Last month, the Centers for Medicaid & Medicare Services (CMS) released a final rule that will grant it broad new revocation and denial authority for providers and suppliers who are "affiliated" with previously-sanctioned entities. CMS describes this new authority as a "first of its kind action" that "marks a critical step forward in CMS' long-standing fight to end 'pay and chase' in federal healthcare fraud efforts and replace it with smart, effective, and proactive measures."

The new "affiliations" provision - which is part of the Program Integrity Enhancements to the Provider Enrollment Process (CMS-6058-FC) that will go into effect Nov. 4, 2019 - will allow CMS to revoke Medicare, Medicaid, and Children's Health Insurance (CHIP) enrollments of providers or suppliers who "pose undue risk of fraud, waste or abuse based on their relationships with other sanctioned entities."

Under this new rule, providers must disclose current or past affiliations with any organization that has uncollected debt, has had a payment suspension under a federal healthcare program, has been excluded from a federal healthcare program, or has had billing privileges denied or rescinded. Failure to make these disclosures may result in the provider no longer being able to participate in Medicare, Medicaid, and CHIP.

"For too many years, we have played an expensive and inefficient game of 'whack-a-mole' with criminals -- going after them one at a time -- as they steal from our programs. These fraudsters temporarily disappear into complex, hard-to-track webs of criminal entities and then re-emerge under different corporate names. These criminals engage in the same behaviors again and again," said CMS Administrator Seema Verma. "Now, for the first time, we have tools to stop criminals before they can steal from taxpayers. This is CMS hardening the target for criminals and locking the door to the vault. If you're a bad actor, you can never get into the program, and you can't steal from it."

Notwithstanding broad consensus on the benefits of combatting fraud and reducing waste, the expansive reach of the new rule has generated significant criticism. Among key concerns is the definition of an "affiliation" in the new rule, which includes: direct or indirect ownership of 5 percent or more in another organization; a general or limited partnership interest, regardless of the percentage; an interest in which an individual or entity "exercises operational or managerial control over, or directly conducts" the daily operations of another organization, "either under direct contract or through some other arrangement" when an individual is acting as an officer or director of a corporation; and any reassignment relationship.

In addition to the "affiliations" component, the new rule also allows CMS to revoke or deny enrollment if a provider or supplier circumvents program rules by coming back into the program under a different name; bills for services or items from non-compliant locations; exhibits a pattern of practice of abuse of ordering or certifying Medicare Part A or Part B items, services, or drugs; or has an outstanding debt to CMS from an overpayment that was referred to the Treasury Department. CMS will also be able to bar re-application in the program for up to three years if the initial application contains false or misleading information and to block revoked providers and suppliers from re-entering the program for up to 10 years.

The new rule will likely result in an increased compliance burden for both providers and suppliers. In fact, CMS estimates an annual cost to providers and suppliers of $937,500 in each of the first three years of implementation to collect all of their affiliation documentation. Nevertheless, CMS believes that the rule strikes a balance between preventing fraud, yet not driving away participating providers. "This new rule builds on CMS' previous accessible efforts to protect beneficiaries and taxpayer dollars while limiting burden on our provider partners without whom we could not deliver high quality care to the millions of people we are honored to serve." Only time will tell if that is in fact the case.

The final version of this new rule includes a "phased-in" approach, targeting first certain providers and suppliers that CMS determines have at least one applicable affiliation. However, because CMS has stated its intension to expand the scope, all providers and suppliers should be considering how they can determine and track whether their affiliations will require disclosure.

Matthew Kroplin is a partner in Burr & Forman's healthcare section. His experience includes the representation of a broad range of healthcare industry clients, as well as to product manufacturers and suppliers and other business entities in regulatory, compliance and operational issues. Kroplin is Certified in Healthcare Compliance. For more information, email mkroplin@burr.com or go online to burr.com.