Medicare Provider and Supplier Enrollment Requirements: Program Integrity Changes for 2024

BACKGROUND

To receive Medicare reimbursement for providing services to Medicare beneficiaries, healthcare providers and suppliers are required to enroll in the Medicare program. Medicare providers and suppliers are required to continuously satisfy enrollment regulations applicable to the specific Medicare provider or supplier type, including making any necessary updates to the provider’s or supplier’s enrollment file in order to receive Medicare reimbursement.

These regulations are intended to promote program integrity and ensure that Medicare providers and suppliers are operating in accordance with program requirements. CMS and Medicare Administrative Contractors (MACs) are permitted to take proactive action against providers and suppliers engaging (or potentially engaging) in fraudulent or abusive behavior who present a risk of harm to Medicare beneficiaries or that are otherwise unqualified to furnish Medicare services or items. Consistent with these continuing policy goals, CMS finalized changes to the Medicare enrollment regulations for a variety of provider and supplier types in the CY 2024 Medicare Physician Fee Schedule Final Rule (MPFS Rule) and the CY 2024 Home Health Prospective Payment System Final Rule (Home Health Rule).

KEY MEDICARE ENROLLMENT CHANGES

CMS Expands Its Authority to Revoke or Deny Enrollment in the Medicare Program

CMS has the authority to revoke a Medicare provider’s or supplier’s enrollment for a variety of reasons, including the provider’s or supplier’s failure to adhere to Medicare enrollment requirements, exclusion by the Office of Inspector General (OIG), and felony convictions, among other bases. When a provider or supplier is revoked, the provider or supplier is generally barred from reenrolling in Medicare for a period of one to 10 years, based on the severity of the basis for revocation. Similarly, CMS may deny a newly enrolling provider’s or supplier’s enrollment for any of the listed reasons. Below is a summary of CMS’s expansion of its revocation and denial authority.

• The existing regulation, 42 C.F.R. § 424.535(a)(1), permits revocation if the provider or supplier is determined to be out of compliance with applicable enrollment requirements or in the enrollment application for the provider or supplier type. The MPFS Rule changes this to noncompliance with the enrollment requirements described in “title 42, or the enrollment application” to account for enrollment requirements located outside of 42 C.F.R. part 424, subpart P.

• False Claims Act judgments. The MPFS Rule adds civil judgment under the False Claims Act (FCA) against any provider or supplier, owner, managing employee or organization, officer, or director within the previous 10 years as a basis for enrollment denial or revocation. The term “civil judgment” does not include FCA settlement agreements.

• Violation of provider and supplier standards. The MPFS Rule provides CMS with broad authority to deny or revoke an independent diagnostic testing facility’s (IDTF), durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) supplier’s, opioid treatment program’s (OTP), home infusion therapy (HIT) supplier’s, or Medicare diabetes prevention program’s (MDPP) enrollment for a violation of any standard or condition listed in the respective IDTF, DMEPOS supplier, OTP, HIT supplier, and MDPP enrollment standards and conditions.

• Existing debt. Currently, CMS may revoke enrollment if the provider or supplier has an existing debt that CMS appropriately refers to the US Department of the Treasury. The MPFS Rule replaces the term “existing debt” with “failure to repay a debt.” This change allows CMS to use its revocation authority even if collection action has ceased and the debt was ultimately terminated as a result, reflecting focus on the provider’s or supplier’s inaction in fulfilling its financial obligations to Medicare rather than the particular status or result of CMS’ collection efforts. CMS will exclude certain situations from the purview of this revocation basis.

Revocation Effective Date

Currently, a Medicare enrollment revocation becomes effective 30 days after CMS or the MAC mails notice of its determination to the provider or supplier, except when the revocation is based on a federal exclusion or debarment, felony conviction, license suspension or revocation, or non-operational practice location. With each of these circumstances, the revocation is effective on the date of exclusion or debarment, felony conviction, license suspension or revocation, or the date that CMS or the MAC determined that the provider or supplier was non-operational.

In addition to these circumstances, CMS has modified the applicable regulations to specify the following circumstances where a retroactive effective date is warranted:

• Revocations based on a state license surrender in lieu of further disciplinary action, to be effective the date of the license surrender
• Revocations based on termination from a federal healthcare program other than Medicare (for example, Medicaid), to be effective the date of the termination
• Revocations based on termination of a Medicare provider agreement, to be effective (depending on the provider type) on the later of the following: (1) the date of the provider agreement termination or (2) as applicable, the date that CMS establishes under 42 C.F.R. § 489.55
• Revocations of an IDTF, DMEPOS supplier, OTP, HIT supplier or MDPP’s enrollment for a violation of any standard or condition listed in the respective IDTF, DMEPOS supplier, OTP, HIT supplier and MDPP enrollment standards and conditions, to be effective as follows:
  • If the standard or condition violation involved the suspension, revocation or termination (or surrender in lieu of further disciplinary action) of the provider’s or supplier’s federal or state license, certification, accreditation or MDPP recognition, the revocation effective date would be the date of the license, certification, accreditation or MDPP recognition suspension, revocation, termination or surrender.
  • If the standard or condition violation involved a non-operational practice location (for example, an IDTF’s failure to maintain a physical facility on an appropriate site), the revocation effective date would be the date the non-operational status began.
  • If the standard violation involved a felony conviction of an individual or entity, the revocation effective date would be the date of the felony conviction.

Timeframes for Reversing a Revocation

Currently, if a revocation is due to adverse activity (i.e., sanction, exclusion or felony) by certain parties, such as an owner, managing employee, authorized or delegated official, or supervising physician, the revocation can be reversed if the provider or supplier terminates (and submits proof that it has terminated) its business relationship with that party within 30 days of the revocation notification. The MPFS Rule reduces this timeframe to 15 days.

Reporting Changes in Practice Location

Under current Medicare regulations, certain suppliers and providers (including DMEPOS suppliers, IDTFs, and physicians, nonphysician practitioners, and physician and nonphysician practitioner organizations) must report any changes of practice location as an enrollment update within 30 days of the change. All other provider types are required to report changes of location within 90 days. The MPFS Rule revises this requirement to require all Medicare provider and supplier types to report changes of location within 30 days of the effective date of the change. CMS also clarified that a “change of practice location” includes additions of a new location and deletion of an existing location.

Creation of a New Provider Enrollment Status: “Stay of Enrollment”

Current regulations allow CMS to deactivate a provider’s or supplier’s Medicare billing privileges pursuant to specified reasons, which is often used instead of a revocation when CMS believes a more modest sanction is warranted. However, deactivations still impose potential burdens on providers and suppliers, including a prohibition on receiving payment for services and items while deactivated. Out of concern that deactivation of billing, while less severe than revocation, may be too punitive in certain cases, the MPFS Rule adopts a new enrollment status referred to as a “stay of enrollment.” This is a preliminary, interim status—prior to any subsequent deactivation or revocation—in which the provider or supplier remains enrolled in Medicare. CMS’s authority to impose a stay is discretionary, and the agency could elect to proceed directly to deactivation or revocation, if desired. The stay period will have a definitive timeframe of no more than 60 days from the postmark date of the notification letter. The stay’s end date will be the date on which CMS or the MAC determines that the provider or supplier has resumed compliance with all Medicare enrollment requirements or the day after the 60-day stay period expires, whichever occurs first. In response to comments, CMS declined to provide guidance regarding the types of conduct that would result in a (1) deactivation, (2) a stay of enrollment or (3) no CMS action. However, CMS indicated that the stay provision is not primarily intended to penalize providers for matters that previously would not have involved CMS action; rather, it is intended to reduce the severity of CMS action for minor cases of noncompliance that would ordinarily have triggered a deactivation.

The MPFS Rule adopts two prerequisites to implementing a stay of enrollment. First, there must be actual noncompliance with at least one enrollment requirement. Second, CMS must ascertain that the provider or supplier can remedy the noncompliance via the submission of an appropriate Medicare enrollment application, change of information or revalidation application (depending on the circumstances).

CMS will provide the provider or supplier with written notice regarding the stay of enrollment. During the stay period, claims submitted by the provider or supplier services or items furnished during the period will be rejected. However, these claims are eligible for payment (and may be resubmitted by the provider or supplier within applicable timeframes) if (1) CMS or the MAC determines that the provider or supplier has resumed compliance with all Medicare enrollment requirements and (2) the stay ends on or before the 60^th day of the stay period.

CMS states the stay of enrollment is also different from deactivation, in that MACs can process change requests more rapidly than reactivation applications, allowing payments to resume sooner. In addition, the completion of a change request is less burdensome than the completion of a reactivation application. The MPFS Rule also adopts a rebuttal process, which will largely align with the existing rebuttal processes for deactivations and payment suspensions.

Definitions

The MPFS Rule adopts new and clarified definitions to help explain the meaning of certain provider enrollment concepts. These includes clarified definitions of “indirect ownership” and “authorized official.”

Retroactive Provider Agreement Terminations

A provider that holds a provider agreement in addition to its Medicare enrollment may voluntarily terminate its provider agreement and stop participating in the Medicare program. Under existing sub-regulatory guidance, a provider may request a retroactive termination effective date (for example, retroactive to the date the provider’s facility closed). To implement and incorporate this practice into regulation, CMS adopted a provision stating that providers may request a retroactive termination date, but only if no Medicare beneficiary received services from the facility on or after the requested termination date.

Deactivation for Non-Billing

Current regulations allow CMS to deactivate a provider’s or suppliers’ billing privileges when the provider or suppler has not submitted any Medicare claims for 12 consecutive months. In the Home Health Rule, CMS finalized a reduction in this time period to six months, permitting CMS to deactivate a provider’s or supplier’s billing privileges more quickly. This change was driven by CMS’ concerns regarding fraud schemes that involved providers utilizing multiple enrollments to inappropriately avoid overpayment obligations or to circumvent investigations, as well as situations where an inactive provider number is used by a third party to fraudulently bill Medicare for services. CMS recognized that certain lengthy periods of non-billing may not necessarily involve any improper provider activity; for example, some providers must be enrolled in Medicare to enroll in Medicaid; in these circumstances, the provider may not intend to bill Medicare, resulting in an extended period of Medicare non-billing. CMS finalized this change and now has discretionary authority to deactivate a provider for six months of non-billing. CMS noted that providers and suppliers that have not been deactivated for 12 months of non-billing should not assume they are more likely to be deactivated based on this change.

Fingerprint-Based Criminal Background Checks for High-Risk Provider and Supplier Types

During the COVID-19 public health emergency (PHE), CMS temporarily waived the requirement for fingerprint-based criminal background checks for individuals who own 5% or more of newly enrolling providers and suppliers who are categorized as “high-risk” providers or suppliers. This “high risk” category includes home health agencies (HHAs), DMEPOS suppliers, MDPP suppliers, certain OTPs, and skilled nursing facilities (SNFs). Due to concerns about the lack of background checks conducted during the PHE, CMS implemented a change in the requirements applicable to DMEPOS suppliers, HHAs, OTPs, MDPPs and SNFs through the revalidation process. For these high-risk provider and supplier types that were not required to have a background check when the provider or supplier initially enrolled during the PHE, the provider or supplier will be required to have any owners holding 5% or more of the entity undergo a fingerprint-based criminal background check in order for the provider or supplier to revalidate its Medicare enrollment. To account for future emergencies under which CMS may waive background checks, the regulations provide that revalidating DMEPOS suppliers, HHAs, OTPs, MDPPs, SNFs and hospices that are subject to a waiver of the background check requirements during their initial enrollment due to a national, state or local emergency will be deemed to be a high-risk provider or supplier for purposes of their revalidation. Practically speaking, these provisions are intended to ensure that CMS can require fingerprint-based criminal background checks for providers and suppliers who were subject to the PHE waiver of these requirements, or for providers and suppliers who may be able to enroll during a future waiver of these background check requirements. In addition to revising and clarifying the regulations related to background checks, CMS clarified that it reserves the right to conduct off-cycle revalidations of high-risk providers and suppliers who may have been able to enroll without a fingerprint-based criminal background check during the PHE.

Expansion of Reapplication Bar

Currently, CMS may prohibit a prospective provider or supplier from enrolling in Medicare for up to three years if the enrollment application is denied because the provider or supplier submitted false or misleading information on or with (or omitted information from) the enrollment application. CMS now has authority to extend the maximum length of the reapplication bar to 10 years to account for provider or supplier conduct of particular severity.

Ordering, Referring, Certifying and Prescribing Restrictions

Continuing with the theme of adding restrictions to prevent providers and suppliers who may have engaged in dishonest or felonious activity from reenrolling or otherwise being able to bill Medicare, CMS has established new regulations intended to prevent certain providers and suppliers from being able to order, refer, certify or prescribe Medicare-covered services, items or drugs. Specifically, a provider or supplier that is currently subject to a reapplication bar is not permitted to order, refer, certify or prescribe Medicare-covered services, items or drugs. To enforce this provision, the rule further adopts a provision stating that Medicare does not pay for any otherwise covered service, item or drug that is ordered, referred, certified or prescribed by a provider or supplier that is currently under a reapplication bar. Additionally, a physician or other eligible professional (regardless of whether they are or were enrolled in Medicare) who has had a felony conviction within the previous 10 years may not order, refer, certify or prescribe Medicare-covered services, items or drugs. With respect to a provider or supplier with a felony conviction, CMS has authority to enforce this prohibition for any felony that CMS determines is detrimental to the best interests of the Medicare program and its beneficiaries. CMS declined to adopt a consistent, defined list of felony convictions that it deems detrimental to Medicare and stated that the agency retains the flexibility to consider each felony case on its own facts and circumstances.

New Mental Health Professional Supplier Types Established

In the Consolidated Appropriations Act of 2023 (CAA), the US Congress established a new Medicare Part B benefit category for services provided by MFTs and MHCs. Consistent with the CAA, the MPFS Rule implements regulations that allow MFTs and MHCs to bill for the diagnosis and treatment of patients with mental illnesses and establishes requirements for these new professional types.

CMS finalized a regulatory definition for a “marriage and family therapist” as an individual who: (1) possesses a master’s or doctoral degree that qualifies them for licensure or certification as a MFT pursuant to state laws of the state in which they provide services; (2) has performed at least two years or 3,000 hours of post-master’s degree clinical supervised experience in marriage and family therapy in an appropriate setting, such as a hospital, SNF, private practice, or clinic; and (3) is licensed and certified as an MFT by the state in which they provide services.

Similarly, “mental health counselor” is defined as an individual who: (1) possesses a master’s or doctoral degree that qualifies for licensure or certification as an MHC, clinical professional counselor, or professional counselor pursuant to state laws of the state in which they provide services; (2) has performed at least two years or 3,000 hours of post-master’s degree clinical supervised experience in mental health counseling in an appropriate setting, such as a hospital, SNF, private practice, or clinic; and (3) is licensed and certified as an MHC, clinical professional counselor, or professional counselor by the state in which they provide services. In commentary, CMS recognized that states use various terms to describe mental health clinicians, and clarified that individuals who meet all of the applicable statutory and regulatory qualifications for the MHC benefit category for education and clinical supervised experience but are licensed or certified by their state under a different title to provide mental health counseling are eligible to enroll in Medicare under the “mental health counselor” category. This includes addiction and drug counselors.

MFTs and MHCs are now able to enroll in Medicare via Form CMS-855I. CMS clarified in guidance that MFTs and MHCs cannot begin billing for services until January 1, 2024, and will not be granted an earlier effective date. MFT and MHC supplier types, like most nonphysician practitioner types, will be subject to limited risk screening.

CONCLUSION

In the most recent regulatory rulemaking cycle, CMS has continued the trend of strengthening its authority to revoke and limit billing privileges for Medicare providers and suppliers who may not be in compliance with Medicare enrollment and participation requirements. Specifically, these new enrollment requirements affect new and existing Medicare providers and suppliers and create new and ongoing compliance obligations.

Given the broad authority CMS and MACs have to enforce Medicare enrollment requirements, the potentially harsh consequences for failure to comply with Medicare requirements, and the lengthy and costly appeal process, providers and suppliers should pay careful attention to their Medicare enrollment records and ensure policies and procedures are in place to appropriately report any changes in information that may be required. CMS has indicated that sub-regulatory guidance will be released for stakeholders that will explain these new provider enrollment requirements and the provider and supplier actions required for compliance.