On December 30, 2015, CMS published a final rule entitled: "Medicare Program; Prior Authorization Process for Certain Durable Medical Equipment, Prosthetics, Orthotics, and Supplies [PDF]," implementing Section 1834(a)(15) of the Social Security Act. In this rule CMS announced an expansion of its prior authorization requirements for certain DMEPOS items. To be clear, the new regulations will apply to both DMEPOS suppliers that have and have not been awarded a competitive bidding contract.

In this final rule, CMS focused on DMEPOS items that have been determined to be "frequently subject to unnecessary utilization," defining "unnecessary utilization" as items furnished by suppliers that "do not comply with one or more of Medicare's coverage, coding, and payment rules." To identify the items that were "determined" to not comply with these rules, CMS utilized OIG and GAO reports published since 2007, and the CERT Program's annual reports beginning in 2011. CMS then further narrowed the list to items with an average purchase price of $1,000 or greater or average monthly rental price of $100 or greater, dollar amounts to be adjusted annually. The created "Master List" for 2016 calendar year is included in Table 5 of the final rules. CMS confirmed it would publish an updated Master List of identified items on an annual basis via the Federal Register. Once on the Master List, an item will generally remain on the list for 10 years. An item could be removed in less time if, for example, the cost of the item dropped below the purchase or rental threshold.

Not all items on the Master List will be subject to prior authorization. Rather, a subset of these items, which has yet to be identified, will be the items requiring prior authorization and which will appear on a "Required Prior Authorization List." When the initial Required Prior Authorization List is developed or updated, CMS will provide a 60-day advance notice via publication in the Federal Register before applying the prior authorization policies to a newly identified item. CMS has reserved the authority to further identify items on the subset list that will apply only to a geographic region or regions from those that would apply nationally. CMS noted it "may consider factors such as geographic location, item utilization or cost, system capabilities, administrative burden, emerging trends, vulnerabilities identified in official agency reports, or other data analysis" as the "types of factors CMS may take into consideration to create the Required Prior Authorization List."

Before dispensing an item on the Required Prior Authorization List, the DMEPOS supplier will have to submit patient records to CMS or the identified CMS contractor demonstrating that the coverage, coding, and payment rules have been followed; and, CMS or its contractors will issue a determination if payment should be made or not. If compliance with the rules is confirmed, CMS or its contractors will issue a provisional affirmation and the DMEPOS supplier is then able to submit the claim. Any claim for an item requiring prior authorization for which there is not a provisional affirmation is to be denied. CMS has identified its DMEPOS Prior Authorization Webpage as the location where the Medicare coverage, coding and payment rules will be posted for items requiring prior authorization.

The prior authorization process differs from a prepayment review in two significant ways. First, if the documentation submitted for an item requiring prior authorization does not comply with the coverage, coding and payment rules, the DMEPOS supplier will be provided information to understand why it did not comply and will be provided an unlimited number of opportunities to resubmit the documentation, bearing in mind that each resubmission further delays a beneficiary's access to receive the item. Additionally, the prior authorization is only a provisional decision and the claim could still be denied if there were other technical problems with the claim, such as an incorrect NPI number for the referring provider or the inadvertent submission of a duplicate claim.

CMS will be issuing policy guidance that will address timeframes for CMS or its contractors to render a provisional decision, although noting it may adopt the proposed 10-business day response following receipt of the supplier's initial request or 20 business days follow a resubmitted request. Several commenters to the proposed timeframe requested an expedited review process for beneficiaries who have clinical symptoms that would require a more timely decision, such as those who require respiratory equipment or oxygen due to low oxygen saturation levels or require a negative pressure wound therapy device or pressure reducing support surface for an open wound. CMS intends to take these comments into consideration when issuing the timeframe policy guidance. Additionally, CMS confirmed there will be an expedited review request process if "the standard timeframe for making a prior authorization decision could seriously jeopardize the life or health of the beneficiary," requiring a provisional decision that will not exceed the proposed timeframe of two (2) business days following receipt of the supplier's documentation. Commenters raised concern that a request before a three-day holiday weekend would result in a five-day wait period if the proposed two-business day rule was finalized.

The decision by the CMS or its contractors is not an "initial determination" as that term is defined in the Medicare regulations. That means that if CMS or its contractors determine that the item should not be covered, that decision could not be appealed.

In the first year alone, CMS estimates it will save $10 million. This estimated saving may not be accurate if DMEPOS suppliers have been dispensing medically necessary items but were not complying with the coverage, coding and payment rules. For example, CMS noted that the 2014 CERT program report identified a 53.1% error rate in paying DMEPOS claims, with 92% of the errors attributed to insufficient documentation. Therefore, if DMEPOS suppliers had taken the necessary steps to ensure all required documentation was obtained before submitting the response to a CERT audit, the error rate would have been reduced to single digits. The $10 million estimate likely takes into account a belief that some DMEPOS suppliers simply will not submit sufficient documentation to demonstrate compliance with the rules.

Ober|Kaler's Comments

Any supplier that has undergone a prepayment review process or a post-payment audit understands how critical it is to be able to get appropriate supporting documentation from the referring physician or non-physician practitioner regarding the medical need for the item. Now is the time to not only focus on compliance with the coverage, coding and payment rules, but to provide education to those who refer items that may be subject to prior authorization regarding the documentation needed to support payment for the claim. Additionally, DMEPOS suppliers who receive a request to submit documentation to support claims by the OIG, GAO, or CERT Program should be sure to submit comprehensive documentation to help limit the type of items that would be added to the Master List during an annual update due to the identified payment error rate.