ACO rule provides detail but creates regulatory burden for providers

Concern about funding schemes running afoul of fraud, tax laws

The much anticipated proposed rule on accountable care organizations (ACOs) has healthcare providers studying their markets and trying to determine whether this brave new world of managed care will benefit them or just pose more risks than they are willing to take. For risk managers in particular, there are serious concerns about how ACO participation might set up the provider for charges of fraud and abuse.

On March 31, 2011, the Centers for Medicare and Medicaid Services (CMS) published a proposed rule to implement Section 3022 of the Patient Protection and Affordable Care Act (ACA), which requires the secretary of the Department of Health and Human Services (HHS) to establish a Medicare Shared Savings Program (SSP). Under the proposed rule, eligible providers, hospitals, and suppliers that participate in the SSP by creating or joining ACOs can continue to receive traditional Medicare fee-for-service payments under Medicare Parts A and B and be eligible for additional payments based upon specified quality and savings requirements.

On the same day, CMS and the Office of Inspector General (OIG) jointly issued a proposed rule describing the waiver of application of various fraud and abuse laws with respect to ACOs. Also the Federal Trade Commission (FTC) and the Department of Justice (DOJ) jointly issued a proposed policy concerning the application of antitrust laws to ACOs; and the Internal Revenue Service (IRS) issued a notice concerning tax-exempt entity participation in the SSP.

The release of the ACO rules should command the attention of risk managers, says Leilani Kicklighter, RN, ARM, MBA, CPHRM, LHRM, a patient safety and risk management consultant with The Kicklighter Group in Tamarac, FL, and a past president of the American Society for Healthcare Risk Management (ASHRM) in Chicago. Whether the ACO concept brings the promised benefits or not, the change in relationships among the hospital, physician, and other players will open up many risk and compliance concerns, she says. "As risk managers we need to learn all we can about ACOs and watch the new regulations closely so we can be ahead of, or at least at the beginning of, the learning curve," Kicklighter says. "We have to be positioned so that we can assist management in our organizations to address any risk issues that may arise as the ACOs are more broadly implemented and activated."

The nearly 500 pages of proposed rules make it clear that CMS is committed to the ACO concept, despite the mixed record of outcomes from pilot programs around the country, says Anil Kottoor, president of MedHOK Healthcare Policy Practice, a healthcare consulting firm in Tampa, FL. "CMS and HHS have painted a very solid picture of what they want to see in what we consider one of the most far-reaching Medicare reorganizations since managed care was introduced. Agency leadership seems to see ACOs as an alternative to full-fledged managed care, one that can take a huge bite out of existing Medicare costs and future trend if done right," Kottoor says. "CMS also makes it clear that not every organization that fancies itself an ACO will be accepted, a retreat from previous pilot initiatives that almost seemed doomed to failure before they were even launched."

On the equally important tenets of cost-effectiveness and quality, Kottoor says CMS makes clear that enrollment will be through a passive system. Medicare beneficiaries attached to primary care physicians in an ACO will be deemed enrolled after the physician notifies the beneficiary that he/she is a participant and that clinical and other information will be used to help improve care and save dollars. A retrospective look at all beneficiaries' use of services and costs will be taken to arrive at a benchmark and determine whether an ACO has saved Medicare money. "One problem area we immediately see is that a beneficiary can opt out of participation entirely, but also could opt out of just data sharing," Kottoor says. "Since data sharing will be crucial to monitoring costs and quality, we don't see how a partial opt-out makes sense."

Must take downside risk

The new rule proposes two shared-savings models, in part to broaden the universe, but also to show CMS means business, Kottoor says.

In the first, an ACO can elect to take on a smaller share of upside savings but assume no risk until its third year. In the second model, an organization willing to take on upside gains and downside risk can qualify for a higher proportion of shared savings from the start. Medicare will continue to pay individual providers and hospitals as it does under fee-for-service (FFS).

"Given the poor outcomes in the FFS system, CMS is taking a very aggressive approach on quality. Even if an ACO achieves cost savings, over time no payment will be made unless quality metrics are met," Kottoor says.

The rules establish quality performance measures and a methodology for linking quality and financial performance, Kottoor notes. They also require the ACO to have in place procedures and processes to promote evidence-based medicine and beneficiary engagement. "The quality measures outlined are among the most rigorous we have seen, and may end up being judged as more expansive than even the Medicare Advantage Star rating system," Kottoor says.

The quality measures touch upon four main areas: outcomes from the Healthcare Effectiveness Data and Information Set (HEDIS), Consumer Assessment of Healthcare Providers and Systems (CAHPS) satisfaction, clinical/disease management infrastructure, and hospital-based quality interventions and after care. "In this last area, the ACO is held responsible for poor hospital outcomes, so ACOs, physicians, and hospitals will have to work together to monitor hospital stays and aftercare," Kottoor says. "Interestingly, some of these hospital-type measures tie to the other FFS reforms in PPACA that force hospitals to ensure better clinical monitoring and outcomes lest they lose revenue in numerous areas."

There were a few surprises in the rule, says Robert D. Belfort, JD, a partner with the law firm of Manatt in New York City, including the requirement that providers move to a two-sided risk model by the third year. CMS appears to have decided that incorporating a downside risk within the first period was important to changing provider behavior, Belfort says.

"That requires that every organization considering an ACO be prepared to take some downside risk and have the reserves and solvency necessary to sustain potential losses," he says.

Belfort also notes that the rule requires primary care physicians to be exclusive to one ACO. He expects that requirement will be a major driver for quick action by providers. Although some providers will want to wait until the ACO program is further along before jumping in, there is now the risk that waiting will mean there are not enough primary care providers who have not yet committed. "Most providers I've talked to are not jumping for joy with this rule. There are a lot of burdensome requirements, and the quality reporting is very demanding," Belfort says. "There are very demanding rules about governance and representation of all participants, and concern about how to give governance rights to physicians without running afoul of the tax exemption and fraud and abuse laws."

The biggest challenge regarding compliance issues in ACOs involves the funding and investment side, Belfort says. The recently announced waiver covers the shared savings distribution to participating providers, but Belfort says there is no similar waiver for investments made to capitalize the ACO. "The challenge comes when the doctors and the hospital want to go in on this joint venture, but the doctors don't have the capital to match what the hospital can do," Belfort says. "The venture has to be structured in such a way that the government can't come in and say the hospital is essentially subsidizing the doctors in violation of the fraud and abuse laws or the tax exemption laws."

Think now about benefits, risks

Belfort advises providers to waste no time in considering the potential pros and cons of an ACO arrangement, particularly because delaying will create problems with finding primary care providers in some markets.

"There is a need for some strategic planning and financial analysis, which I sense a lot of organizations are not doing right now," he says.

The retroactive attribution and assignment of beneficiaries surprised C. Frederick Geilfuss II, JD, a partner with the law firm of Foley & Lardner in Milwaukee. That change makes it more difficult to maximize care management and the use of protocols, because the patient is free to receive services and get second opinions from non-ACO participants, Geilfuss says. He also was concerned by some of the regulatory risks posed by the rule.

"There are new risks that will arise. There are a variety of provisions where officers of the ACO will have to certify on their performance, and they have to make a request for payment as well," Geilfuss says. "My read would be that the False Claims Act and other compliance provisions would relate to those certifications. You have to be truthful, but mistakes can be made so there would be compliance risks related to all of those certifications."


For more information, contact:

• Robert D. Belfort, JD, Partner, Manatt, New York City. Telephone: (212) 830-7270. E-mail:

• C. Frederick Geilfuss II, JD, Partner, Foley & Lardner, Milwaukee. Telephone: (414) 297-5650. E-mail:

• Leilani Kicklighter, RN, ARM, MBA, CPHRM, LHRM, The Kicklighter Group, Tamarac, FL. Telephone: (954) 294-8821. E-mail:

• Anil Kottoor, President, MedHOK Healthcare Policy Practice, Tampa, FL. Telephone: (888) 963-3465. E-mail: