CMS Designates More Providers as “High Risk” - Expect Delays During Enrollment and CHOWs Due to Mandatory Finger-Print Background Checks
On November 23, 2022, the Department of Health and Human Services and the Center for Medicare and Medicaid Services (“CMS”) passed a final rule[1] that drastically changed the risk categories for certain providers when they initiate enrollment actions. These changes will be effective on January 1, 2023. This article analyzes the provider types affected, the fingerprinting process involved and the likely effects these changes will have on these providers as they attempt to enroll new entities or undergo change of ownership (“CHOW”) applications.
As required by the Affordable Care Act, CMS established risk categories identifying what level of scrutiny to apply to new enrollment applications, CHOWs, and revalidations by provider type.[2] The risk categories are “limited”, “moderate” and “high.”
Providers in the high-risk categories are subject to additional requirements that include fingerprint-based criminal background checks as part of the enrollment process.[3] A provider type can be in different categories depending on the enrollment action being requested. For example, a provider can be in the high-risk category when attempting to enroll a new entity and in the moderate-risk category when seeking to revalidate that same entity. In addition, providers of any type can be elevated to a high-risk category and subject to fingerprinting-based background checks if certain sanctions have been imposed on the provider, such as a CMS payment suspension or OIG exclusions.[4]
Provider Types Affected
Skilled Nursing Facilities
Since the inception of the regulation requiring CMS to place providers in categories, skilled nursing facilities (SNFs) had been categorized as limited risk for all enrollment actions. However, with the implementation of this final rule, SNFs will be considered high risk and subject to intense scrutiny when attempting to initially enroll or report a CHOW with CMS. In addition, SNF revalidations will be processed under a moderate level of scrutiny.
The most burdensome part of this change for SNFs will be the fingerprint-based criminal background check requirements. When a SNF initially enrolls, then each individual who owns 5% or more of the SNF must submit fingerprints and undergo a criminal background check in connection with the enrollment application. Fingerprint-based background checks will also be required in the event that an enrolled SNF reports a change of ownership with a new 5% or more owner.
Durable Medical Equipment, Prosthetics, Orthotics (DMEPOS) suppliers
Home Health Agencies (HHAs)
Medicare Diabetes Prevention Program (MDPP) suppliers
Opioid Treatment Program (OTP) providers
DMEPOS suppliers, HHAs, MDPP suppliers and OTP providers will be considered high-risk and subject to intense scrutiny when attempting to report a change of ownership with CMS. These providers were previously considered high risk for a new CMS enrollment, but not for CHOW applications.
Effective January 1, 2023, DMEPOS suppliers, HHAs, MDPP suppliers and OTP providers that were certified by the Substance Abuse and Mental Health Services Administration after October 24, 2018, submitting either: (i) a change of ownership application or (ii) an application to report any new owner must have the new owner submit to fingerprint-based criminal background check requirements. In either scenario, the new owner must have a 5% or greater interest.
Fingerprinting and Background Check Procedures
CMS has contracted with Accurate Biometrics to conduct the fingerprint-based background check on all individuals with a 5% or greater ownership in a provider or supplier that falls under the high risk category for purposes of enrollment screening.[5] If a provider is required to process fingerprints through Accurate Biometrics, they will receive a letter from the Medicare Administrative Contractor.[6] Then, the provider must print the fingerprint and affidavit forms available on the Accurate Biometrics website and take them to a law enforcement agency or fingerprint vendor to have the fingerprints done. Then, the form and affidavit must be mailed to Accurate Biometrics. There is a link on the website to check the status of the fingerprint and background check processing.[7]
Effects of These Changes on Providers
The fingerprinting process will likely slow down initial enrollment applications and CHOWs when these affected providers are forming a new entity or undergoing a change of ownership transaction. To complicate the process further for DMEPOS suppliers, CMS recently eradicated the National Supplier Clearinghouse for Medicare enrollment applications for DMEPOS suppliers. Effective on November 7, 2022, there is now a National Provider Enrollment East administered by Novitas Solutions and a National Provider Enrollment West administered by Palmetto GBA.[8] DMEPOS suppliers will now process Medicare enrollments through one of these National Provider Enrollment contractors depending on state location. As these contractors transition to their new roles, pending enrollment applications for DMEPOS suppliers are likely to be affected.
Another interesting aspect of the increased scrutiny will be how CMS will enforce the fingerprinting-based criminal background checks for affected provider types when the owners or new owners with 5% or more interest are corporations or private entity firms. The statute designates that “individuals” who maintain a 5% or greater direct or indirect ownership interest in the provider or supplier are subject to the high screening requirements.[9] As private equity firms’ involvement in the healthcare system continues to increase[10], CMS will have to determine how to screen owners who are not individuals.
If you need assistance with navigating these changes to provider enrollment or any CMS enrollment issue, Nexsen Pruet is here to help.
[1] 87 FR 72293
[2] 42 C.F.R §424.518.
[3] 42 C.F.R §424.518(c)(2)(ii)(A) and (B)
[4] 42 C.F.R §424.518(c)(3)
[5] https://cmsfingerprinting.com/
[6] https://cmsfingerprinting.com/fingerprinting_procedures.html
[7] https://status.cmsfingerprinting.com/
[8] https://www.cms.gov/medicare/provider-enrollment-and-certification
[9] 42 C.F.R §424.518(c)(2)(ii)(A) and (B)
[10] Private equity in healthcare: What to know (medicalnewstoday.com)
About Maynard Nexsen
Maynard Nexsen is a full-service law firm with more than 550 attorneys in 24 offices from coast to coast across the United States. Maynard Nexsen formed in 2023 when two successful, client-centered firms combined to form a powerful national team. Maynard Nexsen’s list of clients spans a wide range of industry sectors and includes both public and private companies.
