Client Alert
HHS-OIG Finalizes Significant Changes to the Anti-Kickback Statute and Stark Law
Client Alert
HHS-OIG Finalizes Significant Changes to the Anti-Kickback Statute and Stark Law
December 15, 2020
On December 2, 2020, the U.S. Department of Health and Human Services’ (“DHHS”) Office of the Inspector General (OIG) and the Centers for Medicare & Medicaid Services (“CMS”) published in the Federal Register final rules implementing changes to the federal Anti-Kickback Statute (the “AKS”), the federal Civil Monetary Penalty Law (“CMP Law”), and the Ethics in Patient Referrals Act (the “Stark Law”). The AKS final rule amends the regulatory safe harbors under the statute by adding new safe harbors, modifies existing safe harbors that protect certain payment practices and business arrangements from sanctions, and finalizes a new exception to the CMP Law provision prohibiting inducements to beneficiaries. The Stark Law final rule establishes exceptions for certain value-based-compensation arrangements between or among physicians, providers, and suppliers. It also establishes a new exception for certain arrangements under which a physician receives limited remuneration for items or services actually provided by the physician, establishes a new exception for donations of cybersecurity technology and related services, and amends the existing exception for electronic health records (“EHR”) items and services. Both rules focus on addressing the potentially burdensome impact of the AKS, the beneficiary inducements CMP Law, and the Stark Law on care coordination and value-based care. While most of the new rules are scheduled go into effect on January 19, 2021, it is possible that this could be delayed to enable the Biden-Harris administration a chance to review them following Inauguration.
See the Anti-Kickback Statute and Stark Law Final Rules, available here and here.
Anti-Kickback Statute Final Rule
OIG effectuated seven new AKS safe harbors, including three designed to offer flexibility and to protect certain arrangements involving a value-based enterprise (“VBE”), which captures a number of network arrangements between a variety of entities where the participants have agreed to collaborate to achieve value-based purposes:
- Care-coordination arrangements: Protects in-kind remuneration (i.e., services) exchanged between VBE participants, provided that the remuneration is used predominately to engage in value-based activities that are directly connected to care coordination and management for a target-patient population.
- Value-based arrangements with substantial downside financial risk: This safe harbor covers both monetary and in-kind-remuneration exchanges between a VBE and a VBE participant in a VBE that assumes substantial downside financial risk from a payer if the VBE participant assumes a meaningful share of the risk. This safe harbor offers greater flexibility than the care-coordination arrangements’ safe harbor, in recognition of parties’ assumption of the requisite level of downside financial risk. For example, while the proposed rule defined “meaningful share of the risk” to mean at least 8%, the OIG reduced this risk threshold, requiring the VBE participant to share at least 5% of the financial risk to qualify.
- Value-based arrangements with full financial risk: Protects monetary or in-kind remuneration from a VBE to a VBE participant, provided that the VBE assumes full financial responsibility for the costs of all items and services, covered by a payer for each patient in the target population, for a term of one year, and is paid prospectively.
This three-tiered safe-harbor approach recognizes that “arrangements involving higher levels of downside financial risk for those in position to make referrals or order products or services could curb … incentives to order medically unnecessary or overly costly items and services.” Moreover, the value-based safe harbors also do not protect remuneration provided to patients, whether in kind or monetary, and the AKS Final Rule revises the definition of a “VBE participant” to expressly exclude patients.
Believing that certain entities presented a “heightened risk for fraud,” OIG initially proposed to wholly exclude from the new value-based safe harbors pharmaceutical manufacturers, distributors, and wholesalers; pharmacy-benefit managers (“PBMs”); laboratories; manufacturers of devices or medical supplies; entities or individuals that sell or rent durable medical equipment, prosthetics, orthotics, and supplies (“DMEPOS”); and medical-device distributors and wholesalers. However, the care-coordination arrangements’ safe harbor provides for a separate, but limited, pathway with specific conditions that protects digital-technology arrangements (e.g., diabetes-management devices or cloud-storage services to monitor blood-sugar levels) involving manufacturers of devices or medical supplies and DMEPOS as part of a VBE.
OIG also finalized a beneficiary-inducements CMP Law[1] exception and new safe harbors applicable to beneficiary incentives. Specifically, OIG finalized a new safe harbor for arrangements for patient engagement and support to improve quality, health outcomes, and efficiency. Similar to the VBE safe harbors above, OIG excluded pharmaceutical manufacturers, distributors, and wholesalers; PBMs; laboratories; manufacturers of devices or medical supplies; and DMEPOS from protection under this safe harbor but allowed manufacturers of devices or medical supplies to exchange digital health technology. Moreover, in-kind remuneration to patients may still be available under this safe harbor if other regulatory requirements are met. The final rule specifies an annual 500 US Dollar (USD) cap, subject to an inflation adjuster, for tools and supports that can be provided to VBE participants (e.g., providing a “smart tablet” to patients). Finally, OIG finalized a less onerous exception for “telehealth technologies” furnished to certain in-home dialysis patients than the exception that was initially proposed.
Notably, OIG also finalized a new safe harbor to protect the exchange nonmonetary donations of certain cybersecurity items and services related to addressing the growing threat of cyberattacks on healthcare-industry systems. The safe harbor permits entities to donate cybersecurity technology to physician groups or other providers, as long as the technology is “necessary and used predominantly to implement, maintain, or reestablish cybersecurity.”
OIG also modified the existing safe harbor for local transportation by increasing the mileage limit for rural areas from 50 miles to 75 miles and eliminated mileage limits for patients discharged from the hospital and transported to their residence. Lastly, the agency finalized proposed modifications to the personal-services/management-contracts safe harbor to add greater flexibility by removing certain requirements pertaining to part-time arrangements and modifying the aggregate-compensation set-in-advance requirement, both of which had limited the practical use of this safe harbor.
Stark Law Final Rule
Like OIG’s actions above, DHHS, through CMS, also finalized a number of changes to clarify and provide guidance on a wide range of technical-compliance requirements under the Stark Law and its implementing regulations.
CMS implemented four new exceptions to the Stark Law for value-based arrangements:
- Full financial risk: Excepts value-based arrangements between VBE participants in a VBE that has assumed full financial risk for the cost of all patient-care items and services covered by the applicable payer for each patient in the target-patient population during the entire duration of the value-based arrangement.
- Meaningful downside financial risk to the physician: Excepts remuneration paid under a value-based arrangement where the physician is at “meaningful downside financial risk” for failure to achieve the value-based purpose of the VBE for the entire term of the value-based arrangement. Meaningful downside financial risk means that the physician is responsible to pay or forgo no less than 10% (reduced from 25% in the proposed rule) of the total value of the remuneration received under a value-based arrangement.
- Value-based arrangements: Excepts value-based arrangements, regardless of the level of risk undertaken by the VBE or any of the VBE participants, subject to a number of specific requirements and restraints.
- Indirect-compensation arrangements that include a value-based arrangement: Excepts indirect-compensation arrangements that include a value-based arrangement to which the physician or physician organization is a direct party.
Each exception requires that any compensation arrangement be commercially reasonable. CMS’s final rule also creates a new exception that would allow certain payments for items or services provided by a physician to an entity (up to 5,000 USD per calendar year) to be made without violation of the Stark Law.
The final rule includes a new exception to protect nonmonetary donations of cybersecurity technology and related services in efforts to address the growing threat of cyberattacks affecting the healthcare industry. The exception permits both individuals and entities to donate cybersecurity technology to physician groups and other providers that lack the resources to procure such technology, as long as it is “necessary and used predominantly to implement, maintain, or reestablish cybersecurity.”
Finally, and perhaps most importantly, CMS’s final rule includes clarification on critical Stark Law terminology. After consideration of comments on the proposed rule, CMS finalized the definitions of such terms including, but not limited to, “commercially reasonable,” “fair market value,” “referral,” and “remuneration.” For instance, CMS defined the term “commercially reasonable” to mean that “the particular arrangement furthers a legitimate business purpose of the parties to the arrangement and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty.”[2] CMS added that “an arrangement may be commercially reasonable even if it does not result in profit for one or more of the parties.” This clarification is particularly critical in the case of physician recruitment and physician-practice acquisition, where a given physician or practice, while not independently “profitable,” is nevertheless critical to the sponsoring hospital or health system and community at large. In this vein, CMS likewise finalized proposals to establish objective tests to determine whether compensation meets the standards set forth in “volume or value” and “other business generated” scenarios.
We note that government orders on the local, state, and federal levels are changing every day, and the information contained herein is accurate only as of the date set forth above.
******************************************************************************
For further information or questions on these finalized rules, please contact Amandeep S. Sidhu, T. Reed Stephens, Christopher Parker, Nasir Hussain, or your Winston relationship attorney.
[1] The beneficiary-inducements CMP is set forth in a civil statute that prohibits knowingly offering something of value to a Medicare or state healthcare-program beneficiary to induce them to select a particular provider, practitioner, or supplier.
[2] 42 C.F.R. § 411.351.