HHS Issues Highly Anticipated Final Regulations for Stark, AKS and the Beneficiary Inducements Provision of the CMP Statute

This article provides a summary of the final regulations as well as some insight into certain, more notable changes.  However, given the breadth of these final regulations, this article does not purport to address all relevant regulatory provisions or agency commentary. Notably, the final regulations become effective on January 19, 2021, except for one provision within Stark that becomes effective on January 1, 2022.⁶

1.      Stark Final Regulations Overview

The final regulations establish new exceptions to Stark for certain value-based compensation arrangements, for certain arrangements under which a physician receives limited remuneration, and for donations of cybersecurity technology and related services.⁷ The final regulations also include clarifying provisions and new exceptions for non-abusive arrangements to reduce unnecessary regulatory burdens and provide guidance to physicians and other healthcare providers with respect to Stark compliance.⁸  CMS identifies several policy and other considerations relevant to the development of the final regulations. For example, CMS cites the transition from a volume-based payment system (e.g., traditional fee-for-service (FFS) model) to a value-based payment system that aligns Medicare payments with the quality of care provided to Medicare beneficiaries through programs created under the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA), the Medicare Improvements for Patients and Providers Act of 2008 (MIPPA) and the Patient Protection and Affordable Care Act’s Medicare Shared Savings Program.⁹ CMS also cites commercial payor initiatives that may implicate Stark as a consideration relevant to the development of the final regulations.¹⁰

A.    Value-Based Exceptions and Corresponding Definitions

In the final regulations, CMS codifies new, value-based exceptions to Stark as well as corresponding definitions, with some modifications from those proposed in the Proposed Regulations. Notably, these new Stark exceptions apply to care furnished to Medicare beneficiaries as well as non-Medicare patients, and a combination of both types of patients.¹¹  

    i.        New Definitions for the Value-Based Exceptions

The final regulations establish new definitions for the following terms, which are applicable only to the new value-based exceptions: value-based activity, value-based arrangement, value-based enterprise (VBE), value-based purpose, VBE participant, and target patient population.¹²

The definition of “value-based activity” means any of the following activities, provided that the activity is reasonably designed to achieve at least one value-based purpose of the VBE: (1) The provision of an item or service; (2) The taking of an action; or (3) The refraining from taking an action.¹³ CMS declines to finalize the Proposed Regulations’ exclusion of referrals from the definition of value-based activity, in part due to a concern that, since referrals include the establishment of a plan of care, such an exclusion would significantly limit the usefulness of the new value-based exceptions.¹⁴ However, CMS revises the definition of “referral” under Stark to affirm its policy that referrals are not items or services for which a physician may be compensated under Stark.¹⁵ In addition, in response to commenters’ inquiries regarding how parties can document that the value-based activity is “reasonably designed” to achieve a value-based purpose, CMS states that contemporaneous documentation is a best practice that it encourages parties to follow.¹⁶

The final regulation’s definition of “value-based arrangement” means “an arrangement for the provision of at least one value-based activity for a target patient population to which the only parties are: (1) A value-based enterprise and one or more of its VBE participants; or (2) VBE participants in the same value-based enterprise.”¹⁷ CMS reminds readers that the parties to a value-based arrangement must include a physician and an entity (as such term is defined at 42 C.F.R. § 411.351) in order for the arrangement to implicate Stark.¹⁸ Also, because the value-based exceptions only apply to compensation arrangements, any financial relationships that are not compensation relationships would not meet these exceptions.¹⁹ Further, CMS clarifies that the definition of value-based arrangement does not include compensation arrangements between a payor and a physician.²⁰

The new value-based exceptions apply only to the value-based arrangements of a VBE and VBE participant(s). The final regulations define VBE to “mean two or more VBE participants: (1) Collaborating to achieve at least one value-based purpose; (2) each of which is a party to a value-based arrangement with the other or at least one other VBE participant in the value-based enterprise; (3) that have an accountable body or person responsible for the financial and operational oversight of the value-based enterprise; and (4) that have a governing document that describes the value-based enterprise and how the VBE participants intend to achieve its value-based purpose(s).”²¹ VBEs include “only organized groups of health care providers, suppliers, and other components of the health care system collaborating to achieve the goals of a value-based health care delivery and payment system.”²² CMS does not limit or dictate the appropriate legal structures that may qualify as a VBE and instead focuses on the functions of the VBE. Additionally, CMS does not require that a VBE be a separate legal entity with the power to contract on its own, and provides that networks of physicians and entities may qualify as a VBE, provided that such networks allow for the VBE to assume legal obligations (e.g., all VBE participants can sign contracts individually obligating the VBE or they could vest the authority to bind the VBE with a designated person who can contract on behalf of the VBE).²³

CMS describes a VBE as “essentially a network of participants (such as clinicians, providers, and suppliers) that have agreed to collaborate with regard to a target patient population to put the patient at the center of care through care coordination, increase efficiencies in the delivery of care, and improve outcomes for patients.”²⁴ Each participant of a VBE must be a party to at least one value-based arrangement with at least one other participant in the VBE. CMS does not exclude the possibility that the VBE itself may be an “entity” (as defined at 42 C.F.R. § 411.351) and therefore be considered a VBE participant.

In order to qualify as a VBE, the VBE participants must collaborate to achieve at least one value-based purpose. The final regulations define “value-based purpose” to mean: “(1) Coordinating and managing the care of a target patient population; (2) improving the quality of care for a target patient population; (3) appropriately reducing the costs to or growth in expenditures of payors without reducing the quality of care for a target patient population; or (4) transitioning from health care delivery and payment mechanisms based on the volume of items and services provided to mechanisms based on the quality of care and control of costs of care for a target patient population.”²⁵ CMS states that the determination of whether a value-based activity is designed to achieve at least one value-based purpose is a fact-specific determination that requires the parties to have a good faith belief that the value-based activity will achieve or lead to the achievement of at least one value-based purpose of the VBE.²⁶ However, the final regulations do not require that the value-based purpose actually be achieved in order for the arrangement to be protected under one of the applicable value-based exceptions.²⁷ That said, if the parties are aware that the actions, or the refraining from taking action, will not further the value-based purpose of the VBE, the arrangement will cease to qualify as a value-based activity and the parties may need to amend or terminate their arrangement in order to comply with Stark.²⁸ Also notable is the fact that CMS declines to define “care coordination and management” in response to commenters’ concerns that such a definition could limit future innovation.²⁹

The term “VBE participant” is defined in the final regulations as “a person or entity that engages in at least one value-based activity as part of a value-based enterprise.”³⁰ CMS clarifies that the term “entity” is not limited to an “entity” as defined at 42 C.F.R. § 411.351 and is, instead, intended to mean the commonly used phrase “person or entity” that is frequently referred to throughout the Stark regulations.³¹ In the Proposed Regulations, CMS considered excluding laboratories and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers from the definition of a VBE participant. However, in the final regulations, CMS declines to incorporate such exclusions or exclude any other specific persons, entities, or organizations from qualifying as a VBE participant.³²

CMS finalizes the definition of “target patient population” as proposed in the Proposed Regulations, without modification, to mean “an identified patient population selected by a value-based enterprise or its VBE participants based on legitimate and verifiable criteria that: (1) Are set out in writing in advance of the commencement of the value-based arrangement; and (2) Further the value-based enterprise’s value-based purpose(s).”³³ CMS provides the following non-exclusive list of examples of legitimate and verifiable criteria: “medical or health characteristics (for example, patients undergoing knee replacement surgery or patients with newly diagnosed type 2 diabetes), geographic characteristics (for example, all patients in an identified county or set of zip codes), payor status (for example, all patients with a particular health insurance plan or payor), or other defining characteristics.”³⁴ CMS also specifically warns that cherry-picking (selecting a target patient population consisting of only lucrative or adherent patients) and lemon-dropping (avoiding costly or non-compliant patients) would not be considered “legitimate” under most circumstances and would, therefore, fail to meet the definitional requirements of a target patient population.³⁵  CMS states that it would not be sufficient for the VBE  or its VBE participants to merely state that the selection criteria will be determined by another party (e.g., a payor) in order to meet the requirement that the criteria be set out in writing in advance of the commencement of the value-based arrangement.³⁶

    ii.        New Value-Based Exceptions (42 C.F.R. § 411.357(aa))

CMS adds three new value-based exceptions for compensation arrangements: (1) value-based arrangements where the VBE has assumed full financial risk from a payor for patient care services performed for a target patient population for the entire duration of the arrangement (the “full-financial risk exception,” set forth at 42 C.F.R. § 411.357(aa)(1)); (2) value-based arrangements under which the physician is at meaningful downside financial risk for failure to achieve the value-based purpose(s) of the VBE for the entire duration of the arrangement (the “meaningful downside financial risk exception,” set forth at 42 C.F.R. § 411.357(aa)(2)); and (3) any value based-arrangements that meet specific requirements (the “value-based arrangements exception,” set forth at 42 C.F.R. § 411.357(aa)(3)).³⁷  The value-based exceptions do not include traditional Stark requirements that the compensation be set in advance, consistent with fair market value, and not determined in any manner that takes into account the volume or value of a physician’s referrals or the other business generated by the physician for the entity.³⁸ CMS rationalizes this based on the fact that the value-based definitions applicable to the value-based exceptions include disincentives for overutilization, stinting on patient care, and other harms that Stark is intended to address, and also because the inclusion of these requirements may inhibit the innovation needed to achieve well-coordinated care.³⁹

In addition, the exceptions will only protect remuneration that is for or results from value-based activities undertaken by the recipient for patients in the target patient population and will, accordingly, not protect payments for referrals or any other actions or business unrelated to the target patient population (e.g., general marketing or sales arrangements) or in-kind remuneration that is not necessary or that merely duplicates technology or other infrastructure that the recipient already has.⁴⁰ None of these exceptions will protect arrangements involving remuneration that is conditioned upon either the referrals of patients who are not part of the target patient population or other business that is not covered by the value-based arrangement.⁴¹ These exceptions will not protect remuneration that is an inducement to reduce or limit medically necessary items or services to any patient.⁴² However, these value-based exceptions will protect remuneration that is conditioned upon the physician’s referrals to a particular provider, practitioner, or supplier if: (1) the requirement to make referrals to a particular provider, practitioner, or supplier is set out in writing and signed by the parties; and (2) the requirement does not apply if the patient expresses a preference for a different provider, practitioner or supplier, or the referral is not in the patient’s best medical interests in the physician’s judgment.⁴³  Also, all three exceptions require that the records pertaining to the methodology for determining the actual amount of remuneration paid under the value-based arrangement be maintained for at least six years and made available to the secretary of HHS (Secretary) upon request.⁴⁴

1.      Full Financial Risk Exception (42 C.F.R. § 411.357(aa)(1))

The full financial risk exception requires that the VBE be financially responsible (or contractually obligated to be financially responsible within 12 months following the commencement date of a value-based arrangement), on a prospective basis, for the cost of all patient care items and services covered by the payor for each patient in the target patient population for a specified period of time.⁴⁵ CMS does not mandate a specific manner for assuming full financial risk and CMS identifies capitated payments and global budget payments from a payor as examples of manners by which a VBE may assume full financial risk.⁴⁶  “Full financial risk” does not prohibit a payor from making payments to a VBE to offset losses incurred by the VBE above those prospectively agreed to by the VBE and payor, nor does it prohibit payment of shared savings or other incentive payments for achieving quality, performance, and/or other benchmarks.⁴⁷ However, CMS specifically declines commenters’ requests to limit “full financial risk” to a defined set of patient care items or services or carve out from “full financial risk” certain high-cost or specialty items or services.⁴⁸

The exception’s requirement that the VBE’s financial risk be prospective means that the VBE must assume “financial responsibility for the cost of all patient care items and services covered by the applicable payor prior to providing patient care items and services to patients in the target patient population.”⁴⁹ Notably, the exception protects only arrangements for which the VBE is at full financial risk for the entire duration of the value-based arrangement.⁵⁰  Although the exception does not include documentation requirements, CMS notes that it is good practice to reduce the arrangement between referral sources to writing.⁵¹

2.      Meaningful Downside Financial Risk Exception (42 C.F.R. § 411.357(aa)(2))

The meaningful downside financial risk exception protects remuneration paid to or from a physician under a value-based arrangement where the physician is at meaningful downside risk for the entire term of the arrangement for failure to achieve the value-based purpose(s) of the VBE.⁵² For purposes of the exception, “meaningful downside risk” means that the physician is responsible to pay or forgo at least 10 percent of the total value of the remuneration (which could include in-kind remuneration) that the physician receives under the value-based arrangement, rather than the 25 percent figure that CMS proposed in the Proposed Regulations.⁵³ The exception requires that the nature and extent of the physician’s financial risk be set forth in writing.⁵⁴

Additionally, the exception mandates that the methodology used to determine the amount of remuneration be set in advance of the furnishing of items or services for which the remuneration is provided. The exception covers individual value-based arrangements between an entity and a physician that are VBE participants in the same VBE under which the physician has assumed financial risk from the entity, regardless of whether the VBE or entity has assumed financial risk from a payor.⁵⁵ CMS notes that this fact distinguishes this Stark exception from the AKS substantial downside financial risk safe harbor, under which the VBE, rather than the physician, is required to take financial risk.⁵⁶

3.      Value-Based Arrangements Exception (42 C.F.R. § 411.357(aa)(3))

The value-based arrangements exception set forth in the final regulations protects compensation arrangements that qualify as value-based arrangements, regardless of the level of risk undertaken by the VBE or any of its VBE participants provided that certain requirements are met.⁵⁷ The final regulations pertaining to the exception permit both monetary and nonmonetary remuneration between the parties.⁵⁸  Similar to the meaningful downside financial risk exception, the value-based arrangements exception includes a requirement that the methodology used to determine the amount of remuneration be set forth in advance of the furnishing of items or services for which the remuneration is provided.⁵⁹ Because the exception would protect value-based arrangements in which neither party undertakes any financial risk, the exception contains the following requirements to protect against program or patient abuse: (1) the value-based arrangement must be set forth in a writing that includes several required terms and that is signed by the parties; (2) the value-based arrangement must be commercially reasonable and further a value-based purpose that relates to the VBE as a whole; and (3) the outcome measures against which the recipient of the remuneration is assessed, if any, must be objective, measurable, and selected based on clinical evidence or credible medical support.⁶⁰ The final regulations define “outcome measure” as a “benchmark that quantifies: (A) Improvements in or maintenance of the quality of patient care; or (B) Reductions in the costs to or reductions in growth in expenditures of payors while maintaining or improving the quality of patient care.”⁶¹ In response to commenters, CMS clarifies that outcome measures may not be applicable to all value-based arrangements; however, if they are included, they must be determined prospectively, in advance of their implementation.⁶² Similarly, any changes to outcome measures must be made prospectively and set forth in writing.⁶³

The exception also includes an explicit monitoring requirement that mandates that the parties or VBE monitor the value-based arrangement at least annually, or at least once during the term of an arrangement that has a duration of less than one year, in order to determine: (1) whether the parties have furnished the value-based activities required under the value-based arrangement; (2) whether and how continuation of the value-based activities is expected to further the value-based purpose(s) of the VBE; and (3) progress toward attainment of the outcome measure(s), if any, against which the recipient of the remuneration is assessed.⁶⁴ If the monitoring indicates that the value-based activity is not expected to further the value-based purpose(s) of the VBE, the parties must either: (a) terminate the arrangement within 30 calendar days; or (b) modify the arrangement to terminate the ineffective value-based activity within 90 calendar days.⁶⁵ Similarly, if the monitoring indicates that an outcome measure is unattainable during the remaining term of the value-based arrangement, the parties must either terminate or replace the unattainable outcome measure within 90 calendar days of completing the monitoring.⁶⁶ CMS believes these remedial timeframes allow the parties an appropriate amount of time to address the findings of their monitoring without fear of violating Stark.⁶⁷

4.      Indirect Compensation Arrangements to Which the Value-Based Exceptions are Applicable

CMS acknowledges that an “indirect compensation arrangement” may be formed by an unbroken chain of financial relationships that includes a value-based arrangement if the other elements of indirect compensation arrangements set forth in 42 C.F.R. § 411.354(c)(2) exist.⁶⁸ Accordingly, the final regulations make the value-based exceptions available to certain indirect compensation arrangements that include a value-based arrangement in the unbroken chain of financial relationships, if the link closest to the physician is a compensation relationship (and not ownership interest) that meets the definition of a value-based arrangement.⁶⁹ In response to some commenters’ inquiries as to whether the exception at 42 C.F.R. § 411.357(n) for risk-sharing arrangements is available to indirect compensation arrangements involving a value-based arrangement, CMS clarifies that the exception for risk-sharing arrangements only applies to direct or indirect compensation paid by a managed care organization (MCO) or independent practice association (IPA) to a physician for services provided to enrollees of a health plan, provided that the compensation arrangement qualifies as a risk-sharing arrangement.⁷⁰ On account of the apparent confusion pertaining to the exception for risk-sharing arrangements, CMS finalizes revisions, which are prospectively effective, to that exception to clarify the above scope.⁷¹

B.     Fundamental Terminology and Requirements

CMS finalizes various clarifications and revisions to existing definitions and requirements within Stark to benefit the industry by providing bright-line rules to enhance compliance efforts.⁷² As part of this effort, CMS identifies the three Stark requirements that compensation be commercially reasonable, not determined in a manner that takes into account the volume or value of a physician’s referrals or other business generated by a physician, and that compensation be fair market value for services actually furnished, as being separate and distinct requirements that should be disentangled from each other.⁷³

    i.        Commercially Reasonable

The final regulations establish that the definition of “commercially reasonable” “means that the particular arrangement furthers a legitimate business purpose of the parties to the arrangement and is sensible, considering the characteristics of the parties, including their size, type, scope, and specialty.”⁷⁴ CMS clarifies that the determination of commercial reasonableness is not a determination of valuation.⁷⁵ In addition, the final regulations specify that an “arrangement may be commercially reasonable even if it does not result in profit for one or more of the parties.”⁷⁶ CMS provides the following as examples of why parties may enter into transactions that do not result in profit for one or more of the parties: community need, timely access to services, fulfillment of licensure or regulatory requirements (e.g., under the Emergency Medical Treatment and Labor Act (EMTALA)), charity care, and improvement of quality and health outcomes.⁷⁷

    ii.        The Volume or Value Standard and the Other Business Generated Standard

CMS finalizes definitions for the volume or value standard and other business generated standard within Stark’s section pertaining to special rules on compensation, at 42 C.F.R. § 411.354(d)(5) and (6).⁷⁸ Compensation is considered to take into account the volume or value of referrals or other business generated if the mathematical formula used to calculate the physician’s (or immediate family member’s) compensation includes the physician’s referrals to the entity or other business generated by the physician for the entity as a variable, and the amount of compensation correlates (either positively or negatively, as specified in the definitions) with the number or value of the physician’s referrals or other business generated.⁷⁹  These definitions are not applicable to the special rules for unit-based compensation set forth at 42 C.F.R. § 411.354(d)(2) and (3).⁸⁰ Thus, if compensation is determined to take into account the volume or value of referrals or other business generated, that determination is final and the special rules for unit-based compensation cannot be applied to then deem the compensation to not take into account the volume or value of referrals or other business generated.⁸¹ CMS states that on and after the effective date of the final regulations, the unit-based compensation rules will be inapplicable or unnecessary, but the regulatory language is being preserved to assist parties, CMS, and law enforcement in applying the historical policies in effect at the time of existence of the compensation arrangement that is being analyzed for compliance.⁸² Additionally, these definitions do not apply in the context of nonmonetary compensation; thus, they do not apply to Stark exceptions for medical staff incidental benefits (42 C.F.R. § 411.357(m)), professional courtesy (42 C.F.R. § 411.357(s)), communitywide health information systems (42 C.F.R. § 411.357(u)), electronic prescribing items and services (42 C.F.R. § 411.357(v)), electronic health records (EHR) items and services (42 C.F.R. § 411.357(w)), or cybersecurity technology and related services (42 C.F.R. § 411.357(bb)).⁸³

    iii.        Patient Choice and Directed Referrals

Notably, the final regulations revise the directed referral requirement set forth at 42 C.F.R. § 411.354(d)(4) to add the condition that neither the existence of the compensation arrangement nor the amount of compensation be contingent on the number or value of the physician’s referrals to the particular provider, practitioner or supplier in order to address the risk of program or patient abuse (e.g., in situations in which a physician will receive no future compensation or the compensation relationship would be terminated if the physician fails to refer as required).⁸⁴ This condition must be met regardless of whether the compensation takes into account the volume or value of the physician’s referrals to the entity with which the physician has the compensation relationship.⁸⁵ In order to incorporate this change in relevant Stark exceptions, CMS revises the language of the Stark exceptions at 42 C.F.R. § 411.355(e) and 42 C.F.R. §§ 411.357(c), (d)(1), (d)(2), (h), (l), (p), and (z) to require that if the physician referrals are directed to a particular provider, practitioner or supplier, the arrangement must satisfy the updated conditions of 42 C.F.R. § 411.354(d)(4).⁸⁶

    iv.        Fair Market Value

CMS updates the definition of “fair market value” at 42 C.F.R. § 411.351 and reorganizes it for clarification purposes, but notes that the final regulatory language does not significantly differ from the statutory language.⁸⁷ The definition sets forth specific definitions of fair market value in the context of equipment and office space rentals, with some differences from previous regulatory language. For example, CMS removes the previous language regarding the rental of office space that related to costs incurred by the lessor in developing, upgrading, or maintaining the property or its improvements.⁸⁸  For clarification purposes, CMS also removes the volume or value standard that was previously included in the definition of “general market value” and organized that definition into three categories based on the types of transactions contemplated in the Stark exceptions that relate to fair market value – asset acquisition, compensation for services, and equipment or office space rentals.⁸⁹ In response to commenters, CMS clarifies that the retention of the language “not in position to generate business” within the definition of “general market value” requires that the nature or identity of the purchaser of items or services be irrelevant to the determination of “general market value,” and, consequently, the definition of “fair market value.”⁹⁰

C.    Group Practice Modifications

The final regulations include several clarifying changes to Stark’s group practice requirements set forth in 42 C.F.R. § 411.352. In addition, CMS reaffirms certain longstanding interpretations pertaining to these requirements. For example, CMS reaffirms its interpretation that the language “based on” in 42 C.F.R. § 411.352(g) and “related to” in 42 C.F.R. § 411.352(i), have the same meaning as “takes into account” as they relate to the volume and value of referrals; accordingly, the special rule at 42 C.F.R. § 411.354(d)(5) applies when determining whether a physician’s compensation, share of overall profits, or productivity bonus takes into account the volume or value of the physician’s referrals to the group practice.⁹¹

CMS also reaffirms its interpretation of “overall profits” in 42 C.F.R .§ 411.352(i) to mean the profits derived from all of the designated health services (DHS) of any component of the group that consists of at least five physicians (which may include all physicians in the group), or from all of the DHS of the group if there are fewer than five physicians in the group.⁹² In recognition of the fact that some group practices may have misinterpreted the meaning of “overall profits,” and because the methodologies for DHS profit distributions, which are often established prior to the beginning of a calendar year, must be determined before the receipt of payment for services, CMS delays the effective date of all revisions to 42 C.F.R. § 411.352(i) until January 1, 2022.⁹³  In response to commenters, CMS confirms that not all components (of at least five physicians) within a group practice must be treated the same with respect to the distribution of overall profits from DHS and a group practice may utilize different distribution methodologies for each of its components (of at least five physicians), provided that the distribution to any physician is not directly related to the volume or value of that physician’s referrals.⁹⁴ Further, the final regulations establish a provision that permits profits from DHS that are directly attributable to a physician’s participation in a VBE to be distributed to that physician.⁹⁵

Notably, as it relates to productivity bonuses set forth in 42 C.F.R. § 411.352(i), CMS responds to a commenter’s inquiry by affirming that: (1) a physician may receive a productivity bonus (or portion thereof) solely based on services that are not DHS but that are performed by members of the physician’s care team; and (2) such a bonus that is solely based on DHS ordered by the physician that are performed by members of the physician’s care team, but not furnished “incident to” the physician’s services, may only indirectly relate to the volume or value of the physician’s referrals for DHS, depending on the facts.⁹⁶

D.    Recalibrating the Scope and Application of the Regulations

CMS finalizes revisions to, and deletions of, certain regulatory requirements. For example, the final regulations remove the requirement in various Stark exceptions that the arrangement comply with the AKS and other state and federal laws governing billing or claims submission, with the exception of the fair market value compensation exception.⁹⁷  The final regulations also eliminate the rules on the period of disallowance at 42 C.F.R. § 411.353(c)(1) in their entirety, and add a new provision at 42 C.F.R. § 411.353(h) that permits an entity to submit claims or bills and receive payment for DHS if all payment discrepancies within the parties’ compensation arrangement are reconciled within 90 consecutive calendar days of expiration or termination of the arrangement and the arrangement otherwise fully complies with a Stark exception.⁹⁸

CMS also finalizes various revisions to definitions within Stark. For example, CMS revises the definition of “DHS” to clarify that for inpatient hospital services only (i.e., not outpatient or other services), a service is not a DHS payable, in whole or in part, by Medicare if furnishing the service does not affect the amount of the payment to the hospital under certain enumerated inpatient prospective payment systems (IPPS).⁹⁹ CMS finalizes its proposed revision to the definition of “referral” that clarifies that a referral is not an item or service for purposes of Stark.¹⁰⁰ Based on observed misuse of the Stark exception for isolated transactions to retroactively cure Stark noncompliance, CMS finalizes definitions to independently define “isolated transaction” apart from the definition of a “transaction” and clarify its policy that a single payment for multiple or repeated services (e.g., services previously provided that were not compensated) does not constitute an isolated transaction.¹⁰¹  CMS also finalizes clarifying revisions to the definitions for physician and remuneration as proposed in the Proposed Regulations.¹⁰²

Further, CMS finalizes its proposal to carve out from the meaning of “ownership and investment interests” (1) titular ownership or investment interests that do not allow for the ability or right to receive financial benefits of ownership or investment; and (2) interests in an entity that arise from an employee stock ownership plan (ESOP) that is qualified under § 401(a) of the Internal Revenue Code.¹⁰³ Additionally, the final regulations remove the special rule for temporary noncompliance with signature requirements at 42 C.F.R. § 411.353(g) and deem the writing requirement to be satisfied if the compensation arrangement satisfies all requirements of a Stark exception except for the writing or signature requirement and the required writing(s) or signature(s) is obtained within 90 consecutive calendar days of the date on which the arrangement became noncompliant with the requirements of the applicable Stark exception, as set forth in 42 C.F.R. § 411.354(e)(4).¹⁰⁴ CMS reiterates that it distinguishes the “set in advance” requirement from the “writing” requirement and clarifies that informal communications (e.g., email, text, internal notes to file, and generally applicable fee schedules) may also support that the compensation was set in advance, depending on the facts and circumstances.¹⁰⁵

The final regulations revise the references to “exclusive use” in the Stark exceptions for rental of office space and rental of equipment to clarify that the references apply only to exclude use by the lessor and any persons or entities related to the lessor (i.e., the lessees may share space and equipment with other persons and entities that are unrelated to the lessor and still meet the exclusivity requirement).¹⁰⁶ CMS finalizes its proposal to remove the requirement that the physician practice sign a physician recruitment agreement if the practice does not receive a financial benefit from the recruitment arrangement (i.e., where the practice receives remuneration and passes all, not part, of it through to the physician).¹⁰⁷

To better align the Stark regulatory and statutory exceptions for payments by a physician, CMS finalizes its proposal to revise the regulatory exception set forth at 42 C.F.R. § 411.35(i) to limit its availability to protect payments made by a physician to an entity as compensation for items or services that are furnished at fair market value to only those situations in which there is no applicable Stark exception set forth 42 C.F.R. §§ 411.357(a)-(h) (which includes arrangements for the rental of office space and equipment).¹⁰⁸  The final regulations also expand the fair market value compensation exception to make it available for the lease of office space, including short-term leases of less than one year in duration, under the same compensation restrictions applicable to the rental of equipment, in addition to finalizing other modifications to the exception.¹⁰⁹ With regard to the exception for assistance to compensate nonphysician practitioners (NPPs), CMS finalizes certain clarifying terms with respect to what constitutes “NPP patient care services” for purposes of the exception’s limitation on previous services performed and the fact that the compensation relationship must predate the physician’s arrangement with the NPP.¹¹⁰

With respect to the Stark exception for EHR items and services, the final regulations revise the exception to incorporate donations of cybersecurity software and services to protect the EHR, remove the sunset provision, modify the definition of “interoperable,” and remove the regulatory provisions that restrict the donor from restricting the use, compatibility, or interoperability of the items or services with other EHR systems.¹¹¹ Further, CMS declines to revise or remove the exception’s 15 percent contribution requirement for physicians.¹¹²

In sum, CMS intends that the above finalized revisions and deletions to existing regulatory provisions remove compliance burdens, while balancing the need to retain Stark’s protections against program and patient abuse.

E.     Providing Flexibility for Non-Abusive Business Practices

In addition to the value-based exceptions, the final regulations codify two additional new exceptions relating to limited remuneration to a physician and cybersecurity technology and related services.

    i.        Limited Remuneration to a Physician (42 C.F.R. § 411.357(z))

CMS finalizes a new exception to Stark based on a limited amount of remuneration being provided by an entity to a physician, even in the absence of documentation and where the compensation is not set in advance, if: (1) the remuneration is for items or service actually provided by the physician or through a wholly-owned entity, locum tenens physicians, or employees who were hired for the purpose of performing the services; (2) the amount of the remuneration to the physician does not exceed $5,000 per calendar year (which would be adjusted for inflation similarly to the limit in the nonmonetary compensation exception); (3) the compensation is not determined in any manner that takes into account the volume or value of referrals or other business generated by the physician; (4) the arrangement would be commercially reasonable even if no referrals were made between the parties; (5) the remuneration does not exceed the fair market value for the items or services; (6) compensation paid for the lease of office space or equipment or the use of the premises, equipment, personnel, items, supplies or services is restricted with respect to percentage-based and per-unit of service compensation in a similar manner to the Stark exceptions for fair market value compensation, indirect compensation arrangements and timeshare arrangements; and (7) if the remuneration is conditioned on the physician’s referrals to a particular provider, practitioner, or supplier, the arrangement satisfies the conditions of 42 C.F.R. § 411.354(d)(4) pertaining to directed referral requirements.¹¹³ CMS reiterates that this exception can be used for multiple undocumented, unsigned arrangements and that this exception can, in certain situations, be used in conjunction with other Stark exceptions to protect an arrangement during the course of a calendar year.¹¹⁴ In addition, CMS clarifies that each physician who stands in the shoes of a physician organization that is paid remuneration pursuant to this exception will be deemed to have the same compensation arrangement with the entity making payment to the physician organization.¹¹⁵

    ii.        Cybersecurity Technology and Related Services (42 C.F.R. § 411.357(bb))

CMS adopts a new Stark exception to protect arrangements set forth in writing involving nonmonetary remuneration, consisting of technology and services, that is necessary and used predominantly to implement, maintain or reestablish cybersecurity, provided that: (1) neither the eligibility of a physician for the technology or services, nor the amount or nature of the technology or services, is determined in any manner that directly takes into account the volume or value of referrals or other business generated between the parties; (2) neither the physician nor the physician’s practice (including employees and staff) makes the receipt of technology or services, or the amount or nature of the technology or services, a condition of doing business with the donor; and (3) the arrangement is documented in writing.¹¹⁶ The definition of “cybersecurity” set forth in the Proposed Regulations was adopted. However, the definition of “technology” was modified so that it no longer excludes hardware, as it did in the Proposed Regulations, and is applicable to hardware that is used predominantly to implement, maintain, or reestablish cybersecurity such as encrypted servers, encrypted drives, and network appliances that are necessary and used predominantly to implement, maintain, or reestablish cybersecurity.¹¹⁷ Notably, the exception does not extend beyond items and services that qualify as cybersecurity technology and services to other types of cybersecurity measures, such as donations of installation, improvement or repair of infrastructure related to physical safeguards.¹¹⁸ In addition, CMS did not propose and does not adopt a requirement that the physician recipient of the cybersecurity contribute to the cost of the technology or services; however, CMS states that donors are free to require such contributions provided that such practices are not determined in any manner that directly takes into account the volume or value of referrals or other business generated between the parties.¹¹⁹

2.      AKS and CMP Law Proposed Regulations Overview

The final regulations establish seven new safe harbors under the AKS and one new exception under the CMP Law, and modify four existing AKS safe harbors.¹²⁰ OIG states that the new and revised safe harbors are “designed to further the goals of access, quality, patient choice, appropriate utilization, and competition, while protecting against increased costs, inappropriate steering of patients, and harms associated with inappropriate incentives tied to referrals.”¹²¹ Specifically, OIG finalizes new AKS safe harbors for value-based arrangements, patient engagement and support, CMS-sponsored models, cybersecurity technology and services, and accountable care organization (ACO) beneficiary incentives.¹²² The final regulations also modify existing safe harbors for EHRs, personal services and management contracts, warranties, and local transportation.¹²³ OIG additionally finalizes a new exception to the CMP Law pertaining to telehealth technologies for in-home dialysis patients.¹²⁴ OIG notes that while some aspects of the final regulations are aligned with CMS’ final regulations, there are some variances due to the differences in statutory structures and penalties between Stark and the AKS and the recognition that the AKS, as a criminal, intent-based statute, should serve as a backstop protection for certain arrangements that may be permitted under Stark.¹²⁵

A.    New Value-Based Enterprise Safe Harbors

OIG finalizes three new value-based safe harbors that are similar, although not identical, to their Stark counterparts and that are based upon the risk assumption of the parties: (1) care coordination arrangements; (2) value-based arrangements with substantial downside risk; and (3) value-based arrangements with full financial risk.¹²⁶ In addition to these three value-based safe harbors, the final regulations include a new safe harbor to protect arrangements for patient engagement and support to improve quality, health outcomes, and efficiency, and a new safe harbor to protect CMS-sponsored model arrangements and patient incentives.

    i.        New Definitions and Common Provisions for the Value-Based Exceptions

Similar to CMS, OIG finalizes the following definitions relating to value-based safe harbors: VBE, value-based arrangement, target patient population, value-based activity, VBE participant, and value-based purpose.¹²⁷ However, unlike CMS, OIG finalizes a definition for “coordination and management of patient care.”¹²⁸

OIG’s finalized definition of VBE is aligned with CMS’s definition and is intended to be broad and flexible to accommodate individuals and entities of varying sizes and financial means to receive value-based safe harbor protection.¹²⁹ OIG confirms that an existing entity (e.g., an integrated delivery system or ACO) can qualify as a VBE and meet the regulatory safe harbor requirements.¹³⁰  Similarly, if parties have an existing governing body, it could be used to meet the requirements of an accountable body or responsible person.¹³¹ OIG finalizes the definition of “value-based arrangement” with a change from the Proposed Regulations to clarify that only the VBE and one or more VBE participants in the same VBE may be parties to a value-based arrangement.¹³² Notably, the final regulations do not preclude value-based arrangements between entities that have common ownership.¹³³

OIG finalizes its proposed definition of “target patient population” without modification and, in order to afford greater flexibility, OIG adopts a “legitimate and verifiable” criteria standard for purposes of the parties’ identification of such a patient population.¹³⁴ OIG defines “value-based activity” in a similar manner as CMS; however, unlike CMS, OIG specifies that the making of a referral is not a value-based activity.¹³⁵ That said, provided that the parties to a value-based arrangement are also performing a value-based activity, they may make and document the reasons for the referrals as part of a value-based arrangement and still be eligible for safe harbor protection.¹³⁶

The final regulations define the term “VBE participant” as an individual (other than a patient, a patient’s family members, or others acting on a patient’s behalf) or entity that engages in at least one value-based activity as part of a VBE.¹³⁷ Although the definition of VBE participant does not exclude any types of individuals or entities (aside from patients and those acting on their behalf), all value-based safe harbors under the AKS identify the following entities as ineligible entities: (1) pharmaceutical manufacturers, distributors, and wholesalers; (2) pharmacy benefit managers (PBMs); (3) laboratory companies; (4) pharmacies that primarily compound drugs or primarily dispense compounded drugs; (5) manufacturers of devices or medical supplies; (6) entities or individuals that sell or rent DMEPOS, other than a pharmacy or a physician, provider, or other entity that primarily furnishes services, all of which remain eligible; and (vii) medical device distributors or wholesalers that are not otherwise manufacturers of devices or medical supplies (e.g., some physician-owned distributors).¹³⁸ OIG explains that many of these ineligible entities are not as likely as other entities to be involved with front line care coordination and does not discourage these entities from becoming VBE participants, but cautions that value-based safe harbor protection is not available to protect any remuneration exchanged by ineligible entities under a value-based arrangement.¹³⁹ With regard to entities with multiple business lines, the determination of whether the entity is an ineligible entity depends upon whether the entity’s predominant or core line of business is included in the list of ineligible entities.¹⁴⁰ The above notwithstanding, manufacturers of devices and medical supplies (other than entities that are owned by physicians or their immediate family members) and DMEPOS companies (other than a pharmacy or a physician, provider, or other entity that primarily furnishes services) that are ineligible entities for the value-based safe harbors are eligible for protection under the care coordination arrangements safe harbor for arrangements involving their provision of remuneration in the form of digital health technology.¹⁴¹

OIG finalizes its proposed definition of “value-based purpose” without modification and notes that while neither this definition nor the value-based safe harbors require the parties to actually achieve the value-based purpose, the value-based activities must be reasonably designed to achieve the value-based purpose(s).¹⁴² The final regulations define “coordination and management of care” as “the deliberate organization of patient care activities and sharing of information between two or more VBE participants, one or more VBE participants and the VBE, or one or more VBE participants and patients, that is designed to achieve safer, more effective, or more efficient care to improve the health outcomes of the target patient population.”¹⁴³ OIG emphasizes that the definition requires information sharing in addition to the deliberate organization of patient care activities, and OIG clarifies that although the efforts must be designed to achieve the goals, actual achievement of the goals is not required.¹⁴⁴

All three value-based safe harbors require that the remuneration not be exchanged or used for the purpose of marketing items or services furnished by the VBE or a VBE participant to patients or for patient recruitment activities, but OIG distinguishes between educational purposes and marketing purposes.¹⁴⁵ All three safe harbors also require that the offeror of remuneration “not take into account the volume or value of, or condition the remuneration on: (i) Referrals of patients who are not part of the target patient population; or (ii) Business not covered under the value-based arrangement.”¹⁴⁶ In addition, the value-based safe harbors all require that the VBE or VBE participant, for a period of at least six years, make all materials and records sufficient to establish compliance with the applicable safe harbor available to the Secretary upon request.¹⁴⁷

    ii.        Care Coordination Arrangements Safe Harbor (42 C.F.R. § 1001.952(ee))

The final regulations implement the care coordination arrangements safe harbor to protect in-kind remuneration exchanged between a VBE and VBE participants or between VBE participants pursuant to a value-based arrangement, and does not require any party to assume downside financial risk.¹⁴⁸ The safe harbor includes 13 required elements including a requirement that all recipients pay at least 15 percent of either the offeror’s cost for the in-kind remuneration, or the fair market value of the in-kind remuneration prior to receiving the remuneration if it is a one-time cost, or by making contributions at reasonable, regular intervals if it is an ongoing cost.¹⁴⁹ The final regulations also require that “the parties to the value-based arrangement establish one or more legitimate outcome or process measures that the parties reasonably anticipate will advance the coordination and management of care for the target patient population based on clinical evidence or credible medical or health science support.”¹⁵⁰ Although the outcomes do not actually need to be achieved, they do generally need to: (1) include one or more benchmarks related to improving or maintaining improvements in the coordination and management of care for the target patient population; (2) be monitored periodically, assessed, and prospectively revised as needed to ensure that they continue to advance such coordination and management of care efforts; (3) relate to the remuneration exchanged under the value-based arrangement; and (4) not be based solely on patient satisfaction or convenience.¹⁵¹

In addition, the “safe harbor includes conditions related to written documentation, monitoring, termination, and diversion and reselling of remuneration.”¹⁵² The final regulations specify that the value-based arrangements cannot limit medical decision-making, direct or restrict referrals under certain circumstances, or induce parties to furnish medically unnecessary care or reduce or limit medically necessary care.¹⁵³ The safe harbor includes a writing requirement that enumerates several elements that must be included in written documentation and signed by the parties in advance of, or contemporaneous with, the commencement of the arrangement and any material change to the arrangement.¹⁵⁴

The final regulations require that the in-kind remuneration (which does not include remuneration provided to patients) be used predominantly to engage in value-based activities that are directly connected to the coordination and management of care for the target population and that the remuneration not result in more than incidental benefits to persons outside of that population.¹⁵⁵ The safe harbor mandates reasonable monitoring and assessing on at least an annual basis (or once during the term of an arrangement that lasts less than one year) of the following: the coordination and management of care for the target patient population in the value-based arrangement, any deficiencies in the delivery of quality care under the arrangement, and any progress toward achieving the legitimate outcome process measure(s) in the arrangement.¹⁵⁶ If, as a result of such monitoring, the VBE’s accountable body or responsible person determines that the arrangement has resulted in material deficiencies in quality of care or is unlikely to further the coordination and management of care for the target patient population, within 60 days, the parties must either terminate the value-based arrangement or develop and implement a corrective action plan designed to remedy the deficiencies within 120 days, and if the deficiencies are not remedied within that 120 day period, the arrangement must be terminated.¹⁵⁷

    iii.        Value-Based Arrangements with Substantial Downside Financial Risk Safe Harbor (42 C.F.R. § 1001.952(ff))

The finalized substantial downside financial risk safe harbor protects both monetary and in-kind remuneration exchanged between a VBE and VBE participant pursuant to a value-based arrangement in which: (1) the VBE (or non-payor VBE participant acting on behalf of the VBE) has assumed, or is contractually required to assume within six months, substantial downside risk from a payor under one of three methodologies for a period of at least one year; and (2) a VBE participant has assumed a meaningful share of the VBE’s total risk.¹⁵⁸ Notably, this safe harbor requires that the VBE assume risk from a payor, and permits that assumption of risk to be prospective or retrospective.¹⁵⁹ The payor has the option of being a VBE participant, in which case the safe harbor’s protection will be available provided that the VBE assumes risk from the payor through a value-based arrangement and all other safe harbor conditions are complied with or, if the payor does not wish to be a VBE participant, the VBE can separately contract with the payor to assume substantial downside financial risk but such arrangement will not receive the safe harbor’s protection for any remuneration exchanged between the payor and VBE.¹⁶⁰

In general, for purposes of the safe harbor, the following methodologies to determine “substantial downside financial risk” are available: (1) the shared savings and losses methodology, which requires that the VBE take financial risk equal to at least 30 percent of any losses and that calculations take into account all items and services covered by a payor and furnished to the target patient population, and is not limited to only those items and services furnished by specified VBE participants; (2) the episodic payment methodology, which requires that the VBE take financial risk equal to at least 20 percent of any loss relating to items and services provided to the target patient population pursuant to a defined clinical episode of care (which is designed to be provided in more than one care setting) covered by a payor; and (3) the VBE partial capitation methodology, which requires that the VBE receive from the payor a prospective, per-patient payment that is designed to produce material savings and is paid on a monthly, quarterly or annual basis for a predefined set of services (i.e., less than all of the items and services covered by the payor) furnished to the target patient population.¹⁶¹

The safe harbor requires that VBE participants (other than the payor from which the VBE is assuming risk) “meaningfully share” in the VBE’s substantial downside financial risk by: (1) assuming two-sided risk for at least five percent of the losses and savings realized by the VBE; or (2) receiving from the VBE a prospective, per-patient payment on a monthly, quarterly, or annual basis for a predefined set of services (i.e., less than all of the items and services covered by the payor) furnished to the target population, provided that the VBE participant does not claim payment from the payor for those predefined items or services.¹⁶² In addition, outside of remuneration that meets one of the safe harbor’s methods for assuming risk, any other remuneration exchanged between the VBE and VBE participants must be directly connected to the VBE’s value-based purpose(s) and such remuneration cannot include the offer or receipt of an ownership or investment interest in an entity or any distributions related to such an interest.¹⁶³ The safe harbor would also require that various terms of the value-based arrangement be set forth in a signed writing in advance of, or contemporaneous with, the commencement of the arrangement.¹⁶⁴ Further, the safe harbor incorporates many of the requirements of the care coordination arrangements safe harbor.¹⁶⁵

    iv.        Value-Based Arrangements with Full Financial Risk Safe Harbor (42 C.F.R. § 1001.952(gg))

OIG finalizes the value-based arrangements with full financial risk safe harbor to protect both monetary and in-kind remuneration exchanged between a VBE and a VBE participant pursuant to a value-based arrangement, that is set out in a writing signed by the parties that specifies material terms, in which the VBE (or non-payor VBE participant acting on behalf of the VBE) assumes, or is contractually obligated to assume within one year, full financial risk from a payor for a target patient population for a period of at least one year.¹⁶⁶  For purposes of the safe harbor, “full financial risk” means that, on a prospective basis, the VBE is financially responsible for the cost of all items and services covered by the payor for each patient in the target patient population for a term of at least one year; however, OIG acknowledges that the VBE can limit the number of patients via its selection of the target patient population, provided that legitimate and verifiable criteria, among other requirements, are used in the selection process.¹⁶⁷ OIG clarifies that the term “items and services” only refers to healthcare items, devices, supplies, and services, and does not include anything reasonably related to the provision of those items, although OIG notes that the VBE may choose to assume risk for such reasonably related items and services.¹⁶⁸

The safe harbor does not permit VBE participants (outside of payor participants) to claim payment in any form from the payor for items or services covered under the value-based arrangement or contract between the VBE and payor.¹⁶⁹ Similar to the value-based arrangements with substantial downside financial risk safe harbor, the payor has the option of being a VBE participant, in which case the arrangement may be structured to comply with the value-based arrangements with the full financial risk safe harbor, or the payor can contract separately with the VBE, in which case the safe harbor will not be available to protect remuneration between the VBE and payor.¹⁷⁰

The final regulations require that the remuneration be directly connected to one or more of the VBE’s value-based purposes and that it not include the offer or receipt of an ownership or investment interest in an entity or any distributions related to such interest.¹⁷¹ In addition, the safe harbor requires the VBE to provide or arrange for a quality assurance program for the services furnished to the target patient population that protects against underutilization and assesses the quality of care furnished.¹⁷² While the safe harbor incorporates some additional requirements of the other value-based safe harbors, OIG states that this safe harbor is intended to provide the greatest flexibility because the VBE assumes full financial risk.¹⁷³

    v.        Arrangements for Patient Engagement and Support to Improve Quality, Health Outcomes and Efficiency Safe Harbor (42 C.F.R. § 1001.952(hh))

The final regulations implement the arrangements for patient engagement and support safe harbor to protect nonmonetary patient engagement tools and support furnished by a VBE participant to a patient in a target patient population of a value-based arrangement.¹⁷⁴ The patient engagement tool or support must be furnished by a VBE participant that is a party to the value-based arrangement or its eligible agent (i.e., an entity that is not identified as ineligible to furnish tools and supports under the safe harbor) directly to the patient or the patient’s caregiver, family, or other individual acting on the patient’s behalf.¹⁷⁵ Notably, the patient engagement tool or support cannot be funded or contributed by either a VBE participant that is not a party to the applicable value-based arrangement or an entity that is identified as ineligible under the safe harbor.¹⁷⁶ Further, the patient engagement tool must be an in-kind item, good or service, rather than cash or cash equivalents, with an aggregate annual retail value that does not exceed $500.¹⁷⁷ OIG clarifies that gift cards may meet the in-kind requirement only if their potential use is limited to certain categories of items and services that meet all other elements of the safe harbor and they cannot easily be diverted from their intended purpose or converted to cash.¹⁷⁸ OIG also explains that the safe harbor will not protect waivers of or reductions in patient cost-sharing obligations.¹⁷⁹

Additionally, the patient engagement tool or support must: (1) have a direct connection to the coordination and management of care provided to the target patient population; (2) be recommended by the patient’s licensed healthcare professional; (3) not result in medically unnecessary or inappropriate items or services reimbursed in whole or in part by a federal healthcare program; and (4) advance at least one of five enumerated goals designed to ensure that the tool or support is tied to care coordination, quality of care, and health outcomes.¹⁸⁰ The safe harbor precludes the VBE participant (or any eligible agent on behalf of a VBE participant) from exchanging or using the patient engagement tool or support for recruitment purposes or to market other reimbursable services.¹⁸¹ The final regulations also require that the availability of a tool or support not be determined in a manner that takes into account the patient’s type of insurance coverage.¹⁸²

    vi.        CMS-Sponsored Model Arrangements and CMS-Sponsored Model Patient Initiatives Safe Harbor (42 C.F.R. § 1001.952(ii))

The CMS-sponsored model arrangements and CMS-sponsored model patient initiatives safe harbor is finalized to protect both monetary and in-kind remuneration between or among CMS-sponsored model parties during their participation in a CMS-sponsored model arrangement or a CMS-sponsored model patient incentive for which CMS has determined that the safe harbor is available if certain requirements are met.

The goal of this safe harbor is to provide uniform and predictable requirements for those participating in CMS-sponsored models.¹⁸³  OIG explains that its existing fraud and abuse waivers for CMS-sponsored models will continue in accordance with their terms and that parties can structure arrangements to satisfy the conditions of an applicable waiver or this (or any other applicable) safe harbor.¹⁸⁴

Unlike the above four proposed value-based safe harbors that generally exclude pharmaceutical manufacturers, manufacturers, distributors, and suppliers of DMEPOS, and laboratories from their protection, this safe harbor does not exclude these entity types from protection under the safe harbor if they participate in a CMS-sponsored model and meet all safe harbor requirements.¹⁸⁵ In addition, the safe harbor does not protect remuneration exchanged between CMS-sponsored model parties for activities that occur before the model begins or after the termination or expiration of the model.¹⁸⁶

B.     Cybersecurity Technology and Related Services Safe Harbor (42 C.F.R. § 1001.952(jj))

OIG finalizes the cybersecurity technology and related services safe harbor to protect nonmonetary donations of certain types of cybersecurity technology and services, including certain hardware, provided that they are necessary and used predominantly to implement, maintain, or reestablish effective cybersecurity and meet certain safe harbor requirements.¹⁸⁷ The final regulations protect all types of donors, without any limitations.¹⁸⁸ Similarly, the safe harbor does not restrict the scope of recipients that it protects, including patient recipients.¹⁸⁹ Any hardware donations must be necessary and used predominantly to implement, maintain, or reestablish effective cybersecurity and meet all other conditions of the safe harbor to receive protection under the safe harbor.¹⁹⁰

The terms of the safe harbor are similar to those set forth in the corresponding Stark exception. Additionally, the safe harbor provides that the donor must not condition the donation, or the amount or nature of the technology or services donated, upon future referrals.¹⁹¹ The final regulations also prohibit the donor from shifting the costs of the donated technology or services to any federal healthcare program.¹⁹²

C.    ACO Beneficiary Incentive Programs Safe Harbor (42 C.F.R. § 1001.952(kk))

OIG finalizes the ACO beneficiary incentive programs safe harbor to codify the statutory exception by adopting language nearly identical to the statutory language.¹⁹³ The safe harbor protects incentive payments made by ACOs to assigned beneficiaries under a beneficiary incentive program established under, and in accordance with requirements set forth in, Section 1899(m) of the Social Security Act, provided that the incentive payments are made in accordance with that Section’s requirements related both to ACO beneficiary incentive programs and incentive payments made pursuant to such programs.¹⁹⁴

D.    Modifications to Existing AKS Safe Harbors

The final regulations include various modifications to existing safe harbors. For example, OIG implements several revisions to the EHR safe harbor, at 42 C.F.R. § 1001.952(y), in a similar manner to the changes that CMS codifies to the EHR items and services exception to Stark discussed above. OIG expands the safe harbor to protect cybersecurity software and services as well as items and services donated by an expanded group of donors such as ACOs and health systems.¹⁹⁵ OIG also retains the 15 percent contribution requirement, but adds some flexibility with respect to the timing of payment.¹⁹⁶

In addition, the final regulations modify the personal services and management contracts safe harbor at 42 C.F.R. § 1001.952(d) by removing the conditions pertaining to services provided on a part-time, periodic, or sporadic basis, and most notably, by removing the requirement that the “aggregate” compensation to be paid over the term of the agreement be set in advance.¹⁹⁷ Instead, the safe harbor requires only that the methodology of determining the compensation over the term of the agreement be set in advance.¹⁹⁸  OIG also expands the safe harbor by including a second provision to protect outcomes-based payments between a principal and agent based on the achievement of one or more legitimate outcome measures that: (1) are selected based on clinical evidence or credible medical support; and (2) have benchmarks that are used to quantify improvements in, or the maintenance of improvements in, the quality of patient care and/or material reductions in costs to (or growth in expenditures of) payors, while maintaining or improving quality of care.¹⁹⁹ However, the safe harbor excludes from its protection payments that relate to the achievement of internal cost savings for the principal, payments based solely on patient satisfaction or convenience, and payments made (directly or indirectly) by a list of excluded entities that are excluded from protection under the safe harbor.²⁰⁰ In order to receive safe harbor protection, the outcome-based payments must reward the agent for successfully achieving an outcome measure or recoup from or reduce payment to an agent for failure to achieve an outcome measure.²⁰¹ Further, similar to many other AKS safe harbors, the methodology for determining the aggregate compensation paid via outcome-based payments must be “set in advance, commercially reasonable, consistent with fair market value, and not determined in a manner that directly takes into account the volume or value of any referrals or business otherwise generated between the parties for which payment may be made in whole or in part by a Federal health care program.”²⁰² The safe harbor also requires that the arrangement be set forth in a writing that includes specified terms and is signed by the parties, and that the parties monitor and assess the agent’s performance and benchmarks and, as necessary, revise benchmarks and remuneration under the arrangement.²⁰³

OIG also finalizes modifications to the warranties safe harbor at 42 C.F.R. § 1001.952(g) to: (1) protect warranties for one or more items and services (i.e., bundled warranties) upon meeting certain requirements; (2) require that for warranties for more than one item (or one or more items and related services), the items and services be reimbursed by the same federal healthcare program and in the same federal healthcare program payment; and (3) prohibit a manufacturer or supplier from conditioning a warranty on the buyer’s exclusive use, or minimum purchase of, any items or supplies.²⁰⁴ Notably, the safe harbor only protects warranties that cover at least one item and, therefore, would not protect warranties covering only services.²⁰⁵ The final regulations also expand the definition of warranty to include written affirmations of facts or written promises made in connection with the sale of an item or bundle of items and services, and written undertakings to refund, repair, replace, or take remedial action, provided that enumerated conditions are met.²⁰⁶

Further, the final regulations modify the local transportation safe harbor at 42 C.F.R. § 1001.952(bb) to: (1) expand the distance in which patients residing in rural areas may be transported to 75 miles; and (2) remove the distance limitation on transportation of a patient discharged from an inpatient healthcare facility following inpatient admission or released from a hospital after being placed in observation status for at least 24 hours and transported to the patient's residence (or another residence of the patient’s choice).²⁰⁷  OIG also shares its position that safe harbor protection is available to ride-sharing services that meet safe harbor requirements.²⁰⁸

E.     Amendment to CMP Law for Telehealth for In-Home Dialysis

The final regulations amend the Beneficiary Inducements portion of the CMP Law to permit the provision of certain telehealth technologies by providers of services, physicians, or renal dialysis facilities to individuals with end-stage renal disease (ESRD) who receive home dialysis.²⁰⁹ OIG defines “telehealth technologies” broadly, without specific reference to types of technology, as “hardware, software, and services that support distant or remote communication between the patient and provider, physician, or renal dialysis facility for diagnosis, intervention, or ongoing care management.”²¹⁰

To be protected, such technologies must: (1) be furnished to the patient by the provider of services, physician, or the renal dialysis facility that either is currently providing, or has been selected or contacted by the patient to schedule an appointment for the provision of in-home dialysis, telehealth services, or ESRD care to the patient; (2) not be offered as part of any advertisement or solicitation, and (3) be provided for the purpose of furnishing telehealth services related to the patient’s ESRD.²¹¹

3.      Conclusion

CMS and OIG have finalized many modifications to modernize Stark, the AKS and the CMP Law to ease compliance burdens and promote value-based care. These finalized changes are extensive and CMS and OIG detail thoughtful responses to numerous comments received following publication of the Proposed Regulations. All affected parties should take the full opportunity to consider the impacts of these finalized regulations and make necessary adjustments to noncompliant practices.²¹²

Endnotes

1. The Regulatory Sprint to Coordinated Care was announced by HHS in 2018 as a focus on “identifying regulatory requirements or prohibitions that may act as barriers to coordinated care, assessing whether those regulatory provisions are unnecessary obstacles to coordinated care, and issuing guidance or revising regulations to address such obstacles and, as appropriate, encouraging and incentivizing coordinated care.” 83 Fed. Reg. 29524 (June 25, 2018).  The Regulatory Sprint to Coordinated Care focuses on Stark, the AKS, HIPAA and 42 C.F.R. Part 2. Secretary Azar Highlights Recognition of HHS as Top Agency for Regulatory Reform, U.S. Department of Health & Human Services Press Release (Oct. 17, 2018), available at https://www.hhs.gov/about/news/2018/10/17/secretary-azar-highlights-recognition-of-hhs-as-top-agency-for-regulatory-reform.html. 
2. HHS Makes Stark Law and Anti-Kickback Statute Reforms to Support Coordinated, Value-Based Care, U.S. Department of Health & Human Services Press Release (Nov. 20, 2020), available at https://www.hhs.gov/about/news/2020/11/20/hhs-makes-stark-law-and-anti-kickback-statute-reforms-support-coordinated-value-based-care.html.
3. See HHS Office of Inspector General Fact Sheet: Final Rule: Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements (November 2020), available at https://oig.hhs.gov/reports-and-publications/federal-register-notices/factsheet-rule-beneficiary-inducements.pdf; see also Modernizing and Clarifying the Physician Self-Referral Regulations Final Rule (CMS-1720-F), Centers for Medicare & Medicaid Fact Sheet (Nov. 20, 2020), available at https://www.cms.gov/newsroom/fact-sheets/modernizing-and-clarifying-physician-self-referral-regulations-final-rule-cms-1720-f.
4. HHS Office of Inspector General Fact Sheet: Final Rule: Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements (November 2020), available at https://oig.hhs.gov/reports-and-publications/federal-register-notices/factsheet-rule-beneficiary-inducements.pdf; see also 84 Fed. Reg. 55694 (Oct. 17, 2019), available at  https://www.federalregister.gov/documents/2019/10/17/2019-22027/medicare-and-state-healthcare-programs-fraud-and-abuse-revisions-to-safe-harbors-under-the; see also 84 Fed. Reg. 55766 (Oct. 17, 2019), available at https://www.federalregister.gov/documents/2019/10/17/2019-22028/medicare-program-modernizing-and-clarifying-the-physician-self-referral-regulations.
5. See HHS Makes Stark Law and Anti-Kickback Statute Reforms to Support Coordinated, Value-Based Care, U.S. Department of Health & Human Services Press Release (Nov. 20, 2020), available at https://www.hhs.gov/about/news/2020/11/20/hhs-makes-stark-law-and-anti-kickback-statute-reforms-support-coordinated-value-based-care.html.
6. HHS Office of Inspector General Fact Sheet: Final Rule: Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements (November, 2020), available at https://oig.hhs.gov/reports-and-publications/federal-register-notices/factsheet-rule-beneficiary-inducements.pdf; Modernizing and Clarifying the Physician Self-Referral Regulations Final Rule (CMS-1720-F), Centers for Medicare & Medicaid Fact Sheet (Nov. 20, 2020), available at https://www.cms.gov/newsroom/fact-sheets/modernizing-and-clarifying-physician-self-referral-regulations-final-rule-cms-1720-f.
7. 85 Fed. Reg. 77492 (Dec. 2, 2020).
8. See 85 Fed. Reg. 77492, 77496; see also Modernizing and Clarifying the Physician Self-Referral Regulations Final Rule (CMS-1720-F), Centers for Medicare & Medicaid Fact Sheet (Nov. 20, 2020), available at https://www.cms.gov/newsroom/fact-sheets/modernizing-and-clarifying-physician-self-referral-regulations-final-rule-cms-1720-f.
9. See 85 Fed. Reg. 77493-77494 (Dec. 2, 2020).
10. Id. at 77494.
11. Id. at 77496.
12. Id.
13. Id. at 77662.
14. See id. at 77500 – 77501.
15. Id. at 77497.
16. See id. at 77500.
17. Id. at 77497.
18. Id. at 77498.
19. Id.
20. See id. at 77501.
21. Id.
22. Id.
23. See id. at 77510 – 77511.
24. Id. at 77501.
25. Id.
26. See id. at 77500.
27. Id.
28. See id.
29. Id. at 77498, 77502.
30. Id. at 77662.
31. See id. at 77499.
32. Id.
33. Id.
34. Id.
35. See id.
36. See id. at 77505.
37. See id. at 77508.
38. Id. at 77509.
39. See id.
40. Id. at 77511.
41. Id. at 77512.
42. Id. at 77680-77682.
43. Id.
44. Id.at 77512.
45. Id.at 77510.
46. Id.
47. Id. at 77511.
48. Id. at 77512-77513.
49. Id. at 77511.
50. Id.
51. Id. at 77512
52. Id.at 77515.
53. See id.
54. Id.
55. Id. at 77516.
56. Id. at 77517.
57. Id. at 77518.
58. Id.
59. Id.
60. Id. at 77519.
61. Id. at 77681-77682.
62. See id. at 77519, 77524.
63. Id. at 77519.
64. Id. at 77520.
65. Id.
66. Id.
67. Id. at 77521.
68. Id. at 77525.
69. Id. at 77526.
70. Id. at 77527-77528.
71. See id. at 77528.
72. Id. at 77530.
73. Id.
74. Id. at 77657.
75. Id. at 77531.
76. Id. at 77657.
77. Id. at 77531.
78. Id. at 77537.
79. Id. at 77537, 77667.
80. Id. at 77537.
81. Id. at 77538.
82. Id. at 77544.
83. Id. at 77542.
84. Id. at 77548, 77666; see id. at 77550.
85. Id. at 77548.
86. Id. at 77549.
87. Id. at 77553.
88. Id. at 77554.
89. Id.
90. Id. at 77556
91. Id. at 77558-77559.
92. Id. at 77561.
93. Id.
94. Id. at 77563, 77565.
95. Id. at 77559-77560.
96. See id. at 77566.
97. See id. at 77568.
98. See id. at See id. at 77581-77585.
99. See id. at 77571.
100.   Id. at 77573.
101.   See id. at 77577.
102.   See id at 77572-77574.
103.   See id. at 77587-77589.
104.   See id. at 77591-77592.
105.   Id. at 77591, 77596.
106.   See id. at 77598.
107.   Id. at 77600.
108.   See id. at 77604.
109.   See id. at 77607.
110.   See id. at 77621.
111.   Id. at 77609-77610, 77612-77613, 77615.
112.   Id. at 77616.
113.   See id. at 77623-77624, 77680.
114.   Id. at 77624-77625.
115.   Id. at 77626.
116.   See id. at 77632-77633, 77682.
117.   Id. at 77636, 77639.
118.   Id. at 77636.
119.   See id. at 77641.
120.   HHS Office of Inspector General Fact Sheet: Final Rule: Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements (November 2020), available at https://oig.hhs.gov/reports-and-publications/federal-register-notices/factsheet-rule-beneficiary-inducements.pdf.
121.   85 Fed. Reg. 77688 (Dec. 2, 2020).
122.   Id. at 77685-77686.
123.   Id. at 77686.
124.  See id.
125.   Id. at 77689.
126.   Id. at 77691.
127.   Id. at 77695.
128.   Id.
129.   Id. at 77695, 77697.
130.   Id. at 77696.
131.   Id. at 77698.
132.   Id. at 77700.
133.   Id.
134.   Id. at 77702-77703.
135.   Id. at 77703-77704.
136.   Id. at 77705.
137.   Id. at 77705, 77707.
138.   Id. at 77706.
139.   Id. at 77707; see id. at 77709-77715.
140.   Id. at 77718.
141.   See id. at 77706, 77716-77717.
142.   See id. at 77720.
143.   Id. at 77890.
144.   Id. at 77721-77722.
145.   Id. at 77789-77792.
146.   Id.
147.   Id.
148.   Id. at 77724.
149.   Id. at 77729.
150.   Id. at 77727.
151.   See id. at 77727, 77729.
152.   Id. at 77724.
153.  See id. at 77890.
154.  Id. at 77733-77735.
155.  See id. at 77736-77737.
156.  Id. at 77748.
157.  Id. at 77749.
158.  See id. at 77755.
159.  See id. at 77757, 77759.
160.   See id. at 77763-77764.
161.  See id. at 77756-77758.
162.  Id. at 77760.
163.  See id. at 77766-77767.
164.  See id. at 77891.
165.  See id.
166.  See id. at 77771.
167.  Id. at 77772.
168.  Id. at 77774.
169.  Id. at 77776.
170.  Id. at 77775.
171.  Id. at 77777-77778.
172.  Id. at 77779.
173.  Id. at 77771.
174.  Id. at 77892.
175.  Id. at 77786-77787.
176.  Id. at 77787.
177. Id. at 77806.
178. Id. at 77790.
179. Id. at 77790-77791.
180.  Id. at 77794.
181. Id. at 77797.
182. Id. at 77804.
183. Id. at 77810.
184. Id.
185. Id. at 55731.
186.  Id. at 77814.
187. See id. at 77815-77816.
188.  Id. at 77817.
189.  See id.
190.  Id. at 77821.
191. Id. at 77825.
192. Id. at 77828.
193. Id. at 77864.
194. Id. at 77864-78865.
195. Id. at 77830, 77836.
196.  Id. at 77833.
197. Id. at 77839, 77841.
198.  Id. at 77839.
199.  Id. at 77841.
200.    See id. at 77841-77842, 77847.
201.   Id. at 77841.
202.   Id. at 77887.
203.   Id. at 77848.
204.   See id. at 77848, 77851, 77854.
205.   Id. at 77848.
206.   Id. at 77856.
207.   Id. at 77858.
208.   Id. at 77863.
209.   Id. at 77894.
210.   Id. at 77867, 77895.
211. Id. at 77866, 77869-77871.
212.  HHS Office of Inspector General Fact Sheet: Final Rule: Revisions to the Safe Harbors Under the Anti-Kickback Statute and Civil Monetary Penalty Rules Regarding Beneficiary Inducements (November 2020), available at https://oig.hhs.gov/reports-and-publications/federal-register-notices/factsheet-rule-beneficiary-inducements.pdf; Modernizing and Clarifying the Physician Self-Referral Regulations Final Rule (CMS-1720-F), Centers for Medicare & Medicaid Fact Sheet (Nov. 20, 2020, available at https://www.cms.gov/newsroom/fact-sheets/modernizing-and-clarifying-physician-self-referral-regulations-final-rule-cms-1720-f.