In Depth
PROVIDER-BASED COMPLIANCE MYTHS
Below are 10 myths about provider-based compliance that arise frequently in evaluations of such compliance for both new and established hospital outpatient locations. In light of increasing government focus on provider-based locations, hospitals and health systems should review these myths, along with the corresponding truths, to identify and proactively correct noncompliance before any implementation of requirements to submit PBAs and prove compliance with all provider-based requirements to the satisfaction of the government.
Myth #1: Compliance with the provider-based rules “doesn’t matter” because the government does not enforce them, and Medicare routinely pays claims for services at locations that do not meet the provider-based rules.
Truth: Compliance with the provider-based rules is a condition of receiving payment from Medicare. While it is true that public enforcement of the provider-based rules has been limited, that does not diminish the obligation to comply with the provider-based rules. When a hospital submits a claim for services at a provider-based location, and when it files its Medicare cost report, it attests to compliance with the provider-based rules. Submission of a claim for services at hospital location that is known to not comply with the provider-based rules is a false claim, subject to civil and criminal penalties, including per-claim penalties of more than $25,000 and prison sentences. Receiving payment for hospital services that do not meet the provider-based rules is also an overpayment. Such overpayments may require a full refund of claims billed from the location or a refund that constitutes the difference between the hospital payment and the payment that would have been received had the service been furnished at a non-hospital location.
Lack of historical enforcement does not change these difficult truths. Hospitals and health systems that have not carefully tracked ongoing compliance with the provider-based rule are well advised to make this part of their compliance workplans in 2025 to understand their compliance risks in this area. If PBAs become a requirement for all off-campus locations, as expected, hospitals will be required to attest to compliance up front and to maintain compliance over time, which carries additional monitoring and oversight challenges.
Myth #2: Compliance with the provider-based rules is easy and can be accomplished in a matter of days or weeks.
Truth: For strategic reasons, hospitals often acquire, create, or convert locations to provide off-campus hospital services. In some instances, there may be significant pressure to establish a location as a hospital off-campus department and, in turn, to come into compliance with the provider-based rules. However, because of certain requirements under the provider-based rules, it typically takes months, if not a year or more, to establish provider-based compliance for a new hospital location. For example, compliance with signage and public awareness rules requires permanent signage, which must be designed, ordered, and installed. Ensuring that the medical records for a provider-based location are integrated with the hospital’s electronic health records (EHRs) may require reconfiguring EHRs and other software systems to incorporate the new location. Compliance with employment and clinical and administrative oversight requirements may require renegotiation of employment contracts and compensation, particularly when unions are involved. Finally, provider-based locations often must be licensed as part of the hospital, which can take many months in some states. These are just a few examples. Establishing compliance with the provider-based rules entails many time-consuming tasks that cannot be expedited no matter how strong the perceived need.
In almost all cases, there will be operational matters related to compliance with the provider-based rules that require input from compliance and legal counsel, even when relying on competent consultant support in the development of the provider-based location.
Myth #3: Hospitals can temporarily create a provider-based location or operate a “part-time” provider-based location.
Truth: Provider-based locations are required to be operationally, administratively, and financially integrated with the hospital. Because of the close integration with the hospital required for provider-based compliance, it is not possible to “temporarily” convert a location to provider-based status. As noted, many of the requirements for provider-based compliance are time consuming to implement appropriately. Hospital conditions of participation also typically do not accommodate arrangements that allow a provider-based location to be operated as a hospital location on some days and as a different provider type on others. Where such arrangements may currently exist, it is unlikely that they satisfy the provider-based requirements, and they may also fail to meet the requirements to bill for services as another provider type – resulting in such a location being unable to compliantly bill Medicare at all. If a plan to “temporarily” convert or “time share” a provider-based location as a quick fix to achieve a specific operational goal sounds too good to be true, it probably is.
Myth #4: A provider-based hospital outpatient location on the main hospital campus can operate as a joint venture.
Truth: The reference to on-campus joint venture provider-based locations in the provider-based rules requires compliance with all other provider-based rules and, for hospital outpatient departments, a joint venture location cannot practically meet all other provider-based rules. Licensure, financial integration, clinical integration, operational integration, and compliance with the hospital’s Medicare provider agreement, among other applicable requirements, present significant barriers to on-campus hospital outpatient department joint ventures. A joint venture outpatient department also cannot be enrolled in Medicare as part of a hospital, cannot be certified by Medicare as part of a hospital, and cannot comply with Medicare cost reporting rules. Other transaction structures, such as co-management arrangements, may provide alternatives to achieve some of the business and clinical goals otherwise driving a proposed “provider-based joint venture.”
Myth #5: Provider-based locations can operate under separate leadership from the main campus.
Truth: Off-campus provider-based locations must be under the “direct supervision” of the main provider hospital, and the monitoring and oversight of the provider-based location must be the same as the monitoring and oversight of on-campus locations. This means that an off-campus provider-based location must act like a department of the hospital that is located on campus, including reporting up through the hospital’s organizational structure. This requirement extends to clinical as well as administrative reporting. For example, nurses providing services at an off-campus provider-based location are part of the hospital nursing staff and as such must report up through the hospital’s nursing staff structure and not through a different structure that ultimately ends at an administrator rather than the hospital’s chief nursing officer. For physicians, because the provider-based location is part of the hospital, roles such as chief medical officer, director, or other leadership titles must align with those of the hospital and reflect that they are part of the hospital’s structure, not a different medical staff or clinical enterprise.
Compliance with this requirement becomes more difficult to demonstrate when the distance between the provider-based location and the main campus is great. While the provider-based rules generally require that provider-based locations be within 35 miles of the main campus, there are several exceptions. None of the exceptions, however, change the nature of the main provider’s required oversight of the provider-based location.
“Remote locations” (additional inpatient campuses) are provider-based locations and are subject to the provider-based rules in the same manner as outpatient locations. Remote locations must be and operate under the control of the main provider. They must comply with the requirement that the remote location have the same monitoring and oversight by the main provider as any on-campus location. The remote location and the main provider hospital are, for CMS purposes, a single hospital, meaning that there is one chief executive officer, one chief nursing officer, a single medical staff, single nursing staff, single clinical departments, single medical record, etc., and administrative and clinical reporting structures must reflect this reality. This can be particularly challenging to explain to hospital leaders, or those who seek to be hospital leaders, as they may conflate separate campuses with separate hospitals and seek to create redundant structures that risk noncompliance with the provider-based rules.
Myth #6: There is flexibility in the language used for notification to Medicare beneficiaries of the provider-based status of off-campus outpatient departments.
Truth: Off-campus outpatient locations must provide Medicare beneficiaries with a notice to inform them that they are receiving services at a hospital location. The notice must include the specific content and language used in the provider-based rule.
Failure to provide such notice, or failure to include in the notice language acceptable to CMS, could result in false claims and overpayments due to noncompliance with the provider-based rule.
Myth #7: Provider-based location signage only requires the name of the health system.
Truth: With limited exceptions, provider-based locations are required to be held out to the public as part of the specific hospital to which the department is provider-based. With increased movement toward health system (as opposed to hospital) branding, this requirement is frequently overlooked. Signage and other public-facing written materials of the provider-based location must make it clear to patients that they are receiving services from the specific hospital of which the provider-based location is a part. Use of a system name is not sufficient to “hold out” the location as part of a specific enrolled hospital. Counsel should carefully review any naming conventions for provider-based locations that vary from simple use of the hospital’s name before they are rolled out.
Myth #8: If a location complies with the plain text of the provider-based rules, it can bill Medicare as a hospital.
Truth: The provider-based rules are not the only rules that apply when determining if Medicare may consider a particular location to be part of a hospital. All applicable state laws, Medicare enrollment rules, Medicare certification rules, and Medicare cost reporting rules, among other federal and state laws, must be met before a location may bill Medicare as part of a hospital. For example, if a location has met all provider-based rules, but the location has not been added to the hospital’s Medicare enrollment record, the location cannot bill Medicare as a hospital location.
Myth #9: It is only necessary to comply with the provider-based rules at the time a location first starts billing Medicare as a hospital.
Truth: Continued compliance with the provider-based rules cannot be guaranteed just because the rules were met when a location opened or when a periodic compliance review was conducted. Even submission and approval of a PBA does not establish a location as provider-based in perpetuity. Provider-based compliance must be incorporated into the hospital’s ongoing compliance program and compliance monitoring protocols. All staff of provider-based locations should be regularly trained on the requirements for provider-based status and how to identify potential risk areas or noncompliance. “Slippage” in compliance with the provider-based rules happens frequently if compliance is not effectively monitored. If at any point a location no longer meets all appliable provisions of the provider-based rules, it cannot be considered part of the hospital, and any payments made to the hospital or at hospital rates could be considered overpayments subject to quantification and return to the government. For locations with approved PBAs, any material changes from the facts submitted with the attestation could result in loss of provider-based status. CMS requires locations to report any material changes to the information in the PBA, which is difficult to accomplish if provider-based locations are not carefully and regularly monitored.
Myth #10: The provider-based attestation is a short document that is easy to prepare and have approved.
Truth: A quick internet search for provider-based attestation templates produces examples of forms that are a few pages long. This should not lull hospitals into thinking that completion of the template form is all that a PBA requires. Such examples are grossly misleading because they typically include only the cover page of a PBA and give the impression that a PBA is a rote box-checking exercise. It is not. The typical PBA, once fully compiled and completed, is generally about 500 pages and includes voluminous documentation to support the statements attested to by the hospital on the cover page. Preparing a PBA requires coordination and cooperation across many hospital departments, and determining the proper supporting documentation and locating it can often take weeks, if not months. Policy and procedure updates, organizational and reporting chart updates, and other document revisions necessary to prepare attachments to the PBA can add to the preparation time. Further, because of the highly technical nature of many of the provider-based rules and the significant consequences for noncompliance, it is prudent to have legal counsel actively involved in the attestation preparation process and for them to meaningfully review and comment on the final PBA before it is submitted.
Moreover, submission of a PBA is not the end of the process, and the final approval likely will not come quickly. Both the Medicare Administrative Contractors (MACs) and CMS routinely respond to PBAs with follow-up questions, often requiring hospitals to locate and produce additional documentation. Approval of a PBA typically takes more than six months and can involve multiple rounds of follow-up questions. At times, the MAC or CMS may require material changes to information submitted with the attestation, which can in turn require material modifications to the operations of the location at issue before it can compliantly bill for services as hospital services.
CONCLUSION
Congress appears to be intent on requiring PBAs for all off-campus provider-based hospital locations and will likely continue to push for this requirement until it is implemented. Hospitals and health systems should evaluate their provider-based compliance now, in anticipation of this change, or risk losing the ability to bill Medicare for off-campus hospital locations as part of the hospital. A starting point is to evaluate the operations of existing provider-based locations to ensure that they are consistent with the “truths” of provider-based status and not the “myths.”
We will also be hosting a webinar on provider-based myths and truths on March 17, 2025, from 12:30 – 1:30 pm ET. Please click here to register.
