In recent weeks, the Centers for Medicare & Medicaid Services (CMS) has been contacting certain Medicare-enrolled providers and suppliers (hereinafter “providers”) to verify that their ownership information, as reported in Medicare enrollment records, is accurate. While CMS does not appear at this time to be taking adverse actions against providers for failure to update ownership information, this outreach serves as an important reminder to providers of their regulatory obligations to accurately report and update ownership information in Medicare enrollment filings or face severe penalties.
Read on for additional context of this latest CMS outreach, along with certain actions that all providers should take today to avoid potential scrutiny.
CMS Checking Accuracy of Enrollment Ownership Data
CMS is sending letters to enrolled providers with two or more enrollments under one tax identification number (TIN) where it has found inconsistent ownership information. Such multiple enrollments can occur when providers add service lines such as durable medical equipment, prosthetic, orthotic and other supplies; locations straddle multiple Medicare Administrative Contractors (MAC); or the provider simply has grown over time.
The letters include an exhibit with the ownership information found on the entity’s most recent Medicare enrollment filing and state that this ownership information will be applied to all enrollments under the same TIN 30 days from the date of the letter. CMS states in the letters that providers should verify that the ownership information is accurate, and if it is not, instructs providers to update information as necessary via a CMS-855 application or through CMS’ Provider Enrollment, Chain, and Ownership System (PECOS). This effort follows CMS issuing a newsletter update in January 2023 reminding Medicare-enrolled providers to ensure that ownership information is consistent across all enrollment records under the provider’s TIN. In the newsletter, CMS noted that it would send a letter if different ownership was disclosed in the multiple enrollments.
Importantly, CMS does not appear to be taking punitive administrative action in connection with these letters, as it could under existing regulatory authorities that permit CMS to penalize providers for failing to update Medicare enrollment records in a timely manner. For example, pursuant to 42 CFR § 424.535, CMS has the authority to revoke a provider’s enrollment in the Medicare program for failing to comply with enrollment requirements, including failure to report changes to enrollment records in a timely manner.
Among other requirements, CMS requires providers to disclose in Medicare enrollment applications all individuals or entities that have a more than 5% direct or indirect ownership interest, or any partnership interest, in the provider. Additionally, providers must report any individuals or entities with other ownership or control interests, including officers and directors, managing employees, or entities that own an interest in a mortgage, note or other obligation secured by the provider. However, it appears that this effort by CMS is intended to be a mechanism for streamlining the process of updating Medicare enrollment records rather than taking administrative action against providers, at least at this time.
These new letters follow other recent efforts by CMS and its MACs to verify the accuracy of ownership and control information supplied in enrollment filings in the past years. Recent administrative actions indicate that MACs may independently search publicly available records to determine if a provider’s ownership and other enrollment information is correct. For example, jn a recent revocation action, a MAC discovered incorrect officer information by checking publicly available corporate records on a state’s secretary of state website and finding that the provider had not updated its chief executive officer’s information.
If a MAC finds inconsistent ownership or control information via public databases, it may seek approval from CMS to revoke the provider’s enrollment. If CMS approves of the revocation, the MAC will send a letter notifying the provider of the revocation of its Medicare billing privileges and establishing a re-enrollment bar of up to 10 years. There is an administrative appeal process to challenge such revocations, but the standard for overturning a revocation is high, and providers are often unsuccessful in overturning a revocation absent a factual mistake or misapplication of the CMS’ regulatory authority.
Takeaways and Recommended Next Steps
These letters and actions taken by CMS should serve as an important warning to providers. Providers enrolled in Medicare must be proactive to ensure that ownership, control and all other information reported on Medicare enrollment applications is continually updated. Here are four key takeaways from CMS’ recent enforcement of Medicare notice requirements.
- Providers should be aware of CMS’ scrutiny of ownership information in Medicare enrollment data. If a provider receives a letter requesting verification of ownership information for multiple enrollments under one TIN, the provider should promptly confirm the ownership information CMS has on file is accurate and make any necessary updates quickly by filing a CMS-855 application or through PECOS.
- Scrutiny of ownership information in Medicare enrollment data can result in harsh penalties if providers fail to comply with CMS letter mandates. With respect to its most recent letters seeking verification of ownership information for multiple enrollments under one TIN, CMS appears to be exercising enforcement discretion by not taking action to revoke Medicare billing privileges. CMS may, however, change its position at any time and could exercise its right to take enforcement action if it finds that required reports were not made. To mitigate the risk of punitive administrative action from CMS, providers should update enrollment information in a timely manner.
- Providers should be proactive in updating Medicare enrollment data. Even before receiving a letter from CMS, providers should take care to ensure their Medicare enrollment data is up to date. When a provider experiences ownership changes or other reportable organizational changes, it should promptly notify CMS through PECOS. Further, regular internal audits of Medicare enrollment records can be an important tool for proactively updating ownership and other enrollment information to safeguard Medicare billing privileges.
- An immediate audit of Medicare enrollment data would be wise. In addition to regular audits, for providers and suppliers that historically have not focused on ensuring appropriate records, internally auditing such records today would be wise. Many in the healthcare industry do not focus on such filings. Typically, Medicare filings do not rise to the provider’s leadership or owners, and instead, low-level staff members often submit such information. An internal compliance audit now would be wise to ensure that submitted information is correct and that any leadership changes are made.
Please contact McGuireWoods or one of the authors of this alert for more information on best practices healthcare providers and suppliers can implement to ensure compliance with Medicare enrollment requirements.