United States: Final Anti-Kickback Safe Harbors And Stark Exceptions For Electronic Prescribing And Health Records Arrangements

On August 8, 2006, the Office of Inspector General ("OIG") of the U.S. Department of Health and Human Services ("HHS") and the Centers for Medicare & Medicaid Services ("CMS") published final rules providing additional safe harbors under the federal anti-kickback statute¹ and corresponding exceptions to the physician self-referral law ("Stark law").² The new rules, which will become effective on October 10, 2006, will protect certain arrangements whereby certain permitted donors provide electronic prescribing ("E-prescribing") technology to specified recipients. In addition, the final rules will protect similar arrangements involving the provision of electronic health records ("EHR") technology. The final rules have largely incorporated the public comments and suggestions received in response to the proposed rules, published on October 11, 2005.³ The OIG and CMS clearly relied on input from the health care industry in attempting to craft regulations that facilitate the use of technologies that improve patient safety, quality of care, and efficiency, while at the same time minimizing the risk those arrangements might be used to induce or reward referrals.

As a general matter, the protections offered by the final rules are less restrictive than the proposed rules, particularly with respect to the value of technology that may be donated, the range of items and services that may be prescribed using protected technology, and the certification requirements imposed on recipients of such technology. In particular, neither the Stark exception nor the antikickback safe harbor contain a maximum cap on the value of E-prescribing or EHR technology that may be donated to a particular recipient. In addition, the final EHR rules are more simplified, allow the donation of certain multi-functional technologies (e.g., software that performs more than just EHRrelated functions), and apply to a wider range of donors and recipients, although recipients now have a cost-sharing obligation not included in the respective proposed rules. Also, E-prescribing technology protected under the final rules may be used to prescribe any non-drug item or service routinely ordered by prescription, including durable medical equipment ("DME") and laboratory tests. Lastly, both agencies have abandoned their proposals to develop a separate safe harbor and corresponding Stark exception to protect the donation of multi-functional technology; instead, CMS and the OIG have developed broader EHR rules that may encompass such arrangements.

The E-prescribing rules will likely have an impact on health care entities and their relationships with individual providers in the context of E-prescribing, particularly considering the absence of a cap on the value of items and services that can be donated. Additionally, the final EHR regulations will allow a wide range of health care providers, suppliers, ancillary service providers, and others donate and receive EHR software, training, and information technology services that meet industry-standard criteria for EHR technologies. The final Stark exception and anti-kickback safe harbor for EHR and Eprescribing arrangements will become effective on October 10, 2006; the protections offered by the final regulations will expire December 31, 2013.

The federal anti-kickback statute, section 1128B(b) of the Social Security Act (the "Act")⁴, establishes criminal penalties for individuals or entities that knowingly and willfully offer, pay, solicit, or receive remuneration in order to induce or reward the referral of, or arrange for, business reimbursable under any of the federal health care programs, including Medicare and Medicaid. Due to the broad reach of the statute, the OIG has promulgated so-called "safe harbor" provisions that identify certain financial arrangements and business practices that are not prohibited by the anti-kickback statute due to their reduced potential for fraud and abuse.⁵ Although compliance with safe harbor provisions is completely voluntary, the OIG encourages health care providers to structure arrangements to fit within safe harbors in order to ensure that their business practices are not subject to enforcement actions under the anti-kickback statute.

Similarly, a federal law that is commonly known as the Stark law⁶ prohibits physicians from making referrals for certain designated health services ("DHS") payable by Medicare and Medicaid to entities with which they (or a close family member) have a financial relationship.⁷ The Stark law establishes various exceptions to the referral prohibition for arrangements that do not pose a risk of abuse for the federal programs and patients. CMS has issued regulations interpreting the Stark law and its exceptions and creating a number of additional regulatory exceptions.⁸ Unlike the anti-kickback safe harbors, however, compliance with Stark exceptions is mandatory in that, absent an applicable exception, a physician’s referrals to a DHS provider are prohibited if a financial relationship exists.

In 2003, the Medicare Prescription Drug, Improvement, and Modernization Act (the "MMA") established a prescription drug benefit under the Medicare program. In order to facilitate the development of E-prescribing technology that will improve patient safety, quality of care, and overall program efficiency, the MMA directed the Secretary of HHS (the "Secretary") to adopt standards for E-prescribing.⁹ Further, the MMA directed the Secretary to create an additional Stark exception and corresponding anti-kickback statute safe harbor to protect certain arrangements involving the provision of E-prescribing technology by DHS providers and other entities for the sole use of transmitting and receiving electronic prescription information.

Pursuant to the mandates of the MMA, the OIG and CMS published proposed rules providing additional safe harbors under the federal anti-kickback statute and corresponding exceptions to the Stark law on October 11, 2005. These rules proposed to protect certain arrangements involving hospitals, group practices, prescription drug plans ("PDPs"), and Medicare Advantage ("MA") organizations that provide E-prescribing and EHR technology to specified recipients. The proposed rules were unusual because the agencies explicitly solicited public comment on so many features of the proposals, including the cost, type, and necessity of E-prescribing and EHR technology, and the criteria with which recipients of such software and hardware may be selected without implicating fraud and abuse concerns. In addition, the proposes rules proposed to implement caps on the total value of technology that could be donated and offered bifurcated EHR safe harbors and Stark exceptions that would respectively operate before and after the Secretary adopted certification standards for such technology. Notably, neither the OIG nor CMS proposals included draft regulatory language for the provision of multi-functional technologies, and the OIG proposal did not include draft regulatory language relating to a safe harbor for EHR technology; rather, the agencies’ thoughts on these aspects were reflected only in their preamble discussions.

The OIG and CMS have now issued their final E-prescribing rules mandated by the MMA. In addition to this new E-prescribing Stark exception and corresponding anti-kickback safe harbor, the agencies also have finalized their rules protecting certain arrangements involving the provision of EHR software and information technology services to health care providers and suppliers. Both the OIG and CMS have indicated that the final Stark and anti-kickback regulations are intended to be as complementary and consistent as possible, despite the differences in their respective underlying statutes.

The E-prescribing rules are aimed at allowing certain persons, referred to as "donors," to furnish to other persons, referred to as "recipients," certain E-prescribing hardware, software, and information technology and training services, without risking a violation of the anti-kickback statute or Stark law. The E-prescribing rules contain a number of requirements designed to minimize the risk of abuse, including requirements as to the necessity and use of the technology protected by the rules, limitations on the donors and recipients of the technology, limitations on the type and usefulness of the technology, and certain other requirements.

The E-prescribing rules allow the provision of E-prescribing technology in non-monetary form only. Therefore, this technology would have to be furnished as an in-kind benefit, rather than an award of cash to enable the recipient to acquire it.

The MMA requires that the Stark exception and anti-kickback safe harbor protect only the provision of items and services that are "necessary and used solely" to transmit and receive electronic prescription information. A number of commenters asserted that the MMA’s use of the term "electronic prescription information" should be interpreted broadly to encompass a range of items and services that can be ordered by prescription, rather than just drugs. CMS and the OIG agreed with the commenters and have defined the term "prescription information" for purposes of the final rules as meaning "information about prescriptions for drugs or any other item or service normally accomplished through a written prescription."¹⁰

Consequently, the final rules will protect E-prescribing technology that is used for the transmission of prescription information for items and services other than drugs, such as DME, physical therapy, and laboratory tests. This expansion of the proposed rules is likely of special importance to our clients who manufacture and distribute DME, perform laboratory testing services, or prescribe such items and services covered under the federal health care programs.

As with the proposed rules, the OIG and CMS insist that limiting the exceptions to the provision of "necessary" technology is critical to minimizing prohibited referrals and remuneration. According to the OIG and CMS, "necessary" items and services includes software, hardware, internet connectivity, training, information technology support services, and subsequent upgrades that are not technically or functionally equivalent to E-prescribing technology the receiving physician or provider already possesses. For example, a hospital could provide a physician with a hand-held device for E-prescribing, despite the fact that the provider may have a desktop computer which performs the same function. However, the OIG and CMS state that the provision of a second hand-held device to the same prescribing provider will not qualify under the Stark exception or safe harbor because it would not be "necessary" to facilitate increased E-prescribing.

One significant change from the proposed rule is that recipients of E-prescribing technology will not have to certify that received items and services are not technically or functionally equivalent to those the recipient has already obtained. In the proposed rules, the OIG and CMS asserted that recipient certification would be required to ensure that provided items and services were "necessary," and not a disguised payment or inducement for recipients to refer reimbursable business to donors. As a number of commenters pointed out, however, the certification requirement might deter a recipient without the necessary technological expertise and/or cause a recipient to incur additional costs in hiring technology consultants to make such determinations. CMS and the OIG agreed with these commenters and, consequently, have not implemented the certification requirement on grounds that it would be unnecessarily burdensome for recipients.

Nonetheless, the final E-prescribing protections will only apply if the donor of protected items and services "does not have actual knowledge of, and does not act in reckless disregard or deliberate ignorance of, the fact that the recipient possesses or has obtained items of services equivalent to those provided by the donor."¹¹ Accordingly, the donor will bear the burden of ensuring that donated Eprescribing technology is "necessary," i.e., not duplicative of the recipient’s existing items and services. To that end, CMS and the OIG recommend that prudent donors may want to make reasonable inquiries of potential recipients and document such communications.

In the preamble to the proposed rules, the OIG and CMS also worried that prospective recipients might intentionally divest themselves of their existing E-prescribing technology in order to shift the cost of new technologies to donors. Accordingly, the agencies solicited comments from the public on how this possibility might be prevented or mitigated under the final rules. However, neither CMS nor the OIG have taken any further action with respect to this concern in the final Stark exception and safe harbor.

The MMA also requires that protected E-prescription technology must be "used solely" for the transmission or receipt of E-prescribing data. The final regulatory language for the E-prescribing antikickback safe harbor and Stark exception similarly include the "used solely" requirement. The OIG and CMS explain that this requirement is necessary to safeguard against abusive arrangements in which technology might constitute a payment for referrals because it provides additional uses and benefits beyond just E-prescribing. For example, a computer or software provided to a physician might provide valuable general office management, billing, and scheduling functions in addition to E-prescribing. The furnishing of any such additional benefit might result in a violation of the anti-kickback statute or the Stark law, particularly if the recipient does not pay fair market value for the additional functions provided by the items and services ostensibly donated for E-prescribing purposes.

In the proposed rule, the OIG and CMS indicated their cognizance that many practitioners may prefer to use a single multi-functional system rather than maintain multiple single-use devices or software packages. Accordingly, the OIG and CMS proposed the creation of a separate safe harbor and corresponding Stark exception to protect the provision of hardware and connectivity services which are multi-functional, so long as a substantial use of such items and services is to transmit and receive E-prescribing data. However, the agencies have abandoned the development of an additional multifunction safe harbor and Stark exception at this time and such technology will not be protected under the final E-prescribing rules.

Consequently, any donated "hardware, software, and information technology services and training" must be used solely for E-prescribing functions in order to qualify for protection under the final E-prescribing safe harbor and Stark exception.¹² The agencies indicate that protected technology could include licenses, upgrades, necessary operating software, and patches designed to link the donor’s existing E-prescribing system to the recipient’s existing systems. However, billing, scheduling, administrative, general office software, and/or technology for personal, non-medical purposes will not be protected; the provision of office staff will also not be covered. Nonetheless, CMS and the OIG indicate that the expanded EHR final rules may protect certain arrangements wherein multi-functional software is donated to qualifying recipients.¹³

The MMA sets out three categories of donors and recipients entitled to protection under the safe harbor and Stark exception for providing E-prescribing technology. In turn, both the OIG and CMS proposed rules that mirrored the provisions of the MMA, except that, because the Stark law applies only to physicians, CMS necessarily limited its proposed regulation to technology given to physicians. In the final E-prescribing rules, these lists of protected donors and recipients remain unchanged, despite a number of public comments requesting that the categories be expanded to include a variety of providers, practitioners, suppliers, and their affiliates. As asserted by CMS and the OIG, the rules need not protect additional donors and recipients because the following enumerated categories "reflect individuals and entities centrally involved in the ordering, processing, filing, or reimbursing of prescriptions." 71 Fed. Reg. at 45117, 45147.

The final rules will protect donations of qualifying E-prescribing technology provided by a hospital to physicians on its medical staff. CMS and the OIG state that E-prescribing technology may not be used to induce physicians practicing at a different hospital to join the staff of the donor hospital, however. In the proposed rule, the agencies also indicated that only those physicians who routinely furnish services at the hospital may be given such technology under the medical staff Stark exception and corresponding safe harbor; however, CMS and the OIG are silent with respect to this requirement in the final rules. As indicated above, the OIG and CMS initially solicited comments on whether the provision of E-prescribing technology to other practitioners (e.g., other health care prescribing professionals who treat patients at the hospital, such as nurse practitioners) should also be protected. Nevertheless, the agencies have elected not to take a more expansive approach to the final rules and, accordingly, the E-prescribing safe harbor and Stark exception will only protect a hospital’s donation of qualifying technology to members of its medical staff.¹⁴

The final safe harbor and Stark exception will also allow group practices to furnish approved E-prescribing technology to their members who are prescribing practitioners. For the most part, both the proposed safe harbor and Stark exception interpret the terms "group practice" and "members" of a group practice consistent with existing Stark law provisions.¹⁵ However, the final E-prescribing safe harbor will also protect donations by group practices to all prescribing professionals (e.g., nurse practitioners) who are members or employees of the group and who are authorized to prescribe under applicable state licensing laws. The OIG notes that many E-prescribing arrangements between group practices and their members can be structured to fit within existing anti-kickback safe harbors, including the safe harbors for personal services and management contracts or for employee compensation.¹⁶ Similarly, CMS finds that certain E-prescribing arrangements may fit into existing Stark exceptions, such as the in-office ancillary services exception or the employment exception.¹⁷ However, both the OIG and CMS believe that the importance of fostering and facilitating E-prescribing warrants the creation of the new safe harbor and Stark exception to clarify arrangements which are permissible under federal law.

Lastly, the final rules will also protect PDP sponsors and MA organizations that donate E-prescribing items and services to participating pharmacies, participating pharmacists, and "prescribing health care professionals." The OIG defines "prescribing health care professionals" as a physician or other health care professional licensed to prescribe drugs in the state in which the drugs are dispensed. Because the Stark law is limited to physician referrals, CMS’s final Stark exception for donations from PDP sponsors and MA organizations will apply solely to prescribing physician recipients. For purposes of both final rules, the term "PDP sponsor" and "MA organization" are to be interpreted consistent with the Medicare Part D prescription drug benefit regulations.¹⁸

According to the agencies, the purpose behind both the anti-kickback safe harbor and Stark exception is to promote the use of E-prescribing to increase patient safety, reduce costs, and promote overall program efficiency without increasing the risk of fraud and abuse. Therefore, both of the final rules are limited with regard to the type and usefulness of E-prescribing technology that may be provided to certain qualifying providers.

The MMA requires that qualifying E-prescribing technology must be used to transmit and receive E-prescribing information in accordance with standards established by the Secretary for Medicare Part D electronic prescription drug programs.¹⁹ Consequently, both the final anti-kickback safe harbor and Stark exception will require the use of E-prescribing technology as part of, or to access, an electronic prescription drug program that meets applicable standards at the time the technology is donated.²⁰ Presently, the applicable technical standards are the Secretary’s "foundation standards," set forth at 42 C.F.R. § 423.160(b).²¹ These standards were developed by CMS in consultation with the National Committee on Vital and Health Statistics ("NCVHS") and are intended to establish an initial "foundation" of technical standards upon which additional standards and requirements will be developed. The final rules also specifically prohibit donors from taking any action to limit or restrict the use or compatibility of donated E- prescribing items and services with other E-prescribing or EHR systems.²²

Another major change from the proposed rules is that the final safe harbor and Stark exception do not impose a maximum cap on the aggregate fair market value of all items and services provided to a prescribing health professional by a single donor entity. In the proposed rules, the OIG and CMS considered whether to limit the value of E-prescribing technology that could be donated under one or both rules and whether such a cap should relate to both E-prescribing and EHR technology donated to a particular recipient. However, many commenters opposed a value cap on donated E-prescribing technology on grounds that valuation would be difficult and that certain providers, particularly rural and/or individual practitioners, might be disadvantaged due to a lack of compatible computer systems with which to integrate the donated technology. CMS and the OIG were persuaded by such considerations and agree that the "necessary" and "used solely" restrictions will be sufficient to safeguard against fraud and abuse. Accordingly, the agencies have elected not to impose a cap on the value of E-prescribing technology that may be donated under the applicable final Stark exception and safe harbor. Furthermore, there is no cost-sharing obligation for recipients of E-prescribing technology, as there is in the final EHR rules.²³

The final E-prescribing rules also contain additional conditions that are designed to reduce the possibility of fraud and abuse and to improve the quality of care for all patients. Many of these same limitations are present in the current anti-kickback safe harbors and Stark exceptions.

First, although the OIG and CMS understand that some donated technology (such as formulary tracking software for MA organizations) may not applicable to all patients, the agencies indicate that any protected technology should, to the extent possible, be used to treat all patients so that the uninsured and non-federal health program beneficiaries also receive the benefits of the technology. Therefore, both final rules contain a requirement that, for E-prescribing items and services that can be used for any patient without regard to the payor status, the donor must "not restrict, or take any action to limit, the recipient’s right or ability to use the items or services for any patient."²⁴

Second, the final rules prohibit potential recipients from making the donation of E-prescribing technology a condition of doing business with the donating entity.²⁵ Both the OIG and CMS view such conditional E-prescribing business as prohibited remuneration because it requires a material benefit to be given to practitioners in exchange for increased referral business to the provider supplying the E-prescribing technology.

Third, both final rules also provide that the eligibility of a prescribing health care professional to receive items and services from a donor entity may not be determined in a manner which takes into account the volume or value of the prescriber’s referrals to the entity or other business between donor and recipient.²⁶ This prohibition does not preclude selection criteria based upon the total number of prescriptions written by the health care professional; after all, those practitioners who have a high volume of prescriptions are the ones best suited to implement E-prescribing technology and to pass on the benefits of the technology to their patients. Nevertheless, an entity which dispenses prescriptions may not select recipients based on the volume of prescriptions that are transmitted to that entity.

Finally, the final E-prescribing rules will require any arrangement for the provision of qualified technology or services to be in writing, to be signed by the parties, to specifically identify the technology provided, and include the donor’s costs in providing such technology.²⁷ The OIG and CMS also initially proposed that any written arrangement between the parties must be amended to reflect any subsequent donation of E-prescribing technology and that new agreements must contain the description and value of items and services that have previously been donated. However, the agencies have relaxed this restriction in response to comments that such requirements would be particularly onerous with regard to system-wide donations and/or in the event that no value cap was adopted. Accordingly, the final E-prescribing rules will deem the documentation requirement satisfied if all separate agreements between the donor (and affiliated parties) and the recipient incorporate each other by reference of if they cross-reference a master list of agreements that is available to the Secretary upon request.

In addition to the final Stark exception and anti-kickback safe harbor for E-prescribing technology, the OIG and CMS also have finalized exemptions for donated software and related training for the transmission, storage, and receipt of EHRs. In many ways, the final exception and safe harbor for EHRs are identical to those proposed for E-prescribing, particularly with respect to the requirement that such technology be "necessary," the selection criteria for recipients, and the absence of a cap on the value of donated technology. However, the EHR final rules are far broader with respect to the categories of protected donors and recipients of EHR technology, permit the donation of multifunctional software and services provided that the predominant use of such technology is for EHR purposes, and are more flexible in allowing the provision of ancillary functionalities. In addition, the final EHR safe harbor and Stark exception both impose a 15 percent cost-sharing requirement on recipients of qualifying technology that is not present in either of the final E-prescribing regulations.

Initially, the OIG and CMS proposed an incremental approach to EHR protections through two distinct sets of EHR Stark exceptions and safe harbors; one set would have operated before the Secretary adopted product certification criteria for EHR technology and the second set would have taken effect after the Secretary established such standards. However, the agencies have abandoned this bifurcated regulatory approach and are instead promulgating a single Stark exception and corresponding antikickback safe harbor for EHR technology, similar to the exceptions for the donation of E-prescribing equipment and related services.

Like the E-prescribing rules, the EHR final rules are limited to furnishing EHR technology in non-monetary form. The award of cash, even if used by the recipient to purchase EHR technology, would not meet the requirements of the rules.

Unlike the E-prescribing final rules, the final EHR rules only protect the provision of software, training, and information technology services (including connectivity services); the final EHR rules will not protect the donation of hardware of any kind. The OIG and CMS posit that the provision of EHR technology poses greater risk of abuse than the provision of limited E-prescribing technology because EHRs are inherently more valuable to health care professionals in terms of actual cost, reduced overhead, and general administrative expenses. On the other hand, the agencies also view the provision of EHR technology as having a more significant impact on the quality of patient care. Although the OIG and CMS solicited and received comments on whether hardware should ultimately be included in the final rule, the agencies have maintained their original approach and will only protect the donation of software, training, and information technology service necessary for EHR purposes.

Based upon comments submitted and input from the information technology industry, the OIG and CMS have finalized a definition of "electronic health record" for purposes of the final rules. Accordingly, an "electronic health record" is defined under each final rule as a "repository of consumer health status information in computer processable form used for clinical diagnosis and treatment for a broad array of clinical conditions."²⁸ This broad definition is intended to encompass a range of health information generated and maintained by providers, insurers, and patients and is consistent with the agencies’ stated goal of encouraging widespread adoption of EHR technology.

Similar to the final E-prescribing rules, the EHR Stark exception and safe harbor only protect the provision of technology software "necessary" to create, maintain, transmit, or receive EHRs. In other words, the final EHR rules will allow donors to provide software, internet connectivity (excluding hardware), training, and information technology support services that are not technically or functionally equivalent to items that the receiving physician or provider already possesses. As with the final Eprescribing rules, the OIG and CMS have abandoned their proposed certification requirement and will not require recipients to certify that donated software and services are not equivalent to EHR technology and training the recipient has already obtained. Nonetheless, donors must not have actual knowledge of, and not act in reckless disregard or deliberate ignorance of, the fact that recipients already possess functionally equivalent EHR systems.²⁹

The EHR final rules differ significantly from the E-prescribing rules with respect to the type and functionality of EHR software, training, and services that may be donated. In particular, EHR technology that is "used predominantly" for EHR purposes will qualify for the Stark exception and antikickback safe harbor, whereas only technology "used solely" for E-prescribing will be protected under the E-prescribing final rules. As CMS and the OIG explain in the preamble to the final rules, the agencies have greater latitude regarding the promulgation of EHR protections because the MMA’s "used solely" requirement is limited to arrangements for the provision of E-prescribing technology. The agencies therefore agreed with commenters that the EHR safe harbor and Stark exception may also protect those elements of an EHR system that incidentally facilitate administrative functions, such as software that links to diagnosis codes for billing purposes.³⁰

Accordingly, the EHR final rules will simply require that "the core functionality of the technology must be the creation, maintenance, transmission, or receipt of individual patients’ [EHRs]."³¹ As such, the final EHR rules will protect the donation of software packages that include other functions, e.g., patient administration, scheduling functions, billing, and clinical support, so long as the EHR function is predominant. Connectivity services and software to facilitate internet access and/or wireless networking will also be protected by the final EHR rule when donated in connection with EHR products; however, networking hardware such as modems and routers will not be protected. Lastly, any EHR software donated under the final rules must include an E-prescribing component that meets the technical standards required by the final Stark exception and anti-kickback safe harbor for E-prescribing.

As discussed above, because the MMA does not address the provision of EHR technology, there are no specific statutory limitations for the provision of EHR software and related services, such as the categories of donors and recipients that may entitled to protection under a safe harbor or Stark exception for EHR arrangements. However, the widespread use and dissemination of EHRs is an enumerated priority of the current administration, CMS, and the health care industry.³² To advance the priority, CMS and the OIG accepted the suggestions of a number of commenters to protect many different types of donors and recipients of EHR technology. Consequently, the final EHR Stark exception and corresponding safe harbor will each protect a wide range of donors, and in the case of the safe harbor, a wide range of recipients (because the Stark law applies only to physicians, CMS has necessarily limited its regulation to technology given to physicians).

Under the proposed EHR safe harbor, the OIG stated that protection would be offered only to the categories of donors and recipients protected under the E-prescribing safe harbor, i.e., hospitals and their medical staff, group practices and their members, and MA organizations and PDPs donating to pharmacies and prescribing professionals. However, a number of commenters argued that these proposed categories were too narrow, particularly because there are many other providers, suppliers, and ancillary providers that have a substantial and central stake in patients’ EHRs. Other commenters advocated that health plans other than PDPs and MA organizations should be allowed to donate EHR technology under the safe harbor for the same reasons. Consequently, the OIG has elected to protect a broad range of donors in the final EHR safe harbor.

a. Protected donors

First, the safe harbor will protect any "individual or entity that provides services covered by a Federal health care program and submits claims or requests for payment, either directly or through reassignment, to the Federal health care program."³³ The OIG further explains that hospitals, group practices, physicians, nursing and other care facilities, pharmacies, laboratories, DME suppliers, oncology centers, community health centers, federally qualified health centers ("FQHCs"), and dialysis facilities can qualify as donors under the final safe harbor.

Second, the final safe harbor will also protect "health plans" as donors of EHR technology. The OIG explains that such entities also play an important and central role in the adoption and use of Eprescribing and EHR systems and therefore will be entitled to protection. In order to qualify as a health plan under the EHR safe harbor, an entity must meet the definition of "health plan" set forth in the existing managed care safe harbor, which provides as follows:

Health plan means an entity that furnishes or arranges under agreement with contract health care providers for the furnishing of items or services to enrollees, or furnishes insurance coverage for the provision of such items and services, in exchange for a premium or a fee, where such entity:

1. Operates in accordance with a contract, agreement or statutory demonstration authority approved by CMS or a state health care program;
2. Charges a premium and its premium structure is regulated under a state insurance statute or a state enabling statute governing health maintenance organizations or preferred provider organizations;
3. Is an employer, if the enrollees of the plan are current or retired employees, or is a union welfare fund, if the enrollees of the plan are union members; or
4. Is licensed in the state, is under contract with an employer, union welfare fund, or a company furnishing health insurance coverage as described in conditions (ii) and (iii) of this definition, and is paid a fee for the administration of the plan which reflects the fair market value of those services.³⁴

Accordingly, the OIG’s use of this definition of "health plan" will allow a broad array of entities to donate EHR technology, including organizations such as PDPs, MA organizations, and Medicaid managed care plans, among others.

However, the OIG has declined to include pharmaceutical, device, or DME manufacturers in the list of protected EHR donors because "there is a substantial risk that, in many cases, manufacturers’ primary interest in offering technology to potential referral sources would be to market their products."³⁵ Moreover, the OIG asserts, such entities do not directly furnish items or services to patients or submit claims for those services. Research entities and entities in the research-based biopharmaceutical industry were also excluded for this reason.

b. Protected Recipients

In comparison to the proposed EHR safe harbor, the OIG has simplified and expanded the class of recipients in its final rule. The OIG received a number of comments recommending that recipients not be limited to those established in the MMA with respect to E-prescribing technology, i.e. medical staff, group practice members, or prescribing professionals that receive technology from their network MA organizations or PDPs. Other commenters indicated that the widespread dissemination of EHR technology could not be furthered by limiting the class of recipients under the safe harbor.

Consequently, the final EHR safe harbor will protect any "individual or entity engaged in the delivery of health care" as a qualified recipient of EHR software and related services.³⁶ The OIG further explains that the final rule will permit the donation of protected remuneration to any such individual or entity, without regard to whether the recipient is on a medical staff, is a member of a group practice, or is in the network of a particular health plan. As such, protected recipients will include without limitation group practices, physicians, nurse practitioners, nurses, therapists, audiologists, nursing and other care facilities, pharmacies, laboratories, DME suppliers, community health centers, FQHCs, and other suppliers. In many respects, this list of protected recipients is identical to the categories of donors also protected under the final EHR safe harbor.

CMS initially proposed that the EHR Stark exception would mirror the proposed E-prescribing Stark exception, meaning that the categories of protected donors and recipients would be limited to hospitals and medical staff physicians, group practices and their physician members, and MA organizations and PDPs donating to prescribing physicians. As with the proposed E-prescribing Stark exception, however, many commenters asserted that these categories were too limited because there are many other providers, suppliers, and ancillary providers that have a substantial interest in providing EHR technology to physicians. CMS is in agreement with the majority of commenters and, therefore, has broadly expanded the class of protected donors and recipients in the final EHR Stark exception.

a. Protected donors

The final EHR Stark exception will now protect any "entity" that furnishes DHS, as that term is defined at 42 C.F.R. § 411.351. Essentially, this means that any provider or supplier of the following items or services may donate qualifying EHR technology:

• Clinical laboratory services;
• Physical therapy, occupational therapy, and speech pathology services;
• Radiology and certain other imaging services;
• Radiation therapy services and supplies;
• DME and related supplies;
• Parenteral and enteral nutrients, equipment, and supplies;
• Prosthetics, orthotics, and supplies;
• Home health services;
• Outpatient prescription drugs; and
• Inpatient and outpatient hospital services.³⁷

In addition to this broad array of providers and suppliers, the final EHR Stark exception will also protect as donors those physician group practices, health plans, managed care organizations ("MCOs"), provider-sponsored organizations ("PSOs"), or independent practice associations ("IPAs") that employ suppliers or operate facilities that could accept reassignment of suppliers’ claims for provided DHS.³⁸ This category of protected donors is largely similar to donors protected under the EHR anti-kickback safe harbor. Furthermore, both the EHR safe harbor and Stark exception are significantly more broad than the E-prescribing protections established by the final rules. Consequently, we believe that many arrangements that do not qualify under the final E-prescribing protections – particularly those involving the provision of multi-functional software and services – may well be protected by the final EHR safe harbor and Stark exception.

b. Protected recipients

As with the OIG’s final EHR safe harbor, CMS has simplified the class of recipients in its final EHR regulation. Namely, the final EHR Stark exception will protect the donation of qualifying technology to any physician.³⁹ CMS explains in the preamble that it agrees with the majority of commenters that limiting the class of recipients to hospital medical staff physicians or group practice members would impede the agency’s goal of widespread adoption of EHR technology. Accordingly, CMS will allow entities or individuals that furnish DHS to donate EHR software and related services to any physician, regardless of whether a recipient has an existing relationship with the particular donor. CMS believes that the recipient’s cost-sharing obligation and the requirement that donated technology be "necessary and used predominantly" for EHR purposes will help to mitigate the risk of fraud and abuse in such arrangements.

Like the E-prescribing regulations, the purpose behind both the final EHR anti-kickback safe harbor and Stark exception is to promote the use of EHRs to increase patient safety and promote overall program efficiency without increasing the risk of fraud and abuse. Consequently, both the final EHR rules are limited with regard to the type of EHR technology that may be provided and place restrictions on how donors may select the recipients of such technology.

The OIG and CMS place particular emphasis on the requirement that donated EHR systems be "interoperable" and compatible with the systems of other providers and suppliers, rather than useful solely or primarily to transmit or receive EHR information with the donor. The final EHR Stark exception defines the term "interoperable" to mean:

able to communicate and exchange data accurately, effectively, securely, and consistently with different information technology systems, software applications, and networks, in various settings; and exchange data such that the clinical or operational purpose and meaning of the data are preserved and unaltered.⁴⁰

Despite the absence of a similar definition in the OIG’s final EHR rule, the regulation does require that all technology qualifying under the safe harbor be "interoperable." Accordingly, we believe that the definition of "interoperable" provided in the EHR Stark exception will guide the application of the safe harbor as well.

For purposes of both the safe harbor and Stark exception, donated EHR software will be deemed "interoperable" if a certifying body recognized by the Secretary has certified the software within 12 months prior to the date it is provided to the recipient.⁴¹ Although the final rules do not specify the certifying bodies that are currently recognized by the Secretary, we believe that such information will be provided to donors and recipients through subsequent regulatory guidance issued by CMS and the OIG.

Lastly, the final rules also specifically prohibit donors from taking any action to limit or restrict the use, compatibility, or interoperability of donated EHR software and services with other Eprescribing or EHR systems.⁴² The agencies insist that interoperability will serve as an important safeguard against fraud and abuse because it will reduce the risk that an entity would offer proprietary EHR technology to a physician or other qualified recipient in an attempt to secure the recipient’s referrals to the donor. Interoperable EHR technology would instead permit a professional or entity to exchange valuable and accurate patient EHR information with a wide range of providers, suppliers, and health plans.

Like the final E-prescribing regulations, the final EHR safe harbor and Stark exception do not impose a maximum cap on the aggregate fair market value of all items and services provided to a recipient by a single donor entity. As indicated in the preamble, CMS and the OIG agree with the majority of commenters that each regulation’s requirement that donated technology be "necessary" will sufficiently safeguard against fraud and abuse. Consequently, the agencies have elected not to impose a cap on the value of EHR technology that may be donated under the final EHR Stark exception and safe harbor.

Unlike the final E-prescribing rules, however, the final EHR Stark exception and safe harbor will each impose a 15 percent cost-sharing obligation on recipients of covered EHR technology.⁴³ In particular, a qualifying recipient must pay to the donor 15 percent of the donor’s cost for the technology before the items and services are provided to the recipient. In addition, the donor (or any party related to the donor) is prohibited from financing the recipient’s contribution or loaning funds to the recipient with which to pay the cost-sharing obligation. Moreover, any subsequent items or services provided to the recipient (e.g., software updates or additional training) will be subject to a separate cost-sharing obligation unless such items and services were included in the donor’s initial purchase price. Lastly, any provided "homegrown" products, i.e., those items and services developed by the donor itself, must be valuated using a reasonable and verifiable method for allocating costs such that an excess benefit is not provided to the recipient.

The OIG and CMS state that a cost-sharing obligation is required under the final EHR regulations for two primary reasons. First, the agencies believe that the provision of EHR technology poses greater risk of abuse than the provision of limited E-prescribing technology because EHRs are inherently more valuable to health care professionals in terms of actual cost, reduced overhead, and general administrative expenses. Second, the ability of donors to provide EHR technology that may have other valuable functions (e.g., incidental billing and coding utilities) poses an increased risk of fraud and abuse compared to the donation of E-prescribing technology, which must be "used solely" for E-prescribing. Consequently, the agencies are essentially imposing the EHR cost-sharing obligation as a counterbalance to these perceived risks of fraud and abuse.

The final EHR regulations also contain additional limitations that are present in many of the existing safe harbors and Stark exceptions and which are identical to those included in the final Eprescribing safe harbor and Stark exception. First, the final EHR Stark exception and safe harbor each include a requirement that, where possible, recipients must be able to use the EHR for all patients without regard to payor status.⁴⁴

Second, the final EHR rules prohibit potential recipients from making the donation of qualifying EHR technology a condition of doing business with the donating entity.⁴⁵ Both the OIG and CMS view such conditional arrangements as prohibited remuneration because they require a material benefit to be given to recipients in exchange for increased referral business to the providers or suppliers donating the EHR software and services.

Third, both EHR regulations also provide that the eligibility of a recipient to receive items and services from a donor entity may not be determined in a manner that takes into account the volume or value of the recipient’s referrals to the entity or other business between donor and recipient.⁴⁶ Nonetheless, CMS and the OIG believe that there is a wider range of criteria by which donors might select recipients in the EHR context than in E-prescribing arrangements, e.g., selection criteria based upon the total number of prescriptions written by a potential recipient would not necessarily be informative in selecting EHR recipients. Consequently, the agencies provide that EHR arrangements will be deemed not to violate the referral-based selection prohibition if the determination of a recipient is based on:

• The total number of prescriptions written by the recipient (but not the volume or value of prescriptions dispensed or paid by the donor or billed to a federal health care program);
• The size of the recipient’s medical practice (for example, total patients, total patient encounters, or total relative value units);
• The total number of hours that the recipient practices medicine;
• The recipient’s overall use of automated technology in his or her medical practice (without specific reference to the use of technology in connection with referrals made to the donor);
• Whether the recipient is a member of the donor’s medical staff, if the donor has a formal medical staff;
• The level of uncompensated care provided by the recipient; or
• The determination is made in any reasonable and verifiable manner that does not directly take into account the volume or value of referrals or other business generated between the parties.⁴⁷

As is evident, the final EHR rules contemplate a number of selection criteria that may be appropriately used by donors to select recipients of qualifying EHR software and related services.

Lastly, the final EHR regulations will require any arrangement for the provision of software or services to be in writing, to be signed by the parties, and to specifically identify the technology provided, the donor’s costs in providing such technology, and the amount of the recipient’s contribution.⁴⁸ This documentation requirement will be met under the final EHR safe harbor and Stark exception if all separate agreements between the donor (and affiliated parties) and the recipient incorporate each other by reference or if they cross-reference a master list of relevant agreements between the parties.

The final rules provide the-much anticipated Stark exceptions and corresponding anti-kickback safe harbors for health care entities that seek to engage in arrangements involving the provision of E-prescribing and EHR technology. Pursuant to standards and goals enunciated in the MMA and the Act, the OIG and CMS have created consistent and complementary protections for certain E-prescribing and EHR arrangements.

Both sets of final rules are notable in that there will be no maximum cap on the total value of technology that may be donated under the new safe harbors and Stark exceptions, although the EHR rules will impose cost-sharing obligations on recipients. More significantly, the EHR rules have been finalized such that a wide range of donors and recipients may engage in arrangements for the provision of EHR software and related services; the E-prescribing final rules remain limited to donations by hospitals, group practices, MA organizations, and PDPs. Furthermore, the final EHR rules will permit donors to provide multi-functional software and services as long as the EHR component is predominant, whereas donated E-prescribing technology must be used solely for E-prescribing purposes. Consequently, many arrangements that would not qualify under the final E-prescribing safe harbor and Stark exception may be subject to protection under the final EHR regulations (although the cost-sharing requirement would apply).

This article is presented for informational purposes only and is not intended to constitute legal advice.