(a) Definitions. For purposes of this section only, the following terms apply to the definition of disclosable event in § 424.502:

(1) “Uncollected debt” only applies to the following:

(i) Medicare, Medicaid, or CHIP overpayments for which CMS or the state has sent notice of the debt to the affiliated provider or supplier.

(ii) Civil money penalties imposed under this title.

(iii) Assessments imposed under this title.

(2) “Revoked,” “Revocation,” “Terminated,” and “Termination” include situations where the affiliated provider or supplier voluntarily terminated its Medicare, Medicaid, or CHIP enrollment to avoid a potential revocation or termination.

(b) General. Upon a CMS request, an initially enrolling or revalidating provider or supplier must disclose any and all affiliations that it or any of its owning or managing employees or organizations (consistent with the terms “owner” and “managing employee” as defined in § 424.502) has or, within the previous 5 years, had with a currently or formerly enrolled Medicare, Medicaid, or CHIP provider or supplier that has a disclosable event (as defined in § 424.502). CMS will request such disclosures when it has determined that the initially enrolling or revalidating provider or supplier may have at least one such affiliation.

(c) Information. The provider or supplier must disclose the following information about each reported affiliation:

(1) General identifying data about the affiliated provider or supplier. This includes the following:

(i) Legal name as reported to the Internal Revenue Service or the Social Security Administration (if the affiliated provider or supplier is an individual).

(ii) “Doing business as” name (if applicable).

(iii) Tax identification number.

(iv) NPI.

(2) Reason for disclosing the affiliated provider or supplier.

(3) Specific data regarding the affiliation relationship, including the following:

(i) Length of the relationship.

(ii) Type of relationship.

(iii) Degree of affiliation.

(4) If the affiliation has ended, the reason for the termination.

(d) Mechanism. The information required to be disclosed under paragraphs (b) and (c) of this section must be furnished to CMS or its contractors via the Form CMS-855 application (paper or the internet-based PECOS enrollment process).

(e) Denial or revocation. The failure of the provider or supplier to fully and completely disclose the information specified in paragraphs (b) and (c) of this section when the provider or supplier knew or should reasonably have known of this information may result in either of the following:

(1) The denial of the provider's or supplier's initial enrollment application under § 424.530(a)(1) and, if applicable, § 424.530(a)(4).

(2) The revocation of the provider's or supplier's Medicare enrollment under § 424.535(a)(1) and, if applicable, § 424.535(a)(4).

(f) Undue risk. Upon receiving the information described in paragraphs (b) and (c) of this section, CMS determines whether any of the disclosed affiliations poses an undue risk of fraud, waste, or abuse by considering the following factors:

(1) The duration of the affiliation.

(2) Whether the affiliation still exists and, if not, how long ago it ended.

(3) The degree and extent of the affiliation.

(4) If applicable, the reason for the termination of the affiliation.

(5) Regarding the affiliated provider's or supplier's disclosable event under paragraph (b) of this section:

(i) The type of disclosable event.

(ii) When the disclosable event occurred or was imposed.

(iii) Whether the affiliation existed when the disclosable event occurred or was imposed.

(iv) If the disclosable event is an uncollected debt:

(A) The amount of the debt.

(B) Whether the affiliated provider or supplier is repaying the debt.

(C) To whom the debt is owed.

(v) If a denial, revocation, termination, exclusion, or payment suspension is involved, the reason for the disclosable event.

(6) Any other evidence that CMS deems relevant to its determination.

(g) Determination of undue risk. A determination by CMS that a particular affiliation poses an undue risk of fraud, waste, or abuse will result in, as applicable, the denial of the provider's or supplier's initial enrollment application under § 424.530(a)(13) or the revocation of the provider's or supplier's Medicare enrollment under § 424.535(a)(19).

(h) Duplicate data. A provider or supplier is not required to report affiliation data in that portion of the Form CMS-855 application that collects affiliation information if the same data is being reported in the “owning or managing control” (or its successor) section of the Form CMS-855 application.

(i) Undisclosed affiliations. CMS may apply § 424.530(a)(13) or § 424.535(a)(19) to situations where a disclosable affiliation (as described in § 424.519(b) and (c)) poses an undue risk of fraud, waste or abuse, but the provider or supplier has not yet reported or is not required at that time to report the affiliation to CMS.

[84 FR 47853, Sept. 10, 2019]