Blog Post

OIG Releases Final Rule on New and Amended Anti-Kickback Safe Harbors and CMP Exception

The Department of Health and Human Services (HHS) Office of Inspector General (OIG) recently published a final rule to modify and add new safe harbors under the federal Anti-Kickback Statute (AKS) and to codify a new Civil Monetary Penalty law (CMP) exception for beneficiary inducements related to healthcare system improvements. In order for an arrangement to be “protected” under either the AKS or the CMP exceptions, it must meet all the conditions of a safe harbor.

Specifically, the OIG finalized the following additions or amendments to the AKS safe harbors:

Value-Based Agreement Safe Harbors

The OIG finalized three new safe harbors, with no modifications from the proposed rule, related to remuneration exchanged between or among participants in value-based arrangements designed to coordinate and manage patient care, as outlined below:

  1. Care Coordination Arrangements to Improve Quality, Health Outcomes, and Efficiency – This safe harbor allows qualifying value-based enterprise (VBE) participants to provide in-kind remuneration without assuming any risk or assuming less than substantial downside risk. Remuneration exchanged under this type of arrangement must be used predominantly to engage in activities directly connected to the coordination and management of care for patients that do not result in more than incidental benefits to persons outside of the target patient population.
  2. Value-Based Arrangements with Substantial Downside Financial Risk – This safe harbor protects both monetary and in-kind remuneration for care coordination arrangements where the VBE assumes a substantial financial risk for a period of at least one (1) year from a payor for a targeted patient population.
  3. Value-Based Arrangements with Full Financial Risk – This safe harbor protects certain arrangements that involve in-kind and monetary remuneration involving VBEs that assume full financial risk for a period of at least one (1) year from a payor for a target patient population.

For the purposes of these safe harbors, the OIG defines “value-based enterprise” as “two or more VBE participants: (i) collaborating to achieve at least one value-based purpose; (ii) each of which is a party to a value-based arrangement with the other or at least one other VBE participant in the value-based enterprise;(iii) that has an accountable body or person responsible for financial and operational oversight of the value-based enterprise; and (iv) that have a governing document that describe the value-based enterprise and how the VBE participants intend to achieve its value-base purpose(s).” Such purposes include coordinating, managing, and improving the care of a VBE defined target patient population; appropriate cost reductions; or transitioning to healthcare delivery and payment mechanisms based on the quality of care and control of costs of care for a target patient population.

Further, a VBE participant is “an individual or entity that engages in at least one value-based activity as part of a value-based enterprise.” However, the following entities are prohibited from using a value-based safe harbor: pharmaceutical manufacturers, distributors, and wholesalers; pharmacy benefit managers (PBMs); laboratory companies; pharmacies that primarily compound drugs or primarily dispense compounded drugs; manufacturers of devices or medical supplies; entities or individuals that sell or rent durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) (except for a pharmacy or a physician, provider, or other entity that primarily furnishes services); and medical device distributors and wholesalers.

Patient Engagement and Support Safe Harbor

The OIG finalized, with some modification from the proposed rule, a new safe harbor for certain arrangements where VBE participants provide patient engagement tools and supports to specific patients to improve quality, health outcomes, and efficiency. Under the safe harbor, “remuneration” under the AKS would not include in-kind engagement tools or supports directly connected to coordination and management that a VBE participant furnishes to a patient in a target patient population.

Key conditions and safeguards for the safe harbor include the following, among others:

  1. Protected patient engagement tools and supports are limited to in-kind items, goods, or services that have a direct connection to the coordination and management of care and that advance one or more of the following goals: adherence to a treatment regimen, drug regimen, follow-up care plan; prevention or management of disease; or promotion of patient safety;
  2. The VBE participant cannot accept or use funds or free in-kind items or services furnished by any non-VBE participant to finance or facilitate its patient engagement tools or supports;
  3. The aggregate retail value of the patient engagement tools and supports furnished to a patient must not exceed $500 a year;
  4. The remuneration must not include any in-kind item, good, or service used for patient recruitment or marketing to patients; and

The availability of a tool or support cannot be determined in a way that takes into account the patient’s type of insurance coverage.

 CMS-Sponsored Models

The rule finalizes, with modification from the proposed rule, a new safe harbor for certain remuneration provided in connection with a CMS-sponsored model. This new AKS safe harbor would permit remuneration between and among parties to arrangements under a model or other initiative being tested or expanded by CMS’ Innovation Center and the Medicare Shared Savings Program in the form of incentives and supports provided by CMS model participants and their agents.

The OIG finalized the following conditions for protection under the safe harbor:

  1. Participants must determine that the arrangement will advance one or more goals of the CMS- sponsored model;
  2. The exchange of value under the arrangement must not induce parties or other providers to furnish medically unnecessary items or reduce medically necessary items or services to CMS- sponsored model patients;
  3. Remuneration that is explicitly or implicitly offered, paid, solicited, or received in return for, or used to induce or reward any referrals or other business generated outside of the CMS- sponsored model is prohibited;
  4. The arrangement must be in writing;
  5. Materials and records about the arrangement must be made available to the Department of Health and Human Services (HHS) Secretary upon request; and
  6. The arrangements must comply with other programmatic requirements that CMS puts in place in connection with this safe harbor.

 Cybersecurity Technology and Services

The OIG finalized, with some modifications from the proposed rule, a new safe harbor for donations of certain cybersecurity technology and services, with appropriate safeguards. The safe harbor applies to covered technology, which is defined as “any software or other types of information technology.” OIG did not finalize it proposal to exclude hardware from the definition of covered technology, but noted that hardware must be necessary and used predominantly to implement, maintain, or reestablish effective cybersecurity to receive protection under the safe harbor.

A donation of cybersecurity technology is protected under the safe harbor if the following conditions are met:

  1. The donor does not take into account the volume or value of referrals or future referrals between parties;
  2. Neither the recipient nor the recipient’s practice makes the receipt of technology, or the amount or nature of the technology, a condition of doing business with the donor;
  3. The agreement is in writing; and
  4. The cost of the technology or services are not billed to any Federal health care program.

ACO Beneficiary Incentive Programs

The OIG finalized without modification the new safe harbor, which codifies the statutory exception to the definition of “remuneration” related to Accountable Care Organization (ACO) Beneficiary Incentive Programs for the Medicare Shared Savings Program. The Bipartisan Budget Act of 2018 added a section to the Social Security Act that states that, “illegal remuneration [under the Anti-Kickback Statute] does not include . . .an incentive payment made to a Medicare fee-for-service beneficiary by an ACO under an ACO Beneficiary Incentive Program,” specifically when payments are made in accordance with statutory and regulatory requirements.

 Outcomes-Based Payments and Part-Time Arrangements

The OIG finalized, with some modifications from the proposed rule, the existing safe harbor for personal services and management contracts, to add flexibility with respect to outcome-based payments and part-time arrangements. The finalized changes include:

  1. Replacing the requirement that aggregate compensation under these agreements be set in advance with a requirement that the methodology for determining compensation be set in advance;
  2. Eliminating the requirement that the parties set a schedule, length, and exact charge of an agent’s services that are provided periodically, sporadically, or on a part-time basis;
  3. Protecting certain outcome-based payments; and
  4. Requiring that the written agreement for outcome-based payments include, at a minimum, a general description of the services to be performed under the agreement.

EHR Items and Services

The OIG finalized modifications to the existing safe harbor for electronic health record (EHR) items and services. OIG finalized its proposal to eliminate the prohibition on the donation of technology that is equivalent to technology the recipient already possesses. Additionally, OIG eliminated the sunset provision date of December 31, 2021, making the safe harbor permanent. OIG also expanded the scope of protected donors to include certain additional entities, including accountable care organizations. The final rule also maintains the requirement that EHR recipients must pay a contribution of at least 15 percent of the cost of the EHR, but finalized a flexibility eliminating the requirement that the contribution be paid in advance for updates to previously donated EHR software and technology, including replacement software and technology.


The OIG finalized, without modification, the proposed changes to the existing safe harbor for warranties. Specifically, the modification protects warranties applying to a bundle of items or a bundle of one or more items and services, but not warranties applying only to a service. Additionally, the OIG specified that remuneration for any medical, surgical, or hospital expense is capped at the cost of the items and services subject to the warranty. Finally, OIG added a safeguard that precludes warranties from being conditioned on the exclusive use or minimum purchase of one or more items or services, which could lead to steering or anticompetition.

 Local Transportation OIG finalized, with some modifications from the proposed rule, the existing safe harbor for local transportation. OIG finalized expanding the mileage limitation for residents of rural areas to 75 miles. OIG also finalized a policy to set no mileage limitations on transportation furnished to a patient who has been discharged after being admitted as an inpatient, if the transportation is to the patient’s residence or another residence of their choice. The OIG did not expand the safe harbor to include transferring of patients to a non-residence, such as another health care facility. However, the safe harbor is extended to patients who stayed in the hospital for at least 24 hours for observation, even if they were never admitted as an inpatient.

 Amendment to the Beneficiary Inducement provisions of the Civil Monetary Penalties rules.

 Beneficiary Inducement CMP

The OIG also finalized an amendment extending protection under the Beneficiary Inducement CMP to remuneration related to “telehealth technologies,” defined as “hardware, software, and services that support distant or remote communication between the patient and provider, physician, or renal dialysis facility for diagnosis, intervention, or ongoing care management.

The rule will be effective 60 days after it is published in the Federal Register on December 2, 2020. The final rule is available at:

Subscribe to blog