CMS Final Rule Overhauls Medicare Enrollment Process

In recent months, the Centers for Medicare and Medicaid Services ("CMS") has taken steps to strengthen and streamline the Medicare enrollment process that will affect all Medicare providers and suppliers. On April 21, 2006, CMS published a final rule ("Final Rule")¹ establishing new enrollment procedures for all providers and suppliers, except those who opt out of the Medicare program. The Final Rule represents the first codification of detailed rules relating to enrolling in the Medicare program and maintaining Medicare billing privileges. CMS also has issued new versions of the Medicare enrollment applications, which already are in use.

According to CMS, the purpose of the new regulations, which take effect on June 20, 2006, is to curb abuse of Medicare billing numbers and to grant CMS further access to information about enrolled providers and suppliers.

Important highlights include:

• a new process for revalidation of enrollment information currently on file with CMS, including submission of a CMS 855 by providers and suppliers who have not previously done so;

• clear authority for CMS to conduct on-site visits to verify information furnished in the CMS 855;

• broad discretion for CMS to deny enrollment, to revoke enrollment and billing privileges, and to deactivate billing privileges; and

• changes to the procedures for giving notification of a change in ownership or control.

The Final Rule is substantially similar to the proposed rule issued in 2003 ("Proposed Rule").² The most noteworthy changes are the lengthening of the period that would result in deactivation of billing privileges for failure to submit Medicare claims from six months to twelve months, the implementation of a phased-in approach for requiring submission of enrollment information by currently participating providers and suppliers, and extension of the revalidation cycle from three to five years.

Although CMS intended the Final Rule and the new versions of the enrollment applications to improve the Medicare enrollment process, these changes may raise more questions than they answer. All providers and suppliers should note the significant administrative obligations imposed by the new regulations and, in light of the penalties for non-compliance, take immediate steps to comply.

Initial Enrollment

CMS will continue to require all providers and suppliers to submit an enrollment application, know as the CMS 855, to enroll in the Medicare program and to obtain Medicare billing privileges. The new regulations describe the required content of the enrollment application in general terms.

Despite requests to the contrary, CMS will continue to use multiple versions of the CMS 855, but CMS has made efforts to decrease the administrative burden imposed on applicants with it recent revisions. For instance, CMS has eliminated some sections of the applications, and the CMS 855 now includes a list of specific supporting documentation in section 17 to guide applicants in preparing their submissions.

One of the most significant changes is that applicants must furnish a National Provider Identifier ("NPI") on the CMS 855 even though the deadline for obtaining an NPI is not until May 23, 2007.³ Applicants also must provide a copy of the NPI notification received from the National Plan and Provider Enumeration System.

The new regulations establish strict standards for submissions. CMS will reject an enrollment application if the applicant does not provide complete information within sixty days of notification from CMS that it is incomplete, but may grant an extension to an applicant who is "actively working with CMS to resolve any outstanding issues."⁴

Applicants should not count on obtaining extensions under this ambiguous standard and therefore should make every effort to submit timely, complete applications. Rejection of an enrollment application is not subject to appeal, but a provider or supplier may reapply.⁵

As part of the enrollment process, CMS has the right to perform an on-site inspection.⁶ In response to comments protesting the on-site visits, CMS stated that it has the statutory authority to conduct these visits, which are its only method for verifying that a provider and supplier is operational and is in compliance with Medicare’s requirements for participation.⁷

CMS clarified that this site visit is separate and distinct from survey and certification visits conducted to ensure compliance with Medicare’s conditions of participation by certain providers, such as hospitals, nursing homes, and home health agencies.⁸

For the most part, the scope and nature of the on-site visits, which will be conducted by CMS’s fee-for-service contractors, is undefined. Providers and suppliers likely will see overlap with accreditation inspections as well as with state and federal surveys and therefore should consider how to incorporate preparation into existing policies and procedures. The timing of on-site reviews also is unclear because CMS declined to set any deadlines for contractors making initial enrollment determinations.

In response to comments received on the Proposed Rule, CMS clarified that it has not changed its policy on effective billing dates. As a result, providers and suppliers still may submit claims retroactively upon completion of the enrollment process, to the extent permitted by current regulations.⁹

Reporting Changes to Enrollment Information

A provider or supplier must submit changes in enrollment information, along with supporting documentation, within ninety days of the change,¹⁰ with two exceptions. First, DMEPOS suppliers must continue to report all changes within thirty days. Second, a provider or supplier must give notice of a change in ownership or control within thirty days. The ramifications of failing to submit changes to enrollment information previously were unclear, but the new regulations specifically state that a failure to comply can lead to deactivation or revocation Medicare billing privileges.

Reporting Changes in Ownership or Control.

Reporting of changes in ownership or control also is addressed in other parts of the Final Rule, including the regulation on prohibition on the sale or transfer of billing privileges. This regulation addresses the requirements for a provider undergoing a change of ownership ("CHOW")¹¹ in accordance with part 489, subpart A, of the Medicare regulations,¹² and it establishes that "the current owner and the prospective new owner must complete and submit enrollment applications before completion of the change of ownership."13

In the past, the regulations did not speak to this issue, and the CMS 855 did not clearly state whether such notice had to be given before or after closing. However, the Medicare contractors generally advised providers to give notice as far in advance as possible and to supplement with the Bill of Sale after closing.

Both parties may suffer consequences for failure to comply with the new filing requirements. The current owner’s failure to submit a CMS 855 may result in sanctions even after the date of ownership change.¹⁴

Further, if the prospective new owner fails to submit a CMS 855 "within 30 days of the change of ownership," CMS may deactivate its current Medicare billing number. Deactivation also may result if the application contains material omissions or if CMS questions whether it should transfer the provider agreement.¹⁵ These vague grounds give CMS wide latitude to deactivate billing privileges in this situation.

Further, providers may have difficulty complying with the pre-closing notification requirements imposed by the Final Rule. In many cases, information needed for the enrollment application is not available and the date of the change is not certain until the transaction actually closes.

Pre-change notification is particularly unrealistic for publicly traded companies, which must adhere to a variety of legal limitations on disclosure, which could make any disclosure problematic before the actual closing of the transaction. CMS responded to these concerns in part by stating that it "understand[s] that not all enrollment information is available before the change of ownership [and that it] will work with the new owner(s) to ensure a seamless transition. . . ."¹⁶

However, given the possible penalties for submission of incomplete or untimely information, this statement offers little comfort to providers who must give pre-closing notification.

The regulation addressing the sale or transfer of billing privileges also speaks to changes in ownership or control for suppliers who are not covered by part 489 of the regulations. Like the regulation on reporting changes in information, this regulation also requires reporting of a change in ownership or control within thirty days of the change.¹⁷

This thirty-day deadline replaces the previous deadline of ninety days for reporting all changes. The regulation specifically states that a change of ownership resulting in a new tax identification number requires completion and submission of a new enrollment application by the new owner.¹⁸ Suppliers should take note of this new deadline on reporting changes of ownership and control because a failure to comply may result in temporary deactivation or, ultimately, revocation of Medicare billing privileges.

Despite CMS’s attempts to clarify the notification requirements, the relationship among the various regulations addressing the issue is, at best, unclear. For example, the regulation on reporting changes references reporting "within" thirty days, but it does not mention the pre-closing notification requirement applicable to providers covered by part 489.

Further, providers covered by a provider agreement must give notice "before" the change occurs, but the timing of this pre-closing submission is uncertain.¹⁹ A provider or supplier undergoing a change in ownership or control therefore should consult the appropriate Medicare contractor and experienced legal counsel well in advance of the transaction to ensure compliance with these requirements.

Revalidation of Enrollment Information

One of the most controversial aspects of the Final Rule is the regulation requiring providers and suppliers to resubmit and revalidate the accuracy of enrollment information every five years.²⁰ Although CMS initially proposed a three-year revalidation cycle, it was persuaded by commenters to lengthen the cycle to five years.²¹

CMS wisely decided to implement a phased-in approach in recognition of the large number of physicians who currently bill Medicare but have never completed an enrollment application.²²

CMS plans to instruct its contractors to process new enrollment applications first, then to request and process firsttime enrollment applications for providers and suppliers currently billing Medicare in Fiscal Years 2006 and 2007, and, finally, to initiate revalidations on a limited basis in Fiscal Year 2006, with such activity increasing beginning in Fiscal Year 2008.²³

CMS will contact each provider or supplier directly when it is time to revalidate enrollment information.²⁴ Enrollees who have never submitted a CMS 855 must now do so. As a result, those who enrolled in the Medicare program prior to the use of the CMS 855 will need to submit a vast amount of information not previously furnished to CMS. The revalidation process will require CMS’s contractors to process a substantial volume of enrollment information. Although CMS has committed to phasing in this process over the next few fiscal years, CMS’s claim that its contractors can handle this workload should be viewed with a healthy dose of skepticism.

The provider or supplier must submit a CMS 855 with complete and accurate information, including supporting documentation, for revalidation within sixty days of receiving notification from CMS.²⁵ A provider or supplier may seek additional time to respond,²⁶ but, as with initial applications, CMS did not articulate a defined standard for granting extensions.

Given this lack of clarity and the short time frame for response, providers and suppliers should have policies and procedures in place to ensure proper coordination of responses to revalidation requests and submission of accurate information in a timely fashion.

As part of the revalidation process, CMS reserves the right to conduct further on-site inspections to evaluate compliance with enrollment requirements and to confirm that the provider or supplier is, CMS’s in fact, operational.²⁷ The regulations did not establish any other standards regarding when contractors may decide to conduct an on-site inspection. Given the breadth of the regulations, providers and suppliers likely will have trouble predicting when such a review may occur and should prepare accordingly.

CMS also may perform non-routine revalidations of enrollment information and request recertification of the accuracy of enrollment information whenever necessary. This process may include a site visit.²⁸ The Final Rule provided little information regarding the process and timeframe for responding to non-routine revalidations. The list of possible events that could trigger off-cycle revalidation is so broad that it offers little practical guidance regarding when such a review may occur.

Application Requirements

Providers and suppliers should take note of certain application requirements that apply whether seeking enrollment, submitting changes to information, or going through the revalidation process. While some of these requirements are new, others are existing obligations that are important enough to warrant reexamination.

Certification Requirements.

The new regulations require a provider or supplier to certify that it is in compliance with all applicable federal and state licensure requirements, including Medicare statutes and regulations, and that it does not employ or contract with excluded or debarred individuals or entities.²⁹ These certification requirements apply any time that a provider or supplier submits a CMS 855.

The certification regarding relationships with excluded or debarred individuals or entities is significant because it requires an affirmative representation about which the applicant may or may not have specific knowledge at the time of certification. Although many providers and suppliers include such representations in their contracts and perform routine background checks, they do not necessarily know the status of all employees or contractors at all times.

The new version of the CMS 855 does not include an express certification this broad,³⁰ but CMS could seek to revise it anytime. Furthermore, the certification regarding compliance with Medicare laws, regulations, and program instructions could extend to this requirement. At a minimum, in light of this emphasis on relationships with debarred or excluded parties, all providers and suppliers should reevaluate their policies and procedures for ensuring compliance in this area.

As mentioned above, the certification also includes (as it has in the past) a statement regarding compliance with Medicare laws, regulations, and program instructions, and it specifically names the federal Anti-kickback Statute and the Stark Law. In other words, compliance with these rules and regulations is a pre-condition to receiving payment from the Medicare program.

As a result, this certification could make it difficult for a provider or supplier to defend against a False Claims Act case based on a theory of implied certification because it has certified compliance with these statutes as a pre-condition to payment. Similarly, the CMS 855 requires the applicant to agree to recoupment of Medicare overpayments, which could preempt any subsequent legal argument regarding the provider or supplier’s obligation to return a particular overpayment.

Finally, providers and suppliers also should note the considerable criminal and civil penalties for deliberately falsifying information in the enrollment application. Various federal statutes authorize the imposition of substantial fines as well as imprisonment. These penalties could apply to the entity as well as to the individuals involved. Providers and suppliers therefore should take all necessary steps to ensure that enrollment applications contain accurate information.

Signature Requirements.

Under the new regulation, CMS requires each enrollment application to be signed by an individual who has the authority to bind the provider or supplier, both legally and financially, and who has an ownership or control interest in the provider or supplier.³¹ The person who signs the application must attest to the accuracy of the information submitted and to the provider or supplier’s compliance with a number of additional requirements, including the certification statements previously discussed.³² In light of the possible penalties for noncompliance, the signatory bears considerable responsibility.

After initial enrollment, a "delegated official" may take responsibility for subsequent updates or changes to enrollment information, provided that the delegated official is a W-2 managing employee of, or an individual with an ownership or control interest in, the provider or supplier.³³ CMS clarified, for the first time, that a W-2 employee of the parent corporation cannot serve as a delegated official of a subsidiary because he or she must have a "direct relationship and connection with the applicant."³⁴ In light of this development, providers and suppliers should ensure that the responsibility to sign the CMS 855 is properly delegated in all instances. Many organizations, especially those with multiple locations, may find that the current delegated official does not meet CMS’s requirements.

Denial of Enrollment

The Final Rule expands CMS’s discretion to deny enrollment in the Medicare program. The possible reasons for denial are so broad that CMS could find grounds for denial in nearly any situation. For example, CMS may deny enrollment if the provider or supplier is out of compliance with the Medicare enrollment requirements "at any time" and has not submitted a plan of corrective action as required by the regulations. ³⁵

Another notable basis for denial relates to a provider, supplier, or owner’s conviction for a felony that CMS has determined is "detrimental to the best interests of the program and its beneficiaries."³⁶ Such offenses include but are not limited to crimes against persons, financial crimes, felonies that pose immediate risk to the program or its beneficiaries, and health care fraud.³⁷ A denial imposed on this basis lasts at least ten years from the date of conviction.³⁸

Unlike rejection of an application, denial of enrollment may be appealed, but the provider or supplier must wait until the appeal is over before submitting a new application. If no appeal is filed, a new application may be submitted after the time for filing an appeal has lapsed. An appeal could take a considerable amount of time, so, depending on the circumstances, submission of a new application may be a wiser course of action in this situation.³⁹

The Final Rule allows some flexibility in the case of a denial based on the provider or supplier’s relationship with an excluded or convicted individual or entity. In this situation, CMS may reverse the denial if the provider or supplier submits proof that it has terminated the relationship. Even so, the regulation is unclear how long such a reversal may take.

A denial may have extremely broad and damaging implications because, according to the Final Rule, a denial will cause CMS to automatically review the enrollment of all other locations and determine whether the denial warrants similar adverse action.⁴⁰ This requirement could pose particularly serious complications for large entities with multiple locations.

Revocation of a Medicare Billing Number

The Final Rule establishes grounds for revocation of a Medicare billing number that are substantially similar to the reasons why CMS may deny enrollment.⁴¹ The revocation becomes effective within thirty days of the initial revocation notice and results in simultaneous termination of the provider agreement (if any).⁴² CMS may reverse a revocation based on an association with an excluded or convicted individual or entity if the provider or supplier submits proof that it terminated the relationship.⁴³

In determining whether to revoke a Medicare billing number, CMS explained that it will weigh the severity of the offenses, mitigating circumstances, program and beneficiary risk resulting from continued enrollment, possibility of corrective action plans, beneficiary access to care, and any other pertinent factors.⁴⁴ A provider or supplier may appeal revocation, but CMS will not make payment while an appeal is pending.⁴⁵ CMS promised to establish, in a separate regulation, a new process for appealing denials and revocations.⁴⁶

The effect of a revocation is significant and could have adverse effects on providers and suppliers, especially those with multiple locations. Like the regulations governing denial of enrollment, the revocation regulations state that, once a provider or supplier number is revoked, CMS must automatically review the files of associated providers or suppliers.

Deactivation of a Medicare Billing Number

Under the Final Rule, CMS may deactivate the billing number of a provider or supplier who does not submit any Medicare claims for twelve consecutive calendar months or who fails to report a change in the information supplied on the enrollment application within ninety days of when the change occurred (or within thirty days for changes of ownership and control).⁴⁷ The Proposed Rule would have shortened the inactivity period to six months, but CMS decided to retain the current twelve-month period.⁴⁸

When a billing number is deactivated, billing privileges are temporarily suspended but can be restored upon the submission of updated or recertified information. Providers and suppliers whose billing numbers are deactivated for any reason other than non-submission of claims must submit a new enrollment application and re-enroll in Medicare.⁴⁹

This rule points to the importance of ensuring the effectiveness of policies and procedures related to enrollment updates. If deactivation is for non-submission of claims, a provider or supplier must simply recertify that the enrollment information currently on file with Medicare is still correct.⁵⁰

Prohibition on Sale or Transfer of Billing Privileges

The Final Rule prohibits a provider or supplier from selling, transferring, or allowing another entity or individual to use its Medicare billing number, except in accordance with reassignment or change of ownership rules.⁵¹ In addition, CMS retained broad discretion to deactivate a Medicare billing number at any time before the provider agreement is transferred to the new owner.⁵²

Conclusion

The Final Rule brings some clarity to the enrollment process, but in doing so it imposes significant new administrative burdens and serious consequences for non-compliance. All providers and suppliers should review the Final Rule and the updated CMS 855 forms carefully to ensure they are aware of the obligations imposed, especially given the tight timeframes and the possible penalties involved, and make changes to current policies and procedures as necessary.

Footnotes

1 71 Fed. Reg. 20754 (Apr. 21, 2006).

2 68 Fed. Reg. 22063 (Apr. 25, 2003).

3 69 Fed. Reg. 3434 (Jan. 23, 2004).

4 71 Fed. Reg. 20779 (42 C.F.R. § 424.525(b)).

5 71 Fed. Reg. 20779 (42 C.F.R. § 424.525(c), (d)).

6 71 Fed. Reg. 20776 (42 C.F.R. § 424.510(c)(8)).

7 71 Fed. Reg. 20755, 20765.

8 71 Fed. Reg. 20757.

9 71 Fed. Reg. 20763.

10 71 Fed. Reg. 20778 (42 C.F.R. § 424.520(b)).

11 According to the new version of the CMS 855A, a CHOW generally occurs when a provider is purchased by another organization, and it results in the transfer of the Medicare provider number, provider agreement, and outstanding debt. The CMS 855A distinguishes between a CHOW and an acquisition or merger, which occurs when a currently enrolled Medicare provider purchases or has been purchased by another enrolled provider, and only the buyer’s provider number and tax identification number remain. In the case of an acquisition/merger, the seller’s provider number dissolves, but, in the case of a CHOW, the provider number is transferred.

12 This rule generally applies to institutional providers who have a provider agreement, such as hospitals, skilled nursing facilities, home health agencies, and hospices. See 42 C.F.R. § 489.2(b).

13 71 Fed. Reg. 20781 (42 C.F.R. § 424.550(b) (emphasis added). In the past, the instructions accompanying the CMS 855A directed the prospective new owner to file an application containing information about the current owner, but both parties did not have to comply with independent filing requirements.

14 71 Fed. Reg. at 207781 (to be codified at 42 C.F.R. § 424.550(b).

15 This requirement seems to conflict with 42 C.F.R. § 489.18, which requires automatic transfer of a provider agreement upon a change in ownership.

16 71 Fed. Reg. at 20762.

17 71 Fed. Reg. 20781 (42 C.F.R. § 424.550(c)).

18 Id.

19 The regulation states that the prospective new owner must submit its application "within" thirty days and does not establish a specific deadline for the current owner’s submission. Based on these statements, one could imply the pre-closing submissions are due thirty days before the change of ownership, but the regulation does not specifically state a pre-closing deadline.

20 71 Fed. Reg. 20778 (42 C.F.R. § 424.515).

21 71 Fed. Reg. 20765.

22 Id.

23 71 Fed. Reg. 20764.

24 71 Fed. Reg. 20778 (42 C.F.R. § 424.515(a)).

25 Id.

26 Id.

27 71 Fed Reg. 20778 (42 C.F.R. § 424.515(c)).

28 71 Fed. Reg. 20778 (42 C.F.R. § 424.515(d)).

29 71 Fed. Reg. 20778 (42 C.F.R. § 424.520)).

30 For example, the current CMS 855B includes the following certification: "Neither this supplier, not any five percent or greater owner, partner, officer, director, managing employee, authorized official, or delegated official thereof is currently sanctioned, suspended, debarred, or excluded by [any state or federal health care program], or is otherwise prohibited from supplying services to Medicare or other Federal program beneficiaries."

31 71 Fed. Reg. 20777 (42 C.F.R. § 424.510(d)(3)).

32 Id.

33 71 Fed. Reg. 20777 (42 C.F.R. § 424.510(d)(3)(ii)).

34 Id.

35 71 Fed. Reg. 20779 (42 C.F.R. § 424.530(a)(1)).

36 71 Fed. Reg. 20779 (42 C.F.R. § 424.530(a)(3)).

37 71 Fed. Reg. 20779 (42 C.F.R. § 424.530(a)(3)(i)).

38 71 Fed. Reg. 20779 (42 C.F.R. § 424.530(a)(3)(ii)).

39 See 71 Fed. Reg. 20779 (42 C.F.R. § 424.530).

40 Id. (to be codified at 42 C.F.R. § 424.530(d)).

41 71 Fed. Reg. 20779 (42 C.F.R. § 424.530(a)).

42 71 Fed. Reg. 20779 (42 C.F.R. § 424.530(e)).

43 71 Fed. Reg. 20781 (42 C.F.R. § 424.535(d)).

44 71 Fed. Reg. 20761.

45 71 Fed. Reg. 207781 (42 C.F.R. § 424.545(a)).

46 71 Fed. Reg. 20765.

47 71 Fed. Reg. 20780 (42 C.F.R. § 424.540(a)).

48 See 71 Fed. Reg. 20763.

49 71 Fed. Reg. 20780 (42 C.F.R. § 424.540).

50 Id.

51 71 Fed. Reg. 20781 (42 C.F.R. § 424.535(a)).

52 71 Fed. Reg. 20781 (42 C.F.R. § 424.550(b)).

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.