06-3722. Medicare Program; Requirements for Providers and Suppliers To Establish and Maintain Medicare Enrollment

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Final rule.

SUMMARY:

This final rule requires that all providers and suppliers (other than physicians or practitioners who have elected to “opt-out” of the Medicare program) complete an enrollment form and submit specific information to us. This final rule also requires that all providers and suppliers periodically update and certify the accuracy of their enrollment information to receive and maintain billing privileges in the Medicare program. In addition, this final rule implements provisions in the statute that require us to ensure that all Medicare providers and suppliers are qualified to provide the appropriate health care services. These statutory provisions include requirements meant to protect beneficiaries and the Medicare Trust Funds by preventing unqualified, fraudulent, or excluded providers and suppliers from providing items or services to Medicare beneficiaries or billing the Medicare program or its beneficiaries.

DATES:

Effective Date: These regulations are effective on June 20, 2006.

FOR FURTHER INFORMATION CONTACT:

Michael C. Collett, [phone].

SUPPLEMENTARY INFORMATION:

 

Copies: To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at [phone] (or toll-free at 1-888-293-6498) or by faxing to [phone]. The cost for each copy is $10. As an alternative, you can view and photocopy the Federal Register document at most libraries designated as Federal Depository Libraries and at many other public and academic libraries throughout the country that receive the Federal Register.

This Federal Register document is also available from the Federal Register online database through GPO Access, a service of the U.S. Government Printing Office. The Web site address is: http://www.gpoaccess.gov/​nara/​index.html.

I. Background

A. General

The Medicare program, title XVIII of the Social Security Act (the Act), is the primary payer of health care costs for 43 million enrolled beneficiaries. Under section 1802 of the Act, a beneficiary may obtain health services from any institution, agency, or person qualified to participate in the Medicare program. Qualifications to participate are specified in statute and in regulations. (See, for example, sections 1814, 1815, 1819, 1833, 1834, 1842, 1861, 1866, and 1891 of the Act; and 42 CFR Chapter IV, subchapter E, which concerns standards and certification requirements.)

Providers and suppliers furnishing services must comply with the Medicare requirements stipulated in the Act and in our regulations. These requirements are meant to ensure compliance with applicable statutes, as well as to promote the furnishing of high quality care. CMS, State survey and certification agencies, or both inspect facilities when required, for compliance with regulatory and operational requirements before we allow them to participate in the Medicare program. Thereafter, we will review and re-verify the continued adherence to our requirements either as part of a scheduled recertification survey, or as a result of a complaint or other information received that will directly affect the provider's or supplier's business relationship with the Medicare program or indicate noncompliance with this regulation. The initial certification and subsequent recertification ensure that Medicare requirements are met, continue to be met, and promote the appropriate spending of the Medicare Trust Funds by helping to ensure that unqualified providers and suppliers are not granted billing privileges with the Medicare program.

Historically, a provider or supplier wishing to receive payment from Medicare or its beneficiaries would contact a Medicare fiscal intermediary (FI), the State survey agency, or a Medicare carrier. In compliance with sections 1816, 1842 and 1874 of the Act, as stipulated in 42 CFR Part 421, we contract with fee-for-service contractors to administer payment for services and to manage other administrative responsibilities that the law imposes. Our regional offices, State survey agencies, carriers and FIs use statutes, regulations, and operating instructions as guidance when assigning appropriate identification numbers and determining whether to grant billing privileges in the Medicare program to providers and suppliers.

As Medicare program expenditures have grown, increased attention was focused on strategies to curb improper Medicare payments by implementing business processes and standards that safeguard the Medicare program and its beneficiaries, while ensuring that well qualified individuals and health care organizations serve beneficiaries as promptly as possible.

B. Specific Authority To Collect Enrollment Information

1. Various sections of the Act and the Code of Federal Regulations require providers and suppliers to furnish information concerning the amounts due and the identification of individuals or entities who furnish medical services to beneficiaries before payment can be made.

• Sections 1102 and 1871 of the Act provide general authority for the Secretary of Health and Human Services (the Secretary) to prescribe regulations for the efficient administration of the Medicare program. Under this authority, this final rule will require the collection of information from providers and suppliers for the purpose of enrolling in the Medicare program and granting privileges to bill the program for health care services furnished to Medicare beneficiaries.
• Sections 1814(a), 1815(a), and 1833(e) of the Act require the submission of information necessary to determine the amounts due a provider or other person.
• Section 1842(r) of the Act requires us to establish a system for furnishing a unique identifier for each physician who furnishes services for which payment may be made. To complete this, we need to collect information unique to that physician.
• Section 1862(e)(1) of the Act states that no payment may be made when an item or service was at the medical direction of an individual or entity that is excluded in accordance with sections 1128, 1128A, 1156, or 1842(j)(2) of the Act.
• Section 1834(j)(1)(A) of the Act states that no payment may be made for items furnished by a supplier of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) unless that supplier obtains, and renews at intervals as we may require, a billing number.

Section 4313 of the Balanced Budget Act of 1997 (BBA) (Pub. L. 105-33) amended sections 1124(a)(1) and 1124A of the Act to require disclosure of both the Employer Identification Number (EIN) and Social Security Number (SSN) of each provider or supplier, each person with ownership or control interest in the provider or supplier, any subcontractor in which the provider or supplier directly or indirectly has a 5 percent or more ownership interest, and any managing employees including Directors and Board Members of corporations and non-profit organizations and charities. The Secretary signed and sent to the Congress a “Report to Congress on Steps Taken to Assure Confidentiality of Social Security Account Numbers as Required by the Balanced Budget Act” on January 26, 1999, with mandatory collection of SSNs and EINs effective on or after April 26, 1999.

2. Section 31001(i)(1) of the Debt Collection Improvement Act of 1996 (DCIA) (Pub. L. 104-134) amended section 7701 of 31 U.S.C. by adding paragraph (c) to require that any person or entity doing business with the Federal Government must provide their Tax Identification Number (TIN).

3. We are authorized to collect information on the CMS 855-Provider/Supplier Enrollment Application, (Office of Management and Budget (OMB) approval number 0938-0685) to ensure that correct payments are made to providers and suppliers under the Medicare program as established by Title XVIII of the Act.

C. Prior Enrollment Initiatives

For a number of years, concern about easy entry into the Medicare program by unqualified or even fraudulent providers or suppliers has led us to step up our efforts on a number of fronts to establish more stringent controls on provider and supplier entry into the Medicare program.

For example, in 1993 we established the National Supplier Clearinghouse (NSC), our contractor for enrolling suppliers of DMEPOS in Medicare. We instituted new procedures to use validation software to certify the existence of the listed business address for suppliers of DMEPOS. The NSC also checked the DMEPOS supplier telephone numbers against a national directory. This initial effort resulted in the revocation of about 1,500 supplier billing numbers and an estimated savings of $7 million per month to the Medicare Trust Funds.

In fiscal year (FY) 1998, we required site visits for all new DMEPOS suppliers. The DMEPOS visits resulted in: 156 denials of new applicants out of 159 visits; and 656 revocations of existing suppliers out of 2,091 visits.

In FY 1998 and FY 1999, our carriers and FIs submitted proposals to conduct site visits for those provider or supplier types that they believed would yield the greatest benefit in their regions. After reviewing the submitted proposals, we funded 320 site visits to various enrolling and currently enrolled Independent Diagnostic Testing Facilities (IDTFs), skilled nursing facilities (SNFs), home health agencies (HHAs), rural health clinics, comprehensive outpatient rehabilitation facilities, physician groups, clinical psychologists, and ambulance companies. The project provided useful information for making appropriate determinations for the eligibility to bill Medicare. In the course of these reviews—

• 219 provider numbers were authorized or maintained;
• 30 provider numbers were deactivated;
• 37 provider applications were denied; and
• 34 providers were referred to contractor fraud units.

These site visits proved valuable to some providers and suppliers by helping them to enroll in the Medicare program properly. The site visits were also helpful to us in ensuring that we only conduct business with legitimate providers and suppliers. We believe that site visits are an important component of successful provider and supplier enrollment. We believe that there is ample authority in the statute for this approach. The statute confers upon the Secretary the authority to seek information he needs to determine the amounts due to providers and suppliers of services. Part of that duty is fulfilled by reviewing documentation offered by those entities submitting claims, but part of that duty may also be performed through the use of on-site reviews that enable the Secretary to verify, for example, that he is paying an entity that actually exists or that is providing a service that it represented it would provide in its enrollment application. Often these kinds of determinations cannot be made solely based on the review of paper documentation submitted to contractors even though they bear heavily on the amounts that may be due to a particular provider or supplier. As past experience has demonstrated, in many cases site visits are the only method we have to ensure that providers and suppliers actually exist and meet the requirements to participate in the Medicare program, particularly in the absence of State licensure or regulation. Left unchecked, Medicare program resources and the health of Medicare beneficiaries may be vulnerable.

II. Provisions of the Proposed Rule

In the April 25, 2003 Federal Register (68 FR 22064), we published a proposed rule that builds on our collective experience and sets forth our standard enrollment requirements in new subpart P in part 424 of this chapter. We proposed that all providers and suppliers, other than the “opt-out” physicians and “opt-out” practitioners described below, must submit an enrollment application with specific information to enroll in the Medicare program, obtain a Medicare billing number, and receive Medicare billing privileges. The provisions of the proposed rule were designed to supplement, but not replace or nullify, existing regulations concerning the establishment of provider or supplier agreements, the issuance of provider or supplier billing numbers, and payment for Medicare covered services or supplies to eligible providers or suppliers.

Specifically, we proposed to require that providers and suppliers prove their qualifications and identity and submit specified information to us before they are granted billing privileges in the Medicare program. If the provider or supplier fails to meet the requirements or submit the required information, we would not enroll it in the Medicare program or, if it is currently in the program, we would revoke its billing privileges. We believe the documentation and associated verification methods we use to determine whether to grant a provider or supplier billing privileges are necessary to ensure compliance with Medicare requirements and to prevent abuse of the Medicare program and the inappropriate use of Medicare funds. We also believe that the requirements will not hinder qualified individuals and organizations from enrolling or maintaining enrollment in the Medicare program.

A. Scope and Definitions

We proposed to establish our standard enrollment requirements in part 424, new subpart P. In proposed § 424.500 (Scope), we stated that these requirements apply to all providers and suppliers except those physicians and other eligible practitioners who have elected to “opt-out” of Medicare as described in part 405, subpart D of our regulations.

In proposed § 400.502 (Definitions), we would establish the definitions for several key terms used throughout new subpart P. The terms “provider” and “supplier” are not defined in this subpart because their definitions are already established throughout 42 CFR. The term “provider” is defined in both § 400.202 and § 488.1. Together these sections define a provider as including a hospital, a critical access hospital, a skilled nursing facility, a nursing facility, a comprehensive outpatient rehabilitation facility, a home health agency, or a hospice, that has in effect an agreement to participate in Medicare; or a provider of outpatient physical therapy or speech pathology services; or a community mental health center. The term “supplier,” as defined in § 400.202, is a physician or other practitioner, or an entity other than a provider (as defined in § 400.202 and § 488.1) that furnishes health care services under Medicare. Section 488.1 also defines “supplier” to mean independent laboratory; portable X-ray services; physical therapist in independent practice; ESRD facility; rural health clinic; Federally-qualified health center; or chiropractor. The term “supplier” also includes “indirect suppliers,” as indicated in 45 CFR 61.3.

We proposed to define “managing employee” to be a general manager, business manager, administrator, director, or other individual who exercises operational or managerial control over, or who directly or indirectly conducts the day-to-day operations of, the institution, organization, or agency, either under contract or through some other arrangement, regardless of whether the individual is a W-2 employee.

Section 1124A of the Act and § 420.204 authorize the Secretary to collect information about managing employees. Section 1124A of the Act incorporates by reference the definition of managing employee, contained in section 1126(b) of the Act as an individual, including a general manager, business manager, administrator, and director, who exercises operational or managerial control over the entity, or who directly or indirectly conducts the day-to-day operations of the entity. We have found that a number of providers and suppliers are managed by individuals that have control over the day-to-day operations of the entity and are not employees. Some of these individuals are known to bill Medicare fraudulently, and are on the Office of Inspector General (OIG) “List of Excluded Individuals and Entities” and the General Services Administration (GSA) “List of Parties Excluded from Federal Procurement and Non-procurement Programs”. These lists are commonly referred to as the “OIG Sanction List” for those parties excluded by the OIG from participation in any Federal health care programs (as defined in section 1128B(f) of the Act), and the “GSA Debarment List” for those parties debarred, suspended or otherwise excluded by other Federal agencies from participation in Federal procurement and non-procurement programs and activities, in accordance with the Federal Acquisition and Streamlining Act of 1994, and with the HHS Common Rule at 45 CFR part 76.

Extending the term “managing employee” to include individuals performing managerial duties who are not technically employees would be consistent with the legislative intent to require information on those individuals that have effective control over a provider's or supplier's day-to-day operations.

B. Basic Enrollment Requirement

Proposed § 424.505 requires a provider or supplier to have a valid Medicare billing number for the date a service was rendered in order to receive payment for covered Medicare services from either Medicare (in the case of assigned claims) or the Medicare beneficiary (in the case of unassigned claims).

Under longstanding policy and operating procedures, any claim submitted without an active billing number is incomplete and cannot be processed for payment. Providers and suppliers who are not enrolled in the Medicare program must adhere to the mandatory claims submission rules at § 424.32(a)(1) (Basic requirements for all claims) and section 1848(g)(4) of the Act. In addition, a claim submitted without a valid Medicare billing number would not be considered a valid claim and will be rejected. If the mandatory claims submission requirements are not met the provider or supplier could have sanctions imposed as outlined in section 1848(g)(4) of the Act for failure to file a claim as required.

C. Requirements for Obtaining a Billing Number and Medicare Billing Privileges

To obtain a Medicare billing number and be eligible to receive payment for Medicare covered services, providers and suppliers must enroll in the Medicare program and meet other applicable Federal requirements. The Medicare program, through its contractors, requires specific identifying information from a provider or supplier before payment is authorized. Our issuance of an identification number to a provider or supplier does not automatically convey the privilege to bill Medicare. There must be a corresponding approval of the provider or supplier as meeting all Federal requirements to bill Medicare for the number to be an approved and active Medicare billing number.

In § 424.510 (CMS 855), we proposed that a provider or supplier must submit to us the appropriate completed CMS 855—Provider/Supplier Enrollment Application based on the type of provider or supplier enrolling. As part of our continuing efforts to improve the enrollment process, the series of CMS 855 enrollment forms with proposed revisions were submitted with the proposed rule, and were published in the Federal Register concurrently for review and public comment. Some of the proposed revisions were the removal of certain data collections from all forms in the series such as information on clearinghouses used in claims submission, practice locations from the CMS 855R, and a shortened attachment for ambulance companies in the CMS 855B. We also simplified the sections for reporting owners and managers and added instructional clarifications. The forms are identified as follows:

• CMS 855A—For providers billing fiscal intermediaries.
• CMS 855B—For supplier organizations billing carriers.
• CMS 855I—For individual health care practitioners billing carriers.
• CMS 855R—For individual health care practitioners to reassign benefits to an organization.
• CMS 855S—For DMEPOS Suppliers billing the NSC.

The CMS 855 applications will be used to gather information on providers and suppliers for the purpose of authorizing billing numbers and establishing eligibility to furnish services to Medicare beneficiaries. The information submitted will also uniquely identify the providers and suppliers for the purpose of enumeration and payment. OMB approved the CMS 855 for these purposes (OMB approval number 0938-0685).

In § 424.510(a)(1), we proposed to require that a provider or supplier submit the following on its CMS 855:

• Complete and accurate responses to all information requested within each section as applicable to the provider or supplier type.
• Any documentation currently required by CMS under this or other statutory or regulatory authority to uniquely identify the provider or supplier (for example, an SSN or a TIN).
• Any documentation currently required by CMS under this or other statutory or regulatory authority to establish the provider or supplier's eligibility to furnish services to beneficiaries in the Medicare program (for example, a medical license or business license).

Under the authorities noted previously in this preamble all providers, suppliers, and other health care related individuals and entities who would receive Medicare reimbursements, either directly or indirectly as a result of enrolling in the Medicare program, must furnish their SSN and TIN as a condition of maintaining an active enrollment status and billing privileges. We also maintained the right to require persons with ownership or control interests (as that term is defined in section 1124(a)(3) of the Act) in their providers and suppliers, and of all managing employees (as that term is defined in section 1126(b) of the Act and in § 420.201 of the regulations) of these providers and suppliers to also furnish their SSN and TIN as a condition of enrollment.

We proposed to require that providers and suppliers must certify that all the information furnished on the CMS 855 is accurate, complete, truthful, and verifiable. Any concealment or misrepresentation of material information in these applications would constitute violation of this regulation and may result in the rejection, denial, or revocation of the provider or supplier's enrollment and billing privileges. In addition, the concealment or misrepresentation would be referred to the OIG for investigation and appropriate criminal, civil or administrative action.

In § 424.510(a)(2), we proposed to require that the CMS 855 must be signed by an individual who has the authority to bind the provider or supplier both legally and financially to the requirements set forth in subpart P. This person must be the individual practitioner or have an ownership or control interest in the provider or supplier, as that term is defined in section 1124(a)(3) of the Act, such as, be the provider's or supplier's general partner, chairman of the board, chief financial officer, chief executive officer, president, or hold a position of similar status and authority within the provider or supplier organization. The signature would attest that the information submitted is accurate, complete, and truthful, and the provider or supplier is aware of, and will abide by, Medicare rules and regulations.

To ensure that the individual signing the form can bind the enrollee from a financial and legal standpoint, we would require the following persons to sign the enrollment form:

• In the case of an individual practitioner, the applying practitioner.
• In the case of a sole proprietorship, the applying sole proprietor.
• In the case of a corporation, partnership, group, limited liability company (LLC), or other organization, an authorized official as defined in § 424.502.

When an authorized official signs the application, the signed application is considered binding upon the corporation partnership, organization, group, or LLC (hereafter referred to in this section as an organization), as applicable. This requirement establishes accountability for the accuracy of the information on the CMS 855 and ensures that the provider or supplier is committed to taking the necessary steps to comply with these requirements. In addition to the signature requirements, we proposed to establish a delegation of authority. As stated in this section, the original and all subsequent revalidation CMS 855s submitted by an organization to enroll or maintain enrollment in the Medicare program must have certification statements signed by the current authorized official(s) on file with Medicare. Any subsequent updates or changes made outside the enrollment or revalidation process may be signed by a delegated official of the enrolled organization.

The delegated official must be a W-2 managing employee of the provider or supplier who is enrolling in, or currently enrolled in, the Medicare program, or be an individual with ownership or control interest in the provider or supplier.

The delegation of signature authority would not apply for individual practitioners and sole proprietors. All CMS 855s submitted by individual practitioners or sole proprietors must be signed by the enrolling or enrolled individual.

As proposed in § 424.510(a)(2)(ii), the delegation of authority must be assigned by the authorized official currently on file with us or the authorized official who has signed the CMS 855 currently being submitted to us. All delegations of authority must be submitted via the CMS 855 and must include the title of each person delegated authority to update or change the organization's enrollment information. The assignment must be signed by both the authorized official currently on file with Medicare and the person(s) being delegated as an official of the organization. The signature of the delegated official would bind the organization both legally and financially, as if the signature was that of the authorized official. Once the delegation of authority is established, the signatures of the authorized official or the assigned delegated official(s) would be the only acceptable signature(s) on correspondence to report updates or changes to the enrollment information.

In § 424.510(b), we proposed to verify initial compliance with statutes and regulations before providers and suppliers are granted billing privileges, as well as on a continuing basis. The verifications would be based on information submitted by providers and suppliers on the CMS 855.

We proposed to require in § 424.510(c) that providers and suppliers, including those that are deemed to meet Medicare health and safety requirements by virtue of their accreditation by a national accrediting body, must attest via signature on the CMS 855 that they have met all the requirements set forth in this regulation before they are granted billing privileges. Those providers for which certification is required must meet the provisions of part 488 concerning mandatory State survey and certification requirements. Providers also must have completed a provider agreement in accordance with part 489, which specifies the requirements for provider agreements. In addition, in § 424.510(d) and (e), we proposed to require that providers and suppliers must be operational as defined in § 424.502 and must meet additional requirements that apply to both enrolling and currently enrolled providers and suppliers before receiving a Medicare billing number and becoming eligible for Medicare payments.

In recognition of the effectiveness of site visits, we proposed to require, at § 424.510(f), a plan for integrating site visits as part of our enrollment validation process and general program oversight activities. We proposed to reserve the right to perform on-site inspections of the provider or supplier when we deem necessary to ensure compliance with Medicare enrollment requirements. For certain providers and suppliers this practice has always been the case (for example, hospitals, SNFs, and HHAs), but we are extending this to all providers and suppliers when deemed necessary based on questionable enrollment information. Site visits for enrollment purposes will not affect those site visits performed for establishing conditions of participation.

The proposed site visits and on-site inspections to ensure compliance with Medicare enrollment requirements are unrelated to the compliance-related site visits already being conducted by the OIG. After a provider or supplier enters into a corporate integrity agreement with the OIG, usually as the result of a Federal False Claims Act settlement, the OIG may conduct a site visit as part of its work in monitoring the provider or supplier's compliance with the terms of the corporate integrity agreement.

Upon the provider or supplier's successful completion of the enrollment process, including State survey and certification, accreditation, and approval of the CMS 855, we would grant Medicare billing privileges and issue a billing number if one has not already been issued. The effective date for reimbursement of Medicare covered services would continue to be determined based on current Medicare regulations and policy based on the type of provider or supplier submitting claims. Currently, the effective dates for reimbursement can be found at § 489.13 for providers and suppliers requiring State survey or certification or accreditation, § 424.5 and § 424.44 for nonsurveyed or certified/accredited suppliers, and § 424.57 and section 1834(j)(1)(A) of the Act for DMEPOS suppliers. For those providers and suppliers seeking accreditation from a CMS-approved accreditation organization, the effective date for reimbursement is the later of the date accreditation was received or the final approval of the CMS 855. Based on the regulations cited previously, we would not issue Medicare billing numbers or grant Medicare billing privileges retroactive to the date that the provider or supplier received final approval of their enrollment application (CMS 855). We proposed to use this process because we believe there is a relationship between fulfilling the requirements stipulated in the Medicare program statutes and related laws, the integrity of the provider and supplier, the quality of care furnished to Medicare beneficiaries, and the confidence of the public in the Medicare program.

In the future there will be universal provider and supplier numbers, as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), for uniquely identifying a provider or supplier and for purposes of billing all health plans, including Medicare and Medicaid. When this universal number is in place, it will still be necessary for providers and suppliers to apply for enrollment as a Medicare provider or supplier and be granted Medicare billing privileges.

D. Requirements for Reporting Changes and Updates to, and the Periodic Revalidation of, Medicare Enrollment Information

In § 424.515, we proposed to require that a provider or supplier must update its enrollment information, and recertify as to its accuracy when any changes are made. We would also periodically require revalidation of the enrollment information by all providers and suppliers when enrollment information has aged over 3 years. The revalidation process will ensure that we have complete and current information on all Medicare providers and suppliers and ensure continued compliance with Medicare requirements. In addition, this process further ensures that Medicare beneficiaries are receiving services furnished only by legitimate providers and suppliers, and strengthens our ability to protect the Medicare Trust Funds.

The accuracy of the data describing the individuals or organizations with which we do business is essential to efficient and effective operation of the Medicare program. For this reason, we proposed to require at § 424.520(b), that individuals and organizations are responsible for updating their CMS 855 information to reflect any changes in a timely manner. We would define timely as meaning within 90 days, with the exception of a change in ownership or control of the provider or supplier which must be reported within 30 days. Failure to do so may result in deactivation or even revocation of their billing privileges.

We would determine, upon receipt of any changes, if continued enrollment in the Medicare program is proper. We expect that in the vast majority of cases, updates or changes would not affect the status of the provider or supplier. Where it does, we would follow the revocation procedures outlined later in this rule.

When no such changes or updates were reported or submitted for a period of time, we believe that it is prudent to take steps to confirm the continued validity of the information that was previously submitted. We believe that this revalidation of enrollment information should be accomplished in a way that minimizes the reporting burden to the provider or supplier, but also mitigates the risk to the program of maintaining incomplete or inaccurate information that materially affects the relationship of the program to the provider or supplier. For this reason, we proposed to require that we will initiate a revalidation process for any individual or organization that has not submitted a change or update within the last 3 years. Routine revalidations may or may not be accompanied by site visits.

We will reserve the right to perform non-routine revalidation and request the provider or supplier to recertify as to the accuracy of the enrollment information when warranted to assess and confirm the validity of the enrollment information. Non-routine revalidation may be triggered as a result of information indicating local problems, national initiatives, fraud investigations, complaints from beneficiaries, or other reasons that cause us to question the integrity of the provider or supplier in its relationship with the Medicare program. Like routine revalidation, non-routine revalidation may or may not be accompanied by site visits.

We proposed to require that the revalidation of enrollment information occur no more than once every 3 years. We reserve the right to adjust this schedule if we determine that revalidation should occur on a more frequent basis due to complaints or evidence we receive indicating noncompliance with the statute or regulations by specific provider or supplier types. The schedule may also be on a less frequent basis if we determine that the integrity of and compliance with the statute and regulations by specific provider or supplier types indicates that less frequent validation is justified. If such a change were to occur, we would notify all affected providers and suppliers in writing at least 90 days in advance of implementing the change. We would continue to revalidate enrollment information for Ambulance Service Suppliers in accordance with regulations set forth at § 410.41(c)(2) (Requirements for ambulance suppliers), and DMEPOS suppliers would continue to renew enrollment in accordance with regulations set forth at § 424.57(e) (Special payment rules for items furnished by DMEPOS suppliers and issuance of DMEPOS supplier billing numbers).

We proposed to require at new § 424.515(a) that during the revalidation or update process all providers and suppliers must attest by way of a signed certification statement that the requirements set forth in this regulation continue to be met. This requirement would not only ensure continued accuracy of the CMS 855 information, but would also ensure that the provider or supplier is committed to taking the necessary steps to maintain compliance with these requirements. However, it should be noted that periodic validation of a provider or supplier's Medicare enrollment information is separate from the survey requirements for the provider or supplier as contained in 42 CFR Chapter IV, subchapter E (Standards and certification).

We proposed to require the information submitted for revalidation or update to include any new or changed documentation as required by us under this or other statutory or regulatory authority that identifies the provider or supplier, and any documentation as required by us under this or other statutory or regulatory authority required to verify the provider or supplier's continued eligibility to furnish services to beneficiaries in the Medicare program. We would also require a signature on the completed CMS 855 that meets the requirements proposed in § 424.510(a)(3).

In § 424.515(b), we also proposed to require that a provider or supplier must submit a CMS 855 with complete information for revalidation within 60 calendar days of our revalidation notification. For those providers and suppliers who initially enrolled in the Medicare program via the CMS 855, we would furnish a copy of the information currently on file for their review, request that they make any changes, and certify via their signature that the information is accurate, complete, and truthful. We estimate that completion of the form would require on average 8 hours. Therefore, we believe 60 days is a reasonable timeframe for providers and suppliers to comply.

As part of the revalidation process, we would verify the accuracy of the reported information on the applicable CMS 855. Because survey and certification are independent program requirements distinct from the revalidation of enrollment information requirements set forth in this subpart, we proposed in § 424.515(c) that new surveys or certifications are not required for the revalidation process. However, providers must continue to meet the provisions of § 488 and § 489 concerning mandatory State survey and certification requirements. When applicable, providers must also have completed a provider agreement in accordance with § 489, which specifies the requirements for provider agreements. We would also reserve the right, at proposed § 424.515(d), to perform on-site inspections, to further ensure compliance with Medicare requirements.

We understand that the resubmission and update of enrollment information would place an obligation on providers and suppliers. We are considering a variety of ways to minimize the burden of this important information collection and verification provision (including the use of Internet technology).

To reduce the burden when reporting updates or changes in the future, we would require that all providers and suppliers currently in the Medicare program complete, in its entirety, the CMS 855 at least once if they have not done so in the past. This would ensure that we have the most current and accurate information, and would allow us to make full use of electronic data submissions via the Internet. By having a complete enrollment record, we would be able to produce and transmit or mail the CMS 855, pre-populated with previously reported information, to the provider or supplier for their review and signature certification as to the continued accuracy of the information and require them to update any information that is no longer current.

E. Additional Provider and Supplier Requirements for Enrolling and Maintaining Active Enrollment Status in the Medicare Program

In new § 424.520, we proposed to specify the additional requirements that providers and suppliers must meet to enroll or maintain enrollment in the Medicare program. The provider or supplier must certify that it meets, and continues to meet, the following requirements:

• Compliance with title XVIII of the Act (Medicare Statutory Provisions) and applicable regulations.
• Compliance with all applicable Federal and State licensure and regulatory requirements that apply to the specific provider or supplier type that relate to providing health care services.
• Not employing or contracting with individuals or entities excluded from participation in Federal Health care programs for the provision of items and services reimbursable under these programs in violation of section 1128A(a)(6) of the Act.

The OIG program exclusion regulations were amended effective August 25, 1995, in accordance with the Federal Acquisition Streamlining Act of 1994 (FASA), and with the HHS Common Rule at 45 CFR part 76, to explain the scope and effect of an OIG exclusion. In accordance with the FASA, government-wide reciprocal effect will be given by all Federal agencies to an administrative sanction imposed by any Federal agency. Specifically, the statute provides that: “No agency shall allow a party to participate in any procurement and nonprocurement activity if any [other] agency has debarred, suspended, or otherwise excluded, that party from participation in a procurement or nonprocurement activity,” (FASA, section 2455). Therefore, consistent with the FASA, its implementing regulation, and OIG regulations (§ 1001.1901(b)), we would deny or revoke enrollment (revocation effective on the date of the exclusion) if the provider or supplier is subject to an OIG exclusion, or is debarred, suspended or otherwise excluded by any other Federal health care program or agency.

F. Rejection of a Provider's or Supplier's CMS 855 for Medicare Enrollment

In new § 424.525, we proposed that if a provider or supplier enrolling in the Medicare program for the first time fails to furnish complete information on the CMS 855, or fails to furnish missing information or any necessary supporting documentation as required by CMS under this or other statutory or regulatory authority within 60 calendar days of our request to furnish the information, we would reject the provider or supplier's CMS 855 application. Rejection would not occur if the provider or supplier is actively communicating with us to resolve any issues regardless of any timeframes.

Upon notification of a rejected CMS 855, the provider or supplier must again begin the enrollment process by completing and submitting a new CMS 855 and all applicable documentation. We proposed to specify in § 424.525(b) that the new form must also update any information that is different from that originally submitted. This would ensure that we have the most recent information about the provider or supplier. The enrollment process would culminate in the granting of billing privileges or denial or rejection of the application.

G. Denial of Enrollment

We would deny enrollment in the Medicare program to providers or suppliers whom we determine to be ineligible. Providers and suppliers who are denied enrollment would not receive Medicare billing privileges. In § 424.530(a), we proposed to require that a provider or supplier applying for enrollment in the Medicare program may be denied enrollment for any of the following reasons:

• Under § 424.530(a)(1), enrollment may be denied if the provider or supplier were found not to be in compliance (for example, failure to furnish required documentation, lack of qualified practice location) with the Medicare enrollment requirements applicable to the type of provider or supplier enrolling, unless the reason for noncompliance were corrected or the provider or supplier has submitted a plan of corrective action as outlined in part 488.
• In § 424.530(a)(2), we proposed to require that enrollment may also be denied if: a provider, supplier, an owner, managing employee, authorized or delegated official an supervising physician, medical director, or other health care personnel furnishing Medicare reimbursable services who is required to be reported on the providers' or suppliers' CMS 855 (for example, an ambulance crew member) —

+ Is excluded from the Medicare, Medicaid, or any other Federal health care programs, as defined in § 1001.2, in accordance with § 1001.1901(a); or

+ Is debarred, suspended, or otherwise excluded from participating in any other Federal procurement or nonprocurement activity in accordance with FASA, section 2455; (See HHS Common Rule provisions that discuss the effect of a program exclusion under title XI of the Act, as well as other Federal agency debarments, suspensions, and exclusions found at 45 CFR 76.100(c) and (d)).

We are required to ensure that no payments are made to any providers or suppliers who are excluded from participation in the Medicare program under authorities found in sections 1128, 1156, 1862, 1867, and 1892 of the Act, or who are debarred, suspended or otherwise excluded as authorized by FASA. This includes any individual, entity, or any provider or supplier that arranges or contracts with (by employment or otherwise) an individual or entity that the provider or supplier knows or should know is excluded from participation in a Federal health care program for the provision of items or services for which payment may be made under such a program (section 1128A(a)(6) of the Act), and any provider or supplier that has been debarred, suspended, or otherwise excluded from participation in any other Executive Branch procurement or nonprocurement programs or activity (FASA, section 2455).

Therefore, when an individual or entity is excluded by the OIG under section 1128 of the Act, the exclusion is applicable to participation in all Federal health care programs (including Medicare and Medicaid as defined in section 1128B(f) of the Act). In addition, section 1862(e) of the Act prohibits the Secretary from paying for items and services furnished by excluded individuals. We believe that our general authorities, in combination with the prohibition against paying for items or services furnished by excluded individuals, provides authority for us to deny enrollment unless a provider or supplier terminates its relationship with the relevant individual. The denial will remain effective until that provider, supplier, managing employee, authorized or delegated official, medical director, supervising physician, or other health care personnel furnishing Medicare reimbursable services, is no longer excluded or sanctioned. Section 424.530(b)(3) also would provide that the denial will be effective within 30 days of the denial notification.

In § 424.530(a)(3), we also proposed to require that we may deny enrollment in the Medicare program if the provider or supplier, or any owner of the provider or supplier, has been convicted of a Federal or State felony offense that we determine to be detrimental to the best interests of the Medicare program or its beneficiaries. This authority is afforded to us in many of the HIPAA fraud and abuse provisions and section 4302 of the BBA. In making assessments, we proposed to require including any felony convictions from the last 10 years or more. In addition, we would consider the severity of the underlying offense.

Felonies that we determine to be detrimental to the best interests of the Medicare program or its beneficiaries include the following:

• Within the last 10 years or more preceding enrollment or revalidation of enrollment, crimes against persons, such as rape, murder, kidnapping, assault and battery, robbery, and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions. We believe it is reasonable for the Medicare program to question the ability of the individual or entity with such a history to respect the life and property of program beneficiaries.
• Within the last 10 years or more preceding enrollment or revalidation of enrollment, financial crimes, such as extortion, embezzlement, income tax evasion, making false statements, insurance fraud, and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions. We believe it is reasonable for the Medicare program to question the honesty and integrity of the individual or entity with such a history in providing services and claiming payment under the Medicare program.
• Within the last 10 years or more preceding enrollment or revalidation of enrollment, any felony that placed the Medicare program or its beneficiaries at immediate risk, such as a malpractice suit that resulted in a conviction of criminal neglect or misconduct.
• Any felonies referred to in section 1128 of the Act.

Under section 1128(a) of the Act, the Secretary must exclude individuals or entities convicted of certain crimes, such as program-related crimes, crimes related to patient abuse or neglect, and conviction of a felony related to health care fraud or controlled substances. In addition, the Secretary has authority to exclude individuals and entities for other adverse actions including when an individual or entity is owned or controlled by a sanctioned or convicted individual, in accordance with section 1128(b)(8) of the Act.

In cases where the provider or supplier is not a convicted individual but, rather, has an ownership or management relationship with a convicted or excluded individual, that provider or supplier may also be subject to civil monetary penalties as stated in section 1128A(a)(6) of the Act. In addition, we may deny or revoke billing privileges if such a relationship exists. However, the denial may be reversed if, within 30 days of the denial notification, the provider or supplier terminates its ownership or management relationship with the convicted or excluded individual or organization.

In § 424.530(a)(4), we proposed to require that we may deny enrollment if the provider or supplier has deliberately submitted false or misleading information on their CMS 855 to gain enrollment in the Medicare program. Offenders may be subject to fines or imprisonment, or both, in accordance with current statute and regulation.

In § 424.530(a)(5), we proposed possible denial of enrollment where there are repeated instances in which, upon on-site review or other reliable evidence, we do not find present those licensed medical professionals required under the statute or regulations to supervise treatment or provide Medicare covered services for Medicare patients; or we determine that the provider or supplier is not operational to furnish Medicare covered services or supplies.

As outlined in § 424.530(b), if the denied provider or supplier appeals the decision, and the denial is upheld, that provider or supplier may submit a new CMS 855 after we notify it that the original determination was upheld. If the provider or supplier did not appeal the determination, it may submit a new CMS 855 when the timeframe for appeal rights has lapsed. We proposed this latter requirement to prevent administrative difficulties that might result in processing two enrollment forms if a new one is submitted during the time period when the provider or supplier may appeal an initial denial.

Medicare enrollment denials would impact the provider or supplier on a national scale. In proposed § 424.530(c), we stated that when a provider or supplier is denied enrollment in Medicare, we would review all other related Medicare enrollment files that the denied provider or supplier has an association with (for example, as an owner or managing employee) to determine if the denial warrants an adverse action of the associated Medicare provider or supplier.

H. Revocation of Enrollment and Billing Privileges From the Medicare Program

Revocation occurs when an enrolled provider or supplier's billing privileges are terminated. In proposed § 424.535, we outlined the causes for revocation and what a provider or supplier would need to do to re-enroll in the Medicare program after revocation. In considering whether to revoke enrollment and billing privileges in the Medicare program, we would consider the severity of the offenses, mitigating circumstances, program and beneficiary risk if enrollment was to continue, possibility of corrective action plans, beneficiary access to care, and any other pertinent factors.

In general, we proposed to require revocation criteria that are similar to our reasons for denial of initial Medicare program enrollment. In § 424.535(a)(1), we proposed to require that a provider or supplier's enrollment and billing privileges may be revoked if, at any time, it is determined to be out of compliance with the Medicare enrollment requirements outlined in subpart P including failure to report changes to enrollment information timely or failure to adhere to corrective action plans, and has not corrected the problem within 30 days of notice of noncompliance or submitted a plan of corrective action as cited earlier. We may request additional documentation from the provider or supplier to determine compliance if adverse information is received or otherwise found concerning the provider or supplier. If requested documentation we required under this or other statutory or regulatory authority is not submitted within 30 calendar days of our request, we would immediately begin revocation proceedings. If the documentation is received timely, we would review and verify the information to determine if we should proceed with the revocation. Providers requiring State survey and certification would continue to receive payment during the data verification review under current regulations found at part 488 and under section 1819(h)(2)(c) of the Act. Providers and suppliers not subject to State survey and certification may have their payments suspended during the data review.

We also proposed to require that we may revoke a provider or supplier's billing privileges if the provider or supplier establishes the following:

• Repeated instances in which, upon on-site review or other reliable evidence, we do not find present those licensed medical professionals required under the statute or regulation to supervise treatment of, or to provide Medicare covered service for, Medicare patients.

Additional proposed reasons that may result in the revocation of billing privileges in § 424.535(a) includes the following:

• The provider or supplier, any owner, managing employee, authorized or delegated official, supervising physician or other health care personnel who must be reported on the CMS 855 (for example, ambulance crew member) of the provider or supplier, in accordance with section 1862(e)(1) and (2) of the Act, becomes excluded from the Medicare, Medicaid or any other Federal health care programs, as defined in § 1001.2, in accordance with section 1128 or 1156 of the Act, or is debarred, suspended or otherwise by any Federal health care program or agency.
• The provider or supplier, or any owner of the provider or supplier, is convicted of a Federal or State felony offense that we determine to be detrimental to the best interests of the program as outlined in “Denial of Enrollment” above.
• The provider or supplier certified as “true” deliberately submitted false or misleading information on the CMS 855 in order to enroll or maintain enrollment in the Medicare program. (Offenders may be subject to criminal or civil prosecution, in accordance with current laws and regulations).
• Upon on-site review, we determine that the provider or supplier is no longer operational to furnish Medicare covered services or supplies.
• The provider or supplier fails to furnish complete and accurate information on the CMS 855 and any applicable documentation within 60 calendar days of our notice to recertify its enrollment information.
• The provider or supplier knowingly sells to or allows another individual or entity to use its billing number.

In addition to the revocation of the provider's or supplier's billing privileges, we proposed to require at § 424.535(b) that any provider agreement in effect at the time of revocation would also be terminated effective with the date of revocation. We do not believe it would be prudent for us to maintain an active provider agreement for a provider or supplier whose business relationship with Medicare was adverse enough as to cause the revocation of its billing privileges. Section 1866(b)(2)(A) of the Act specifies that the Secretary may terminate a provider agreement after the Secretary has determined that the provider fails to comply substantially with the provisions of title XVIII. We proposed to amend § 489.53 and § 498.3 to reflect this proposal.

In new § 424.535(c), we proposed to require that upon notification of the revocation of its billing number, if the provider or supplier seeks to re-establish enrollment and billing privileges in the Medicare program (either after the appeals process is exhausted or in place of the appeals process), then the provider or supplier must complete and submit a new CMS 855 as a new provider or supplier and applicable documentation. Providers must be resurveyed or recertified by the State survey agency as a new provider and must establish a new provider agreement with our Regional Office.

If the billing privileges are revoked due to the adverse activity of an individual or organization other than the provider or supplier, the revocation may be reversed if the provider or supplier terminates its business relationship with the individual or organization that was responsible for the revocation within 30 days.

As with a denial of Medicare enrollment, revocations would impact the provider or supplier on a national scale. As proposed in § 424.535(d), if a provider or supplier's billing privileges are revoked, we would review all other related Medicare enrollment files that the revoked provider or supplier has an association with (for example, as an owner or managing employee) to determine if the revocation warrants an adverse action of the associated Medicare provider or supplier.

I. Deactivation of Medicare Billing Privileges

When a provider or supplier's billing number is deactivated, billing privileges are suspended, but can be restored upon the submission of updated or recertified information. In new § 424.540, we proposed to continue to deactivate a provider or supplier's Medicare billing number if no Medicare claims are submitted for 2 consecutive calendar quarters (6 months) unless current policy or regulations specify otherwise for specific provider or supplier types. Our current policy requires deactivation of billing numbers after 4 consecutive calendar quarters (12 months) of no claim submissions. We included this reduction to the current requirement because we are aware of a number of program integrity issues related to inactive Medicare billing numbers. We wish to prevent, for example, questionable businesses from deliberately obtaining multiple numbers so that they could keep one “in reserve” in the event their practices result in suspension of claims payment under their active number. We also wish to prevent fraudulent entities from obtaining information about discontinued providers or suppliers, for example, using the Medicare billing number of a deceased physician.

We also proposed to require deactivation of a billing number if we discover changes to the information provided on the provider or supplier's CMS 855 that were not reported within 90 days of the change. This includes, but is not limited to, changes to billing services, a change in the practice location, or a change of any managing employee. A change in ownership or control must be reported within 30 calendar days.

Deactivation of Medicare billing privileges is considered a temporary action to protect the provider or supplier from misuse of their billing number and to also protect the Medicare Trust Funds from unnecessary overpayments. The temporary deactivation of a billing number would not have any effect on a provider or supplier's participation agreement or conditions of participation.

In § 424.540(b), we proposed that a provider or supplier whose billing number has been deactivated for any reason other than nonsubmission of a claim for 6 months and who wants to reactivate its Medicare billing number must complete and submit a new CMS 855. Those providers and suppliers whose billing number are deactivated after nonsubmission of a claim must recertify that the enrollment information currently on file with Medicare is correct before the claim would be paid. In addition, the provider or supplier must meet all current Medicare requirements in place at the time of the reactivation. The provider or supplier must also be prepared to submit a valid claim or risk subsequent deactivation of their billing number. Once notified, we would give all reactivations of Medicare billing numbers priority handling to ensure expedient payment of claims. Reactivation of a Medicare billing number would not require resurvey or certification by State agency, or the establishment of a new provider agreement.

J. Provider and Supplier Appeals

In new § 424.545, we proposed that a provider or supplier that has been denied enrollment in the Medicare program, or whose enrollment has been revoked, may appeal our decision in accordance with our regulations at part 405, subpart H, for suppliers or part 498, subpart A, for providers. We are currently drafting a single regulatory appeals process for all providers and suppliers denied or revoked from participation in the Medicare program. In keeping with current policy, we also proposed that no payments would be made during the appeals process. If the provider or supplier is successful in overturning a denial or revocation, unpaid claims for services furnished during the overturned period may be resubmitted.

In addition, we proposed in § 424.545(b) that a provider or supplier whose billing privilege was deactivated may file a rebuttal using procedures found at § 405.74.

K. Prohibitions on the Sale or Transfer of Billing Privileges

We proposed in new § 424.550 that a provider or supplier would be prohibited from selling its Medicare billing number to any individual or entity, or allowing another individual or entity to use its Medicare billing number. Similarly, we would prohibit a provider or supplier from transferring its Medicare billing privileges to any individual or entity, except during a change in ownership, as stated below. A provider or supplier does not have independent authority to sell or transfer any billing number issued or the billing privileges granted with the billing number assigned.

We proposed this policy because only we and our agents have the authority to issue Medicare billing numbers and grant Medicare billing privileges. These numbers are issued only after the information about the provider or supplier collected on the CMS 855 is verified. Because it is used to uniquely identify a provider or supplier, the Medicare billing number we issue is solely for use by the specific provider or supplier to whom it was issued.

In the case of a provider or supplier undergoing a change of ownership as described in part 489 subpart A, we would require at § 424.550(b) that a CMS 855 be completed and submitted by both the current owner and the new owner before the completion of the ownership change. Failure of the current owner to submit the CMS 855 prior to the change of ownership may result in sanctions and penalties, after the date of ownership change, in accordance with § 424.520, § 424.540, and § 489.53. Failure of the new owner to submit the CMS 855 prior to the change of ownership may result in the deactivation of the Medicare billing number until the CMS 855 has been submitted.

We may deactivate a Medicare billing number at any time before final transference of the provider agreement to the new owner. This may occur as a result of the submission of a CMS 855 with material omissions, or preliminary information received or determined by us that makes us question whether the new owner would ultimately be granted a final transference of the provider agreement. This allows us the right to ensure that billing privileges are given only to a new owner for which we have adequate information to, at a minimum, determine that the new owner should have billing privileges prior to the complete validation of their CMS 855 and the transfer of the provider agreement.

We understand that not all enrollment information is available before the change of ownership. We will work with the new owner(s) to ensure a seamless transition, but it is the provider's or supplier's responsibility to report this and any other changes to us to prevent us from imposing any adverse action against it.

For those providers and suppliers not covered by part 489, any change in the ownership or control of the provider or supplier must be reported on the CMS 855 within 90 days of the change as noted in § 424.540(a)(2). Generally, a change of ownership that also changes the tax identification number would require a new CMS 855 from the new owner.

L. Payment Liability

In new § 424.555, we proposed that any expenses for services furnished to a Medicare beneficiary by those categories of suppliers covered by section 1834 of the Act (that is, suppliers of DMEPOS) are the responsibility of that supplier if the supplier has been denied Medicare billing privileges. We further proposed that no payment may be made for covered services furnished to a Medicare beneficiary by a provider or supplier whose billing privileges were deactivated or revoked. The Medicare beneficiary would have no financial responsibility for this type of expense, and the provider or supplier must refund on a timely basis any amounts collected from the beneficiary for those covered services.

We proposed these provisions because a provider or supplier who fails to provide valid enrollment information, or who is not a valid provider or supplier type under the Medicare program, cannot be verified as a legitimate provider or supplier for purposes of this rule. Claims or bills submitted for covered Medicare services must have an active Medicare billing number. Claims or bills submitted by a provider or supplier who is not properly enrolled, and does not have an active Medicare billing number, would be considered incomplete and would be returned. The provider or supplier would then be in violation of the mandatory claims submission requirements and could be fined for each occurrence. An incomplete claim returned for this reason would not be afforded appeal rights for the provider or supplier. However, a provider or supplier may appeal a denial or revocation of enrollment in accordance with regulations elsewhere in this subpart.

Sections 1802(b), 1834(j), 1866, and 1870 of the Act, provide Medicare beneficiaries with certain protections against liabilities imposed by providers and suppliers. In section 1834(j)(4), for example, the statute protects the beneficiary against demands for payment for covered Medicare services by certain categories of suppliers that have not been granted Medicare billing privileges. Section 1866 of the Act prohibits providers that have entered into agreements described in that section from charging the beneficiary for covered items or services that are not paid by Medicare because the provider has failed to comply with certain requirements. Furthermore, section 1802(b) of the Act, which sets forth a variety of criteria under which physicians and practitioners may enter into private contracts with Medicare beneficiaries, provides for additional beneficiary protection. Section 1870 of the Act provides that, except under certain circumstances, any payment to a provider of services for items or services furnished shall be considered a payment to the individual, but that the individual will not be liable for overpayment to the provider where the individual is without fault.

In addition, section 1128A(a)(6) of the Act provides for criminal penalties for providers and suppliers having knowledge of events affecting the right to benefit or payment, and concealing or failing to disclose such an event with an intent to fraudulently secure benefit or payment when it is not authorized.

The CMS 855 states that the following penalties may be imposed:

• 18 U.S.C. 1001 authorizes criminal penalties against an individual who in any matter within the jurisdiction of any department or agency of the United States knowingly and willfully falsifies, conceals or covers up by any trick, scheme or device a material fact, or makes or uses any false, fictitious, or fraudulent statements or representations, or makes any false writing or document knowing the same to contain any false, fictitious or fraudulent statement or entry. Individual offenders are subject to fines of up to $250,000 and imprisonment for up to 5 years. Offenders that are organizations are subject to fines of up to $500,000. 18 U.S.C. 3571(d) also authorizes fines of up to twice the gross gain derived by the offender.
• Section 1128B(a)(1) of the Act authorizes criminal penalties against an individual who “knowingly and willfully makes or causes to be made any false statement or representation of a material fact in any application for any benefit or payment under a Federal health care program.” The offender is subject to fines of up to $25,000 or imprisonment for up to 5 years, or both.
• The Civil False Claims Act, 31 U.S.C. 3729, imposes a civil penalty of $5,000 to $10,000 per violation, plus three times the amount of damages sustained by the Government and imposes civil liability, in part, on any person who—

+ Knowingly presents, or causes to be presented, to an officer or an employee of the United States Government a false or fraudulent claim for payment or approval;

+ Knowingly makes, uses, or causes to be made or used, a false record or statement to get a false or fraudulent claim paid or approved by the Government; or

+ Conspires to defraud the Government by getting a false or fraudulent claim allowed or paid.

• Section 1128A(a)(1) of the Act imposes administrative sanctions on a person for the submission to a Federal health care program of false or otherwise improper claims.

These administrative sanctions include a civil monetary penalty of up to $10,000 for each item or service falsely or fraudulently claimed an assessment of up to triple the amount claimed, and exclusion from participation in all Federal health care programs.

The government may assert common law claims such as “common law fraud,” “money paid by mistake,” and “unjust enrichment.” Remedies include compensatory and punitive damages, restitution, and recovery of the amount of the unjust profit.

In addition, the following two sanctions were added to the CMS 855 form:

• 18 U.S.C. 1035 authorizes criminal penalties against individuals in any matter involving a health care benefit program who knowingly and willfully falsifies, conceals, or covers up by any trick, scheme, or device a material fact; or makes any materially false, fictitious, or fraudulent statements or representations, or makes or uses any materially false fictitious, or fraudulent statement or entry, in connection with the delivery of or payment for health care benefits, items, or services. The individual shall be fined or imprisoned up to 5 years or both.
• 18 U.S.C. 1347 authorizes criminal penalties against individuals who knowing and willfully execute, or attempt, to execute a scheme or artifice to defraud any health care benefit program, or to obtain, by means of false or fraudulent pretenses, representations, or promises, any of the money or property owned by or under the control of, any health care benefit program in connection with the delivery of or payment for health care benefits, items, or services. Individuals shall be fined or imprisoned up to 10 years or both. If the violation results in serious bodily injury, an individual will be fined or imprisoned up to 20 years, or both. If the violation results in death, the individual shall be fined or imprisoned for any term of years or for life, or both.

III. Analysis and Responses to Public Comments

We received a total of 152 comments on the April 25, 2003 proposed rule. Below is a summary of the comments received and our responses to them.

Comment: Several commenters stated that the language concerning “effective billing dates” was confusing. Commenters stated that they thought we were changing the current policy on submitting claims retroactively after the enrollment process was complete.

Response: While we understand these concerns, it was never our intent to change our policy on effective billing dates. We have clarified and referenced current policy citations in the final regulation text. We will continue to pay claims under all current reimbursement policies.

Comment: Several commenters expressed concern about our proposal to reduce the period of nonbilling activity to deactivate a Medicare billing number. This period is currently 12 months and we proposed reducing it to 6 months.

Response: Based on the expressed concerns, we will maintain the current 12-month period. In addition, to avoid future misinterpretation, we have defined the 12-month time period as beginning the 1st day of the 1st month without the submission of a claim through the last day of the 12th consecutive month without submitting a claim.

Comment: Several commenters expressed concern regarding our proposal to begin a 3-year revalidation process for all providers and suppliers billing Medicare. The concerns were with our ability to efficiently handle the additional workload and continue to issue new Medicare billing numbers in a timely manner.

Response: While we appreciate this concern, we will not implement this initiative until OMB approves changes to the November 2001 provider/supplier enrollment applications.

Comment: Several commenters recommended that we add a number of definitions, including provider, supplier, applicant, and managing director to this final rule. Moreover one of these commenters recommended that all definitions in the enrollment forms be included in the regulation and that all definitions included in the final rule be included in the instructions to the enrollment forms.

Response: We decided not to include additional definitions because many of the definitions that commenters requested that we include in this final rule are already defined in statute. However, to ensure consistency in application and clarity for individual and organizational applicants, our manuals and the provider enrollment applications will include all necessary definitions. We do not believe that it is necessary to include all of the definitions included in the enrollment applications in this regulation.

Comment: One commenter recommended that we amend the proposed regulation to affirmatively state that a W-2 employee of the applicant parent corporation can serve as a delegated official, even though he or she may or may not be a W-2 employee of the applicant itself.

Response: We believe that it is essential that any individual assigned as a delegated official has a direct relationship and connection with the applicant. We recognize that there are instances where an employee of a provider's parent company may exercise a tremendous degree of authority over the provider. However, in these cases the fact remains that the provider and the parent company are two separate legal entities. For obvious legal reasons, we simply cannot establish a blanket provision whereby a W-2 employee of one entity can sign the CMS 855 on behalf of another entity.

Comment: Several commenters made comments regarding the provider/supplier enrollment applications that were published in 2001.

Response: We considered these changes as we developed the latest version of the provider and supplier enrollment applications. These fully revised applications were published in the Federal Register in July 2005. Some of the changes to the redesigned provider/supplier enrollment applications were made in preparation for an electronic enrollment process. We will continue to use the approved version (November 2001) of the provider and supplier enrollment applications until the revised applications are approved by OMB.

Comment: One commenter requested that we clarify if currently enrolled providers and suppliers are required to complete a provider enrollment application.

Response: All providers and suppliers, including those currently billing Medicare, will be required to complete and submit an enrollment application. We will phase-in the revalidation process for providers and suppliers currently participating in the Medicare program.

Comment: One commenter questioned the need to obtain a national provider identifier and also enroll in the Medicare program.

Response: The National Provider Identifier (NPI) will replace healthcare provider identifiers in use today in standard healthcare transactions. The application and request for a NPI does not replace the enrollment process for Medicare. Enrolling in a particular health plan authorizes providers and suppliers to bill and be paid for services covered under Medicare.

Comment: A number of commenters expressed the need for us to have an electronic enrollment process, including the ability to update and report changes to their enrollment information.

Response: We are currently developing a web-based electronic enrollment process which will also allow for reporting changes electronically. We expect this process to be operational in 2007. It is expected that this process will reduce the burden on the providers and suppliers and speed the approval process for new applications.

Comment: Several commenters expressed the need for us to establish an electronic signature process. Another commenter recommended that providers and suppliers be allowed to report changes electronically.

Response: We appreciate these suggestions and will consider adopting as we develop our electronic enrollment process.

Comment: One commenter recommended that we develop pre-populated revalidation applications which list the current information on enrolled providers and suppliers. This would allow providers and suppliers to simply verify that the information is correct, make necessary corrections, and sign the document to attest to the correctness of the information provided.

Response: As we stated in the preamble to the proposed rule, we support this approach and appreciate this recommendation. We believe that the electronic enrollment process will allow providers and suppliers to verify existing information, make necessary corrections, and attest to the correctness of the information submitted.

Comment: One commenter recommended postponing the effective date of revalidation until technology is available for electronic submission.

Response: We understand this commenter's concern. However, we do not believe that it is practical to delay implementation of revalidation until an electronic process is established. Moreover, section 902 of the Medicare Prescription Drug, Improvement and Modernization Act of 2003 (MMA) amended section 1871(a) of the Act and requires us to publish a final regulation within 3 years of publishing proposed or interim final regulation in order to implement the proposed or interim final regulation.

Comment: A number of commenters recommended that CMS phase-in requirements to submit an initial enrollment application or respond to a revalidation request.

Response: We agree that a phased-in approach will limit delays in the enrollment process. While we note that a provider or supplier may voluntarily submit an enrollment application at any time, we will instruct our contractors to process new enrollment applications first, request and process enrollment applications for providers and suppliers currently billing the program second, and initiate revalidation activities for most providers and suppliers third. Clearly, we will monitor the processing of enrollment applications to ensure that all applications are processed within established time frames.

Comment: A number of commenters expressed concern about individual contractors' ability to process the increased workload associated with obtaining and validating new enrollment applications for existing providers.

Response: In addition to processing enrollment applications for providers and suppliers seeking entry into the Medicare program, we expect that our fee-for-service contractors will request enrollment applications from providers and suppliers already billing the Medicare program in FY 2006 and FY 2007. In addition, we expect they will conduct a limited number of revalidations in FY 2006 and FY 2007, with an increased number of revalidations in FY 2008. By focusing on processing enrollment applications for new applicants and existing Medicare providers and suppliers who have not completed and submitted a Medicare enrollment application, we expect to process enrollment applications in a timely manner.

Comment: Several commenters recommended that we establish a 5-year cycle rather than a 3-year cycle for revalidation.

Response: We appreciate these comments and agree that establishing a 5-year revalidation cycle rather than a 3-year cycle reduces the burden on providers and suppliers. Therefore, we have revised the final rule to establish a 5-year revalidation cycle. We believe that extending the revalidation cycle by an additional 2 years from our proposed approach will lessen the burden on providers and suppliers. Moreover, since providers and suppliers are required to update their enrollment when changes occur, we believe that we will be able to ensure that we maintain correct enrollment information for each provider or supplier billing the Medicare program.

Comment: Several commenters recommend that we describe how providers and suppliers would be notified about revalidation.

Response: We expect that a fee-for-service contractor would notify the provider or supplier in writing regarding the need to revalidate its enrollment information. Once notified, providers and suppliers would be expected to review, update and submit any changes and supporting documentation regarding the enrollment record within 60 days. If no changes have occurred, a provider or supplier would simply sign, date, and return the revalidation application.

Comment: Several commenters raised concerns about our contractors' ability to review and validate enrollment applications for the large numbers of physicians who are currently billing Medicare but who have not completed an enrollment application.

Response: To mitigate any potential processing delays, we will phase-in the enrollment of physicians along with all other providers and suppliers who are currently billing Medicare but who have not completed and submitted an enrollment application. Moreover, we will instruct our contractors to work closely with individual providers and suppliers, provider organizations, and State and local associations to ensure that enrollment process is implemented in an efficient manner. We will closely monitor fee-for-service contractor workloads and processing times to ensure that all enrollment applications are processed in a timely manner.

Comment: Several commenters recommended that we allow providers and suppliers 90 days to respond to contractor's initial or revalidation request.

Response: We believe that provider and suppliers can routinely respond to an initial or revalidation request within 60 days. This is especially true for those providers and suppliers who submit changes to the fee-for-service contractor as they occur. For those providers or suppliers needing additional time to respond to a contractor's request for enrollment data, providers and suppliers should notify the contractor that additional time is needed. However, if a provider or supplier fails to submit the requested application and supporting documentation in a timely manner, contractors will need to make a decision regarding revocation.

Comment: Several commenters recommended that we not conduct unannounced site visits to verify enrollment information.

Response: We believe that unannounced site visits are a useful tool to ensure that providers and suppliers are meeting their enrollment requirements. Therefore, we will continue this practice to verify enrollment information.

Comment: Several commenters recommended that we exclude certain provider types (that is, SNFs) from the revalidation site visit process.

Response: While we understand these commenters' concerns, we believe that a revalidation site visit is a useful tool to ensure that providers and suppliers maintain their practice location and other enrollment information on file with Medicare. In addition, we have not been able to develop an objective measure that would allow us to exclude some provider types from revalidation, but not others. Therefore, we will continue to use site visits in the revalidation process as we deem appropriate.

Comment: One commenter recommended that a negative finding from a site visit not be used as a basis to immediately deny or revoke enrollment in the Medicare program.

Response: We will consider that nature of the negative finding in determining whether to deny or revoke enrollment. We will use the criteria established in § 424.515(c)(1) and (2) to conduct on-site inspections. In addition, if it is determined to deny or revoke enrollment, we will ensure that every provider and supplier is afforded the appropriate appeals rights. We believe that providers and suppliers must meet the enrollment criteria prior to enrollment. Moreover, providers and suppliers have an obligation to notify their fee-for-service contractor in a timely manner regarding any changes in their enrollment application. Therefore, we will not adopt this recommendation.

Comment: One commenter recommended that we provide permissive exemption from revalidation for providers that can demonstrate a good reporting history or multi-facility providers with a well-developed and effective reporting system for reporting changes.

Response: We believe that an exemption process for revalidation is not viable because revalidation is a separate process from provider survey and certification procedures.

Comment: One commenter recommended that we establish a process to “grandfather” providers who already have Medicare billing numbers.

Response: We believe that it is essential that all providers and suppliers who are billing the Medicare program furnish complete and accurate enrollment information that can be validated to ensure compliance with Medicare requirements. Therefore, we will not establish a process to “grandfather” providers who already have Medicare billing numbers.

Comment: Several commenters recommended that we provide additional information about the provider enrollment appeals process.

Response: We will establish an appeals process for providers and suppliers whose applications for enrollment or revalidation of enrollment are denied or revoked in a separate proposed regulation.

Comment: One commenter recommended that all potential suppliers be accredited.

Response: In implementing section 302 of the MMA, we will publish a proposed rule that would implement a competitive bidding program for suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS). This proposed rule would also implement new quality and accreditation standards for all suppliers of DMEPOS items and services, including suppliers who will participate in the DMEPOS competitive bidding program. While we are developing a competitive bidding program for DMEPOS suppliers, we do not anticipate developing a separate accreditation program for other supplier types.

Comment: Several commenters recommended that we establish provider enrollment processing timeliness standards.

Response: In implementing section 936(a)(2) of the MMA, we expect to publish a proposed rule which specifies the time frames in which the Medicare fee-for-service contractors are expected to process all provider and supplier enrollment applications.

Comment: Several commenters recommended that we clarify the definition of the term, “managing employee.”

Response: We believe that the statutory language at section 1126(b) of the Act is clear and places no limits on the number of managing employees who must be reported. Accordingly, we are not making any changes to this definition.

Comment: Several commenters recommended that we allow physicians to revalidate their enrollment in Medicare through the credentialing office of a hospital.

Response: We believe that this approach would result in an increase in the administrative burden on most hospitals and thus are unable to adopt this approach.

Comment: One commenter recommended that we remove the surety bond section (Section 11) from the CMS 855S application.

Response: We concur with this recommendation and will remove the surety bond section from all versions of the provider enrollment application when we update and republish these applications.

Comment: One commenter stated that it was unclear whether our carriers and FIs, or State agencies would conduct provider enrollment site visits.

Response: Medicare carriers and FIs will conduct provider enrollment site visits. State agencies and other accrediting bodies will continue to conduct the survey and certification of providers separately.

Comment: One commenter recommended that we provide a site visit exemption to selected provider groups, which have exhibited compliance with all Medicare guidelines and requirements.

Response: We understand the commenter's concern, but do not believe it would be practical to establish an exception policy at this time. We expect that our contractors will prioritize the need for site visits for both newly enrolling and existing providers and suppliers.

Comment: One commenter raised concerns about CMS charging user fees to pay for costs associated with enrolling in the Medicare program.

Response: As part of the rulemaking process, we did not propose charging a fee to enroll in the Medicare program.

Comment: One commenter asked that we clarify language contained in § 424.530(a)(3) and § 424.535(a)(3) which refers to reporting felony convictions.

Response: We have clarified that we may deny or revoke a provider or supplier's billing privileges if the provider or supplier was convicted of certain types of felonies as specified in § 424.530(a)(3) and § 424.535(a)(3) within the 10 years preceding enrollment or revalidation of enrollment.

Comment: Several commenters recommended that we notify providers regarding an upcoming revalidation by sending any request via certified mail to the authorized representative listed on the enrollment application.

Response: We do not believe that this level of operational detail is required in this final rule. We believe that requiring the use of certified mail will significantly increase administrative costs for the program. Moreover, we believe that we should be able to maintain a level of flexibility regarding our notification procedures.

Comment: One commenter asked that we clarify the distinction between enrolling in the Medicare program and establishing and maintaining billing privileges. This commenter also asked that we provide an example of the circumstances under which a provider would be issued an identification number without activating the corresponding billing privileges.

Response: Providers and suppliers are required to enroll in Medicare prior to submitting a claim. The enrollment process allows Medicare to determine if the provider or supplier meets all applicable Federal and State requirements. Once a provider or supplier is enrolled in a Medicare program, it can obtain Medicare billing privileges. These privileges continue as long as the provider or supplier continues to meet applicable Federal and State requirements. Therefore, we have clarified in this final rule the requirements to enroll or remain enrolled in the Medicare program.

Comment: One commenter recommended that we continue the current practice of enrolling providers subject to certification surveys as of the date of their initial survey.

Response: We appreciate this comment and have clarified that we are maintaining the effective dates for reimbursement that are specified in § 489.13 for providers and suppliers requiring State survey or certification or accreditation, § 424.5 and § 424.44 for nonsurveyed or certified/accredited suppliers, and § 424.57 and section 1834(j)(1)(A) of the Act for DMEPOS suppliers.

Comment: One commenter stated that the proposed rule blurs the concepts of “routine revalidation” with “non-routine revalidation” and that we should clarify these concepts.

Response: We appreciate this comment and have clarified the concepts of “revalidation” and “off cycle revalidation.” We believe that revalidation activities would occur on a scheduled basis (for example, every 5 years) while off cycle revalidations would occur when warranted to assess and confirm the validity of the enrollment information provided to CMS.

Comment: One commenter suggested that the enrollment process be national in scope where a provider or supplier need only complete one application to be able to render services anywhere in the country without completing another application.

Response: While we have made every effort to reduce the paperwork burden associated with enrolling in the Medicare program, we can not use a single enrollment application because of the large number of different provider and supplier types and specialties, each with different eligibility requirements for enrollment in the Medicare program. This avenue was attempted in the past and was unsuccessful. With the release of the new Medicare enrollment applications, we have simplified the enrollment process and combined forms and or sections of information collection where possible. CMS will further simplify multi-State enrollment burdens when the web based forms and submission process are implemented. Thus, it is not administratively feasible to adopt this comment.

Comment: One commenter asked that we clarify that this rule only applies when a provider or supplier is billing for “Medicare-covered” services or supplies.

Response: We agree with this commenter and have added the phrase “Medicare covered services or supplies” to § 424.500.

Comment: One commenter requested that a change in the “control of an entity” not be held to the same stringent requirements as a change in “ownership” of an entity.

Response: Because past history has shown this to be a problematic enrollment reporting area, we are not able to adopt this request.

Comment: One commenter asked that we allow flexibility on the timeframe to submit additional information when it is missing from the enrollment application.

Response: To assist providers and suppliers in determining what documentation must be submitted with an enrollment application, we are revising section 17 of the provider/supplier enrollment application to clarify what documents must be submitted with the enrollment application. The fee-for-service contractor will notify a provider or supplier regarding any missing documentation. In addition, § 424.525 states that a contractor may reject an applicant's enrollment application if it fails to furnish all required supporting documentation within 60 calendar days of submitting the enrollment application. Contractors may extend the 60-day period if the contractor determines that the provider or supplier is actively working with CMS to resolve any outstanding issues.

Comment: One commenter stated that current regulations in § 489 do not allow termination of a provider agreement if billing privileges are terminated.

Response: We are changing the provisions at § 489 which allow these terminations to occur.

Comment: One commenter asked that the requirements for reporting a change of ownership be removed or lessened.

Response: In order to maintain correct provider and supplier enrollment information, we believe that it is reasonable for providers to provide information regarding changes in ownership in a timely manner.

Comment: A commenter suggested that we could reduce some administrative burden if we specified that the payment liability provisions only apply after all appeals processes have been rendered.

Response: We appreciate this comment, but are unable to adopt this suggestion because we must comply with the limitation on patient liability as specified in section 1834(j)(4) of the Act.

Comment: One commenter suggested we only revalidate providers that are proven to be a potential threat to the Medicare program or the beneficiary.

Response: We will consider this issue in future rulemaking. Initially, we believe that it is essential that we obtain valid enrollment information on all providers and suppliers who have a business relationship with the Medicare program.

IV. Provisions of the Final Rule

We are adopting the provisions of the proposed rule as final with the following changes.

Section 936(a)(2) of the MMA established section 1866(j)(1)(A) of the Act which requires that the Secretary establish a process by regulation for the enrollment of providers and suppliers. Therefore, we refer to this authority to collect enrollment information.

In § 424.530 and § 424.535, we revise the regulation text to include the authority given to us in sections 1128A and 1842 of the Act regarding exclusion authorities.

In § 424.505, we clarify that we will maintain our practice that all providers and suppliers have a valid Medicare billing number at the time that a claim is being submitted for Medicare covered items or services.

Under section 1834 (j)(1)(A) of the Act, DMEPOS suppliers must have an effective Medicare billing number for the date an item or service was rendered in order to receive payment for Medicare covered items or services.

Under longstanding policy and operating procedures any claim submitted with an inactive billing number is incomplete and cannot be processed for payment. Providers and suppliers who are not enrolled in the Medicare program must adhere to the mandatory claims submission rules specified in section 1848(g)(4) of the Act and § 424.32(a)(1) (Basic requirements for all claims). In addition, a claim submitted without a valid Medicare billing number would not be considered a valid claim and will be rejected. If the mandatory claims submission requirements are not met, the provider or supplier may have sanctions imposed as outlined in section 1848(g)(4) of the Act for failure to file a claim as required.

We are adopting a position that the issuance of an identification number, including a NPI, to a provider or supplier does not automatically convey the privilege to bill Medicare. There must be a corresponding approval of the provider or supplier as meeting all Federal and State requirements to bill Medicare for the identification number to be an approved and active Medicare billing number. The NPI, as defined in 45 CFR part 162, subpart D, will be the Medicare billing number upon its adoption the Medicare program.

In § 424.510, we adopted language to clarify that the current policy remains the same and that a provider or supplier must submit to us the applicable provider/supplier enrollment application based on the type of provider or supplier enrolling. Currently, the applicable enrollment applications are identified as follows:

• CMS 855A—Medicare Enrollment Application for Institutional Providers.
• CMS 855B—Medicare Enrollment Application for clinics, Group Practices and Certain Other Suppliers.
• CMS 855I—Medicare Enrollment Application for Physicians and Non-Physician Practitioners.
• CMS 855R—Medicare Enrollment Application for Reassignment of Medicare Benefits.
• CMS 855S—Medicare Enrollment Application for Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Suppliers.
• The appropriate CMS Internet web based electronic version of the provider/supplier enrollment applications.

Note:

CMS is currently developing these electronic enrollment applications and expects it to be available in 2007.

The applicable enrollment application is used to gather information on providers and suppliers for the purposes of authorizing billing numbers and establishing eligibility to furnish services to Medicare beneficiaries. The information submitted also allows for the unique identification of the providers and suppliers for the purpose of enumeration and payment. The CMS 855 forms have been used since 1996 and were approved by OMB for these purposes (OMB approval number 0938-0685).

At § 424.510(d)(2), we are adopting the provisions which requires that a provider or supplier submit the following on the appropriate enrollment application:

• Complete, accurate and truthful responses to all information requested within each section as applicable to the provider or supplier type.
• All documentation required by CMS under this or other statutory or regulatory authority, or under the Paperwork Reduction Act of 1995 to uniquely identify the provider or supplier (for example, an NPI, a SSN or a TIN). We are including the NPI because it closely resembles other types of information contained in the proposed rule. Further, CMS will not be able to finalize the enrollment review process after May 23, 2007, unless the provider or supplier furnishes an NPI.
• All documentation required by us under this or other statutory or regulatory authority, or under the Paperwork Reduction Act of 1995 to establish the provider or supplier's eligibility to furnish items or services to beneficiaries in the Medicare program (for example, a medical license or business license).

In § 424.515, we are adopting a 5-year revalidation cycle. In adopting a 5-year revalidation cycle, we believe that we can address the concerns raised during the public comment process about fee-for-service contractor's ability to continue to process new enrollments while also conducting revalidation activities. Moreover, we believe that extending the revalidation cycle from 3 years to 5 years will significantly decrease the burden on providers and suppliers.

We will contact all providers and suppliers directly as to when their 5-year revalidation cycle starts beginning with those providers and suppliers currently enrolled in the Medicare program but that have not submitted a completed enrollment application. The revalidation process would ensure that we collect and maintain complete and current information on all Medicare providers and suppliers and ensure continued compliance with Medicare requirements. In addition, this process further ensures that Medicare beneficiaries are receiving items or services furnished only by legitimate providers and suppliers, and strengthens our ability to protect the Medicare Trust Funds.

We will reserve the right to perform off cycle (non-routine) revalidations and request a provider or supplier to recertify as to the accuracy of the enrollment information when warranted to assess and confirm the validity of the enrollment information. Off cycle revalidations may be triggered as a result of information indicating local health care fraud problems, national initiatives, fraud investigations, complaints from beneficiaries, or other reasons that cause us to question the integrity of the provider or supplier in its relationship with the Medicare program. Like routine revalidations, off cycle revalidations may or may not be accompanied by site visits.

In § 424.520(b), we are adopting a policy that individuals and organizations are responsible for updating their enrollment information to reflect any changes in a timely manner. We would define timely as meaning within 90 days, with the exception of DMEPOS suppliers which are currently required to report changes of enrollment information within 30 days, or a change in ownership or control of any provider or supplier which also must be reported within 30 days. Failure to do so may result in deactivation or even revocation of their billing privileges.

In § 424.525, we are adopting a position that if a provider or supplier enrolling in the Medicare program for the first time fails to furnish complete information on the enrollment application, or fails to furnish missing information or any necessary supporting documentation as required by CMS under this or other statutory or regulatory authority within 60 calendar days of our request to furnish the information, we would reject the provider or supplier's enrollment application. Rejection would not occur if the provider or supplier is actively communicating with us to resolve any issues regardless of any timeframes.

Upon notification of a rejected enrollment application, if the provider or supplier still wishes to enroll in the Medicare program, they must begin the enrollment process over by completing and submitting a new enrollment application and all applicable documentation. Since CMS cannot process an incomplete enrollment application, we must reject the application. Further, we clarify that applications that are rejected are not afforded appeal rights.

In § 424.530(a)(2) and § 424.535(a)(2), we clarify that no payments will be made to any providers or suppliers who are excluded from participation in the Medicare program under authorities found in sections 1128, 1128A, 1156, 1862, 1867, and 1892 of the Act, or who are debarred, suspended or otherwise excluded as authorized by the FASA. This includes any individual, entity, or any provider or supplier that arranges or contracts with (by employment or otherwise) an individual or entity that the provider or supplier knows or should know is excluded from participation in a Federal health care program for the provision of items or services for which payment may be made under such a program (section 1128A(a)(6) of the Act), and any provider or supplier that has been debarred, suspended, or otherwise excluded from participation in any other Executive Branch procurement or nonprocurement programs or activity (FASA, section 2455).

In § 424.530(a)(3), we are adopting the position that we may deny enrollment in the Medicare program if the provider or supplier, or any owner of the provider or supplier has been convicted of a Federal or State felony offense that we determine to be detrimental to the best interests of the Medicare program or its beneficiaries. This authority is afforded to us in many of the HIPAA fraud and abuse provisions and section 4302 of the BBA. In making assessments, we are stating that any felony convictions within the last 10 years preceding enrollment or revalidation of enrollment. In addition, we would consider the severity of the underlying offense.

Felonies that we determine to be detrimental to the best interests of the Medicare program or its beneficiaries include the following:

• Within the last 10 years preceding enrollment or revalidation of enrollment, crimes against persons, such as murder, kidnapping, rape, assault and battery, robbery, and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions. We believe it is reasonable for the Medicare program to question the ability of the individual or entity with such a history to respect the life and property of program beneficiaries.
• Within the last 10 years preceding enrollment or revalidation of enrollment, financial crimes, such as extortion, embezzlement, income tax evasion, making false statements, insurance fraud and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions. We believe it is reasonable for the Medicare program to question the honesty and integrity of the individual or entity with such a history in providing services and claiming payment under the Medicare program.
• Within the last 10 years preceding enrollment or revalidation of enrollment, any felony that placed the Medicare program or its beneficiaries at immediate risk, such as a malpractice suit that resulted in a conviction of criminal neglect or misconduct.
• Any felonies referred to in section 1128 of the Act.

In § 424.530(a)(5), we are adopting a position that we may deny enrollment when, upon on-site review or other reliable evidence, we determine that the provider or supplier is not operational to furnish Medicare covered items or services or is not meeting these Medicare enrollment requirements or the requirements set forth in the enrollment application.

As outlined in § 424.530(b), if the denied provider or supplier appeals the decision, and the denial is upheld, that provider or supplier may submit a new enrollment application after we notify it that the original determination was upheld. If the provider or supplier did not appeal the determination, it may submit a new enrollment application when the time frame for appeal rights has lapsed. We are adopting this latter requirement to prevent administrative difficulties that might result in processing two enrollment forms if a new one is submitted during the time period when the provider or supplier may appeal an initial denial.

In § 424.535, we are also adopting a position that we may revoke a provider or supplier's billing privileges if we find:

• The provider or supplier, any owner, managing employee, authorized or delegated official, supervising physician or other health care personnel who must be reported on the enrollment application, of the provider or supplier, becomes excluded from the Medicare, Medicaid or any other Federal health care programs, as defined in § 1001.2, or is debarred, suspended or otherwise excluded from participating in any other Federal health care program or agency.
• The provider or supplier, or any owner of the provider or supplier, is convicted of a Federal or State felony offense that we determine to be detrimental to the best interests of the program as outlined in “Denial of Enrollment” above.
• The provider or supplier certified as “true” deliberately submitted false or misleading information in order to enroll or maintain enrollment in the Medicare program. (Offenders may be subject to criminal or civil prosecution, in accordance with current laws and regulations).
• Upon on-site review, we determine that the provider or supplier is no longer operational to furnish Medicare covered items or services.
• The provider or supplier fails to furnish complete and accurate information on the enrollment application and any applicable documentation within 60 calendar days of our notice to recertify its enrollment information.
• The provider or supplier knowingly sells to or allows another individual or entity to use its billing number.

In addition to the revocation of the provider's or supplier's billing privileges, we will require at § 424.535(b) that any provider agreement or supplier agreement in effect at the time of revocation would also be terminated effective with the date of revocation. We do not believe it would be prudent for us to maintain an active provider agreement for a provider or supplier whose business relationship with Medicare was adverse enough as to cause the revocation of its billing privileges. Section 1866(b)(2)(A) of the Act specifies that the Secretary may terminate a provider agreement after the Secretary has determined that the provider fails to comply substantially with the provisions of title XVIII. We proposed to amend § 489.53 and § 498.3 to reflect this proposal.

In new § 424.535(c), we require upon notification of the revocation of its billing privileges that the provider or supplier must complete and submit a new enrollment application as a new provider or supplier and applicable documentation. Providers must be resurveyed or recertified by the State survey agency as a new provider and must establish a new provider agreement with our Regional Office.

If the billing privileges are revoked due to the adverse activity of an individual or organization other than the provider or supplier, the revocation may be reversed if the provider or supplier terminates its business relationship with the individual or organization that was responsible for the revocation within 30 days.

As with a denial of Medicare enrollment, revocations would impact the provider or supplier on a national scale. In § 424.535(e), we added language to clarify that if a provider or supplier's billing privileges are revoked, we would review all other related Medicare enrollment files and practice locations that the revoked provider or supplier has an association with (for example, as an owner or managing employee of another enrolled organization, or member of a group practice) to determine if the initial revocation warrants additional revocations of the other associated Medicare providers or suppliers.

In § 424.535(f) we added language that the revocation becomes effective within 30 days of the initial revocation notification. In § 424.540, we add that to continue to deactivate a provider or supplier's Medicare billing number if no Medicare claims are submitted for 12 consecutive months unless current policy or regulations specify otherwise for specific provider or supplier types. The 12 month period will begin the 1st day of the 1st month without a claims submission through the last day of the 12th month without a submitted claim.

We are also adopting a position to require deactivation of a billing number if we discover changes to the information provided on the provider or supplier's enrollment application that were not reported within 90 days of the change. This includes, but is not limited to, changes to billing services, a change in the practice location, or a change of any managing employee. A change in ownership or control must be reported within 30 calendar days.

Deactivation of Medicare billing privileges is considered an interim action to protect the provider or supplier from misuse of their billing number and to also protect the Medicare Trust Funds from unnecessary overpayments. The deactivation of a billing number would not have any effect on a provider or supplier's participation agreement or conditions of participation.

In § 424.540(b), we added language to clarify the requirements of reactivation of billing privileges when a provider or supplier's billing number is deactivated, but can be restored upon the submission of updated or recertified information. We are requiring that a provider or supplier whose billing number has been deactivated for any reason other than nonsubmission of a claim for 12 months and who wants to reactivate its Medicare billing number must complete and submit a new enrollment application as appropriate. Those providers and suppliers whose billing number are deactivated after nonsubmission of a claim must recertify that the enrollment information currently on file with Medicare is correct before the claim would be paid. In addition, the provider or supplier must meet all current Medicare requirements in place at the time of the reactivation. The provider or supplier must also be prepared to submit a valid claim or risk subsequent deactivation of their billing number. Once notified, we would give all reactivations of Medicare billing numbers priority handling to ensure expedient payment of claims. Reactivation of a Medicare billing number would not require resurvey or certification by State agency, or the establishment of a new provider agreement.

In § 424.545(a), we clarify that payment will not be made during the appeals process.

In § 424.545(c),we require that the provider or supplier be able to demonstrate that they meet the enrollment requirements and be able to make available any documents and records that support the provisions of this regulation and the Medicare enrollment application.

In § 424.550, we state that a provider or supplier would be prohibited from selling its Medicare billing number to any individual or entity, or allowing another individual or entity to use its Medicare billing number. Similarly, we would prohibit a provider or supplier from transferring its Medicare billing privileges to any individual or entity, except during a change of ownership, as stated below. A provider or supplier does not have independent authority to sell or transfer any billing number issued or the billing privileges granted with the billing number assigned.

We are adopting this policy because only CMS and its agents can enroll providers and suppliers and grant Medicare billing privileges. These numbers are issued only after the information about the provider or supplier collected on the applicable enrollment application is verified. Because it is used to uniquely identify a provider or supplier, the Medicare billing number we issue is solely for use by the specific provider or supplier to whom it was issued.

In the case of a provider or supplier undergoing a change of ownership as described in part 489 subpart A, we would require at § 424.550(b) that an enrollment application be completed and submitted by both the current owner and new owner before the completion of the ownership change. Failure of the current owner to submit an enrollment application prior to the change of ownership may result in sanctions and penalties, after the date of ownership change, in accordance with § 424.520, § 424.540, and § 489.53. Failure of the new owner to submit the enrollment application prior to the change of ownership may result in the deactivation of the Medicare billing privileges until the enrollment application has been submitted.

We may deactivate a Medicare billing number at any time before final transference of the provider agreement to the new owner. This may occur as a result of the submission of an enrollment application with material omissions, or preliminary information received or determined by us that makes us question whether the new owner would ultimately be granted a final transference of the provider agreement. This allows us the right to ensure that billing privileges are given only to a new owner for which we have adequate information to, at a minimum, determine that the new owner should have billing privileges prior to the complete validation of their enrollment application and the transfer of the provider agreement.

We understand that not all enrollment information is available before the change of ownership. We will work with the new owner(s) to ensure a seamless transition, but it is the provider's or supplier's responsibility to report this and any other changes to us to prevent us from imposing any adverse action against it.

For those providers and suppliers not covered by part 489, and change in the ownership of control of the provider or supplier must be reported on the enrollment application within 30 days of the change as noted in § 424.540(a)(2). Generally, a change of ownership that also changes the tax identification number would require a new enrollment application from the new owner.

In § 424.555, we clarify that no payment may be made for otherwise covered items or services furnished to a Medicare beneficiary by a provider or supplier whose billing privileges were deactivated or revoked. The Medicare beneficiary would have no financial responsibility for this type of expense, and the provider or supplier must, after all appeal processes have been exhausted and if the billing privileges have not been restored, refund on a timely basis any amounts collected from the beneficiary for those otherwise covered items or services.

We are adopting these provisions because a provider or supplier who fails to provide valid enrollment information, or who is not a valid provider or supplier type under the Medicare program, cannot be verified as a legitimate provider or supplier for purposes of this rule. Claims or bills submitted for otherwise Medicare covered items or services must have an active Medicare billing number. Claims or bills submitted by a provider or supplier who is not properly enrolled, and does not have an active Medicare billing number, would be considered incomplete and would be returned. The provider or supplier would then be in violation of the mandatory claims submission requirements and could be fined for each occurrence as set forth in Section 1848(g)(4) of the Act. An incomplete claim returned for this reason would not afford appeal rights for the provider or supplier. However, as described earlier, a provider or supplier may appeal a denial or revocation of enrollment in accordance with regulations elsewhere in this subpart.

V. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995, we are required to provide 30-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 requires that we solicit comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

Section 424.510 Requirements for Obtaining a Billing Number and Medicare Billing Privileges

To enroll in the Medicare program and obtain and activate a Medicare provider or supplier billing number, § 424.510(a) requires a provider or supplier to complete and submit an enrollment application to us, demonstrating that the provider or supplier meets all of the requirements set forth in this section. The burden associated with these requirements are currently captured in form CMS 855 (OMB Approval Number 0938-0685) and shown below in Table 1.

Table 1.—Current Estimated Hours for Completion of CMS 855 Forms for Initial Enrollment

CMS form No.	Estimated number of respondents	Estimated time for completion per respondent	Total number of hours for completion	Total cost in dollars (millions)
855A	5,000	6 hours	30,000	$4.5
855B	35,000	6 hours	210,000	31.5
855I	75,000	4 hours	300,000	6
855R	100,000	15 minutes	25,000	0.5
855S	16,000	6 hours	96,000	14.4
Total Estimated Hourly and Financial Burden			661,000	56.9

The estimated number of respondents is based on FY 2004 Medicare contractor workload reports. The cost in dollars is based on hourly salaries for applicable staff to complete the applications.

Section 424.510(a)(7) states that we reserve the right to perform on-site inspections of a provider or supplier to verify and ensure validity of the information submitted to us or our agents and to determine compliance with Medicare requirements. We intend to conduct on-site visits of all new suppliers of DMEPOS before they can enroll in the Medicare program. The burden associated with these requirements are currently captured and approved in form HCFA-R-263 (OMB Approval Number 0938-0749).

We also intend to conduct approximately 500 on-site visits to Community Mental Health Centers. The burden associated with these requirements are currently captured and approved in form HCFA-R-273 OMB Approval Number 0938-0770). In addition, we intend to conduct approximately 2,800 visits to IDTFs on an annual basis. We will seek OMB approval for these visits. The burden associated with this requirement is the time and effort necessary for a facility to provide documentation to verify information provided on their CMS 855 form and to demonstrate that they meet other necessary Medicare requirements and regulations.

Table 2.—Estimated Annual Reporting Burden

CFR sections	Annual number of responses	Frequency	Average burden per reponse (hours)	Annual burden (hours)	Annual cost
424.510(d)	2,800	1	4	11,200	$0

Since these site visits are unannounced and performed to ensure proper physical location, equipment, and personnel to meet Medicare requirements, we do not expect the provider or supplier to incur any financial burden.

We may also conduct on-site visits of providers or suppliers based on any information that leads us or our agents to believe that an administrative action, investigation, or audit is warranted. Information collected under these situations is exempt from the PRA, as stipulated in 5 CFR 1320.4.

Section 424.515 Requirements for Reporting Changes and Updates To, and the Periodic Revalidation of, Medicare Enrollment Information

A provider or supplier must recertify for revalidation its enrollment information once every 5 years. Section 424.515(b) states that within 60 calendar days of our notice to recertify their enrollment information for revalidation, a provider or supplier must submit any new or revised form CMS 855 information and documentation necessary to demonstrate that they meet the requirements set forth in this section.

Table 3.—Estimated Annual Reporting Burden

CFR sections	Annual number of responses	Frequency	Average burden per reponse (minutes)	Annual burden (hours)	Annual cost (millions)
424.515(b)	232,000	* *	90	348,000	$23.2
** Where frequency is once every 5 years. (1.16 million providers and suppliers/5 years × 90 minutes/60 minutes.)

The burden hours shown above are for the standard 5-year reporting period. We are exploring various options on ways of minimizing the burden on providers and suppliers during the process of revalidating their enrollment information.

The estimated cost is based on an average cost of $100 per application per provider to review and return.

Section 424.520 Additional Provider and Supplier Requirements for Enrolling and Maintaining Active Enrollment Status in the Medicare Program

Following enrollment and periodic recertification of enrollment information, a provider or supplier must report to us any changes to the information furnished on the CMS 855 or supporting documentation within 90 calendar days of the change.

Table 4.—Estimated Annual Reporting Burden

CFR section	Annual number of responses	Frequency	Average burden per response (hours)	Annual burden (hours)	Annual cost (millions)
424.20	100,000	1	1	100,000	$10

Section 424.525 Rejection of a Provider or Supplier's Medicare Enrollment Application

We will reject a provider or supplier's enrollment application if the provider or supplier does not furnish missing or necessary information and documentation to us within 60 calendar days of a request. We believe that the burden associated with this requirement is captured in § 424.515, as we will merely be seeking the information initially requested in the CMS 855.

Section 424.525(c) states that upon notification of a rejected CMS 855, the provider or supplier must complete and resubmit a new enrollment application and all applicable documentation to resume the enrollment process and obtain a Medicare billing number and billing privileges.

Table 5.—Estimated Annual Reporting Burden

CFR section	Annual number of responses	Frequency	Average burden per response (min)	Annual burden (hours)	Annual cost (millions)
424.525(b)	5,000	1	90	7,500	$0.5

The annual dollar cost is based on $100 per respondent to update and resubmit a previously submitted enrollment application.

Section 424.535 Revocation of Enrollment and Billing Privileges From the Medicare Program

Section 424.535(c) states that upon notification of the revocation of its billing privileges, if the provider or supplier seeks to re-establish enrollment in the Medicare program it must re-enroll in the Medicare program through the completion and submission of a new CMS 855 and applicable documentation.

Table 6.—Estimated Annual Reporting Burden

CFR section	Annual number of responses	Frequency	Average burden per response (hours)	Annual burden (hours)	Annual cost (millions)
424.535(b)	200	1	6	1,200	$0.12

The annual dollar cost is based on $600 per respondent to re-enroll in the Medicare program.

Providers must also be resurveyed or recertified by the State Survey Agency and must establish a new provider agreement with our Regional Office. The burden associated with the survey and certification requirement is exempt from the PRA, as provided in section 4204(c) of COBRA 87 (Pub. L. 100-203), as amended by the Medicare Catastrophic Coverage Act of 1988 (Pub. L. 100-360). The burden associated with the requirement to establish a new provider agreement (Form HCFA-460) is currently approved under OMB Approval Number 0938-0373.

Section 424.540 Deactivation of Medicare Billing Privileges

Section 424.540(a)(1) states that if no Medicare claims are submitted for 12 consecutive calendar months we will deactivate a provider or supplier's Medicare billing number. The provider or supplier must complete and submit an enrollment application for validation to reactivate its Medicare billing number and billing privileges.

Table 7.—Estimated Annual Reporting Burden

CFR section	Annual number of responses	Frequency	Average burden per response (min)	Annual burden (hours)	Annual cost
424.540(a)(1)	1200	1	90	1,800	$120,000

The annual cost is based on $100 per respondent to review and recertify via signature their previously submitted enrollment application/information.

Table 8 shows the total estimated hourly and financial burden for all requirements outlined and proposed in this rule.

Table 8.—Estimated Hourly and Financial Burden for All Requirements

CFR section	Annual number of responses	Annual burden hours (millions)	Annual cost
424.500	572,200	1.13	$90.84

We have submitted a copy of this final rule to OMB for its review of the information collection requirements in § 424.510, § 424.515, § 424.520, § 424.525, § 424.535, and § 424.540 and related forms in the addendum. These requirements are not effective until they have been approved by OMB.

VI. Regulatory Impact Analysis

We have examined the impacts of this final rule as required by Executive Order 12866 (September 1993, Regulatory Planning and Review), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Act, the Unfunded Mandate Reform Act of 1995 (Pub. L. 104-4), and Executive Order 13132.

Executive Order 12866 (as amended by Executive Order 13258, which merely reassigns responsibility of duties) directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any one year). This final rule will establish in regulations specific provider and supplier initial enrollment procedures and the periodic revalidation of eligibility. It is not expected to have an impact that will meet the threshold criteria to be considered economically significant.

The RFA requires agencies to analyze options for regulatory relief of small businesses. For the purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or having revenues of $6 million to $29 million in any 1 year. Because of the scope of this final rule, all small entities that participate in the Medicare program are considered providers and suppliers and will be affected, but we do not expect that effect to be of a significant nature. As we show in section B of this impact analysis, the annual burden on providers and suppliers for completing the CMS 855 forms will not rise to the level of a significant burden.

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area and has fewer than 100 beds. This final rule does not significantly impact small rural hospitals. As noted above, there is a minimum amount of time needed to gather data and provide the information requested on the enrollment application when initially enrolling or when resubmitting enrollment information to obtain and maintain a Medicare billing number. We are not preparing a rural impact statement since we have determined, and certify, that we do not expect this rule to impose any additional burden or otherwise significantly impact the operations of a substantial number of small rural hospitals. By default, due to their smaller size, the burden to small rural hospitals will actually be less than the average provider.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, update annually for inflation. That threshold level is currently approximately $120 million. This final rule has no consequential adverse impact on State, local, or tribal governments. This final rule may reduce some State burdens since they will no longer certify providers that are not qualified to participate in the Medicare program. The impact on the private sector is well below the threshold.

Executive Order 13132 establishes certain requirements that an agency must meet when it issues a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on State and local governments, preempts State law, or otherwise has Federalism implications. This final rule has no substantial direct requirement costs or consequential adverse impact on State or local governments. This final rule will actually reduce some State burdens since they will no longer certify providers that are not qualified to participate in the Medicare program.

The following analysis, together with the rest of this preamble, explains the rationale, purpose, and alternatives considered in the final rule. This is an administrative initiative that may result in Medicare program savings but at this time those savings are inestimable. We believe the probable costs providers or suppliers will incur as a result of this rule to be negligible.

A. Rationale, Purpose, and Alternatives Considered

We are responsible for protecting the Medicare Trust Funds by ensuring that unqualified, fraudulent, or excluded providers and suppliers do not bill the Medicare program. Past experience with a number of program integrity efforts has identified that granting billing privileges to entities that do not exercise sound business practices can result in uncollectible overpayments. The ease of obtaining a billing number in the past has paved the way for unscrupulous businesses to defraud the government deliberately by billing for items or services never furnished or furnished at inflated prices.

The provisions of this final rule supplement, but do not replace or nullify, existing regulations concerning the establishment of provider or supplier agreements, the issuance of provider or supplier billing numbers, and payment for Medicare covered items or services to eligible providers and suppliers.

Basically, this final rule consolidates current regulations found throughout the Code of Federal Regulations and more clearly defines what Medicare expects from providers and suppliers furnishing items or rendering services to the Medicare beneficiaries. We expect this final rule to ensure that the Medicare program has adequate information on those who seek to bill the program for items or services. Furthermore, it assures us that information will be periodically updated and reviewed. We believe that establishing the foundation for a sound business relationship with providers and suppliers will minimize billing problems and otherwise protect the Medicare Trust Funds. Similarly, we believe it is necessary for us to impose the requirements of this regulation on existing providers and suppliers and to establish safeguards that enable us to deny enrollment of unqualified providers and suppliers, and to revoke the billing privileges of egregious offenders whose actions place the Medicare Trust Funds at risk.

The primary goal of this final rule, through standard enrollment requirements and periodic revalidation of the enrollment information, is to allow us to collect and maintain (keep current) a unique and equal data set on all current and future providers and suppliers that are or will bill the Medicare program for items or services rendered to our beneficiaries. By achieving this goal, we will be better positioned to combat and reduce the number of fraudulent and abusive providers and suppliers in the Medicare program, thereby protecting the Trust Funds and the Medicare beneficiaries. This rule will also allow us to develop, implement, and enforce national provider and supplier enrollment procedures to be administered uniformly by all Medicare contractors. Over time, we strongly believe that any current burden imposed on the providers and suppliers will be greatly diminished through the use of computer storage and web-based internet technology.

Studies performed by our contractors, the GAO, and OIG have shown numerous instances of fictitious applicants being granted Medicare billing numbers. This final rule will integrate the request for enrollment with sufficient data to substantiate an appropriate level of performance on the part of a new or continuing business. In prior studies, the OIG has found applicants who had submitted applications with nonexistent addresses. In some instances, suppliers had no inventory of goods to be sold, lacked business licenses, had no financial investment, or lacked any experience in the business venture.

The GAO report (GAO/T-HEHS-94-124), concluded: “Weaknesses in CMS' current provider enrollment process have made Medicare vulnerable to dishonest providers. To protect the integrity of Medicare, CMS and its contractors must have effective practices for reviewing applicants to verify that they are eligible for enrollment in the program, as well as the authority to deny or revoke enrollment to those that are not.” This report also concluded that, “Periodic revalidation of provider enrollment data should be a valuable means of ensuring that we have current, useful data on active providers and that providers no longer eligible to participate in Medicare are dropped from the program.” Therefore, based on the above recommendation and our own successes with our 3-year re-enrollment policy currently in effect for DMEPOS suppliers, we are expanding this requirement to all providers and suppliers billing the Medicare program.

We have already increased our efforts to seek more uniformity in the enrollment process. However, our experience clearly shows that the best means for preventing payment errors and, in worst cases, abuse by providers and suppliers, is to discourage and prevent their entry into the Medicare program through this rule and the authority to deny enrollment or revoke their billing number.

While some entities may perceive our requirements as a barrier to their access to serving Medicare beneficiaries, we do not believe that bona fide businesses will experience any difficulty in obtaining or maintaining a Medicare billing number. We estimate that furnishing the requested information will require no more than 6 hours to complete and that most businesses should have the information readily available.

B. Rural Hospital Impact Statement

Section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. Such an analysis must conform to the provisions of section 604 of the RFA. For purposes of section 1102(b) of the Act, we define a small rural hospital as a hospital that is located outside of a Metropolitan Statistical Area and has fewer than 100 beds. As noted above, there is a minimum amount of time needed to gather data and provide the information requested on the enrollment application when initially enrolling or when resubmitting enrollment information to obtain and maintain a Medicare billing number. We are not preparing a rural impact statement since we have determined, and certify, that we do not expect this rule to impose any additional burden or otherwise significantly impact the operations of a substantial number of small rural hospitals. By default, due to their smaller size, the burden to small rural hospitals will actually be less than the average provider.

There are currently about 1.2 million providers (hospitals, HHAs, rural health clinics, and SNFs) and suppliers (physicians, nurses, ambulance companies, clinical laboratories, and durable medical equipment suppliers) enrolled in the Medicare program. In addition, about 74,000 new providers and suppliers apply to enroll in Medicare each year. Listed below is the current estimated annual burden on the affected public in both hours and dollars.

1. Estimated Costs for Completion of CMS 855 Forms for Initial Enrollment

Assumptions:

a. The monetary cost to the respondents is calculated as follows based on the following assumptions:

• The CMS 855I and CMS 855R will be completed by clerical staff (secretary).
• The CMS 855A, CMS 855B, and CMS 855S will be completed by professional staff (attorney or accountant).

b. Estimated Cost per Form

The monetary cost to the respondent to complete and submit the necessary CMS 855 form is:

• $900 for the CMS 855A, CMS 855B, and CMS 855S
• $80 for the CMS 855I, and
• $5 for the CMS 855R

c. Estimated Hourly Wage for Staff Completing Forms

The cost per respondent per form was determined using the following wages:

• $20.00 per hour (administrative wage)
• $150.00 per hour (professional wage)

Table 9.—Current Estimated Hours for Completion of CMS 855 Forms for Initial New Enrollments

CMS form No.	Estimated number of respondents	Estimated time for completion per respondent	Total number of hours for completion	Total cost in dollars (millions)
855A	5,000	6 hours	30,000	$4.5
855B	35,000	6 hours	210,000	31.5
855I	75,000	4 hours	300,000	6
855R	100,000	15 minutes	25,000	0.5
855S	16,000	6 hours	96,000	14.4
Total Estimated Hourly and Financial Burden			661,000	56.9

The estimated number of respondents is based on FY 2004 Medicare contractor workload reports.

2. Completing Forms to Report Changes to Enrollment Information

The hourly burden and monetary cost estimate for this activity for all forms is—

100,000 respondents × 1 hour each = 100,000 hours

Average cost per respondent = $100

Total cost for all respondents = $10 million

3. Completing Forms to Recertify Enrollment Information (5 yr cycle)

The hourly burden and monetary cost estimate for this activity for all forms is—

232,000 respondents × 1.5 hours each = 348,000 hours

Average cost per respondent = $100

Total cost for all respondents = $23.2 million

The estimated current total annual hour burden for all classes of providers (hospitals, HHAs, rural health clinics, and SNFs) and suppliers (physicians, nurses, ambulance companies, clinical laboratories, and durable medical equipment suppliers) is 1.13 million hours.

Based on the above, the estimated current annual monetary burden for all classes of providers (for example, hospitals, HHAs, rural health clinics, SNFs) and suppliers (for example, physicians, nurses, ambulance companies, clinical laboratories durable medical equipment suppliers) is $90.84 million. The 1997 revenue receipts for all classes of providers and suppliers were $913.7 billion. The cost of obtaining and maintaining billing privileges in the Medicare program on average is less than 1 percent of the total revenue.

Although it is possible that a few entities may be significantly affected by this final rule, we do not expect that a substantial number of affected entities will experience a significant increase in the reporting burden; therefore, the Secretary certifies that this rule is not expected to impose any additional burden or otherwise significantly impact a substantial number of small entities.

C. Alternatives Considered

Since this final rule is a codification of our current policies on provider and supplier enrollment, with the exception of imposing a cyclical revalidation process, we did not consider alternatives to this process. However, the current process was reviewed and, when possible, changes proposed or made that will reduce the current burden, such as the time frame for reporting changes.

Although we do not expect this final rule to have a significant economic impact, we are revising the requirements for reporting changes to the provider or supplier's enrollment information to reduce the current burden. Currently, providers and suppliers must report any changes to their enrollment information within 30 days. We are changing this requirement to 90 days (or quarterly). We considered retaining the current requirement but determined the 30-day timeframe as too stringent in light of the rapid changes seen in today's health care industry. This change is expected to reduce the administrative burden for the providers, suppliers, our contractors, and us.

D. Accounting Statement

As required by OMB Circular A-4 (available at http://www.whitehouse.gov/​omb/​circulars/​a004/​a-4.pdf), in Table 10, we have prepared an accounting statement showing the classification of the expenditures associated with the provisions of this final rule. This table provides our best estimate of the Medicare payments for providers and suppliers to establish and maintain Medicare enrollment. All expenditures are classified as transfers to Medicare providers (that is, fee for service contractors).

Table 10.—Accounting Statement—Classification of Estimated Expenditures, From FY 2006 to FY 2007

[In millions]

Category	Transfers
Annualized Monetary Transfers	$90.84.
From Whom to Whom?	Federal Government to Medicare Providers (that is, Fee for Service Contractors).

In accordance with the provisions of Executive Order 12866, this final rule was reviewed by OMB.

List of Subjects

42 CFR Part 420

• Fraud
• Health facilities
• Health professions
• Medicare

42 CFR Part 424

• Emergency medical services
• Health facilities
• Health professions
• Medicare
• Reporting and recordkeeping requirements

42 CFR Part 489

• Health facilities
• Medicare
• Reporting and recordkeeping requirements

42 CFR Part 498

• Administrative practice and procedure
• Health facilities
• Health professions
• Medicare
• Reporting and recordkeeping requirements

For the reasons set forth in this preamble, 42 CFR chapter IV is amended as set forth below:

PART 420—PROGRAM INTEGRITY: MEDICARE

1. The authority citation for part 420 continues to read as follows:

Authority: Secs. 1102 and 1871 of the Social Security Act (42 U.S.C. 1302 and 1395hh).

2. In § 420.201, the definition for “managing employee” is revised to read as follows:

§ 420.201

Definitions

* * * * *

Managing employee means a general manager, business manager, administrator, director, or other individual that exercises operational or managerial control over, or who directly or indirectly conducts, the day-to-day operation of the institution, organization, or agency, either under contract or through some other arrangement, whether or not the individual is a W-2 employee.

* * * * *

PART 424—CONDITIONS FOR MEDICARE PAYMENT

1. The authority citation for part 424 continues to read as follows:

Authority: Secs. 1102 and 1871 of the Social Security Act (42 U.S.C. 1302 and 1395hh)

2. Section 424.1(a)(1) is amended by adding in numerical order a statutory reference to read as follows:

§ 424.1

Basis and scope.

(a) * * *

(1) * * *

* * * * *

1833(e)—Requirement to furnish information to determine payment.

* * * * *

Subparts N-O—[Reserved]

3. Subparts N and O are reserved.

4. Subpart P is added to read as follows.

Subpart P—Requirements for Establishing and Maintaining Medicare Billing Privileges

424.500

Scope.

424.502

Definitions.

424.505

Basic enrollment requirement.

424.510

Requirements for enrolling in the Medicare program.

424.515

Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information.

424.520

Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program.

424.525

Rejection of a provider or supplier's enrollment application for Medicare enrollment.

424.530

Denial of enrollment.

424.535

Revocation of enrollment and billing privileges in the Medicare program.

424.540

Deactivation of Medicare billing privileges.

424.545

Provider and supplier appeal rights.

424.550

Prohibitions on the sale or transfer of billing privileges.

424.555

Payment liability.

Subpart P—Requirements for Establishing and Maintaining Medicare Billing Privileges

§ 424.500

Scope.

The provisions of this subpart contain the requirements for enrollment, periodic resubmission and certification of enrollment information for revalidation, and timely reporting of updates and changes to enrollment information. These requirements apply to all providers and suppliers except for physicians and practitioners who have entered into a private contract with a beneficiary as described in part 405, subpart D of this chapter. Providers and suppliers must meet and maintain these enrollment requirements to bill either the Medicare program or its beneficiaries for Medicare covered services or supplies.

§ 424.502

Definitions.

As used in this subpart, unless the context indicates otherwise—

Approve/Approval means the enrolling provider or supplier has been determined to be eligible under Medicare rules and regulations to receive a Medicare billing number and be granted Medicare billing privileges.

Authorized official means an appointed official (for example, chief executive officer, chief financial officer, general partner, chairman of the board, or direct owner) to whom the organization has granted the legal authority to enroll it in the Medicare program, to make changes or updates to the organization's status in the Medicare program, and to commit the organization to fully abide by the statutes, regulations, and program instructions of the Medicare program.

Deactivate means that the provider or supplier's billing privileges were stopped, but can be restored upon the submission of updated information.

Delegated official means an individual who is delegated by the “Authorized Official,” the authority to report changes and updates to the enrollment record. The delegated official must be an individual with ownership or control interest in, or be a W-2 managing employee of the provider or supplier.

Deny/Denial means the enrolling provider or supplier has been determined to be ineligible to receive Medicare billing privileges for Medicare covered items or services provided to Medicare beneficiaries.

Enroll/Enrollment means the process that Medicare uses to establish eligibility to submit claims for Medicare covered services and supplies. The process includes—

(1) Identification of a provider or supplier;

(2) Validation of the provider's or supplier's eligibility to provide items or services to Medicare beneficiaries;

(3) Identification and confirmation of the provider or supplier's practice location(s) and owner(s); and

(4) Granting the provider or supplier Medicare billing privileges.

Enrollment application means a CMS-approved paper enrollment application or an electronic Medicare enrollment process approved by OMB.

Managing employee means a general manager, business manager, administrator, director, or other individual that exercises operational or managerial control over, or who directly or indirectly conducts, the day-to-day operation of the provider or supplier, either under contract or through some other arrangement, whether or not the individual is a W-2 employee of the provider or supplier.

Operational means the provider or supplier has a qualified physical practice location, is open to the public for the purpose of providing health care related services, is prepared to submit valid Medicare claims, and is properly staffed, equipped, and stocked (as applicable, based on the type of facility or organization, provider or supplier specialty, or the services or items being rendered), to furnish these items or services.

Owner means any individual or entity that has any partnership interest in, or that has 5 percent or more direct or indirect ownership of the provider or supplier as defined in sections 1124 and 1124A(A) of the Act.

Reject/Rejected means that the provider or supplier's enrollment application was not processed due to incomplete information, or that additional information or corrected information was not received from the provider or supplier in a timely manner.

Revoke/Revocation means that the provider or supplier's billing privileges are terminated.

§ 424.505

Basic enrollment requirement.

To receive payment for covered Medicare items or services from either Medicare (in the case of an assigned claim) or a Medicare beneficiary (in the case of an unassigned claim), a provider or supplier must be enrolled in the Medicare program. Once enrolled, the provider or supplier receives billing privileges and is issued a valid billing number effective for the date a claim was submitted for an item that was furnished or a service that was rendered. (See 45 CFR Part 162 for information on the National Provider Identifier and its use as the Medicare billing number.)

§ 424.510

Requirements for enrolling in the Medicare program.

(a) Providers and suppliers must submit enrollment information on the applicable enrollment application. Once the provider or supplier successfully completes the enrollment process, including, if applicable, a State survey and certification or accreditation process, CMS enrolls the provider or supplier into the Medicare program. To be enrolled, a provider or supplier must meet enrollment requirements specified in paragraph (c) of this section.

(b) The effective dates for reimbursement are specified in § 489.13 of this chapter for providers and suppliers requiring State survey or certification or accreditation, § 424.5 and § 424.44 for non-surveyed or certified/accredited suppliers, and § 424.57 and section 1834(j)(1)(A) of the Act for DMEPOS suppliers.

(c) The effective date for reimbursement for providers and suppliers seeking accreditation from a CMS-approved accreditation organization as specified in § 489.13(d).

(d) Providers and suppliers must meet the following enrollment requirements:

(1) Submittal of the enrollment application. A provider or supplier must submit a complete enrollment application and supporting documentation to the designated Medicare fee-for-service contractor.

(2) Content of the enrollment application. Each submitted enrollment application must include the following:

(i) Complete, accurate, and truthful responses to all information requested within each section as applicable to the provider or supplier type.

(ii) Submission of all documentation required by CMS under this or other statutory or regulatory authority, or under the Paperwork Reduction Act of 1995, to uniquely identify the provider or supplier. This documentation may include, but is not limited to, proof of the legal business name, practice location, social security number (SSN), tax identification number (TIN), National Provider Identifier (NPI), if issued, and owners of the business.

(iii) Submission of all documentation, including all applicable Federal and State licensure and regulatory requirements that apply to the specific provider or supplier type that relate to providing health care services, required by CMS under this or other statutory or regulatory authority, or under the Paperwork Reduction Act of 1995, to establish the provider or supplier's eligibility to furnish Medicare covered items or services to beneficiaries in the Medicare program.

(3) Signature(s) required on the enrollment application. The certification statement found on the enrollment application must be signed by an individual who has the authority to bind the provider or supplier, both legally and financially, to the requirements set forth in this chapter. This person must also have an ownership or control interest in the provider or supplier, as that term is defined in section 1124(a)(3) of the Act, such as, the general partner, chairman of the board, chief financial officer, chief executive officer, president, or hold a position of similar status and authority within the provider or supplier organization. The signature attests that the information submitted is accurate and that the provider or supplier is aware of, and abides by, all applicable statutes, regulations, and program instructions.

(i) Requirements. The signature requirements specified in paragraphs (d)(3)(i)(A) through (C) of this section outline who must sign the enrollment application for an enrolling provider or supplier. In the case of—

(A) An individual practitioner, the applying practitioner.

(B) A sole proprietorship, the applying sole proprietor.

(C) A corporation, partnership, group, limited liability company, or other organization (hereafter referred to collectively in this section as an organization), an authorized official, as defined in § 424.502. When an authorized official signs the certification statement on behalf of an organization, the signed statement is considered legally binding upon the organization.

(ii) Delegation of authority. The original enrollment application submitted for an organization's initial enrollment and all subsequent enrollment applications submitted for periodic revalidation of the organization's enrollment data (as required to maintain enrollment in the Medicare program) must be signed by an authorized official. Any updates or changes reported outside of the initial enrollment or periodic revalidation process may be signed by a delegated official(s) of the organization. The delegated official's signature binds the organization both legally and financially, as if the signature was that of the authorized official. Before the delegation of authority is established, the only acceptable signature on the enrollment application to report updates or changes to the enrollment information is that of the authorized official currently on file with Medicare. Once the delegation of authority is established, the only acceptable signatures on correspondence to report updates or changes to the enrollment information are those of the authorized official and the person(s) to whom this authority is delegated in accordance with the requirements described in this section. Individual practitioners and sole proprietors cannot delegate signature authority when submitting an enrollment application for any reason. All enrollment applications submitted by individual practitioners and sole proprietors must be signed by the enrolling or enrolled individual. Each delegation of authority to a delegated official must—

(A) Be assigned by the authorized official currently on file with CMS;

(B) Be submitted to CMS using the appropriate enrollment application or CMS established electronic enrollment process;

(C) Include the title and SSN of each person delegated authority to update or change the organization's enrollment information;

(D) Be an individual that has an ownership or control interest in the organization or is a W-2 managing employee as defined in section 1126(b) of the Act; and

(E) Be signed by the authorized official and the delegated official(s) of the organization.

(4) Verification of information. The information submitted by the provider or supplier on the applicable enrollment application must be such that CMS can validate it for accuracy at the time of submission.

(5) Completion of any applicable State surveys, certifications, and provider agreements. The providers or suppliers who are mandated under the provision in part 488 of this chapter to be surveyed or certified by the State survey and certification agency, and to also enter into and sign a provider agreement as outlined in part 489 of this chapter, must also meet those requirements as part of the process to obtain Medicare billing privileges.

(6) Ability to furnish Medicare covered items or services. The provider or supplier must be operational to furnish Medicare covered items or services before being granted Medicare billing privileges.

(7) Additional requirements. Providers and suppliers must meet the provisions of § 424.520 regarding additional compliance and reporting requirements.

(8) On-site review. CMS reserves the right, when deemed necessary, to perform on-site inspections of a provider or supplier to verify that the enrollment information submitted to CMS or its agents is accurate and to determine compliance with Medicare enrollment requirements. Site visits for enrollment purposes do not affect those site visits performed for establishing compliance with conditions of participation.

(i) Medicare Part A providers. CMS determines, upon on-site review, that the provider is no longer operational to furnish Medicare covered items or services, or the provider fails to satisfy any of the Medicare enrollment requirements.

(ii) Medicare Part B suppliers. CMS determines, upon review that the supplier is no longer operational to furnish Medicare covered items or services, or the supplier has failed to satisfy any or all of the Medicare enrollment requirements, or has failed to furnish Medicare covered items or services as required by the statute or regulations.

§ 424.515

Requirements for reporting changes and updates to, and the periodic revalidation of Medicare enrollment information.

To maintain Medicare billing privileges, a provider or supplier (other than a DMEPOS supplier) must resubmit and recertify the accuracy of its enrollment information every 5 years. All providers and suppliers currently billing the Medicare program or initially enrolling in the Medicare program are required to complete the applicable enrollment application. The provider or supplier then enters a 5-year revalidation cycle once a completed enrollment application is submitted and validated. (Ambulance service providers must continue to resubmit enrollment information in accordance with § 410.41(c)(2) of this chapter and DMEPOS suppliers must continue to renew enrollment in accordance with § 424.57(e)). The requirements for the resubmission, recertification and reverification of enrollment information include the following:

(a) Submission of the enrollment application and supporting documentation. The provider or supplier must meet the submission, content, signature, verification, operational, inspection, and other requirements outlined in § 424.510.

(1) CMS contacts each provider or supplier directly when it is time to revalidate their enrollment information.

(2) A provider or supplier must submit to CMS the applicable enrollment application with complete and accurate information and applicable supporting documentation within 60 calendar days of our notification to resubmit and certify to the accuracy of its enrollment information.

(b) Completion of any applicable State surveys, certifications and provider agreements. A new certification and a new provider agreement are not required for the purpose of resubmission and certification for revalidation of enrollment information. Providers and suppliers must continue to meet the requirements of parts 488 and 489 of this chapter, or any currently established supplier agreement, if applicable.

(c) On-site inspections. CMS reserves the right to perform on-site inspections of a provider or supplier to verify that the information submitted to CMS or its agents is accurate and to determine compliance with Medicare enrollment requirements. Site visits for enrollment purposes do not affect those site visits performed for establishing compliance with conditions of participation.

(1) Medicare Part A providers. CMS determines, upon on-site review, that the provider is no longer operational to furnish Medicare covered items or services, or the provider fails to satisfy any of the Medicare enrollment requirements.

(2) Medicare Part B suppliers. CMS determines, upon review that the supplier is no longer operational to furnish Medicare covered items or services, or the supplier has failed to satisfy any or all of the Medicare enrollment requirements, or has failed to furnish Medicare covered items or services as required by the statute or regulations.

(d) Off Cycle revalidations. (1) CMS reserves the right to perform off cycle revalidations in addition to the regular 5-year revalidations and may request that a provider or supplier recertify the accuracy of the enrollment information when warranted to assess and confirm the validity of the enrollment information maintained by CMS. Off cycle revalidations may be triggered as a result of random checks, information indicating local health care fraud problems, national initiatives, complaints, or other reasons that cause CMS to question the compliance of the provider or supplier with Medicare enrollment requirements. Off cycle revalidations may be accompanied by site visits.

(2) CMS reserve the right to adjust the routine 5-year revalidation schedule if we determine that revalidation should occur on a more frequent basis due to complaints or evidence we receive indicating noncompliance with the statute or regulations by specific provider or supplier types. The schedule may also be on a less frequent basis if we determine that the integrity of and compliance with the statute and regulations by specific provider or supplier types indicates that less frequent validation is justified. If a change occurs, CMS notifies all affected providers and suppliers at least 90 days in advance of implementing the change.

(3) CMS revalidates enrollment information for ambulance service suppliers in accordance with § 410.41(c)(2) of this chapter (Requirements for ambulance suppliers), and DMEPOS suppliers renews enrollment in accordance with § 424.57(e) (Special payment rules for items furnished by DMEPOS suppliers and issuance of DMEPOS supplier billing numbers).

§ 424.520

Additional provider and supplier requirements for enrolling and maintaining active enrollment status in the Medicare program.

(a) Certifying compliance. CMS enrolls and maintains an active enrollment status for a provider or supplier when that provider or supplier certifies that it meets, and continues to meet, and CMS verifies that it meets, and continues to meet, all of the following requirements:

(1) Compliance with title XVIII of the Act and applicable Medicare regulations.

(2) Compliance with Federal and State licensure, certification and regulatory requirements, as required, based on the type of services or supplies the provider or supplier type will furnish and bill Medicare.

(3) Not employing or contracting with individuals or entities—

(i) Excluded from participation in any Federal health care programs, for the provision of items and services covered under the programs, in violation of section 1128A (a)(6) of the Act; or

(ii) Debarred by the General Services Administration (GSA) from any other Executive Branch procurement or nonprocurement programs or activities, in accordance with the Federal Acquisition and Streamlining Act of 1994, and with the HHS Common Rule at 45 CFR part 76.

(b) Reporting requirements. Following enrollment, a provider or supplier must report to CMS any changes to the information furnished on the enrollment application and furnish supporting documentation within 90 calendar days of the change, with the exception of DMEPOS suppliers which are required to report changes of information within 30 days as specified in § 424.57(c)(2), or a change of ownership or control of the provider or supplier that must also be reported within 30 calendar days. Failure to do so may result in the deactivation or revocation of the provider or supplier's Medicare billing privileges.

§ 424.525

Rejection of a provider or supplier's enrollment application for Medicare enrollment.

(a) Reasons for rejection. CMS may reject a provider or supplier's enrollment application for the following reasons:

(1) The provider or supplier fails to furnish complete information on the provider/supplier enrollment application within 60 calendar days from the date of the contractor request for the missing information.

(2) The provider or supplier fails to furnish all required supporting documentation within 60 calendar days of submitting the enrollment application.

(b) Extension of 60-day period. CMS, at its discretion, may choose to extend the 60-day period if CMS determines that the provider or supplier is actively working with CMS to resolve any outstanding issues.

(c) Resubmission after rejection. To enroll in Medicare and obtain Medicare billing privileges after notification of a rejected enrollment application, the provider or supplier must complete and submit a new enrollment application and submit all supporting documentation for CMS review and approval.

(d) Additional review. Enrollment applications that are rejected are not afforded appeal rights.

§ 424.530

Denial of enrollment.

(a) Reasons for denial. CMS may deny a provider's or supplier's enrollment in the Medicare program for the following reasons:

(1) Compliance. The provider or supplier at any time is found not to be in compliance with the Medicare enrollment requirements described in this section or on the applicable enrollment application to the type of provider or supplier enrolling, and has not submitted a plan of corrective action as outlined in part 488 of this chapter.

(2) Provider or supplier conduct. A provider, supplier, an owner, managing employee, an authorized or delegated official, medical director, supervising physician, or other health care personnel furnishing Medicare reimbursable services who is required to be reported on the enrollment application, in accordance with section 1862(e)(1) of the Act, is—

(i) Excluded from the Medicare, Medicaid and any other Federal health care programs, as defined in § 1001.2 of this chapter, in accordance with section 1128, 1128A, 1156, 1842, 1862, 1867 or 1892 of the Act.

(ii) Debarred, suspended, or otherwise excluded from participating in any other Federal procurement or nonprocurement activity in accordance with section 2455 of the Federal Acquisition Streamlining Act (FASA).

(3) Felonies. If within the 10 years preceding enrollment or revalidation of enrollment, the provider, supplier, or any owner of the provider or supplier, was convicted of a Federal or State felony offense that CMS has determined to be detrimental to the best interests of the program and its beneficiaries. CMS considers the severity of the underlying offense.

(i) Offenses include—(A) Felony crimes against persons, such as murder, rape, or assault, and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions.

(B) Financial crimes, such as extortion, embezzlement, income tax evasion, insurance fraud and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions.

(C) Any felony that placed the Medicare program or its beneficiaries at immediate risk (such as a malpractice suit that results in a conviction of criminal neglect or misconduct).

(D) Any felonies outlined in section 1128 of the Act.

(ii) Denials based on felony convictions are for a period to be determined by the Secretary, but not less than 10 years from the date of conviction if the individual has been convicted on one previous occasion for one or more offenses.

(4) False or misleading information. The provider or supplier has submitted false or misleading information on the enrollment application to gain enrollment in the Medicare program. (Offenders may be referred to the Office of Inspector General for investigation and possible criminal, civil, or administrative sanctions.)

(5) On-site review. Upon on-site review or other reliable evidence, we determine that the provider or supplier is not operational, or is not meeting Medicare enrollment requirements to furnish Medicare covered items or services. Upon on-site review, CMS determines that—

(i) A Medicare Part A provider is no longer operational to furnish Medicare covered items or services, or the provider fails to satisfy any of the Medicare enrollment requirements.

(ii) A Medicare Part B supplier is no longer operational to furnish Medicare covered items or services, or the supplier has failed to satisfy any or all of the Medicare enrollment requirements, or has failed to furnish Medicare covered items or services as required by the statute or regulations.

(b) Resubmission after denial. A provider or supplier that is denied enrollment in the Medicare program cannot submit a new enrollment application until the following has occurred if the denial:

(1) Was not appealed, the provider or supplier may reapply after its appeal rights have lapsed.

(2) Was appealed, the provider or supplier may reapply after notification that the determination was upheld.

(c) Reversal of denial. If the denial was due to adverse activity (sanction, exclusion, debt, felony) of an owner, managing employee, an authorized or delegated official, medical director, supervising physician, or other health care personnel of the provider or supplier furnishing Medicare reimbursable services, the denial may be reversed if the provider or supplier terminates and submits proof that it has terminated its business relationship with that individual or organization within 30 days of the denial notification.

(d) Additional review. When a provider or supplier is denied enrollment in Medicare, CMS automatically reviews all other related Medicare enrollment files that the denied provider or supplier has an association with (for example, as an owner or managing employee) to determine if the denial warrants an adverse action of the associated Medicare provider or supplier.

(e) Effective date of denial. Denial becomes effective within 30 days of the initial denial notification.

§ 424.535

Revocation of enrollment and billing privileges in the Medicare program.

(a) Reasons for revocation. CMS may revoke a currently enrolled provider or supplier's Medicare billing privileges and any corresponding provider agreement or supplier agreement for the following reasons:

(1) Noncompliance. The provider or supplier is determined not to be in compliance with the enrollment requirements described in this section or in the enrollment application applicable for its provider or supplier type and has not submitted a plan of corrective action as outlined in part 488 of this chapter. All providers and suppliers are granted an opportunity to correct the deficient compliance requirement prior to a final determination to revoke billing privileges.

(i) CMS may request additional documentation from the provider or supplier to determine compliance if adverse information is received or otherwise found concerning the provider or supplier.

(ii) Requested additional documentation must be submitted within 60 calendar days of request.

(2) Provider or supplier conduct. The provider or supplier, or any owner, managing employee, authorized or delegated official, medical director, supervising physician, or other health care personnel of the provider or supplier is—

(i) Excluded from the Medicare, Medicaid, and any other Federal health care program, as defined in § 1001.2 of this chapter, in accordance with section 1128, 1128A, 1156, 1842, 1862, 1867 or 1892 of the Act.

(ii) Is debarred, suspended, or otherwise excluded from participating in any other Federal procurement or nonprocurement program or activity in accordance with the FASA implementing regulations and the Department of Health and Human Services nonprocurement common rule at 45 CFR part 76.

(3) Felonies. The provider, supplier, or any owner of the provider or supplier, within the 10 years preceding enrollment or revalidation of enrollment, was convicted of a Federal or State felony offense that CMS has determined to be detrimental to the best interests of the program and its beneficiaries.

(i) Offenses include—

(A) Felony crimes against persons, such as murder, rape, assault, and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions.

(B) Financial crimes, such as extortion, embezzlement, income tax evasion, insurance fraud and other similar crimes for which the individual was convicted, including guilty pleas and adjudicated pretrial diversions.

(C) Any felony that placed the Medicare program or its beneficiaries at immediate risk, such as a malpractice suit that results in a conviction of criminal neglect or misconduct.

(D) Any felonies that would result in mandatory exclusion under section 1128(a) of the Act.

(ii) Denials based on felony convictions are for a period to be determined by the Secretary, but not less than 10 years from the date of conviction if the individual has been convicted on one previous occasion for one or more offenses.

(4) False or misleading information. The provider or supplier certified as “true” misleading or false information on the enrollment application to be enrolled or maintain enrollment in the Medicare program. (Offenders may be subject to either fines or imprisonment, or both, in accordance with current law and regulations.)

(5) On-site review. CMS determines, upon on-site review, that the provider or supplier is no longer operational to furnish Medicare covered items or services, or is not meeting Medicare enrollment requirements under statute or regulation to supervise treatment of, or to provide Medicare covered items or services for, Medicare patients. Upon on-site review, CMS determines that—

(i) A Medicare Part A provider is no longer operational to furnish Medicare covered items or services, or the provider fails to satisfy any of the Medicare enrollment requirements.

(ii) A Medicare Part B supplier is no longer operational to furnish Medicare covered items or services, or the supplier has failed to satisfy any or all of the Medicare enrollment requirements, or has failed to furnish Medicare covered items or services as required by the statute or regulations.

(6) Inadequate reverification information. The provider or supplier fails to furnish complete and accurate information and all supporting documentation within 60 calendar days of the provider or supplier's notification from CMS to submit an enrollment application and supporting documentation, or resubmit and certify to the accuracy of its enrollment information.

(7) Misuse of billing number. The provider or supplier knowingly sells to or allows another individual or entity to use its billing number. This does not include those providers or suppliers who enter into a valid reassignment of benefits as specified in § 424.80 or a change of ownership as outlined in § 489.18 of this chapter.

(b) Effect of revocation on provider agreements. When a provider's or supplier's billing privilege is revoked, any provider agreement in effect at the time of revocation is terminated effective with the date of revocation.

(c) Re-enrollment after revocation. If a provider or supplier seeks to re-establish enrollment in the Medicare program after notification that its billing privileges is revoked (either after the appeals process is exhausted or in place of the appeals process), the following conditions apply:

(1) The provider or supplier must re-enroll in the Medicare program through the completion and submission of a new applicable enrollment application and applicable documentation, as a new provider or supplier, for validation by CMS.

(2) Providers must be resurveyed and recertified by the State survey agency as a new provider and must establish a new provider agreement with CMS's Regional Office.

(d) Reversal of revocation. If the revocation was due to adverse activity (sanction, exclusion, or felony) against an owner, managing employee, or an authorized or delegated official; or a medical director, supervising physician, or other personnel of the provider or supplier furnishing Medicare reimbursable services, the revocation may be reversed if the provider or supplier terminates and submits proof that it has terminated its business relationship with that individual within 30 days of the revocation notification.

(e) Additional review. When a provider or supplier is revoked from the Medicare program, CMS automatically reviews all other related Medicare enrollment files that the revoked provider or supplier has an association with (for example, as an owner or managing employee) to determine if the revocation warrants an adverse action of the associated Medicare provider or supplier.

(f) Effective date of revocation. Revocation becomes effective within 30 days of the initial revocation notification.

§ 424.540

Deactivation of Medicare billing privileges.

(a) Reasons for deactivation. CMS may deactivate a provider or supplier's Medicare billing privileges for the following reasons:

(1) The provider or supplier does not submit any Medicare claims for 12 consecutive calendar months. The 12 month period will begin the 1st day of the 1st month without a claims submission through the last day of the 12th month without a submitted claim.

(2) The provider or supplier does not report a change to the information supplied on the enrollment application within 90 calendar days of when the change occurred. Changes that must be reported include, but are not limited to, a change in practice location, a change of any managing employee, and a change in billing services. A change in ownership or control must be reported within 30 calendar days as specified in § 424.520(b) and § 424.550(b).

(b) Reactivation of billing privileges. (1) When deactivated for any reason other than nonsubmission of a claim, the provider or supplier must complete and submit a new enrollment application to reactivate its Medicare billing privileges or, when deemed appropriate, at a minimum, recertify that the enrollment information currently on file with Medicare is correct.

(2) Providers and suppliers deactivated for nonsubmission of a claim are required to recertify that the enrollment information currently on file with Medicare is correct and furnish any missing information as appropriate. The provider or supplier must meet all current Medicare requirements in place at the time of reactivation, and be prepared to submit a valid Medicare claim.

(3) Reactivation of Medicare billing privileges does not require a new certification of the provider or supplier by the State survey agency or the establishment of a new provider agreement.

(c) Effect of deactivation. Deactivation of Medicare billing privileges is considered an action to protect the provider or supplier from misuse of its billing number and to protect the Medicare Trust Funds from unnecessary overpayments. The deactivation of Medicare billing privileges does not have any effect on a provider or supplier's participation agreement or any conditions of participation.

§ 424.545

Provider and supplier appeal rights.

(a) A provider or supplier that is denied enrollment in the Medicare program or whose Medicare enrollment has been revoked may appeal CMS' decision in accordance with part 405, subpart H, for suppliers, or part 498, subpart A for providers, of this chapter, which set forth the appeals process for providers and suppliers. When revocation of billing privileges also results in the termination of a corresponding provider agreement, the provider may appeal CMS' decision in accordance with part 498 of this chapter with the final decision of the appeal applying to both the billing privileges and the provider agreement. Payment is not made during the appeals process. If the provider or supplier is successful in overturning a denial or revocation, unpaid claims for services furnished during the overturned period may be resubmitted.

(b) A provider or supplier whose billing privileges are deactivated may file a rebuttal in accordance with § 405.374 of this chapter.

(c) The provider or supplier must be able to demonstrate that it meets the enrollment requirements and it must be able to make available any documents and records that support the provisions of this regulation and the Medicare enrollment application if requested by CMS or its agents.

§ 424.550

Prohibitions on the sale or transfer of billing privileges.

(a) General rule. A provider or supplier is prohibited from selling its Medicare billing number or privileges to any individual or entity, or allowing another individual or entity to use its Medicare billing number.

(b) Change of ownership. In the case of a provider undergoing a change of ownership in accordance with part 489, subpart A of this chapter, the current owner and the prospective new owner must complete and submit enrollment applications before completion of the change of ownership. If the current owner fails to complete and submit an enrollment application to report the change, the current owner may be sanctioned or penalized, even after the date of ownership change, in accordance with § 424.520, § 424.540, and § 489.53 of this chapter. If the prospective new owner fails to submit a new enrollment application containing information concerning the new owner within 30 days of the change of ownership, CMS may deactivate the Medicare billing number. If an incomplete enrollment application is submitted, CMS may also deactivate the Medicare billing number based upon material omissions on the submitted enrollment application, or based on preliminary information received or determined by CMS that makes CMS question whether the new owner is ultimately granted a final transference of the provider agreement.

(c) Suppliers not covered by part 489 of this chapter. For those suppliers not covered by part 489 of this chapter, any change in the ownership or control of that supplier must be reported on the enrollment application within 30 days of the change as noted in § 424.540(a)(2). Generally, a change of ownership that also changes the tax identification number requires the completion and submission of a new enrollment application from the new owner.

§ 424.555

Payment liability.

(a) No payment may be made for otherwise Medicare covered items or services furnished to a Medicare beneficiary by suppliers of durable medical equipment, prosthetics, orthotics, and other supplies unless the supplier obtains (and renews, as set forth in section 1834(j) of the Act) Medicare billing privileges.

(b) No payment may be made for otherwise Medicare covered items or services furnished to a Medicare beneficiary by a provider or supplier if the billing privileges of the provider or supplier are deactivated, denied, or revoked. The Medicare beneficiary has no financial responsibility for expenses, and the provider or supplier must refund on a timely basis to the Medicare beneficiary any amounts collected from the Medicare beneficiary for these otherwise Medicare covered items or services.

(c) If any provider or supplier furnishes an otherwise Medicare covered item or service for which payment may not be made by reason of paragraph (b) of this section, any expense incurred for such otherwise Medicare covered item or service shall be the responsibility of the provider or supplier. The provider or supplier may also be criminally liable for pursuing payments that may not be made by reason of paragraph (b) of this section, in accordance with section 1128B(a)(3) of the Act.

PART 489—PROVIDER AGREEMENTS AND SUPPLIER APPROVAL

7. The authority citation for part 489 continues to read as follows:

Authority: Secs. 1102, 1819, 1861, 1864(m), 1866, 1869, and 1871 of the Social Security Act (42 U.S.C. 1302, 1395i-3, 1395x, 1395aa(m), 1395cc, 1395ff, and 1395hh).

8. Section 489.53 is amended by adding paragraph (a)(15) to read as follows:

§ 489.53

Termination by CMS.

(a) * * *

(15) It had its enrollment in the Medicare program revoked in accordance to § 424.535 of this chapter.

* * * * *

PART 498—APPEALS PROCEDURES FOR DETERMINATIONS THAT AFFECT PARTICIPATION IN THE MEDICARE PROGRAM AND FOR DETERMINATIONS THAT AFFECT THE PARTICIPATION OF ICFs/MR AND CERTAIN NFs IN THE MEDICAID PROGRAM

9. The authority citation for part 498 continues to read as follows:

Authority: Secs. 1102 and 1871 of the Social Security Act (42 U.S.C. 1302 and 1395hh).

10. Section 498.3, is amended by adding paragraph (b)(17) as follows:

§ 498.3

Scope and applicability.

(b) * * *

(17) The revocation of a provider or supplier's Medicare enrollment in accordance to § 424.535 of this chapter.

* * * * *

(Catalog of Federal Domestic Assistance Program No. 93.774, Medicare—Supplementary Medical Insurance Program.)

Dated: August 30, 2005.

Mark B. McClellan,

Administrator, Centers for Medicare & Medicaid Services.

Approved: February 17, 2006.

Michael O. Leavitt,

Secretary.