Update (Feb. 22, 2021): As discussed below, the final rules discussed in the alert below were given a Jan. 19, 2021, effective date, but some ambiguity existed with respect to their effective status. Since publication, according to an industry publication, CMS has now clarified its view that the regulations finalized in the final rule are effective. McGuireWoods will continue to review further guidance from the new administration to understand if the policies in this final review are otherwise modified or retracted.
As discussed in a prior McGuireWoods alert, the U.S. Department of Health and Human Services (HHS) published final rules that significantly amend the Physician Self-Referral Law (Stark Law), the federal Anti-Kickback Statute (AKS) and the Civil Monetary Penalties Law. The final rules discussed in this alert were originally given a Jan. 19, 2021, effective date. Since publication, however, the Government Accountability Office concluded that the final rules did not incorporate a required 60-day delay in their effective date. Meanwhile, on Jan. 20, 2021, the Biden administration paused final rules from the Trump administration from taking effect. McGuireWoods will review further guidance from the new administration to understand if the policies in this final review are modified, retracted or corrected with a new effective date.
This client alert, the latest in McGuireWoods’ summary series on these final rules, focuses on four key revisions to existing AKS safe harbors and provides key takeaways to assist healthcare providers in navigating these new changes. Specifically, the final rules changed several existing AKS safe harbors, including: (i) modifying the electronic health records (EHR) safe harbor to expand cybersecurity protections, among other updates; (ii) increasing flexibility under the personal services and management contracts safe harbor; (iii) expanding around patient transportation protections and loosening several restrictions; and (iv) extending coverage and protections under the warranties safe harbor. This alert also provides a brief overview of the final rule’s new safe harbors that cover value-based delivery models and patient engagement tools. By implementing these changes, the Office of the Inspector General (OIG) will reduce burdens for healthcare providers and other stakeholders within the healthcare industry and provide greater flexibility under existing laws while, at the same time, continuing to protect against misuse, fraud and abuse.
The final rules stem from HHS’ “Regulatory Sprint to Coordinated Care,” discussed more thoroughly in a previous McGuireWoods alert, which is intended to incentivize value-based arrangements and patient care coordination by expressly permitting certain activities that could be deemed problematic under historic laws.
- Focus on EHR and cybersecurity technology protections. As discussed in a prior McGuireWoods alert, the OIG has amended the EHR safe harbor several times since its creation in 2006. Most recently, it recognized that certain flexibilities would allow providers to engage in new digital health technology arrangements to develop more sustainable value-based delivery models, strengthen the healthcare industry against cyberattacks, and combat the current public health emergency resulting from the COVID-19 pandemic. Accordingly, the final rule shields the donation of cybersecurity items and services through new protections under the existing EHR safe harbor as well as through the addition of a new cybersecurity technology and services safe harbor.
Changes to the existing EHR safe harbor include: (i) expanded protections for cybersecurity technology and services; (ii) modernization updates regarding interoperability provisions; (iii) changes to cost-sharing requirements; (iv) removal of the replacement technology donation prohibition; and (iv) removal of sunset provisions. The new cybersecurity exception and safe harbor permits the donation of cybersecurity technology and related services as long as certain conditions are met. More detailed information regarding the OIG’s changes to the existing EHR safe harbor and the new cybersecurity technology safe harbor can be found in this recent McGuireWoods alert.
- Broadened flexibility under the local transportation safe harbor. Undoubtedly, and as the OIG acknowledged, transportation plays a vital role in patients’ access to quality care and care coordination. To increase flexibility to meet those needs, the OIG finalized its proposed rule (with slight modifications) to update the local transportation safe harbor by: (i) expanding the mileage limits for rural areas from 50 miles to 75 miles (inclusive of shuttle service); (ii) eliminating mileage limitations to transport patients back to a residence after being discharged from an inpatient facility or hospital; and (iii) clarifying that safe harbor protections extend to rideshare arrangements. The OIG did, however, decline to extend safe harbor protection to transportation offered for non-medical purposes, even if such purpose would improve or maintain patient health, citing risk of fraud and abuse.
By increasing the mileage limits for rural areas from 50 to 75 miles, the OIG hopes to improve access to healthcare for rural residents and those living in transportation deserts. In setting this new mileage limit, the OIG solicited comments and relied on data and evidence as to the distance patients in rural communities travel to obtain healthcare. The OIG believes the increase to 75 miles is both “necessary and practical,” yet maintains the “local” transportation nature this safe harbor was intended to capture and is unlikely to be subject to abuse.
The OIG cited strong support to eliminate the distance limitations on transportation furnished to a patient “discharged from an inpatient facility following an inpatient admission or released from a hospital” to such patient’s preferred place of residence, regardless of whether the patient resides in an urban or rural area. The OIG expressly confirmed that it intends the term “residence” to include and protect transporting patients to the following locations as long as other requirements of the safe harbor are met: (i) custodial care facilities (such as nursing), provided that the patient established such facility as a residence before receiving treatment; (ii) homeless shelters; and (iii) a residence of the patient’s choice, such the home of a friend or relative who is caring for the patient post-discharge.
The OIG noted that many commenters advocated for the OIG to expand the safe harbor to protect transportation to any location a discharged patient’s chooses, including to another healthcare facility; however, the OIG declined to do so, citing the potential for abuse if the safe harbor extended to protecting transportation between healthcare providers in a position to refer to each other. The OIG also declined to eliminate distance limitations for patients other than those discharged as inpatients or after spending 24 hours in observation status, reasoning that such an exception would be too “expansive and overly broad.”
Lastly, while the OIG did not believe an amendment to the regulatory text was necessary, the OIG did expressly state that it supports eligible entities utilizing ridesharing services or other transportation methods similar to that of taxis to make local transportation available to their patients.
- Increased protection and flexibility for personal services and management contracts. While the OIG largely adopted its proposed modifications to the personal services and management contracts safe harbor, the OIG did modify the conditions an arrangement must meet if the parties to an arrangement will make outcomes-based payments. Specifically, the OIG (i) removed the requirement that contracts for part-time arrangements specify the schedule, length and exact charge for the intervals of time worked under the arrangement; (ii) substituted the requirement that aggregate compensation paid under an arrangement be set in advance, with a new requirement that only the methodology for determining compensation be set in advance; and (iii) adopted modified conditions permitting outcomes-based payments under a personal services or management contracts arrangement.
Removal of the part-time arrangements restrictions and modification of the “set in advance” requirement provide regulatory protection (assuming all other elements of the safe harbor are met) and greater flexibility to providers that need periodic management and personal services arrangements but are unable to predict the exact frequency of their need for services (e.g., call coverage). Additionally, these changes more closely align the personal services and managements contract safe harbor with the personal arrangements exception to the Stark Law. In finalizing these revisions, the OIG noted its desire to accommodate a broad range of part-time or sporadic-need value-based payment and care arrangements and, at this time, will not require additional documentation requirements as it continues to believe that the other conditions to this requirement sufficiently safeguard against potential fraud or abuse.
By changing the requirement that the aggregate compensation be set in advance, to the methodology for determining such compensation be set in advance, the OIG made additional protections available for provider compensation. As a result of the final rule, productivity and unit-based methodologies can meet the service arrangement safe harbor as long as the methodology is consistent with fair market value and set in advance, and, in any event, does not take into account the volume or value of any referrals or other business generated between the parties.
In commentary discussing modification of the “set in advance” requirement, the OIG addressed whether a payment methodology based on “actual expenses incurred” could be a methodology sufficiently set in advance to satisfy the modified safe harbor requirement. While acknowledging that whether the compensation methodology is sufficiently set in advance depends on the facts and circumstances of the arrangement, the OIG stated that it could be possible for compensation based on actual expenses incurred to satisfy the set-in-advance requirement. The example provided in the commentary details a hospital compensating a physician practice for a leased physician based on the percent of the practice’s actual expenses in employing the physician that correlate to the percentage of the physician’s work actually performed for the hospital. There, the expenses include salary, benefits, bonus, liability insurance and overhead. The OIG said such expenses could be set in advance but cautioned that the safe harbor would not be met if the physician’s bonus took into account the volume or value of referrals between the parties.
Extending protections of the personal services and management contracts safe harbor to outcomes-based payments opens the door for rewarding agents for improving patient or population health, or reducing payor costs, while simultaneously improving quality of care so long as such arrangements do not relate solely to the achievement of cost savings for the principal. Consistent with the OIG’s proposal, the final rule excludes pharmaceutical manufacturers; manufacturers, distributors and suppliers of durable medical equipment, prosthetics, orthotics and supplies; and laboratories. The OIG also decided to exclude from protection under the safe harbor for any outcomes-based payments those pharmacies that primarily compound drugs or primarily dispense compounded drugs, wholesalers and distributors of pharmaceutical products, and pharmacy benefit managers. While such entities are currently ineligible to receive protection, the OIG indicated that it may consider outcomes-based contracting for pharmaceutical products and medical device manufacturers in future rulemaking.
- Expanded warranties safe harbor to provide flexibility and encourage innovative arrangements. The OIG finalized, without modifications, its proposal to amend the warranties safe harbor, which includes (among others) the following key changes: (i) extending coverage for bundled warranties, including warranties that cover the sale of multiple items and related services (as described in more detail below); (ii) finalizing the “same program/same payment requirement”; (iii) capping the warranty remuneration at the buyer’s cost of the entire bundle of items or items and services in the applicable warranty; (iv) barring arrangements that condition warranties on exclusive use or minimum purchase requirements; (v) requiring buyers (other than beneficiaries) to report price reductions in a way that is compatible with the applicable reimbursement methodology for the items or services (without implementing a specific timeline); and (vi) separately and directly defining “warranties” rather than cross-referencing the definition to other statutes or case law.
The most material modification to the warranties safe harbor that was finalized is OIG’s safeguarding of bundled warranties and protecting, for the first time, warranties that cover bundled items and related services. Previously, the safe harbor for warranties limited its protection to warranties for single items. Although the OIG repeatedly clarified in the final rule that the expanded safe harbor protection will not extend to “services-only” warranties (i.e., the warranty arrangement must include at least one item in the bundle), the OIG expects that the safe harbor’s expansion to safeguard warranties related to the sales of services will facilitate innovative and value-based arrangements. The OIG reiterated in the final rule that the safe harbor continues to protect only warranty remedies (i.e., the expanded safe harbor does protect free or discounted services or items that are provided as part of a bundle or ancillary to a warranty arrangement).
Despite commentators’ concerns, the final rule also finalized the “same program/same payment requirement,” which protects warranties for bundled items or items and services so long as such items and services are reimbursed by the same federal healthcare program and in the same payment. For example, warranties for a bundle of items and services reimbursed under a single state’s Medicaid program are not eligible for protection under this safe harbor if the buyer receives separate reimbursement for each item and service in the bundle under different payment systems.
Notably, in the final rule, the OIG declined to include a “commercial reasonableness” standard in the expanded safe harbor for warranties and expressly stated that the expanded safe harbor does not protect “population-based warranties”; however, the OIG clarified that it may consider implementing specific safe harbor protection for value-based and outcome-based, pharmaceutical-related arrangements in the future.
- New safe harbors protecting value-based delivery models and patient engagement tools and supports. In addition to changes under existing safe harbors, the OIG proposed three new safe harbors designed to protect value-based arrangements and create new opportunities for external alignment models, specifically: (i) a safe harbor regarding care coordination arrangements that do not require parties to assume risk; (ii) a safe harbor regarding value-based arrangements with substantial downside financial risk; and (iii) a safe harbor regarding value-based arrangements with full financial risk. The OIG notes that, by design, these safe harbors will “offer flexibility for innovation and customization of value-based arrangements to the size, resources, needs, and goals of the parties themselves” and further allow arrangements to reflect up-to-date understandings of medicine and the healthcare industry. More information regarding the new value-based safe harbors can be found in this McGuireWoods alert.
As a result of the growing digital health technology industry, the OIG also finalized, with some modifications, a new safe harbor that protects patient engagement tools and supports provided only by a value-based enterprise participant to certain patients within a target patient population. For a tool or support to satisfy the safe harbor, the tool and support must be in-kind items, goods and services, and the aggregate retail value of the tools or support must not exceed $500 per year.
With the implementation of these final rules, the OIG seeks to remove specific AKS burdens on providers, while at the same time protecting against substantial risk of increased fraud or abuse. While some of these changes to existing safe harbors are not drawing the same focus as the value-based arrangement changes, they could have similarly large impacts in allowing more care coordination and reducing overall costs to the healthcare system.
Contact a McGuireWoods attorney or one of the authors of this alert for more information regarding these final rules. Given the significance of these changes, McGuireWoods plans to provide additional analysis and summaries on key changes and implementation of the same.
For more information – to review additional guidance on the final rules, see the following McGuireWoods legal alerts:
- Part V: Easing Stark Law Compliance (Feb. 16, 2021)
- Part III: New Value-Based Arrangement Protections (Jan. 20, 2021)
- Part II: Amended EHR and New Cybersecurity Donation Safe Harbors and Exceptions (Jan. 12, 2021)
- Part I: Changes to Patient Inducement and Kickback Policies (Jan. 11, 2021)
- Private Equity Healthcare Affiliations (Jan. 7, 2021)
- Summary of the final rules (Nov. 23, 2020)