HHS OIG and CMS Release Historic, Sweeping Reforms to Stark Law and Anti-Kickback Statute Regulations

As mentioned in our earlier report, on November 20, 2020, The Department of Health and Human Services (HHS) Office of Inspector General (OIG) and Centers for Medicare & Medicaid Services (CMS) published two long-awaited final rules significantly reforming regulations interpreting the federal Stark Law and Anti-Kickback Statute. The stated goals of these new rules are to reduce regulatory red tape to coordinated patient care and to fast-track the ongoing progression of the health care payment system from fee-for-service to value-based. To that end, the final rules offer increased opportunities for health care providers to enter into value-based arrangements and coordinate care, while also relaxing bureaucratic barriers on providers and strengthening protections against fraud, waste, and abuse.

The HHS OIG published the final rule “Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements,” and CMS promulgated the final rule “Modernizing and Clarifying the Physician Self-Referral Regulations.” These rules are a key component of HHS’s “Regulatory Sprint to Coordinated Care,” which has scrutinized numerous regulations that hinder health care providers’ attempts to move toward value-based care and improve coordinated care across both the federal and commercial sectors.

In a statement accompanying the new rules, HHS Secretary Alex Azar said, “Today, we’ve completed historic reforms to regulations that have stood in the way of creativity and innovation by American healthcare providers for far too long. These new regulatory reforms will mean better care, including innovative arrangements with digital technology that may help patients receive care during the COVID-19 pandemic.”

1. Stark Law Regulations Final Rule

CMS’s final rule modernizes outdated federal regulations implementing the Physician Self-Referral Law (commonly known as the Stark Law). Subject to certain exceptions, the Stark Law generally prohibits a physician from making referrals to an entity for certain “designated health services” payable by Medicare if the physician (or an immediate family member) has a financial relationship (whether by ownership or through other compensation arrangements) with the entity performing or billing for the services. Some courts have interpreted the statute to implicate Medicaid as well. While the Stark Law and its corresponding regulations have been amended over the years, the most recent final rule expands or adds significant new concepts that alter the way these rules will apply to many health care arrangements.

At the time the Stark Law was enacted in 1989, providers were reimbursed primarily on a fee-for-service basis under which they were incentivized to deliver more services regardless of quality or need. However, with the enactment of the Affordable Care Act (ACA) and the Medicare Shared Savings Program’s accountable care organizations (ACOs), along with more recent value-based models such as the Merit-based Incentive Payment System (MIPS), the federal government has increasingly tried to provide financial incentives for quality and coordinated care.

Stakeholders and regulators are generally in agreement that the government’s efforts in this regard have been hampered by the Stark Law’s strict-liability standard prohibiting any financial relationship with physicians, regardless of the purpose. Despite implementing exceptions to protect certain payments under an ACO or to encourage the use of electronic health records (EHR), many believe that the Stark Law continues to be an impediment to large-scale adoption of value-based care models.

At the same time, twenty years of enforcement and guidance—and most notably submissions under the Self-Referral Disclosure Protocol (SRDP)­—has shown that providers were spending time and resources focusing on nuances of the Stark Law regulations in ways that were interfering with the delivery of care. In response, CMS began, as early as 2015, to clarify the regulations’ requirements for written agreements and signatures.

The new final rule endeavors to continue these clarification efforts and pave new paths to incentivize value-based care. Specifically, it is designed to decrease the regulatory burdens on health care providers while supporting the Stark Law’s aim of protecting patients from medically unnecessary treatment and from being steered to more expensive care due to a provider’s economic self-interest. The final rule also creates new pathways for health care providers to coordinate the care of their patients and thereby allow providers across different health care settings to work collaboratively to ensure patients receive high quality care.

The rule finalizes many of the proposed policies from the notice of proposed rulemaking issued in October 2019, which we previously discussed here, including:

• Exceptions for Value-based Arrangements. The final rule creates new, permanent exceptions for value-based arrangements that will allow health care providers to design and enter into more flexible value-based arrangements without fear that legitimate activities to coordinate and improve the quality of care for patients and lower costs would violate Stark Law. Certain types of arrangements had been subject to temporary waivers due to COVID-19, but these exceptions give providers more confidence to enter into long-term arrangements that will be protected under the Stark Law.
• New Guidance and Clarifications. The final rule provides additional guidance on key requirements of the exceptions to the Stark Law to make it easier for health care providers to comply with the law. For instance, compensation provided to a physician by another health care provider must generally be at “fair market value.” The final rule clarifies how to determine whether compensation meets this requirement.
• Other New Exceptions. The final rule establishes new exceptions to protect nonabusive, beneficial arrangements between physicians and other health care providers that apply regardless of whether the parties operate in a fee-for-service or value-based payment system—such as donations of cybersecurity technology that safeguard the integrity of the health care system.

Unless otherwise specified in the rule, all of its provisions will go into effect 60 days from the rule’s display date in the Federal Register. In other words, this rule is effective as of the date the new administration takes office and the President is sworn in on January 20, 2021.

Overall this rule is designed to result in better access and outcomes for patients by creating clearer paths for providers to coordinate care while, at the same time, retaining the strong patient protections from the original law to clearly prohibit referrals that are based solely on financial incentives to providers. CMS Administrator Seema Verma said, “When CMS launched our nationwide tour to kick off our Patients Over Paperwork initiative in 2017, one of the top things we heard from front-line providers was how the outdated Stark regulations impeded them from moving toward a more value-driven reimbursement model. Our team listened and took action, and today’s final rule is the historic result.”

For more information about the major provisions of the final rule, see CMS’s fact sheet available here.

2. Anti-Kickback Statute and Civil Monetary Penalty Final Rule

OIG’s new and amended regulations to the federal Anti-Kickback statute^[1] and the civil monetary penalty law provision prohibiting inducements to beneficiaries (Beneficiary Inducements CMP^[2]) address concerns that these laws unnecessarily inhibit the ways in which health care providers can transition to value-based care and improve the coordination of care with beneficiaries of Medicare and other federal health care programs.

The federal Anti-Kickback statute provides for criminal penalties for whoever knowingly and willfully offers, pays, solicits, or receives remuneration to induce or reward (among other things) the referral of business reimbursable under any of the federal health care programs. Health care providers and others may voluntarily seek to comply with statutory and regulatory safe harbors so that they can be sure their business practices do not run afoul of the statute. Unlike the Stark Law, which is a strict-liability statute, the Anti-Kickback statute is a criminal statute and therefore intent-based. Accordingly, the failure to satisfy a safe harbor does not automatically mean that an arrangement violates the Anti-Kickback statute.

The Beneficiary Inducements CMP imposes civil monetary penalties against any person who offers or transfers remuneration to a Medicare or state health care program beneficiary that the person knows or should know is likely to influence the beneficiary’s selection of a particular provider, practitioner, or supplier for the order or receipt of any item or service for which payment may be made, in whole in in part, by such health care program.

OIG’s final safe harbor regulations seek to remove barriers to coordinated and value-based care and include safeguards to protect federal health care programs and patients. The final rule implements seven new safe harbors, modifies four existing safe harbors, and codifies one new exception under the Beneficiary Inducements CMP.

The final rule modifies and clarifies the Notice of Proposed Rulemaking promulgated by OIG on October 17, 2019, which we discussed in a previous article. For example, the final rule clarifies how medical device manufacturers and durable medical equipment companies may participate in protected care coordination arrangements that involve digital health technology, and it lowers the level of “downside” financial risk parties must assume to qualify under the new safe harbor for value-based arrangements that involve substantial downside financial risk. In addition, the rule recognizes the growing threat of cyberattacks to the health care industry by expanding the new safe harbor for cybersecurity technology and services to defend cybersecurity-related hardware.

Subject to certain conditions, the final safe harbor rules protect:

• Value-Based Arrangements. Three new safe harbors for certain remuneration exchanged between or among eligible participants in a value-based arrangement that fosters better coordinated and managed patient care:
  • Care Coordination Arrangements to Improve Quality, Health Outcomes, and Efficiency (§ 1001.952(ee));
  • Value-Based Arrangements With Substantial Downside Financial Risk (§ 1001.952(ff)); and
  • Value-Based Arrangements With Full Financial Risk (§ 1001.952(gg)).
• Patient Engagement and Support. A new safe harbor (§ 1001.952(hh)) for certain tools and supports furnished to patients to improve quality, health outcomes, and efficiency.
• CMS-Sponsored Models. A new safe harbor (§ 1001.952(ii)) for certain remuneration provided in connection with a CMS-sponsored model (as defined in the final rule), which should reduce the need for separate and distinct fraud and abuse waivers for new CMS-sponsored models.
• Cybersecurity Technology and Services. A new safe harbor (§ 1001.952(jj)) for donations of cybersecurity technology and services.
• Electronic Health Records Items and Services. Modifications to the existing safe harbor for EHR items and services (§ 1001.952(y)) to add protections for certain related cybersecurity technology, to update provisions regarding interoperability, and to remove the sunset date.
• Outcomes-Based Payments and Part-Time Arrangements. Modifications to the existing safe harbor for personal services and management contracts (§ 1001.952(d)) to add flexibility for certain outcomes-based payments and part-time arrangements.
• Warranties. Modifications to the existing safe harbor for warranties (§ 1001.952(g)) to revise the definition of “warranty” and provide protection for bundled warranties for one or more items and related services.
• Local Transportation. Modifications to the existing safe harbor for local transportation (§ 1001.952(bb)) to expand and modify mileage limits for rural areas and for transportation for patients discharged from an inpatient facility or released from a hospital after being placed in observation status for at least 24 hours.
• Accountable Care Organization Beneficiary Incentive Programs. Codification of the statutory exception to the definition of “remuneration” under the Anti-Kickback statute related to ACO Beneficiary Incentive Programs for the Medicare Shared Savings Program (§ 1001.952(kk)).

In addition, subject to certain conditions in the final rule, the final exception regulations under the Beneficiary Inducements CMP protect:

• Telehealth for In-Home Dialysis. An amendment to the definition of “remuneration” in the CMP rules (42 C.F.R. § 1003.110) interpreting and incorporating a new statutory exception to the prohibition on beneficiary inducements for “telehealth technologies” furnished to certain in-home dialysis patients.

According to Principal Deputy Inspector General Christi A. Grimm, “OIG’s new safe harbor regulations are designed to facilitate better coordinated care for patients, value-based care, and improved cybersecurity, while also protecting against fraudulent or abusive conduct. Providers and the health care system are still on the front lines against COVID-19, and this rule establishes flexibilities for remote patient monitoring or other arrangements to assist in the ongoing response and recovery efforts.”

For additional information on this final rule, see OIG’s fact sheet.

[1] 42 U.S.C. § 1320a-7b(b).

[2] 42 U.S.C. § 1320a-7a(a)(5).