OIG finalizes new and modified anti-kickback safe harbors

On November 20, the Office of Inspector General (OIG) and the Centers for Medicare & Medicaid Services (CMS) of the U.S. Department of Health and Human Services (HHS) issued final rules, revising regulations under the Federal anti-kickback safe harbor and beneficiary inducement civil monetary penalty (CMP) regulations (the OIG final rule) and the Medicare physician self-referral law known as the “Stark Law” (the CMS final rule). Both final rules were published in the Federal Register on December 2, and contain provisions designed to help transform healthcare by promoting a shift toward value-based care, providing greater flexibility for healthcare providers, and reducing regulatory risks in the delivery of patient care. This alert provides a general overview of various safe harbor provisions from the OIG’s final rule. See our Stark Law Alert for an overview of the CMS final rule.

In general, the anti-kickback statute (42 USC § 1320a-7b(b)) prohibits the offer, solicitation, payment or receipt of direct or indirect remuneration in exchange for, or to induce, referrals of items or services payable under a federal health care program, such as Medicare or Medicaid. Over the years, the OIG has published various “safe harbor” regulations, which define arrangements that it has determined are unlikely to result in fraud and abuse. Any arrangement that satisfies all elements of a safe harbor regulation is not subject to prosecution or sanction under the anti-kickback statute. The failure to fit within a safe harbor does not necessarily mean that an arrangement violates the anti-kickback statute, but rather shows that the arrangement is potentially subject to scrutiny under the anti-kickback statute by the OIG, prosecutors or others.

New Value-Based Arrangement Safe Harbors

The OIG created four new safe harbors with related definitions (generally similar, but not identical, to the new Stark Law value-based exceptions under the CMS final rule) for value-based enterprises (VBEs) and their healthcare professionals and other eligible participants who engage in value-based activities that are designed to better enhance patient care:

• Value-Based Arrangements The following three safe harbors for value-based  arrangements offer new opportunities to facilitate better coordinated patient care at potentially lower costs, with more flexibility for value-based arrangements involving more downside financial risk:
  • Care Coordination Arrangements to Improve Quality, Health Outcomes, and Efficiency under § 1001.952(ee) protects only in-kind remuneration between a VBE and any of its participants or between VBE participants pursuant to a value-based arrangement
  • Value-Based Arrangements with Substantial Downside Financial Risk under § 1001.952(ff) protects both in-kind and monetary remuneration between a VBE and VBE participants where VBE participants “meaningfully share” in the downside risk
  • Value-Based Arrangements with Full Financial Risk under § 1001.952(gg) provides considerable flexibility but is balanced by higher financial risk. This category protects both monetary and in-kind remuneration to a VBE participant
• Patient Engagement Tools and Support This new safe harbor under § 1001.952(hh) promotes patient care quality and outcomes by protecting patient engagement tools and support furnished by a VBE participant to a patient in connection with a value-based arrangement.

Other New Safe Harbors

• Outcomes-Based Payment Arrangements This safe harbor under new subsections of existing § 1001.952(d) protects outcome-based payments for achieving legitimate outcome measures and satisfying various conditions.
• Accountable Care Organization (ACO) Beneficiary Incentives The statutory exception to “remuneration” relating to ACO Beneficiary Incentive Programs for the Medicare Shared Savings Program is codified under § 1001.952(kk) and protects incentive payments made to an assigned beneficiary.
• CMS-Sponsored Model Arrangements A new safe harbor category is created under § 1001.952(ii)) for certain remuneration provided in relation to CMS-sponsored models. This safe harbor should reduce the need for separate fraud and abuse waivers.
• Cybersecurity Technology and Services The new safe harbor under § 1001.952(jj) protects donations of cybersecurity technology and related services, as well as  hardware that functions predominantly for effective cybersecurity, such as two-factor authentication dongles, security tokens, facial-recognition cameras, biometric authentication, secure identification card and device readers, intrusion detection systems, data backup and data recovery systems.
  • NOTE: The OIG did not finalize its proposal to exclude hardware from this safe harbor, but stated in the preamble that most multi-functional hardware would not satisfy the safe harbor condition of use predominantly for effective cybersecurity, and so would typically not qualify for protection. Monetary remuneration or reimbursement does not qualify, but a recipient contribution is not required, regardless of whether or not hardware is included in a donation.

Modified Safe Harbors
The OIG final rule modifies these existing safe harbors:

• Electronic Health Records The current safe harbor for electronic health records items and services under § 1001.952(y) is revised to:
  • Add protection for providing cybersecurity software and related services, such as training
  • Delete the December 31, 2021 sunset date
  • Delete the prior condition that the donor not actually or constructively know that the beneficiary possesses or has obtained equivalent EHR items or services
  • Expand the types of permitted donors to include entities (such as ACOs or health systems) that are comprised of healthcare providers
  • Update the definition of “interoperable” to reflect the definition in the 21^st Century Cures Act,  relating to software which allows complete access, exchange, and use of information
• Local Transportation The existing safe harbor for local transportation under § 1001.952(bb) is modified by extending the rural mileage limit from 50 to 75 miles and removing the mileage limit for transportation to the patient’s residence or another residence of the patient’s choice if the patient is discharged from an inpatient facility after being under observation for at least 24 hours.
• Personal Services and Management Contracts The existing safe harbor for personal services and management contracts under § 1001.952(d) is modified to add flexibility to structure productivity, time, and unit-based payments and related arrangements within the protection of the safe harbor. In particular, the final rule removes requirements that the aggregate compensation be set forth in the agreement (the methodology for determining compensation can be sufficient) and a part-time agreement will no longer need to set forth the exact schedule and charge for each interval.
• Warranties The existing safe harbor definition of “warranty” under § 1001.952(g) is revised to include three possible meanings of the term and will provide protection for some bundled warranties of one or more items and related services in relation to arrangements between manufacturers and suppliers.

The OIG final rule will become effective on Jan. 19, 2021.

For additional information on these new and modified safe harbors and other OIG final rule provisions, please contact the attorneys below.