CMS Final Rule on Disclosure of Affiliations is Now in Effect—What to Expect Next

On September 10, 2019, the Centers for Medicare & Medicaid Services (CMS) published in the Federal Register a final rule with comment period which, among other things, requires providers and suppliers to disclose certain current and previous affiliations with other providers and suppliers.  These new regulations, which became effective on November 4, 2019, are intended to weed out unqualified and fraudulent entities and individuals and deter improper behavior.  

Under the new regulations, Medicare, Medicaid and CHIP providers and suppliers must report certain “affiliations” with other providers or suppliers that have a “disclosable event,” as those terms are defined under the new regulations.  “Affiliation” is broadly defined under the new regulations, and includes, for example, a 5% or greater direct or indirect ownership interest that an individual or entity has in another organization, and an interest in which an individual is acting as an officer or director of a corporation. Examples of a “disclosable event” include an uncollected debt to Medicare, Medicaid, or CHIP, or exclusion by the OIG from participation in Medicare, Medicaid, or CHIP.  

In response to concerns that this requirement will be quite burdensome for providers and suppliers, CMS has adopted a phased-in approached for implementing this disclosure requirement.  This phased-in approach means that it may be many years before most Medicare providers and suppliers are required to report any affiliations.  This is because the first step in this phased-in approach will be for CMS to update its 855 forms to accommodate these affiliation disclosures.  And both the paper 855 forms and the online applications will be subject to notice and comment.  

Once CMS updates its 855 forms to accommodate affiliation disclosures, CMS will then conduct research and identify certain providers and suppliers that may have at least one “affiliation” that includes a “disclosable event” (again, as defined under the new regulations).  CMS will then request that those providers and suppliers report all affiliations that include a disclosable event (not just the one identified by CMS).  In commentary accompanying the final rule, CMS estimates that only about 2,500 to 4,000 providers and suppliers will be affected per year, meaning that over 99% of Medicare providers and suppliers will not be subject to this initial request by CMS to report affiliations.   In the final rule, CMS sought public comments on how to implement this affiliation disclosure requirement more widely to a projected 1.7 million providers and suppliers. 

The new regulations set forth a different phased in approach for Medicaid and CHIP providers that are not enrolled in Medicare.  The first step in this approach is for each state, in consultation with CMS, to choose one of two options for implementing the affiliation disclosure requirement.  

The final rule is very broad and other aspects of it may impact providers and suppliers immediately.  But for now, with respect to the affiliation disclosure requirement, providers and suppliers should keep an eye out for updated 855 forms from CMS.