicare beneficiaries, 
or otherwise fails to meet Medicare requirements. Recognizing that not 
all patterns or practices involve inappropriate behavior, we stated in 
the proposed rule that we would consider the following factors in 
determining whether a pattern or practice of improper ordering, 
certifying, referring, or Part B drug prescribing exists:
     Whether the physician's or eligible professional's 
diagnoses support the orders, certifications, referrals, or 
prescriptions in question.
     Whether there are instances where the necessary evaluation 
of the patient for whom the service, item, or drug was ordered, 
certified, referred, or prescribed could not have occurred (for 
example, the patient was deceased or out of state at the time of the 
alleged office visit).
     The number and type(s) of disciplinary actions taken 
against the physician or eligible professional by the licensing body or 
medical board for the state or states in which he or she practices, and 
the reason(s) for the action(s).
     Whether the physician or eligible professional has any 
history of final adverse actions (as that term is defined in Sec.  
424.502).
     The length of time over which the pattern or practice has 
continued.
     How long the physician or eligible professional has been 
enrolled in Medicare.
     The number and type(s) of malpractice suits that have been 
filed against the physician or eligible professional related to 
ordering, certifying, referring, or prescribing that have resulted in a 
final judgment against the physician or eligible professional or in 
which the physician or eligible professional has paid a settlement to 
the plaintiff(s) (to the extent this can be determined).
     Whether any state Medicaid program or any other public or 
private health insurance program has restricted, suspended, revoked, or 
terminated the physician's or eligible professional's ability to 
practice medicine, and the reason(s) for any such restriction, 
suspension, revocation, or termination.
     Any other information that we deem relevant to our 
determination.
    We received the following comments regarding our proposal:
    Comment: A commenter expressed support for our proposed addition of 
Sec.  424.535(a)(21).
    Response: We appreciate the commenter's support.
    Comment: A commenter opposed our proposal, stating that it--(1) 
duplicates current safety mechanisms; (2) interferes with the long 
history of states regulating the licensure process; and (3) adds 
another layer of bureaucracy and administrative costs to the program. 
The commenter added that CMS is inappropriately suggesting that a 
medical liability lawsuit is somehow equivalent to liability without 
regard for the lawsuit's outcome. The commenter stated that--(1) there 
are many ways in which physicians could be named in a medical liability 
suit, regardless of whether there is any evidence of negligence; and 
(2) many liability insurers settle cases with little to no merit.
    Response: We respectfully disagree with the commenter's 
contentions. First, Sec.  424.535(a)(21) does not duplicate any 
existing Medicare safety mechanisms. Unlike with abusive billing (Sec.  
424.535(a)(8)(ii)) and abusive prescribing of Part D drugs (Sec.  
424.535(a)(14)), we currently lack the authority to take enrollment 
action against patterns or practices of abusive ordering or certifying 
of Medicare items and services or Part B drugs. This is behavior we 
have seen and against which we must protect the Medicare program. 
Second, we recognize the role of state medical boards in monitoring the 
practice of medicine. Such bodies, however, operate independently of 
CMS. They play no role in overseeing the Medicare program, a 
responsibility that rests with CMS. As such, we must be able to rapidly 
take protective measures without having to wait for possible action by 
state licensing boards or other bodies.
    We do not believe this provision adds layers of bureaucracy. It is 
simply a further regulatory protection for the Medicare program. 
Concerning medical liability lawsuits, we currently consider this 
criterion in determining whether a revocation under Sec.  
424.535(a)(14) is warranted, and we are duplicating this factor in 
Sec.  424.535(a)(21). We emphasize, however, that it is only one of 
several factors we will consider in

[[Page 47826]]

our determination; it is not alone dispositive.
    After consideration of the comments received, we are finalizing 
Sec.  424.535(a)(21) as proposed.
4. Reenrollment and Reapplication Bar Period
a. Reenrollment Bar
    Under Sec.  424.535(c), if a provider, supplier, owner, or managing 
employee has their billing privileges revoked, they are barred from 
participating in Medicare from the date of the revocation until the end 
of the reenrollment bar. The reenrollment bar begins 30 days after CMS 
or its contractor mails notice of the revocation. It lasts a minimum of 
1 year, but not greater than 3 years, depending on the severity of the 
basis for revocation.
    We proposed the following changes to Sec.  424.535(c):
    First, we proposed to incorporate the existing version of Sec.  
424.535(c) into a new paragraph (c)(1) that would increase the current 
maximum reenrollment bar from 3 years to 10 years (excluding the 
situations described in new paragraphs (c)(2) and (3), discussed later 
in this section of this final rule with comment period). We stated in 
the proposed rule that it would be reasonable in certain cases to 
prevent a provider or supplier from participating in Medicare for 
longer than 3 years. Indeed, certain behavior could prove so harmful to 
Medicare, its beneficiaries, and/or the Trust Funds that a very lengthy 
bar from Medicare is warranted. We believed that a 10-year maximum 
timeframe is appropriate, both to--(1) ensure that providers and 
suppliers engaging in such activities are kept out of Medicare; and (2) 
deter others from potentially duplicating this behavior. We chose 10 
years because there is precedent for this period; under Sec.  
424.535(a)(3)(iii), it constitutes the minimum revocation timeframe for 
providers that have been convicted of multiple felonies. However, we 
did not expect to impose longer reenrollment bars for certain existing 
revocation reasons. Revocations that currently involve only a 1-year 
reenrollment bar, for instance, would not necessarily result in a 
longer period under new Sec.  424.535(c)(1).
    Second, we proposed in new Sec.  424.535(c)(2) that CMS may add up 
to 3 more years to the provider's or supplier's reenrollment bar (even 
if such period exceeds the maximum otherwise allowable under paragraph 
(c)(1)) if CMS determines that the provider or supplier is attempting 
to circumvent its existing reenrollment bar by enrolling in Medicare 
under a different name, numerical identifier, or business identity. We 
stated that such efforts to avoid Medicare rules warrant the provider's 
or supplier's Medicare revocation being for a longer timeframe than was 
originally imposed.
    We noted that the affected provider or supplier could appeal CMS' 
imposition of additional years to the provider's or supplier's existing 
reenrollment bar under Sec.  424.535(c)(2). These appeal rights would 
be governed by 42 CFR part 498. However, they would not extend to the 
imposition of the original reenrollment bar under Sec.  424.535(c)(1); 
they would be limited to the additional years imposed under Sec.  
424.535(c)(2).
    Third, we proposed in new Sec.  424.535(c)(3) that CMS may impose a 
reenrollment bar of up to 20 years if the provider or supplier is being 
revoked from Medicare for the second time. Multiple revocations 
indicate that the provider or supplier cannot be considered a reliable 
partner of the Medicare program. The reenrollment bar under paragraph 
(c)(3) would be in lieu of the reenrollment bar described in paragraph 
(c)(1). We proposed to determine the bar's length by considering the 
following factors--(1) the reasons for the revocations; (2) the length 
of time between the revocations; (3) whether the provider or supplier 
has any history of final adverse actions (other than Medicare 
revocations) or Medicare or Medicaid payment suspensions; and (4) any 
other information that CMS deems relevant to its determination. In 
addition, we proposed to apply paragraph (c)(3) even if the two 
revocations occurred under different names, numerical identifiers, or 
business identities so long as we can determine that the two actions 
effectively involved the same provider or supplier.
    Fourth, we proposed in new Sec.  424.535(c)(4) that a reenrollment 
bar would apply to a provider or supplier under any of its current, 
former, or future business names, numerical identifiers, or business 
identities. We explained that this would help ensure that revoked 
providers and suppliers do not attempt to circumvent a revocation and 
reenrollment bar by changing their name, identity, business structure, 
etc.
    We emphasized in the proposed rule that our sole objective was to 
make certain that unscrupulous providers and suppliers are kept out of 
Medicare for as long as possible.
b. Reapplication Bar
    We also proposed in new Sec.  424.530(f) that CMS may prohibit a 
prospective provider or supplier from enrolling in Medicare for up to 3 
years if its enrollment application is denied because the provider or 
supplier submitted false or misleading information on or with (or 
omitted information from) its application in order to gain enrollment 
in Medicare. This reapplication bar would apply to the individual or 
organization under any current, former, or future name, numerical 
identifier, or business identity.
    The purpose of this proposal was to keep untrustworthy providers 
and suppliers from entering the Medicare program and to forestall 
future efforts to enroll. We explained that the submission of false 
information or the withholding of information relevant to the 
provider's or supplier's enrollment eligibility represents a 
significant program integrity risk. For this reason, and to provide 
consequences for such behavior, we stated that our proposed 
reapplication bar was warranted. When determining the reapplication 
bar's length, we proposed to consider the following factors--(1) the 
materiality of the information in question; (2) whether there is 
evidence to suggest that the provider or supplier purposely furnished 
false or misleading information or deliberately withheld information; 
(3) whether the provider or supplier has any history of final adverse 
actions or Medicare or Medicaid payment suspensions; and (4) any other 
information that we deem relevant to our determination.
c. Comments Received
    We received the following comments regarding our reenrollment bar 
and reapplication bar proposals:
    Comment: A number of commenters opposed our proposed--(1) expansion 
of the maximum reenrollment bar from 3 years to 10 years; and (2) 
establishment of a maximum reenrollment bar of 20 years for a second 
revocation. They believed the proposed bars were excessive and overly 
punitive. Several of them urged CMS to retain the existing 3-year 
reenrollment bar.
    Response: As explained in the proposed rule, we believe it is 
reasonable in certain cases to prevent a provider or supplier from 
participating in Medicare for longer than 3 years. Certain behavior 
could prove so harmful to Medicare, its beneficiaries, and/or the Trust 
Funds that a longer bar from Medicare is justified. Again, we believe 
that the 10-year and 20-year maximum periods are appropriate to--(1) 
make sure that abusive parties are kept out of Medicare; and (2) deter 
others from mirroring such behavior. We emphasize, though, that 10-year 
and 20-year bars (as

[[Page 47827]]

well as other longer bars) will typically be reserved for more serious 
conduct and not be imposed unless determined to be warranted after 
careful consideration of all of the required factors.
    With respect to the maximum 20-year bar for individuals or entities 
that have been revoked a second time, CMS believes that the standard 
appeals process at Part 498 should allow for the resolution of 
``mistaken identity'' cases regarding the first revocation. In other 
words, if a provider or supplier to which CMS applies Sec.  
424.535(c)(3) correctly claims on appeal that a different individual or 
entity was, in fact, the subject of the first revocation, CMS will be 
able modify the re-enrollment bar length such that it only applies to 
the second revocation, pursuant to Sec.  424.535(c)(1). As explained 
below, we are modifying Sec.  498.3(b)(17) to afford appeal rights in 
this scenario.
    Comment: A commenter stated that the proposed rule does not clarify 
the lengths of the reenrollment bars that will be applied to different 
offenses, meaning that reenrollment bars would be determined 
arbitrarily. The commenter, as well as others, urged CMS to provide 
guidelines as to what offenses would merit bans of certain time 
periods. They added that said guidance should be narrowly defined to 
target egregious cases and hold harmless reputable providers.
    Response: We respectfully decline to specify in regulation the 
precise reenrollment bar lengths that will be imposed for particular 
acts. Each case could vary widely, and we must continue to have the 
discretion and flexibility to (consistent with current practice) 
consider all relevant facts, including circumstances that mitigate 
against a longer reenrollment bar.
    Comment: A commenter suggested--(1) a maximum reenrollment bar of 5 
years instead of 10 years; and (2) a bar for a second revocation of 10 
years rather than 20. Another commenter urged a maximum reenrollment 
bar of 6 years with exceptions.
    Response: We appreciate these recommendations. As indicated 
earlier, we believe that the seriousness of certain conduct warrants a 
longer maximum re-enrollment bar. A 5-year or 6-year bar may be 
insufficient to protect the Medicare program in some instances. We 
believe that our 10-year and 20-year maximum bars enable us to address 
various factual situations, including particularly improper or 
fraudulent behavior.
    Comment: Some commenters supported our proposed reenrollment bar 
provisions in Sec.  424.535(c).
    Response: We appreciate the commenters' support.
    Comment: A commenter contended that barring a provider for 10 years 
would only be justified in extreme cases of fraud. Another commenter 
stated that any reenrollment bar should only be imposed when there--(1) 
is sufficient evidence that serves a program integrity goal; and (2) 
are robust due process and appeal rights for the affected provider or 
supplier.
    Response: While we respectfully disagree that a 10-year bar should 
only be warranted in extreme instances of fraud, 10-year timeframes 
will generally be restricted to serious behavior. Concerning the second 
commenter, we believe that every reenrollment bar aids our program 
integrity objectives by prohibiting revoked parties from effectively 
circumventing the revocation by immediately submitting an application 
to reenroll. We note also that providers and suppliers may appeal a 
revocation under Sec.  498.3, thus ensuring due process.
    Comment: A commenter cited CMS's statement in the proposed rule's 
preamble concerning precedent for the 10-year reenrollment bar in 
existing Sec.  424.535(a)(3)(ii) (specifically, a 10-year bar for 
multiple felony convictions). The commenter stated that felony 
convictions involve substantially more due process than the largely 
administrative adjudications addressed under Sec.  424.535(c). The 
commenter contended that Sec.  424.535(a)(3)(ii) is not a precedent for 
the proposed reenrollment bar. Rather, it is a cautionary note about 
the degree of due process that should be afforded to providers before 
such a lengthy ban is imposed. The commenter added that CMS' assurance 
that longer bars would only apply to egregious cases is an inadequate 
substitute for a finding of criminal guilt beyond a reasonable doubt by 
a court of law. Another commenter stated that under 48 CFR 9.406-4, the 
period of debarment for a government contractor generally should not 
exceed 3 years unless there is a violation of the Drug-Free Workplace 
Act of 1988; even in the latter situation, the debarment may not exceed 
5 years.
    Response: The reference to Sec.  424.535(a)(3)(ii) was strictly 
intended to demonstrate a precedent for a 10-year timeframe, not to 
equate felony convictions with all other actions covered under Sec.  
424.535(a). Regardless, we note that serious misconduct can occur 
without a criminal conviction. In fact, many of our revocation reasons 
in Sec.  424.535(a) neither involve criminal behavior nor require a 
judgment of guilt. We reiterate our view that an extended reenrollment 
bar (that is, longer than 3 years) may sometimes be warranted, 
depending upon the facts, circumstances, and scope of the provider's or 
supplier's conduct. Moreover, we--(1) do not believe that significantly 
longer bars should be restricted to felony convictions; and (2) are not 
bound by 48 CFR 9.406-4 and have the discretion to establish a 
reenrollment bar specific to Medicare.
    Comment: A commenter stated that expanding the reenrollment bar 
beyond 3 years may be appropriate under certain limited circumstances 
for program integrity reasons. However, the commenter was concerned 
about the reenrollment bar's application to any current, former or 
future business names, identifiers or business identities. The 
commenter stated that this could lead to an overly broad application to 
well-intentioned and compliant providers and suppliers. The commenter 
urged that CMS--(1) not impose a reenrollment bar across multiple 
providers or suppliers that may be affiliated with a provider or 
supplier, but which had no knowledge of the behavior leading to the 
bar; and (2) allow flexibility in extenuating circumstances that 
appropriately balances program integrity risk with community need.
    Response: Section 424.535(c)(4) is designed to prevent situations 
where a provider or supplier is revoked and under a reenrollment bar, 
and then changes its name to circumvent both sanctions. In cases where, 
for instance, a provider or supplier is revoked based on an affiliation 
with another revoked provider or supplier, each revocation is treated 
separately. Both revoked providers, moreover, should be subject to a 
reenrollment bar to prevent an immediate reenrollment and consequent 
circumvention of their revocation, though it should not be assumed that 
both bars will be the same length. We will carefully review the 
circumstances of each revocation on its own merits and facts in 
determining the appropriate bar for that provider; as the commenter 
suggests in its second comment, we will balance various considerations 
in establishing bars.
    Comment: A commenter opposed the extension of the maximum re-
enrollment bar if the affiliation disclosure provisions are finalized. 
The commenter stated that a 10-year reenrollment bar is too drastic 
given the extreme difficulty of complying with the reporting 
requirements in certain circumstances.

[[Page 47828]]

    Response: We have stated in this final rule with comment period our 
rationale for the 10- and 20-year reenrollment bars. We will make 
certain, however, that the length of the imposed re-enrollment bar is 
proper for the behavior involved by considering all relevant facts and 
circumstances.
    Comment: A commenter recommended that CMS establish a specific 
reenrollment bar for each revocation reason. Citing examples, the 
commenter stated that if a site survey found the supplier to be non-
compliant and the supplier is appealing the revocation, 3 or 5 years 
would be an appropriate period; if an owner of the supplier is found 
guilty of a felony, the commenter stated, a 10-year period would be 
more appropriate.
    Response: We appreciate the commenter's suggestions and examples. 
As previously stated, however, each case may differ widely. We must 
have the flexibility to consider every situation on its own merits 
rather than be compelled to impose certain reenrollment bar lengths for 
particular actions.
    Comment: Several commenters stated that--(1) a 3-year reenrollment 
or reapplication bar is adequate only in egregious cases of intentional 
fraud, submission of false claims, or other instances that CMS 
specifically identifies; (2) any bar should be removed or shortened if 
the provider eliminates its affiliation with an organization or 
individual that had a disclosable event; and (3) CMS should only bar 
reenrollment and reapplication if a provider's actions or omissions 
were intentional and material.
    Response: We respectfully disagree with the commenters' first and 
third contentions regarding reenrollment bars. A 3-year reenrollment 
bar for the conduct described may often be too short. Such providers 
and suppliers should not be permitted to reenter Medicare to 
potentially repeat their behavior after such a comparatively brief 
timeframe; the Medicare Trust Funds and Medicare beneficiaries must be 
protected for as long as possible. Further, as already mentioned, any 
failure to impose a reenrollment bar for a revocation would undercut 
the latter action since the provider could otherwise immediately 
resubmit an application for reenrollment. As for the second contention, 
we note that a provider or supplier under Sec.  424.535(e) may avoid a 
revocation and associated reenrollment bar if it terminates (and 
submits proof that it has terminated) its business relationship with 
the applicable party within 30 days of the revocation notification. If 
said affiliation relationship does not fall within the confines of 
Sec.  424.535(e), CMS considers the scope of the relationship in 
determining whether an undue risk exists under Sec.  424.519(f) and, by 
extension, the appropriate length of any reenrollment bar.
    Regarding the reapplication bar, evidence of intent and the 
information's materiality are factors that we will consider in our 
determination. Certainly, evidence of purposeful falsification of 
crucial data will warrant a longer reapplication bar. Given the various 
factual scenarios that could arise and the need for flexibility in our 
determinations, however, we believe it is imprudent to explicitly 
require evidence of intent and materiality before a bar is imposed.
    After consideration of the comments received, we are finalizing our 
proposed reenrollment bar and reapplication bar provisions. However, we 
believe that two minor technical edits to Sec. Sec.  405.800 and 
498.3(b)(17) are necessary to ensure that appeal rights are available 
under Part 498 regarding additional years applied under Sec.  
424.535(c)(2)(i) to any existing reenrollment bar.
    First, we are adding a new paragraph (c) to Sec.  405.800 that 
discusses notification to the provider or supplier of additional years 
applied to a provider's or supplier's existing reenrollment bar under 
Sec.  424.535(c)(2)(i). Said notice per Sec.  405.800(c)(1) will 
include the following:
     The reason for the application of additional years in 
sufficient detail to allow the provider or supplier to understand the 
nature of the action.
     The right to appeal in accordance with part 498 of this 
chapter.
     The address to which the written appeal must be mailed.
    In Sec.  405.800(c)(2), we specify that paragraph (c)(1) applies 
only to the years added to the existing reenrollment bar under Sec.  
424.535(c)(2)(i) and not to the original length of the reenrollment 
bar, which is not subject to appeal.
    The language concerning written notice and the contents thereof is 
consistent with that used in Sec.  405.800(a) and (b) regarding denials 
and revocations of enrollment. It is designed to ensure that the 
provider or supplier receives sufficient information regarding the 
action taken. Paragraph (c)(2) is necessary to clarify that the 
original length of the reenrollment bar is not appealable.
    Second, Sec.  498.3(b) outlines matters on which CMS makes initial 
determinations. Paragraph (b)(17) lists among them the determination as 
to whether to deny or revoke a provider or supplier's Medicare 
enrollment in accordance with Sec.  424.530 or Sec.  424.535. To 
clarify the availability of appeal rights, we are reorganizing and 
revising paragraph (b)(17) as follows:
     The existing version of paragraph (b)(17) will be 
redesignated as paragraph (b)(17)(i).
     New paragraph (b)(17)(ii) will state: ``Whether, under 
Sec.  424.535(c)(2)(i) of this chapter, to add years to a provider's or 
supplier's existing reenrollment bar;''
     New paragraph (b)(17)(iii) will state: ``Whether, under 
Sec.  424.535(c)(3) of this chapter, an individual or entity other than 
the provider or supplier that is the subject of the second revocation 
was the actual subject of the first revocation.''
5. Referral of Debt to the United States Department of Treasury
    The Debt Collection Improvement Act of 1996 requires federal 
agencies to refer eligible delinquent debt to the United States 
Department of Treasury-designated Debt Collection Center (DCC) for 
cross-servicing and offset. CMS must refer all eligible debt over 120 
days delinquent for cross-servicing and offset. Prior to sending a debt 
to the Department of Treasury, CMS attempts to recoup it via the 
procedures outlined in CMS Publication 100-06, chapter 4. Generally 
speaking, we refer a debt to the Department of Treasury only if we 
cannot fully recover the debt through our existing procedures. In all 
cases, though, a provider or supplier is given adequate opportunity to 
repay the debt or make arrangements to do so (for example, if eligible 
for an extended repayment plan) before the debt is sent to the 
Department of Treasury.
    We stated in the proposed rule that referral to the Department of 
Treasury may indicate the provider's or supplier's unwillingness to 
repay a debt, which brings into doubt whether the provider or supplier 
can be a reliable partner of the Medicare program. Accordingly, we 
proposed in new Sec.  424.535(a)(17) that CMS may revoke a provider's 
or supplier's Medicare enrollment if the provider or supplier has an 
existing debt that CMS refers to the Department of Treasury. In 
determining whether a revocation is appropriate, we proposed to 
consider the following factors:
     The reason(s) for the failure to fully repay the debt (to 
the extent this can be determined).
     Whether the provider or supplier has attempted to repay 
the debt.
     Whether the provider or supplier has responded to our 
request(s) for payment.
     Whether the provider or supplier has any history of final 
adverse actions

[[Page 47829]]

or Medicare or Medicaid payment suspensions.
     The amount of the debt.
     Any other information that we deem relevant to our 
determination.
    We received the following comments regarding this proposal:
    Comment: A commenter requested that CMS eliminate proposed Sec.  
424.535(a)(17) from the final rule.
    Response: We respectfully disagree. We believe that this provision 
is based upon sound fiscal policy and will help ensure that providers 
and suppliers repay their debts to the Medicare program.
    Comment: A commenter stated that there have been instances where a 
referral of a debt to Treasury occurred--(1) when the debt has been or 
was in the process of repayment through an agreed-upon repayment plan; 
or (2) regarding an individual when a corporate debt had not been 
timely repaid. The commenter requested that CMS clarify when the 
Treasury referral applies to the enrollment determination and to 
identify the remedy for erroneous referrals.
    Response: We appreciate this comment. If a provider's or supplier's 
debt is referred to the Department of Treasury, we may invoke Sec.  
424.535(a)(17) after a careful consideration of the factors stated 
therein. The provider or supplier may appeal the revocation under part 
498. CMS recognizes, however, that some debts could indeed, as the 
commenter suggests, be referred to Treasury incorrectly. We are 
therefore adding the word ``appropriately'' before ``refers'' in Sec.  
424.535(a)(17). This will clarify that only debts that have been 
referred to Treasury correctly will constitute a ground for revocation 
under Sec.  424.535(a)(17).
    After consideration of the comments received, we are finalizing 
Sec.  424.535(a)(17) as proposed with two exceptions. First, as just 
explained, we are adding the word ``appropriately'' before ``refers''. 
Second, we are adding the language ``(to the extent this can be 
determined)'' to the end of the factors enumerated in Sec.  
424.535(a)(17)(ii) (concerning attempts to repay) and (iii) (regarding 
responses to request for repayment). This is to account for the 
possibility that it may occasionally prove difficult to ascertain and 
acquire this information.
6. Failure to Report
    Existing Sec.  424.535(a)(9) permits CMS to revoke the Medicare 
enrollment of a physician, non-physician practitioner, physician group, 
or non-physician practitioner group if the supplier fails to comply 
with Sec.  424.516(d)(1)(ii) or (iii), which requires the supplier to 
report a change in its practice location or final adverse action status 
within 30 days of the change.
    We proposed to expand Sec.  424.535(a)(9) in two ways. First, we 
proposed that CMS may apply Sec.  424.535(a)(9) to all of the reporting 
requirements in Sec.  424.516(d), not merely those in Sec.  
424.516(d)(1)(ii) and (iii). We could thus revoke the Medicare 
enrollment of a physician, non-physician practitioner, physician group, 
or non-physician practitioner group if the supplier fails to report 
either of the following:
     A change of ownership, final adverse action, or practice 
location within 30 days of the change (as required under Sec.  
424.516(d)(1)(i), (ii), and (iii), respectively).
     Any other change in enrollment data within 90 days of the 
change (as required under Sec.  424.516(d)(2)).
    Second, we proposed that CMS may apply Sec.  424.535(a)(9) to the 
reporting requirements in Sec.  410.33(g)(2) (pertaining to IDTFs), 
Sec.  424.57(c)(2) (pertaining to DMEPOS suppliers), and Sec.  
424.516(e) (pertaining to all other provider and supplier types). This 
means we could revoke a provider or supplier under Sec.  424.535(a)(9) 
if any of the following occur:
     An IDTF fails to report a change in ownership, location, 
general supervision, or final adverse action within 30 days of the 
change or fails to report any other change in its enrollment data 
within 90 days of the change.
     A DMEPOS supplier fails to submit any change in its 
enrollment information within 30 days of the change.
     A provider or supplier other than a physician, non-
physician practitioner, physician group, non-physician practitioner 
group, IDTF, or DMEPOS supplier fails to report any of the following:
    ++ A change in ownership or control within 30 days of the change.
    ++ A revocation or suspension of a federal or state license or 
certification within 30 days of the revocation or suspension.
    ++ Any other change in its enrollment data within 90 days of the 
change.
    We contended that our revocation authority under Sec.  
424.535(a)(9) should not be restricted to certain provider and supplier 
types that have omitted reporting a change in practice location or 
final adverse action. Any failure to report changed enrollment data, 
regardless of the provider or supplier type involved, is of concern to 
us. We must have complete and accurate data on each provider and 
supplier to help confirm that the provider or supplier still meets all 
Medicare requirements and that Medicare payments are made correctly. 
Inaccurate or outdated information puts the Medicare Trust Funds at 
risk.
    While we stated that we would retain the discretion to revoke a 
provider's or supplier's enrollment for any failure to meet the 
reporting requirements in Sec.  424.516(d) or (e), Sec.  410.33(g)(2), 
or Sec.  424.57(c)(2), our proposal was focused on significant cases of 
non-reporting. For instance, a provider's belated omission to report a 
ZIP code change until 120 days after the change does not represent an 
equivalent level of program integrity risk as a complete failure to 
report a new practice location. We proposed to consider the following 
factors in determining whether a Sec.  424.535(a)(9) revocation is 
appropriate (1) whether the data in question was reported; (2) if the 
data was reported, how belatedly; (3) the materiality of the data in 
question; and (4) any other information that we deem relevant to our 
determination.
    We received the following comments regarding our proposal:
    Comment: Several commenters expressed concern regarding our 
proposed revision to Sec.  424.535(a)(9). They stated that the proposal 
could allow CMS to revoke providers and suppliers for inadvertent or 
innocent errors or oversights, even if no federal health care program 
reimbursement was involved with the enrollment change that was not 
reported. They added that many reporting failures are mere oversights 
and not indicative of fraud or abuse. They recommended that CMS rescind 
its proposal, believing that revocation in such instances is an overly 
severe penalty.
    Response: We note that we already have the authority to revoke 
providers and suppliers under Sec.  424.535(a)(1) for failing to timely 
report changes of information under, as applicable, Sec. Sec.  
424.516(d), 410.33(g)(2), and 424.57(c)(2). Our revision to Sec.  
424.535(a)(9) simply establishes a dedicated paragraph in Sec.  
424.535(a) to address all information changes, not merely those in 
Sec.  424.516(d)(ii) and (iii). In other words, we have always had 
general authority to revoke for failing to report changes, and this 
rule expands upon that existing authority. The expansion of Sec.  
424.535(a)(9), however, is focused largely on significant cases of non-
reporting, and we will carefully consider several factors, such as the 
data's materiality, in determining

[[Page 47830]]

whether a revocation is appropriate. Yet we must emphasize that we 
still retain the right to revoke under Sec.  424.535(a)(9) for any 
failure to timely report informational changes.
    Comment: A commenter suggested that CMS require advance notice and 
an opportunity for information correction or rebuttal of allegations of 
noncompliance prior to imposing a revocation for a failure to timely 
report a practice location change.
    Response: We believe that a failure to report a practice location 
is a serious matter, especially considering that practice location data 
has a material effect on the accuracy of Medicare payments. Thus, we do 
not believe that advance notice and an opportunity to correct is 
appropriate and stress that the provider or supplier may appeal any 
revocation under part 498. We note further that advance notice and a 
correction opportunity could remove any incentive for providers and 
suppliers to timely report information changes. The provider or 
supplier could simply wait until receiving such notice (assuming that 
CMS even learns of the new or changed data) to disclose the information 
via the Form CMS-855.
    Comment: A commenter stated that while our proposed factors under 
Sec.  424.535(a)(9) were reasonable considerations, they were 
inadequate to protect against the revocation of a provider for trivial 
reasons. The commenter recommended that CMS add to the regulatory text 
the language from the proposed rule's preamble indicating that a 
decision to revoke would be focused on ``egregious'' cases of non-
reporting. Another commenter stated that revoking Medicare enrollments 
under Sec.  424.535(a)(9) should only occur in egregious cases.
    Response: We believe that our proposed factors sufficiently ensure 
that--(1) we will carefully consider all circumstances of the case 
before taking action; and (2) any decision to revoke will not be taken 
lightly. Also, we believe that the language regarding ``egregious'' 
non-reporting is inappropriate for regulatory text.
    Comment: A commenter stated that revocation under Sec.  
424.535(a)(9) should extend only to instances where the unreported 
information was material and the non-disclosure intentional. 
Materiality would thus be the threshold question as opposed to a mere 
factor for consideration. The commenter suggested that materiality 
could be based on whether the failure to report would result in ``undue 
risk'' (as articulated in section 1866(j)(5)) or otherwise would have 
changed the provider's enrollment status. The commenter also requested 
that CMS provide additional examples of what constitutes egregious 
cases of non-reporting.
    Response: We do not believe that materiality should be the 
threshold question, for this would imply that certain information need 
never be reported to CMS. In other words, providers and suppliers might 
assume that they need not comply with our reporting requirements in 
many cases because they would only be revoked for instances involving 
material data. We emphasize that providers and suppliers have a 
continuing obligation to report changes in their enrollment information 
via the Form CMS-855 regardless of the data's relative materiality. In 
addition, we respectfully decline to set forth examples of significant 
non-reporting. The facts of each case may vary greatly, and we must 
retain our flexibility to address and consider particular 
circumstances.
    After consideration of the comments received, we are finalizing our 
proposed revisions to Sec.  424.535(a)(9).
7. Payment Suspensions
    Section 424.530(a)(7) permits the denial of a provider's or 
supplier's Medicare enrollment application if the current owner, 
physician, or non-physician practitioner has been placed under a 
Medicare payment suspension in accordance with Sec. Sec.  405.370 
through 405.372. Under Sec.  405.371, a Medicare payment suspension may 
be imposed if CMS determines that a credible allegation of fraud 
against a provider or supplier exists. The general purpose of a payment 
suspension based upon a credible allegation of fraud is to temporarily 
halt the payment of Medicare Trust Fund dollars to a provider or 
supplier pending the resolution of a particular investigation 
concerning, for instance, whether the provider or supplier has engaged 
in fraudulent activity. CMS also has the authority to impose a payment 
suspension based upon reliable information that an overpayment exists. 
The goal of this type of suspension is to temporarily halt Medicare 
payments while CMS performs subsequent action to determine the 
existence of an overpayment.
    We proposed several revisions to Sec.  424.530(a)(7) and one 
revision to Sec.  405.371.
    First, we proposed to expand the applicability of Sec.  
424.530(a)(7) to--(1) all provider and supplier types; and (2) any 
owning or managing employee or organization of the provider or 
supplier. We stated that the existing scope of Sec.  424.530(a)(7), 
which is limited to owners, physicians, and non-physician 
practitioners, does not address the continuum of program 
vulnerabilities in this area. Indeed, providers and suppliers other 
than physicians and non-physician practitioners are currently not 
prohibited from enrolling in Medicare based on a payment suspension. We 
note further that a managing individual or entity often has as much (or 
more) day-to-day control over a provider or supplier as an owner. In 
our view, automatically allowing a provider or supplier to enroll in 
Medicare even though one of its managing officials or organizations is 
under a payment suspension poses a risk to Medicare and its 
beneficiaries.
    Second, we proposed to include Medicaid payment suspensions within 
the purview of Sec.  424.530(a)(7). Under Sec.  455.23, the state 
Medicaid agency must suspend all Medicaid payments to a provider or 
supplier after the agency determines that there is a credible 
allegation of fraud for which a Medicaid investigation is pending 
(unless the agency has good cause to not suspend payments). We 
contended that there was no significant difference between Medicare and 
Medicaid payment suspensions in terms of the threat posed to federal 
health care program integrity; potentially fraudulent behavior in the 
Medicaid program could be repeated in the Medicare program. We thus 
proposed to be able to prevent such providers and suppliers from 
entering Medicare.
    Third, we proposed to incorporate these revised provisions into a 
new Sec.  424.530(a)(7)(i).
    Fourth, we proposed to establish a new Sec.  424.530(a)(7)(ii) that 
would permit CMS to apply Sec.  424.530(a)(7) to the following:
     Any of the provider's or supplier's or owning or managing 
employee's or organization's current or former names, numerical 
identifiers, or business identities.
     Any of the provider's or supplier's existing enrollments.
    This reflected our previously discussed desire to ensure that 
questionable parties are unable to reenter the Medicare program (be it 
as a provider, supplier, owner, or manager) by using alternate 
identifiers. We were also concerned about situations where the provider 
or supplier has multiple enrollments, including those under different 
names, tax identification numbers, or other identifiers or business 
structures.
    We proposed to consider the following factors in determining 
whether a denial is appropriate:
     The specific behavior in question.

[[Page 47831]]

     Whether the provider or supplier is the subject of other 
similar investigations.
     Any other information that we deem relevant to our 
determination.
    Fifth, we proposed to expand Sec.  405.371 to state that a Medicare 
payment suspension may be imposed if a state Medicaid program suspends 
payment pursuant to Sec.  455.23(a)(1). Again, we expressed concern 
that possible fraudulent behavior in Medicaid might be repeated in 
Medicare.
    We received the following comments regarding these proposals:
    Comment: Regarding our proposal to expand the application of Sec.  
424.530(a)(7), a commenter questioned whether this authority applies if 
the payment suspension is later lifted or reversed.
    Response: Under existing policy, if a Medicare enrollment 
application is denied under Sec.  424.530(a)(7) because of a current 
payment suspension, the application denial is not reversed if the 
payment suspension is later lifted or reversed. Once the suspension 
ends, however, the provider or supplier may submit another initial 
application for enrollment.
    Comment: A commenter expressed concern about denials based on 
terminations or suspensions that are under appeal because the latter 
actions can be caused by administrative or other error. The commenter 
recommended that CMS allow the appeals process to run its course before 
denying an application, stating that--(1) this would be consistent with 
due process; and (2) CMS would retain the ability to revoke the 
provider's enrollment if the appeal is unsuccessful.
    Response: We respectfully disagree. If a provider or supplier has 
potentially engaged in questionable behavior, we should not be required 
to enroll the provider or supplier pending the completion of the 
appeals process or, in the case of payment suspensions, the rebuttal 
process under Sec.  405.374. We must be able to take steps at the 
beginning of the enrollment process to protect the Medicare program, 
the Trust Funds, and beneficiaries from such risks.
    After consideration of the comments received, we are finalizing our 
proposed changes to Sec. Sec.  424.530(a)(7) and 405.371.
8. Other Federal Program Termination
    To further protect Medicare from inappropriate activities occurring 
in other programs, we proposed two changes regarding denials and 
revocations.
a. Denials
    We proposed in new Sec.  424.530(a)(14) that CMS may deny a 
provider's or supplier's Medicare enrollment application if:
     The provider or supplier is currently terminated or 
suspended (or otherwise barred) from participation in a state Medicaid 
program or any other federal health care program; or
     The provider's or supplier's license is currently revoked 
or suspended in a state other than that in which the provider or 
supplier is enrolling.
    Section 455.416(c) states that a Medicaid state agency must deny 
enrollment or terminate the enrollment of any provider that is 
terminated on or after January 1, 2011, under Medicare or the Medicaid 
program or CHIP of any other state. We explained in the proposed rule 
that Sec.  424.530(a)(14) would facilitate consistency with the 
framework of Sec.  455.416(c). Again, a provider's or supplier's 
improper behavior in another federal health care program may be 
duplicated in Medicare. Likewise, a Medicare provider's or supplier's 
actions that led to a license revocation or suspension in one state 
could be repeated with respect to its prospective enrollment in another 
state.
    We stated in the proposed rule that a relevant program or license 
suspension warrants additional scrutiny, for the conduct behind the 
suspension could raise questions concerning the prospective provider's 
or supplier's ability to be a dependable Medicare participant. We 
recognized that license and federal program suspensions are generally 
temporary rather than permanent actions. Under certain conditions, 
however, license suspensions may be imposed for extended periods and 
involve serious transgressions. We believed that in circumstances 
triggering significant program integrity concerns, we should consider 
such conduct and determine the risk it poses before allowing the 
provider or supplier to enroll.
    We stated that Sec.  424.530(a)(14) could apply regardless of 
whether any appeals are pending. We acknowledge that, under current 
Sec.  424.535(a)(12)(ii), we may not revoke a provider's or supplier's 
Medicare enrollment based on a Medicaid termination unless the provider 
or supplier has exhausted all applicable appeal rights regarding the 
Medicaid termination. Yet we did not believe a similar clause should 
apply to Sec.  424.530(a)(14). As discussed earlier regarding license 
or federal program suspensions, Medicaid or other program terminations 
may be indicators of serious transgressions. We thus deemed it 
inappropriate to permit a Medicaid-terminated provider or supplier (or 
a provider or supplier terminated under any federal program) into 
Medicare simply because that party had not yet exhausted its appeal 
rights. In fact, such a clause might encourage the provider or supplier 
to file a frivolous appeal in order to enroll in Medicare prior to the 
exhaustion of its appeal rights.
    In determining whether to invoke Sec.  424.530(a)(14) in a 
particular case, we proposed to consider the following factors:
     The reason(s) for the termination, revocation, or 
suspension.
     Whether, as applicable, the provider or supplier:
    ++ Is currently terminated or suspended (or otherwise barred) from 
more than one program (for example, more than one state's Medicaid 
program);
    ++ Has been subject to any other sanctions during its participation 
in other programs or by any other state licensing boards; or
    ++ Has had any other final adverse actions imposed against it.
     Any other information that we deem relevant to our 
determination.
    Consistent with our previously discussed rationale, we further 
proposed that Sec.  424.530(a)(14) would apply to the provider or 
supplier under any of its current or former names, numerical 
identifiers, or business identities.
b. Revocations
    Under existing Sec.  424.535(a)(12), Medicare may revoke a 
provider's or supplier's enrollment if a state Medicaid agency 
terminates the provider's or supplier's Medicaid enrollment. Similar to 
our discussion concerning Sec.  424.530(a)(14), we proposed to expand 
Sec.  424.535(a)(12)(i) such that CMS may revoke a provider's or 
supplier's Medicare enrollment if the provider or supplier is 
terminated or revoked (or otherwise barred) from participation in any 
other federal health care program. In determining whether a revocation 
is appropriate, we proposed to consider the following factors:
     The reason(s) for the termination or revocation.
     Whether the provider or supplier:
    ++ Is currently terminated, revoked, or otherwise barred from more 
than one program (for example, more than one state's Medicaid program); 
or
    ++ Has been subject to any other sanctions during its participation 
in other programs.
     Any other information that we deem relevant to our 
determination.
    Section 424.535(a)(12)(ii) states that Medicare may not terminate a 
provider's

[[Page 47832]]

or supplier's enrollment unless and until a provider or supplier has 
exhausted all applicable appeal rights. We did not propose to modify 
this provision. We would not revoke a provider's or supplier's 
enrollment under paragraph (a)(12)(i) unless all applicable appeal 
rights relating to the termination have been exhausted.
    In addition, and for reasons previously explained, we proposed to 
add new Sec.  424.535(a)(12)(iii). This would enable us to apply Sec.  
424.535(a)(12)(i) to the provider or supplier under any of its current 
or former names, numerical identifiers, or business identities.
c. Comments Received
    We received the following comments regarding these denial and 
revocation proposals:
    Comment: A commenter stated that CMS should apply penalties only 
after a termination or suspension is final and not while it is being 
appealed. The commenter stated that this is similar to how CMS treats 
revocations.
    Response: We respectfully disagree. As already stated, if a 
provider or supplier has perhaps engaged in questionable behavior, we 
should not be required to enroll the provider or supplier pending the 
completion of the appeals process. We must be able to protect the 
Medicare program, the Trust Funds, and beneficiaries from such risks at 
the beginning of the enrollment process. Waiting to take action until 
the end of a possibly lengthy appeals process could permit the provider 
or supplier to continue its behavior for an extended period. We also 
note that Medicare revocations may be and have been imposed prior to 
the expiration of the applicable Medicare appeals process.
    Comment: A commenter supported our proposal to deny or revoke 
enrollment if the provider or supplier is currently terminated from a 
Medicaid or other federal health care program under any of its current 
or former names, numerical identifiers, or business entities. However, 
the commenter opposed the proposal to deny or revoke enrollment if the 
provider's or supplier's license is revoked in a state other than that 
in which the provider or supplier is enrolled or enrolling.
    Response: We appreciate the commenter's support for our proposal 
addressing program terminations. Concerning out-of-state license 
terminations, we note that these denial and revocation authorities are 
discretionary and will only be exercised after a careful consideration 
of the specified factors. We add that these authorities regarding out-
of-state license terminations are necessary because, once again, 
potentially improper conduct in one state can be repeated in another 
state.
    After consideration of the comments received, we are finalizing new 
Sec.  424.530(a)(14) and revised Sec.  424.535(a)(12) as proposed with 
several exceptions. In Sec.  424.530(a)(14), we are changing the phrase 
``particular State Medicaid program'' to ``State Medicaid program''. We 
believe that elimination of the term ``particular'' will help clarify 
that the provisions refer to any state Medicaid program rather than a 
specific one. In the same section, we are adding ``(as that term is 
defined in Sec.  424.502)'' to Sec.  424.530(a)(14)(i)(B) as a 
reference to the regulatory definition of final adverse actions. As for 
Sec.  424.535(a)(12), we are changing ``particular Medicaid program'' 
to ``State Medicaid program'' for the same reason described above. 
Also, we are changing the term ``terminate'' to ``revoke'' in Sec.  
424.535(a)(12)(ii) to clarify that CMS revokes enrollments.
9. Extension of Revocation
    We proposed in new Sec.  424.535(i) that CMS may revoke any and all 
of a provider's or supplier's Medicare enrollments--including those 
under (1) different names, numerical identifiers, or business 
identities, and (2) different types (for example, an entity is enrolled 
as a group practice via the Form CMS-855B and a DMEPOS supplier via the 
Form CMS-855S--if the provider or supplier is revoked under Sec.  
424.535(a). This proposal was designed to make certain that parties 
that are revoked for inappropriate behavior are not permitted to remain 
enrolled in Medicare in any capacity. Consider the following examples:
     A physician's State X enrollment is revoked because his 
license in X was revoked. Under Sec.  424.535(i), we also could revoke 
the physician's State Y enrollment even if he is still licensed in Y.
     An entity has two enrollments: One via the Form CMS-855A 
as a certified supplier, another via the Form CMS-855B as a group 
practice. The entity's Form CMS-855A enrollment is revoked under Sec.  
424.535(a)(4). Under Sec.  424.535(i), CMS could also revoke the 
organization's Form CMS-855B enrollment, even if that enrollment is in 
another state.
     A non-physician practitioner is enrolled via the Form CMS-
855I (OMB Control No. 0938-0685)) as an individual supplier and as a 
DMEPOS supplier via the Form CMS-855S. The individual's Form CMS-855I 
enrollment is revoked for abusive billing practices. Under Sec.  
424.535(i), CMS could also revoke her Form CMS-855S enrollment.
    In determining whether to revoke a provider's or supplier's other 
enrollments under Sec.  424.535(i), we proposed to consider the 
following factors:
     The reason for the revocation and the facts of the case.
     Whether any final adverse actions have been imposed 
against the provider or supplier regarding its other enrollments (for 
example, licensure suspensions imposed by the state, prior revocations, 
and/or payment suspensions).
     The number and type(s) of other enrollments (for instance, 
Form CMS-855B).
     Any other information that we deem relevant to our 
determination.
    We stated that this provision would not be an ``all or nothing'' 
provision; that is, we would not be required to automatically revoke 
all of the provider's or supplier's other enrollments if we chose to 
invoke Sec.  424.535(i). We would instead apply the previously listed 
factors to each enrollment in determining whether it should be revoked.
    We received the following comments concerning this proposal:
    Comment: A commenter contended that a separate justification for 
extending an enrollment/reactivation bar to related entities should be 
required. This should include, the commenter stated, a requirement that 
the secondary entities be found to pose an undue risk beyond the fact 
that the entity is related to a party that is subject to a warranted 
enrollment/reactivation bar. The commenter added that there should be 
no extension of an enrollment/reactivation bar until all appeals by the 
primary affected entity are concluded.
    Response: We stated in the proposed rule that the factors outlined 
in Sec.  424.535(i) would be individually applied to each location and 
enrollment. We still hold this position. However, we disagree with 
explicitly requiring an undue risk standard for other locations and 
enrollments. Secondary locations and enrollments, in our view, can pose 
as much (or even more) of a threat to the Medicare program as the 
principal ones. Accordingly, they should not be held to a different 
standard (via the undue risk threshold) than the primary locations and 
enrollments. We also do not believe that we should be required to wait 
until all appeals involving the principal location and enrollment have 
been exhausted before taking action against the secondary ones. CMS 
must retain

[[Page 47833]]

the ability to take immediate steps to protect the Medicare program, 
the Trust Funds, and beneficiaries. Delaying action for a potentially 
lengthy period due to an ongoing appeals process would hinder this 
objective.
    After consideration of the comments received, we are finalizing 
Sec.  424.535(i) as proposed.
10. Voluntary Termination Pending Revocation
    As we explained in section II.A. of the proposed rule, we have seen 
instances of providers and suppliers failing to meet Medicare 
requirements or otherwise engaging in improper behavior, and then 
voluntarily terminating their Medicare enrollment to avoid a potential 
revocation of their enrollment and a consequent reenrollment bar. For 
instance, assume that we perform a site visit of a provider's lone 
location. The site does not comply with our requirements. Knowing that 
its Medicare enrollment may soon be revoked, the provider submits a 
Form CMS-855 to voluntarily terminate its enrollment; the purpose, 
again, is to depart Medicare to avoid a formal revocation and 
reenrollment bar and any other consequences stemming therefrom.
    We contended in the proposed rule that such attempts to circumvent 
the revocation process represent a risk to the Medicare program. Not 
only do they reflect dishonesty on the provider's or supplier's part, 
but also that the provider or supplier may be deliberately taking 
advantage of program vulnerabilities because no reenrollment bar has 
been imposed. To this end, we proposed in new Sec.  424.535(j)(1) that 
we may revoke a provider's or supplier's Medicare enrollment if we 
determine that the provider or supplier voluntarily terminated its 
Medicare enrollment in order to avoid a revocation under Sec.  
424.535(a) that CMS would have imposed had the provider or supplier 
remained enrolled in Medicare. This would prevent the provider or 
supplier from avoiding a re-enrollment bar.
    In making our determination, we proposed to consider the following 
factors:
     If there is evidence to suggest that the provider knew or 
should have known that it was or would be out of compliance with 
Medicare requirements.
     If there is evidence to suggest that the provider knew or 
should have known that its Medicare enrollment would be revoked.
     If there is evidence to suggest that the provider 
voluntarily terminated its Medicare enrollment in order to circumvent 
such revocation.
     Any other evidence or information that CMS deems relevant 
to its determination.
    In new paragraph (j)(2), we proposed that a revocation under Sec.  
424.535(j)(1) would be effective the day before the Medicare contractor 
receives the provider's or supplier's Form CMS-855 voluntary 
termination application. We believed this date was appropriate because 
the provider's or supplier's submission of the voluntary termination 
application is the basis for the paragraph (j)(1) revocation. 
Procedurally, the voluntary termination would be reversed (if the 
Medicare contractor processed the application to completion) and the 
provider's or supplier's enrollment would then be revoked.
    Although we received several comments regarding voluntary 
terminations in the context of our proposed affiliation disclosure 
requirements (see section II.A of this final rule with comment period), 
we received no comments specifically pertaining to Sec.  424.535(j). 
Therefore, we are finalizing this proposal.
11. Enrollment for Ordering/Certifying/Referring/Prescribing of All 
Part A and B Services, Items, and Drugs; Maintenance of Documentation
a. Background of Part A and B Enrollment Proposal
    Section 6405(c) of the Affordable Care Act gives the Secretary the 
authority to extend the requirements of section 6405(a) and (b) of the 
Affordable Care Act to all other categories of items or services under 
title XVIII of the Act (including covered Part D drugs) that are 
ordered, prescribed, or referred by a physician or eligible 
professional enrolled under section 1866(j) of the Act. Under this 
authority, existing Sec.  424.507(a) and (b) collectively state that to 
receive payment for ordered imaging services, clinical laboratory 
services, DMEPOS items, or home health services, the service or item 
must have been ordered or certified by a physician or, when permitted, 
an eligible professional who--(1) is enrolled in Medicare in an 
approved status; or (2) has a valid opt-out affidavit on file with an 
Part A/B MAC.
    Section 424.507(a) and (b) were implemented via an April 27, 2012 
final rule titled ``Medicare and Medicaid Programs; Changes in Provider 
and Supplier Enrollment, Ordering and Referring, and Documentation 
Requirements; and Changes in Provider Agreements'' (77 FR 25284). Also, 
in the previously mentioned May 23, 2014 final rule (79 FR 29843), we 
finalized provisions under which the prescriptions of a physician or 
eligible professional who is not enrolled in Medicare and does not have 
a valid opt-out affidavit on file with an A/B MAC would not be covered 
under the Part D program.
    The purpose of the provider enrollment process is to ensure that 
providers and suppliers that furnish services and items to Medicare 
beneficiaries meet all Medicare requirements. We stated in the proposed 
rule that the importance of confirming that all physicians and eligible 
professionals who order, certify, refer, or prescribe Part A or B 
services, items, or drugs (and not simply those services and items 
described in Sec.  424.507) are qualified to do so dictated that we 
expand the purview of Sec.  424.507. To this end, we proposed the 
following changes to Sec.  424.507(a) and (b):
    The heading to paragraph (a) currently reads--``Conditions for 
payment of claims for ordered covered imaging and clinical laboratory 
services and items of durable medical equipment, prosthetics, 
orthotics, and supplies (DMEPOS).'' We proposed to change this to 
state: ``Conditions for payment of claims for ordered, certified, 
referred, or prescribed covered Part A or B services, items, or 
drugs.''
    The heading to existing paragraph (a)(1) reads--``Ordered covered 
imaging, clinical laboratory services, and DMEPOS item claims.'' We 
proposed to change this to state: ``Ordered, certified, referred, or 
prescribed covered Part A or B services, items or drugs.''
    The opening sentence in paragraph (a)(1) currently states in part: 
``To receive payment for ordered imaging, clinical laboratory services, 
and DMEPOS items (excluding home health services described in Sec.  
424.507(b), and Part B drugs)''. We proposed to change this language to 
read: ``To receive payment for ordered, certified, referred, or 
prescribed covered Part A or B services, items or drugs''.
    Paragraph (a)(1)(i) states in part: ``The ordered covered imaging, 
clinical laboratory services, and DMEPOS items (excluding home health 
services described in paragraph (b) of this section, and Part B drugs) 
must have been ordered by''. We proposed to change this language to: 
``The ordered, certified, referred, or prescribed covered Part A or B 
service, item, or drug must have been ordered, certified, referred, or 
prescribed by''.
    In paragraph (a)(2), we proposed to change the heading from ``Part 
B beneficiary claims'' to ``Part A and B

[[Page 47834]]

beneficiary claims.'' We also proposed to change the language that 
states ``To receive payment for ordered covered items and services 
listed at Sec.  424.507(a)'' to ``To receive payment for ordered, 
certified, referred, or prescribed covered Part A or B services, items 
or drugs''.
    In paragraphs (a)(1)(ii) and (iii), and (a)(2)(i), we proposed to 
change the language that reads ``who ordered the item or service'' to 
``who ordered, certified, referred, or prescribed the Part A or B 
service, item, or drug''.
    We proposed to change the existing language in paragraphs 
(a)(1)(iv) and (a)(2)(ii) that reads ``If the item or service is 
ordered by'' to ``If the Part A or B service, item, or drug is ordered, 
certified, referred, or prescribed by''.
    We proposed to revise the existing language in paragraphs 
(a)(1)(iv)(A)(1) and (a)(2)(ii)(A)(1) from ``As the ordering supplier'' 
to ``As the ordering, certifying, referring or prescribing supplier''.
    We proposed to change the current language in paragraphs 
(a)(1)(iv)(B) and (a)(2)(ii)(B) that reads ``order such items and 
services'' to ``order, certify, refer, or prescribe such services, 
items, and drugs''.
    In paragraphs (a)(1)(iv)(B)(1) and (a)(2)(ii)(B)(1), we proposed to 
replace the word ``order'' with ``order, certify, refer, or 
prescribe''.
    We proposed to delete the existing version of paragraph (b), which 
deals with home health services. Such services would be addressed in 
revised paragraph (a). We proposed to redesignate current paragraph (c) 
as revised paragraph (b). We also proposed in this paragraph to--
     Change the language that reads ``covered items and 
services'' to ``ordered, certified, referred, or prescribed Part A or B 
services, items or drugs;''
     Delete ``or (b)'' and ``and (b)'', since the existing 
version of paragraph (b) would be replaced;
     Change ``paragraphs (a)(1)'' to ``paragraph (a)(1)''; and
     Delete ``respectively.''
    We proposed to redesignate current paragraph (d) as revised 
paragraph (c). We also proposed in this paragraph to:
     Change the language that reads ``covered items or 
services'' to ``ordered, certified, referred, or prescribed covered 
Part A or B services, items or drugs''.
     Change the language that states ``paragraphs (a) and (b)'' 
to ``paragraph (a).''
     Delete paragraph (d).
    Our proposal included drugs that are covered under Part B. We 
believed that this, combined with Sec.  423.120(c), would help confirm 
that all prescribers of Medicare drugs are thoroughly vetted for 
compliance with Medicare requirements.
    We also proposed that our changes to Sec.  424.507 would become 
effective on January 1, 2018 to give sufficient time for--(1) providers 
and suppliers to complete the enrollment or opt-out process; (2) 
stakeholders (including CMS and its contractors) to prepare for, 
operationalize, and implement these requirements; and (3) provider and 
beneficiary education.
    In the April 27, 2012 final rule (77 FR 25291), we agreed with 
commenters that there were a number of operational issues associated 
with a requirement that services of a specialist be ordered or 
referred. We thus removed that requirement. However, with the 
successful implementation of the current version of Sec.  424.507, we 
stated in the proposed rule that the expansion of Sec.  424.507 to 
include other services can be fully operationalized.
b. Preclusion List for Medicare Advantage (MA) and Part D
    In the previously mentioned May 23, 2014 final rule, we finalized 
provisions that would require Medicare Part D prescribers to enroll in 
or opt-out of the Medicare program in order to prescribe Part D drugs 
to Medicare beneficiaries. In a similar vein, we established provisions 
in a November 15, 2016 final rule (81 FR 80170) titled ``Medicare 
Program; Revisions to Payment Policies Under the Physician Fee Schedule 
and Other Revisions to Part B for CY 2017; Medicare Advantage Bid 
Pricing Data Release; Medicare Advantage and Part D Medical Loss Ratio 
Data Release; Medicare Advantage Provider Network Requirements; 
Expansion of Medicare Diabetes Prevention Program Model; Medicare 
Shared Savings Program Requirements'' requiring Medicare Advantage (MA) 
providers to enroll in Medicare in order to furnish MA services and 
items to Medicare beneficiaries. These provisions were intended to 
supplement those in Sec.  424.507 by expanding the enrollment 
requirement to include MA and Part D, thereby strengthening the payment 
safeguard elements of the latter two programs.
    During our preparations to implement the Part D and MA enrollment 
provisions by the January 1, 2019 effective date, several provider 
organizations expressed concerns about our forthcoming requirements. 
With respect to Part D, these organizations stated that--(1) most 
prescribers pose no risk to the Medicare program; (2) certain types of 
physicians and eligible professionals prescribe Part D drugs only very 
infrequently; and (3) the burden to the prescriber community would 
outweigh the program integrity benefits of the Part D enrollment 
requirement. Regarding MA, some stakeholders were, too, concerned about 
the burden of having to enroll in Medicare, particularly considering 
that MA organizations enrolling in Medicare must also undergo 
credentialing by their respective health plans. While enrolling such 
prescribers and providers gives Medicare a greater degree of scrutiny 
in determining a prescriber's or provider's qualifications, we noted 
that the perceived burden associated with this process could cause some 
prescribers and providers not to enroll in Medicare, thus possibly 
leading to access to care issues if such providers left MA networks as 
a result. As of early 2018, approximately 420,000 Part D prescribers 
and 120,000 MA providers remained unenrolled in Medicare.
    Given these concerns, on April 16, 2018 we published in the Federal 
Register a final rule titled, ``Medicare Program; Contract Year 2019 
Policy and Technical Changes to the Medicare Advantage, Medicare Cost 
Plan, Medicare Fee-for-Service, the Medicare Prescription Drug Benefit 
Programs, and the PACE Program'' (83 FR 16440) (hereafter referred to 
as the April 16, 2018 final rule). In that rule, we removed the MA and 
Part D enrollment requirements outlined in the May 23, 2014 and 
November 15, 2016 final rules, respectively. They were replaced with a 
payment-oriented (rather than an enrollment-based) approach by which we 
would focus on prescribers and providers that present an elevated risk 
to Medicare beneficiaries and the Trust Funds. Rather than require the 
enrollment of MA providers and Part D prescribers regardless of the 
level of risk they might pose, we would prevent payment for MA items or 
services and Part D drugs that are, as applicable, furnished or 
prescribed by demonstrably problematic prescribers and providers. To 
this end, the April 16, 2018 rule stated that--(1) such problematic 
parties would be placed on a ``preclusion list''; and (2) payment for 
Part D drugs and MA services and items prescribed or furnished by these 
individuals and entities would be rejected or denied, as applicable. 
The implementation of the MA and Part D preclusion list policies began 
in late 2018.
c. Comments Received on Proposed Changes to Sec.  424.507
    We received a number of comments regarding our proposed changes to

[[Page 47835]]

Sec.  424.507. They focused on several matters. First, commenters 
expressed concern about the burden that would be involved in enrolling 
in Medicare to order, certify, refer, or prescribe Part A or B 
services, items, or drugs. Second, several stated that our proposal 
would negatively impact beneficiaries who seek care and treatment in 
emergency departments for acute illnesses or acute exacerbations of a 
chronic condition. Third, commenters requested that the proposed 
January 1, 2018 effective date was much too soon to enable stakeholders 
to prepare for these requirements and should be significantly pushed 
back.
    Given the adoption of the preclusion list approach in lieu of MA 
and Part D enrollment and our interest in reducing burden on the 
provider and supplier community, we have decided not to finalize our 
proposed changes to Sec.  424.507.
d. Maintenance of Documentation
    In the November 19, 2008 Federal Register, we published a final 
rule titled, ``Medicare Program; Payment Policies Under the Physician 
Fee Schedule and Other Revisions to Part B for CY 2009; E-Prescribing 
Exemption for Computer-Generated Facsimile Transmissions; and Payment 
for Certain Durable Medical Equipment, Prosthetics, Orthotics, and 
Supplies'' (73 FR 69726). In that rule, we established Sec.  424.516(f) 
stating that--(1) a provider or supplier is required to maintain 
ordering and referring documentation, including the NPI, received from 
a physician or eligible non-physician practitioner for 7 years from the 
date of service; and (2) physicians and non-physician practitioners are 
required to maintain written ordering and referring documentation for 7 
years from the date of service.
    Section 1866(a)(1) of the Act, which was amended by section 
6406(b)(3) of the Affordable Care Act, require that providers and 
suppliers maintain and, upon request, provide to the Secretary access 
to written or electronic documentation relating to written orders or 
requests for payment for durable medical equipment, certifications for 
home health services, or referrals for other items or services written 
or ordered by the provider as specified by the Secretary. Under section 
1842(h) of the Act, which was amended by section 6406(a) of the 
Affordable Care Act, the Secretary may revoke a physician's or 
supplier's enrollment if the physician or supplier fails to maintain 
and, upon request of the Secretary, provide access to documentation 
relating to written orders or requests for payment for durable medical 
equipment, certifications for home health services, or referrals for 
other items or services written or ordered by such physician or 
supplier, as specified by the Secretary.
    Consistent with the authority given to the Secretary in sections 
1866(a)(1) and 1842(h) of the Act, we revised Sec.  424.516(f) in the 
previously referenced April 27, 2012 final rule to specify the 
following:
     Under paragraph (f)(1), a provider or supplier that 
furnishes covered ordered items of DMEPOS, clinical laboratory, imaging 
services, or covered ordered/certified home health services is required 
to maintain documentation for 7 years from the date of service, and 
provide access to that documentation upon the request of CMS or a 
Medicare contractor.
     Under paragraph (f)(2), a physician who orders/certifies 
home health services and the physician or, when permitted, other 
eligible professional who orders items of DMEPOS or clinical laboratory 
or imaging services is required to maintain documentation for 7 years 
from the date of service, and provide access to that documentation upon 
the request of CMS or a Medicare contractor.
    The documentation in paragraphs (f)(1) and (2) includes written and 
electronic documents (including the NPI of the physician who ordered/
certified the home health services and the NPI of the physician or, 
when permitted, other eligible professional who ordered items of DMEPOS 
or clinical laboratory or imaging services) relating to written orders 
and certifications and requests for payments for items of DMEPOS and 
clinical laboratory, imaging, and home health services.
    We proposed to expand these requirements in Sec.  424.516(f) to 
include all Part A and Part B services, items, and drugs that are 
ordered, certified, referred, or prescribed by a physician or, when 
permitted, eligible professional. Thus, the provider or supplier 
furnishing the Part A or B service, item, or drug, as well as the 
physician or, when permitted, eligible professional who ordered, 
certified, referred, or prescribed the service, item or drug, would 
have to maintain documentation for 7 years from the date of the service 
and furnish access to that documentation upon a CMS or Medicare 
contractor request. The documentation would include written and 
electronic documents (including the NPI of the ordering/certifying/
referring/prescribing physician or, when permitted, eligible 
professional) relating to written orders, certifications, referrals, 
prescriptions, and requests for payments for a Part A or B service, 
item, or drug.
    We stated in the proposed rule that it is important that payments 
for Part A and B services, items, and drugs be made correctly. Without 
being able to review the documentation addressed in Sec.  424.516(f), 
we may be unable to confirm that the order, certification, referral, or 
prescription was proper and that the ordering, certifying, referring or 
prescribing individual was qualified. We further noted in the proposed 
rule our belief in the importance of revising Sec.  424.516(f) to be 
consistent with our proposed changes to Sec.  424.507. We stated that 
to require all persons who order, certify, refer, and prescribe Part A 
and B services, items, or drugs to enroll in Medicare without requiring 
them (or the billing provider) to retain supporting documentation would 
undercut the effectiveness of Sec.  424.507. Although, as already 
mentioned, we are not finalizing our proposed changes to Sec.  424.507, 
we maintain this view. We must be able to verify that the--(1) order, 
certification, referral, or prescription was appropriate; (2) ordering, 
certifying, referring or prescribing individual was qualified; and (3) 
payment at issue was correctly made.
    We received the following comments regarding this proposal:
    Comment: A commenter stated that the proposed 7-year documentation 
requirement was onerous, with seemingly no basis for such lengthy 
documentation retention. The commenter recommended that the proposed 
timeframe be reduced to 3 years, while recognizing that providers and 
suppliers may choose or be required (under state law) to maintain such 
documentation for longer periods.
    Response: We believe that a 7-year period is appropriate and note 
that this timeframe has been in place in Sec.  424.516(f) since its 
enactment in the previously mentioned November 19, 2008 final rule. We 
continue to believe that the timeframe must be of sufficient length to 
ensure that we can confirm the accuracy and legitimacy of prior orders, 
certifications, referrals, and prescriptions and the payments stemming 
therefrom. A 3-year period, in our view, would remove from our 
requirement certain documents that could help us execute this function.
    Comment: A commenter concurred that the ordering provider should 
maintain the clinical justification for the imaging study. The 
commenter added that a radiology group--(1) need only maintain the 
documentation it receives from the ordering physician or non-physician 
practitioner; and (2) must ensure that the submitted information

[[Page 47836]]

on the claim accurately reflects the information it received from the 
ordering physician or non-physician practitioner. Further, the 
commenter agreed that it is the ordering professional's responsibility 
to provide the documentation associated with the imaging order to CMS 
or a Medicare contractor.
    Response: Portions of this comment are outside the scope of this 
final rule with comment period, but we appreciate the commenter's 
support.
    Comment: A commenter sought clarification regarding--(1) the 
penalty for a physician who fails to maintain documentation under Sec.  
424.516(f); and (2) whether there is any penalty for the provider that 
supplied the care that the physician ordered, certified, or referred.
    Response: Section 424.516(f) includes document retention 
requirements for -- (1) the ordering, certifying, referring, or 
prescribing physician or eligible professional; and (2) the provider or 
supplier furnishing the service. Currently, failure to comply with 
these requirements may result in the revocation of the responsible 
party's enrollment under Sec.  424.535(a)(1).
    Comment: A commenter was concerned that certain dentists, such as 
locum tenens dentists or those who were formerly employed by a 
government agency or group dental practice, may be unable to comply 
with this proposal because they do not have control over the relevant 
documents. The commenter recommended that CMS place the burden for any 
recordkeeping compliance solely on the individual or entity who 
controls such records.
    Response: Consistent with long-standing CMS policy, the physician 
for whom the locum tenens physician is substituting is responsible for 
retaining and furnishing the application documentation under Sec.  
424.516(f).
    After consideration of the comments received, and for reasons 
stated previously, we are finalizing our revisions to Sec.  424.516(f) 
as proposed notwithstanding the non-finalization of our proposal to 
revise Sec.  424.507.
12. Opt-Out Physicians and Practitioners
    As previously referenced, no Medicare payment (either directly or 
indirectly) will be made for services furnished by opt-out physicians 
or practitioners, except as permitted in accordance with Sec. Sec.  
405.435(c) and 405.440. The effects of opting-out are described in 
Sec.  405.425. Section 405.425(i) states that an opt-out physician or 
practitioner who has not been excluded under sections 1128, 1156 or 
1892 of the Act may order, certify the need for, or refer a beneficiary 
for Medicare-covered items and services, provided he or she is not paid 
directly or indirectly for such services (except as provided in Sec.  
405.440). Under Sec.  405.425(j), an excluded physician or practitioner 
may not order, prescribe, or certify the need for Medicare-covered 
items and services, except as provided in 42 CFR 1001.1901, and must 
otherwise comply with the terms of the exclusion in accordance with 42 
CFR 1001.1901.
    We proposed to revise Sec.  405.425(i) and (j) by including opt-out 
physicians and practitioners who are revoked under Sec.  424.535. Thus, 
a revoked opt-out physician or practitioner would be unable to order, 
prescribe, and certify the need for or refer a beneficiary for 
Medicare-covered services and items except as otherwise provided in 
those paragraphs. We expressed concern that revoked physicians and 
practitioners who have opted-out could, through inappropriate ordering 
and certifying practices, pose a risk to Medicare beneficiaries. Our 
concern is heightened because opt-out physicians and practitioners are 
not subject to the same stringent enrollment and verification processes 
that enrolled physicians and practitioners are. Therefore, we believed 
that these proposed changes were necessary.
    We received the following comment regarding our proposal:
    Comment: A commenter expressed concern that there is no publicly 
available list of revocations and that, other than receiving a claim 
denial, it is unclear how the recipient of an order, prescription, 
certification, or referral would be able to identify an opt-out 
provider's revocation status. The commenter stated that CMS should not 
hold hospitals to this standard until there is a viable way to 
determine which ordering physicians have been revoked.
    Response: We appreciate the commenter's concerns. While we are 
finalizing this provision, we may examine means to expand the scope of 
revocation data that is available to the public.
    After reviewing the comment received, we are finalizing our 
proposal with three exceptions.
    First, the opening language of Sec.  405.425(j) states: ``The 
physician or practitioner who is excluded . . . or whose Medicare 
enrollment is revoked under Sec.  [thinsp]424.535 of this chapter may 
not order, prescribe or certify the need for Medicare-covered items and 
services except . . . '' We are changing the language ``items and 
services'' to ``items, services, and drugs . . . '' The addition of the 
term ``drugs'' is meant to correspond with our addition of 
``prescribe'' to Sec.  405.425(j). To ensure consistency with this 
addition, we are also changing the language in Sec.  405.425(i) that 
reads ``may order, certify the need for, prescribe, or refer a 
beneficiary for Medicare-covered items and services'' to ``may order, 
certify the need for, prescribe, or refer a beneficiary for Medicare-
covered items, services, and drugs''.
    Second, the closing language of Sec.  405.425(j) reads, '' . . . 
except as provided in Sec.  1001.1901 of this title, and must otherwise 
comply with the terms of the exclusion in accordance with Sec.  
1001.1901 effective with the date of the exclusion.'' Because Sec.  
1001.1901 of this title only applies to excluded individuals and 
entities, we are clarifying that the references to Sec.  1001.1901 in 
Sec.  405.425(j) are inapplicable to revocations. We are therefore 
revising Sec.  405.425(j) to read, '' . . . except, with respect to 
exclusions, as provided in Sec.  1001.1901 of this title, and must 
otherwise comply with the terms of any exclusion in accordance with 
Sec.  1001.1901 effective with the date of the exclusion.''
    Third, the opening language of Sec.  405.425(i) specifies that: 
``The physician or practitioner who has not been excluded under 
sections 1128, 1156 or 1892 of Social Security Act or whose Medicare 
enrollment is not revoked under Sec.  424.535 of this chapter may 
order, certify the need for, prescribe. . . .'' We are changing the 
phrase ``or whose Medicare enrollment'' to ``and whose Medicare 
enrollment.'' This is to clarify our intention that a physician or 
practitioner must be neither excluded nor revoked in order to conduct 
the activities addressed in paragraph (i).
13. Moratoria
    Under Sec.  424.570(a), CMS may impose a temporary moratorium on 
the enrollment of new Medicare providers and suppliers of a particular 
type or the establishment of new practice locations of a particular 
type in a particular geographic area. Per Sec.  424.570(a)(2)(i), a 
moratorium is imposed when CMS determines that there is a significant 
potential for fraud, waste, or abuse with respect to a particular 
provider or supplier type, a particular geographic area, or both. 
Consistent with this authority, we have published several Federal 
Register documents announcing the imposition of temporary moratoria on 
the enrollment of HHAs and certain ambulance suppliers. (See, for 
example, the July 31, 2013 (78 FR 46339) and February 4, 2014 (79 FR 
6475) Federal Registers.)

[[Page 47837]]

    We proposed several changes to Sec.  424.570(a).
a. Change in Practice Location
    Section 424.570(a)(1)(iii) states that a temporary moratorium does 
not apply to changes in practice locations, changes in provider or 
supplier information (such as phone numbers), or changes in ownership 
(except changes in ownership of HHAs that would require an initial 
enrollment under Sec.  424.550)).
    We proposed three revisions to Sec.  424.570(a)(1)(iii).
    The first proposal divided the current version of Sec.  
424.570(a)(1)(iii) into paragraphs (a)(1)(iii)(A), (B), and (C) so that 
each requirement mentioned in paragraph (a)(1)(iii) could be addressed 
individually.
    Secondly, we clarified in paragraph (a)(1)(iii)(A) (which would 
address practice locations) that a temporary moratorium applies to 
situations in which a provider or supplier is changing a practice 
location from a location outside the moratorium area to a location 
inside the moratorium area. We saw no difference between this situation 
and one in which a provider or supplier is opening a brand new practice 
location in the moratorium area. In both cases, an additional site is 
being established in the moratorium area, something the moratorium is 
designed to prevent. We thus believed this change was necessary.
    Lastly, we proposed to clarify the existing policy in paragraph 
(a)(1)(iii)(C) by removing the language ``under Sec.  424.550''. Under 
Sec.  489.18(c), if an HHA changes ownership as specified in Sec.  
489.18(a), the existing provider agreement is automatically assigned to 
the new owner. However, if the new owner declines to accept the assets 
and liabilities of the HHA and refuses assignment of the provider 
agreement, Sec.  489.18(c) does not apply and the HHA must enroll as a 
new provider via an initial enrollment. The existing reference to Sec.  
424.550 in paragraph (a)(1)(iii) may have caused some confusion on this 
point. Accordingly, we proposed to remove this reference in order to 
clarify current policy.
b. Application of Moratorium
    Section 424.570(a)(1)(iv) currently states that a temporary 
enrollment moratorium does not apply to any enrollment application that 
has been approved by the enrollment contractor but not yet entered into 
PECOS at the time the moratorium is imposed. We proposed to revise this 
paragraph to state that a temporary moratorium does not apply to any 
enrollment application received by the Medicare contractor prior to the 
date the moratorium is imposed.
    In the moratoria that have been imposed, some providers and 
suppliers have spent significant resources to prepare for enrollment 
only to have their Form CMS-855 applications denied near the end of the 
enrollment process because of the sudden imposition of a moratorium. 
This has been especially problematic for HHAs--(1) whose Form CMS-855A 
applications, at the time a moratorium is imposed, have been 
recommended for approval by the contractor; (2) that have successfully 
completed a state survey; and (3) whose applications and survey results 
have been forwarded by the state to a CMS Regional Office for final 
review. This entire process, much of which occurs after an application 
is received by the contractor but before the application is finally 
approved by the contractor, can take a substantial amount of time, and 
the considerable resources the provider or supplier may have expended 
by this point are effectively lost when CMS imposes a moratorium.
    We stated that this has been an unintended consequence of the 
moratoria. In our view, the overall objective of the moratoria--the 
need to reduce the potential for fraud, waste, or abuse in certain 
geographic areas--can be equally satisfied by not applying a moratorium 
to applications submitted before the moratorium is imposed, 
irrespective of whether they have been approved. Therefore, we believed 
that our proposed ``prior to the moratorium date'' threshold was an 
appropriate balance between limiting provider burden and protecting the 
integrity of the Medicare program and the Trust Funds.
    We also proposed in Sec.  424.570(a)(1)(iv) to change the term 
``enrollment contractor'' to ``Medicare contractor.'' We believed the 
latter term is more consistent with CMS' use of MACs.
    We received the following comments regarding our proposed revisions 
to Sec.  424.570.
    Comment: A few commenters supported our proposed addition of Sec.  
424.570(a)(1)(iv).
    Response: We appreciate the commenters' support.
    Commenter: A commenter opposed our proposed revision to Sec.  
424.570(a)(1)(iii), stating that it would prevent an entity from 
relocating its office into the moratoria area while maintaining its 
existing service area. As a result, the moratoria would erect 
unnecessary barriers to enhancement of care quality and block the cost 
efficiencies that relocation could bring. The commenter recommended 
that CMS permit a practice location change from outside the moratoria 
area to inside the area when a provider can demonstrate that it 
currently has the moratoria area as a service area.
    Response: We respectfully disagree with this recommendation. As we 
stated in the proposed rule, we see no difference between the 
relocation of an office into a moratorium area and the opening of a 
brand new practice location in the moratorium area. In both cases, an 
additional site is being established in the moratorium area, something 
the moratorium is designed to prevent. We also stress that Sec.  
424.570 is and has been focused on the specific location of the office 
site itself rather than on the larger area that the provider services. 
Therefore, we believe this change is necessary and vital to protecting 
the integrity of the Medicare program.
    Comment: A commenter stated, for CMS' consideration, that the 
current prohibitions against (1) the establishment of new HHA branch 
offices and (2) allowing established provider organizations outside the 
moratorium area to expand into the moratorium area can lock in some of 
the providers that CMS seeks to address through its program integrity 
initiatives. In other words, the commenter explained, the prohibitions 
in some ways maintain the status quo rather than producing the desired 
change. . The commenter added that it could also restrict the 
opportunity for patients and referral sources to choose a more 
compliant provider organization.
    Response: We appreciate the commenter's suggestion. For reasons 
previously stated, however, we believe that our revision of Sec.  
424.570(a)(1)(iii) is consistent with the purpose of a temporary 
enrollment moratorium and is warranted in order to protect the 
integrity of the Medicare program.
    After consideration of these comments, we are finalizing our 
proposed revisions to Sec.  424.570.
14. Surety Bonds
    Since 2009, certain DMEPOS suppliers have been required under Sec.  
424.57(d) to obtain, submit, and maintain a surety bond in an amount of 
at least $50,000 as a condition of enrollment. Paragraph (d)(5)(i) 
states that the surety bond must guarantee that the surety will--within 
30 days of receiving written notice from CMS containing sufficient 
evidence to establish the surety's liability under the bond of unpaid 
claims, CMPs, or assessments--pay CMS a total of up to

[[Page 47838]]

the full penal amount of the bond in the following amounts: (1) The 
amount of any unpaid claim, plus accrued interest, for which the DMEPOS 
supplier is responsible; and (2) the amount of any unpaid claims, CMPs, 
or assessments imposed by CMS or the OIG on the DMEPOS supplier, plus 
accrued interest. Paragraph (d)(5)(ii), meanwhile, states that the 
surety bond must provide that the surety is liable for unpaid claims, 
CMPs, or assessments that occur during the term of the bond.
    We have specific procedures for collecting monies from sureties in 
accordance with Sec.  424.57(d)(5) and have recouped several million 
dollars via these procedures. However, we have encountered instances 
where the surety has failed to submit payment to CMS, notwithstanding 
its obligation to do so under both Sec.  424.57(d)(5) and the surety 
bond's terms. We stated in the proposed rule that CMS should not permit 
a DMEPOS supplier to use that particular surety when the latter has not 
fulfilled its legal responsibilities to us as the obligee under the 
surety bond. We thus proposed in new Sec.  424.57(d)(16) that CMS may 
reject an enrolling or enrolled DMEPOS supplier's new or existing 
surety bond if the surety that issued the bond has failed to make a 
required payment to CMS in accordance with Sec.  424.57(d). This means 
that we could reject any and all surety bonds furnished by the surety 
to enrolling or enrolled DMEPOS suppliers under Sec.  424.57(d), not 
just the surety bond(s) on which the surety refused to make payment. If 
we reject a surety bond under proposed Sec.  424.57(d)(16), the 
enrolling or enrolled DMEPOS supplier would have to obtain a bond from 
a new surety in order to enroll in or maintain its enrollment in 
Medicare.
    We illustrated how Sec.  424.57(d)(16) would operate with this 
example. Suppose a surety has issued surety bonds for DMEPOS Suppliers 
W, X, Y, and Z, all of which are enrolled in Medicare. CMS sought to 
collect from the surety on the bond issued for Supplier X, but the 
surety failed to make payment. We would have the discretion to--(1) 
reject the bonds for W, X, Y, and Z, thus requiring the suppliers to 
obtain new bonds from a different surety; and (2) refuse to accept 
future bonds issued to DMEPOS suppliers by the non-compliant surety.
    In making a determination under items (1) and (2) in the previous 
sentence, we proposed to consider the following factors:
     The total number of Medicare-enrolled DMEPOS suppliers to 
which the surety has issued surety bonds.
     The total number of instances in which the surety has 
failed to make payment to CMS.
     The reason(s) for the surety's failure(s) to pay.
     The percentage of instances in which the surety has failed 
to pay.
     The total amount of money that the surety has failed to 
pay.
     Any other information that CMS deems relevant to its 
determination.
    Although CMS would reserve the right to reject all of a surety's 
existing bonds with Medicare-enrolled DMEPOS suppliers if the surety 
failed to make even one required payment, CMS would take into account 
the circumstances surrounding the surety and its failure to make 
payment per the aforementioned factors.
    Comment: A commenter opposed our proposed addition of Sec.  
424.57(d)(16) on several grounds. First, the commenter contended that 
the proposal changes the surety bond requirement under Sec.  424.57(d) 
from a conditional obligation for the surety (that is, the surety must 
currently pay only if, for instance, (1) the DMEPOS supplier's non-
payment of the claim; and (2) sufficient evidence to establish 
liability being presented to the surety) to a demand obligation. The 
commenter stated that the threat of rejection under Sec.  424.57(d)(16) 
as a means of coercing sureties to pay legitimately disputed claims 
effectively converts the bond to a demand obligation.
    Second, the commenter stated that the surety should have an 
opportunity before an impartial tribunal to present its defenses (and 
those of the DMEPOS supplier) and explain why payment is not due. 
Sureties are not supposed to advocate for the supplier but merely pay 
the bond. The imposition of Sec.  424.57(d)(16) requires due process 
for the surety.
    Third, the commenter stated that sureties would respond to the 
increased risk that Sec.  424.57(d)(16) poses by tightening its 
underwriting requirements, meaning that fewer DMEPOS suppliers would be 
able to obtain bonds.
    Fourth, the commenter explained that Sec.  424.57(d)(16) would 
effectively amount to a debarment of the surety; debarment authority, 
however, is vested in the Department of Treasury.
    Fifth, the commenter stated that Sec.  424.57(d)(16) does not 
comply with the requirements of 31 CFR 223.17, which permits an agency 
to refuse future bonds from a surety ``for cause''; this includes 
failing to pay an administratively final bond obligation. Some of the 
commenters contentions included--(1) CMS does not articulate its 
procedures and ``for cause'' standards for declining to accept bonds in 
an agency regulation or for declining bonds in specific cases; (2) the 
provision does not define when a bond obligation becomes 
administratively final under agency procedures, establish advance 
notice, or give the surety an opportunity to cure or rebut; (3) the 
provision does not allow the surety an opportunity to be heard, to 
confront and cross-examine witnesses, to be represented by for counsel, 
to submit evidence, or to have an impartial decision-maker.
    Sixth, the commenter contended that there is a strong presumption 
of judicial review of administrative actions; with respect to 
prohibiting sureties from providing bonds, Congress has actually 
required judicial involvement. The commenter stated that Sec.  9305(e) 
prohibits a surety from providing further bonds if it has failed to pay 
a final judgment. The commenter concluded because the proposed 
regulation does not comply with 31 CFR 223.17, including rudimentary 
due process protection, CMS may not exercise any authority to reject 
bonds.
    Response: We appreciate the commenter's concerns. After reviewing 
these comments, and given the complexity of certain operational aspects 
of our proposal, we are not finalizing proposed Sec.  424.57(d)(16) in 
this rule.
    Comment: A commenter stated that CMS should not implement Sec.  
424.57(d)(16) without several prerequisites. First, CMS must create 
tools to help sureties understand a supplier's history and also develop 
a process for issuing claims against sureties. Second, the commenter 
believed that since sureties likely have not seen or commented on this 
proposal, CMS should issue a proposed rule specific to the surety bond 
issues under discussion; this should include a process for filing a 
claim against a surety. Third, the GAO should complete a study on the 
entire surety bond process and its guidelines before CMS institutes the 
policies addressed in this final rule. Fourth, CMS should clarify that 
one bond can cover the requirement for both Medicare and Medicaid 
programs for a particular location. The commenter stated that many 
state Medicaid programs will not accept a supplier's bond if it shows 
CMS as the Obligee but will require the supplier to obtain a second 
bond showing Medicaid as the Obligee. Since the bonds are required to 
be under the Obligee of CMS, the commenter stated, one bond should 
cover the requirements for both programs.

[[Page 47839]]

    Response: As previously stated, we are not finalizing proposed 
Sec.  424.57(d)(16).
    After consideration of the comments received, we are not finalizing 
proposed Sec.  424.57(d)(16).
15. Reactivation
    Under Sec.  424.540(a), a provider's or supplier's Medicare billing 
privileges may be deactivated if the provider or supplier fails to--(1) 
submit any Medicare claims for 12 consecutive calendar months; (2) 
report a change to its Medicare enrollment information within 90 
calendar days (or, for changes in ownership or control, within 30 
days); or (3) furnish complete and accurate information and all 
supporting documentation within 90 calendar days of receipt of 
notification from CMS to submit an enrollment application and 
supporting documentation, or to resubmit and certify the accuracy of 
its enrollment information. To reactivate its billing privileges, the 
provider or supplier must follow the requirements of Sec.  424.540(b). 
Specifically--
     Paragraph (b)(1) states that if the provider or supplier 
is deactivated for any reason other than non-submission of a claim, the 
provider or supplier must submit a new enrollment application or, when 
deemed appropriate, recertify that the enrollment information currently 
on file with Medicare is correct; and
     Paragraph (b)(2) states that if the provider or supplier 
is deactivated for non-submission of a claim, it must recertify that 
the enrollment information currently on file with Medicare is correct 
and furnish any missing information as appropriate.
    We proposed to revise paragraph (b) in two ways. Paragraph (b)(1) 
would state that in order for a deactivated provider or supplier to 
reactivate its Medicare billing privileges, it must recertify that its 
enrollment information currently on file with Medicare is correct and 
furnish any missing information as appropriate. Paragraph (b)(2) would 
state that notwithstanding paragraph (b)(1), CMS may for any reason 
require a deactivated provider or supplier to submit a complete Form 
CMS-855 application as a prerequisite for reactivating its billing 
privileges.
    There were several reasons for these proposed changes. First, the 
existing language in Sec.  424.540(b)(1) had been a source of confusion 
for providers and suppliers because it does not articulate what the 
phrase ``when deemed appropriate'' means. There also is some repetition 
between paragraphs (b)(1) and (2), for both indicate that a 
recertification is acceptable. Our proposed version of paragraph 
(b)(1), which combined parts of existing paragraphs (b)(1) and (2), 
clarified that a provider or supplier may use recertification--
regardless of the deactivation reason--as a means of reactivation.
    Second, we believed that CMS should have the discretion to require 
at any time the submission of a complete Form CMS-855 reactivation 
application irrespective of the deactivation reason. The Form CMS-855 
captures information about the provider or supplier that, in the case 
of a reactivation, would help us determine whether the provider or 
supplier is still in compliance with Medicare enrollment requirements. 
A recertification, meanwhile, generally only consists of a statement 
from the provider or supplier that the information on file is correct 
and, if necessary, the submission of Form CMS-855 pages containing 
updated information. Therefore, the Form CMS-855 collects more 
information than the recertification submission, and there may be 
situations where CMS determines that a complete application must be 
submitted. These could include, but are not limited to, the following:
     The provider or supplier was deactivated for failing to 
submit a claim for 12 consecutive months and has been deactivated for 
at least 6 months.
     The provider or supplier does not have access to internet-
based PECOS.
     The provider or supplier was deactivated for failing to 
report a change of information.
    In these circumstances, respectively, the provider or supplier--(1) 
has not submitted a claim for at least 18 months; (2) cannot view its 
existing enrollment data and thus may be unable to determine the 
accuracy of this information; and (3) previously failed to comply with 
Medicare requirements by not timely reporting changed enrollment data. 
Such instances, in our view, raise questions as to the validity of the 
provider's or supplier's current enrollment information and possibly 
its compliance with existing Medicare requirements, thus warranting a 
complete Form CMS-855 if we deem it necessary. We stressed that we 
could request a complete application in any reactivation situation, not 
simply those outlined in this section. We solicited comment on whether 
we should restrict the reasons for which CMS may request a complete 
reactivation application and, if so, what those reasons should be.
    While we proposed to revise Sec.  424.540(b)(1) and (2) as 
previously described, we did not propose any changes to Sec.  
424.540(b)(3).
    We received no comments regarding our proposed changes to Sec.  
424.540 and are therefore finalizing them.
16. Changes to Definition of Enrollment
    We proposed several additional changes to 42 CFR part 424 to 
address the general concept of enrollment as it pertains to the Form 
CMS-855O (OMB Control No. 0938-1135). This form is used by physicians 
and eligible professionals seeking to enroll in Medicare solely to 
order and certify certain items or services and/or prescribe Part D 
drugs.
    We received no comments on any of the proposals outlined in this 
section II.B.16. Given, however, our above-referenced non-finalization 
of our revisions to Sec.  424.507 and our elimination of the Part D 
enrollment requirement, we believe that many of these section II.B.16 
proposed changes may be unnecessary. We are therefore finalizing, 
modifying, and/or not finalizing these provisions as follows.
a. Definition of ``Enroll/Enrollment'' (Sec.  424.502)
    We proposed several revisions of the existing definition of 
``Enroll/Enrollment'' in Sec.  424.502.
    First, the opening sentence of the definition currently specifies 
that enroll/enrollment means the process that Medicare uses to 
establish eligibility to submit claims for Medicare-covered items and 
services, and the process that Medicare uses to establish eligibility 
to order or certify Medicare-covered items and services. We proposed to 
change this definition to specify that enroll/enrollment means the 
process that Medicare uses to establish eligibility to submit claims 
for Medicare-covered items and services, and the process that Medicare 
uses to establish eligibility to order, certify, refer, or prescribe 
Medicare-covered Part A or B services, items or drugs or to prescribe 
Part D drugs.'' There were two reasons for this proposed change. One 
was to align this definition with the language in our proposed 
revisions to Sec.  424.507(a) and (b). (See section II.A.12. of this 
final rule with comment period.) The second was to address in this 
definition the enrollment provisions in Sec.  423.120(c)(6) relating to 
Part D drugs.
    Second, the current version of paragraph (2) of the definition of 
``Enroll/Enrollment'' specifies that except for those suppliers that 
complete the Form CMS-855O form, CMS-identified equivalent, successor 
form or process for the sole purpose of obtaining eligibility to order 
or certify Medicare-covered items and services, validating

[[Page 47840]]

the provider or supplier's eligibility to provide items or services to 
Medicare beneficiaries. We proposed to change this to provide that 
except for those suppliers that complete the Form CMS-855O, CMS-
identified equivalent, successor form or process for the sole purpose 
of obtaining eligibility to order, certify, refer, or prescribe 
Medicare-covered Part A or B services, items or drugs or to prescribe 
Part D drugs, validating the provider's or supplier's eligibility to 
provide items or services to Medicare beneficiaries. This revision was 
to clarify that a supplier's completion of the Form CMS-855O solely to 
obtain eligibility to order, certify, refer, or prescribe Medicare-
covered Part A or B services, items or drugs or to prescribe Part D 
drugs, does not convey Medicare billing privileges to the supplier.
    Third, and for reasons similar to those involving our proposed 
change to paragraph (2) of the definition of ``Enroll/Enrollment,'' we 
proposed to revise paragraph (4) thereof. The new version of paragraph 
(4) would specify that except for those suppliers that complete the 
Form CMS-855O, CMS-identified equivalent, successor form or process for 
the sole purpose of obtaining eligibility to order, certify, refer, or 
prescribe Medicare-covered Part A or B services, items or drugs or to 
prescribe Part D drugs, granting the Medicare provider or supplier 
Medicare billing privileges.
    As we are not finalizing our proposed revisions to Sec.  424.507 
and in light of the rescission of the Part D enrollment requirement, we 
do not believe these proposed changes to the definition of ``Enroll/
Enrollment'' in Sec.  424.502 are necessary. We therefore decline to 
finalize them.
b. Revision to Sec.  424.505
    We also proposed to replace the language in Sec.  424.505 that 
states ``to order or certify Medicare-covered items and services'' with 
``to order, certify, refer, or prescribe Medicare-covered Part A or B 
services, items or drugs or to prescribe Part D drugs.''
    This was to clarify that completion of the Form CMS-855O does not 
convey Medicare billing privileges to the supplier. For the same 
reasons behind our non-finalization of our proposed revisions to the 
``Enroll/Enrollment'' definition in Sec.  424.502, we are not 
finalizing our proposed change to Sec.  424.505.
c. Revision to Sec.  424.510(a)(3)
    Section 424.510(a)(3) currently specifies that to be enrolled 
solely to order and certify Medicare items or services, a physician or 
non-physician practitioner must meet the requirements specified in 
paragraph (d) except for paragraphs (d)(2)(iii)(B), (d)(2)(iv), 
(d)(3)(ii), and (d)(5), (6), and (9). We proposed to revise this to 
specify that to be enrolled solely to order, certify, refer, or 
prescribe Medicare-covered Part A or B services, items or drugs or to 
prescribe Part D drugs, a physician or non-physician practitioner must 
meet the requirements specified in paragraph (d) except for paragraphs 
(d)(2)(iii)(B), (d)(2)(iv), (d)(3)(ii), and (d)(5), (6), and (9). This 
proposal was intended to include within the purview of Sec.  
424.510(a)(3) those suppliers who are enrolling via the Form CMS-855O 
pursuant to Sec.  423.120(c)(6) or pursuant to our proposed revisions 
to Sec.  424.507(a) and (b).
    However, for reasons similar to those discussed previously, we are 
not finalizing this change.
d. Revision to Sec.  424.535(a)
    We also proposed to change the term ``billing privileges'' in the 
opening paragraph of Sec.  424.535(a) to ``enrollment.'' The paragraph 
would thus read: ``CMS may revoke a currently enrolled provider's or 
supplier's Medicare enrollment and any corresponding provider agreement 
or supplier agreement for the following reasons''. This was to clarify 
that the revocation reasons in Sec.  424.535(a) apply to all enrolled 
parties, including suppliers who are enrolled solely to order, certify, 
refer, or prescribe Medicare-covered Part A or B services, items, or 
drugs, or to prescribe Part D drugs; the reasons are not limited to 
providers and suppliers that have Medicare billing privileges. Thus, 
for instance, a Part D prescriber's Medicare enrollment may be revoked 
if one of the revocation reasons in Sec.  424.535(a) applies.
    We note also that the opening paragraph of Sec.  424.530(a), which 
deals with denials, uses the term ``enrollment'' as well. Our change to 
Sec.  424.535(a) would achieve consistency with Sec.  424.530(a) in 
this regard.
    Notwithstanding the non-finalization of the proposed changes to 
Sec.  424.507 and the removal of the Part D enrollment requirement, we 
believe that this proposed clarification to Sec.  424.535(a) remains 
necessary. This is because some providers and suppliers (for example, 
DMEPOS suppliers; physicians who certify home health services) are 
still required under Sec.  424.507(a) to enroll in Medicare to order or 
certify certain Medicare items or services. We are thus finalizing this 
revision.
    In addition, we are removing the phrase ``or supplier agreement'' 
from Sec.  424.535(a). We believe that the reference to ``supplier 
agreement'' in this paragraph has caused confusion.
17. Miscellaneous Comments
    We also received the following miscellaneous comments:
    Comment: A commenter questioned whether a prescriber whose 
enrollment has been denied or revoked and has been terminated on the 
Medicare Individual Provider List will still qualify for provisional 
fills and, if not, how they will be identified.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter stated that there must be stricter 
requirements that individuals must meet before being approved for 
Medicare, Medicaid, or CHIP. The commenter stated that--(1) there 
should be a marketing committee established to go into low-income 
neighborhoods to educate individuals about government health insurance 
assistance programs and to work to enroll individuals who meet the 
requirements; and (2) after these individuals are enrolled into a 
qualified health insurance program, there should be a follow-up 
conducted every 3 months to ensure that the individual still meets the 
requirements and that there is no increase in his or her income. The 
commenter added that conducting daily license and background monitoring 
will help individuals who are misusing their access to these federal 
health insurance assistance programs. Moreover, the commenter stated 
that there should be a fine for individuals who commit fraud relating 
to a failure to report changes that have been made to their income or 
even if they no longer need the assistance of their federal health 
insurance.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter commended CMS for continuing work on anti-
fraud issues in the proposed rule and recommended that the agency 
emphasize the use of cost-effective anesthesia care provided by 
certified registered nurse anesthetists (CRNAs). Anesthesiologist 
medical direction reimbursement models, the commenter stated, 
contribute to increased healthcare system costs without improving 
access or quality. They also present fraud risk when medical direction 
requirements are not met by the anesthesiologist submitting a claim for 
such services. The commenter stated that CMS should--(1) direct 
Medicare, Medicaid and CHIP programs to

[[Page 47841]]

consider such costs in developing and carrying out their systems for 
anesthesia reimbursement, and to favor reimbursement systems that 
support the most cost-effective and safe anesthesia delivery models, 
such as for non-medically directed CRNA services; and (2) direct states 
to eliminate from their Medicaid plans such requirements for medical 
direction of CRNA services.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter stated that the proposed rule does not specify 
how long CMS might suspend payments to wrongly accused providers. The 
commenter requested further clarification on the timeline CMS envisions 
for due process in cases where payments are suspended due to suspected 
fraud.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter expressed concern about providers and 
suppliers repeatedly changing their names and identities to avoid 
sanctions. The commenter suggested that if the provider is about to be 
revoked due to a questionable situation, it should be allowed 30 days 
to change its practices or procedures. If it fails to comply with CMS 
regulations--(1) its enrollment should be revoked; and (2) the revoked 
status should apply to the name of the provider as well as everyone in 
management, billing, and any other identifications regarding that 
business. This would prevent the owners from filing for a new federal 
employee identification number (FEIN), a new business license from the 
state, and ``opening'' a new business in the same location. If CMS 
could develop this ability, the commenter stated, it could track this 
type of fraudulent activity and prevent such situations from happening.
    Response: We appreciate these suggestions and will take them into 
consideration as we continue to explore additional means of protecting 
the Trust Funds from improper behavior.
    Comment: A commenter stated that when seeking enrollment in 
Medicare, a provider should furnish supporting documentation to 
establish its identity and the business that it is conducting. This 
could include--(1) documentation of state licensure to practice and/or 
state business licensure; (2) federal payroll information proving that 
the provider has employees or is paying payroll taxes; (3) receipts of 
sales for services to customers that are not being billed through CMS; 
(4) any and all legal matters that are being investigated for fraud or 
misrepresentation; (5) for practicing physicians, a copy of his or her 
malpractice insurance, and a report of the number of malpractice cases 
pending or settled on his or her behalf; and (6) a background report 
from the OIG on all employees and managing partners that will be 
involved in the billing process. The commenter stated that by providing 
this additional information, CMS can more easily determine the nature 
and character of the individual or business applying for enrollment.
    Response: We appreciate these suggestions and will take them into 
consideration as we continue to explore additional means of protecting 
the Trust Funds from improper behavior.
    Comment: A commenter stated that the high burden of the proposed 
rule could force innocent providers and suppliers to downscale or close 
their practices altogether, which could cause access to care issues. 
Another commenter stated that the final rule should focus on 
organizations with historical integrity issues versus a ``wide swath'' 
approach.
    Response: We appreciate these concerns. As previously explained, 
however, we have, among other things--(1) modified our affiliation 
disclosure provisions; and (2) consistently emphasized in this final 
rule with comment period that we will exercise our denial and 
revocation authorities in a cautious, careful, and judicious manner, 
and not as a routine matter of course.
    Comment: A commenter expressed concern about the disclosure of SSNs 
as part of the enrollment process, citing the need to protect providers 
and suppliers and their owners and managers against identity theft. The 
commenter suggested that CMS--(1) consider the need to eliminate SSN 
disclosure; (2) work with key stakeholders to integrate Medicare/
Medicaid/NPI enrollment into PECOS, thereby reducing the need for 
multiple submissions of SSNs to different programs and eliminating 
duplicative work for providers, CMS, contractors and the states; and/or 
(3) consider establishing a pseudo-identifier in lieu of the NPI.
    Response: We appreciate these suggestions and will take them into 
consideration as we continue to explore additional means of protecting 
the Trust Funds from improper behavior.
    Comment: A commenter stated that, with more than 60,000 DMEPOS 
suppliers enrolled in Medicare, CMS should discontinue its practice of 
allowing Medicare beneficiaries to submit claims for DMEPOS services.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter requested that CMS clarify which NPI is 
entered into the ordering and referring field of the 837P by a locum 
tenens physician.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter recommended that CMS discontinue permitting 
physicians and other practitioners who have their Medicare billing 
privileges suspended from ordering, certifying, or prescribing in the 
Medicare program during the period of said suspension.
    Response: This comment is outside the scope of this rule. We also 
note that, under current policy, Medicare billing privileges are not 
``suspended'' but are instead either denied or revoked. However, 
Medicare payments may be suspended under Sec.  405.371.
    Comment: A commenter recommended that CMS implement the necessary 
edits within its claims processing systems to link a claim with a 
Medicare order or certification for DMEPOS or lab services with the 
name and NPI of the practitioner who furnished the service. The 
commenter believed that this change would prevent suppliers from 
submitting a claim with the name and NPI of a physician that has not 
seen the patient.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter requested clarification regarding the 
rationale for allowing Medicare beneficiaries to submit--(1) DMEPOS 
claims from suppliers that are not accredited; and (2) the CMS-1490 
without the name and NPI of the ordering physician. With the latter, 
the commenter requested an explanation for why CMS does not have 
policies for its contractors to request that name and NPI of the 
physician, recommended that contractors require beneficiaries to submit 
this information, and that contractors verify this information before 
paying a Medicare claim.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter requested clarification as to whether a 
beneficiary can submit a claim for a DMEPOS item when the DMEPOS 
supplier is not enrolled in Medicare. The commenter stated that CMS 
permits this practice.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter sought clarification regarding--(1) whether a 
beneficiary can be paid for DMEPOS when the item or service is obtained 
from a non-Medicare supplier or is ordered or referred from an 
unenrolled physician; (2) how contractors verify whether the ordering 
physician is Medicare-enrolled when the information about the ordering

[[Page 47842]]

physician is not on the Medicare beneficiary claim form; (3) whether 
Medicare will pay a beneficiary for services when the DMEPOS supplier 
does not have a valid supplier number; (4) the number of beneficiary 
DMEPOS claims paid in 2015; and (5) whether CMS' new policies for 
Medicare beneficiaries will prevent beneficiaries from submitting 
claims for off-the-shelf DMEPOS or items purchased at a store that does 
not participate in Medicare.
    Response: These comments are outside the scope of this rule.
    Comment: A commenter urged CMS and its contractors to structure 
their teams to measure and promote continuity with provider 
organizations. The commenter stated that it is important for CMS and 
its contractors to build solid working relationships with local 
providers and organizations that serve Medicare beneficiaries.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter stated that the proposed rule unfairly 
penalizes all providers and suppliers even when there is no risk of 
fraud, abuse and waste. Specifically, the proposal--(1) increases the 
administrative burden and complexity of the enrollment process; (2) 
severely penalizes providers for inadvertent errors without any 
recourse for them; (3) potentially exceeds and contravenes the 
statutory authority granted to CMS through the Affordable Care Act; (4) 
allows CMS to pierce to corporate veil and ignore corporate 
formalities; and (5) creates a de facto exclusion with no accompanying 
due process. In particular, the commenter stated that due process for a 
denied or revoked provider or supplier under the rule is impossible 
within the existing appeals process. The commenter contended that the 
current appeals process furnishes too short a timeframe for providers 
and suppliers to compile and submit evidence of compliance, does not 
permit expedited appeals (which could severely hurt cash flow), and 
contains no process for timely restoring a provider's or supplier's 
enrollment and for reversing any concomitant overpayment demand or 
recalling any debt referral. The commenter made two specific 
recommendations concerning the appeals process. First, CMS should 
modify its existing appeals processes so that providers and suppliers 
can effectively appeal denials and revocations. Second, in the case of 
an overpayment demand for services billed from the retroactive 
effective date of a revocation, the overpayment obligation should be 
stayed to allow providers and suppliers to utilize the appeals process.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter recommended that CMS eliminate the 36-month 
rule under Sec.  424.550(b). The commenter stated that this would 
enable compliance-oriented providers to make business decisions that 
are in the best interests of their operations, their patients and 
communities, and in some instances, their institutional connections.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter stated that it strongly supported the proposed 
rule. The commenter explained that CMS must ensure that only qualified 
providers and suppliers that meet and maintain compliance with the 
program's participation requirements are enrolled. The screening and 
enrollment processes now in place because of the Affordable Care Act, 
the commenter added, help serve that goal, and the enhanced policies, 
authorities, and requirements described in the proposed rule would do 
even more to enhance these processes.
    Response: We appreciate the commenter's support.
    Comment: A commenter recommended that CMS consider sharing 
information with other public and private payers concerning the actions 
taken under this rule. For example, if CMS revokes or denies an 
enrollment based on a risk of fraud, waste, or abuse, it should share 
that information with other payers, including Medicare Part C or D 
contractors, state Medicaid managed care programs, and private health 
insurers. Such information-sharing, the commenter stated, is critical 
to the effective and timely prevention of health care fraud and abuse 
throughout America's health care system.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter stated that the only factor CMS should use to 
determine whether an individual or organization is eligible to 
participate in Medicare is verifiable proof of that party's fraudulent 
or criminal activity.
    Response: We respectfully disagree. We must take steps to protect 
the Medicare program, its beneficiaries, and the Trust Funds against 
wasteful and abusive behavior and potential threats (which can 
eventually materialize into very serious harm) to the same extent we do 
against actual fraudulent and criminal activity.
    Comment: A commenter stated that this and other regulations will 
continue to discourage physicians from wanting to see Medicare and 
Medicaid patients. The commenter added that so long as physicians 
``follow the rules,'' they should not have to report their personal 
investments to the public.
    Response: We respectfully disagree that this rule will discourage 
physicians from seeing Medicare and Medicaid patients. We have issued 
other provider enrollment regulations in previous years, yet the number 
of enrolled physicians continues to increase. Although we are unclear 
which rules and personal investments the commenter is referring to, we 
believe that our new authorities in this final rule with comment period 
will aid our program integrity efforts without unduly burdening the 
vast majority of honest and legitimate providers and suppliers.
    Comment: A commenter encouraged the streamlining of the process 
through which MA plans are notified about providers who are excluded, 
sanctioned, or opted-out of Medicare. The commenter believed this will 
help ensure that MA plans are not paying or including these providers 
in their networks. The commenter made several other recommendations. 
First, CMS should amend its look-back periods for both participating 
and non-participating providers. Participating providers should have a 
1 year look-back period due to contracting constraints; non-
participating providers be given a 3-year look-back period. The 
commenter believed these changes would replace the current 7-year look-
back period. Second, if a provider opted-out of Medicare or Medicaid 
(or both), a private fee agreement between the provider and member 
should be mandated for a provider to bill the member for any services 
rendered. Third, CMS should make clear that a provider opting out of 
Medicare or Medicaid cannot otherwise bill the member without a private 
fee agreement and that there will consequences for doing so.
    Response: This comment is outside the scope of this rule.
    Comment: A commenter stated that CMS' proposed provider enrollment 
standards are mostly proper and effective program integrity measures, 
though the commenter added several recommendations and observations. 
First, any program integrity measure must be targeted to the fraud 
matter at issue; random, untargeted measures could harm to Medicare 
beneficiaries and all other stakeholders. Second, anti-fraud 
initiatives should be evidence-based with a demonstrated return on 
investment. Third, stakeholder support is essential to achieving 
success in

[[Page 47843]]

program integrity; program integrity measures should be developed in a 
transparent manner that allows for public input. Fourth, there must be 
clear legal authority for any program integrity activity. Fifth, anti-
fraud measures should not erect a barrier to appropriate health care 
access. Sixth, any program integrity initiative should properly 
distinguish fraud from unintentional noncompliance. Finally, the 
outcome of program integrity measures should be reliable with no 
``innocent victims'' resulting.
    Response: We appreciate these suggestions and observations and will 
consider them as we continue our efforts to further strengthen Medicare 
program integrity.
    Comment: CMS refers to denials, revocations, and terminations of 
enrollment in the rule. A commenter questioned whether these include 
actions that have been reversed on appeal and/or informal review. The 
commenter recommended that such actions be limited to those that are 
final and/or those that CMS has not reversed.
    Response: We are unclear as to the specific provisions to which the 
commenter is referring, though we believe the reference is to Sec.  
424.519. For reasons previously discussed, we believe that denials, 
revocations, and terminations qualify as disclosable events even if 
they are under appeal.
    Comment: A commenter noted that CMS referred in the proposed rule 
to Sec.  424.535(a)(8)(ii), which permits revocation if the provider 
``has a pattern or practice of submitting claims that fail to meet 
Medicare requirements.'' The commenter requested that CMS define a 
``pattern'' of submitting noncompliant claims.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period. We refer the commenter to 
our discussion of this provision in the previously mentioned December 
5, 2014 final rule, which finalized Sec.  424.535(a)(8)(ii).
    Comment: A commenter requested that CMS furnish guidance on how 
rejected Form CMS-855 applications will be treated as opposed to Form 
CMS-855 application denials. The commenter did not believe that an 
inadvertent clerical error in leaving a data element on the Form CMS-
855 incomplete should be considered a denied enrollment.
    Response: We believe this comment is outside the scope of this 
rule, though we note that existing procedures regarding rejected and 
denied applications can be found in CMS Publication 100-08, Program 
Integrity Manual, Chapter 15.
    Comment: A commenter stated that CMS should establish processes to 
ensure that providers and suppliers--(1) promptly receive notice of 
uncollected debt (for example, sending the notices to multiple 
addresses in the provider's or supplier's enrollment record or creating 
a database that providers and suppliers can query to determine whether 
CMS believes an uncollected debt is owed to CMS or a state Medicaid 
agency); and (2) are given a reasonable amount of time to repay a debt 
(for example, 60 days) and that the debt need not be reported as 
uncollected debt until that time period has elapsed.
    Response: We appreciate these suggestions and observations and will 
consider them as we continue our efforts to further strengthen Medicare 
program integrity.
    Comment: A commenter stated that CMS should avoid broadly painting 
clinicians as perpetrators of fraud, for this fundamentally damages the 
clinician-patient relationship. It also makes it difficult to ensure 
that patients will follow through on recommendations provided by their 
treating professional.
    Response: While we appreciate this comment, we have an obligation 
to protect Medicare, its beneficiaries, and the Trust Funds against 
improper activities. This rule is, accordingly, directed towards 
parties that engage in such behavior.
    Comment: A commenter stated that CMS should revoke all of a 
supplier's NPIs if an owner is convicted of fraud in a court of law.
    Response: We appreciate this comment and note that several of our 
finalized provisions will permit CMS to expand a revocation to a 
provider's or supplier's other locations and enrollments.
    Comment: A commenter stated that CMS should--(1) automatically 
terminate a supplier that has not submitted a claim in 18 months; and 
(2) consider requiring suppliers to maintain all enrollment records 
electronically via PECOS. The commenter believed that the latter would 
better enable suppliers to periodically review their enrollment records 
to ensure their accuracy.
    Response: We appreciate these suggestions and observations and will 
consider them as we continue our efforts to further strengthen Medicare 
program integrity.
    Comment: A commenter stated that while making certain that 
suppliers maintain accurate enrollment information, CMS should be 
similarly required to ensure that PECOS records are up to date. The 
commenter recommended that a timeframe (preferably 30 days) be 
established in which CMS must confirm that online records are up to 
date and accurate.
    Response: We appreciate these suggestions and observations and will 
consider them as we continue our efforts to further strengthen Medicare 
program integrity.
    Comment: A commenter recommended that the effective date of 
enrollment be the date the supplier meets accreditation and licensure 
requirements for a particular location. The commenter stated that 
because this rule may significantly increase the volume of Form CMS-
855S applications received, CMS should ensure that any delays resulting 
therefrom are considered in establishing a date.
    Response: We believe that the commenter's first comment is outside 
the scope of this final rule with comment period. Regarding the second 
comment, we understand the concerns about workload, and we will take 
steps to ensure that applications are processed as promptly as 
possible.
    Commenter: A commenter stated that CMS and its contractors should 
have a defined timeframe in which various processes related to 
enrollment applications must be completed; the commenter cited, as 
examples, a new application being processed within 60 days and a change 
of information or ownership being processed in 90 days. The commenter 
stated that such requirements should extend to Medicaid programs, 
adding that--(1) some state Medicaid programs take up to 9 months to 
process a change of address; and (2) suppliers are not usually notified 
that their application has been processed and approved and that state 
programs should be required to do this.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter stated that CMS should (1) clarify how it will 
treat health care professionals whose Medicare payments were improperly 
suspended because they did not actually commit fraud; and (2) make 
certain that health care professionals whose Medicare enrollment is 
revoked or denied have the opportunity to discuss their matter with 
CMS.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter stated that the costs associated with 
implementing and forcing adherence to the proposed rule outweigh the 
potential benefits to CMS. The vast majority of information will be 
useless to CMS, the commenter

[[Page 47844]]

contended, and not worth the time it takes for CMS to review the data. 
The commenter added that the rule's requirements--(1) could push more 
physicians away from CMS; and (2) are impossible to comply with, 
difficult to enforce, and most likely unconstitutional.
    Response: We disagree that the costs associated with this rule will 
outweigh the benefits to CMS. CMS has an obligation to protect the 
Medicare program, the Trust Funds, and beneficiaries, and we believe 
this rule will go far towards achieving these objectives. Also, and for 
reasons stated previously, we do not believe this rule--(1) will 
discourage physicians from enrolling and remaining in Medicare; or (2) 
lack legal authority. As we are unclear which provisions the commenter 
believes are impossible to comply with and difficult to enforce, we are 
unable to address this particular comment.
    Comment: A commenter recommended that CMS either--(1) incorporate 
data collected by the Council for Affordable Quality Healthcare (CAQH) 
ProView portal system for enrollment; or (2) adopt a system that has 
usability similar to the CAQH portal. CMS could use the CAQH data as a 
starting point (subject to review by the physician and a CMS credential 
verification contractor) to reduce the amount of information doctors 
must provide to CMS. The commenter stated that CMS' adoption of such a 
system would--(1) enable physicians and their practices to spend less 
time and resources on enrollment, focus more on accurately disclosing 
information that may help CMS discover fraud and abuse, and spend more 
time treating patients; and (2) improve the overall enrollment process 
by simplifying and increasing the usability of the current enrollment 
system.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter stated that the proposed rule did not specify 
whom within CMS or its contractors will apply the outlined factors and, 
if applicable, deny or revoke enrollment. Given the potential 
consequences of a denial or revocation, the commenter continued, CMS 
should require contractors to escalate cases to the CMS Regional Office 
for assessment of the factors and final denial or revocation actions.
    Response: We appreciate the commenter's concern. This information 
may be issued via subregulatory guidance.
    Comment: A commenter stated that there should be a ``phase-in 
period'' or a stay on edits within CMS' systems to enable providers to 
come into compliance with the proposed requirements.
    Response: We respectfully disagree that the implementation of this 
rule's provisions should be delayed beyond the timeframes prescribed 
therein. This is particularly true concerning our new denial and 
revocation reasons, which are necessary for the protection for the 
Medicare program, its beneficiaries, and the Trust Funds.
    Comment: A commenter stated that CMS should clarify--(1) which 
penalties would apply to specific types of offenses; and (2) the amount 
of time a potential ban from the Medicare program would be.
    Response: We are unable to provide such specifics in this final 
rule with comment period. The imposition of a denial, revocation, or 
termination and the length of any subsequent reenrollment bar will 
depend upon the particular facts of the situation.
    Comment: A commenter stated that it agreed that some of the 
proposed denial and revocation reasons regarding affiliations may be 
appropriate, but urged CMS implement a materiality threshold to avoid 
denials and revocations for immaterial deficiencies that do not 
adversely affect program integrity.
    Response: We are unclear as to the specific denial and revocation 
reasons to which the commenter believes a materiality standard should 
be applied. Nonetheless, we emphasize that many of our existing and 
proposed denial and revocation reasons contained regulatory-prescribed 
criteria that CMS must carefully take into account before taking 
action; generally speaking, the degree of the provider's or supplier's 
conduct is considered in each case.
    Comment: Several commenters stated that if CMS plans to use 
contractors to implement this rule, it should avoid creating a ``bounty 
system'' that inappropriately incentivizes contractors (for example, 
based on the volume or percentage of providers whose enrollments or 
revalidations they deny or revoke).
    Response: CMS contractors are not rewarded or otherwise given 
financial contractual incentives for denying or revoking provider or 
supplier enrollments or a percentage thereof.
    Comment: A commenter stated that publicly-traded companies should 
not be required to report any direct or indirect ownership interests 
held by mutual funds or other large investment or stock-holding 
vehicles on the Form CMS-855. Since the exact percentage of such 
interests can fluctuate daily and because this data can be very 
difficult to obtain, it is unreasonable and burdensome for publicly-
traded providers or suppliers to track and report such changes.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter recommended that CMS consider implementing 
similar reporting obligations under Medicare and Medicaid. The 
commenter believed that consistency between the Medicare and Medicaid 
programs would--(1) help ensure that the enhanced program integrity 
protections in this rule apply to both programs; and (2) reduce 
providers' compliance burden through uniform reporting requirements, 
even if said requirements reflects the regulatory schemes of the more 
stringent state Medicaid agencies.
    Response: We appreciate this comment but believe it is outside the 
scope of this final rule with comment period.
    Comment: A commenter suggested that CMS specifically include 
notification given to the state confirming the provider's compliance 
with the conditions of participation as a mitigating circumstance in 
determining whether a revocation under Sec.  424.535 is warranted. 
Inclusion of this factor would reduce the concerns of compliant home 
care organizations regarding the proposed rule.
    Response: We appreciate this comment but believe it is outside the 
scope of this rule.

III. Provisions of the Final Rule With Comment Period

    This final rule with comment period incorporates the provisions of 
the proposed rule. Those provisions of this final rule with comment 
period that differ from the proposed rule are as follows:
     We are not finalizing our proposed changes to Sec. Sec.  
424.505, 424.507, 424.510, or to the definition of Enroll/enrollment in 
Sec.  424.502.
     Changes to ``Disclosure of affiliations'' (Medicare Sec.  
424.519 and Medicaid Sec.  455.107):
    ++ We are adding a definition of ``disclosable event'' to 
Sec. Sec.  424.502 and 455.101 that will apply to, respectively, 
Sec. Sec.  424.519 and 455.107. A ``disclosable event'' under these 
definitions means any of the following:

--Currently has an uncollected debt to Medicare, Medicaid, or CHIP, 
regardless of: the amount of the debt;

[[Page 47845]]

whether the debt is currently being repaid (for example, as part of a 
repayment plan); or whether the debt is currently being appealed;
--Has been or is subject to a payment suspension under a federal health 
care program (as that latter term is defined in section 1128B(f) of the 
Act), regardless of when the payment suspension occurred or was 
imposed;
--Has been or is excluded by the OIG from participation in Medicare, 
Medicaid, or CHIP, regardless of whether the exclusion is currently 
being appealed or when the exclusion occurred or was imposed; or
--Has had its Medicare, Medicaid, or CHIP enrollment denied, revoked or 
terminated, regardless of: (i) The reason for the denial, revocation, 
or termination; (ii) whether the denial, revocation, or termination is 
currently being appealed; or (iii) when the denial, revocation, or 
termination occurred or was imposed.

    ++ We are adding the following language to the end of the opening 
paragraph of Sec.  424.519(a): ``to the definition of disclosable event 
in Sec.  424.502:'' We are making a similar change to the opening 
paragraph of Sec.  455.107(a) with respect to Sec.  455.101.
    ++ Proposed Sec. Sec.  424.519(a)(1)(ii) and 455.107(a)(1)(ii) are 
being finalized as ``Civil money penalties imposed under this title''.
    ++ Proposed Sec. Sec.  424.519(a)(1)(iii) and 455.107(a)(1)(iii) 
are being finalized as ``Assessments imposed under this title.''
    ++ We are revising the entirety of Sec.  424.519(b) to now read as 
set out in the regulatory text.

--In Sec. Sec.  424.519(f) and 455.107(f), we are changing the term 
``action'' to ``disclosable event.''
--We are not finalizing proposed Sec.  424.519(h)(1) and (h)(2)(i).
--Proposed Sec.  424.519(h)(2)(ii) is being finalized as new paragraph 
(h) ``Duplicate data''.

    ++ We are revising 455.107(b) to specify the following:
    ++ Under paragraph (b)(1)(i), a state, in consultation with CMS, 
must select one of the two options identified in paragraph (b)(2) for 
requiring the disclosure of affiliation information.
    ++ Under paragraph (b)(1)(ii), a state may not change its selection 
under paragraph (b) after it has been made.
    ++ Paragraph (b)(2)(i) describes the first option. Specifically, in 
a state that has selected this option, a provider that is not enrolled 
in Medicare but is initially enrolling in Medicaid or CHIP (or is 
revalidating its Medicaid or CHIP enrollment information) must disclose 
any and all affiliations that it or any of its owning or managing 
employees or organizations (consistent with the terms ``person with an 
ownership or control interest'' and ``managing employee'' as defined in 
Sec.  455.101) has or, within the previous 5 years, had with a 
currently or formerly enrolled Medicare, Medicaid, or CHIP provider or 
supplier that has a disclosable event (as defined in Sec.  455.101).--
    ++ Paragraph (b)(2)(ii) describes the second option. Specifically, 
in a state that has selected this option, upon request by the state, a 
provider that is not enrolled in Medicare but is initially enrolling in 
Medicaid or CHIP (or is revalidating its Medicaid or CHIP enrollment 
information) must disclose any and all affiliations that it or any of 
its owning or managing employees or organizations (consistent with the 
terms ``person with an ownership or control interest'' and ``managing 
employee'' as defined in Sec.  455.101) has or, within the previous 5 
years, had with a currently or formerly enrolled Medicare, Medicaid, or 
CHIP provider or supplier that has a disclosable event (as defined in 
Sec.  455.101). The state will request such disclosures when it, in 
consultation with CMS, has determined that the initially enrolling or 
revalidating provider may have at least one such affiliation.
    ++ In Sec.  455.107(d), we are adding the language ``in 
consultation with the Secretary'' at the end thereof.
    ++ We are not finalizing proposed Sec.  455.107(h) and are 
redesignating Sec.  455.107(i) as Sec.  455.107(h). We are changing the 
heading of Sec.  424.530(a)(13) from ``Affiliation that poses undue 
risk of fraud'' to simply ``Affiliation that poses an undue risk''.
     In Sec.  424.530(a)(14), we are changing the phrase 
``particular State Medicaid program'' to ``State Medicaid program''. We 
are also adding ``(as that term is defined in Sec.  424.502)'' to Sec.  
424.530(a)(14)(i)(B) as a reference to the regulatory definition of 
final adverse actions.
     In Sec.  424.535(a)(12), we are changing ``particular 
Medicaid program'' to ``State Medicaid program''. Also, we are changing 
the term ``terminate'' to ``revoke'' in Sec.  424.535(a)(12)(ii) to 
clarify that CMS revokes enrollments.
     In Sec.  424.535(a)(17), we are adding the word 
``appropriately'' before ``refers''. Also, we are adding the language 
``(to the extent this can be determined)'' to the end of the factors 
enumerated in Sec.  424.535(a)(17)(ii) and (iii).
     In Sec.  424.535(a)(20), we are modifying the beginning of 
the section to read as set out in the regulatory text.
     We are revising Sec.  405.425(i) to state that the 
physician or practitioner who has not been excluded under sections 
1128, 1156 or 1892 of the Act and whose Medicare enrollment is not 
revoked under Sec.  424.535 of this chapter may order, certify the need 
for, prescribe, or refer a beneficiary for Medicare-covered items, 
services, and drugs, provided the physician or practitioner is not 
paid, directly or indirectly, for such services (except as provided in 
Sec.  405.440).
     In Sec.  405.425(j), we are changing the language ``items 
and services'' to ``items, services, and drugs''. Also, we are revising 
the closing language of Sec.  405.425(j) by revising the last clause of 
the paragraph to clarify the compliance with and the effective date of 
the exclusion.
     We are not finalizing proposed Sec.  424.57(d)(16).
     We are adding a new paragraph (c) to Sec.  405.800 that 
discusses additional years applied to a provider's or supplier's 
existing reenrollment bar under Sec.  424.535(c)(2)(i) and the 
notification requirements associated therewith. These requirements 
apply only to the years added to the existing reenrollment bar under 
Sec.  424.535(c)(2)(i) and not to the original length of the 
reenrollment bar, which is not subject to appeal.
     We are revising Sec.  498.3(b)(17) as follows:
    ++ The existing version of paragraph (b)(17) will be redesignated 
as paragraph (17)(i).
    ++ New paragraph (b)(17)(ii) will address the addition of years to 
a provider's or supplier's existing reenrollment bar;
    ++ New paragraph (b)(17)(iii) will address appeals concerning Sec.  
424.535(c)(3).

IV. Collection of Information Requirements

    Under the Paperwork Reduction Act of 1995, we are required to 
provide 60-day notice in the Federal Register and solicit public 
comment before a collection of information requirement is submitted to 
the Office of Management and Budget (OMB) for review and approval. In 
order to fairly evaluate whether an information collection should be 
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act 
of 1995 requires that we solicited comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency.
     The accuracy of our estimate of the information collection 
burden.

[[Page 47846]]

     The quality, utility, and clarity of the information to be 
collected.
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    In the proposed rule, we estimated a total information collection 
burden of $285 million in each of the first 3 years of this rule. Most 
of this cost stemmed from our affiliation proposal (Sec. Sec.  424.519 
and 455.107), the principal burden of which would come from--(1) all 
initially enrolling and revalidating providers and suppliers having to 
completion of the applicable enrollment application sections; and (2) 
the time involved in researching data. We solicited public comment and 
feedback regarding these burdens.
    This collection of information section will address the costs 
associated with this rule. The regulatory impact analysis section of 
this final rule with comment period will analyze the rule's savings.

A. ICRs Related to Affiliations (Sec. Sec.  424.519 and 455.107)

    Proposed Sec. Sec.  424.519 and 455.107 required that a Medicare, 
Medicaid, or CHIP provider or supplier disclose information about 
present and past affiliations with certain currently or formerly 
enrolled Medicare, Medicaid, or CHIP providers and suppliers. Medicare 
providers and suppliers will furnish this information via the paper or 
internet-based version of the Form CMS-855 applications, which will be 
updated to collect this data.
    Though the specific vehicle for collecting affiliation information 
a from Medicaid and CHIP providers and suppliers is left to the state's 
discretion, we anticipate that the information will be provided on an 
existing enrollment form or through a separate form created by the 
state. The principal burden involved with this collection will be the 
time and effort needed to--(1) obtain this information; and (2) 
complete and submit the appropriate section of the applicable form.
    We proposed that the data would be submitted upon initial 
enrollment and revalidation; new affiliations and changes in current 
affiliations would also have to be reported. As discussed in section 
II.A. of this final rule with comment period, and with the exception of 
the first option under Sec.  455.107(b), we are now restricting the 
reporting requirements to instances where CMS or the state, as 
applicable, requests the information. The following estimates in 
section V.A. of this final rule with comment period reflect our final 
policies for Sec. Sec.  424.519 and 455.107.
1. Medicare
    We estimated in the proposed rule that it would take each provider 
or supplier an average of 10 hours to obtain and furnish this 
information. Although some commenters, as described later in section, 
expressed concern with the 10-hour estimate for obtaining and 
furnishing this data after a CMS request, we are retaining our estimate 
of 10 hours. We believe that a typical provider or supplier's effort to 
secure the data, coupled with furnishing the information on the 
appropriate Form CMS-855 application, will require, on average, 10 
hours or less in most cases. It is true that for large providers or 
suppliers, the average time expenditure may be higher than 10 hours; 
for small providers and suppliers, however, the average time 
expenditure will likely be considerably less than 10 hours. Therefore, 
we believe that 10 hours remains a reasonable estimate for purposes of 
the information collection requirement (ICR) cost burden projection.
    We cannot conclusively predict the number of instances in which CMS 
will request the reporting of disclosable affiliations under Sec.  
424.519 in each of the first 3 years of the rule. However, for purposes 
of this information collection request only, and as we indicated 
previously in this rule, we believe that average of 2,500 requests per 
year is a reasonable projection. This results in an estimated annual 
hour burden of 25,000 hours.
    Per our experience, we believe that the reporting provider's or 
supplier's administrative staff (for example, officer managers and 
support staff) will be responsible for securing and listing affiliation 
data on the Form CMS-855. According to the most recent wage data 
provided by the Bureau of Labor Statistics (BLS) for May 2018, the mean 
hourly wage for the general category of ``Office and Administrative 
Support Occupations'' is $18.75 per hour (see https://www.bls.gov/oes/current/oes_nat.htm#430000). With fringe benefits and overhead, the per 
hour rate is $37.50. Given the foregoing, and using this per hour rate, 
we estimate the annual ICR burden for initially enrolling and 
revalidating providers and suppliers from Sec.  424.519 to be 25,000 
hours (2,500 requests x 10 hours) at a cost of $937,500 (25,000 hours x 
$37.50).
2. Medicaid and CHIP
    We cannot project the number of instances in which states will 
request the reporting of disclosable affiliations under Sec.  455.107. 
This is particularly true given that, under revised Sec.  455.107(b)--
(1) states will have two options for requesting affiliation 
information, and we do not know which states will select which 
alternatives; and (2) we do not know when each state will update its 
applicable data collection mechanism to reflect the Sec.  455.107(b) 
requirements.
3. Collection of Information From States
    As we stated in the proposed rule, it is possible that states may 
eventually be required to report to CMS certain information regarding 
its processing of data submitted under Sec.  455.107. This may include, 
for example, the number of applications in which an affiliation was 
reported and the number of cases in which the state determined that an 
affiliation posed an undue risk. However, we are unable to estimate the 
possible ICR burden because we do not know whether, to what extent, and 
by what vehicle data concerning Sec.  455.107 will be reported to CMS.
4. Total Burden
    We estimate a total annual ICR burden of our affiliation disclosure 
requirements of 25,000 hours at a cost of $937,500.

B. ICRs Related to Our Proposed and Finalized Denial Reasons in Sec.  
424.530 and Revocation Reasons in Sec.  424.535

    We do not anticipate any collection burden resulting from our 
revisions to the denial authorities in Sec.  424.530 or the revocation 
authorities in Sec.  424.535. An appeal from a denial of enrollment or 
an appeal from a revocation of enrollment are both exempt from the PRA. 
There are no other potential sources of ICR that would result from the 
final rule's changes to the denial or revocation authorities.

C. ICRs Related to Changes in Maximum Reenrollment Bars (Sec.  
424.535(c)) and the Establishment of Reapplication Bars (Sec.  
424.530(f))

    We do not anticipate any collection burden resulting from our 
revisions to Sec.  424.535(c). The burden, in fact, may actually 
decrease because certain providers and suppliers may be barred from 
Medicare for a longer period of time and thus will submit Form CMS-855 
applications less frequently. In addition, we do not anticipate any 
collection burden resulting from our addition of Sec.  424.530(f). 
Additional applications will not be submitted because of this 
provision.

D. Documentation

    We revised Sec.  424.516(f) to state that a provider or supplier 
furnishing a Part A

[[Page 47847]]

or B service, item, or drug, as well as the physician or, when 
permitted, eligible professional who ordered, certified, referred, or 
prescribed the Part A or B service, item, or drug must maintain 
documentation for 7 years from the date of the service and furnish 
access to that documentation upon a CMS or Medicare contractor request.
    The burden associated with the requirements in Sec.  424.516(f) 
will be the time and effort necessary to both maintain documentation on 
file and to furnish the information upon request to CMS or a Medicare 
contractor. While the requirement is subject to the PRA, we believe the 
associated burden is negligible. As discussed in the previously 
referenced November 19, 2008 final rule (73 FR 69915) and the April 27, 
2012 final rule (77 FR 25313), we believe the burden associated with 
maintaining documentation and furnishing it upon request is a usual and 
customary business practice.

E. ICRs Related to Temporary Moratorium (Sec.  424.570)

    We were unable in the proposed rule to estimate the number of 
applications that will be approved or denied as a result of our changes 
to Sec.  424.570, for we had insufficient data on which to base a 
precise projection. To enhance our ability to formulate such an 
estimate, we solicited comment on--(1) whether an annual figure of 
2,000 potentially impacted providers and suppliers could serve as a 
reasonable approximation; and (2) the potential cost burden to 
providers and suppliers. We received no specific comments on either 
issue and remain unable to provide a reasonable estimate because we do 
not have adequate information with which to do so.

F. ICRs Related to Reactivations (Sec.  424.540(b))

    We were unable in the proposed rule to project the number of 
certifications that will be submitted versus the number of complete 
Form CMS-855 applications. To enhance our ability to formulate a 
projection of the ICR burden associated with this provision, we 
solicited comment on--(1) whether an annual figure of 10,000 instances 
in which a Form CMS-855 will be requested could serve as a reasonable 
approximation; and (2) the potential cost burden to providers and 
suppliers. We received no comments and remain unable to formulate a 
reasonable estimate due to the lack of sufficient data.

G. Revision to Definition of Enrollment (Sec.  424.535(a))

    As this revision is primarily technical in nature, we do not 
foresee an associated ICR burden.

H. Total ICR Overall Burden

    Based on the foregoing, we estimate an annual ICR burden over each 
of the first 3 years of the rule of 25,000 hours at a cost of $937,500. 
These costs are limited to our affiliation provisions, for, as 
discussed above, we do not anticipate costs associated with any of our 
other provisions. We note that the annual ICR burden in this final rule 
with comment period is significantly less than the predicted $285 
million dollar annual ICR burden in the proposed rule based on our 
election to pursue a phased-in approach for Medicare, Medicaid, and 
CHIP affiliation disclosures.

I. Comments Received on Our ICR Estimates in the Proposed Rule

    The following is a summary of the comments we received on our ICR 
estimates in the proposed rule:
    Comment: Several commenters contended that the $289.8 million cost 
estimate and the 10-hour estimate in the proposed rule associated with 
reporting disclosable affiliations were too low. They generally stated 
that these projections did not account for lost productivity to 
physician practices, including diversion of staff from clinical and 
related duties that directly impact and support patient care. A 
commenter stated that the rule's cost does not justify the value of any 
benefits accruing from the rule.
    Response: We disagree. As stated previously, we will be taking a 
phased-in approach with the affiliations provisions. The overwhelming 
majority of enrolling and revalidating providers will not be requested 
to provide affiliations disclosures upon the effective date of this 
rule. Accordingly, consistent with our earlier discussion, the annual 
costs over the first 3 years of this rule will be less than $1 million 
because far fewer providers and suppliers than estimated in the 
proposed rule will be required to disclose affiliation data.
    The 10-hour estimate, which formed the basis of our initial $289.8 
projection in the proposed rule, accounts for the fact that many 
providers and suppliers are small in nature (for example, solo 
practitioners and small group practices) and will accordingly have few, 
if any, affiliations. It is true that larger providers and suppliers 
may need to spend more than 10 hours in researching affiliation 
information. Insofar as any diversion from patient care, we do not 
believe that reporting affiliation data upon initial enrollment and 
once every 3 or 5 years thereafter (depending on provider or supplier 
type) will negatively impact beneficiary services. Finally, and as 
shown in Table 2, we believe that the prevention of problematic 
providers and suppliers from accessing the Trust Funds will more than 
offset the costs associated with this rule.
    Comment: A commenter stated that providers and suppliers would need 
to (1) develop systems to track and monitor all identified affiliation 
relationships; and (2) rely on higher paid, more sophisticated 
employees or an outside consultant or attorney, at a rate substantially 
higher than $34 per hour.
    Response: We disagree. We believe that our removal of proposed 
Sec. Sec.  424.519(h)(1) and (h)(2)(i) and 455.107(h) will effectively 
eliminate the burden of regularly tracking disclosable affiliation 
data. Also, it has been our experience that the researching and 
reporting of ownership and managerial information on the Form CMS-855 
is typically performed by the provider's or supplier's administrative 
staff. We believe that providers and suppliers will use this same 
approach with disclosable affiliation data.
    Comment: Several commenters stated that the 30-minute estimate for 
reporting a new affiliation or a change to an existing affiliation is 
too low.
    Response: As previously stated, we are not finalizing proposed 
Sec. Sec.  424.519(h)(1) and (h)(2)(i) and 455.107(h).
    Comment: A commenter stated that CMS (1) underestimated the time 
necessary to complete the Form CMS-855O, (2) underestimated the value 
of the doctors' time at $93.74 (or $187.48 with fringe benefits and 
overhead), (3) did not account for the cost to patients and society of 
diverting so many hours of doctors' time away from patient care for the 
completion of government forms, and (4) unrealistically limited the ICR 
cost to the rule's first 3 years.
    Response: We disagree with these comments. Our estimated time for 
completing the Form CMS-855O is consistent with our prior public 
projections as well as with feedback we have received from the provider 
community. Also, our projection regarding physician wages and our use 
of the 3-year ICR estimate are consistent with policies established by 
the Office of Management and Budget. Regarding the third comment, and 
as alluded to earlier, we do not believe that--(1) reporting 
affiliation data upon initial

[[Page 47848]]

enrollment and once every 3 or 5 years thereafter; or (2) completing 
the Form CMS-855O will negatively affect patient care. However, we note 
that we are not finalizing our proposed changes to Sec.  424.507, which 
we believe would alleviate further the burden on the physician 
community.
    If you comment on these information collection and recordkeeping 
requirements, please do either of the following:
    1. Submit your comments electronically as specified in the 
ADDRESSES section of this final rule with comment period; or
    2. Submit your comments to the Office of Information and Regulatory 
Affairs, Office of Management and Budget,
    Attention: CMS Desk Officer, CMS-6058-P
    Fax: (202) 395-6974; or
    Email: [email protected]

V. Regulatory Impact Analysis

A. Statement of Need

    As previously stated, this final rule with comment period is 
necessary to implement sections 1866(j)(5) and 1902(kk)(3) of the Act, 
which require providers and suppliers to disclose information related 
to any current or previous affiliation with a provider or supplier that 
has uncollected debt; has been or is subject to a payment suspension 
under a federal health care program; has been excluded from 
participation under Medicare, Medicaid, or CHIP; or has had its billing 
privileges denied or revoked. This final rule with comment period is 
also necessary to address other program integrity issues that have 
arisen. We believe that our finalized provisions will--(1) enable CMS 
and the states to better track current and past relationships involving 
different providers and suppliers; and (2) assist our efforts to stem 
fraud, waste, and abuse, hence protecting the Medicare Trust Funds. 
Failure to publish this rule, we believe, would continue to enable 
certain parties engaging in fraud, waste, and abuse to bill the 
Medicare program, endangering both the Trust Funds and Medicare 
beneficiaries.

B. Savings and Impact

1. Background
    We have examined the impacts of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, 
section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 
1995; Pub. L. 104-4) and Executive Order 13132 on Federalism (August 4, 
1999) and the Congressional Review Act (5 U.S.C. 804(2)) and Executive 
Order 13771 on Reducing Regulation and Controlling Regulatory Costs 
(January 30, 2017).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). Section 
3(f) of Executive Order 12866 defines a ``significant regulatory 
action'' as an action that is likely to result in a rule--(1) having an 
annual effect on the economy of $100 million or more in any 1 year, or 
adversely and materially affecting a sector of the economy, 
productivity, competition, jobs, the environment, public health or 
safety, or state, local or tribal governments or communities (also 
referred to as ``economically significant''); (2) creating a serious 
inconsistency or otherwise interfering with an action taken or planned 
by another agency; (3) materially altering the budgetary impacts of 
entitlement grants, user fees, or loan programs or the rights and 
obligations of recipients thereof; or (4) raising novel legal or policy 
issues arising out of legal mandates, the President's priorities or the 
principles set forth in the Executive Order.
    A regulatory impact analysis (RIA) must be prepared for major rules 
with economically significant effects ($100 million or more in any 1 
year). We explained in section IV. of this final rule with comment 
period that the costs of our provisions will not exceed $100 million in 
any of the first 3 years of this final rule with comment period. 
However, as discussed we expect that annual federal budget savings over 
this 3-year period will exceed $100 million. Therefore, we estimate 
that this rulemaking is economically significant as measured by the 
$100 million threshold and thus is a major rule under the Congressional 
Review Act. We have accordingly prepared this RIA.
2. Savings
a. Affiliations (Sec. Sec.  424.519 and 455.107)
    As explained in Section I. of this rule, over the last 5 years, 
$51.9 billion dollars (with adjusted factors applied) has been paid to 
2,097 entities with affiliations stemming from the revoked Medicare 
enrollment of an associated individual or other entity. If the 
affiliations/undue risk revocation authority we are finalizing had been 
in place during that period, we project that CMS would have taken 
revocation action in approximately 40 percent of identified prior 
affiliation cases (or approximately 838 cases) based on a determination 
of undue risk of fraud, waste, or abuse. Accordingly, we would not have 
paid those problematic providers who we know are at the core of the 
ongoing fraud risk we face. As a result, over the last 5 years the 
program would have seen a resulting $20.7 billion in cost-avoidance 
savings, or an average of $4.14 billion per year. We project for 
purposes of this final rule with comment period that similar savings 
could be achieved once our affiliation provisions become effective.
    We believe it is appropriate, however, to outline a range of 
savings estimates for our affiliation provisions, given the potential 
for fluctuations. We thus restate the projections we outlined in Table 
1, based on figures of 20 percent, 40 percent, and 60 percent:

 Table 2--Range of Projected Savings Related to Affiliations Provisions
------------------------------------------------------------------------
                                                              Annual
                                                           affiliations
            Percentage               5-Year affiliations     authority
                                       authority total         total
                                                             (billion)
------------------------------------------------------------------------
60% of the 5-year adjusted factor   $31.1 billion over 5           $6.22
 total of $51.9 billion.             years.
40% of the 5-year adjusted factor   $20.7 billion over 5            4.14
 total of $51.9 billion.             years.
20% of the 5-year adjusted factor   $10.3 billion over 5            2.06
 total of $51.9 billion.             years.
------------------------------------------------------------------------


[[Page 47849]]

    We plan to begin updating our enrollment applications within 1 year 
of publication of the final rule with comment. Once all of the 
enrollment forms are completed and have gone through the PRA process 
(during which we will solicit public comment on our burden estimates 
for completing and submitting affiliation data via the Form CMS-855), 
and subregulatory guidance has been disseminated to the states 
regarding phase one, we will begin the process of entering phase two of 
the affiliations disclosure process. As we have stated throughout this 
rule, the initial period of the affiliation requirement will enable CMS 
to carefully monitor and analyze the progress and operational 
components of the phased-in approach in preparation for the subsequent 
future rulemaking.
b. New Denial Reasons in Sec.  424.530 and Revocation Reasons in Sec.  
424.535
    In section IV. of the proposed rule, we explained the difficulty in 
predicting the number of denials and revocations that would result from 
our proposed revisions. Considering that these would be new provisions, 
there were no historical statistics upon which we could base adequate 
estimates. Nonetheless, we outlined the following tentative estimates 
strictly for purposes of soliciting public comment on the number of 
denials or revocations that CMS was likely to undertake each year:

         Table 3--Projected Denials/Revocations in Proposed Rule
------------------------------------------------------------------------
                                                     Projected number of
                                                     denials/revocations
            Denial/revocation authority                for purposes of
                                                    comment solicitation
------------------------------------------------------------------------
Different Name, Numerical Identifier or Business                   8,000
 Identity (Sec.  Sec.   424.530(a)(12) and
 424.535(a)(18))..................................
Billing for Non[dash]Compliant Location (Sec.                        (*)
 424.535(a)(20))..................................
Abusive Ordering, Certifying, Referring or                         4,000
 Prescribing of Part A or B Services, Items or
 Drugs (Sec.   424.535(a)(21))....................
Referral of Debt to the United States Department                   2,000
 of Treasury (Sec.   424.535(a)(17))..............
Reporting Requirements (Sec.   424.535(a)(9)).....                10,000
Payment Suspensions (Sec.   424.530(a)(7) and Sec.                 1,000
   405.371).......................................
Denials and Revocations for Other Federal Program                  2,500
 Termination or Suspension (Sec.   424.530(a)(14))
Extension of Revocation (Sec.   424.535(i)).......              **12,000
Voluntary Termination Pending Revocation (Sec.                     2,000
 424.535(j))......................................
------------------------------------------------------------------------
* We were and remain unable to devise a concrete estimate for this
  revocation reason. While there is data concerning the number of
  locations that are terminated from Medicare for non-compliance each
  year, we cannot predict the number of additional locations that will
  be terminated due to Sec.   424.535(a)(20). In other words, if a
  provider or supplier has five locations and one is terminated for non-
  compliance, we have no means of predicting whether any or all of the
  remaining four locations will be terminated. This is because each
  provider's and supplier's circumstances are different.
** The 12,000 figure represents revoked enrollments. We projected (for
  purposes of comment solicitation only) that this would involve 5,000
  providers and suppliers.

    We received no comments on these estimates. After careful 
consideration, and for several reasons, we believe that said 
projections were too high and that a smaller, uniform number 
encompassing all of the denial and revocation reasons listed earlier is 
more appropriate. First, and as we explain throughout this final rule 
with comment period, we do not intend to deny and revoke providers and 
suppliers as a routine matter of course. We recognize the legal 
significance of such actions and the effect it can have on the provider 
or supplier in question. We reiterate that we will only exercise our 
authority under these new denial and revocations very cautiously and 
only after the most careful and thorough consideration of--(1) the 
regulatorily-outlined factors associated with each reason; and (2) the 
circumstances surrounding the particular case. This warrants, in our 
view, significantly smaller estimates than what we proposed for public 
comment. Second, while we made tentative estimates in the proposed rule 
for comment solicitation purposes, we made clear that we did not, and 
indeed could not, know how many instances in which each denial and 
revocation authority would be exercised. These were entirely new 
provisions for which there was no historical data upon which to base 
reasonable estimates. We continue to hold this view and accordingly 
believe that the best approach for projecting the number of denials and 
revocations is to establish a single figure encompassing all of the 
authorities identified in Table 1.
    We project that our new revocation authorities will lead to 2,600 
new revocations per year, which we believe is a conservative and, as 
explained previously, a necessarily cautious estimate. This will result 
in 10-year savings to the federal government of $4.16 billion, a figure 
predicated on internal CMS data indicating a per provider annual 
payment amount of $160,000 (2,600 x $160,000). The average annual 
savings to the federal government will thus be $416 million.
c. Maximum Reenrollment Bars (Sec.  424.535(c)) and the Establishment 
of Reapplication Bars (Sec.  424.530(f))
    We estimate that our reenrollment and reapplication bar provisions 
will annually impact 400 Medicare revocations, leading to savings above 
and beyond that which CMS experiences today based on the current three-
year maximum reenrollment bar.
    We project that this would result in estimated actual savings of 
$1.79 billion over 10 years based on our earlier project per provider 
amount of $160,000. The following example illustrates the rationale 
behind this calculation. The year 1 batch of 400 revocations would have 
7 years of actualized savings during the first 10 year period. The 
first 3 years would not generate new savings because the previous 
maximum reenrollment bar was 3 years. Thus, savings from this rule 
would begin in year 4 and run through year 10 yielding a savings of 
$448 million for the year 1 batch of revocations ($160,000 x 400 x 7). 
Additionally, the year 2 batch of 400 revocations would have 6 years of 
actualized savings during the first 10 year period. In year 1 these 
entities were not revoked and years 2 through 4 did not generate new 
savings. Thus, savings for the year 2 batch of 400 revocations would 
begin in year 5 and run through year 10 resulting in a savings of $384 
million ($160 x 400 x 6). This pattern would continue for each year's 
batch of 400 revocations. The total 10 year

[[Page 47850]]

savings is, accordingly, anticipated to be $1.79 billion.
    Furthermore, we project that this would result in a ``caused 
savings'' of $4.48 billion based on our earlier projected per provider 
amount of $160,000 (400 x 10 x 7 x $160,000). As noted above, ``caused 
savings'' refers to the full amount of money that will be saved based 
on the new reenrollment and reapplication bars over a 10-year period; a 
large portion of the savings will be made after the first 10-year 
period of interest and will not be fully actualized until year 20.
    The following example illustrates the rationale behind this 
calculation. In year 1, 400 revocations would occur. Currently, and 
until the provisions in this rule are effective, CMS may impose a 
reenrollment bar of 1 to 3 years. Thus, the year 1 batch of 400 
revocations mentioned earlier will not have actualized savings derived 
from this rule until year 4 in the 10-year period following revocation. 
The 7 years of savings associated with the year 1 batch of 400 
revocations would be actualized over the next 10 years, with all 7 of 
those years falling within the initial 10-year period. Additionally, 
the average annual actualized savings during the initial 10-year period 
would be $179 million (the total actualized savings during the first 
10-year period of interest would be $1.79 billion). This is because 
each year's batch of 400 revocations will have 1 less year of 
actualized savings during the first 10-year period. For instance, the 
year 1 batch of 400 revocations will have all 7 years of savings 
actualized within the first 10-year period, the year 2 batch will only 
have 6 of its 7 years of savings actualized within the first 10-year 
period, etc.
d. Totals
    Table 4 outlines the projected annual savings to the federal 
government for the applicable provisions described previously. (For 
affiliations, we are using the aforementioned 40 percent figure, which 
we believe is the most accurate notwithstanding our establishment of a 
projected range in Tables 1 and 2).

       Table 4--Projected Annual Savings to the Federal Government
------------------------------------------------------------------------
                                                            Savings per
                        Provision                            year  ($)
------------------------------------------------------------------------
Affiliation-Based Revocations...........................   4,140,000,000
Other new Revocation Authorities........................     416,000,000
Reenrollment and Reapplication Bars.....................     179,000,000
                                                         ---------------
    Total...............................................   4,735,000,000
------------------------------------------------------------------------

    Given, therefore, our annual savings estimates for affiliation-
based revocations (using our median 40 percent figure), revocations 
from other new authorities, and reenrollment and reapplication bars, we 
project a total savings over a 10-year period of $47.35 billion.
2. Impact
    We believe there will be three principal impacts associated with 
our finalized provisions. First, denied and revoked suppliers could 
incur costs associated with potential lost billings due to denials and 
revocations. Second, we estimate that the denial, revocation, 
reenrollment bar, and reapplication bar provisions described earlier 
will result in approximately $4.735 billion dollars of annual savings 
to the federal government and, by extension, the Medicare Trust Funds 
and the taxpayers. Third, we believe that CMS, Medicare contractors, 
and the states may incur costs, in implementing and enforcing our 
affiliation disclosure provision. These could include information 
technology system changes and provider education. We estimate total 
costs of $937,500 in each year following implementation of the proposed 
rule.
    Executive Order 13771, titled Reducing Regulation and Controlling 
Regulatory Costs, was issued on January 30, 2017. It requires that the 
costs associated with significant new regulations shall, to the extent 
permitted by law, be offset by the elimination of existing costs 
associated with at least two prior regulations. This final rule with 
comment period is considered an E.O. 13771 regulatory action. We 
estimate that this rule generates $0.73 million in annualized costs in 
2016 dollars, discounted at 7 percent relative to year 2016, over a 
perpetual time horizon. Details on the estimated costs of this rule can 
be found in the preceding analyses.
    In accordance with the provisions of Executive Order 12866, this 
rule was reviewed by the Office of Management and Budget.
    Finally, we do not anticipate any significant impact on beneficiary 
access to care from the provisions in this final rule with comment 
period. Only a minute fraction of providers and suppliers, when 
compared to the entire population of providers and suppliers enrolled 
in Medicare, will be revoked or denied as a result of these new and 
revised revocation and denial authorities.

C. Anticipated Effects

    The RFA requires agencies to analyze options for regulatory relief 
of small businesses. For purposes of the RFA, small entities include 
small businesses, nonprofit organization, and small governmental 
jurisdictions. Most entities and most other providers and suppliers are 
small entities, either by nonprofit status or by having revenues less 
than $7.5 million to $38.5 million in any 1 year. Individuals and 
states are not included in the definition of a small entity.
    For several reasons, we do not believe that this final rule with 
comment period will have a significant economic impact on a substantial 
number of small businesses. First, the furnishing of affiliation data 
will be required very infrequently, for example, once every 5 years for 
non-DMEPOS suppliers. The cost burden per provider or supplier (10 
hours for affiliation data) will likely be less than $1,000, which 
should not be a significant burden on a provider or supplier. Second, 
it is true that some small businesses could be denied enrollment or 
have their enrollments revoked under our provisions. Yet the number of 
denials and revocations per year is currently--and will continue to be 
under our new provisions --very small when compared to the total number 
of enrolled providers and suppliers nationwide. Therefore, we do not 
believe that our new denial and revocation reasons will have a 
significant impact on a substantial number of small businesses.

D. Effects on Small Rural Hospitals

    In addition, section 1102(b) of the Act requires us to prepare a 
regulatory impact analysis if a rule may have a significant impact on 
the operations of a substantial number of small rural hospitals. This 
analysis must conform to the provisions of section 604 of the RFA. For 
purposes of section 1102(b) of the Act, we define a small rural 
hospital as a hospital that is located outside of a metropolitan 
statistical area and has fewer than 100 beds. We are not preparing an 
analysis for section 1102(b) of the Act because we have determined, and 
therefore the Secretary has determined, that this final rule with 
comment period will not have a significant impact on the operations of 
a substantial number of small rural hospitals.

E. Unfunded Mandates

    Section 202 of the Unfunded Mandates Reform Act of 1995 (UMRA) also 
requires that agencies assess anticipated costs and benefits before

[[Page 47851]]

issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2018, that 
is approximately $150 million. This rule does not mandate any 
requirements for state, local or tribal governments or for the private 
sector.

F. Executive Order 13132

    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on state 
and local governments, preempts state law or otherwise has federalism 
implications. Since this regulation does not impose any costs on state 
or local governments, the requirements of Executive Order 13132 are not 
applicable.

G. Accounting Statement and Table

    As required by OMB Circular A-4 (available at https://www.whitehouse.gov/omb/circulars/a0004/a-4/pdf), in Table 5 we have 
prepared an accounting statement showing estimates, over the first 3 
years of the rule's implementation, of the total cost burden to 
providers and suppliers for reporting data using, respectively, 7 
percent and 3 percent annualized discount rates.

           Table 5--Accounting Statement Classification of Estimated Costs and Federal Budget Savings
                                                 [$ in millions]
----------------------------------------------------------------------------------------------------------------
                                                                               Units
                                                  --------------------------------------------------------------
             Category                 Estimates                     Discount rate
                                                     Year dollar         (%)               Period covered
----------------------------------------------------------------------------------------------------------------
Costs: *
    Annualized Monetized                      0.9            2017               7  FY 2019-FY 2021.
     ($million/year).
                                              0.9            2017               3  FY 2019-FY 2021.
Savings to the Federal
 Government:
    Annualized Monetized                    4,735            2017               7  FY 2019-FY 2021.
     ($million/year).
                                            4,735            2017               3  FY 2019-FY 2021.
----------------------------------------------------------------------------------------------------------------
* Cost associated with the information collection requirements.

H. Alternatives Considered

    We considered and have finalized several alternatives to reduce the 
overall burden of our provisions.
    First, we contemplated a 10-year timeframe for the affiliation 
lookback period but proposed to limit the timeframe to 5 years. We 
believed this would ease the burden on Medicare, Medicaid, and CHIP 
providers and suppliers by restricting the volume of information that 
must be reported. Similarly, we proposed that changed data regarding 
past affiliations need not be reported. We have finalized the 5-year 
lookback period and have eliminated altogether the requirement to 
report new and changed affiliations as part of a change of information 
request. Although we are unable to calculate the financial savings that 
would accrue to providers and suppliers from not having to (1) research 
and report affiliation data from 6 to 10 years ago, and (2) regularly 
monitor and disclose new or changed affiliation information, we believe 
that the burden on providers and suppliers would be reduced.
    Second, and more generally, we have incorporated a phased-in 
approach for our affiliation disclosure requirements. As previously 
explained, this would dramatically reduce the annual costs to providers 
and suppliers over the first three years of this rule to less than $1 
million. We believe that a phased-in approach is a sounder alternative 
than an immediate, full-blown implementation not only because of the 
burden reduction but also because it would: (1) Give the provider and 
supplier community at large more time to prepare for our affiliation 
provisions; and (2) enable CMS to carefully monitor and analyze the 
progress and operational components of the phased-in approach in 
preparation for the subsequent future rulemaking.
    Third, and for reasons already discussed, we have elected not to 
finalize our proposed changes to Sec.  424.507. We estimated in the 
proposed rule that the annual cost burden to affected providers and 
suppliers of these changes (over the first 3 years of the rule) would 
be approximately $4.5 million. Our non-finalization of these changes 
will eliminate said costs.
    Fourth, regarding our extension of the maximum re-enrollment bar to 
10 years, we considered shorter alternative timeframes. However, we 
settled on 10 years because we believe it was imperative to keep 
demonstrably problematic providers and suppliers out of the Medicare 
program for an extended period. We believe similarly with respect to 
the maximum 20-year period for twice-revoked providers and suppliers. 
Although we contemplated briefer maximum periods, repeated improper 
conduct potentially warranted, in our view, a very long bar.

List of Subjects

42 CFR Part 405

    Administrative practice and procedure, Health facilities, Health 
professions, Kidney diseases, Medical devices, Medicare Reporting and 
recordkeeping requirements, Rural areas, X-rays.

42 CFR Part 424

    Emergency medical services, Health facilities, Health professions, 
Medicare, Reporting and recordkeeping requirements.

42 CFR Part 455

    Fraud, Grant programs--health, Health facilities, Health 
professions, Investigations, Medicaid Reporting and recordkeeping 
requirements.

42 CFR Part 457

    Administrative practice and procedure, Grant programs--health, 
Health insurance, Reporting and recordkeeping requirements.

42 CFR Part 498

    Appeals.

    For the reasons stated in the preamble of this final rule with 
comment period, the Centers for Medicare & Medicaid Services amends 42 
CFR chapter IV as follows:

PART 405--FEDERAL HEALTH INSURANCE FOR THE AGED AND DISABLED

0
1. The authority for part 405 is revised to read as follows:

    Authority:  42 U.S.C. 263a, 405(a), 1302, 1320b-12, 1395x, 
1395y(a), 1395ff, 1395hh, 1395kk, 1395rr, and 1395ww(k).


[[Page 47852]]



0
2. Section 405.371 is amended---
0
a. By revising paragraph (a) introductory text;
0
b. In paragraph (a)(1) by removing the semicolon at the end of the 
paragraph and adding in its place a period.
0
c. In paragraph (a)(2) by removing ``; or'' at the end of paragraph and 
adding in its place a period; and
0
d. By adding paragraph (a)(4).
    The revision and addition read as follows.


Sec.  405.371   Suspension, offset, and recoupment of Medicare payments 
to providers and suppliers of services.

    (a) General rules--Medicare payments to providers and suppliers, as 
authorized under this subchapter (excluding payments to beneficiaries), 
may be one of the following:
* * * * *
    (4) Suspended, in whole or in part, by CMS or a Medicare contractor 
if the provider or supplier has been subject to a Medicaid payment 
suspension under Sec.  455.23(a)(1) of this chapter.
* * * * *

0
3. Section 405.425 is amended by revising paragraphs (i) and (j) to 
read as follows:


Sec.  405.425   Effects of opting-out of Medicare.

* * * * *
    (i) The physician or practitioner who has not been excluded under 
sections 1128, 1156 or 1892 of the Act and whose Medicare enrollment is 
not revoked under Sec.  424.535 of this chapter may order, certify the 
need for, prescribe, or refer a beneficiary for Medicare-covered items, 
services, and drugs, provided the physician or practitioner is not 
paid, directly or indirectly, for such services (except as provided in 
Sec.  405.440).
    (j) The physician or practitioner who is excluded under sections 
1128, 1156 or 1892 of the Act or whose Medicare enrollment is revoked 
under Sec.  424.535 of this chapter may not order, prescribe or certify 
the need for Medicare-covered items, services, and drugs except, with 
respect to exclusions, as provided in Sec.  1001.1901 of this title, 
and must otherwise comply with the terms of any exclusion in accordance 
with Sec.  1001.1901 of this title effective with the date of the 
exclusion.

0
4. Section 405.800 is amended by adding paragraph (c) to read as 
follows:


Sec.  405.800  Appeals of CMS or a CMS contractor.

* * * * *
    (c) Additional years applied to a reenrollment bar. (1) If, under 
Sec.  424.535(c)(2)(i) of this chapter, CMS or a CMS contractor applies 
additional years to a provider's or supplier's existing reenrollment 
bar, CMS or the CMS contractor notifies the provider or supplier by 
certified mail. The notice includes the following:
    (i) The reason for the application of additional years in 
sufficient detail to allow the provider or supplier to understand the 
nature of the action.
    (ii) The right to appeal in accordance with part 498 of this 
chapter.
    (iii) The address to which the written appeal must be mailed.
    (2) Paragraph (c)(1) of this section applies only to the years 
added to the existing reenrollment bar under Sec.  424.535(c)(2)(i) of 
this chapter and not to the original length of the reenrollment bar, 
which is not subject to appeal.

PART 424--CONDITIONS FOR MEDICARE PAYMENT

0
5. The authority for part 424 continues to read as follows:

    Authority:  42 U.S.C. 1302 and 1395hh.


0
6. Section 424.502 is amended by adding the definitions for 
``Affiliation'', ``Disclosable event'', ``NPI'', and ``PECOS'' in 
alphabetical order to read as follows:


Sec.  424.502  Definitions.

* * * * *
    Affiliation means, for purposes of applying Sec.  424.519, any of 
the following:
    (1) A 5 percent or greater direct or indirect ownership interest 
that an individual or entity has in another organization.
    (2) A general or limited partnership interest (regardless of the 
percentage) that an individual or entity has in another organization.
    (3) An interest in which an individual or entity exercises 
operational or managerial control over, or directly or indirectly 
conducts, the day-to-day operations of another organization (including, 
for purposes of this paragraph (3), sole proprietorships), either under 
contract or through some other arrangement, regardless of whether or 
not the managing individual or entity is a W-2 employee of the 
organization.
    (4) An interest in which an individual is acting as an officer or 
director of a corporation.
    (5) Any reassignment relationship under Sec.  424.80.
* * * * *
    Disclosable event means, for purposes of Sec.  424.519, any of the 
following:
    (1) Currently has an uncollected debt to Medicare, Medicaid, or 
CHIP, regardless of--
    (i) The amount of the debt;
    (ii) Whether the debt is currently being repaid (for example, as 
part of a repayment plan); or
    (iii) Whether the debt is currently being appealed;
    (2) Has been or is subject to a payment suspension under a federal 
health care program (as that latter term is defined in section 1128B(f) 
of the Act), regardless of when the payment suspension occurred or was 
imposed;
    (3) Has been or is excluded by the OIG from participation in 
Medicare, Medicaid, or CHIP, regardless of whether the exclusion is 
currently being appealed or when the exclusion occurred or was imposed; 
or
    (4) Has had its Medicare, Medicaid, or CHIP enrollment denied, 
revoked, or terminated, regardless of--
    (i) The reason for the denial, revocation, or termination;
    (ii) Whether the denial, revocation, or termination is currently 
being appealed; or
    (iii) When the denial, revocation, or termination occurred or was 
imposed.
* * * * *
    NPI stands for National Provider Identifier.
* * * * *
    PECOS stands for Internet-based Provider Enrollment, Chain, and 
Ownership System.
* * * * *

0
7. Section 424.516 is amended by revising paragraphs (f)(1)(i) 
introductory text, (f)(1)(ii), (f)(2)(i) introductory text, and 
(f)(2)(ii) to read as follows:


Sec.  424.516  Additional provider and supplier requirements for 
enrolling and maintaining active enrollment status in the Medicare 
program.

* * * * *
    (f) * * *
    (1)(i) A provider or a supplier that furnishes covered ordered, 
certified, referred, or prescribed Part A or B services, items or drugs 
is required to--
* * * * *
    (ii) The documentation includes written and electronic documents 
(including the NPI of the physician or, when permitted, other eligible 
professional who ordered, certified, referred, or prescribed the Part A 
or B service, item, or drug) relating to written orders, 
certifications, referrals, prescriptions, and requests for payments for 
Part A or B services, items or drugs.
    (2)(i) A physician or, when permitted, an eligible professional who 
orders, certifies, refers, or prescribes Part A or

[[Page 47853]]

B services, items or drugs is required to--
* * * * *
    (ii) The documentation includes written and electronic documents 
(including the NPI of the physician or, when permitted, other eligible 
professional who ordered, certified, referred, or prescribed the Part A 
or B service, item, or drug) relating to written orders, 
certifications, referrals, prescriptions or requests for payments for 
Part A or B services, items, or drugs.

0
8. Section 424.519 is added to read as follows:


Sec.  424.519  Disclosure of affiliations.

    (a) Definitions. For purposes of this section only, the following 
terms apply to the definition of disclosable event in Sec.  424.502:
    (1) ``Uncollected debt'' only applies to the following:
    (i) Medicare, Medicaid, or CHIP overpayments for which CMS or the 
state has sent notice of the debt to the affiliated provider or 
supplier.
    (ii) Civil money penalties imposed under this title.
    (iii) Assessments imposed under this title.
    (2) ``Revoked,'' ``Revocation,'' ``Terminated,'' and 
``Termination'' include situations where the affiliated provider or 
supplier voluntarily terminated its Medicare, Medicaid, or CHIP 
enrollment to avoid a potential revocation or termination.
    (b) General. Upon a CMS request, an initially enrolling or 
revalidating provider or supplier must disclose any and all 
affiliations that it or any of its owning or managing employees or 
organizations (consistent with the terms ``owner'' and ``managing 
employee'' as defined in Sec.  424.502) has or, within the previous 5 
years, had with a currently or formerly enrolled Medicare, Medicaid, or 
CHIP provider or supplier that has a disclosable event (as defined in 
Sec.  424.502). CMS will request such disclosures when it has 
determined that the initially enrolling or revalidating provider or 
supplier may have at least one such affiliation.
    (c) Information. The provider or supplier must disclose the 
following information about each reported affiliation:
    (1) General identifying data about the affiliated provider or 
supplier. This includes the following:
    (i) Legal name as reported to the Internal Revenue Service or the 
Social Security Administration (if the affiliated provider or supplier 
is an individual).
    (ii) ``Doing business as'' name (if applicable).
    (iii) Tax identification number.
    (iv) NPI.
    (2) Reason for disclosing the affiliated provider or supplier.
    (3) Specific data regarding the affiliation relationship, including 
the following:
    (i) Length of the relationship.
    (ii) Type of relationship.
    (iii) Degree of affiliation.
    (4) If the affiliation has ended, the reason for the termination.
    (d) Mechanism. The information required to be disclosed under 
paragraphs (b) and (c) of this section must be furnished to CMS or its 
contractors via the Form CMS-855 application (paper or the internet-
based PECOS enrollment process).
    (e) Denial or revocation. The failure of the provider or supplier 
to fully and completely disclose the information specified in 
paragraphs (b) and (c) of this section when the provider or supplier 
knew or should reasonably have known of this information may result in 
either of the following:
    (1) The denial of the provider's or supplier's initial enrollment 
application under Sec.  424.530(a)(1) and, if applicable, Sec.  
424.530(a)(4).
    (2) The revocation of the provider's or supplier's Medicare 
enrollment under Sec.  424.535(a)(1) and, if applicable, Sec.  
424.535(a)(4).
    (f) Undue risk. Upon receiving the information described in 
paragraphs (b) and (c) of this section, CMS determines whether any of 
the disclosed affiliations poses an undue risk of fraud, waste, or 
abuse by considering the following factors:
    (1) The duration of the affiliation.
    (2) Whether the affiliation still exists and, if not, how long ago 
it ended.
    (3) The degree and extent of the affiliation.
    (4) If applicable, the reason for the termination of the 
affiliation.
    (5) Regarding the affiliated provider's or supplier's disclosable 
event under paragraph (b) of this section:
    (i) The type of disclosable event.
    (ii) When the disclosable event occurred or was imposed.
    (iii) Whether the affiliation existed when the disclosable event 
occurred or was imposed.
    (iv) If the disclosable event is an uncollected debt:
    (A) The amount of the debt.
    (B) Whether the affiliated provider or supplier is repaying the 
debt.
    (C) To whom the debt is owed.
    (v) If a denial, revocation, termination, exclusion, or payment 
suspension is involved, the reason for the disclosable event.
    (6) Any other evidence that CMS deems relevant to its 
determination.
    (g) Determination of undue risk. A determination by CMS that a 
particular affiliation poses an undue risk of fraud, waste, or abuse 
will result in, as applicable, the denial of the provider's or 
supplier's initial enrollment application under Sec.  424.530(a)(13) or 
the revocation of the provider's or supplier's Medicare enrollment 
under Sec.  424.535(a)(19).
    (h) Duplicate data. A provider or supplier is not required to 
report affiliation data in that portion of the Form CMS-855 application 
that collects affiliation information if the same data is being 
reported in the ``owning or managing control'' (or its successor) 
section of the Form CMS-855 application.
    (i) Undisclosed affiliations. CMS may apply Sec.  424.530(a)(13) or 
Sec.  424.535(a)(19) to situations where a disclosable affiliation (as 
described in Sec.  424.519(b) and (c)) poses an undue risk of fraud, 
waste or abuse, but the provider or supplier has not yet reported or is 
not required at that time to report the affiliation to CMS.

0
9. Section 424.530 is amended by revising paragraph (a)(7) and adding 
paragraphs (a)(12) through (14) and (f) to read as follows:


Sec.  424.530   Denial of enrollment in the Medicare program.

    (a) * * *
    (7) Payment suspension. (i) The provider or supplier, or any owning 
or managing employee or organization of the provider or supplier, is 
currently under a Medicare or Medicaid payment suspension as defined in 
Sec. Sec.  405.370 through 405.372 or in Sec.  455.23 of this chapter.
    (ii) CMS may apply the provision in this paragraph (a)(7) to the 
provider or supplier under any of the provider's, supplier's, or owning 
or managing employee's or organization's current or former names, 
numerical identifiers, or business identities or to any of its existing 
enrollments.
    (iii) In determining whether a denial is appropriate, CMS considers 
the following factors:
    (A) The specific behavior in question.
    (B) Whether the provider or supplier is the subject of other 
similar investigations.
    (C) Any other information that CMS deems relevant to its 
determination.
* * * * *
    (12) Revoked under different name, numerical identifier or business 
identity. The provider or supplier is currently revoked under a 
different name, numerical identifier, or business identity, and the 
applicable reenrollment bar period has not expired.

[[Page 47854]]

In determining whether a provider or supplier is a currently revoked 
provider or supplier under a different name, numerical identifier, or 
business identity, CMS investigates the degree of commonality by 
considering the following factors:
    (i) Owning and managing employees and organizations (regardless of 
whether they have been disclosed on the Form CMS-855 application).
    (ii) Geographic location.
    (iii) Provider or supplier type.
    (iv) Business structure.
    (v) Any evidence indicating that the two parties are similar or 
that the provider or supplier was created to circumvent the revocation 
or reenrollment bar.
    (13) Affiliation that poses undue risk. CMS determines that the 
provider or supplier has or has had an affiliation under Sec.  424.519 
that poses an undue risk of fraud, waste, or abuse to the Medicare 
program.
    (14) Other program termination or suspension. (i) The provider or 
supplier is currently terminated or suspended (or otherwise barred) 
from participation in a State Medicaid program or any other federal 
health care program, or the provider's or supplier's license is 
currently revoked or suspended in a State other than that in which the 
provider or supplier is enrolling. In determining whether a denial 
under this paragraph (a)(14) is appropriate, CMS considers the 
following factors:
    (A) The reason(s) for the termination, suspension, or revocation.
    (B) Whether, as applicable, the provider or supplier is currently 
terminated or suspended (or otherwise barred) from more than one 
program (for example, more than one State's Medicaid program), has been 
subject to any other sanctions during its participation in other 
programs or by any other State licensing boards or has had any other 
final adverse actions (as that term is defined in Sec.  424.502) 
imposed against it.
    (C) Any other information that CMS deems relevant to its 
determination.
    (ii) CMS may apply paragraph (a)(14)(i) of this section to the 
provider or supplier under any of its current or former names, 
numerical identifiers or business identities, and regardless of whether 
any appeals are pending.
* * * * *
    (f) Reapplication bar. CMS may prohibit a prospective provider or 
supplier from enrolling in Medicare for up to 3 years if its enrollment 
application is denied because the provider or supplier submitted false 
or misleading information on or with (or omitted information from) its 
application in order to gain enrollment in the Medicare program.
    (1) The reapplication bar applies to the prospective provider or 
supplier under any of its current, former, or future names, numerical 
identifiers or business identities.
    (2) CMS determines the bar's length by considering the following 
factors:
    (i) The materiality of the information in question.
    (ii) Whether there is evidence to suggest that the provider or 
supplier purposely furnished false or misleading information or 
deliberately withheld information.
    (iii) Whether the provider or supplier has any history of final 
adverse actions or Medicare or Medicaid payment suspensions.
    (iv) Any other information that CMS deems relevant to its 
determination.

0
10. Section 424.535 is amended--
0
a. In paragraph (a) introductory text, by removing the term ``billing 
privileges'' and adding in its place the word ``enrollment'';
0
b. By revising paragraphs (a)(9) and (12);
0
c. By adding reserved paragraphs (a)(15) and (16);
0
d. By adding paragraphs (a)(17) through (21);
0
e. By revising paragraph (c); and
0
f. By adding paragraphs (i) and (j).
    The additions and revisions read as follows:


Sec.  424.535   Revocation of enrollment in the Medicare program.

    (a) * * *
    (9) Failure to report. The provider or supplier did not comply with 
the reporting requirements specified in Sec.  424.516(d) or (e), Sec.  
410.33(g)(2) of this chapter, or Sec.  424.57(c)(2). In determining 
whether a revocation under this paragraph (a)(9) is appropriate, CMS 
considers the following factors:
    (i) Whether the data in question was reported.
    (ii) If the data was reported, how belatedly.
    (iii) The materiality of the data in question.
    (iv) Any other information that CMS deems relevant to its 
determination.
* * * * *
    (12) Other program termination. (i) The provider or supplier is 
terminated, revoked or otherwise barred from participation in a State 
Medicaid program or any other federal health care program. In 
determining whether a revocation under this paragraph (a)(12) is 
appropriate, CMS considers the following factors:
    (A) The reason(s) for the termination or revocation.
    (B) Whether the provider or supplier is currently terminated, 
revoked or otherwise barred from more than one program (for example, 
more than one State's Medicaid program) or has been subject to any 
other sanctions during its participation in other programs.
    (C) Any other information that CMS deems relevant to its 
determination.
    (ii) Medicare may not revoke unless and until a provider or 
supplier has exhausted all applicable appeal rights.
    (iii) CMS may apply paragraph (a)(12)(i) of this section to the 
provider or supplier under any of its current or former names, 
numerical identifiers or business identities.
* * * * *
    (15)-(16) [Reserved]
    (17) Debt referred to the United States Department of Treasury. The 
provider or supplier has an existing debt that CMS appropriately refers 
to the United States Department of Treasury. In determining whether a 
revocation under this paragraph (a)(17) is appropriate, CMS considers 
the following factors:
    (i) The reason(s) for the failure to fully repay the debt (to the 
extent this can be determined).
    (ii) Whether the provider or supplier has attempted to repay the 
debt (to the extent this can be determined).
    (iii) Whether the provider or supplier has responded to CMS' 
requests for payment (to the extent this can be determined).
    (iv) Whether the provider or supplier has any history of final 
adverse actions or Medicare or Medicaid payment suspensions.
    (v) The amount of the debt.
    (vi) Any other evidence that CMS deems relevant to its 
determination.
    (18) Revoked under different name, numerical identifier or business 
identity. The provider or supplier is currently revoked under a 
different name, numerical identifier, or business identity, and the 
applicable reenrollment bar period has not expired. In determining 
whether a provider or supplier is a currently revoked provider or 
supplier under a different name, numerical identifier, or business 
identity, CMS investigates the degree of commonality by considering the 
following factors:
    (i) Owning and managing employees and organizations (regardless of 
whether they have been disclosed on the Form CMS-855 application).
    (ii) Geographic location.
    (iii) Provider or supplier type.
    (iv) Business structure.
    (v) Any evidence indicating that the two parties are similar or 
that the provider or supplier was created to

[[Page 47855]]

circumvent the revocation or reenrollment bar.
    (19) Affiliation that poses an undue risk. CMS determines that the 
provider or supplier has or has had an affiliation under Sec.  424.519 
that poses an undue risk of fraud, waste, or abuse to the Medicare 
program.
    (20) Billing from non-compliant location. CMS may revoke a 
provider's or supplier's Medicare enrollment or enrollments, even if 
all of the practice locations associated with a particular enrollment 
comply with Medicare enrollment requirements, if the provider or 
supplier billed for services performed at or items furnished from a 
location that it knew or should have known did not comply with Medicare 
enrollment requirements. In determining whether and how many of the 
provider's or supplier's enrollments, involving the non-compliant 
location or other locations, should be revoked, CMS considers the 
following factors:
    (i) The reason(s) for and the specific facts behind the location's 
non-compliance.
    (ii) The number of additional locations involved.
    (iii) Whether the provider or supplier has any history of final 
adverse actions or Medicare or Medicaid payment suspensions.
    (iv) The degree of risk that the location's continuance poses to 
the Medicare Trust Funds.
    (v) The length of time that the non-compliant location was non-
compliant.
    (vi) The amount that was billed for services performed at or items 
furnished from the non-compliant location.
    (vii) Any other evidence that CMS deems relevant to its 
determination.
    (21) Abusive ordering, certifying, referring, or prescribing of 
Part A or B services, items or drugs. The physician or eligible 
professional has a pattern or practice of ordering, certifying, 
referring, or prescribing Medicare Part A or B services, items, or 
drugs that is abusive, represents a threat to the health and safety of 
Medicare beneficiaries, or otherwise fails to meet Medicare 
requirements. In making its determination as to whether such a pattern 
or practice exists, CMS considers the following factors:
    (i) Whether the physician's or eligible professional's diagnoses 
support the orders, certifications, referrals or prescriptions in 
question.
    (ii) Whether there are instances where the necessary evaluation of 
the patient for whom the service, item or drug was ordered, certified, 
referred, or prescribed could not have occurred (for example, the 
patient was deceased or out of state at the time of the alleged office 
visit).
    (iii) The number and type(s) of disciplinary actions taken against 
the physician or eligible professional by the licensing body or medical 
board for the state or states in which he or she practices, and the 
reason(s) for the action(s).
    (iv) Whether the physician or eligible professional has any history 
of final adverse actions (as that term is defined in Sec.  424.502).
    (v) The length of time over which the pattern or practice has 
continued.
    (vi) How long the physician or eligible professional has been 
enrolled in Medicare.
    (vii) The number and type(s) of malpractice suits that have been 
filed against the physician or eligible professional related to 
ordering, certifying, referring or prescribing that have resulted in a 
final judgment against the physician or eligible professional or in 
which the physician or eligible professional has paid a settlement to 
the plaintiff(s) (to the extent this can be determined).
    (viii) Whether any State Medicaid program or any other public or 
private health insurance program has restricted, suspended, revoked, or 
terminated the physician's or eligible professional's ability to 
practice medicine, and the reason(s) for any such restriction, 
suspension, revocation, or termination.
    (ix) Any other information that CMS deems relevant to its 
determination.
* * * * *
    (c) Reapplying after revocation. (1) After a provider or supplier 
has had their enrollment revoked, they are barred from participating in 
the Medicare program from the effective date of the revocation until 
the end of the reenrollment bar. The reenrollment bar--
    (i) Begins 30 days after CMS or its contractor mails notice of the 
revocation and lasts a minimum of 1 year, but not greater than 10 years 
(except for the situations described in paragraphs (c)(2) and (3) of 
this section), depending on the severity of the basis for revocation.
    (ii) Does not apply in the event a revocation of Medicare 
enrollment is imposed under paragraph (a)(1) of this section based upon 
a provider's or supplier's failure to respond timely to a revalidation 
request or other request for information.
    (2)(i) CMS may add up to 3 more years to the provider's or 
supplier's reenrollment bar (even if such period exceeds the 10-year 
period identified in paragraph (c)(1) of this section) if it determines 
that the provider or supplier is attempting to circumvent its existing 
reenrollment bar by enrolling in Medicare under a different name, 
numerical identifier or business identity.
    (ii) A provider's or supplier's appeal rights regarding paragraph 
(c)(2)(i) of this section--
    (A) Are governed by part 498 of this chapter; and
    (B) Do not extend to the imposition of the original reenrollment 
bar under paragraph (c)(1) of this section; and
    (C) Are limited to any additional years imposed under paragraph 
(c)(2)(i) of this section.
    (3) CMS may impose a reenrollment bar of up to 20 years on a 
provider or supplier if the provider or supplier is being revoked from 
Medicare for the second time. In determining the length of the 
reenrollment bar under this paragraph (c)(3), CMS considers the 
following factors:
    (i) The reasons for the revocations.
    (ii) The length of time between the revocations.
    (iii) Whether the provider or supplier has any history of final 
adverse actions (other than Medicare revocations) or Medicare or 
Medicaid payment suspensions.
    (iv) Any other information that CMS deems relevant to its 
determination.
    (4) A reenrollment bar applies to a provider or supplier under any 
of its current, former or future names, numerical identifiers or 
business identities.
* * * * *
    (i) Extension of revocation. (1) If a provider's or supplier's 
Medicare enrollment is revoked under paragraph (a) of this section, CMS 
may revoke any and all of the provider's or supplier's Medicare 
enrollments, including those under different names, numerical 
identifiers or business identities and those under different types.
    (2) In determining whether to revoke a provider's or supplier's 
other enrollments under this paragraph (i), CMS considers the following 
factors:
    (i) The reason for the revocation and the facts of the case.
    (ii) Whether any final adverse actions have been imposed against 
the provider or supplier regarding its other enrollments.
    (iii) The number and type(s) of other enrollments.
    (iv) Any other information that CMS deems relevant to its 
determination.
    (j) Voluntary termination. (1) CMS may revoke a provider's or 
supplier's Medicare enrollment if CMS determines that the provider or 
supplier voluntarily terminated its Medicare enrollment in

[[Page 47856]]

order to avoid a revocation under paragraph (a) of this section that 
CMS would have imposed had the provider or supplier remained enrolled 
in Medicare. In making its determination, CMS considers the following 
factors:
    (i) Whether there is evidence to suggest that the provider knew or 
should have known that it was or would be out of compliance with 
Medicare requirements.
    (ii) Whether there is evidence to suggest that the provider knew or 
should have known that its Medicare enrollment would be revoked.
    (iii) Whether there is evidence to suggest that the provider 
voluntarily terminated its Medicare enrollment in order to circumvent 
such revocation.
    (iv) Any other evidence or information that CMS deems relevant to 
its determination.
    (2) A revocation under paragraph (j)(1) of this section is 
effective the day before the Medicare contractor receives the 
provider's or supplier's Form CMS-855 voluntary termination 
application.

0
11. Section 424.540 is amended by revising paragraphs (b)(1) and (2) to 
read as follows:


Sec.  424.540  Deactivation of Medicare billing privileges.

* * * * *
    (b) * * *
    (1) In order for a deactivated provider or supplier to reactivate 
its Medicare billing privileges, the provider or supplier must 
recertify that its enrollment information currently on file with 
Medicare is correct and furnish any missing information as appropriate.
    (2) Notwithstanding paragraph (b)(1) of this section, CMS may, for 
any reason, require a deactivated provider or supplier to, as a 
prerequisite for reactivating its billing privileges, submit a complete 
Form CMS-855 application.
* * * * *

0
12. Section 424.570 is amended by revising paragraphs (a)(1)(iii) and 
(iv) to read as follows:


Sec.  424.570   Moratoria on newly enrolling Medicare providers and 
suppliers.

    (a) * * *
    (1) * * *
    (iii) The temporary moratorium does not apply to any of the 
following:
    (A) Changes in practice location (except if the location is 
changing from a location outside the moratorium area to a location 
inside the moratorium area).
    (B) Changes in provider or supplier information, such as phone 
numbers.
    (C) Changes in ownership (except changes in ownership of home 
health agencies that would require an initial enrollment).
    (iv) A temporary moratorium does not apply to any enrollment 
application that has been received by the Medicare contractor prior to 
the date the moratorium is imposed.
* * * * *

PART 455--PROGRAM INTEGRITY: MEDICAID

0
13. The authority citation for part 455 is revised to read as follows:


    Authority:  42 U.S.C. 1302.


0
14. Section 455.101 is amended by adding the definitions for 
``Affiliation'' and Disclosable event'' in alphabetical order to read 
as follows:


Sec.  455.101  Definitions.

    Affiliation means, for purposes of applying Sec.  455.107, any of 
the following:
    (1) A 5 percent or greater direct or indirect ownership interest 
that an individual or entity has in another organization.
    (2) A general or limited partnership interest (regardless of the 
percentage) that an individual or entity has in another organization.
    (3) An interest in which an individual or entity exercises 
operational or managerial control over, or directly or indirectly 
conducts, the day-to-day operations of another organization (including, 
for purposes of this paragraph (3), sole proprietorships), either under 
contract or through some other arrangement, regardless of whether or 
not the managing individual or entity is a W-2 employee of the 
organization.
    (4) An interest in which an individual is acting as an officer or 
director of a corporation.
    (5) Any payment assignment relationship under Sec.  447.10(g) of 
this chapter.
* * * * *
    Disclosable event means, for purposes of Sec.  455.107, any of the 
following:
    (1) Currently has an uncollected debt to Medicare, Medicaid, or 
CHIP, regardless of--
    (i) The amount of the debt;
    (ii) Whether the debt is currently being repaid (for example, as 
part of a repayment plan); or
    (iii) Whether the debt is currently being appealed;
    (2) Has been or is subject to a payment suspension under a federal 
health care program (as that latter term is defined in section 1128B(f) 
of the Act), regardless of when the payment suspension occurred or was 
imposed;
    (3) Has been or is excluded by the OIG from participation in 
Medicare, Medicaid, or CHIP, regardless of whether the exclusion is 
currently being appealed or when the exclusion occurred or was imposed; 
or
    (4) Has had its Medicare, Medicaid, or CHIP enrollment denied, 
revoked or terminated, regardless of--
    (i) The reason for the denial, revocation, or termination;
    (ii) Whether the denial, revocation, or termination is currently 
being appealed; or
    (iii) When the denial, revocation, or termination occurred or was 
imposed.
* * * * *

0
15. Section 455.103 is revised to read as follows:


Sec.  455.103   State plan requirement.

    A State plan must provide that the requirements of Sec. Sec.  
455.104 through 455.107 are met.

0
16. Section 455.107 is added to subpart B to read as follows:


Sec.  455.107  Disclosure of affiliations.

    (a) Definitions. For purposes of this section only, the following 
terms apply to the definition of disclosable event in Sec.  455.101:
    (1) ``Uncollected debt'' only applies to the following:
    (i) Medicare, Medicaid, or CHIP overpayments for which CMS or the 
State has sent notice of the debt to the affiliated provider or 
supplier.
    (ii) Civil money penalties imposed under this title.
    (iii) Assessments imposed under this title.
    (2) ``Revoked,'' ``Revocation,'' ``Terminated,'' and 
``Termination'' include situations where the affiliated provider or 
supplier voluntarily terminated its Medicare, Medicaid, or CHIP 
enrollment to avoid a potential revocation or termination.
    (b) General. (1)(i) Selection of option. A State, in consultation 
with CMS, must select one of the two options identified in paragraph 
(b)(2) of this section for requiring the disclosure of affiliation 
information.
    (ii) Change of selection. A State may not change its selection 
under paragraph (b) of this section after it has been made.
    (2)(i) First option. In a State that has selected the option in 
this paragraph (b)(2)(i), a provider that is not enrolled in Medicare 
but is initially enrolling in Medicaid or CHIP (or is revalidating its 
Medicaid or CHIP enrollment information) must disclose any and all 
affiliations that it or any of its owning or managing employees or 
organizations (consistent with the terms ``person with an ownership or 
control interest'' and ``managing employee'' as defined in

[[Page 47857]]

Sec.  455.101) has or, within the previous 5 years, had with a 
currently or formerly enrolled Medicare, Medicaid, or CHIP provider or 
supplier that has a disclosable event (as defined in Sec.  455.101).
    (ii) Second option. In a State that has selected the option in this 
paragraph (b)(2)(ii), and upon request by the State, a provider that is 
not enrolled in Medicare but is initially enrolling in Medicaid or CHIP 
(or is revalidating its Medicaid or CHIP enrollment information) must 
disclose any and all affiliations that it or any of its owning or 
managing employees or organizations (consistent with the terms ``person 
with an ownership or control interest'' and ``managing employee'' as 
defined in Sec.  455.101) has or, within the previous 5 years, had with 
a currently or formerly enrolled Medicare, Medicaid, or CHIP provider 
or supplier that has a disclosable event (as defined in Sec.  455.101). 
The State will request such disclosures when it, in consultation with 
CMS, has determined that the initially enrolling or revalidating 
provider may have at least one such affiliation.
    (c) Information. The initially enrolling or revalidating provider 
must disclose the following information about each affiliation:
    (1) General identifying information about the affiliated provider 
or supplier, which includes the following:
    (i) Legal name as reported to the Internal Revenue Service or the 
Social Security Administration (if the affiliated provider or supplier 
is an individual).
    (ii) ``Doing business as'' name (if applicable).
    (iii) Tax identification number.
    (iv) National Provider Identifier (NPI).
    (2) Reason for disclosing the affiliated provider or supplier.
    (3) Specific data regarding the affiliation relationship, including 
the following:
    (i) Length of the relationship.
    (ii) Type of relationship.
    (iii) Degree of affiliation.
    (4) If the affiliation has ended, the reason for the termination.
    (d) Mechanism. The information described in paragraphs (b) and (c) 
of this section must be furnished to the State in a manner prescribed 
by the State in consultation with the Secretary.
    (e) Denial or termination. The failure of the provider to fully and 
completely report the information required in this section when the 
provider knew or should reasonably have known of this information may 
result in, as applicable, the denial of the provider's initial 
enrollment application or the termination of the provider's enrollment 
in Medicaid or CHIP.
    (f) Undue risk. Upon receipt of the information described in 
paragraphs (b) and (c) of this section, the State, in consultation with 
CMS, determines whether any of the disclosed affiliations poses an 
undue risk of fraud, waste, or abuse by considering the following 
factors:
    (1) The duration of the affiliation.
    (2) Whether the affiliation still exists and, if not, how long ago 
the affiliation ended.
    (3) The degree and extent of the affiliation.
    (4) If applicable, the reason for the termination of the 
affiliation.
    (5) Regarding the affiliated provider's or supplier's disclosable 
event under paragraph (b) of this section, all of the following:
    (i) The type of disclosable event.
    (ii) When the disclosable event occurred or was imposed.
    (iii) Whether the affiliation existed when the disclosable event 
occurred or was imposed.
    (iv) If the disclosable event is an uncollected debt--
    (A) The amount of the debt;
    (B) Whether the affiliated provider or supplier is repaying the 
debt; and
    (C) To whom the debt is owed.
    (v) If a denial, revocation, termination, exclusion, or payment 
suspension is involved, the reason for the disclosable event.
    (6) Any other evidence that the State, in consultation with CMS, 
deems relevant to its determination.
    (g) Determination of undue risk. A determination by the State, in 
consultation with CMS, that a particular affiliation poses an undue 
risk of fraud, waste, or abuse will result in, as applicable, the 
denial of the provider's initial enrollment in Medicaid or CHIP or the 
termination of the provider's enrollment in Medicaid or CHIP.
    (h) Undisclosed affiliations. The State, in consultation with CMS, 
may apply paragraph (g) of this section to situations where a 
reportable affiliation (as described in paragraphs (b) and (c) of this 
section) poses an undue risk of fraud, waste, or abuse, but the 
provider has not yet disclosed or is not required at that time to 
disclose the affiliation to the State.

PART 457--ALLOTMENTS AND GRANTS TO STATES

0
17. The authority citation for part 457 is revised to read as follows:

    Authority: 42 U.S.C. 1302.


0
18. Section 457.990 is amended by redesignating paragraphs (a) and (b) 
as paragraphs (b) and (c) and adding a new paragraph (a) to read as 
follows:


Sec.  457.990   Provider and supplier screening, oversight, and 
reporting requirements.

* * * * *
    (a) Section 455.107.
* * * * *

PART 498--APPEALS PROCEDURES FOR DETERMINATIONS THAT AFFECT 
PARTICIPATION IN THE MEDICARE PROGRAM AND FOR DETERMINATIONS THAT 
AFFECT THE PARTICIPATION OF ICFs/IID AND CERTAIN NFs IN THE 
MEDICAID PROGRAM

0
19. The authority citation for part 498 is revised to read as follows:

    Authority: 42 U.S.C. 1302, 1320a-7j, and 1395hh.

0
20. Section 498.3 is amended by revising paragraph (b)(17) to read as 
follows:


Sec.  498.3  Scope and applicability.

* * * * *
    (b) * * *
    (17)(i) Whether to deny or revoke a provider's or supplier's 
Medicare enrollment in accordance with Sec.  424.530 or Sec.  424.535 
of this chapter;
    (ii) Whether, under Sec.  424.535(c)(2)(i) of this chapter, to add 
years to a provider's or supplier's existing reenrollment bar; or
    (iii) Whether, under Sec.  424.535(c)(3) of this chapter, an 
individual or entity other than the provider or supplier that is the 
subject of the second revocation was the actual subject of the first 
revocation.
* * * * *

    Dated: April 4, 2019.
Seema Verma,
Administrator, Centers for Medicare & Medicaid Services.

    Dated: April 9, 2019.
Alex M. Azar II,
Secretary, Department of Health and Human Services.
[FR Doc. 2019-19208 Filed 9-5-19; 11:15 am]
 BILLING CODE 4120-01-P