Key Takeaways from the Revised and Clarified Stark Law Regulations – Part 1

CMS made impactful changes to the Federal physician self-referral law’s (i.e., Stark Law’s) regulations in its Final Rule that were effective January 19, 2021 (with the exception of the changes to 42 C.F.R. § 411.352(i) that are effective January 1, 2022). Although lengthy (190 pages/3-column format), the Final Rule is worth the read with multiple clarifications and revisions to the dense regulations.

In this first part of our two-part blog, each reader will find gems in the Final Rule that are impactful, but we note particularly the following key changes, clarification, and discussion:

1.  New Value-Based Exceptions (§ 411.357(aa))

The new value-based (VB) exceptions offer three (3) options to arrangements involving remuneration paid under a VB arrangement:

1. full financial risk for which the VB enterprise (VBE) is at “full financial risk”—meaning that the VBE is financially responsible on a prospective basis for the cost of all patient care items and services covered by the applicable payer for each patient in the target patient population for a specified period of time. 42 C.F.R. § 411.357(aa)(1)(vii)—(or is contractually obligated to be at full financial risk within the 12 months following the commencement of the VB arrangement) during the entire duration of the VB arrangement;
   
   
2. meaningful downside risk for which the physician is at “meaningful downside risk”—meaning that the physician is responsible to repay or forgo no less than 10% of the total value of the remuneration the physician received under the value-based arrangement. 42 C.F.R. § 411.357(aa)(2)(ix)—for failure to achieve the VB purpose(s) of the VBE during the entire duration of the VB arrangement and the nature and extent of that risk is set forth in writing; and
   
   
3. value-based arrangements for which the arrangement is set forth in writing and signed by the parties and includes a description of (A) the VB activities to be undertaken under the arrangement, (B) how those activities are expected to further the VB purposes of the VBE; (C) the target patient population for the arrangement; (D) the type/nature of the (monetary or nonmonetary) remuneration; (E) the methodology used to determine the remuneration; and (F) the outcome measures against which the recipient of the remuneration is assessed (if any). (NOTE: The title of this 3^rd exception is confusing because it is called “value-based arrangements” despite all three exceptions applying to VB arrangements.)

With regard to all three (3) VB exception options:

• The exceptions have additional requirements, and there are multiple definitions that need attention.
  
  
• VB exceptions do not include fair market value, set in advance, volume or value of referrals or other business-generated requirements. However, the VB arrangement exception does expressly require that the compensation arrangement is commercially reasonable (the full financial risk and meaningful downside risk exceptions do not).

2.  New Exception for Limited Remuneration to a Physician (§ 411.357(z))

CMS finalized a new exception to protect compensation not exceeding an aggregate amount of $5,000 per calendar year, as adjusted for inflation, to a physician for the provision of items and services (including the lease of office space or equipment) without the need for a signed writing.

• CMS noted that if an entity has multiple arrangements with a physician that are undocumented and unsigned, it will consider the parties to have a single compensation arrangement for the various items and services, and the aggregate compensation for all those items and services may not exceed the $5,000 annual limit (See 85 Fed. Reg. at 77,624).
  
  
• That annual aggregate remuneration limit resets each calendar year.
  
  
• The exception permits the physician to provide services directly or through employees hired for the purpose of performing the services, a wholly-owned entity or through locum tenens physicians (but not through independent contractors).
  
  
• The writing and set in advance requirements are only triggered if there is a directed referral arrangement.
  
  
• The limited remuneration to a physician exception is intended to apply to a physician, not to a physician organization. (Id. at 77,626) Be careful how these arrangements are structured, because if “stand in the shoes” compensation is received by a physician organization, then that compensation counts to all physician who “stand in the shoes” of the organization.

3.  New Cybersecurity Technology and Related Services Exception (§ 411.357(bb))

CMS adopted a new cybersecurity technology and related services exception that incorporates many of the same requirements of the EHR exception.

• The exception covers cybersecurity software (e.g., malware prevention, data protection and encryption); cybersecurity-related hardware</em>; and cybersecurity-related services (e.g., cybersecurity training services, services associated with performing a cybersecurity risk assessment). Examples are fleshed out in the Final Rule, and are illustrative, not exhaustive. (Id. at 77,634)
  
  
• The exception only applies to technology and services that are necessary and used predominantly to implement, maintain, and reestablish cybersecurity.
  
  
• The exception is limited to nonmonetary compensation (i.e., no subsidies are permitted under this exception and no ransom payments).
  
  
• CMS did not exclude any particular type of technology or services—including patches and updates—from the application of the final cybersecurity exception. There is no financial contribution requirement so the initial writing and meeting the exception’s other requirements can cover patches.
  
  
• The exception does not apply to donations of installation, improvement, or repair of infrastructure related to physical safeguards even if they could improve cybersecurity (e.g., upgraded wiring or high security doors) because such donations have benefits outside cybersecurity.
  
  
• Physicians cannot make the receipt of cybersecurity technology and services a condition of doing business.
  
  
• The exception does not require the parties to sign the writing that documents the arrangement, nor do they need to draft the writing as a formal contract. The writing requirement is satisfied if contemporaneous documents would permit a reasonable person to verify compliance with the exception at a time the referral is made. (Id. at 77,642)