By Rebecca Burke, Esq. and Megan La Suer, Esq., MHA
New safe harbors under the anti-kickback statute, scheduled to take effect January 19, 2021, create additional flexibilities for remote patient monitoring (RPM) companies wishing to partner with health care providers to improve care coordination and management. In a Final Rule issued November 20, 2020, the Department of Health and Human Services (HHS) Office of Inspector General (OIG) added seven new safe harbors that provide protections for, among other things, coordinated care and value-based arrangements; arrangements for patient engagement and support to improve quality, health outcomes and efficiency; and cybersecurity technology and related services. The OIG has also created additional flexibilities under the existing safe harbor for personal service and management contracts.
The Final Rule is part of the administration’s “Regulatory Sprint to Coordinated Care” and was issued in tandem with a separate final rule that creates new and modified exceptions under the Physician Self-Referral or “Stark” law.
RPM companies seeking to enter into arrangements with health care providers must navigate the sometime perilous waters of the Medicare and Medicaid anti-kickback statute. The new HHS OIG final rule eases this process and provides additional clarification as to the types of arrangements that are and are not protected.
Modifications to the Personal Services and Management Contracts Safe Harbor (42 C.F.R. §1001.952(d))
Under the current personal services and management contracts safe harbor, contracts that are periodic or part-time can only qualify for safe harbor protection if the schedule of such services and exact charge for each interval is specified up front. RPM companies seeking to provide services to physician practices or hospitals, such as nurses to assist with care coordination and treatment management services, must often forgo this safe harbor protection if services are to be provided on an as-needed. The Final Rule removes this additional requirement for part-time arrangements, making it much easier for them to meet the terms of this safe harbor.
In addition, the current requirement that aggregate compensation payable under a services contract be set in advance is being replaced with a more flexible requirement that the methodology for determining compensation be set in advance.
The safe harbor still requires that compensation reflect fair market value and not be based on the volume or value of referrals or other business generated between the parties. However, the above changes vastly expand the types of arrangements that may qualify for the personal services and management contracts safe harbor protection.
The OIG has also finalized a new provision within this safe harbor for “outcome-based payments” between a “principal” and an “agent” in which the agent achieves certain outcome measures. The outcome measures must be based on clinical evidence or credible medical support, must have benchmarks used to quantity improvements in patient care and/or reduction in costs. Excluded from protection are payments related solely to achievement of internal cost savings by the principal or based solely on patient satisfaction or convenience.
The new outcome-based payment protection could allow arrangements in which an RPM company is rewarded for helping a healthcare provider achieve certain clinical outcomes.
Value-Based Enterprise Arrangements
Many types of RPM arrangements have, as a primary objective, improving care for patients with chronic conditions and, at the same time, reducing emergency department visits and hospitalizations. For example, RPM devices that detect changes in a patient’s weight or blood pressure let the physician know when a patient with congestive heart failure may need changes in their treatment regimen. The “value proposition” (the ability to improve care and reduce costs) in such arrangements is clear.
Under three new safe harbors for value-based enterprise (VBE) arrangements, eligible participants in such arrangements can more easily collaborate to achieve certain value-based goals. The new safe harbors are designed to protect:
- Certain in-kind and non-monetary remuneration exchanged between qualifying VBE participants to advance value-based activities for care coordination and management (42 C.F.R. § 1001.952(ee));
- In-kind and monetary arrangements where the VBE assumes substantial downside financial risk from a payor (42 C.F.R. § 1001.952(ff)); and
- In-kind and monetary arrangements where the VBE assumes full downside financial risk from a payor (42 C.F.R. § 1001.952(gg)).
The new safe harbors do not, however, protect remuneration given directly to patients.
The first of these new safe harbors which does not require any downside risk is limited to non-monetary remuneration exchanged between VBE participants such as in-kind services, provided they are intended to achieve one of four value-based purposes:
- Coordinating and managing the care of a target patient population;
- Improving quality of care for a target patient population;
- Appropriately reducing costs to payors without reducing quality for the target population; or
- Transitioning from a fee-for-service delivery and payment system to one based on quality of care and control of costs.
This safe harbor would seem the most relevant to RPM companies and it is not difficult to imagine how use of RPM, with its focus on care management and coordination, especially for patients with chronic or high-risk conditions, could play a role in advancing value-based care.
Unlike most other safe harbors, the VBE safe harbor does not require the remuneration from one VBE participant to another to meet the fair market value requirement, nor is there a prohibition on it being tied to volume or value of referrals, provided the remuneration is intended to benefit the target population. This could allow, for example, an RPM company that is a VBE participant to provide services such as a software platform or even clinical staff to another VBE participant (e.g., a physician practice, home health agency, hospital) to help achieve the goals of the VBE.
Some of the criteria that must be met under the VBE care coordination and management safe harbor include:
- The in-kind remuneration cannot be for financial or administrative services;
- The remuneration must be to another VBE participant and not the patient (see discussion below about another safe harbor protecting giving things of value to patients);
- The VBE participant of the in-kind remuneration must contribute 15% of the offeror’s cost or 15% of its fair market value;
- The remuneration must be directly connected to the purposes of the VBE for the targeted population;
- The value-based arrangement is commercially reasonable;
- The terms of the arrangement are set forth in writing and must include the outcome or process measure(s) against which recipient of remuneration will be measured, the target patient population, description of remuneration, offeror’s cost; percent contributed by recipient; and
- The VBE must monitor and assess, at least annually, the VBE’s progress in achieving its goals.
Significantly, this safe harbor is not available to pharmaceutical companies, pharmacy benefit managers (PBMs), laboratories, compounding pharmacies, or most device, supply and DME companies (with one narrow exception for “limited technology participants”).
The two other new safe harbors for VBEs require either substantial or full downside risk from payors and allow for both monetary and non-monetary remuneration. Under these safe harbors, the VBE must accept financial risk if value-based objectives are not achieved.
In addition, RPM companies interested in arrangements that do not qualify for the VBE safe harbors should consider whether the arrangement might be protected under the safe harbor for personal services and management contracts, including the new provision for outcome-based payments.
Arrangements for Patient Engagement and Support to Improve Quality, Health Outcomes, and Efficiency (42 C.F.R. § 1001.952(hh))
This new safe harbor, which does not require downside risk, allows certain VBE participants to provide a “patient engagement tool or support” directly to individuals in the target population of a VBE arrangement that advances certain enumerated goals:
- Adherence to a treatment or drug regimen or follow-up care plan as directed by the patient’s health care professional;
- Prevention or management of a disease or condition as directed by the patient’s health care professional; or
- Ensure patient safety.
Most significant is that the annual value of all remuneration to a specific patient cannot exceed $500 in value.
An arrangement that qualifies for protection under this safe harbor is also considered to be protected under the Beneficiary Inducements Civil Monetary Penalty (CMP) law.
As with the VBE safe harbors, pharmaceutical companies, PBMs, laboratories, compounding pharmacies, DMEPOS suppliers, and medical device distributors are not eligible to use this Safe Harbor. In addition, medical device manufacturers are not eligible to use the safe harbor unless the patient engagement tool or support is digital health technology defined as “hardware, software, or services that electronically capture, transmit, aggregate, or analyze data and that are used for the purpose of coordinating and managing care.”
Other criteria that must be met under this new safe harbor include:
- The patient engagement tool or support must be furnished directly to the patient (or caregiver) by a VBE participant;
- The patient engagement tool or support is an in-kind good or service (no cash or cash-equivalent);
- It must have direct connection to coordination and management of target population;
- It cannot result in medically unnecessary items or services if reimbursed in whole or part by a Federal health care program;
- It cannot be funded by a VBE participant that is not a party to the specific VBE arrangement;
- It must be recommended by the patient’s licensed health care professional; and
- Availability cannot take into account type of insurance patient has.
Like any arrangement, the care provided must be medically necessary for the patient’s condition. This safe harbor might, for example, allow an RPM company that is a participant in a VBE to furnish a patient with an RPM device for use in the home or partner with an assisted living facility and a physician practice to provide RPM devices and monitoring to the facility’s residents provided the RPM service was medically necessary and appropriate.
Cybersecurity and Electronic Health Records Technology (42 C.F.R. § 1001.952(jj))
The OIG has created a new safe harbor intended to permit industry stakeholders to reduce the risk of cyberattacks by allow them to make non-monetary donations of software and cybersecurity technology and related services to help improve the cybersecurity posture of the health care industry. This is in addition to the existing electronic health records (EHR) safe harbor which protects remuneration intended to support EHR. The new cybersecurity safe harbor allows donation of technology that is necessary and used predominantly for cybersecurity purposes. Remuneration can be to patients or health care providers and has no monetary cap provided the donor does not shift the costs to any federal health care program and the donation is not based on volume or value of referrals or other business generated.
The OIG issued “safe harbor” regulations to protect certain payment practices from prosecution or civil sanction under the anti-kickback statute. Compliance with a safe harbor generally ensures protection from prosecution. However, it is important to remember that failure to qualify for a safe harbor does not mean that an arrangement is illegal; instead it will be evaluated based on its specific facts and circumstances. RPM service providers considering modifying business practices based on these new safe harbors should consider having legal counsel review service contracts to ensure an arrangement includes the criteria required to qualify for one of the safe harbors.
For more information, please feel free to contact Rebecca Burke at Rebecca.Burke@PowersLaw.com or Megan La Suer at Megan.Lasuer@PowersLaw.com.
*This article is provided for informational and educational purposes and is not intended to provide legal advice and should not be relied up as such. Readers should consult with an attorney for legal advice regarding the subject matter of this article.