ZPIC Audits are Here. When it Rains, it Pours . . . DME Compliance is Essential!

II. Preenrollment and Revalidation Screening Procedures:

The ACA empowered CMS to classify newly-enrolling or revalidating providers based on their perceived risk of fraud and then link those classifications to various types of screening procedures. This new rule, which went into effect on March 25, 2011, creates three categories of risk into which providers will be sorted: (1) Limited, (2) Moderate, and (3) High. The risk level with which a provider is designated is commensurate with the extent and nature of the pre-enrollment or revalidation screening procedures. Under the new rule, currently enrolled, revalidating DMEPOS suppliers have been assigned to the “Moderate Risk” category,^[1] while newly-enrolling DMEPOS suppliers (including currently-enrolled DMEPOS suppliers who are adding another location) will be deemed “High Risk.”^[2]

(A) Overview of Available Screening Procedures.

The following screening procedures are currently available to CMS:

• Licensure Requirements – DMEPOS suppliers are required to comply with all applicable licensing, certification, or accreditation requirements in the state where they are located. Medicare contractors are responsible for reviewing state licensing board data every month to ensure that DMEPOS suppliers remain licensed, certified, or accredited.
• Database Checks – Medicare contractors check various databases to ensure that current and prospective supplier information is accurate. CMS contractors check databases maintained by the Social Security Administration (used to verify an individual’s Social Security Number), the National Plan and Provider Enumeration System (NPPES) (used to verify the national provider identifier (NPI)), HHS-OIG’s “List of Excluded Individuals or Entities,” and the General Service Administration’s “Excluded Parties List System.”
• Site Visits – The Medicare Program Integrity Manual (MPIM) permits contractors to conduct site visits to determine if a DMEPOS supplier is “operational”^[3] or to ascertain whether the supplier is meeting applicable regulatory standards or program requirements. Some examples of site visits include:
• The National Supplier Clearinghouse (NSC) Medicare Administration Contractor (the Medicare contractor responsible for handling enrollment applications for DMEPOS suppliers) currently conducts pre-enrollment site visits of DMEPOS applicants that are not part of a chain supplier (a chain is a supplier with more than 25 locations).
• The NSC also conducts post-enrollment site visits to DMEPOS suppliers if CMS or NSC believes that the supplier may be involved in fraudulent or abusive activities. These post-enrollment site visits are intended to help ensure DMEPOS compliance with supplier standards.
• A state survey agency or an approved national accreditation organization with “deeming authority” may also conduct pre-enrollment surveys of certified providers and suppliers to determine if they meet the Federal conditions of participation.
• Criminal Background Checks – CMS is now empowered to conduct criminal background checks of DMEPOS “owners” (e.g. those who maintain a 5% or more ownership interest in the supplier), authorized officials, or managing employees.
• Fingerprinting – the new fingerprinting requirement also applies to all owners, authorized officials, or managing employees of a DMEPOS supplier.

(B) Currently-Enrolled, Revalidating DMEPOS Suppliers.

Currently enrolled, revalidating DMEPOS suppliers, which are deemed “Moderate Risk” under the new regulations, will be subject to the following screening measures:

• Verification that the provider meets applicable federal regulations and state requirements;
• Verification that the provider meets applicable licensure requirements;
• Ongoing database checks to ensure that the provider satisfies all applicable enrollment criteria; and
• Unannounced or unscheduled site visits prior to and following provider enrollment or revalidation.

CMS has elected to categorize currently-enrolled, revalidating DMEPOS suppliers as “Moderate Risk” because many of them are highly dependent on federal healthcare programs for revenue and because CMS believes that a number of these types of providers enter business without any substantial clinical or business experience.

(C) Newly-Enrolling DMEPOS Suppliers.

Newly-enrolling DMEPOS suppliers will fall into the “High Risk” category and therefore must meet all of the foregoing requirements for “Moderate Risk” providers and undergo:

• Fingerprinting; and
• Criminal background checks.

CMS has classified newly-enrolling DMEPOS suppliers as “High Risk” because of the substantial number of such providers already enrolled in the Medicare program and the numerous government reports alleging waste, fraud, and abuse by DMEPOS suppliers in the Medicare program.

(D) Adjustments to a Supplier’s Risk Category.

The new rule also permits CMS to increase a supplier’s risk level from “Limited” or “Moderate” to “High” in any of the following circumstances:

• CMS imposed a payment suspension on the supplier in the last 10 years;
• The supplier has been excluded from Medicare by HHS-OIG;
• The supplier’s billing privileges were revoked in the last 10 years and the supplier is attempting to establish new Medicare billing privileges by enrolling as a new supplier or registering a new practice location;
• The supplier is precluded from billing Medicaid;
• The supplier has been subject to any “final adverse action” in the last 10 years;
• The supplier has been excluded from any federal healthcare program; or
• CMS has lifted a temporary moratorium for a particular supplier type and a supplier that was prevented from enrolling due to the moratorium applies for enrollment within 6 months from the date the moratorium was lifted.