HHS Finalizes Anti-Kickback and Stark Reforms that Simplify Compliance and Promote Value-Based Care

On November 20, 2020, the Department of Health and Human Services (HHS) published two rules that finalize sweeping reforms to the regulations governing fraud and abuse in the Medicare and Medicaid programs. The first rule, published by the HHS Office of Inspector General (OIG), focuses primarily on the Anti-Kickback Statute (AKS). The second rule, published by the Centers for Medicare & Medicaid Services (CMS), addresses the Physician Self-Referral Law, commonly referred to as the “Stark Law.” These final rules take effect on January 19, 2021—the day before Inauguration Day—suggesting that the Trump Administration may have timed the release of these rules with an eye toward preventing the incoming Biden Administration from delaying implementation.

These rules finalize many of the policies that HHS originally proposed in October 2019, notably including a new set of protections for so-called “value-based arrangements.” (See here for Manatt’s summary of the 2019 proposed rules.) Responding to stakeholder concerns that the AKS and Stark Law impede innovation around value-based care, the newly finalized rules define several types of protected arrangements through which providers may take on responsibility for the cost of healthcare services, support enhanced care coordination and incentivize high-value care. OIG and CMS have made a number of adjustments to the proposed rules that clarify—or even expand—the scope of protection.

In addition to these new protections for value-based arrangements, the final rules include dozens of other changes to the AKS and Stark regulations, including:

• Enhanced protections regarding transfers of technology related to cybersecurity and electronic health records (EHR).
• Clarifications for foundational Stark Law concepts, such as new or modified definitions for “designated health services,” “commercially reasonable” and “fair market value.”
• Revisions that aim to streamline compliance with existing protections by relaxing documentation requirements and other parameters. 

Background: AKS, Stark and the HHS Regulatory Sprint

In response to industry concern that federal regulations impede innovation in healthcare finance and delivery, HHS announced in 2018 a “Regulatory Sprint to Coordinated Care.” The agency’s goal is to remove regulatory barriers to patient engagement, care coordination, data sharing among providers and financial arrangements that promote value-based care. In 2018, CMS and OIG published Requests for Information soliciting suggestions for how the AKS and Stark regulations might be amended to better support these goals. After reviewing the hundreds of public comments, as well as agency records of enforcement actions and provider self-disclosures, OIG and CMS released proposed rules in October 2019. Each rule received more than 300 public comments, some of which prompted the agencies to modify the parameters in their final rules.

These proposals focus on two of the core federal statutes governing fraud and abuse in federal healthcare programs, including Medicare and Medicaid:

• The Anti-Kickback Statute prohibits individuals and entities from offering or accepting remuneration with the purpose of inducing or rewarding referrals in federal healthcare programs. Impermissible remuneration includes cash kickbacks, as well as more indirect forms of compensation such as, for example, discounted office rental fees or donated medical equipment. OIG is responsible for developing rules relating to the AKS, and has defined a number of “safe harbors” protecting certain types of conduct that, in the agency’s view, present a sufficiently low risk of abuse.
• The Stark Law focuses exclusively on physicians. The law prohibits them from referring program beneficiaries for federally reimbursable “designated health services” (DHS) to any entity with which the physician (or the physician’s family member) has a financial relationship. CMS is charged with enforcing the Stark Law, and has promulgated a number of regulatory exceptions. Unlike the AKS, the Stark Law is a “strict liability” statute, meaning that self-referrals automatically violate the law unless an exception applies, with or without any intention to commit wrongdoing. 

New Rules to Promote Care Coordination and Value-Based Care

OIG and CMS have finalized, with only modest changes, the new AKS safe harbors and Stark exceptions that protect value-based arrangements among healthcare providers.

Addressing Long-Standing Barriers to Value-Based Care. Existing exceptions already allow for many types of value-based reimbursement arrangements between health plans and large providers, such as health systems. However, the current regulatory structure creates legal risk for downstream arrangements between those first-level provider entities and other providers, especially physicians.

As originally crafted, the AKS and Stark frameworks assumed that hospitals and physicians operated in silos, with little recognition of the need for hospitals to financially support value-driven integration initiatives. In particular, a number of the current AKS safe harbors and Stark exceptions require that compensation be “fair market value,” or that reimbursement be determined in a manner that does not “take into account the volume or value of referrals or other business generated.” These are difficult concepts to apply in the context of a value-based arrangement, which often involves concepts of “value” beyond the merely financial (such as patient outcomes), and which often, by definition, takes into account the “volume or value” of services.

OIG and CMS have finalized several new provisions intended to address these and other regulatory barriers to patient-centered, value-based healthcare innovation. The agencies sought to align their approaches where possible, including by defining a shared set of terminology, and also by creating a tiered system of requirements in which providers that take on greater downside financial risk receive greater flexibility with respect to the design of their value-driven initiatives. Even so, the parameters for the new AKS and Stark protections differ in several respects due to key structural distinctions between the two laws, as described above.

Defined Terms. The new safe harbors and exceptions rely on a set of shared terminology relating to value-based care. These definitions have been finalized largely as proposed, with one significant difference regarding the types of entities that are eligible to participate in value-based arrangements.

• Value-Based Arrangement. An agreement to take actions reasonably designed to promote one or more Value-Based Purposes, including care coordination, quality improvement, cost reduction, or otherwise transitioning from volume to value.
• The value-based purpose must address a Target Patient Population, defined using verifiable criteria such as ZIP code, diagnosis or payor. These criteria must be defined in advance and codified in writing. Although AKS and Stark generally focus on referrals involving federal healthcare programs, the target patient population is not so limited, and can include uninsured or commercially insured patients.
• Value-Based Enterprise (VBE). Two or more people or entities (referred to as “VBE Participants”) who collaborate to achieve value-based purposes. The VBE is subject to governance requirements, and may be a legally distinct entity (e.g., an accountable care organization (ACO)) or merely a network of VBE participants affiliated through a VBE governing document. Each VBE participant must be part of a value-based arrangement with at least one other VBE participant or the VBE entity itself. Moreover, any given value-based arrangement may not include any participants other than the VBE and its VBE participants.
  • OIG originally proposed to prohibit certain types of entities—such as drug and device manufacturers—from participating in a VBE or in value-based arrangements for purposes of the AKS safe harbors. In the final rule, OIG removed those restrictions from the definition of VBE participant, thereby allowing any person or entity (other than a patient) to participate in the contracts that make up VBEs and value-based arrangements. Each safe harbor, however, includes restrictions on the types of entities that are eligible to receive protection for the remuneration they provide.
  • The following entities are generally ineligible for protection under the new AKS safe harbors: drug and device manufacturers, PBMs, laboratory companies, compounding pharmacies, and certain suppliers of durable medical equipment, prosthetics, orthotics and supplies (DMEPOS). Under certain safe harbors, protection may be available with respect to digital health technology supplied by certain device manufacturers or DMEPOS suppliers. 

New AKS Safe Harbors. OIG has finalized several new safe harbors that address value-based care, including three “tiered” safe harbors tied to the level of downside financial risk, a fourth safe harbor that promotes “patient engagement tools and support,” and a safe harbor that protects arrangements within CMS-sponsored care models.

OIG finalized three safe harbors tied to the level of financial risk, with only modest modifications from the 2019 proposed rule:

• Full Financial Risk. For at least one year, the VBE receives prospective payments from the payor for all covered services for the target patient population (e.g., global capitation or global budgets).
• Substantial Downside Financial Risk. The VBE’s arrangement with both the payor and with the VBE participant(s) satisfy the rule’s definition of “substantial downside” risk. The final rule makes certain adjustments to the parameters for qualifying risk models, which include shared savings and losses, bundled payment, and partial capitation.
• Care Coordination Arrangements. VBE participants may exchange in-kind benefits to promote evidence-based care coordination, as long as the arrangement is commercially reasonable and the recipient contributes at least 15% of the cost. 

Each of these three safe harbors is subject to a variety of additional safeguards, including the following:

• All remuneration among VBE participants must be used predominantly for value-based purposes, and may not induce VBE participants to limit medically necessary services, include ownership or investment interests, or involve patient recruitment or marketing;
• The value-based arrangement may not take into account the volume or value of referrals or other business outside the arrangement; and
• The arrangement must be set forth in writing and the VBE participants must maintain records for at least six years to establish their compliance with all safe harbor requirements.

OIG also finalized a fourth safe harbor allowing VBE participants to furnish patients with up to $500 annually in in-kind benefits that meet the rule’s definition of “Patient Engagement Tools and Supports.” Whereas the proposed rule included specific examples of permitted tools and supports, the final rule permits any item or service that is recommended by the patient’s licensed healthcare professional in connection with patient safety, disease prevention and management, or adherence to a treatment plan or drug regimen, subject to meeting certain safeguards.

Finally, OIG finalized a safe harbor protecting remuneration—including reimbursement among the participants, as well as patient incentives and supports—within CMS-Sponsored Models, such as the Medicare Shared Savings Program for ACOs, Bundled Payments for Care Improvement, or the Oncology Care Model. Unlike the other safe harbors, this one could potentially extend to pharmaceutical manufacturers and other entities, subject to CMS approval.

New Stark Exceptions. CMS finalized the three proposed exceptions to the Stark Law for VBE participants, and generally preserved the details of the 2019 proposal. Like the AKS safe harbors, the proposed Stark exceptions reduce the number of regulatory requirements as the VBE participants take on additional financial risk.

• Full Financial Risk. During the entire term of the arrangement, the VBE receives prospective payments for all covered services for the target patient population.
• Meaningful Downside Financial Risk for the Physician. The physician’s reimbursement must involve either minimum risk thresholds or partial capitation, and this methodology must be determined in advance and set forth in writing. CMS has modified the details of the “meaningful downside risk” standard, most notably by lowering the minimum risk percentage from 25% to 10% of the total value of the physician’s remuneration under the value-based arrangement.
• Other Value-Based Arrangements. Value-based arrangements with no downside financial risk may qualify for protection if the details, including remuneration, are determined in advance and set forth in a signed writing. Any outcome measures established in the arrangement must be both objectively defined and prospectively measured. The VBE participants must monitor their performance at least annually and, if necessary, make adjustments to the value-based arrangement. 

All three exceptions require certain safeguards, similar to those described above regarding the tiered AKS safe harbors. In addition, if physician remuneration is conditioned on referrals to a particular provider, the value-based arrangement must be set out in writing, and must contain exceptions based on the patient’s preferences, the payor’s direction or the physician’s medical judgment.

With respect to indirect compensation arrangements, CMS has finalized the following proposal: If there exists an unbroken chain of financial relationships between the referring physician and the DHS entity, CMS proposes that the entire chain would be protected as long as the relationship to which the physician is a direct party falls under one of the exceptions defined above.

Updates Regarding Cybersecurity and Electronic Health Records

OIG and CMS have finalized their proposals regarding new protections for nonmonetary donations of cybersecurity hardware, technology and related services, as well as modifications to the existing protections related to EHR, most notably by removing the EHR sunset provision, pursuant to which the existing EHR protections would have expired at the end of 2021. These changes are virtually identical across the AKS and Stark rules.

Other Revisions to the AKS Safe Harbors

Beyond the provisions described above regarding value-based care, OIG finalized several other additions or modifications to the AKS safe harbors.

• Personal Services and Management Contracts. OIG finalized a number of changes to streamline and expand the existing safe harbor for personal services contracts, including the following:
  • Aligning this safe harbor with the corresponding Stark exception by requiring the compensation formula—but not necessarily the aggregate payments—to be set in advance.
  • Eliminating the requirement that contracts for part-time services must specify the exact schedule for such services.
  • Expanding the personal services safe harbor to protect certain outcomes-based payments, thereby allowing parties who are not VBE participants to define outcomes-based payments that indirectly take into account the volume or value of referrals or other business, subject to implementing certain safeguards.
• Warranties. This existing safe harbor protects warranty arrangements in which vendors offer remuneration to their customers in the event that one of their items fails to meet a specified level of performance. Whereas this safe harbor was previously limited to warranties covering a single item, the revised rule now permits manufacturers and suppliers to offer “bundled” warranties covering multiple related items and services, as long as those items and services are all reimbursed by a single payment under a federal healthcare program.
• Local Transportation. OIG finalized the following three modifications to this existing safe harbor:
  • For rural communities, expanding the transportation distance limit from 50 miles to 75 miles.
  • Eliminating the distance limit on transportation for a patient who has been discharged after an inpatient admission, regardless of whether the patient resides in an urban or rural area.
  • Clarifying that ride-sharing services, such as Lyft or Uber, fall within the transportation safe harbor to the same extent as a taxi service. 

Other Stark Law Revisions

Although the “value-based care” exceptions were the headline item in CMS’s final rule, these new exceptions accounted for only one quarter of the rule’s preamble text; the bulk of the preamble was dedicated to CMS’s many other regulatory revisions that clarify long-standing ambiguities and implement certain policy changes. Particularly salient changes are described below.

• Definitions for Foundational Stark Law Concepts. CMS has added or modified definitions for several key terms in the Stark Law regulations, including:
  • Amending the definition of “designated health services” (DHS) to exclude any service provided by a hospital to an inpatient if the service does not affect the hospital’s reimbursement under Medicare’s prospective payment methodologies for hospitals, inpatient rehabilitation facilities, inpatient psychiatric facilities and long-term care hospitals. CMS considered, but ultimately rejected, a further DHS carve-out for certain outpatient hospital services.
  • Adding a new definition for “commercially reasonable,” a term that previously lacked a regulatory definition. Under the final rule, an arrangement is “commercially reasonable” if the arrangement “furthers a legitimate business purpose of the parties to the arrangement and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty.” The new rule helpfully confirms that “an arrangement may be commercially reasonable even if it does not result in profit for one or more of the parties.”
  • Creating an objective test to determine whether an arrangement “takes into account the volume or value of referrals or other business.” An arrangement will fit this description when the formula used to calculate compensation includes as a variable referrals or other business generated, and the amount of the compensation correlates with the number or value of referrals or other business. (CMS had proposed additional policies regarding fixed-rate compensation, but declined to include those policies in the final rule.)
  • Revising the “fair market value” definition to provide a definition of general application (“The value in an arm’s-length transaction, consistent with the general market value of the subject transaction”), as well as definitions that apply specifically to equipment rentals and office space rentals.
• Limited Remuneration to a Physician. CMS finalized a new exception protecting remuneration from an entity to a physician for items or services up to $5,000 per calendar year (up from a $3,500 limit in the proposed rule). The compensation may not take into account the volume or value of referrals, must reflect fair market value, and must be commercially reasonable. The arrangement need not be set forth in writing, however. This exception will help to avoid many technical violations—often due to a delayed signing or expired written agreement—for physician services that are offered on a temporary or infrequent basis.
• Temporary Noncompliance. With respect to exceptions that require an executed writing, CMS has expanded the types of technical errors that may be corrected within 90 days. Previously, noncompliance with the signature requirement was the only type of error eligible for the 90-day grace period.
• Ownership and Investment Interests. CMS finalized its proposal to exclude the following from the definition of “ownership or investment interests”:
  • Any interests that are merely “titular” in nature (codifying existing CMS guidance that exempts from the Stark Law’s reach arrangements involving a physician who holds a titular ownership in an entity, but who does not have a right to the distribution of profits or the proceeds of sale); and
  • An interest that arises through participation in an employee stock ownership program that complies with the requirements of the Employee Retirement Income Security Act.
• Period of Disallowance. CMS has eliminated the bright-line rules that previously determined the point in time when a “financial relationship” has come to an end, such that a physician may resume making referrals without violating the Stark Law. CMS will instead apply a case-by-case approach.
• Patient Choice and Directed Referrals. CMS has expanded the applicability of the requirement for certain types of arrangements to preserve patient choice of provider and payor-directed referrals. This requirement (contained at 42 C.F.R. § 411.354(d)(4)) now applies to a number of additional exceptions.
• Other Exceptions. CMS finalized various other adjustments to the definitions and exceptions addressing shared use of rented office space, fair market value for office space, isolated financial transactions, the signature requirement in physician recruitment agreements, physician services unrelated to DHS, payments by a physician to a laboratory, and nonphysician practitioners. 

Conclusion

These rules represent some of the most significant regulatory changes to America’s fraud and abuse landscape in the last decade. As OIG and CMS noted in the preambles to the final rules, many of these proposed revisions drew strong support from across the healthcare industry, although some commenters expressed concern that the new protections for value-based care may prove challenging for smaller and more rural providers, who may have limited administrative capacity for new documentation and compliance burdens or limited financial capacity for downside financial risk.

It remains to be seen how quickly providers will begin taking advantage of the newly finalized protections for value-based arrangements, particularly those that require the assumption of substantial or full risk for the cost of care. As soon as the rules take effect on January 19, 2021, however, there is no doubt that many healthcare stakeholders will be breathing a sigh of relief in light of the many revisions that expand the scope and relax the requirements of existing protections under the AKS and Stark Law.

NOTE:  More detailed information on the AKS and Stark reforms is available through Insights@ManattHealth, Manatt’s Health’s premium content information service. Please contact Barret Jefferds at bjefferds@manatt.com to learn more or to schedule a demonstration.