CMS and HHS Signal Course Correction in New Stark, AKS, and CMP Final Rules and Give the Green Light for Value-Based Care

By Mills Fleming, HunterMaclean

With a nod to the broad reach and increasing complexity of the federal health care fraud and abuse laws, while also acknowledging their detrimental impact on advancing quality care initiatives, both the Centers for Medicare and Medicaid Services (CMS) and the Department of Health and Human Services (HHS) took the unprecedented step last December of issuing corresponding final rules as part of their Regulatory Sprint to Coordinated Care initiative, aka the Sprint Project.

As explained in the HHS’s press release, these historic and sweeping new rules, published on December 2, 2020, aim to “reduce regulatory barriers to care coordination” and “accelerate the transformation of the health care system into one that pays for value and promotes the delivery of coordinated care.”

The new rules are also designed to facilitate the market’s rapid move away from fee-for-service to value-based care models with the hope that these changes will “stand the test of time.” As then-HHS Deputy Secretary Eric Hargan commented, “Too often, ‘sorry, Stark’ or ‘can’t do it, AKS’ have been watchwords in American healthcare…we’re finally breaking down barriers to patient-centered, value-based healthcare innovation.”

How We Got Here

The federal laws in question are the anti-kickback statute (AKS), the physician self-referral law known as Stark, and the civil monetary penalty (CMP) law provision prohibiting inducements to beneficiaries. They have been in effect for decades and suffered their fair share of piece-meal applications and judicial interpretations. They have also become the government’s weapon of choice to punish violations—even if, as reinforced in United States v. Shah, No. 19-12319 (11th Cir. 2020), “one purpose” out of a multitude of many legitimate objectives is construed to induce the volume or value of impermissible referrals (under the AKS) or any arrangement that does not fall within an applicable Stark exception.

Those who have practiced in this area are all too familiar with the peril associated with these violations. Federal courts acknowledge this disparity as well, calling the Stark law in particular a “booby trap” and a “death sentence” for the wary and unwary alike.

Adding to this peril is the ever-widening chasm between regulatory guidance and judicial application, which has vexed the most well-intentioned attorneys and led one federal appellate judge to comment, “It is easy to see how even diligent counsel could wind up giving clients incorrect advice.”

And, finally, health care providers have had to navigate the treacherous impasse created by a dual regulatory environment where an arrangement could violate one law while meeting the requirements for protection under the other.

Enter the Sprint Project

In 2018, HHS formally launched the Sprint Project to accelerate a transformation of the health care system, with a focus on removing “unnecessary government obstacles” to coordinated care and to “address any undue regulatory impact and burden” caused by Stark and the AKS. Soon after the launch, both HHS and CMS published Requests for Information (RFI) to solicit public input. Subsequently, HHS’s Office of Civil Rights issued a similar RFI with respect to the Health Insurance Portability and Accountability Act (HIPAA) rules.

HHS and CMS collectively received over 700 responses to the RFI, and on October 9, 2019, they published their proposed respective changes to the AKS/CMP and Stark. The final rules were published just over a year later on December 2, 2020.

Overview

Overall, the AKS final rule adds new safe harbors for the following:

• Remuneration exchanged between participants in value-based arrangements where the parties assume full financial risk, substantial downside financial risk, and no or lower risk
• Patient engagement tools and supports furnished by a value-based enterprise to a patient in a target patient population
• CMS-sponsored model arrangements and CMS-sponsored model patient incentives that would require OIG fraud and abuse waivers Remuneration in the form of cybersecurity technology and services

It also modifies the existing safe harbors for electronic health records, personal services and management contracts and outcomes-based payments, warranties, and local transportation.

Likewise, the Stark final rule establishes new exceptions for the following:

• Certain value-based arrangements between physicians, providers, and suppliers
• Certain arrangements under which a physician receives limited remuneration for items or services actually provided by the physician
• Donations of cybersecurity technology and related services

It also amends the existing exception for electronic health records items and services.

Perhaps more significant for health care practitioners, the Stark final rule eases compliance with certain signature requirements (e.g., missing and/or electronic signatures) and compensation modifications (including the “set in advance” requirement). It also revises key definitions and guidance for fair market value, commercial reasonableness, and the volume or value/other business generated standard; indirect compensation arrangements; “group practice” requirements (particularly as they relate to profit shares and productivity bonuses); physician recruitment signature requirements; and electronic health record donations.

With a few minor exceptions, the new rules went into effect on January 19, 2021.

Value-Based Care Is the New Cornerstone

Both HHS and CMS devote roughly 50% of their respective final rules to “value-based” care (e.g., pay-for-performance arrangements or certain risk-sharing arrangements). Therefore, appreciating how the government approaches this new model and authorizes previously problematic care coordination and incentives is critical to having clients avoid becoming test cases for noncompliance.

Compliance with value-based care begins with understanding a new lexicon of words and phrases, adhering to their definitions, and appreciating their interrelationships.

As a starting point, the rules provide key definitions for: (i) value-based activity, (ii) value-based arrangement, (iii) value-based enterprise (VBE), (iv) value-based purpose, (v) VBE participant, (vi) target patient population, and (vii) coordinating and managing care (defined for purposes of the AKS only since CMS opted not to do so). This terminology is interconnected and designed to work in concert with the totality of the value-based care ecosystem. More importantly, compliance with an applicable AKS safe harbor or a Stark exception will turn on whether the value-based arrangement meets the relevant definition(s).

Fortunately, HHS and CMS use substantially similar definitions for these terms with slight differences emerging in how each may be applied given that the AKS is an intent-based criminal law and, therefore, may be more restrictive (to allow for “backstop” protection) compared to Stark, which is a civil/strict liability statute.

Specifically, the AKS and Stark use the same value-based terminology to describe VBEs, value-based arrangements, and value-based purposes. Note, however, that there is a minor variance with respect to the definition of value-based activities where slightly different language was required to integrate the new rules into the existing regulatory structures (e.g., the AKS final rule excludes a referral from being a value-based activity but Stark does not because of CMS’s desire to allow for care planning as part of the definition of a “referral”). As a practical matter, this means that the same VBE, value-based arrangement, or value-based purpose can seek protection under both regulatory schemes, provided the relevant conditions of a safe harbor and an exception are satisfied.

The same can also be said for a “target patient population,” which is defined by both the AKS and Stark as an identified patient population selected by a VBE or its VBE participants based on legitimate and verifiable criteria that: (i) are set out in writing in advance of the commencement of the value-based arrangement, and (ii) further the VBE’s value-based purpose(s). The VBE is permitted to use criteria where the target patient population includes patient populations that are retroactively attributed (e.g., the use of a retrospective claims-based methodology).

Because of potential abuse associated with selecting a target patient population consisting of only lucrative or adherent patients (known as “cherry-picking”) and avoiding costly or noncompliant patients (known as “lemon-dropping”), HHS and CMS state that such actions would not be legitimate or permissible even if the selection criteria is verifiable.

For the term “VBE participant,” the AKS and Stark definitions are substantially similar and apply to an entity or person that engages in at least one value-based activity as part of a VBE, other than a patient acting in his or her capacity as a patient. One key is the definition’s application to laboratories as well as pharmaceutical manufacturers, suppliers, and distributors of durable medical equipment, prosthetics, orthotics, or supplies. Although these were originally excluded in the proposed rule from being “participants” in a VBE, HHS and CMS decided not to explicitly ban them from the list and, instead, prohibited them from receiving protection under the applicable value-based safe harbor or exception. However, other safe harbors and exceptions may still be available.

The only explicit break between the AKS and Stark comes with finalizing the definition of “coordinating and managing care,” which the AKS does but Stark does not. Under the AKS, the definition requires the “deliberate organization” of patient care activities and sharing of information between the VBE and its participants and/or patients that is designed to achieve safe, effective, and efficient care to improve outcomes of the target patient population. The AKS final rule then provides a broad list of how and between whom the coordination might occur.

CMS, on the other hand, takes a different approach. While acknowledging that patient care coordination and management are the foundation of a value-based health care delivery system, CMS reasoned, “Most arrangements that qualify as value-based arrangements, by their nature, have care coordination and management at their heart, eliminating the need for an explicit requirement.”

Value-Based Safe Harbors and Exceptions

Subject to the definitions and conditions set forth in HHS’s and CMS’s respective final rules, both agencies carefully crafted safe harbors and exceptions to advance the goal of value-based care innovation.

For the AKS, HHS creates three new safe harbors:

• Care Coordination Arrangements to Improve Quality, Health Outcomes, and Efficiency (no financial risk)
• Value-Based Arrangements With Substantial Downside Financial Risk
• Value-Based Arrangements With Full Financial Risk

To the extent a transaction causes a VBE participant to become an “ineligible entity,” safe harbor protection is not available.

In addition, to qualify for safe harbor protection, HHS requires that: the material aspects of the value-based arrangement be in writing (which can be satisfied by a “collection of documents”) and signed by the parties; the arrangement not reduce or limit medically necessary services for the patient; the arrangement not take into account the volume or value of referrals of patients who are outside of the target patient population; the arrangement not allow the exchange or use of remuneration for the purpose of marketing items or services furnished by the VBE or VBE participants to patients or for the purpose of patient recruitment activities; and, for a period of at least six years, the VBE or its VBE participants must maintain materials and records sufficient to establish compliance with the conditions of the safe harbor.

For Stark, CMS adds three new exceptions that are similar to the AKS safe harbors above:

• A payor’s full financial risk for patient care services for a target patient population
• A value-based arrangement where the physician is at meaningful downside financial risk
• Any value-based arrangement, provided the arrangement satisfies specified requirements

CMS also allowed these exceptions to be applicable to indirect compensation arrangements, which include value-based arrangements in an unbroken chain of financial relationships (and which may not be able to satisfy the requirements of 42 CFR § 411.357(p)).

Notably, none of these Stark exceptions include the “traditional” requirements that the compensation is set in advance, fair market value, and not determined in a manner that takes into account the volume or value of a physician’s referrals. In addition, VBEs can require physician participants to direct their target patient population referrals to particular providers unless it is not in the patient’s best interests, the patient expresses a preference for another provider, or the patient’s payor requires a different provider.

Summary

For years, health care providers have decried the government’s severe enforcement actions for alleged violations of the complicated fraud and abuse laws. The other unspoken reality is that health care fraud and abuse judgments, settlements, and other administrative actions have become a lucrative line item for the government and translate into billions of dollars each year for each agency’s recoupment efforts. However, the new final rules are a step in the right direction, particularly given HHS’s and CMS’s explicit attempt to implement detailed guidance for value-based care. What remains to be seen is how aggressive the government will be in either furnishing additional clarity as this area of the law develops or using technical and unintended violations to ambush providers with more fines and penalties.

T. Mills Fleming is a partner with HunterMaclean. His practice areas include health care, immigration, and corporate law. He can be reached at or 912-236-0261 or [email protected].