HHS Finalizes New Protections for Value-Based Arrangements and Other Revisions to the Anti-Kickback Statute Safe Harbors and Civil Monetary Penalties Exceptions

On November 20, 2020, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) issued a final rule, "Revisions to Safe Harbors under the Anti-Kickback Statute, and Civil Monetary Penalties Rules Regarding Beneficiary Inducements" (the "Final Rule"), adding seven new safe harbors to protect, among other things, certain coordinated care and value-based arrangements and patient support tools; modifying four existing safe harbors, and adding a new exception to the Civil Monetary Penalties (CMP) provisions related to beneficiary inducement.¹ The Final Rule was published the Federal Register on December 2, 2020. The effective date of the finalized regulations is January 19, 2021.

This rule was issued as part of HHS's "Regulatory Sprint to Coordinated Care" and in conjunction with a final rule issued by the Centers for Medicare and Medicaid Services (CMS) entitled "Modernizing and Clarifying the Physician Self-Referral Regulations".² In addition, OIG issued a separate final rule regarding safe harbors under the Anti-Kickback Statute (AKS), which removes safe harbor protection for rebates from pharmaceutical manufacturers to plan sponsors under Medicare Part D or pharmacy benefit managers (PBMs) under contract with them and creates two new safe harbors to protect certain point-of-sale reductions in price on prescription pharmaceutical products and PBM service fees.

As proposed, and described in more detail below, the final regulations identify certain types of entities that are not eligible to use a number of the new safe harbors because it OIG's view they are not typically on the front lines of care coordination and posed a higher risk of fraud and abuse. Specifically, pharmaceutical manufacturers, distributors, and wholesalers; PBMs, compounding pharmacies, and physician-owned distributors are not rely on the value-based safe harbors (42 C.F.R. § 1001.952(ee)-(gg)), the patient engagement and support safe harbor (42 C.F.R. § 1001.952(hh), or the outcomes-based payments safe harbor (42 C.F.R. § 1001.952(d)(2)). In addition, manufacturers of devices or medical supplies and durable medical equipment (DMEPOS) suppliers generally are ineligible for these safe harbors except for certain limited exceptions involving digital health technology. As a resource, OIG has posted a chart summarizing which types of entities are eligible and ineligible for these new safe harbors.

Below we summarize key aspects of the new and modified safe harbors and new CMP exception, including significant changes from OIG's proposed rule. ³

Safe Harbors to the Anti-Kickback Statute

Value-Based Enterprise Arrangements

The OIG finalizes, with a number of modifications, its proposals to establish three new safe harbors under the AKS for certain remunerative arrangements between eligible participants in a "value-based enterprise" (VBE), which is a network of individuals and entities that collaborate to implement one or more value-based activities (VBAs)⁴ with the intent of achieving at least one of the following four value-based goals:

• Coordinating and managing the care of a target patient population.
• Improving the quality of care for a target patient population.
• Appropriately reducing the costs to, or growth in expenditures of, payors without reducing the quality of care for a target patient population.
• Transitioning from healthcare delivery and payment mechanisms based on the volume of items and services provided to mechanisms based on the quality of care and control of costs of care for a target patient population.

In response to comments including specific examples of remuneration exchanged between VBE participants (or between VBE participants and other entities), the OIG explains that the VBE Safe Harbors are designed to protect a well-defined set of arrangements. In many cases, a different safe harbor (e.g., personal services and management contracts) may be available to protect an arrangement or entities may utilize the OIG advisory opinion process when an arrangement does not fit squarely within a safe harbor. In addition, the OIG frequently reminds stakeholders that the VBE Safe Harbors do not protect remuneration provided by VBE participants to patients and that one would need to look to the beneficiary inducement statute to determine if such remuneration was protected.

While the OIG makes a number of modifications to its VBE proposals in order to clarify the obligations of a VBE and the type of conduct that is protected, the OIG also makes clear that in many cases determining whether certain conduct is protected under a VBE safe harbor is a fact-specific inquiry. As proposed, the OIG requires that the VBE set forth in a written document the purpose and activities of the VBE and establish a governing body that is responsible for monitoring the activities related to its VBAs, among other things.

In the Final Rule, the OIG finalizes modifications to its proposals as to who is an eligible VBE participant. OIG proposed to include physician practices, hospitals, post-acute providers, and payors, as well as other individuals and entities. In the Final Rule, OIG adds to this list pharmaceutical manufacturers; pharmacy benefit managers; pharmacies that primarily compound or dispense compounded drugs; medical device manufacturers and distributers; manufacturers, distributors, and suppliers of durable medical equipment, prosthetics, orthotics, or supplies (DMEPOS); and laboratories. However, remuneration provided or exchanged by these additional entities will not have VBE Safe Harbor protection, with the exception of device and DMEPOS manufacturers and suppliers that qualify as "limited technology participants," as discussed below. OIG does not preclude entities with common ownership with an ineligible entity from being participants in VBEs or utilizing the individual safe harbors, as applicable. OIG suggests that an entity with more than one line of business (e.g., a hospital that runs a clinical lab) should determine what its predominant business is and classify itself accordingly to ascertain the ability of the entity to rely on a VBE Safe Harbor.

The three finalized safe harbors will provide prospective protection for VBEs and progressively greater flexibility in designing an arrangement as the VBE takes on greater downside financial risk for costs and quality of care.

At a high level, the three safe harbors protect:

• Certain in-kind and monetary arrangements where the VBE assumes full downside financial risk from a payor.
• Certain in-kind and monetary arrangements where the VBE assumes substantial downside risk from a payor.
• Certain in-kind remuneration exchanged between qualifying VBE participants for value-based activities that are to care coordination and care management.

OIG has coordinated with CMS to the extent possible to align these safe harbors with the new and revised exceptions under the Stark Law. However, the OIG notes that the alignment is not complete because of differences in the laws (e.g., the Stark Law is a strict liability statute and the AKS is not) and other factors.

The first two safe harbors above will be applicable to arrangements between a healthcare entity(ies) and a payor. VBEs for which the third safe harbor is applicable could be arrangements between a healthcare entity and a payor or between/among healthcare entities.

Under each of these safe harbors, the remuneration cannot take into account the volume or value of referrals of patients who are not in the target population or of business not covered under the VBAs, cannot be used for marketing or patient recruitment, and cannot be used to limit the provision of medically necessary items and services. Additionally, for all the safe harbors, the VBE must have a governing body that monitors the work of the VBE, and the VBA and its material terms must be set forth in a writing, before or contemporaneously with the commencement of the arrangement and revised whenever there is a material change to the arrangement.

Full Downside Financial Risk

The OIG finalizes a safe harbor that protects certain arrangements between VBE participants in a VBE that has assumed full financial risk for the cost of all patient care items and services for each patient in a target patient population. To be protected under the safe harbor, the VBE must be paid on a prospectively determined basis, assume full financial risk within 12 months of the commencement of the VBA, and assume full risk for the target patient population for at least one year.

"Full financial risk" means that the VBE includes a payor or that the VBE has a written contract with a payor such that the VBE assumes full financial risk that is determined prospectively and that the VBE cannot claim payment from the payor for any items or services provided to the target population for at least one year. However, the VBE can enter into arrangements, such as global risk adjustments, risk corridors, reinsurance, or stop-loss agreements, to protect against catastrophic losses so long as the insurance does not shift the financial risk back to the payor. Remuneration cannot be exchanged with the entities listed in the HHS table, cannot be used for marketing or patient recruitment activities, and must be directly related to one or more of the VBE's value-based purposes.

Substantial Downside Financial Risk

The OIG finalizes a safe harbor from the AKS for VBAs between participants in VBEs that assume substantial downside financial risk that protects monetary and in-kind remuneration. To be protected under the safe harbor, OIG finalizes that the VBE must be paid on a prospectively determined basis and assume substantial financial risk within 6 months of the commencement of the VBA, and on a prospective basis for at least one year. Furthermore, each VBE participant must be at risk for a meaningful share of the downside risk. The remuneration must be directly connected to the value-based purposes of the VBE, and the arrangement cannot limit the a VBE's ability to make decisions in the best interest of the patient or direct referrals to a particular provider if the patient expresses a preference for a different provider, the payor determines the provider, or the restriction is contrary to applicable law.

Substantial downside "financial risk" is defined as follows:

• Shared savings with a repayment obligation to the payor of at least 30 percent of any shared losses, where loss is determined based upon a comparison of current expenditures for all items and services covered by the payor and furnished to the target population to a bona fide benchmark designed to estimate the total costs of care;
• A repayment obligation to the payor under an episode of care model of at least 20 percent of any total loss, where loss is determined based upon a comparison to a bona fide benchmark designed to approximate the total cost of care for the defined episode of care, and where the episode of care comprises items and services furnished in more than one site of service (e.g., coverage only of an inpatient stay would not qualify whereas coverage of care across an inpatient stay and a skilled nursing facility would qualify); or
• A prospective per patient payment from the payor for a set of items and services for the target patient population where payment is designed to produce material savings, is paid on a monthly, quarterly, or annual basis for a predefined set of items and services to be furnished to the target population and is designed to reflect the total cost of those items and services.

The OIG defines "meaningful downside financial risk" of a VBE participant as follows:

• Assumes two-sided risk for at least five percent of the losses and savings, as applicable, realized by the VBE pursuant to its assumption of downside financial risk; or
• Receives from the VBE a monthly, quarterly, or annual payment for a predefined set of items and services furnished to the target population that is designed to approximate the total cost of those items and services and the VBE does not claim payment in any form from the payor for those items and services.

Care Coordination Arrangement to Improve Quality, Health Outcomes, and Efficiency

OIG intends this safe harbor to protect VBEs and VBE participants who organize patient care activities and exchange information for the purpose of achieving safer, more effective, and more efficient care to improve health outcomes of the target population. Two examples of such an arrangement are the provision of clinical staff by one entity to another to facilitate discharge planning from a hospital to a nursing home or to prevent readmissions to a hospital from a nursing home.

As a threshold matter, this safe harbor does not require the assumption of downside risk. OIG notes that due to its view that the arrangements that might qualify for this safe harbor are inherently highrisk, the requirements are somewhat different than for the other two value-based safe harbors.

The remuneration exchanged between the VBE and one or more or its participants, or between VBE participants must be "in-kind." Due to the high potential for the remuneration to have benefits beyond those for the target population, the remuneration must be used "predominantly" to engage in VBAs that are "directly connected" to the coordination and management of care for the target population, and the remuneration may not result in more than an incidental benefit to patients outside the target population.

Furthermore, the remuneration may not be used more than incidentally for the recipients' billing or financial management services and, as with the other value-based safe harbors, may not be used for marketing or patient recruitment.

The parties to the arrangement must establish "legitimate" outcomes measures for the arrangement that will advance care coordination and management of the target population and that are related to the remuneration exchanged. OIG proposed to require these measures be evidence based, but it declines to finalize this requirement. Instead, OIG finalizes that the measures need to be "legitimate" for the purpose of the arrangement and be based on clinical evidence or credible medical support. The measures also must have benchmarks that enable the arrangement to determine whether the organization is improving coordination and management of care and must be periodically reassessed to assure they continue to be legitimate, though OIG imposes no requirement that care actually be improved.

The writing setting forth the VBA must include the value-based activities to be undertaken by the arrangement, the value-based purposes of those activities, the target population, a description of in-kind remuneration to be exchanged, the term of the arrangement, and the outcome measures against which the recipient will be evaluated. With respect to the remuneration, the writing must include additional details such as the offeror's cost of the remuneration (based upon a reasonable accounting methodology) or the fair market value of the remuneration, the percentage and amount contributed by the recipient (which must be at least 15 percent of the offeror's cost using any reasonable accounting methodology, or the fair market value of the remuneration), and the frequency of payments for ongoing costs, if applicable.

As with the substantial financial risk safe harbor, the arrangement cannot (i) limit the ability of the VBEs to make decisions in the best interest of the patient or (ii) direct or require referrals contrary to the patient's preference, reflecting determination by the payor, or when contrary to law. Importantly, the arrangement cannot induce the provision of unnecessary care or limit medically necessary care.

Based on comments explaining that care coordination and management could benefit from software platforms that allow for, among other things, remote monitoring of patients, the OIG makes a substantial change to this safe harbor by creating a category of VBE participants called "limited technology participants" whose provision or exchange of remuneration is protected by this safe harbor − but only in a very limited way. A limited technology participant may be a medical device manufacturer or supplier or a manufacturer or supplier of durable medical equipment, prosthetics, orthotics, or supplies but only when such manufacturer or supplier exchanges (as remuneration) digital health technology with a VBE or a VBE participant. However, this exception is very limited because outside of this exception, such entities can be VBE participants but any remuneration they provide or exchange is not protected by this care coordination safe harbor or any of the other VBE Safe Harbors. The universe of limited technology participants is further limited to exclude entities that must report ownership or investment interests under the Federal Sunshine Act. Digital health technology is defined as hardware, software, or services (e.g., internet or connectivity services) that electronically captures, analyzes, aggregates, or transmits data that is used for the purpose of care coordination and management. Importantly, the exchange of remuneration by a limited technology participant cannot be conditioned on the recipient' exclusive use or minimum purchase requirement of the technology. Note that pharmaceutical manufacturers are not allowed to be limited technology participants.

Under this safe harbor, unlike the other VBE Safe Harbors, the VBE must monitor the coordination and management of care of the target population, any deficiencies in such care, and any progress toward achieving the legitimate outcome measures of the VBE. If any deficiencies are identified, or the arrangement is unlikely to further the coordination and management of the target population, the VBE must do one of two things within 60 days of such finding: (1) terminate the arrangement, or (2) develop and implement a corrective action plan within 120 days and if the plan fails, terminate the arrangement.

Exchange of remuneration between a VBE participant and a patient is not protected under this safe harbor. Such remuneration would need to be protected under a different safe harbor or an exception to the beneficiary inducement statute.

Patient Engagement and Support

OIG finalizes its proposal to add a new Patient Engagement and Support Safe Harbor to protect arrangements for patient engagement and support to improve quality, health outcomes, and efficiency), with modifications.

As finalized, the Patient Engagement and Support Safe Harbor protects the provision of in-kind patient engagement tools or supports, furnished directly by a VBE participant to a patient in a target patient population if the tool or support is directly connected to the coordination and management of care and all other conditions of the Safe Harbor are met. OIG finalizes that the tools or supports must advance one or more specifically enumerated goals: (i) adherence to a treatment regimen, drug regimen, or follow-up care plan as determined by the patient's health care professional; (ii) prevention or management of a disease or condition, as directed by the patient's health care professional; or (iii) ensuring patient safety.

As noted above, based on OIG's stated concern that certain entities could misuse this safe harbor to offer remuneration to beneficiaries as a means to market products and services, the following entities are ineligible to use the Safe Harbor to furnish protected remuneration to patients, regardless of whether such entities are VBE participants: (i) pharmaceutical manufacturers, wholesalers, and distributors; (ii) PBMs; (iii) laboratories; (iv) compounding pharmacies; (v) DMEPOS suppliers; and (vi) medical device distributors or wholesalers that are not otherwise manufacturers of devices or medical supplies, including physician-owned distributors.

Additionally, medical device manufacturers generally are not eligible to use this safe harbor, except with respect to digital health technology. In a change from the proposal, manufacturers of devices or medical supplies are eligible for protection under the Safe Harbor, but only to the extent that the tools and supports they provide to patients meet the definition of digital health technology, as defined in the Final Rule. However, eligible VBE participants, other than manufacturers of devices or medical supplies, are not limited to digital heath technology as long as all applicable conditions of this safe harbor are met.

Types of Remuneration

OIG explains that the types of renumeration eligible for protection under the Safe Harbor include all in-kind items, goods, and services that otherwise meet all applicable conditions of the Safe Harbor. Although OIG proposed to include specific types of protected in-kind items, goods, or services (i.e., preventive items, goods, or services; health-related technology and patient health-related monitoring tools and services; and supports and services designed to identify and address "social determinants of health"), OIG has decided not to specify such protected categories in the final regulations. OIG notes that its policy is to be "agnostic" to the types of in-kind tools and supports that can be protected by the Safe Harbor, as long as all the safe harbor conditions are met.

As proposed, the annual, aggregate retail value of the tools or supports provided to a particular patient cannot exceed $500 a year. OIG does not finalize a proposed exception that would have permitted a VBE participant to exceed the cap for patients with demonstrated financial need, but the Final Rule does provide that the cap will be adjusted annually for inflation.

The Final Rule protects only in-kind remuneration, excluding cash and cash equivalents, but it does not expressly prohibit gift cards, as OIG had proposed. OIG notes that some gift cards in limited circumstances may appropriately be considered in-kind remuneration eligible for Safe Harbor protection. For instance, OIG would consider a voucher for a particular tool or support (e.g., a meal voucher or a voucher for a taxi) to satisfy the Safe Harbor's in-kind requirement. However, consistent with OIG's treatment of these issues in prior regulations, debit cards, rebate checks, and most gift cards are considered by OIG to be cash equivalents and not a protected form of in-kind remuneration under the Safe Harbor. Further, cost-sharing waivers or other tools and supports designed to effectuate a waiver of beneficiary cost-sharing are not protected under the finalized Safe Harbor.

Additional Safeguards

OIG finalizes a number of additional safeguards as conditions of Safe Harbor protection:

• The VBE participant or eligible agent cannot exchange or use the tools or supports to market other federally reimbursable items or services, or for patient recruitment purposes.
• The tool or support must be recommended by the patient's licensed health care professional and cannot result in medically unnecessary or inappropriate items or services reimbursed by a Federal health care program.
• The availability of a tool or support cannot be determined in a manner that takes into account the type of insurance coverage of the patient (replacing OIG's proposal to require VBE participants to provide the same tools or supports to an entire target patient population).
• Materials and records sufficient to establish compliance with the Safe Harbor must be made available to the Secretary upon request, and such records must be kept for a period of at least 6 years.

For various reasons related to feasibility, OIG chose not to finalize a number of other safeguards, such as:

• Prohibiting protection for remuneration where the VBE participant knows or should know that the tool or support is likely to be diverted, sold, or misused by the patient.
• Requiring VBE participants to use "reasonable efforts" to monitor the effectiveness of the tool or support in achieving the intended benefit and to retrieve an item or good from a patient in certain circumstances.
• Prohibiting VBE participants from billing payors, including Federal health care programs, for the tool or support; claiming the value of the tool or support as bad debt; or otherwise shifting the burden of the value of the tool or support onto payors, including Federal health care programs. OIG noted that it did not believe the addition of a cost-shifting prohibition would add appreciable additional protection for programs or patients and that it did not want to foreclose safe harbor protection for the variety of arrangements with payors, including reimbursement terms that permit certain costs to be passed on to third-party payors. OIG explained that if a tool or support is a covered item or service under a Federal health care program and a VBE participant appropriately obtains full payment for such tools or supports in accordance with applicable rules, then the VBE participant has not transferred any remuneration to a beneficiary and does not implicate the AKS.⁵

Personal Services and Management Contracts and Outcomes Based Payments

OIG finalizes the modifications to the existing Personal Services and Management Contracts Safe Harbor as proposed, and finalizing a new provision for outcomes-based payments with modifications, as summarized below.

Final Changes to the Existing Personal Services Safe Harbor

First, OIG is replacing the current Safe Harbor requirement that the aggregate compensation payable under the services arrangement is set in advance with a requirement that the methodology for determining the compensation paid to the agent over the term of the agreement is set in advance. Compensation must still reflect fair market value, be commercially reasonable, and not take into account the volume or value of referrals of business otherwise generated between the parties. OIG emphasizes that parties seeking protection under this safe harbor must "evaluate the specific facts and circumstances of their arrangement to determine whether the compensation methodology over the term of the agreement is set in advance before any payment under the arrangement is made."

Second, OIG eliminates entirely the current requirement that, if any agreement provides for services on a periodic, sporadic or part-time basis, the contract must specify the schedule, length and the exact charge for such intervals. The removal of these part-time arrangement requirements will afford parties additional flexibility to contract for services on an as-needed basis and more closely aligns the Safe Harbor with the personal arrangements exception to the Stark Law.

Safe Harbor Protection for Certain Outcome-Based Payments

OIG finalizes, with modifications, a new provision within this Safe Harbor to protect "outcome-based payments" between a "principal" and an "agent" that reward improvements in, or maintenance of improvements in, the quality of patient care, and/or that appropriately reduce payor costs while improving or maintaining quality of care. OIG revises its proposed definition of "outcomes-based payment" to clarify that the payment may be either a reward for successfully achieving an outcome measure or a recoupment or reduction in payment for failure to achieve an outcome measure. OIG finalizes its proposal to exclude from the definition of "outcomes-based payments" any payments (i) related solely to the achievement of internal cost savings for the principal or (ii) based solely on patient satisfaction or convenience measures. Additionally, OIG finalizes safeguards to protect clinical decision-making; guard against stinting on care; ensure written documentation, monitoring, and periodic assessment of outcome measures under the arrangement; and require corrective actions for deficiencies in quality of care.

OIG also finalizes its proposal to exclude from the safe harbor protections pharmaceutical manufacturers; PBMs; DMEPOS companies; laboratories; medical device manufacturers; medical device distributors or wholesalers; and compounding pharmacies.

Warranties

The existing Warranties Safe Harbor protects the exchanges of value pursuant to a warranty agreement "provided by a manufacturer or supplier of an item to a buyer (such as a health care provider or beneficiary)," as long as certain conditions are met. OIG finalizes as proposed the following changes to the Warranties Safe Harbor:

• Update the definition of "warranty" to provide a direct definition rather than through reference to the definition of "written warranty" in the Magnuson-Moss Act. The new definition continues to include agreements promising that warranted items or services "will meet a specified level of performance over a specified period of time," which OIG interprets to include arrangements conditioned on clinical outcome guarantees (provided the arrangements meet all of the safe harbor's requirements; however, OIG did not provide specific examples of the types of clinical outcomes guarantees that might be protected because they "do not wish to narrow the scope of innovative arrangements that might seek coverage under the safe harbor").
• Expand the Safe Harbor to encompass warranty arrangements for one or more items (i.e., bundled items) and related services, as long as all federally reimbursable items and services subject to the warranty are reimbursed (1) by the same Federal health care program, and (2) in the same payment (e.g., where items or services are reimbursed by Medicare Part A in the same DRG payment). The bundle must include at least one item; the Safe Harbor does not protect warranties covering services only.
• Exclude beneficiaries from the reporting requirements applicable to buyers of products because beneficiaries do not report costs to the government.
• Limit remuneration to any individual (other than a beneficiary) provided under a warranty to the cost of the items and services subject to that warranty.
• Prohibit manufacturers and suppliers from conditioning warranties on either the exclusive use of one or more items and services or on minimum purchase requirements.

Under the Safe Harbor, a warrantied bundle of items and services could encompass services offered by the manufacturer that are not federally reimbursable and are offered free of charge, although the Safe Harbor only protects remuneration provided as a warranty remedy; services offered for free by manufacturers would not themselves be protected under this safe harbor.OIG notes that items or related services with an independent value to the buyer would require the protection of a different safe harbor.

CMS-Sponsored Models

CMS-Sponsored Model Arrangements

OIG finalizes a new Safe Harbor that would protect certain remunerative arrangements between or among "parties" to a CMS-sponsored model "for which CMS has determined that the safe harbor is available" and protect "participants" that furnish certain incentives to patients in such a model. "CMS-sponsored model" means: (1) a Phase I or Phase II model sponsored by the Center for Medicare and Medicaid Innovation (CMMI); or (2) the Medicare Shared Savings Program. The purpose of this safe harbor is to "reduce the need for model-by-model waivers of fraud and abuse laws;" however, CMS still must specify that the Safe Harbor is available for the particular model. OIG finalizes the Safe Harbor as proposed with some minor modifications. The Safe Harbor includes, among other requirements, the following:

• The parties reasonably determine that their arrangement will advance one or more of the model's goals.
• The arrangement does not induce providers or suppliers either to furnish medically unnecessary care or to reduce or limit medically necessary care to any patient.
• The parties do not offer, pay, solicit, or receive remuneration in return for, or to induce or reward, any Federal health care program business outside of the CMS-sponsored model.
• The parties document their arrangement (including the activities to be undertaken and the remuneration to be exchanged) in a writing signed by the time the arrangement begins.

CMS-Sponsored Model Patient Incentives

The Safe Harbor also protects certain patient incentives furnished by "participants" in a CMS-sponsored model for which CMS has decided the Safe Harbor is available. CMS would define in the participation documentation the incentives permitted under the model or program and/or those prohibited, as well as which entities may provide an incentive. OIG contemplates that the Safe Harbor could protect a broad scope of incentives if permitted by CMS, including, for example, transportation, nutrition support, home monitoring technology, or gift cards.

The Safe Harbor requires, among other things, that:

• The participant reasonably determines that the patient incentive will advance one or more of the model's goals; and
• The patient incentive has a "direct connection to the patient's healthcare."

Accountable Care Organization Beneficiary Incentive Programs

Accountable Care Organizations (ACOs) in certain two-sided risk models may operate CMS-approved beneficiary incentive programs, intended to encourage beneficiaries to obtain medically necessary primary care services. These beneficiary incentive programs operate under § 1899(m) of the Social Security Act (SSA); CMS finalized regulations implementing this provision in December 2018.

OIG finalizes as proposed a Safe Harbor codifying in regulations a statutory exception to the definition of "remuneration" in the AKS, which provides that remuneration does not include an incentive payment made to a Medicare fee-for-service beneficiary by an ACO's beneficiary incentive program. The Final Rule uses language nearly identical to that in the statute, with two exceptions designed to sharpen the focus. First, the new Safe Harbor applies only to incentive payments made by the ACO to the ACO's assigned beneficiaries. Second, for an incentive payment to satisfy the statutory exception and thus to qualify for the corresponding proposed safe harbor, all of the requirements regarding incentive payments that are enumerated in SSA § 1899(m) and those alone, must be satisfied.

Local Transportation

OIG finalizes its proposed modifications to the existing Safe Harbor for local transportation with the goal of easing rural mileage and other restrictions. First, OIG increases the distance patients residing in rural areas may be transported, from 50 miles to 75 miles. Second, OIG removes mileage limits on transporting a patient who is discharged from a health care facility following either (i) inpatient admission or (ii) at least 24 hours under observation status from that facility to the patient's place of residence or another residence of the patient's choice, regardless of whether the patient resides in an urban or rural area. In addition, OIG reiterates its position that the current Safe Harbor already applies to all ride-sharing services and declines to extend safe harbor protection to transportation for non-medical purposes.

Cybersecurity and Electronic Health Records Technology

Cybersecurity Technology Safe Harbor

In the Final Rule, OIG finalizes the creation of a new Cybersecurity Technology and Related Services Safe Harbor with modifications. The new Safe Harbor is designed to allow industry stakeholders to mitigate the risk of cyberattacks by protecting non-monetary donations of software and certain hardware (as limited by the conditions of the Safe Harbor) used for cybersecurity purposes. We highlight the following key points from the Final Rule:

• "Necessary and used predominantly" standard: OIG maintained the requirement that to be eligible for safe harbor protection, the donated technology (both software and hardware) must be "necessary and used predominantly" for cybersecurity purposes.
• Protected parties: In the proposed rule, OIG solicited comments on the types of donors who should be protected under this safe harbor (for example, by limiting eligible entities to those with "direct and primary patient care relationships," and that "provide[] services and submit[] claims"). In the Final Rule, OIG declines to finalize such a limit; instead, the final regulation protects, as long as the arrangement complies with the other conditions of the safe harbor. Likewise, OIG finalizes its proposal to protect, even if the recipient is a patient. Notably, the scope of protected parties is significantly broader than in the EHR Safe Harbor, which protects donations to and from only certain types of entities.
• No monetary cap: In the proposed rule, OIG solicited comments on whether to include a monetary value limit as part of this safe harbor. OIG declines to finalize such a condition in the Final Rule.
• No "alternative proposal" to require a risk assessment for hardware donations: In the proposed rule, OIG suggested an "alternative proposal" that would have required parties to conduct a risk assessment prior to donating hardware. OIG declines to finalize this proposal but nonetheless encourages parties to conduct such risk assessments.

Finally, OIG emphasizes the consistencies between requirements in the new Safe Harbor and existing EHR Safe Harbor, noting that certain cybersecurity software may be donated under either safe harbor.

Electronic Health Records Safe Harbor

OIG finalizes a modified version of its proposal making certain changes to the existing EHR Safe Harbor, including provisions that:

• Eliminate the sunset provision and the prohibition on donation of EHR items and services if the recipient possesses items or services equivalent to those to be donated.
• Add language that explicitly protects cybersecurity software and services related to EHR.
• Make minor clarifying updates to the "deeming" provision.
• Modify the definition of "interoperable" to align with the statutory definition of "interoperability" in the 21^st Century Cures Act.
• Expand the scope of protected donors to include entities health care providers currently eligible for EHR Safe Harbor protection (e.g., accountable care organizations and health systems). Donations made by laboratories, manufacturers, or suppliers of items remain ineligible for safe harbor protection.

Exceptions to the CMP Provisions Related to Beneficiary Inducement

Telehealth for In-Home Dialysis

The Bipartisan Budget Act of 2018 amended the Social Security Act to permit an individual with end stage renal disease (ESRD) receiving home dialysis to elect to receive their monthly ESRD-related clinical assessment via telehealth. In a complementary change, this law also created a new exception to the definition of "remuneration" in the Beneficiary Inducement CMP for the provision of telehealth technology. In the Final Rule, OIG codifies this exception in regulation and finalizes, with modifications, additional safeguards.

The final exception excludes from the definition of remuneration telehealth technologies provided by a provider of services, physician, or renal dialysis facility to an individual with ESRD receiving home dialysis under Medicare Part B, if such telehealth technologies: (i) are furnished by the patient's current provider (or a provider the patient has selected or contacted to schedule an appointment or provide services); (ii) are not offered as part of any advertisement or solicitation; and (iii) are provided for the purpose of furnishing telehealth services related to the patient's ESRD.

OIG's final definition of telehealth technologies is broader than its proposal and includes "hardware, software, and services that support distant or remote communication between the patient and provider, physician, or renal dialysis facility for diagnosis, intervention, or ongoing care management." This definition includes all of the technologies that the agency proposed as constituting telehealth technologies (i.e., multimedia communications equipment, including audio and video equipment permitting two-way, real-time interactive communication with the patient), as well as technologies that OIG specifically had proposed to exclude from the definition (i.e., telephones, facsimile machines, and electronic mail systems). OIG explains that the final definition is "technology agnostic" as long as the technology supports provider and patient communication for diagnosis, intervention, or ongoing care management, and otherwise meets all conditions of the exception.

Despite its concerns that the provision of telehealth technology with substantial independent value might induce beneficiaries to choose a particular provider, OIG elects not to finalize a requirement that the telehealth technologies not be of "excessive" value. Nevertheless, OIG notes that the value of the telehealth technologies provided to a patient may be a consideration used to assess whether the provision of such technology meets the finalized condition that "telehealth technologies are provided for the purpose of furnishing telehealth services related to the individual's [ESRD]." In other words, depending on the facts and circumstances, technology of excessive value could indicate to OIG that the technology is not being provided for the sole purpose of furnishing telehealth services related to the individual's ESRD.

General Applicability of Anti-Kickback Statute Safe Harbors to Beneficiary Inducement

Arrangements that fit in an AKS statutory exception or regulatory safe harbor are also protected under the Beneficiary Inducements CMP. Therefore, the safe harbors finalized in this Final Rule offer protection under the Beneficiary Inducements CMP as well as the AKS. Note that OIG's position is that the converse is not true: arrangements that fit in a CMP exception are not automatically protected under the AKS.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.