Hogan Lovells 2024 Election Impact and Congressional Outlook Report
Following on last October’s publication of two proposed rules, the Department of Health and Human Services (HHS) published on November 20 two final rules intended to “modernize and clarify” the physician self-referral (Stark) law and federal anti-kickback statute (AKS), reduce regulatory burdens, and accelerate the transition to value-based care. These final rules – an AKS Final Rule issued by the HHS Office of Inspector General (OIG) and a Stark Final Rule issued by the Centers for Medicare & Medicaid Services (CMS) – follow corresponding fall 2019 proposed rules and summer 2018 Requests for Information as part of HHS’s “Regulatory Sprint to Coordinated Care.” This second part examines HHS’s implementation of AKS and Stark changes to allow and encourage the industry shift toward value-based care, with less reliance on fee-for-service models.
Part 1 focused on important proposals to further update and amend the Stark Law regulations, including updated definitions of key terms (such as “takes into account the volume or value of referrals”) and new provisions to reduce technical trip wires under Stark. These rules were issued on the same day as other potentially transformative rules. We have also summarized in other alerts two concurrently published final rules, one from the OIG on pharmaceutical manufacturer rebate arrangements and one from CMS on a drug payment model to tie Medicare Part B payments for certain drugs to the lowest price charged in other similar countries.
Section I of this Alert provides a summary of the value-based arrangements provisions in both Final Rules. Section II provides an overview of other new and modified safe harbors and modifications to the Beneficiary Inducements statute addressed in the AKS Final Rule.
The value-based provisions of the Final Rules set out to protect arrangements between parties in a referral relationship who are engaged in activities intended to promote care coordination or deliver increased value to patients and payers. Many but not all, such arrangements arise in collaborations formed to improve quality and efficiency in a managed care or global fee context. In the Final Rules, CMS and OIG indicated that the Rules aim to remove potential regulatory barriers to innovative arrangements that encourage care coordination and improve patient outcomes, while maintaining or reducing costs.
Both the AKS Final Rule and the Stark Final Rule implement significant proposals related to value-based arrangements, including new and amended AKS safe harbors and Stark exceptions. The Final Rules protect arrangements between hospitals, other health care providers or practitioners, and/or payors that qualify as Value-Based Enterprise (VBE) Participants. The VBE model is a critical component of these new safe harbors and exceptions, as discussed in further detail below.
While both rules provide protection for arrangements under which Participants take on substantial or full downside financial risk for the success of their collaboration, overall the AKS safe harbors and Stark exceptions are not mirror images of each other. CMS issued a third “Value-Based Arrangements” exception to Stark that does not require any party to accept downside risk but imposes a few additional requirements instead. In a similar vein, OIG issued an AKS care coordination arrangements safe harbor that does not require any party to accept downside risk but is applicable only to in-kind benefits and requires 15% cost sharing. OIG also issued an AKS patient engagement and support safe harbor and a new section of the AKS personal services safe harbor for “outcomes-based” payments.
The clearest application of the value-based protections is to clinically integrated networks and similar alignment models (even if not enrolled in CMS alternative payment programs), but the new safe harbors and exceptions are not expressly limited to that setting. The AKS safe harbor for patient engagement also has clear benefits for patient relationships.
These new safe harbors and exceptions largely use the basic structure set forth in last year’s proposed rules, with some modifications to add greater flexibility and in some cases to add other basic safeguards. We summarize below the key takeaways from the lengthy regulations and detailed preambles responding to industry comments on the proposed rules.
The new exceptions and safe harbors do not apply equally across different types of health care entities or in the same manner under the two laws. For AKS purposes, OIG provided a chart summarizing applicability to each type of entity (available here). In sum:
The new AKS safe harbors are not available to drug manufacturers, distributors, and wholesalers. Only two of the safe harbors are available to device and supply manufacturers – “care coordination arrangements” and “patient engagement and support” – and in each case, only with respect to digital health technology. Under the AKS Final Rule, pharmaceutical and device manufacturers can collaborate with others in a value-based arrangement, but remuneration exchanged with these entities would not quality for value-based safe harbor protection.
The Stark exceptions are available to any entity providing a health service covered by the statute’s prohibitions (which do not typically apply to drug or device manufacturers and certain other companies, in any event).
While included in the Stark exceptions, clinical laboratories and PBMs are excluded from all new value-based AKS safe harbors; DMEPOS suppliers also are excluded, except with respect to digital health technology under the “care coordination arrangements” safe harbor.
Health technology companies and pharmacies are included in each of the new AKS safe harbors (except that compounding pharmacies are wholly excluded).
OIG finalized a tailored, risk-based approach to allow for limited participation by device manufacturers and DMEPOS companies in a value-based arrangement to provide services such as remote monitoring, predictive analytics, data analytics, care consultations, patient portals, and telehealth that may be used to coordinate and manage care. Although such entities are otherwise ineligible for protection under the value-based safe harbors, OIG permits device manufacturers and DMEPOS companies to rely on the care coordination arrangements safe harbor for digital health technology arrangements that meet all safe harbor conditions, plus an additional one. Under this additional criterion, “limited technology participants” could include a device manufacturer or DMEPOS company that exchanges digital health technology with another VBE Participant or a with a VBE. However, such exchanges of digital health technology are permitted only insofar as the exchange is not conditioned on any recipient’s exclusive use of, or minimum purchase of, any item or service manufactured, distributed, or sold by the limited technology participant.
OIG did not finalize its proposal to limit protection under value-based arrangements for any remuneration funded by, or otherwise resulting from the contributions of, any individual or entity outside of the VBE. OIG’s stated rationale for this proposal had been to prevent entities outside the definition of a VBE – like drug manufacturers and labs – from indirectly gaining protection for arrangements that they cannot enter into directly. Although OIG did not finalize this requirement, it emphasized that remuneration exchanged outside of a value-based arrangement (which is limited to a set of value-based activities and purposes, as discussed further in the next section, below) would not be protected by any of the value-based safe harbors.
Of course, the absence of safe harbor protection does not necessarily mean that an arrangement violates the AKS, and entities that may wish to seek an advisory opinion from OIG could find support for a value-based arrangement in various elements of the proposed safe harbors.
The AKS and Stark proposals include a common set of broad elements for a protectable value-based arrangement. Many of the central program safeguards in the new rules are grounded in the definitions of these elements. For example, a VBE is necessary for all of the new value-based Stark exceptions and almost all of the new AKS safe harbors designed for use in the value-based setting. A VBE is defined as two or more participants collaborating to achieve at least one “value-based purpose” and must have a governing document and an accountable body (such as a board of directors) or person responsible for financial and operational oversight of the enterprise. Recognized “value-based purposes” include improving the quality of care for a target patient population; appropriately reducing the costs to or growth in expenditures of payors (without reducing the quality of care for a target patient population); or transitioning from health care delivery and payment mechanisms based on the volume of items and services provided to mechanisms based on the quality of care and control of costs of care for a target patient population. Finally, a protected “value-based arrangement” must involve at least one “value-based activity,” which must be reasonably designed to achieve a value-based purpose.
The new safe harbors and exceptions also have certain limitations with respect to marketing or payments solely related to referrals. The new safe harbors generally prohibit payments in relation to marketing or patient recruitment initiatives. The new Stark Law regulations specify that making referrals into a VBE, on its own, is not a value-based activity that can be protected under the new exceptions.
While all of the value-based Stark exceptions rely on these terms, the “outcomes-based payments” prong of the AKS personal services safe harbor does not. This may be helpful, for example, with respect to more formal protection for traditional hospital gainsharing arrangements because savings only within a provider (and not to payors, as well) is not identified as a “value-based purpose.”
The Final Rules add further requirements, recognizable from existing safe harbors, to address OIG’s concern that protected arrangements are bona fide, do not shift costs, and do not result in stinting on care. For example, the value-based arrangement must be documented in a signed writing (the AKS Final Rule permits a collection of documents); must not reduce medically necessary care or unduly limit patient choice; and must not be tied to referrals or business outside the value-based arrangement. OIG did not finalize requirements that the VBE have a compliance program or that the accountable body have specific oversight responsibilities, although CMS added certain monitoring obligations to the broadest Stark exception (called “Value-Based Arrangements,” despite the term “value-based” being used in two other new exceptions), which does not require the VBE or any participants to take on financial risk.
All three Stark exceptions would protect a wide variety of models. Each would apply to payments and in-kind assistance (e.g., infrastructure, administrative, or care coordination assistance). In addition, while a target patient population would need to be defined based on reasonable and legitimate parameters (not solely related to profit potential, for example), key to the Stark exceptions is that they apply across payors. That is significant for providers looking to incorporate fee-for-service Medicare and Medicaid patients into a value-based arrangement, whether or not the provider is participating in the Medicare Shared Savings Program or other government initiatives that come with special fraud and abuse waivers.
Beyond these base requirements, the Final Rules adopt a “tiered approach,” with growing flexibility available to the parties as they assume more financial risk for the cost of care.
The care coordination AKS safe harbor permits (i.e., does not treat as remuneration) certain in-kind benefits that promote care coordination and management, such as the provision of care coordination personnel or technology for the exchange of patient data between VBE Participants. To be protected, the value-based arrangement would need to:
The parallel Stark exception imposes requirements (called the “value-based arrangements” exception) focusing on the design of the value-based activities in a manner similar to the care coordination safe harbor. This new exception would permit similar arrangements as the care coordination safe harbor, such as the provision of care utilization management tools, but the exception is much broader than the AKS care coordination safe harbor in certain respects. First, the remuneration provided to a physician is not limited to care coordination, in-kind benefits, or any other particular form or use (subject to the involvement of a “value-based purpose” between participants of a VBE). It would thus permit incentives for performance-based payment systems or incentives to attract primary care physicians, for example. In addition, unlike the AKS care coordination safe harbor, there is no cost-sharing requirement. The central safeguards required by the exception include:
The latter two conditions above were not in the proposed rule and were added to the Stark Final Rule. But, the value-based arrangements exception (like the new Stark exceptions specific to financial risk arrangements) does not have two the other requirements present in traditional Stark exceptions: it has neither a fair market value requirement nor a prohibition on compensation that is determined in a manner that “takes into account the volume or value of referrals.” As CMS recognized in commentary, these two conditions presented some of the key barriers to value-based care under existing Stark Law exceptions.
The other two tiers of the AKS safe harbors and Stark exceptions both require financial risk.
The first of the financial risk value-based safe harbors protects payments between a VBE and a VBE Participant where the VBE has assumed substantial downside risk from a payor for providing or arranging for items and services subject to the value-based arrangement. In the AKS Final Rule, OIG modified in three key respects the proposed definition of “substantial downside financial risk” the VBE would need to take on with a payor. First, the VBE need only take at least 30% (reduced from 40% as proposed) of shared losses. Second, OIG modified the description of the partial capitation methodology to require assumption of a prospective, per-patient payment, but did not finalize the 60% risk threshold under that methodology. Third, OIG did not finalize the proposed population-based payment methodology.
OIG also finalized certain modifications to the definition of the “meaningful share” of a VBE’s substantial downside financial risk that the VBE Participant needs to take on to qualify under the safe harbor. First, OIG reduced the threshold for two-sided risk from 8% as proposed to 5% as finalized. Second, OIG clarified that a VBE Participant receiving a prospective, per-patient payment cannot claim payment in any form from the payor for the predefined items and services. Finally, OIG did not finalize the proposed meaningful share methodology applicable to physician payments that meet the requirements of the parallel Stark exception for value-based arrangements with meaningful downside financial risk to the physician.
The parallel “meaningful downside financial risk” Stark exception protects remuneration for value-based activities related to the target population if the physician is obligated to take on downside risk for 10% or more of the remuneration he or she receives under the value-based arrangement. For example, this exception might apply to payments to adhere to clinical protocols or in relation to payor savings achieved, if the physician has the downside risk for 10% of the total amount to be paid if the purpose is not achieved. (The exception also applies to in-kind support, if 10% downside for the value is assumed by the physician).
Between the proposed and final rules, in response to comments from the industry, CMS reduced the amount of downside risk that must be assumed by the physician from 25% to 10%. In addition, whereas the AKS safe harbor requires that the remuneration provided to the value-based participant must be used predominantly to engage in value-based activities that are directly connected to the items and services for which the VBE has assumed financial risk, the Stark Law exception does not have this limitation.
The third value-based safe harbor protects payments between a VBE and a VBE Participant where the VBE has assumed full financial risk from a payor. In response to comments, OIG modified the safe harbor to no longer require the VBE to be prospectively paid by the payor prior to the provision of items and services to each patient in the target patient population, so long as the VBE has assumed financial responsibility prior to the provision of items and services. To qualify for protection under this proposed safe harbor, the VBE Participant is precluded from claiming payment in any form directly or indirectly from a payor for items or services covered under the value-based arrangement, or otherwise shifting the costs of the full financial risk arrangement, though OIG clarifies in the AKS Final Rule that the VBE may enter into reinsurance or other risk-adjustment arrangements.
The parallel “full financial risk” Stark exception protects remuneration for value-based activities related to the target patient population if the VBE is at “full financial risk” for each patient covered by the applicable payor in the population. Notably, this does not include traditional Medicare’s prospective payment systems for inpatient and outpatient care because hospitals do not assume risk for other aspects of patient care.
OIG finalized a new safe harbor to streamline protections for certain arrangements provided in connection with a CMS-sponsored value-based models, which have historically had to rely on model-specific waivers of the AKS. In the AKS Final Rule, OIG clarified that CMS shall determine the specific types of financial arrangements and incentives to which safe harbor protection will apply. Any patient incentives protected under the safe harbor must have a direct connection to the patient’s health care, though OIG added the caveat that this requirement may vary if the participation documentation expressly specifies a different standard, in which case that standard must be met. Lastly, the AKS Final Rule added a provision permitting an individual other than the CMS-sponsored model participant or its agent to furnish an incentive to a patient under a CMS-sponsored model if that is specified by the participation documentation. OIG’s deference to CMS in deciding how this safe harbor will apply to a particular CMS-sponsored model does not appear to alter the status quo, though it may lead to a more standardized approach across all CMS-models and reduce uncertainty for entities considering whether to participate in a new CMS-sponsored model.
OIG finalized, with limited modifications, a new safe harbor that allows VBE Participants to give certain in-kind patient tools and supports to patients. In the AKS Final Rule, OIG removed the specific illustrative categories of in-kind patient tools and support services, and instead OIG will be agnostic as to the types of in-kind tools and supports that can be protected by this safe harbor so long as all safe harbor conditions are met. Among other conditions, the tools and supports protected under the safe harbor must be furnished directly by a VBE Participant (or, as added by the AKS Final Rule, by a third party that qualifies as an “eligible agent”) to a patient in a target patient population, must be directly connected to the coordination and management of care, and must advance one or more of the safe harbor’s enumerated goals. The patient engagement tools and supports may not include cash or cash equivalents (though the preamble to the AKS Final Rule allows for certain limited-use gift cards that function as in-kind remuneration), and may not be used for patient recruitment or marketing of items and services reimbursable by Federal health care programs. OIG finalized the $500 annual aggregate cap, but without the proposed exception for tools and supports above the cap furnished based on good faith, individualized determinations of a patient’s financial need. OIG also finalized a condition that the availability of patient engagement tools and supports cannot be determined in a manner that takes into account the type of insurance coverage of the patient.
The AKS Final Rule expanded the current warranty safe harbor to cover certain bundled warranties, but retained significant hurdles to protection for warranties in which manufacturers seek to take on more accountability for clinical outcomes related to their products.
OIG extended the safe harbor to warranties for a bundle of items and/or related services, as long as the bundled items and services are reimbursed under the same federal health care program and in the same federal health care program payment. The requirement that bundled items and services be reimbursed under the same federal health care program payment withholds protection from warranties for items that are clinically related but happen to be reimbursed under different methodologies, or under different Diagnosis-Related Groups (DRGs) or Ambulatory Payment Classifications (APCs). In addition, the safe harbor does not protect manufacturer warranties of services alone without a related item.
OIG declined to provide safe harbor protections to certain “population-based warranties,” where the manufacturer’s payment is not tied to a specific patient or payment, but noted that it may consider it in future rulemaking.
OIG reiterated language from the proposed rule that the safe harbor protects “warranty arrangements conditioned on clinical outcome guarantees,” if the other safe harbor conditions are met. However, the safe harbor retains the current restriction that prohibits manufacturers from paying for any “medical, surgical, or hospital expense” outside the item under warranty (except beneficiary cost-sharing). While OIG extended protection to certain warranties of clinical outcomes, this restriction suggests that OIG is not comfortable giving manufacturers additional flexibility in how to remedy unsatisfactory outcomes.
OIG also finalized as proposed a new restriction that the manufacturer may not condition the warranty on the buyer’s exclusive use of the manufacturer’s items or services or any minimum purchase requirement. This restriction could significantly constrain innovation in the design of warranties and limit their availability.
OIG finalized changes to the existing safe harbor for personal services and management contracts to modernize the safe harbor and address barriers imposed by existing safe harbor requirements. The AKS Final Rule eliminates two barriers that have long prevented health care companies from meeting the strict terms of the safe harbor:
In addition, OIG finalized a new paragraph in the safe harbor to protect certain “outcomes-based” compensation for services. A protected “outcomes-based payment” is a payment between or among a principal and an agent that rewards the agent for successfully achieving (or penalizes an agent for failing to achieve) one or more legitimate outcome measures that quantify: (1) improvements in, or the maintenance of improvements in, the quality of patient care; (2) a material reduction in costs to or growth in expenditures of payors while maintaining or improving quality of care for patients (which OIG clarified cannot be met solely by savings realized by providers); or both. Notably, this outcomes-based payment personal services safe harbor provision affords protection to some arrangements that may also fit within the new Stark exception for no-risk value-based arrangements.
Among other things, the AKS Final Rule clarifies that outcomes-based payments can be made between or among a principal and an agent, and need not only flow from the principal to the agent; can include recoupment or reductions in payments to an agent for failure to achieve an outcome measure; and are not limited only to payments made for achieving outcome measures that “effectively and efficiently coordinate care across care settings.” The AKS Final Rule also relaxed the standards for outcome measures, in line with similar changes to the value-based arrangement safe harbors, to require only that the measures be legitimate and selected based on clinical evidence or credible support.
The Final Rules include parallel provisions to protect donations of cybersecurity technology and amend the existing AKS safe harbor and Stark exception for electronic health records (EHR) arrangements.
​​​​​​​​​​​​​​1. Cybersecurity technology and related services (42 C.F.R. § 1001.952(jj); 42 C.F.R. §411.357(bb))
OIG finalized a new AKS safe harbor, and CMS finalized a new Stark Law exception, to remove barriers to donations of cybersecurity technology and services, allowing parties to address the growing threat of cyberattacks affecting the health care ecosystem. The safe harbor and exception protect donations of software and other information technology, including (as added by the Final Rules) certain cybersecurity hardware donations, that are “necessary and used predominantly” for effective cybersecurity and meet the conditions of the safe harbor and exception. Other modifications in the Final Rules include: clarifying that donations to “reestablish” effective cybersecurity are protected, not requiring a risk assessment prior to donation, not imposing a monetary cap on or requiring recipient contribution towards the value of a donation, and permitting a “collection of documents” approach to satisfy the written agreement requirement.
​​​​​​​2. Electronic health records (EHR) (42 C.F.R. § 1001.952(y); 42 C.F.R. § 411.357(w))
OIG and CMS each finalized updates to existing protections for EHR arrangements. Modifications from the proposed updates include removing the “information blocking” condition from the safe harbor as better addressed through other legal authorities, retaining the 15% contribution requirement but removing the requirement that the contribution be paid in advance for updates to existing EHR systems, and not adopting the proposed changes to the definition of “electronic health record.”
1. Expanded AKS safe harbor for local transportation (42 C.F.R. § 1001.952(bb))
The AKS Final Rule expanded the existing safe harbor for local transportation to: (i) allow residents of rural areas to be transported within 75 miles (up from the previous 50 mile limit); and (ii) remove any mileage limit on transportation of a patient when the patient is discharged from a facility to the patient’s residence. OIG clarified that this second condition is available only upon discharge from an inpatient facility following an inpatient admission or following release from a hospital after being placed in observation status for at least 24 hours. OIG declined to expand the local transportation safe harbor to protect patient transportation for non-medical purposes (such as to food stores, social services facilities, and exercise facilities, among other things). However, where the requirements of the safe harbor are satisfied, OIG clarifies that transportation may be made available through ride-sharing arrangements or through other means of local transportation that may exist in the future (e.g., self-driving cars).
​​​​​​​2. Codified AKS safe harbor for the ACO Beneficiary Incentive Program (42 C.F.R. § 1001.952(kk))
The AKS Final Rule codified the statutory exception to the definition of “remuneration” related to ACO Beneficiary Incentive Programs for the Medicare Shared Savings Program. The regulatory language, finalized without modification, is almost identical to the statutory language, except that it clarifies that an ACO may furnish incentive payments only to assigned beneficiaries.
​​​​​​​​​​​​​​3. Amendment to the Beneficiary Inducement CMP to permit telehealth technologies for In-home dialysis patients
OIG codified a statutory exception to the Beneficiary Inducements Civil Monetary Penalty (CMP) enacted in the Bipartisan Balanced Budget Act of 2018 to permit an individual with End-Stage Renal Disease (ESRD) receiving home dialysis to elect to receive telehealth technologies. The codified regulatory language corresponds closely to the statutory language and does not include most of the additional limitations that had been proposed by OIG, (for example, it expands the definition of “telehealth technologies by removing references to specific technologies,” no longer requires that the technology offer only a de minimis benefit or be nonduplicative of technology the beneficiary already possesses, and no longer requires that the technology be used only for telehealth services paid for by Medicare Part B. However, OIG did finalize language including physicians as a type of practitioner that can provide telehealth technologies to a patient.
* * *
If you have questions about the Final Rules, please do not hesitate to contact the Hogan Lovells lawyer with whom you regularly work or any Hogan Lovells lawyer listed on this alert.
Authored by Thomas Beimers, Jonathan Diesenhaus, Helen Trilling, Ron Wisor, David Thiess, and Laura Hunter