Finalized Changes to Stark & Anti-Kickback Statute Laws

In November 2020, the Centers for Medicare & Medicaid Services (CMS) and the Office of Inspector General (OIG) of the Department of Health and Human Services (HHS) issued two final rules to modernize and clarify the Stark Law and the Anti-Kickback Statute (AKS).(1)

As the authors discussed in a previous article,(2) these rule changes are part of HHS’s larger effort to modernize and clarify fraud and abuse laws as part of its Regulatory Sprint to Coordinated Care initiative and CMS’s Patients over Paperwork initiative. These initiatives aim to reduce regulatory barriers and accelerate the transformation of the healthcare system into one that pays for value and promotes care coordination.

Recognizing the rapidly changing healthcare system, CMS and OIG finalized new rules and rule changes that are more consistent with emerging value-based healthcare delivery and payment models, and that may allow for better coordination of care.

In general, CMS and OIG worked closely to craft the changes to the Stark Law and AKS; however, as OIG noted, the AKS is “an intent-based, criminal statute that covers all referrals of federal health care program business,” whereas the Stark Law is a “civil, strict-liability statute that prohibits payment by CMS for a more limited set of services referred by physicians who have certain financial relationships with the entity furnishing the services.”(3) These fundamental differences make complete alignment impossible.

This article discusses some of the most pertinent changes made in the final rules that physicians should be aware of.

Fundamental Changes in Terminology

Many Stark Law exceptions require that one or more of the following requirements be met: (1) the compensation arrangement is commercially reasonable; (2) the compensation methodology is not determined by the volume or value of referrals (or other business generated between the parties); and, (3) the amount of compensation paid is fair market value (FMV).

CMS took the opportunity in its rulemaking to change the definitions of each of three terms, principally “to establish bright-line, objective regulations for each of these fundamental requirements.”(4)

First, CMS formally defined the term commercial reasonableness for the first time. As noted in the definition in Table 1, CMS emphasized that the focus of any commercial reasonableness analysis should be on the legitimate business purpose of the arrangement and the consideration of the parties’ characteristics.

Second, in regard to the definition of FMV for the purposes of the Stark Law, CMS kept the same language but restructured the definitions so as to: (1) separate and organize based on the type of asset being valued and (2) disentangle the definition from the volume or value standard. (Previously, part of the FMV requirement was that the volume or value of referrals was not considered. CMS stated that such a circular requirement was unnecessary, as most Stark exceptions already require that the volume or value of the physician’s referrals not be considered.)

Third, in response to commenter concerns, CMS finalized certain objective tests for determining whether compensation takes into account the volume or value of referrals or the volume or value of other business generated by the physician, which generally looks at whether payments correlate with the volume or value of referrals or other business generated.(4)

Note that, as with some of the changes discussed below, the definitions discussed above apply only to the Stark Law; they do not apply to AKS. Therefore, in analyzing the legal permissibility of a given arrangement, it is critical to analyze the Stark Law and AKS separately, accounting for any differences in the rules to ensure compliance.

Newly Established Exceptions/Safe Harbors

Application Vignette No.1: A primary care practice and a cardiology practice want to enter into an arrangement to improve healthcare outcomes and lower costs for coronary disease patients. The cardiology practice wants to purchase data analytics related to risk factors for those patients and share it with the primary care practice.(5) The providers are concerned, however, that if the primary care practice does not pay FMV for the data analytics, the government may assume that the practice is paying for referrals.

Application Vignette No.2: A for-profit clinically integrated network (CIN) wishes to pay its independent primary care physicians a percentage of profits received by the CIN from cost savings generated from care coordination; however, the CIN is concerned that because the compensation amount would vary with the volume or value of referrals, the government may assume that the CIN is paying for referrals.

Change: Both CMS and OIG finalized several new permanent Stark exceptions and AKS safe harbors for value-based arrangements (VBAs). In doing so, the agencies introduced several new definitions, including those for value-based activity, VBA, value-based enterprise (VBE), value-based purpose, VBE participant, and target patient population.(6) An illustration of the interplay of these terms is shown in Figure 1.

Figure 1. Illustration of new value-based terms and their interconnectedness

These terms are defined separately by Stark and AKS, but generally they align. While many of the value-based exceptions/safe harbors are also mainly in alignment, some significant differences are seen by comparing the definitions in Table 2 and Table 3.

CMS finalized new Stark Law exceptions for three types of VBAs (see Table 2). Notably, CMS finalized its proposal to not require that remuneration associated with a VBA: (1) be consistent with FMV or (2) take into account the volume or value of a physician’s referrals or the other business generated by the physician for the entity.(4) However, CMS requires that the compensation arrangements under these exceptions be commercially reasonable (although the agency noted that these arrangements are “likely commercially reasonable”).(4)

Additionally, OIG finalized new safe harbors for three types of VBAs (see Table 3). These changes will likely serve to expand the types of legally permissible value-based reimbursement models in which physicians can participate and reduce some of the regulatory burdens that were previously required, such as obtaining an FMV opinion.

Lowered Regulatory Hurdle, New Exception for Limited Remuneration

Application Vignette: A hospital-employed senior intensivist provides day-time care in the intensive care unit, but her contract does not call for night or weekend call coverage. Two or three times a year, due to illness, the hospital employs her to take call, for which she is compensated at an hourly rate. Upon reviewing all provider compensation agreements, new management for the hospital is considering self-reporting the arrangement to OIG because the intensivist was paid for call coverage without having a written agreement in place before the rendering of call coverage.

Change: CMS established a new Stark Law exception (but OIG did not establish an equivalent AKS safe harbor) for limited remuneration to a physician (without documentation) for items or services actually provided by the physician, on an “infrequent or short-term basis.” This exception operates on a calendar year basis and for aggregate amounts not exceeding $5,000 per calendar year (as adjusted for inflation) if:

1. The compensation is not determined in any manner that takes into account the volume or value of referrals or other business generated by the physician;

2. The compensation does not exceed the FMV of the items or services;

3. The arrangement is commercially reasonable; and,

4. Arrangements for the rental or use of office space or equipment do not violate the prohibitions on per-click and percentage-based compensation formulas.(9,4)

Some other arrangements that may benefit from this exception include:

1. A hospital and physician have an arrangement for short-term medical director services after one medical director resigns and the hospital is working to finalize the engagement of the replacement medical director;

2. A hospital sporadically requests a physician to provide supervision services;

3. A hospital and physician have an arrangement for short-term call coverage; and,

4. A hospital occasionally asks a physician to perform certain services (e.g., EKG interpretations).(4)

Safe Harbor for Patient Engagement and Support

Application Vignette: A family practice group is employed by a health system and partially compensated through a VBA. The group has a large preventive care section with a multi-disciplinary team of physicians, nurses, and pharmacists to monitor their patients’ fitness. As part of their service, they would like to provide a Fitbit® to each of their patients but are constrained under current laws.

Providers in a VBA who wanted to give their patients technology such as biometric wireless devices and wearable technology to allow for patient monitoring or iPads to allow the patient to participate in telehealth appointments, previously were unable to do so without potentially running afoul of fraud and abuse laws.

Change: A new safe harbor (but not a similar Stark Law exception) was established by OIG to protect arrangements for patient engagement and support to improve quality, health outcomes, and efficiency. It seeks to engage beneficiaries to obtain needed healthcare services.

Specifically, remuneration by way of tools and supports furnished by VBE participants to those in a target patient population would be protected, provided that, among other things, no more than $500 worth of in-kind (i.e., nonmonetary) remuneration is provided to a given patient in a year.(8) Such tools and supports may include “health-related technology, patient health-related monitoring tools and services, or supports and services designed to identify and address a patient’s social determinants of health.”(8)

This safe harbor is available only to VBE participants. It is not available to pharmaceutical manufacturers, distributors, and wholesalers; pharmacy benefit managers; laboratories; compounding pharmacies; physician-owned medical device and supply manufacturers; medical device distributors and wholesalers; and sellers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS).(7)

Safe Harbor for CMS-Sponsored Models

Application Vignette: The orthopedic surgery specialists in a large multispecialty surgical group practice wish to participate in the Comprehensive Care for Joint Replacement Model; however, the physicians are concerned about the cost and time involved in getting a fraud and abuse waiver from CMS and the enhanced risk of fraud and abuse scrutiny related to orthopedic providers.

Before the final rules, CMS had published fraud and abuse waivers for specific value-based reimbursement models, such as the Medicare Shared Savings Program (MSSP). This piecemeal approach required CMS to establish such waivers specific to certain models each time it introduced an innovative model. Consequently, providers were hesitant to enter into an innovative model before regulatory protection was afforded by HHS.

Change: To combat this issue, OIG established a new safe harbor (but not a similar Stark Law exception) related to remuneration exchanged among CMS-sponsored model participants and to CMS beneficiaries treated under the model (i.e., patient incentives). Such remuneration may include distribution of capitated payments, shared savings or shared losses under the MSSP, or remuneration related to another model/initiative under the Innovation Center.(6) Importantly, CMS must affirmatively determine that this safe harbor applies to a given CMS-sponsored model.(7)

Several criteria must be satisfied for remuneration among participants and remuneration to patients;(8) notably, the arrangement must be memorialized in a signed writing in advance that “must at a minimum [include] the activities to be undertaken by the CMS-sponsored model parties and the nature of the remuneration to be exchanged under the CMS-sponsored model arrangement.”(7)

This new safe harbor clarifies that participating in CMS value-based reimbursement models will not induce fraud and abuse scrutiny and will eliminate the requirement that CMS issue specific fraud and abuse safe harbors for each innovation model going forward.

Easing of Restrictions Related to Cybersecurity Technology

Application Vignette: An independent physician group admits their patients to the hospital and refers them for radiologic and other services not available at their practice site. After their practice was hacked, they made some improvements to their existing cybersecurity; however, they have been told that they need many more improvements, but the cost is prohibitive.

Before the changes, the hospital was restricted from donating cybersecurity technology and/or services because of the financial relationship between the hospital and the physician group.

For years, providers have voiced serious concerns related to the state of cybersecurity in the healthcare industry. Four in five U.S. physicians have experienced some form of cybersecurity attack that has compromised patient privacy.(8)

The threat of cyberattacks, coupled with the rising cost of systems to combat such threats, has resulted in a growing call for protection of donations of cybersecurity technology from fraud and abuse laws. Proponents have argued that those medical practices that do not have the requisite capital or other resources to implement such technology could serve as the entry point for hackers, presenting a risk to the “overall cybersecurity of the health care ecosystem of which the practices are part.”(4)

Change: Recognizing the issues mentioned above, CMS and OIG both finalized the establishment of a new exception/safe harbor for donations of cybersecurity technology and related services that are “necessary to implement, maintain, or reestablish security.”(7,9)

Some examples of protected technology include cybersecurity software and patches and updates to the software; cybersecurity training services; EHR and other information technology; and data recovery services.(8)

For the Stark Law exception and AKS safe harbor to apply, several conditions must be met, including that: (1) the volume or value of referrals not be considered and (2) the receipt of such technology not be a condition of doing business with the donor.(7)

Notably, the agencies included hardware in the category of “cybersecurity technology”; the proposed definitions had omitted hardware, but the final rules removed that omission.(4)

The AKS safe harbor pertains only to nonmonetary donations; the Stark Law exception includes monetary donations. The practical consequences of this new exception and safe harbor is that hospitals may now donate to physicians or physician practices that work with the hospital, technology such as cybersecurity software, malware scanners, data protection and encryption, and spam/malicious email filtering, as well as services such as the development, installation, patching, and updating of that technology, technology training, and cybersecurity risk analyses,(11) which will protect the physicians as well as the hospital.

Recognition That Unprofitable Arrangements May Not Be Commercially Unreasonable

Application Vignette: A large not-for-profit hospital employs a group of pediatric surgeons to provide clinical services during the week and call coverage at night and on weekends, per Level I trauma center requirements. The hospital pays the physicians more than their services bring in collections, resulting in a financial loss to the hospital.

Before the final rule, it was unclear whether arrangements that may not be profitable but are required to fulfill certain operational requirements were commercially reasonable, for example, “community need, timely access to health care services, fulfillment of licensure or regulatory obligations, including those under the Emergency Medical Treatment and Labor Act (EMTALA), the provision of charity care, and the improvement of quality and health outcomes.”(4)

Change: In perhaps one of the most important assertions in the final rules, CMS unequivocally noted in its definition of commercial reasonableness that “[a]n arrangement may be commercially reasonable even if it does not result in profit for one or more of the parties.”(4,12) As a result, CMS has now made clear that such reasons may render a non-profitable arrangement commercially reasonable.

Acknowledgment That Physician Salary Surveys May Not Tell the Whole Story

Application Vignette No.1: A hospital is negotiating for the employment of an orthopedic surgeon. Independent compensation surveys, based on geography, indicate annual compensation of $450,000; however, the surgeon, who is one of the best at treating professional athletes with knee injuries due to his experience, specialized techniques, and outcomes, is a highly sought-after specialist. The surgeon, therefore, is demanding much higher compensation.

Application Vignette No.2: A medium-sized town has two interventional cardiologists but no cardiothoracic surgeon who could perform surgery in the event of an emergency during a catheterization. The hospital has been unsuccessful in attracting a surgeon at the amount indicated by salary surveys, but the hospital is worried that paying above that amount may run afoul of fraud and abuse laws.

CMS notes in the final rule that “extenuating circumstances” may require transactional parties to “veer from values identified in salary surveys and other valuation data compilations that are not specific to the actual parties to the subject transaction.”(4) One example is that of the previously mentioned “rock star” physician scenario.

Change: The Stark Law requires that FMV be “consistent with the general market value.” CMS updated the definition of general market value in the final rule and delineated the definition into three categories, similar to the FMV definition. Most importantly, however, CMS clarified in the final rule that although FMV must be “consistent” with general market value, “the [FMV] of a transaction — and particularly, compensation for physician services — may not always align with published valuation data compilations, such as salary surveys. In other words, the rate of compensation set forth in a salary survey may not always be identical to the worth of a particular physician’s services.”(4)

As a result, CMS’s commentary seems to acknowledge that not all physicians, or compensation arrangements, are the same; compensation arrangements may have qualitative benefits that outweigh quantitative costs (i.e., profitability), and salary surveys are only a starting point in the valuation of a healthcare transaction.

Therefore, in this case, this particular physician would command a significantly higher salary, requiring that the general market value of the transaction be well above $450,000, which may effectively make the compensation FMV.(6)

Changes to the Group Practice Rules Related to Profit Distribution

Application Vignette: A 10-physician multispecialty group distributes overall profits from designated health services (DHS) by specialty group. Physician sub-group A receives profits from the practice’s laboratory services, while physician sub-group B receives profits from its radiology services.(13)

Before the publication of the final rules, these physician practice sub-groups could separate the different service lines and distribute their separate profits according to varying methodology.

Change: The Stark Law final rule clarifies that DHS profits cannot be distributed in this manner going forward. Instead, practices must total all DHS profits before distribution. Physician groups can continue to have sub-groups, and those sub-groups can choose different methodologies for distributing DHS profits, but the DHS profits referred and/or furnished by the group must be aggregated first (i.e., the physicians cannot distribute laboratory profits one way and radiology profits another way), and the profit distribution methodology must be the same for every physician within the group or sub-group.(4)

Result after January 1, 2022, (not January 19, 2021): Concerning the above example, this multispecialty practice will have to revise its profit-distribution methodology and aggregate its laboratory, radiology, and other service line profits, and it can then allow the subgroups to distribute their portion of those profits according to their chosen methodology.

Conclusions

With these changes, CMS and OIG finish HHS’s Regulatory Sprint to Coordinated Care initiative, revising regulations to catch up to the rapidly changing healthcare system and accelerate the transformation of the healthcare system into one that better pays for value and promotes care coordination.

Despite the seemingly fewer regulatory barriers, the novelty of these exceptions and safe harbors, as well as their interplay, will inevitably raise several questions as these now-allowed innovated arrangements are put into practice and will need to be subsequently addressed by HHS.

References

1. HHS Press Office. HHS Makes Stark Law and Anti-Kickback Statute Reforms to Support Coordinated, Value-Based Care. Press Release. US Department of Health & Human Services. November 20, 2020. www.hhs.gov/about/news/2020/11/20/hhs-makes-stark-law-and-anti-kickback-statute-reforms-support-coordinated-value-based-care.html . Accessed November 24, 2020.

2. Satiani B, Zigrang TA, Bailey-Wheaton JL. Proposed Stark Regulations: Small Step Forward. Physician Leadership Journal. May/June 2020.

3. Huttinger R, Aeddula NR. Stark Law. 2020 Jun 3. StatPearls. Treasure Island, FL: StatPearls Publishing; 2021 Jan–. PMID: 32644500.

4. Medicare Program; Modernizing and Clarifying the Physician Self-Referral Regulations: Final Rule. Federal Register. 85(232): 77497, 77509–10, 77515, 77530–31, 77544, 77554, 77561, 77623, 77627, 77639, 77641.

5. Verma S, Brandt K. Updates To Stark Law Regulations Will Drive Value In The Health Care System. Health Affairs blog. December 9, 2020. www.healthaffairs.org/do/10.1377/hblog20201208.472326/full/ . Accessed February 12, 2021.

6. Medicare Program; Modernizing and Clarifying the Physician Self-Referral Regulations. Federal Register. 84(201):55730, 55773, 55799.

7. Exceptions. 42 CFR § 1001.952.

8. Medicare and State Health Care Programs: Fraud and Abuse; Revisions to Safe Harbors Under the Anti-Kickback Statute, and Civil Monetary Penalty Rules Regarding Beneficiary Inducements: Final Rule. Federal Register. 85(232):77724, 77731, 77770–71, 77781, 77809, 77815.

9. Exceptions to the referral prohibition related to compensation arrangements. 42. CFR § 411.357.

10. HHS Issues Final Cybersecurity Safe Harbor and Exception. Faegre Drinker. December 15, 2020. www.faegredrinker.com/en/insights/publications/2020/12/hhs-issues-final-cybersecurity-safe-harbor-and-exception . Accessed February 1, 2021.

11. Cannatti JA, Gottlieb DF. Stark and AKS Final Rules Will Facilitate Donations of EHR and Cybersecurity Technology and Services. McDermott Will & Emery. December 22, 2020. www.mwe.com/insights/stark-and-aks-final-rules-will-facilitate-donations-of-ehr-and-cybersecurity-technology-and-services . Accessed February 1, 2021.

12. Definitions. 42 CFR § 411.351.

13. CMS Adopts Important Changes to the Stark Regulations. Garfunkel Wild, PC. December 11, 2020. https://garfunkelwild.com/cms-adopts-important-changes-to-the-stark-regulations/#:~:text=Beginning%20on%20January%201%2C%202022,from%20DHS%20of%20any%20subgroup . Accessed February 1, 2021.