The Patient Protection and Affordable Care Act (PPACA) and the Health Care and Education Reconciliation Act of 2010 (HCERA)1 provide for the expansion of healthcare coverage for approximately 32 million currently uninsured Americans. How will this vast new entitlement, and steadily rising Medicare and Medicaid costs generally, be financed? Most of the focus in the popular media has been on new and increased taxes and cuts to payments to providers and suppliers. But the third leg of the health reform financing stool will be vigorous enforcement of current and new laws designed to prevent, root out, and punish illegal conduct that adds to Medicare and Medicaid program costs.
The Federal Bureau of Investigation and the National Health Care Anti-Fraud Association estimate that 3 to 10 percent of our national healthcare spending is lost to fraud and abuse.2 With healthcare spending at $2.5 trillion in 2009 and growing, it is estimated that $75 to $250 billion is lost each year to fraud and abuse. These losses dwarf the highly successful enforcement efforts by the U.S. Department of Justice (DOJ) and U.S. Department of Health and Human Services (HHS). The most recent DOJ/HHS Health Care Fraud and Abuse Control Program Report states that in fiscal 2009 alone, antifraud efforts resulted in recoveries of $2.51 billion for the Medicare Trust Fund and $441 million of federal Medicaid expenditures.3 Attorneys should note that much of the money was recovered from large, and presumably well-represented, pharmaceutical companies and hospitals. But physicians and other smaller industry players have also been frequent targets for enforcement actions.
According to Attorney General Eric Holder and HHS Secretary Kathleen Sebelius, the healthcare reform law will give the DOJ and HHS important new tools to "fight fraud, strengthen consumer rights and protect taxpayer dollars."4 Enforcement officials will also have more money to back their efforts. The healthcare reform law provides for an additional $350 million over the next 10 years for the DOJ/HHS Health Care Fraud and Abuse Control Program and the Medicare Integrity Program.
While many key provisions of healthcare reform do not take effect for several years, most of the new enforcement tools are available immediately. These can be roughly divided into three sometimes overlapping categories:
1) Amendments to the Stark Law.
2) Strengthened fraud and abuse rules.
3) Program integrity and transparency.
The Stark Law5--named after its original author, California Congressman Fortney "Pete" Stark--prohibits a physician (or an immediate family member of the physician) from making a referral for the furnishing of Medicare-covered "designated health services" (DHS) if the physician (or an immediate family member) has a financial relationship (through ownership, investment, or a compensation arrangement) with the entity that is the recipient of the referral. DHS includes clinical laboratory services, physical therapy, radiology services, durable medical equipment, outpatient prescription drugs, and hospital inpatient and outpatient services. The Stark Law also prohibits the entity from billing for DHS furnished pursuant to a Stark-prohibited referral--unless an exception applies. Exceptions are potentially available for a variety of qualifying financial relationships, including in-office ancillary services, publicly traded securities, rental of office space and equipment, bona fide employment relationships, personal service arrangements, and fair market value compensation.6
The penalties for violating the Stark Law include the refunding of amounts paid by Medicare pursuant to prohibited referrals, civil monetary penalties (CMP) of $15,000 for each service for which a claim was submitted in knowing violation of the Stark Law, up to three times the amount claimed pursuant to a prohibited referral, CMP of $100,000 for "circumvention schemes,"7 and exclusion from the Medicare and Medicaid programs.8 Further, if an entity knowingly submits a claim pursuant to a Stark Law prohibited referral, the submission can lead to a violation of the False Claims Act (FCA) and substantial per claim civil penalties plus treble damages.9
Unlike the Medicare-Medicaid antikickback statute, the Stark Law is a civil statute and therefore does not require that the government prove criminal intent. While it is, in theory, easier to prove a violation of the Stark Law, in practice--perhaps due to the complexity of the Stark Law and its implementing regulations10--federal prosecutors have focused on simpler cases, such as physicians who refer patients to hospitals who pay them an above fair market value amount for medical director services11 or charge a below fair market value amount for renting office space.12
Changes to the Stark Law
The healthcare reform law makes three important changes to the Stark Law. The first change is to the "in-office ancillary services" (IOAS) exception to the Stark Law.13 Assuming its requirements are met, the IOAS exception permits physicians who have a financial relationship with their own medical group to make referrals to the group for the furnishing of DHS and permits the group to bill for the DHS.
Section 6003 of the PPACA adds two new requirements in order to qualify for the IOAS exception with respect to magnetic resonance imaging (MRI), computed tomography (CT), and positron emission tomography (PET) services provided to Medicare patients. The referring physician 1) must inform the patient, in writing, at the time of the referral that the patient may obtain these services from someone else, and 2) provide the patient with a written list of suppliers who furnish the service in the area in which the patient resides.14 "Suppliers" include other medical groups and independent diagnostic testing facilities, but not hospitals.15 HHS has the authority to apply the notice requirements to other DHS in addition to MRIs, CT, and PET.16
By its terms, Section 6003 of the PPACA applies to services furnished after January 1, 2010. Given that the PPACA was not signed by President Obama until March 23, 2010, this creates a legal impossibility with respect to services rendered before March 23, 2010. The Centers for Medicare and Medicaid Services (CMS) has resolved this anomaly in its proposed 2011 Medicare Physician Fee Schedule (MPFS) by providing that the new disclosure requirements do not go into effect until the CMS issues its final regulations. The proposed 2011 MPFS anticipates that the effective date of the new disclosure requirements will be January 1, 2011,17 and further provides that the disclosure notice to the patient must include a list of at least 10 other suppliers located within a 25-mile radius of the physician's office location. If there are fewer than 10 suppliers within a 25-mile radius, then all those suppliers must be listed.18 Further, the proposed 2011 MPFS requires the list to include each supplier's name, address, telephone number, and distance from the physician's office location.19 Finally, under the proposed 2011 MPFS, a record of the patient's signature on the disclosure notice must be maintained in the patient's medical record.20
While the new law applies only to services involving Medicare patients, California Business and Professions Code Section 650.01(f) has long required referring physicians to disclose their "financial interest in their own practices and groups to the patient, or the parent or legal guardian of the patient, in writing, at the time of the referral or request for consultation." Section 650.01(f) applies to all payers, not just Medicare, and covers in-office referrals for all diagnostic imaging services, physical therapy, lab services, and other covered services. Counsel should alert their physician clients of their continuing obligation to comply with this California disclosure requirement.
The second change to the Stark Law apparently ends the long-running debate about the future of physician-owned hospitals. Section 6001 of the PPACA amends the Stark Law to prohibit physicians from referring their Medicare patients to hospitals in which they have an ownership or investment interest unless the hospital has in place both the physician ownership and a Medicare provider agreement by December 31, 2010.21 Further, hospitals that meet those requirements (with limited exceptions for those with patient populations that contain a high proportion of Medicaid recipients) will not be able to increase the number of operating rooms, procedure rooms, or beds beyond what they are licensed for as of the latter of March 23, 2010, or the date of their provider agreement.22 In addition, currently qualifying hospitals will not be able to increase the percentage of the total value of the ownership or investment interests held by physicians beyond the percentage held by the physicians as of March 23, 2010.23
The third change to the Stark Law is a welcome one. Section 6409 of the PPACA provides that by September 23, 2010, HHS must establish a protocol that enables providers and suppliers to disclose an actual or potential violation of the Stark Law. Further, HHS is authorized to reduce the amount due for those Stark Law violations that are disclosed, based on factors such as the nature and extent of the violation, the timeliness of the self-disclosure, and the cooperation in providing additional information related to the disclosure. Previously, the CMS had stated that it did not have authority to reduce the penalties for self-disclosed Stark Law violations, giving providers little incentive to make such disclosures voluntarily. Nevertheless, depending upon how the self-disclosure protocol is implemented, providers and their counsel will need to carefully analyze the potential risks and rewards of voluntary disclosure.
Amending Fraud and Abuse Laws
The PPACA makes several important changes to the Medicare-Medicaid antikickback statute24 and other fraud and abuse laws. The antikickback statute makes it a crime to offer, pay, solicit, or receive any form of remuneration to induce referrals for the furnishing, or arranging for furnishing, of goods, items, or services covered by Medicare, Medicaid, and other federal healthcare programs or to induce a person to purchase, lease, or order those goods, items, or services. Violators can be punished by fines of up to $25,000, imprisonment for up to five years, or both, and be excluded from participating in federal healthcare programs.25
Section 6402 of the PPACA modifies the antikickback statute by adding that "with respect to violations of this section, a person need not have actual knowledge of this section or specific intent to commit a violation of this section."26 This change appears intended to eliminate the defense that providers in the Ninth Circuit were able to make under Hanlester Network v. Shalala,27 which required the government to prove that the person specifically believed the challenged conduct was illegal under the statute. Section 6402 further amends the antikickback statute to provide that claims for items or services resulting from a violation of the statute also constitute false claims for purposes of the False Claims Act, thus subjecting violators to the FCA's substantial per claim civil penalties and treble damages.28
Section 6402 of the PPACA now requires Medicare and Medicaid overpayments to be reported in writing (including the reason for the overpayment) and refunded within the later of 60 days of being "identified," or after the date any corresponding cost report was due (if applicable).29 The retention of identified overpayments after the 60-day period constitutes an "obligation" under the FCA, thus exposing violators to penalties under the FCA.30 Exactly when an overpayment has been identified is not specifically stated and presumably will be clarified in implementing regulations. The 60-day period for making a report and repaying the overpayment is short, so clients should inform counsel as soon as the clients suspect a possible overpayment.
In an unexpected twist, Section 6402 of the PPACA amends the definition of "remuneration" in connection with CMPs for improper inducements to beneficiaries to order items or services from providers and suppliers. The definition now excludes 1) any remuneration that promotes access to care and presents a low risk of harm to patients and federal healthcare programs, and 2) under certain specified circumstances, the offer or transfer of items or services for free or less than fair market value.31
The PPACA also makes some important changes regarding qui tam, or whistle-blower, lawsuits under the FCA. Previously, a court had no jurisdiction to hear a qui tam lawsuit if the action was based on information that had been publicly disclosed in a prior criminal, civil, congressional, or administrative hearing, report, audit, or investigation, or in the news media--unless the relator was the "original source" of the information. Sections 1303 and 10104 of the PPACA amend the FCA to substantially narrow the public disclosure bar. Specifically, an action or claim will be dismissed if it is based upon publicly disclosed information unless dismissal is opposed by the government. In addition, the type of public information that would require a dismissal is now limited to only federal criminal, civil, or administrative hearings; congressional, GAO, and other federal reports, hearings, audits, and investigations; or news media reports--unless the relator is the original source of the information upon which the claim is based.
Moreover, the definition of "original source" has been modified.32 Previously, to qualify as an original source, the relator was required to have direct and independent knowledge of the information upon which the claim was based. Under the new law it is sufficient if, prior to a public disclosure, the relator has either voluntarily disclosed to the government the information upon which the claim is based or the relator "has knowledge that is independent of and materially adds to the publicly disclosed allegations or transactions, and...has voluntarily provided the information to the Government before filing" his or her qui tam action.33 Thus, a relator can now qualify as an original source even if his or her claim is based upon second-hand information. Most observers believe these changes will increase the number of qui tam lawsuits that will be brought.
Program Integrity and Transparency
Perhaps the most important goal that the federal government hopes to achieve with its new enforcement tools is to nip potential fraud and abuse in the bud. The DOJ and HHS believe that the healthcare reform law "will help shift the emphasis from the old model of 'pay and chase' to a new model that puts a premium on fraud prevention and program integrity."34
Rightly or wrongly, durable medical equipment (DME) and home health have been identified as high-risk areas for fraud and abuse. Section 6405 of the PPACA provides that beginning July 2010, DME and home health services for Medicare patients can be ordered or certified only by a physician or other appropriate professional who is a Medicare provider.35 Section 6405 also authorizes HHS to extend these requirements to all other Medicare-covered items and services. In addition, Section 6406 provides for disenrollment from Medicare for up to one year if a physician or supplier fails to maintain, and upon the request of HHS provide documentation relating to, written orders or requests for payment for DME, certifications for home health services, and referrals for other items or services by the physician or supplier.36
Further, as a condition of payment by Medicare, Section 6407 requires that a physician ordering DME or certifying the need for home health services must have had a face-to-face encounter with the patient (though the doctor and patient also can meet via "telehealth" technology) before the order or certification.37 In the case of DME, the face-to-face encounter can also be performed by certain other designated healthcare professionals, including a physician assistant or nurse practitioner.38 Finally, Section 6407 authorizes HHS to extend the face-to-face encounter requirement to other Medicare-covered items and services.
Section 6411 of the PPACA provides that by the end of 2010, the Recovery Audit Contractor (RAC) audit program will be expanded to include Medicare Part C (the Medicare Advantage program) and Part D (the prescription drug benefit)39 as well as Medicaid.40 RACs are paid, in part, based upon a percentage of the amounts they recover. There have been many complaints that past RAC audits of hospitals and physicians have intentionally overstated the amount of improper claims in order to increase the percentage-based bounty for the RACs.
Section 6002 of the PPACA seeks to mandate greater transparency in the financial relationships between manufacturers of drugs and devices and physicians. Beginning March 31, 2013, and annually thereafter, manufacturers of a covered (by Medicare or Medicaid) drug, device, or biological or medical supply must report to HHS any payments or other transfers of value to a physician or teaching hospital.41 Substantial CMPs may be imposed for failing to make the required reports.42 Transfers of value basically include anything with a value over $10 or $100 in the aggregate for the calendar year, subject to an inflation adjustment.43 In addition, Section 6002 requires that manufacturers and group purchasing organizations (GPOs) that purchase, arrange for the purchase, or negotiate the purchase of a covered drug, device, or biological or medical supply must also report ownership or investment interests held by physicians and their immediate family members in the manufacturers and GPOs.44 This requirement does not apply to ownership or investment interests in publicly traded companies. Beginning September 30, 2013, HHS will make these reports available to the public through a searchable Web site.45
Section 6401 of the PPACA, which takes effect 180 days after the new law's enactment, authorizes HHS and the Office of Inspector General of HHS (OIG) to establish procedures to screen providers and suppliers to the Medicare, Medicaid, and CHIP programs.46 The goal is to prevent fraudulent enrollment of providers and suppliers in these federal programs. The screening procedures must include a licensure check47 and may also involve fingerprinting and unannounced site visits.48 HHS also may require that providers and suppliers, as a condition of enrollment in the Medicare program, establish a compliance program that contains "core elements" applicable to a particular industry sector or category.49 HHS will designate these elements. Prior to the passage of the PPACA, mandatory compliance programs usually applied only when a provider or supplier entered into a corporate integrity agreement with the OIG.
Section 6408 of the PPACA provides for enhanced civil monetary penalties for making or using false records or statements material to a claim for payment under Medicare, Medicaid, and other federal healthcare programs. These enhanced penalties also apply to those who fail to grant the OIG timely access for audits, investigations, or evaluations.50 The new penalties are up to $50,000 for each false record or statement, and up to $15,000 for each day that timely access is not provided.51
Pursuant to Section 6402 of the PPACA, HHS has the authority to suspend Medicare and Medicaid payments to providers and suppliers pending an investigation of a credible allegation of fraud, unless HHS determines that good cause exists for not suspending the payments.52 Thus, under the PPACA, those suspected of fraud can have their Medicare and Medicaid payments suspended before having the opportunity to respond to allegations.
With the passage of the PPACA and the HCERA, the federal government will be focusing more intensely than ever before on preventing, uncovering, and punishing not only intentional fraud and abuse but also the failure to comply with new provisions for program integrity. The government will have a substantially enhanced set of enforcement tools and funds--and be under enormous budgetary pressure--to vigorously pursue fraud and abuse. Given the potentially ruinous penalties for even technical noncompliance, healthcare providers and suppliers will need sophisticated and pragmatic legal advice to navigate this new compliance minefield.