CMS-855A - Responses to 60-day comments

CMS-855A: Responses to 60-day Public Comments

Comment: A commenter expressed support for many of the Form CMS-855A changes we proposed. Response: We appreciate the commenter’s support.

Comment: Two commenters opposed the proposed removal of Section 2(A)(4) of the Form CMS-855A, which asks the provider whether it is a physician-owned hospital.  The commenters indicated that this is inconsistent with the spirit of section 6001 of the Patient Protection and Affordable Care Act, which amended section 1877 of the Social Security Act (the Act) to, in part: (1) impose certain requirements on physician-owned hospitals (POHs); and (2) prohibit POHs from expanding facility capacity absent an exception.  They also asked CMS to collect certain additional information regarding physician ownership or investment in hospitals.                                                                                                                                            

Response: Upon further consideration, we will retain current Section 2(A)(4) in the revised Form CMS-855A.  However, we did not propose to modify the Form CMS-855A with respect to the additional information commenters requested and believe it would be inappropriate to make such modifications without proposing them via the PRA process and providing a 60-day notice in the Federal Register.

                                                               Comment: A commenter opposed our addition of provider-based checkboxes in Section 4(A) that would identify the type of provider-based hospital practice location. Several of these checkboxes include the following language, “….and satisfies applicable requirements at 42 CFR § 413.65”, the provisions of which outline requirements for provider-based status. The commenter contended that this amounts to requiring the provider to attest that it meets § 413.65’s requirements. Yet the commenter stated that such attestations have been voluntary for many years. The commenter recommended that the above-quoted language regarding compliance be stricken from these checkboxes, adding that these changes to Section 4A will not reduce burden.

Response: While, as explained in the supporting statement, the checkboxes will increase the information collection burden for some providers, this data is necessary to help CMS ensure that payments are accurately made in provider-based situations. Concerning the quoted material that the commenter cites, we do not believe that marking a checkbox containing this language amounts to a provider-based attestation. However, we have deleted the above-quoted language from the applicable checkboxes so as to avoid confusion and provider concerns.

Comment: A commenter stated that the eight new categories of provider-based departments (as denoted in the Section 4(A) checkboxes) are unclear. As an example, the commenter expressed uncertainty as to which boxes should be checked for an off-campus dedicated emergency department (ED). Such a facility, the commenter contended, would be both a “dedicated emergency department (ED)” (the third checkbox for outpatient provider-based department (PBD) sites), an outpatient PBD that is “off-campus” of the main provider (the fourth checkbox), and an outpatient PBD that is “excepted off-campus” pursuant to 42 CFR § 419.48(b). The commenter added that this language is unnecessary to the implementation of Section 603 of the Bipartisan Budget Act of 2015 (Pub. L. 114-74), for CMS has required providers to use the “PO” and “PN” modifiers on claim forms to report excepted and non-excepted off-campus PBDs since January 1, 2017. Another commenter noted that these modifiers essentially make the provider-based questions redundant and unneeded because they already indicate to CMS the status of each service and PBD.

Response: To the extent needed, we will issue sub-regulatory guidance to clarify the checkboxes once the revised form has been released for public use. As for the comments regarding modifiers, there is a difference between (1) identifying a department on the enrollment form via checkboxes and (2) billing services on a claim.  The modifiers were created and tied to individual services on a claim.  If all the services billed on outpatient claims were always from the same department, there would be no need for modifiers.  However, the structure of OPPS is such that services rendered by many departments are on the same claim, which necessitates the provider to identify them for payment purposes.  The modifiers augment the information furnished on the enrollment application to ensure accurate provider billing and payment, especially when OPPS billings include services from multiple departments.  We thus do not believe the provider-based questions are redundant and unnecessary.

Comment: Commenters expressed concern about new Section 4(C)(2), which asks providers whether they store their records electronically and, if so, to identify where/how these records are stored; the section notes that the location can be a website, URL, in-house software program, online service, vendor, etc., but it must be an electronic storage site that CMS or its designees can access if needed. The commenters requested that CMS eliminate this question or least significantly modify it. They stated that: (1) public disclosure of this data could create significant cybersecurity risks for providers (especially given the increased targeting of hospitals and health systems by cyber adversaries); and (2) the disclosure of a link accessible by CMS or its designees would be inconsistent with security standards. One commenter contended that any question on the Form CMS-855A regarding electronic medical record storage should be as narrow and targeted as possible and minimize the creation of new risks. In this context, the commenter suggested that: (1) the language in Section 4(C)(2) regarding CMS access could be rephrased to reference a site “to which CMS or its designees can be provided access if necessary”; and/or (2) CMS simply ask whether the provider has a record retention policy that addresses electronically stored patient medical records (similar to existing Section 2(A)(3) of the Form CMS-855A regarding hospital compliance plans). Response: After reviewing these comments and recognizing the commenters concerns, we have revised the language regarding the identification of electronic record storage to state: “[I]f yes, identify the service used to store these records below. This can be an in-house software program, online service, vendor, etc.” An actual website need not be disclosed but only a general reference to the type of electronic storage (e.g., “online service”).

Comment: A commenter expressed uncertainty about: (1) the circumstances under which CMS would access the records’ electronic location; (2) which “designees” would have access to this information, and, if access is granted, how the location and the electronic data would be protected against breaches; and (3) how CMS would use this information. The commenter also suggested that CMS review its proposed changes, as well as the three issues mentioned in the prior sentence, with the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBIs). Response: As has long been the case with paper record facilities reported via the Form CMS-855A, CMS would request access to, and use, electronic records only for purposes and via means specifically authorized under federal law, and CMS will take every security precaution in doing so. As CMS already consults with law enforcement on numerous matters, including information security and criminal investigations, we do not believe separate discussions with DHS and the FBI on Section 4(C)(2) are necessary.

Comment: A commenter stated that the instructions for Section 4(C)(2) are unclear on three grounds: (1) whether the question is soliciting information regarding the location of the electronic data (e.g., local servers, the cloud) or the software platform used to store the data; (2) how a provider would complete this question if the “where” and “how” involve different vendors and in-house solutions; and (3) how a hospital would complete this question if it has multiple storage sites for these records. Response: As needed, we will issue sub-regulatory guidance on these topics once the revised form has been released for public use. (We note that the “where” and “how” references in the commenter’s second ground have been removed per our previously mentioned revision to Section 4(C)(2).) Comment: Commenters opposed the addition to Section 5(A) of the question asking whether the listed owning/managing entity is itself owned by any other organization or any individual. In this regard, a commenter expressed concern that the Form CMS-855A is being expanded with questions that do not improve provider enrollment’s gatekeeping function and create unwarranted provider administrative burden. Another commenter stated that it would enable CMS to implement its September 10, 2019 provider enrollment final rule with comment period (84 FR 47794), which the commenter believed contained overly burdensome and unworkable provisions; the commenter asked CMS to: (1) postpone adoption of this question until it can assess whether providers can realistically answer it; and (2) state the reason for the question and whether it is connected with the September 10, 2019 rule. Response: We disagree that the new Section 5(A) question would fail to strengthen provider enrollment screening. To the contrary, we have found that existing Section 5 does not furnish CMS with enough data to fully ascertain the breadth of the provider’s indirect ownership relationships and, equally important, to confirm that all 5 percent or greater indirect owners are reported. The new query, which is unrelated to the aforementioned final rule, will help alleviate these issues by better enabling CMS to identify actual and potential indirect owners and their linkages to other parties. Comment: A commenter opposed the addition of checkboxes in Section 5 via which a provider would indicate whether a listed entity is a private equity company (PEC) or real estate investment trust (REIT). The commenter believed that: (1) the supporting justification for this addition disparages private equity owners without any evidence or basis; and (2) whatever concerns exist regarding PEC and REIT skilled nursing facility (SNF) ownership does not mean other provider types should be required to report this data. Response: We respectfully disagree with the commenter. We outlined our concerns regarding PECs and REITs in a proposed rule published in the Federal Register on February 15, 2023 titled “Medicare and Medicaid Programs; Disclosures of Ownership and Additional Disclosable Parties Information for Skilled Nursing Facilities and Nursing Facilities” (88 FR 9820). We cited reports that documented quality of care concerns with private-equity owned SNFs. Although the February 15, 2023 proposed rule contained Medicare reporting requirements specific to SNFs, our inclusion of these definitions in the proposed revised Form CMS-855A is due to our concern about PEC and REIT ownership and management across the entire health care spectrum and not simply in relation to SNFs. In this same vein, and as a follow-up to our proposed Form CMS-855A revisions regarding PECs and REITs, we proposed in the Fiscal Year 2024 Inpatient Prospective Payment System proposed rule (placed on display at the Federal Register on April 10, 2023) to apply the definitions of private equity company and real estate investment trust (first proposed in the aforementioned February 15, 2023 proposed rule) to all providers and suppliers that complete the Form CMS-855A.

Comment: A commenter stated CMS should increase its burden estimate for completing the provider-based checkboxes in Section 4(A). The commenter believed that our 15-minute estimate is too low given that the provider may need to perform research before furnishing the requested data. Response: While we have increased our burden estimate to 30 minutes, we believe most hospitals will already know whether a particular location is provider-based and which specific checkbox in Section 4(A) should be marked. We therefore believe that an estimate greater than 30 minutes is unnecessary.

Comment: A commenter stated that as much information as possible about the provider enrollment and revalidation processes should be provided to Form CMS-855A applicants. The commenter accordingly suggested that the Form CMS-855A refer applicants to the CMS Program Integrity Manual.

Response: While we appreciate this comment, the Form CMS-855A refers applicants to https://www.cms.gov/Medicare/Provider-Enrollment-and-Certification, which contains detailed data about provider enrollment. Providers and suppliers have found the information at this link to be helpful, and we wish to continue to refer applicants thereto. Comment: A commenter stated that Section 2 of the Form CMS-855A contains an option for a home health agency (HHA) to enroll as a sub-unit. The commenter stated that HHA sub-units were eliminated several years ago.

Response: We agree and will delete the HHA sub-unit checkbox from Section 2.

Comment: A commenter asked CMS to clarify the following matters related to the final adverse actions listed in Section 3 of the Form CMS-855A: (1) which types of revocations, suspensions, federal sanctions, and Medicaid/federal health care program exclusions, revocations, or terminations must be disclosed; (2) whether a payment suspension based on a late-filed cost report must be disclosed even if the cost report was later filed and the payment suspension lifted; (3) whether a payment suspension resulting from the application of alternative sanctions or enforcement remedies during a Medicare recertification survey; (4) whether an outstanding debt to the Medicare program that is nonetheless being recovered must be disclosed; and (5) when the 10-year period for disclosing certain actions in Section 3 begins. The commenter expressed concern that the data in (2), (3), and (4) would have to be reported, and recommended that CMS furnish examples of cases when the actions described in Section 3 need not be disclosed.

Response: The CMS Program Integrity Manual (PIM) already outlines the parameters of some of the adverse actions the commenter describes. (See Section 10.6.6 of Chapter 10 of the PIM.) For those actions that the PIM does not currently address, CMS will, as needed, issue sub-regulatory guidance once the revised form has been released for public use.

Comment: Commenters recommended that CMS identify on the application the potential liabilities or consequences if the provider does not disclose an adverse legal action against an owner or managing employee. The commenter believed this could encourage more accurate and complete disclosures on the application.

Response: We note that Sections 14 and 15 of the Form CMS-855A already discuss potential penalties for furnishing false or misleading information on the application. We also refer the commenter to §§ 424.530(a) and 424.535(a)(4), which permit CMS to, respectively, deny or revoke enrollment if the provider submitted false or misleading information on the enrollment application to be enrolled or maintain enrollment in the Medicare program.

Comment: A commenter stated that our following two estimates in the supporting statement are too low: (1) 45 minutes to report the two adverse actions being added to Section 3; and (2) 12 minutes to report organizational owners/managers’ phone numbers and electronic addresses is Section 5.

Response: Our 45-minute and 12-minute projections align with our prior estimates and experience with providers’ disclosure of adverse actions and telephone numbers/e-mail addresses. We therefore believe they should be retained.