CMS to Implement Fingerprint-Based Background Checks for High-Risk Providers and Suppliers in 2014

Fingerprint-based background checks intended to “detect bad actors” enrolled or attempting to enroll in federal health programs

This post was authored by Elizabeth Carder-Thompson and Debra McCurdy.

More than three years after publication of final regulations to implement Affordable Care Act (ACA) provisions that strengthen provider and supplier enrollment screening provisions under federal health care programs, the Centers for Medicare & Medicaid Services (CMS) has selected a Fingerprint-Based Background Check Contractor (FBBC) and intends to phase in fingerprint-based background checks beginning in 2014.


By way of background, CMS published a final rule on February 2, 2011 pursuant to Section 640 of the ACA, which required the Department of Health and Human Services to establish procedures for screening providers and suppliers participating in federal health care programs (specifically, Medicare, Medicaid, and the Children’s Health Insurance Program).  Among other things, the final rule applies various screening tools, including unannounced site visits, background checks, and fingerprinting, based on the level of risk associated with different provider and supplier types.  CMS established three levels of risk – limited, moderate, and high – and every provider and supplier category is assigned to one of these three levels.  Individuals who maintain a 5 percent or greater direct or indirect ownership interest in a provider or supplier in the high risk category -- including newly-enrolling home health agencies (HHAs) and newly-enrolling durable medical equipment, orthotics, prosthetics, and supplies (DMEPOS) suppliers -- are subject to a fingerprint-based criminal history report check of the Federal Bureau of Investigations (FBI) Integrated Automated Fingerprint Identification System. 


While the final rule was effective March 25, 2011, as mandated by the ACA, CMS delayed the effective date of the fingerprint-based criminal history record check provision until after additional subregulatory guidance was issued.   CMS awarded a $4.19 million FBBC contract to Accurate Biometrics, Inc. in March 2014, a significant step in the implementation process.  Following this award, CMS issued a provider update announcing that it intends to phase in the fingerprint-based background check implementation beginning in 2014Not all providers and suppliers in the "high" level of risk category will initially be a part of the fingerprint-based background check requirement, but eventually the fingerprint-based background check will be completed on all individuals with a 5 percent or greater ownership interest in a provider or supplier that falls under the high-risk category.


Providers and suppliers subject to the fingerprint requirements will receive a notification letter from their Medicare Administrative Contractor (MAC), and applicable individuals will have 30 days from the date of the notification letter to be fingerprinted at one of at least three locations identified by the FBBC (individuals will incur the cost of having their fingerprints taken). After fingerprinting is complete, the fingerprints will be forwarded to the FBI, which will compile the background history and share results with the FBBC within 24 hours of receipt. The FBBC will assess the data and provide a "fitness recommendation" to CMS indicating whether the criminal history record information contains enrollment violations or otherwise fails to meet requirements or guidelines established by CMS for enrollment of a Medicare provider or supplier; CMS will then make the final determination about the provider or supplier. CMS will notify providers and suppliers if the assessment of the fingerprint-based background check results in the denial of an enrollment application or revocation of existing Medicare billing privileges. The CMS guidance also provides information on standards for securing the data under the review process.


This announcement marks the latest steps in seemingly ever-escalating CMS efforts to clamp down on fraud and abuse in the Medicare and Medicaid programs. While the initial targets of the fingerprint-based background requirements are new DMEPOS suppliers and HHAs, the policy also will apply to those who are elevated to the high risk category in accordance with enrollment screening regulations, which could include providers/suppliers coming back into the Medicare fee-for-service program after a moratorium is lifted, or providers which have been subject to a payment suspension, exclusion, or revocation. It is likely that some "owners" of entities, such principals of investment firms with financial interests in providers and suppliers, will balk at the whole idea of being fingerprinted. Moreover, the pending fingerprint process will doubtless provide even more opportunities for administrative missteps, and erroneous and time-consuming supplier/provider number revocations.

Obama Administration Cites Record-Breaking Health Fraud Recoveries under Joint DOJ-HHS Program

According to the latest Health Care Fraud and Abuse Control Program (HCFAC) Annual Report, federal health care fraud prevention and enforcement efforts resulted in the recovery of a record $4.3 billion in FY 2013, up from $4.2 billion in FY 2012. In announcing detailed enforcement achievements, the Administration cites new ACA authorities – including enhanced provider screening requirements, limited enrollment moratoria, and authority to suspend Medicare payments during pending investigations -- that have improved the government’s ability to clamp down on health care fraud. The report also notes the successes of coordinated Department of Justice (DOJ) and HHS efforts such as the Health Care Fraud Prevention & Enforcement Action Team (HEAT) and interagency Medicare Fraud Strike Force teams.

CMS Extends and Expands Moratoria on Enrollment of Home Health Agency, Ambulance Suppliers in Designated Areas

Citing significant potential for fraud and abuse, CMS has announced that it is temporarily suspending new home health agency (HHA) and ground ambulance enrollment in Medicare, Medicaid, and the Children’s Health Insurance Program in several geographic areas, and it is extending the current enrollment moratoria for these provider types in separate areas. Specifically, effective January 30, 2014, CMS is establishing a 6-month moratorium on HHA enrollment in the following metropolitan areas: Fort Lauderdale, Detroit, Dallas and Houston. CMS also is temporarily suspending enrollment of new ground ambulance suppliers in the Greater Philadelphia area. In addition, CMS is extending for six-months a current enrollment moratoria (announced in July 2013) impacting HHAs in Chicago and Miami and ground ambulance suppliers in Houston. Note that CMS may lift the moratoria earlier or extend them for another six months through issuance of a Federal Register notice.

While existing providers and suppliers can continue to deliver and bill for services in moratoria areas, no new applications for the designated provider types will be approved, unless the provider’s enrollment application has already been approved, but not yet entered into PECOS or the State Provider/Supplier Enrollment System at the time the moratorium is imposed. According to CMS, the initial moratoria that began in July 2013 resulted in the denial of the enrollment applications of 231 HHAs and 7 ambulance companies in the geographic areas affected by the moratoria. A CMS notice explains the rationale for the imposition and extension of the moratoria.

CMS Boosts Provider Enrollment Fee for 2014

CMS has announced the 2014 application fee for institutional providers that are initially enrolling in the Medicare or Medicaid program or the Children's Health Insurance Program (CHIP); revalidating their Medicare, Medicaid or CHIP enrollment; or adding a new Medicare practice location (unless a hardship exemption applies). The fee for 2014 is $542, up from $532 in 2013. CMS uses a broad definition of institutional entities subject to the application fee; it applies to “any provider or supplier that submits a paper Medicare enrollment application using the CMS-855A, CMS-855B (not including physician and non-physician practitioner organizations), CMS-855S or associated Internet-based PECOS enrollment application,” along with additional categories of Medicaid-only and CHIP-only institutional providers.

CMS "Phase 2" Ordering/Referral Denial Edits to Go Live on Jan. 6, 2014

Despite continuing provider concerns, CMS has announced that it will direct Medicare administrative contractors (MACs) to activate controversial “phase 2” ordering/referral edits effective January 6, 2014. Once activated, MACs will deny claims for Medicare Part B services (including lab services and the technical component of imaging services), durable medical equipment, and Part A home health agency (HHA) services if the ordering/referring physician or other professional is not identified, is not in Medicare's enrollment records, or is not of a specialty type that may order/refer the service/item being billed. CMS had previously delayed an earlier May 1, 2013 target date for implementation due to objections by physicians and suppliers that they could experience claims denials and delays based on discrepancies between the names of the ordering physician on the 1500 claim form and in Medicare’s enrollment records. There has been no assurance from CMS, however, that these concerns have been fully resolved, and the only recourse for providers if claims are inappropriately denied claim will be to file an appeal. A CMS educational article accompanying the announcement suggests that imaging suppliers and providers bill global claims separately to prevent a denial for the professional component in the event that the new edits deny the technical component of imaging services. 

CMS Call to Discuss Streamlined Access to PECOS, EHR, and NPPES (Nov. 15)

On November 15, 2013, CMS is hosting a provider call to discuss recent changes in the way providers and suppliers access the Provider Enrollment Chain and Ownership System (PECOS), the Electronic Health Records (EHR) Incentive Program, and the National Plan and Provider Enumeration System (NPPES).   These updates are intended to facilitate registration as an individual practitioner, authorized or delegated official of an organization, or someone working within PECOS on behalf of a provider or supplier. The call will provide detailed instructions on these new processes, which have been available since October 7.

OIG Highlights Inaccuracy in Medicare Enrollment Databases

According to the OIG, Medicare provider enrollment databases include inaccurate, incomplete, and inconsistent provider data, and -- coupled with insufficient oversight -- “present vulnerabilities in all health care programs.” The OIG reviewed heath care provider information maintained in the National Plan and Provider Enumeration System (NPPES) and the Provider Enrollment, Chain and Ownership System (PECOS). For instance, provider data was inaccurate in 48% of NPPES records and 58% of PECOS records, and this data was inconsistent between NPPES and PECOS for 97% of records (addresses were the source of most inaccuracies and inconsistencies). The OIG recommends that CMS: require Medicare Administrative Contractors to implement program integrity safeguards for Medicare provider enrollment; require more verification of NPPES and PECOS data; and detect and correct inaccurate and incomplete provider data. CMS concurred with the recommendations. The title of the OIG report is: “Improvements Are Needed To Ensure Provider Enumeration and Medicare Enrollment Data Are Accurate, Complete, and Consistent.” 

CMS Delays Phase 2 Ordering and Referring Denial Edits

On April 25, 2013, CMS announced that, due to technical issues, it is delaying implementation of the Phase 2 ordering and referring denial edits until further notice. By way of background, CMS plans to implement edits that will deny claims for Medicare Part B services (including the technical/non-interpretation component of imaging services, lab services, and durable medical equipment) and Part A home health agency services if the ordering/referring physician or other professional is not identified, is not in Medicare's enrollment records, or is not of a specialty type that may order/refer the service/item being billed. While CMS intended to require Medicare contractors to activate these edits effective May 1, 2013, concerns had been raised by physicians and suppliers that they could experience claims denials and delays based on discrepancies between the names of the ordering physician on the 1500 claim form and in Medicare’s enrollment records. CMS expects to announce a new implementation date in the near future.

Proposed Rule Would Reward Medicare Fraud Tipsters up to $9.9 Million, Revise Medicare Provider Enrollment Regulations

This post was written by Scot T. Hasselman, Andrew C. Bernasconi, Susan A. Edwards and Debra A. McCurdy.

Yesterday the Centers for Medicare & Medicaid Services (CMS) issued a proposed rule that would dramatically increase the potential reward to an individual who provides a tip leading to the recovery of Medicare funds from a current maximum of $1,000 to a maximum of $9.9 million under the Medicare Incentive Reward Program.  Since 1998, an individual providing information regarding potential Medicare fraud and abuse to the Department of Health & Human Services’ Office of  Inspector General or the Medicare contractor with jurisdiction over the suspected fraudulent provider or supplier may be eligible to receive 10 percent of the Medicare funds ultimately collected from the tip, or $1,000, whichever is less.  Pursuant to the proposed rule CMS issued yesterday, an individual furnishing information that otherwise satisfies the requirements set forth in 42 C.F.R. § 420.405 would be eligible to receive 15 percent of a recovery up to $66 million.  Therefore, a tipster could receive up to a $9.9 million reward for any information provided regarding suspected Medicare fraud and abuse.

In the proposed Medicare Incentive Reward Program rule, CMS explains that it “tentatively project[s] a net increase in recoveries of $24.5 million per year as a result of the proposed changes.”  In addition, CMS notes that it is modeling the proposed Incentive Reward Program changes on a “highly successful” Internal Revenue Services (IRS) reward program that returned “far greater sums than the existing Medicare [Incentive Reward Program].”  Notably, since the implementation of the current Medicare Incentive Reward Program in July 1998, CMS has collected only $3.5 million; in contrast, between 2007 and 2012, the IRS has collected almost $1.6 billion through its reward program.  CMS states in the preamble that it proposes to clarify that it will not pay an award if the same or substantially similar information was the basis for a relators share in a qui tam lawsuit under the federal False Claims Act or a state False Claims Act, or is the basis for a pending state or federal False Claims Act suit.  However, the proposed regulatory language that would codify this change, found at proposed 42 C.F.R. § 420.405(b)(3), does not specify that this provision would apply to state False Claims Acts.

The proposed rule also would pay the reward amount only to the first individual who makes a report.  In addition, among other proposed changes to the regulations found at 42 C.F.R. § 420.405, CMS proposes to emphasize that it has exclusive discretion in determining the amount of a reward and whether the reward criteria are met.  The existing regulation provides for numerous other exceptions and conditions and generally excludes federal and state law enforcement officials, federal government employees, and federal contractors, from eligibility.

CMS also proposes several revisions to Medicare’s provider enrollment regulations, such as:

  • Allowing CMS to deny the enrollment of providers, suppliers, and owners affiliated with an entity that has unpaid Medicare debt;
  • Expanding the instances under which a felony conviction can serve as a basis for denial or revocation of a provider or supplier's enrollment;
  • Enabling CMS to revoke Medicare billing privileges if it determines that the provider or supplier has a pattern or practice of submitting claims for services that fail to meet Medicare requirements; and
  • Limiting the ability of ambulance suppliers to “backbill” for services performed prior to enrollment.

The proposed rule will be published in the April 29, 2013 edition of the Federal Register, and comments will be accepted for 60 days thereafter (June 28, 2013).


Implementation of Medicare Ordering/Referring Provider Edits (March 20 Call)

Effective May 1, 2013, Medicare contractors will activate edits that will deny claims for Medicare Part B (including imaging and lab services), DME, and Part A home health agency (HHA) services if the ordering/referring physician or other professional is not identified, is not in Medicare's enrollment records, or is not of a specialty type that may order/refer the service/item being billed. Concerns have been raised by physicians and suppliers that they could experience claims denials and delays after May 1 based on discrepancies between the names of the ordering physician on the 1500 claim form and in Medicare’s enrollment records. CMS is holding a March 20, 2013 National Provider Call to discuss these new requirements.

2013 Medicare Participation Enrollment Period for DMEPOS Suppliers Extended until April 15, 2013

CMS is extending the 2013 Medicare participation enrollment period for suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) until April 15, 2013. By way of background, a supplier that signs a participation agreement commits to accepting the Medicare Part B rate as payment in full for all beneficiaries. Changes in a supplier’s participation status can only be made during the annual open enrollment period. While CMS is extending the deadline because some suppliers apparently were not aware of a previous deadline extension to February 15, the new announcement gives suppliers another opportunity to examine their participation status in light of recent Medicare payment developments, including sequestration and upcoming Medicare cuts for retail diabetic testing supplies. Any change in election status will be effective January 1, 2013, but CMS will not reprocess claims already filed. 

CMS Issues Revised CMS-855S, 855O Medicare Enrollment Applications

CMS has released the revised CMS-855S Medicare supplier enrollment application, version 01/13. Suppliers may use the 07/11 version of the CMS-855S through May 7, 2013, at which time any information received on the obsolete form will be returned to the supplier, according to the National Supplier Clearinghouse. CMS also has posted an updated (1/13) version of the CMS 855O form, the Medicare Enrollment Application - Registration for Eligible Ordering and Referring Physicians and Non-Physician Practitioners.

Obama Administration's Regulatory Agenda Points to Busy 2013 for HHS

On January 8, 2013, the Obama Administration published its latest semiannual regulatory agenda, outlining planned regulatory initiatives in a number of policy areas. The Federal Register version of the agenda includes only a portion of the regulations in the pipeline, however; the full agenda has been posted on the Office of Management and Budget (OMB) web site. Major Department of Health and Human Services (HHS) regulations are highlighted after the jump.

  • An HHS Office of Inspector General (OIG) proposed rule that would add new/modify existing safe harbors under the anti-kickback statute; add new/revise existing regulations governing OIG's authority to impose civil money penalties and assessments; add new/revise existing regulations governing OIG's exclusion authority; and codify new exceptions to the beneficiary inducement prohibition (expected July 2013);
  • A final Centers for Medicare & Medicaid Services (CMS) rule implementing Affordable Care Act (ACA) provisions related to Medicaid reimbursement for covered outpatient drugs (expected in August 2013);
  • A CMS proposed rule to establish Medicare payment safeguards to prevent providers and suppliers that do not meet Medicare requirements from remaining enrolled in or submitting claims to Medicare (expected May 2013);
  • Proposed emergency preparedness requirements for Medicare and Medicaid participating providers and suppliers (expected in July 2013);
  • A final CMS rule establishing requirements for disclosure of skilled nursing facilities' ownership (expected May 2013);
  • A final rule on long-term care facility agreements with hospice agencies (expected October 2013);
  • A proposed rule to establish a prospective payment system for Federally Qualified Health Centers (expected June 2013);
  • Annual Medicare payment update rules (various dates);
  • Various rules implementing insurance-related provisions of the ACA (various dates);
  • A final rule modifying HIPAA privacy, security, enforcement, and breach notification rules (expected but not released in December 2012);
  • An advance notice of proposed rulemaking to establish a methodology allowing an individual harmed by an offense punishable under HIPAA to receive a percentage of any civil money penalty or monetary settlement collected (expected March 2013);
  • A final rule to enhance human subjects research protections (expected April 2013); and
  • A Food and Drug Administration (FDA) final rule establishing a unique device identification system for medical devices (expected May 2013).

There are also some surprises on the Administration’s list of “long-term actions” – including the long-overdue final ACA “Sunshine Act” rule requiring applicable manufacturers of drugs, devices, biologicals, or medical supplies to annually report certain payments to physicians or teaching hospitals (“final action” listed as December 2014). Other long-term actions include a final rule implementing ACA requirements related to reporting and returning of overpayments (February 2015); a variety of rules dealing with the 340B discount drug program (timing listed as “to be determined”); and a final HIPAA privacy rule on accounting for disclosures under the Health Information Technology for Economic and Clinical Health Act (TBD).

CMS Announces 2013 Provider Enrollment Application Fee Amount

CMS recently published a notice announcing a $532.00 calendar year 2013 application fee for institutional providers that are initially enrolling in the Medicare or Medicaid program or the Children's Health Insurance Program (CHIP); revalidating their Medicare, Medicaid or CHIP enrollment; or adding a new Medicare practice location. This fee is required with any enrollment application submitted on or after January 1, 2013 and on or before December 31, 2013. 

CMS Releases Medicare Advantage/Part D Drug Plan Quality Data as Open Enrollment Period Begins

The 2013 Medicare Open Enrollment Period runs from October 15 to December 7, 2012. To help beneficiaries make informed choices, CMS has posted updated quality rating information for Medicare Advantage plans and Part D prescription drug plans for the coming year. An HHS press release summarizing the data and providing links to additional information is available here

CMS Call on Medicare Provider Enrollment (Oct. 10)

On October 10, 2012, CMS will hold a National Provider Call on Medicare Provider Enrollment. The call will cover the following topics: Revalidation; Billing for Ordered/Referred Services; and PECOS Enhancements. Registration is required.

CMS Proposes Revisions to DMEPOS Supplier Application

CMS is proposing changes to the Medicare enrollment application for DMEPOS suppliers (CMS 855S) to simplify and clarify the current data collection and to remove obsolete questions. According to CMS, the majority of the revisions are non-substantive in nature (e.g., spelling and formatting corrections). Comments on the forms will be accepted until June 4, 2012.

GAO Reviews Medicare Provider/Supplier Screening Efforts

The GAO has issued a report entitled “Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of Providers and Suppliers.” The GAO describes how CMS and its contractors use provider and supplier enrollment information to prevent improper payments, along with factors that may affect the usefulness of this information. The report also provides an update on CMS’s progress in implementing new provider and supplier enrollment screening procedures mandated by the ACA. For instance, CMS informed the GAO that it plans to contract with two Federal Bureau of Investigation-approved contractors to conduct fingerprint-based criminal background checks of high-risk providers and suppliers by the end of 2012. CMS also plans to extend the surety bond requirement to high-risk providers and suppliers beyond DMEPOS suppliers (potentially impacting home health agencies, independent diagnostic testing facilities, and outpatient rehabilitation facilities). The GAO also reports that CMS has charged a new automated screening contractor with, among other things, identifying additional data sources for screening checks (e.g., financial, tax, and business data sources). CMS also contracted with a site visit contractor to perform nationwide physical site visits for all providers and suppliers, except DMEPOS suppliers, in the moderate- and high-risk screening categories. 

CMS Finalizes Changes in Medicare/Medicaid Provider and Supplier Enrollment, Ordering, Documentation Requirements

CMS published a final rule on April 27, 2012 that updates regulations regarding Medicare and Medicaid provider and supplier enrollment, ordering and referring, documentation requirements, and provider agreements, effective June 26, 2012. The rule modifies and finalizes several ACA provisions implemented in the May 5, 2010 interim final rule with comment period. Among other things, the rule:

  • Requires all providers of medical or other items or services and suppliers that qualify for a National Provider Identifier (NPI) to include their NPI on all Medicare and Medicaid enrollment applications and claims.
  • Requires physicians and other professionals who are permitted to order and certify Medicare covered items and services to be enrolled in Medicare. The final rule modifies a requirement that had been in the interim final rule that the ordering provider be registered in the Medicare Provider Enrollment, Chain, and Ownership System (PECOS). While the rule still requires ordering physicians and other eligible professionals to be enrolled in the Medicare program (or to maintain a valid opt-out record), enrollment in PECOS is no longer required.
  • Mandates document retention and provision requirements for certain providers and suppliers that order and certify items and services for Medicare beneficiaries. The provision specifically applies to durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS), laboratory, imaging, and home health services – importantly, CMS has dropped an earlier reference to “specialist services” being subject to these requirements. The final rule also clarifies that the documentation requirement is not the responsibility of the physicians interpreting imaging studies -- only the technical component entity has to meet these requirements. Under the final rule, necessary documentation must be retained for 7 years from the date of service (rather than the date of the order or certification as provided under the interim final rule). A provider or supplier that does not meet the documentation retention requirements is subject to revocation for not more than 1 year for each act of noncompliance. 

CMS Upgrades to PECOS Enrollment System

CMS has announced a series of upgrades to the Medicare online enrollment system, known as PECOS (“Provider Enrollment, Chain, and Ownership System”), that are intended to reduce data entry time and increase access to information.