[Federal Register Volume 74, Number 1 (Friday, January 2, 2009)]
[Rules and Regulations]
[Pages 166-200]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E8-30802]



[[Page 165]]

-----------------------------------------------------------------------

Part II





Department of Health and Human Services





-----------------------------------------------------------------------



Centers for Medicare & Medicaid Services



-----------------------------------------------------------------------



42 CFR Part 424



Medicare Program; Surety Bond Requirement for Suppliers of Durable 
Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS); Final 
Rule

Federal Register / Vol. 74, No. 1 / Friday, January 2, 2009 / Rules 
and Regulations

[[Page 166]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 424

[CMS-6006-F]
RIN 0938-AO84


Medicare Program; Surety Bond Requirement for Suppliers of 
Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
(DMEPOS)

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: Consistent with section 4312(a) of the Balanced Budget Act of 
1997 (BBA), this final rule implements section 1834(a)(16) of the 
Social Security Act (the Act) by requiring certain Medicare suppliers 
of durable medical equipment, prosthetics, orthotics and supplies 
(DMEPOS) to furnish CMS with a surety bond.

DATES: Effective Date: These regulations are effective on March 3, 
2009.

FOR FURTHER INFORMATION CONTACT: Frank Whelan, (410) 786-1302.

SUPPLEMENTARY INFORMATION:

I. Background

A. General and Legislative History

    Medicare services are furnished by two types of entities--providers 
and suppliers. At Sec.  400.202, ``provider'' is defined as a hospital, 
a critical access hospital (CAH), a skilled nursing facility, a 
comprehensive outpatient rehabilitation facility, a home health agency 
(HHA), or a hospice that has in effect an agreement to participate in 
Medicare, or a clinic, a rehabilitation agency, or a public health 
agency that has in effect a similar agreement but only to furnish 
outpatient physical therapy or speech pathology services, or a 
community mental health center that has in effect a similar agreement 
but only to furnish partial hospitalization services. The term 
``provider'' is also defined in sections 1861(u) and 1866(e) of the 
Social Security Act (the Act).
    The term ``supplier'' is defined at section 1861(d) of the Act and 
includes an entity that furnishes durable medical equipment, 
prosthetics, orthotics, and suppliers (DMEPOS). Other supplier 
categories may include, for example, physicians, nurse practitioners 
(NPs), and physical therapists. The term ``DMEPOS'' encompasses the 
types of items included in the definition of medical equipment and 
supplies found at section 1834(j)(5) of the Act. As used in this final 
rule, the term ``supplier'' refers only to a supplier of DMEPOS.
    For purposes of the DMEPOS supplier standards, the term ``DMEPOS 
supplier'' is defined in Sec.  424.57(a) as an entity or individual, 
including a physician or Part A provider, that sells or rents Part B 
covered DMEPOS items to Medicare beneficiaries and that meets the 
DMEPOS supplier standards. Those individuals or entities that do not 
furnish DMEPOS items but furnish other types of health care services 
only (for example, physician services or NP services) would not be 
subject to this requirement.

B. Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
(DMEPOS)

1. Durable Medical Equipment
    The term DME is defined at section 1861(n) of the Act. This 
definition, in part, excludes from coverage as DME those items 
furnished in skilled nursing facilities and hospitals (equipment 
furnished in those facilities is paid for as part of their routine or 
ancillary costs). Also, the term ``DME'' is included in the definition 
of ``medical and other health services'' found at section 1861(s)(6) of 
the Act. Furthermore, the term is defined in Sec.  414.202 as equipment 
furnished by a supplier or a HHA that--
    (1) Can withstand repeated use;
    (2) Is primarily and customarily used to serve a medical purpose;
    (3) Generally is not useful to an individual in the absence of an 
illness or injury; and
    (4) Is appropriate for use in the home.

Examples of DMEPOS supplies include items such as blood glucose 
monitors, hospital beds, nebulizers, oxygen delivery systems, and 
wheelchairs.
2. Prosthetic Devices
    Prosthetic devices are included in the definition of ``medical and 
other health services'' under section 1861(s)(8) of the Act. Prosthetic 
devices are defined in this section of the Act as ``devices (other than 
dental) which replace all or part of an internal body organ (including 
colostomy bags and supplies directly related to colostomy care), 
including replacement of such devices, and including one pair of 
conventional eyeglasses or contact lenses furnished subsequent to each 
cataract surgery with insertion of an intraocular lens.'' Other 
examples of prosthetic devices include cardiac pacemakers, cochlear 
implants, electrical continence aids, electrical nerve stimulators, and 
tracheostomy speaking valves. Under section 1834(h)(4)(B) of the Act, 
prosthetic devices do not include parenteral and enteral nutrition 
nutrients and implantable items payable under section 1833(t) of the 
Act.
3. Orthotics and Prosthetics
    Section 1861(s)(9) of the Act provides for the coverage of ``leg, 
arm, back, and neck braces, and artificial legs, arms, and eyes, 
including replacements if required because of a change in the patient's 
physical condition.'' As indicated by section 1834(h)(4)(C) of the Act, 
these items are often referred to as ``orthotics and prosthetics.''
4. Supplies
    Section 1861(s)(5) of the Act includes ``surgical dressings, 
splints, casts, and other devices used for reduction of fractures and 
dislocation'' as one of the ``medical and other health services'' that 
is covered by Medicare. Other items that may be furnished by suppliers 
would include (among others):
     Prescription drugs used in immunosuppressive therapy 
furnished to an individual who receives an organ transplant for which 
payment is made under this title, and that are furnished within a 
certain time period after the date of the transplant procedure as noted 
at section 1861(s)(2)(j) of the Act.
     Extra-depth shoes with inserts or custom molded shoes with 
inserts for an individual with diabetes as listed at section 
1861(s)(12) of the Act.
     Home dialysis supplies and equipment, self-care home 
dialysis support services, and institutional dialysis services and 
supplies included at section 1861(s)(2)(F) of the Act.
     Oral drugs prescribed for use as an anticancer therapeutic 
agent as specified in section 1861(s)(2)(Q) of the Act.
     Self-administered erythropoietin as described in section 
1861(s)(2)(O) of the Act.

C. The January 20, 1998 Proposed Rule

    In the Medicare Program; Additional Supplier Standards proposed 
rule published in the January 20, 1998 Federal Register (63 FR 2926), 
we proposed to reflect the changes made to section 1834 of the Act by 
section 4312(a) of the Balanced Budget Act of 1997 (BBA) (Pub. L. 105-
33). (Section 4312(a) of the BBA amended section 1834(a) of the Act by 
adding paragraph (a)(16)(B), which requires a DME supplier to provide 
us, on a continuing basis, with a surety bond of at least $50,000, as a 
condition of the issuance or renewal of a provider number. Section 
1834(a)(16) of the Act, as amended by section 4312(c) of the BBA, 
further provides that we may also

[[Page 167]]

require a surety bond from some or all providers or suppliers who 
furnish items or services under Medicare Part A or Part B.) In the 
January 20, 1998 proposed rule, we also proposed that for each tax 
identification number (TIN) for which a supplier billing number is 
issued, a DMEPOS supplier must obtain a surety bond in an amount not 
less than $50,000.
    On October 11, 2000, we published a final rule titled, ``Medicare 
Program; Additional Supplier Standards (HCFA-6004-FC)'' in the Federal 
Register (65 FR 60366). However, as we stated in the October 11, 2000 
final rule with comment that we decided not to incorporate the 
provisions related to surety bonds into this final rule with comment, 
but rather issue the surety bond provisions as a proposed rule at a 
future date.
    In 2003, the Congress enacted section 902 of the Medicare 
Prescription Drug, Improvement, and Modernization Act of 2003 (Pub. L. 
108-173) (MMA) which prohibits the Secretary from finalizing a proposed 
rule related to Title 18 that was published more than 3 years earlier 
except under exceptional circumstances. In light of section 902 of MMA 
and our previous decision to issue a proposed rule, we published a 
proposed rule titled, ``Medicare Program; Surety Bond Requirement for 
Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and 
Supplies'' (DMEPOS) (CMS-6006-P) in the Federal Register (72 FR 42001) 
on August 1, 2007.

II. Provisions of the Proposed Regulations

    In the August 1, 2007 Federal Register (72 FR 42001), we proposed 
to implement the statutory surety bond requirement set forth in section 
1834(a)(16)(B) of the Act.
    Given the lapse in time between the statutory effective date (that 
is, section 1834 of the Act was amended by section 4312(a) of the BBA 
enacted on August 5, 1997) and the date of the proposed rule, we 
proposed to adjust the amount of the surety bond from $50,000 in 1997 
by the Consumer Price Index (CPI) resulting in a higher surety bond 
amount. In doing so, we proposed to adjust the initial surety bond 
amount of $50,000 by the CPI and calculated that a $50,000 surety bond 
in 1997 would equate to a surety bond value of $64,907.17 in 2007. 
Further, we rounded the calculated value of $64,907.17 to the nearest 
thousand to derive a surety bond amount of $65,000. We proposed that 
establishing a $65,000 surety bond for DMEPOS suppliers would: (1) 
Limit the Medicare program risk to fraudulent DME suppliers; (2) 
enhance the Medicare enrollment process to help ensure that only 
legitimate DME suppliers are enrolled or are allowed to remain enrolled 
in the Medicare program; (3) ensure that the Medicare program recoups 
erroneous payments that result from fraudulent or abusive billing 
practices by allowing CMS or its designated contractor to seek payments 
from a surety up to the penal sum; and (4) help ensure that Medicare 
beneficiaries receive products and services that are considered 
reasonable and necessary from legitimate DME suppliers.
    In Sec.  424.57(a), we proposed to define the following terms as 
they are used throughout the regulation in the context of the surety 
bond requirements:
     Assessment.
     Authorized Surety.
     Civil money penalty.
     Government-Operated Suppliers.
     National Supplier Clearinghouse (NSC).
     Penal Sum.
     Rider.
     Sufficient evidence.
     Surety bond.
     Unauthorized Surety.
     Unpaid claim.
    Although we proposed to define ``unauthorized surety'', we 
clarified that we did not envision that we would need to declare a 
surety to be unauthorized except on rare occasions. We anticipate that 
virtually every surety would provide us, upon written request, 
information needed to verify the identity of a bondholder, the 
effective date of the bond, and proof that the surety issued the bond 
as represented by the supplier. However, if a surety fails to comply 
with our request for this information, we would consider that surety as 
unauthorized to provide bonds to DMEPOS suppliers seeking enrollment in 
the Medicare program. We believe that without this provision, some 
sureties may not be inclined to provide information we need on a timely 
basis.
    Furthermore, a surety is unauthorized if it had previously failed 
to comply with a reasonable request from us for payment against a bond. 
An example of a reasonable request would be a request in writing, 
signed by an official of CMS or its representatives, or documentation 
about the amount payable by the supplier. This provision would allow us 
to take action to prevent a surety from issuing a bond to a Medicare 
DMEPOS supplier in cases where we have determined that the surety 
failed to meet its obligations to the Medicare program.
    In Sec.  424.57, we proposed to add new (c)(26). Specifically, we 
proposed that--
     Section 424.57(c)(26) would specify the requirements for a 
DMEPOS supplier seeking to become a Medicare-enrolled DMEPOS supplier.
     Section 424.57(c)(26)(i) would clarify the minimum 
requirements for a DMEPOS supplier. We specified that each Medicare-
enrolled DMEPOS supplier must obtain a surety bond for each National 
Provider Identifier (NPI) from an authorized surety. The surety bond or 
government security would have had to be in the amount of $65,000 and 
in the form specified by the Secretary. While we proposed to adjust the 
amount of the surety bond from $50,000 in 1997 by the CPI and calculate 
a higher surety bond amount of $65,000 in 2007, we did not propose to 
adjust the base surety bond amount by the CPI annually thereafter. 
However, we would consider whether any additional adjustments (increase 
or decrease) in the base bond amount are necessary through a future 
rulemaking effort.
     Section 424.57(c)(26)(i)(A) would specify that a DMEPOS 
supplier must submit a surety bond with its initial paper or electronic 
Medicare enrollment application (CMS-855S, OMB Number 0938-0685) or 
with its paper or electronic revalidation or reenrollment application.
     Section 424.57(c)(26)(i)(B) would specify how a change of 
ownership interest affects the DMEPOS supplier.
     Section 424.57(c)(26)(i)(C) would specify that a DMEPOS 
supplier seeking to enroll a new location must obtain a new surety bond 
for this new location since this new location is also required to be 
enumerated with a unique NPI.
     Section 457.57(c)(26)(ii) would establish an exception to 
the bond requirement for a DMEPOS supplier operated by a Federal, 
State, local, or tribal government agency if the DME supplier has 
provided CMS with a comparable surety bond required under State law and 
if the supplier does not have any unpaid claims, civil money penalties 
(CMPs), or assessments. However, a government-operated supplier that 
did not qualify for an exception would have to submit a surety bond. We 
have determined that an exception to the surety bond requirement for 
government-operated suppliers extends only to those suppliers that have 
a good history of paying their Medicare debts. The basis for this 
exception is principally that government-operated suppliers have the 
power to tax; therefore, it is unlikely that these DMEPOS suppliers 
will be

[[Page 168]]

unable to pay their Medicare debts. Thus, government-operated DMEPOS 
suppliers, by their public nature, furnish a comparable or greater 
guarantee of payment than would be afforded us by a surety bond issued 
by a private surety.
    Also, a supplier operating under a contract with a government 
agency but not owned and staffed by the government would not qualify 
for this exception. Our experience with previously published rules 
suggests that a government-operated entity would timely pay their 
Medicare debts (see the HHA surety bond final rule published in the 
Federal Register on January 5, 1998 (63 FR 315); amended by a final 
rule published in the Federal Register on March 4, 1998 (63 FR 10731); 
a final rule published in the Federal Register on June 1, 1998 (63 FR 
29656); and a final rule published in the Federal Register on July 21, 
1998 (63 FR 41171)).
     We solicited comments on whether to establish exceptions 
for certain types of suppliers. Specifically, we solicited the 
following comments:
    + Whether we should consider establishing an exception to the 
surety bond requirement for certain physicians and nonphysician 
practitioners (NPPs), such as those that occasionally furnish DMEPOS 
items for the convenience of their patients. While we sought comments 
about establishing an exception for physicians and NPPs, we were not 
certain about the scope of the exception that should be established for 
physicians and NPPs. As such, we solicited comments on how to identify 
whether a physician or NPP should be given an exception to the surety 
bond requirement. We also solicited comments on any other appropriate 
criteria that we should use when considering the establishment of an 
exception to this requirement for certain physicians and NPPs.
    + Whether we should establish an exception to the surety bond 
requirement for licensed pharmacists who furnish DMEPOS items for the 
convenience of their patients and any other appropriate criteria that 
we should consider in establishing an exception to this requirement for 
licensed pharmacists.
    + Any other appropriate criteria that we should consider in 
establishing an exception to this requirement for these types of 
suppliers.
    + Whether we should establish an exception to the surety bond 
requirement for large, publicly traded chain suppliers of DMEPOS and on 
any appropriate criteria that we should consider in waiving this 
requirement for these types of suppliers.
    + The appropriate criteria that we may use for establishing 
exceptions for other types of DMEPOS suppliers from the requirement to 
purchase a surety bond.
     Section 424.57(c)(26)(iii) would specify the terms of a 
bond submitted by a DMEPOS supplier.
     Section 424.57(c)(26)(iv) would specify additional DMEPOS 
supplier bond requirements and would specify the surety's liability 
under the bond for unpaid claims, CMPs, or assessments that the surety 
is liable to us, up to a total of the full penal amount of the bond. 
Thus, since we proposed that surety bonds be issued in an amount equal 
to $65,000, the surety is liable to us for up to $65,000.
     Section 424.57(c)(26)(v) would specify the requirements to 
cancel a surety bond. Specifically, this section would allow a DMEPOS 
supplier to terminate or cancel a bond upon proper notice to the NSC. 
If another bond is submitted and there is a lapse in bond coverage, 
Medicare would not pay for items or services furnished during the gap 
in coverage, and the DMEPOS supplier would be held liable for the items 
or services (that is, the DMEPOS supplier would not be permitted to 
charge the beneficiary for the items or services). Failure by the 
DMEPOS supplier to submit another bond would result in the revocation 
of the DMEPOS supplier's Medicare billing privileges. The supplier 
would be required to refund the beneficiary any amounts collected for 
services or supplies furnished during the gap in the surety bond 
coverage. Finally, a supplier or surety may not make amendment to a 
conforming bond that will limit the scope or term of the bond in a 
manner resulting in the bond no longer conforming to the provisions of 
this regulation. Any attempt to do so may result in the revocation of 
the DMEPOS supplier's billing privileges and a determination that the 
surety is an unauthorized surety.
     Section 424.57(c)(26)(vi) would specify that the bond must 
provide that actions under the surety bond may be brought by our 
contractors or us.
     Section 424.57(c)(26)(vii) would specify that the surety 
must provide information regarding its physical location including its 
name, street address, city, state, and zip code and, if different, its 
mailing address, including name, post office box, city, state, and zip 
code.
     Section 424.57(c)(26)(viii) would specify the submission 
date and the term of the DMEPOS supplier bond.
     Section 424.57(c)(26)(viii)(A) would specify that each 
enrolled DMEPOS supplier that does not meet the criteria for an 
exception must submit to the NSC an initial surety bond before (60 days 
following the publication date of the final rule).
     Section 424.57(c)(26)(viii)(B) would specify the type of 
bond required to be submitted by a DMEPOS supplier under this subpart 
must be either a continuous bond or an annual bond, with the exception 
of the initial bond which may differ as specified in this section.
     Section 424.57(c)(26)(ix) would specify the loss of a 
DMEPOS supplier exception. A DMEPOS supplier that no longer qualifies 
for an exception as a government-operated DMEPOS supplier must submit a 
surety bond to the NSC within 60 days after it receives notice that it 
no longer meets the criteria for an exception.
     Section 424.57(c)(26)(x) would specify the conditions 
under which a DMEPOS supplier changes a surety.
     Section 424.57(c)(26)(xi) would specify who the parties 
are to the bond.
     Section 424.57(c)(26)(xii) would specify the effect of a 
DMEPOS supplier's failure to obtain and maintain a surety bond.
     Section 424.57(c)(26)(xii)(A) would specify that we may 
revoke the DMEPOS supplier's billing privileges if an enrolled supplier 
fails to obtain, file timely, and maintain a surety bond as specified 
in this subpart and as instructed by us. The revocation is effective 
with the date the bond lapsed, and any payments for items or services 
furnished on or after that date must be repaid to us by the DMEPOS 
supplier.
     Section 424.57(c)(26)(xii)(B) would specify that we refuse 
to issue billing privileges to the DMEPOS supplier if a DMEPOS supplier 
seeking to become an enrolled DMEPOS supplier fails to obtain and file 
timely a surety bond as specified in this subpart and our instructions.
     Section 424.57(c)(26)(xiii) would specify the 
documentation that a DMEPOS supplier must have to be in compliance with 
these requirements and that we may require a supplier to produce 
documentation demonstrating that it has a bond and that it meets the 
requirements of this section.
     Section 424.57(c)(26)(xiv) would specify the effect of 
subsequent DMEPOS supplier payments paid to us. If a surety has paid an 
amount to us on the basis of liability incurred under a bond and we 
subsequently collect from the DMEPOS supplier, in whole or in part, on 
the unpaid claims, CMPs, or assessments that were the basis for the 
surety's liability, we would reimburse

[[Page 169]]

the surety the amount that we collected from the DMEPOS supplier, up to 
the amount paid by the surety to us, provided the surety has no other 
liability to us under the bond.
     Section 424.57(c)(26)(xv) would specify the effect of a 
review reversing an appealed determination. We would refund to the 
DMEPOS supplier the amount that the DMEPOS supplier paid us, to the 
extent that the amount relates to the matter that was successfully 
appealed, provided all review, including judicial review, has been 
completed on the matter.
    In addition, DMEPOS suppliers have the right to appeal any adverse 
decisions with respect to unpaid claims, CMPs or assessments. DMEPOS 
suppliers must use the following applicable appeals provisions 
specified in 42 CFR associated with each adverse determination: Part 
405, subpart I (claims appeals); Part 1003 (civil money penalties); and 
Part 498 (Medicare participation and enrollment).
    We believe that the appeals processes as they apply to DMEPOS 
suppliers and sureties should be addressed through a private contract 
between the parties. Specifically, we believe that sureties should 
consider requiring DMEPOS suppliers to agree to repay the surety any 
payments made by a Medicare contractor resulting from a DMEPOS 
supplier's appeal of any adverse decisions with respect to unpaid 
claims, CMPs, or assessments. Any such contract must be consistent with 
the applicable appeals processes referenced above. In determining 
whether a private contract is necessary, we suggest that the sureties 
and DMEPOS suppliers consider the following types of provisions: 
Appointment of representative, repayment of any bonding amounts paid to 
the DMEPOS supplier that were already paid by the surety and the 
potential cost of pursuing administrative appeals.
    Furthermore, we solicited comments on requiring DMEPOS suppliers to 
obtain a surety bond of more than $65,000 if the DMEPOS supplier poses 
a significantly higher than average risk to the Medicare Trust Funds. 
Specifically, we solicited comments on how to establish elevated 
amounts of surety bonds for higher risk DMEPOS suppliers. We proposed 
to consider the option of establishing elevated amounts of the surety 
bond at a rate of $65,000 per high risk factor. Also, we solicited 
comments on determining the high risk factors that should be used. We 
suggested several potential high risk factors, and solicited comments 
on these factors, as well as suggestions for additional factors.
    We proposed to consider a $65,000 increase in the surety bond 
amount for each occurrence when a DMEPOS supplier has an adverse action 
as specified in section 221(g)(1)(A) of the Health Insurance 
Portability and Accountability Act of 1996 (Pub. L. 104-191) (HIPAA). 
Examples of adverse actions include, but are not limited to, Federal 
and State criminal convictions related to the delivery of a health care 
item or service; formal or official actions, such as the revocation or 
suspension of a license; and exclusion from participation in Federal or 
State health care programs. The following is an example of how high-
risk criteria would be used to increase the bond amount by $65,000 per 
occurrence.
     We proposed, for example, a DMEPOS supplier would be 
required to obtain a surety bond in the amount of $130,000, an increase 
of $65,000 from the base surety bond amount of $65,000, if the DMEPOS 
supplier or any of its owners, authorized officials, or delegated 
officials had their billing privileges revoked within the last 10 
years. If the DMEPOS supplier or any of its owners, authorized 
officials, or delegated officials had more than one revocation in the 
last 10 years, then the amount of the surety bond the DMEPOS supplier 
would be required to obtain would increase $65,000 per occurrence. We 
proposed, for example, that a DMEPOS supplier with three different 
revocations during the preceding 10 years would be required to obtain a 
surety bond in the amount of $260,000; $65,000 for the base surety 
amount and $195,000 (3 x $65,000) for the multiple revocations.
    In addition to the elevated risk-based model described above, we 
solicited comments regarding the establishment of elevated bond amounts 
by classifying DMEPOS suppliers into two or three general categories 
such as--
     New DMEPOS supplier applicants that have no prior billing 
history with the Medicare program that also would be required to secure 
a surety bond;
     Current Medicare enrolled DMEPOS suppliers that do not 
have any prior history of criminal, civil or administrative sanctions 
for billing-related problems; and,
     Current Medicare enrolled DMEPOS supplier with a prior 
``adverse history'' of criminal, civil or administrative sanctions for 
billing-related problems for which the regulation would elevate the 
amount of the required bond by an appropriate amount per prior 
sanction.
    We solicited comments regarding the appropriate elevated amounts of 
the surety bond using this categorical approach.
    We also solicited comments on whether we should establish an 
exception for rural DMEPOS suppliers and the appropriate criteria that 
we should consider in establishing an exception for rural DMEPOS 
suppliers.
    Finally, we solicited comments on the appropriate period of time 
for which a DMEPOS supplier should be required to maintain a higher 
surety bond amount. Given the higher level of risk associated with 
DMEPOS suppliers that have one or more risk factors, we proposed to 
establish a timeframe of 5 years.

III. Analysis of and Responses to Public Comments

    We received approximately 200 timely public comments in response to 
the August 1, 2007 proposed rule. The following is a summary of the 
comments received and our responses.

    (Note: In order to clarify the regulations regarding surety 
bonds, we have made some technical changes to our proposals.)

    Table 1 is provided to assist the reader in cross-referencing the 
proposed provision with its revised section. (For a more detailed 
explanation of the technical changes made to this final rule, please 
see section IV. of this final rule.)

                            Table 1--Redesignations From Proposed Rule to Final Rule
----------------------------------------------------------------------------------------------------------------
         Subject heading                        Proposed rule                            Final rule
----------------------------------------------------------------------------------------------------------------
Definitions......................  Sec.   424.57(a)                        Sec.   424.57(a)
Effective date...................  Sec.   424.57(c)(26)                    Sec.   424.57(d)(1)
Minimum requirements for a DMEPOS  Sec.   424.57(c)(26)(i)                 Sec.   424.57(d)(2)
 supplier.
Exception to the surety bond       Sec.   424.57(c)(26)(ii)                Sec.   424.57(d)(15)
 requirement.
Terms of the surety bond.........  Sec.   424.57(c)(26)(iii)               Sec.   424.57(d)(4)
Specific surety bond requirements  Sec.   424.57(c)(26)(iv)                Sec.   424.57(d)(5)
Cancellation of a bond and lapse   Sec.   424.57(c)(26)(v)                 Sec.   424.57(d)(6)
 of surety bond coverage.

[[Page 170]]

 
Actions under the surety bond....  Sec.   424.57(c)(26)(vi)                Sec.   424.57(d)(7)
Required surety information on     Sec.   424.57(c)(26)(vii)               Sec.   424.57(d)(8)
 the surety bond.
Submission date..................  Sec.   424.57(c)(26)(viii)              Sec.   424.57(d)(1)
Type of bond.....................  Sec.   424.57(c)(26)(viii)              Sec.   424.57(d)(4)
Loss of DMEPOS supplier exception  Sec.   424.57(c)(26)(ix)                Sec.   424.57(d)(15(ii))
Change of surety.................  Sec.   424.57(c)(26)(x)                 Sec.   424.57(d)(9)
Parties to the bond..............  Sec.   424.57(c)(26)(xi)                Sec.   424.57(d)(10)
Effect of DMEPOS supplier's        Sec.   424.57(c)(26)(xii)               Sec.   424.57(d)(11)
 failure to obtain, maintain, and
 timely file a surety bond.
Evidence of DMEPOS supplier's      Sec.   424.57(c)(26)(xiii)              Sec.   424.57(d)(12)
 compliance.
Effect of subsequent DMEPOS        Sec.   424.57(c)(26)(xiv)               Sec.   424.57(d)(13)
 supplier payment.
Effect of review reversing         Sec.   424.57(c)(26)(xv)                Sec.   424.57(d)(14)
 determination.
----------------------------------------------------------------------------------------------------------------

A. General Comments

    Comment: Numerous commenters opposed the surety bond requirement. 
Commenters stated that the surety bond requirement would create an 
additional and unnecessary burden on DMEPOS suppliers. Commenters 
indicated that DMEPOS suppliers have already been burdened with, among 
other things, continued reductions in Medicare reimbursement, 
competitive bidding, and accreditation. In addition, commenters stated 
that there is no need to impose the surety bond requirement on DMEPOS 
suppliers since these suppliers represent a small fraction of Medicare 
spending.
    Response: We recognize that we have recently implemented a number 
of program integrity measures designed to strengthen the enrollment 
process and improve quality of products and services. As the commenter 
notes, one such initiative is accreditation. Section 302 of the MMA 
added section 1834(a)(20) to the Act, which mandates the establishment 
and implementation of quality standards for DMEPOS suppliers. All 
suppliers that furnish such items or services under section 
1834(a)(20)(D) of the Act, as the Secretary determines appropriate, 
must comply with the quality standards in order to obtain and maintain 
Medicare billing privileges. The Medicare Improvements for Patients and 
Providers Act of 2008 (Pub. L. 110-275) (MIPPA) required all DMEPOS 
suppliers to meet quality standards for Medicare accreditation by 
October 1, 2009. In addition, section 154 of the MIPPA stated that 
certain professionals and persons do not have to meet this deadline 
unless quality standards are developed specific to these professionals 
and persons. Section 154(b) of the MIPPA, added a new subparagraph (F) 
to section 1834(a)(20) of the Act. This subparagraph states that 
eligible professionals and other persons are exempt from meeting the 
October 1, 2009 accreditation deadline unless CMS determines that the 
quality standards are specifically designed to apply to such 
professionals and persons. Eligible professionals under section 
1834(a)(20)(F) of the Act include physicians (as defined in section 
1861(r) of the Act), physical therapists, occupational therapists, 
qualified speech-language pathologists, physician assistants, nurse 
practitioners, clinical nurse specialists, certified registered nurse 
anesthetists, certified nurse-midwives, clinical social workers, 
clinical psychologists, registered dietitians, and nutritional 
professionals. We have designated certain individuals as falling within 
the category of ``other persons'' under the statute; these individuals 
include orthotists, prosthetists, opticians, and audiologists. We will 
work in collaboration with the medical and professional groups to 
develop specific quality standards.
    We believe that the accreditation process will assure that Medicare 
beneficiaries receive quality supplies and services from eligible 
suppliers.
    Nevertheless, we do not believe that the implementation of 
accreditation and other program integrity initiatives obviates the need 
to establish a surety bond requirement for DMEPOS suppliers, something 
that will help ensure that DMEPOS suppliers meet minimum financial 
requirements in order to participate in Medicare.
    Comment: Many commenters stated that a surety bond would offer 
little or no additional protection to CMS since the accreditation 
process for DMEPOS suppliers is already providing a greater level of 
security. The commenters indicated that the quality standards in the 
accreditation process include stringent provisions that limit the risk 
of Medicare fraud. As a result, some of the commenters described the 
surety bond requirement as redundant, duplicative, unnecessary, costly, 
and extreme. Another commenter stated that it believes its licensure 
and certification status as a hand therapist and our accreditation 
process are sufficient evidence of both its competence and ethical 
behavior. Yet another commenter stated that both initiatives should be 
analyzed, coordinated, and reconciled before implementation.
    Response: We disagree with the commenters that a surety bond would 
offer little or no protection because we are in the process of 
implementing the accreditation requirements for DMEPOS suppliers. As 
already indicated, while accreditation will ensure that a DMEPOS 
supplier meets certain quality standards, a surety bond will ensure 
that DMEPOS suppliers that do not qualify for an exception to the 
bonding requirement meet enhanced financial requirements. Moreover, 
only surety bonds can be used to repay any incurred overpayments. We 
believe that these efforts, when combined, will have a significant 
impact on both the quality of products and services provided to 
Medicare beneficiaries, but also increase our efforts to ensure that 
only qualified suppliers are eligible to enroll or remain enrolled in 
the Medicare program.
    We understand that many DMEPOS suppliers are concerned with the 
cumulative effect that several different statutory changes will have on 
suppliers of DMEPOS. We have taken this effect into consideration, and 
the revised impact analysis contained in this final rule accounts for 
the cumulative impact.
    Comment: A commenter stated that it is a waste of American 
citizens' money to require DMEPOS suppliers that bill $25,000 a year or 
less to obtain surety bonds.
    Response: We disagree with the commenter. The surety bond for 
DMEPOS suppliers is designed to reduce the amount of money that is lost 
due to fraudulent or abusive billing schemes perpetrated by individuals 
and organizations. In addition, we do not believe that prior billing is 
necessarily proof of future actions.
    Comment: One commenter believes that the surety bond requirement 
will not substantively strengthen program

[[Page 171]]

integrity. The commenter stated that, although requiring suppliers to 
obtain a surety bond as a condition of Medicare enrollment may deter 
some of the more simplistic criminal fraud schemes, it is unrealistic 
for CMS to expect that the requirement will eliminate the most 
insidious type of fraudulent supplier, which is the DMEPOS supplier 
that initially appears to meet the minimum indicia of a legitimate 
business. The commenter stated that this is the type of criminal 
element that has consistently evaded our oversight and enforcement 
initiatives. Other commenters stated that the surety bond requirement 
is only a repayment mechanism for the Medicare program and not a true 
deterrent to criminal or abusive billing practices. The commenters also 
stated that anyone with a criminal intent, and the means to effectuate 
it, can bill and get paid for fraudulent claims before we have 
identified the fraud.
    Response: We believe that the surety bond requirement is an 
important tool that, when used in conjunction with other efforts to 
reduce fraudulent or abusive behavior, will assist us in protecting the 
Medicare Trust Funds. While we recognize that implementing a surety 
bond requirement for certain DMEPOS suppliers will not deter all types 
of fraud and abuse perpetrated by individuals and organizations intent 
on committing such actions, we believe that this statutorily mandated 
requirement will greatly assist us in our efforts to reduce fraud and 
abuse by some suppliers of DMEPOS and to identify more sophisticated 
instances of fraudulent behavior.
    Comment: One commenter stated that if fraud is located primarily in 
urban areas, such as Miami, Florida, and involves DMEPOS suppliers that 
conduct a large volume of business, then the August 1, 2007 proposed 
rule is misdirected because it penalizes suppliers that conduct a small 
volume of business in other parts of the country, such as the Midwest.
    Response: We understand the concerns of the commenter, but we also 
recognize that fraudulent schemes are portable and can be perpetuated 
in any part of the country, not just urban areas. The surety bond 
requirement will help to ensure that certain newly enrolling DMEPOS 
suppliers meet financial solvency standards, as well as our established 
conditions for enrollment and payment.
    Comment: One commenter stated that we should not impose additional 
costs through the surety bond requirement but should instead focus our 
resources on those suppliers it can readily find committing Medicare 
fraud and abuse.
    Response: We are expanding our effort to identify, detect, and 
revoke the billing privileges of those DMEPOS suppliers who fail to 
meet the supplier standards found at Sec.  424.57. By establishing a 
surety bond requirement for newly enrolling DMEPOS suppliers as well as 
existing DMEPOS suppliers, we believe that we will improve the quality 
of services received by Medicare beneficiaries, as well as establish 
additional program safeguards for the Medicare program.

B. Legislative Authority

    Comment: One commenter stated that we have no legislative authority 
to implement the surety bond requirement. The commenter noted that 
section 902 of the MMA prohibits the Secretary from finalizing a 
proposed rule related to Title 18 that was published more than 3 years 
earlier except under exceptional circumstances. The commenter indicated 
that we did not finalize the January 20, 1998 proposed rule within the 
prescribed timeframe. As a result, the commenter believes that we have 
no specific statutory authority to implement the surety bond 
requirement.
    Response: While the commenter is correct that we did not finalize 
the January 20, 1998 proposed rule in the allotted amount of time as 
required by section 902 of the MMA, we did repropose the surety bond 
provisions in the August 1, 2007 proposed rule and have 3 years from 
that date to finalize the regulation as required by the MMA. Therefore, 
we believe that we are within our statutory authority for finalizing 
this rule.
    Comment: Some commenters questioned the need for the surety bond 
requirement by noting that the surety bond requirement specified in the 
BBA of 1997 reflected a different era when there were fewer 
requirements to become a DMEPOS supplier. For example, one commenter 
observed that DMEPOS suppliers are now required to become accredited, 
and most are about to be subject to additional scrutiny and cost 
controls via the DMEPOS competitive bidding program. Another commenter 
stated that the NSC did not routinely perform onsite inspections before 
issuing billing numbers. Commenters stated the NSC is now required to 
perform an onsite inspection for every DMEPOS supplier that seeks to 
obtain a Medicare billing number.
    Response: While these commenters are correct in that we have 
implemented significant programmatic changes--such as the routine 
performance of onsite visits--we note that the problems that led to the 
enactment of section 4312 of the BBA are still prevalent in the DMEPOS 
industry now. Indeed, the Office of Inspector General (OIG) continues 
to identify questionable conduct in the DMEPOS arena, as reflected in 
its recent report entitled, ``Los Angeles County Suppliers' Compliance 
with Medicare Standards: Results from Unannounced Visits; OEI-09-07-
00550.''
    We further note that on July 15, 2008, the Congress enacted the 
MIPPA which delayed the implementation of the DMEPOS Competitive 
Bidding Program. This, in our view, enhances the importance of the 
implementation of the surety bond requirement; with the delay in 
competitive bidding, we need to utilize the remaining tools at our 
disposal to prevent fraudulent activity in the DMEPOS arena. The onsite 
audits of every DMEPOS supplier serves as an important tool in ensuring 
that the NSC grants billing privileges to legitimate suppliers.

C. Bond Amount

    Comment: Several commenters disagreed with our proposal to increase 
the amount of the surety bond from $50,000 to $65,000 based on the 
Consumer Price Index (CPI). One commenter stated that the proposal is 
flawed because it is not based on risk to the Medicare program or 
Medicare reimbursement levels, and that the amount should be adjusted 
downward to reflect reduced Medicare reimbursement to DMEPOS suppliers 
(that is, commenters noted that Medicare reimbursement to many DMEPOS 
suppliers has decreased, remained the same, or only minimally increased 
since 1997.) In addition, several commenters believe that we should 
assess whether our proposal to increase the surety bond amount, which 
would raise the annual cost of the surety bond requirement from $150 
million to approximately $198 million, would have any appreciable 
increase in benefit. Other commenters stated that nothing in the surety 
bond requirement set forth in section 1834(a)(16)(B) of the Act or its 
history indicates that Congress ever contemplated inflation 
adjustments, or that the surety bond amount should be higher than 
$50,000.
    Response: We disagree with these comments for the following 
reasons. First, section 4312(a)(16)(B) of the BBA states that the bond 
amount must be ``in an amount that is not less than $50,000.'' The 
phrase ``not less than'' makes it clear that we have the authority to 
impose a bond amount higher than $50,000. Second, nowhere in the 
statute or the legislative history did the Congress indicate that the 
bond amount should be tied to the reimbursement

[[Page 172]]

levels of the provider or supplier type in question. To the contrary, 
we believe that the Congress intended for the key factor in determining 
the bond amount to be the risk of fraudulent activity posed by that 
class of provider or supplier.
    Having said this, we nevertheless have elected to reduce the base 
surety bond amount from $65,000 to $50,000 for two reasons. First, we 
wish to preclude an additional regulatory impact associated with 
implementing section 4312(a) of the BBA. This is especially true with 
respect to small, rural DMEPOS suppliers, as discussed in section G of 
the Regulatory Impact Analysis. Second, we believe that $50,000 is an 
appropriate starting point for the bond requirement. Using the 
statutory minimum amount will, in our view, allow us to better gauge 
whether a higher surety bond amount is needed to protect the Medicare 
Trust Funds.
    However, we are establishing a surety bond amount higher than 
$50,000 for those DMEPOS suppliers that pose a significantly higher 
risk to the Medicare program. In addition, we will evaluate the impact 
of this $50,000 surety bond amount requirement for certain DMEPOS 
suppliers before considering any increase in the base surety bond 
amount.
    Comment: Commenters stated there was no need to impose a tiered 
approach to determine what bond amount to impose on a DMEPOS supplier 
based on past conduct. For established DMEPOS suppliers, commenters 
believed that CMS and the OIG have significant administrative remedies 
to address misconduct, including excluding the supplier from the 
Medicare program. Commenters maintained that we should limit the bond 
requirement to new suppliers, which is consistent with the Congress' 
original intent under the BBA.
    Response: We do not agree with the commenters that there is no need 
to establish elevated surety bond amounts for DMEPOS suppliers that 
pose additional risk to the Medicare program, nor do we agree with the 
commenters' statement that the Congress intended to limit the surety 
bond requirement to only new DMEPOS suppliers. As for the former 
comment, we believe that elevated bond amounts are necessary to protect 
the Medicare Trust Fund and Medicare beneficiaries. Furthermore, we 
note that section 4312(a) of the BBA expressly states that ``the 
Secretary shall not provide for the issuance (or renewal) of a provider 
number * * *'' unless the supplier furnishes a surety bond of not less 
than $50,000. (Emphasis added.) Use of the term ``renewal'' evidences a 
congressional intention to apply the surety bond requirement to those 
DMEPOS suppliers already in the Medicare program.
    It is true that CMS and the OIG have various administrative 
remedies to address fraudulent or abusive conduct by DMEPOS suppliers 
after they have enrolled to participate in Medicare; however, we 
believe that the Congress intended to require that suppliers of DMEPOS 
meet financial solvency requirements and to ensure that Medicare could 
recoup some, if not all, of the improper payments made to suppliers of 
DMEPOS.
    Comment: One commenter stated that the preamble to the August 1, 
2007 proposed rule factually ``misdescribes'' the January 20, 1998 
proposed rule. The commenter indicated that the January 20, 1998 
proposed rule did not propose a $65,000 surety bond level, but instead 
proposed a sliding scale approach starting at $50,000 and rising to 15 
percent of reimbursement.
    Response: We agree that the January 20, 1998 proposed rule included 
a minimum $50,000 surety bond amount. We note that the $65,000 figure 
in the August 1, 2007 proposed rule has been reduced in this final rule 
to $50,000, except in the case of high-risk suppliers. We consider any 
DMEPOS supplier with at least one adverse legal action within the 10 
years preceding enrollment, revalidation, or reenrollment to be a 
``high-risk'' supplier.
    Comment: Several commenters maintained that we should have sought 
public comment on the reasonableness of increasing the surety bond 
amount from $50,000 to $65,000. The commenters stated that this change 
represents an increase of 25 percent over the original $50,000 surety 
bond requirement proposed in the January 20, 1998 proposed rule.
    Response: In the August 1, 2007 proposed rule, we solicited public 
comments on the amount of the surety bond for DMEPOS suppliers and, as 
already noted, we have chosen to reduce the minimum surety bond amount 
to $50,000.
    Comment: One commenter stated that, although we justified our 
proposal to increase the amount of the surety bond from $50,000 to 
$65,000 based on the CPI, expecting a DMEPOS supplier to obtain a 
surety bond that far exceeds the value of the supplier's annual claims 
seems unreasonable.
    Response: As already discussed, neither section 4312(a) of the BBA 
nor its legislative history indicate that the Congress intended for the 
bond amount to be tied to the level of reimbursement a supplier 
receives from the Medicare program. The regulatory impact section of 
the proposed rule (72 FR 42008) stated that, ``We estimate that as many 
as 15,000 DMEPOS suppliers, or 23 percent of the 65,984 entities and 15 
percent (or 17,471) of the 116,471 individual suppliers currently 
enrolled in Medicare could decide to cease providing items to Medicare 
beneficiaries if this proposed rule is implemented.'' While we are 
reducing the amount of the surety bond from $65,000 to $50,000, the 
lowest amount allowable under section 4312(a)(16)(B) of the BBA, and 
limiting its impact to certain DMEPOS suppliers, we understand that the 
implementation of this rule will require some DMEPOS suppliers to 
reconsider their participation in the Medicare program because of the 
added cost of the bond.
    Comment: A commenter stated that the surety bond requirement may 
increase costs for small DMEPOS suppliers and reduce costs for large 
DMEPOS suppliers. The commenter stated that the January 20, 1998 
proposed rule provided for a sliding scale approach to the bond 
requirement for DMEPOS suppliers in that the surety bond started at 
$50,000 and rose to 15 percent of Medicare reimbursement (capped at $3 
million). Many commenters stated that a tiered system would be more 
equitable.
    Response: We do not believe that establishing a sliding scale 
approach is appropriate because of the operational complexity 
associated with establishing and maintaining this approach. Moreover, 
it is important to note that 4312(a) of the BBA requires that we 
establish a surety bond in an amount of not less than $50,000. 
Accordingly, by statute, the lowest amount that we can establish for a 
DMEPOS surety bond is $50,000, and based on the public concerns about 
higher bond amounts, we have decided to implement higher surety bond 
amounts only for those individuals or organizations that pose a higher 
risk to the Medicare program.
    Comment: A commenter stated that the financial soundness of DMEPOS 
suppliers will be a factor in the price of surety bonds. The commenter 
maintained that the financial soundness of a DMEPOS may result in 
DMEPOS suppliers not being able to obtain surety bonds. The commenter 
stated that this is one reason for keeping the amount of the surety 
bond low and for allowing sufficient time for a competitive market to 
be formed for surety bonds.
    Response: We agree that financial soundness will be a key 
determinant in whether a DMEPOS supplier will be able to secure a 
surety bond and the

[[Page 173]]

amount that the DMEPOS supplier will have to pay for the bond. To 
reduce cost associated with obtaining a bond, we have reduced the 
amount of surety bond from $65,000 bond to $50,000. In addition, we 
have delayed the implementation of this regulation.
    Comment: One commenter maintained that we did not adequately 
outline the rationale for adjusting the amount of the surety bond in 
the August 1, 2007 proposed rule. The commenter noted that the 
inflation adjusted bond will be 25 percent higher than the $50,000 bond 
originally contemplated by the Congress. The commenter stated that, 
since it appears that our only rationale for increasing the bond amount 
is based on the passage of time, imposing this additional financial and 
administrative burden on suppliers is arbitrary.
    Response: We note that this final rule has been revised to reduce 
the proposed $65,000 surety bond amount to $50,000, the minimum 
allowable under the statute.
    Comment: One commenter stated that the proposed surety bond amount 
of $65,000 is realistic, and that establishing a bond requirement for 
the majority of DMEPOS suppliers is consistent with standard 
suretyship.
    Response: We appreciate this comment. However, this final rule has 
been revised to require a $50,000 surety bond (the minimum allowable 
under the statute) for certain DMEPOS suppliers.

D. Timeframe for Implementation

    Comment: Several commenters requested that we give DMEPOS suppliers 
at least 120 days to comply with this final rule instead of 60 days 
following publication of this rule.
    Response: We agree with the commenters and have revised Sec.  
424.57(d)(1) (proposed Sec.  424.57(c)(26)) to require existing 
suppliers (that is, DMEPOS suppliers already enrolled in the Medicare 
as of the publication date of this final rule in the Federal Register) 
of DMEPOS to obtain a surety bond no later than 9 months after the 
effective date of this final rule. Moreover, beginning 120 days after 
the effective date of this final rule, DMEPOS suppliers, who are 
seeking to enroll in the Medicare program and are subject to the 
provisions of this final rule, are required to furnish to the NSC a 
surety bond of at least $50,000 from an authorized surety for each 
assigned NPI for which the DMEPOS supplier is seeking to obtain 
Medicare billing privileges. Accordingly, any DMEPOS supplier, except 
those specified in Sec.  424.57(d)(15) (proposed Sec.  
424.57(c)(26)(ii)), seeking to enroll a new practice location or to 
change the ownership of an existing DMEPOS supplier after the 
publication date of this rule is required to submit to the NSC a surety 
bond of at least $50,000 beginning 120 days after the effective date of 
this final rule. The DMEPOS supplier must submit a surety bond of at 
least $50,000 with its enrollment application on the date of filing.
    Comment: Several commenters suggested that we delay implementing 
this final rule. The commenters stated that we should wait to see if 
our accreditation process reduces the level of Medicare fraud in the 
DMEPOS industry. Another commenter stated that we should consider 
granting a transition or ``grace period'' that gives suppliers an 
opportunity to, among other things, assess the availability of surety 
bonds and learn how to obtain surety bonds before requiring them to 
comply with any surety bond requirement. The commenter also urged us to 
grant this transition or ``grace period'' to allow time for a robust 
market for DMEPOS supplier surety bonds to develop.
    Response: We agree with the commenters and we have delayed the 
requirement of a surety bond for certain existing DMEPOS suppliers 
until 9 months after the effective date of this final rule, and 120 
days after the effective date of this final rule for certain new DMEPOS 
suppliers. These delays will give existing suppliers an opportunity to 
assess and determine whether they will continue to participate in the 
Medicare program during the accreditation implementation without 
incurring additional costs associated with a surety bond.

E. Definitions

    Comment: Several commenters noted that Sec.  424.57(a) of the 
August 1, 2007 proposed rule stated that paragraph (3) of the proposed 
definition of ``unauthorized surety'' means, among other things, a 
surety that ``[f]ails to pay CMS in full the amount requested, up to 
the penal sum of the bond when presented with a request for payment 
within 30 days of written notification.'' The commenters stated that 
there is no requirement that the request for payment be supported by 
sufficient evidence, and recommended that we revise paragraph (3) as 
follows: ``Fails to pay CMS any amount owed, up to the penal sum of the 
bond, within 30 days of receipt of a request for payment and sufficient 
evidence to support the request.''
    Response: We have removed the proposed definition of an 
``unauthorized surety'' from this final rule.
    Comment: One commenter stated that it is unclear whether there will 
be any ramifications if a DMEPOS supplier purchases a bond from a 
surety that becomes an ``unauthorized surety.'' The commenter believes 
that requiring the supplier to obtain a replacement bond without 
receiving a refund of the premium would penalize the wrong party.
    Response: We believe it is essential that DMEPOS suppliers select 
surety bond companies that will honor their commitments to pay the bond 
amount when presented with sufficient evidence by CMS or the NSC that a 
debt is owed by the DMEPOS supplier.
    Comment: One commenter suggested that we revise the definition of a 
``penal sum'' from, ``a sum to be paid (up to the value of the bond) by 
the surety as a penalty under the terms of the surety bond when a loss 
has occurred'' to ``a sum in the amount of the bond and the maximum 
obligation of the surety if a loss occurs.'' The commenter stated that 
the penal sum is not a penalty to be paid; rather, it represents the 
surety's obligation to pay what the principal owes up to the penal sum.
    Another commenter suggested that we revise the definition of 
``sufficient evidence'' from ``means the documentation that CMS may 
supply to the surety in order to establish that a DMEPOS supplier had 
received Medicare funds in excess of amounts due and payable under the 
statute and regulations'' to ``means documents CMS supplied to the 
surety that established both the amount of Medicare funds a DMEPOS 
supplier received in excess of amounts due and payable under applicable 
statutes and regulations and that this amount was an obligation of the 
surety.''
    Response: In response to these comments, we have revised the 
definitions of ``penal sum'' and ``sufficient evidence'' in Sec.  
424.57(a).
    Comment: A commenter stated that the definition of ``chain 
suppliers of DMEPOS'' should include chain pharmacies.
    Response: We agree that publicly traded chain suppliers of DMEPOS 
include chain pharmacies as long as there are 25 or more distinct 
practice locations under common ownership.
    Comment: One commenter stated that our definition of a ``small 
supplier'' is inconsistent and problematic. The commenter maintained 
that we made an arbitrary decision in the Medicare Program; Competitive 
Acquisition for Certain Durable Medical Equipment, Prosthetics, 
Orthotics, and Supplies (DMEPOS) and Other Issues; Final Rule (April 
10, 2007, 72 FR 17992) to define

[[Page 174]]

a small supplier as a supplier that generates gross revenue of $3.5 
million or less in annual receipts, but did not discuss why it chose 
$3.5 million as the ceiling as opposed to some other figure (for 
example, the commenter noted the SBA defines a small business as a 
business that has less than $6.5 million in annual receipts). The 
commenter stated that we should adopt SBA's definition of a small 
business.
    Response: During the development of the April 10, 2007 final rule 
(72 FR 17992), we adopted a $3.5 million revenue or less standard for 
DMEPOS suppliers. This standard was developed in consultation with the 
SBA during the development of the DMEPOS competitive bidding final 
regulation. To ensure consistency with both the April 10, 2007 rule and 
the guidance furnished by the SBA, we will continue to define a small 
supplier as a supplier that generates gross revenue of $3.5 million or 
less in annual receipts, including Medicare and non-Medicare revenue.

F. Payment and Liability

    Comment: A commenter stated that proposed Sec.  424.57(c)(26)(iii) 
indicates that we will revoke or deny a DMEPOS supplier's billing 
privileges based on submission of a bond that does not reflect the 
requirements of that section. The commenter stated that because, in its 
view, DMEPOS suppliers may experience difficulty obtaining surety bonds 
in the marketplace, we should recognize situations where DMEPOS 
suppliers have made a good faith effort to secure a surety bond that 
meets our requirements if the market will not provide such a product. 
The commenter suggested that we add language to proposed Sec.  
424.57(c)(26)(iii) that recognizes a DMEPOS supplier's good faith 
effort to obtain a surety bond that satisfies the surety bond 
requirement.
    Response: We believe that the delay in the implementation of this 
final rule will allow a surety bond market to develop for prospective 
DMEPOS suppliers as well as existing DMEPOS suppliers enrolled in the 
Medicare program. Therefore, we are not revising Sec.  424.57(d)(4) 
(proposed Sec.  424.57(c)(26)(iii)).
    Comment: One commenter stated that proposed Sec.  
424.57(c)(26)(iv)(C) appears to conflict with Sec.  
424.57(c)(26)(iv)(B). The commenter noted that Sec.  
424.57(c)(26)(iv)(C) states that ``the surety remains liable for unpaid 
claims, CMPs, or assessments that * * * took place during the term of 
the bond or rider * * *,'' and Sec.  424.57(c)(26)(iv)(B) states that 
``[t]he surety is liable for unpaid claims, CMPs, or assessments that 
are presented to the surety for payment when the surety bond is in 
effect, regardless of when the payment, overpayment, or other event 
giving rise to the claim, CMPs, or assessment occurred * * *.'' 
(Emphasis added.) The commenter suggested revising Sec.  
424.57(c)(26)(iv)(B) to place liability on the surety whose bond was in 
effect at the time of each respective default as provided by Sec.  
424.57(c)(26)(iv)(C).
    Response: We agree that the provisions discussed above are in 
conflict and have revised Sec.  424.57(d)(5) in this final rule 
(proposed Sec.  424.57(c)(26)(iv)) accordingly.
    Comment: A commenter stated that we need to clearly spell out the 
process and timeframes by which we would request payment from the 
surety.
    Response: We believe that the provisions of this final rule contain 
sufficient information on both the process and the timeframes involved 
in our payment requests.
    Comment: A commenter stated that it is unclear whether the original 
application and documentation for approval of the surety bond should be 
submitted to the NSC or the U.S. Department of Health and Human 
Services (HHS). The commenter maintained that the surety bond, all 
riders, and notices of cancellation should be filed with HHS to avoid 
any confusion or loss of data should HHS change contractors.
    Response: Since the NSC is our designated contractor responsible 
for establishing DMEPOS billing privileges, all documentation (for 
example, bond approval, riders, and notices of cancellation) associated 
with the surety bond should be sent to the NSC.
    Comment: Several commenters maintained that a default on the surety 
bond should be based on a finding of wrongdoing, not merely on the 
existence of debt, which may be disputed and subject to the Medicare 
appeals process. The commenters stated that a surety's liability should 
be triggered only when there has been a final determination of an 
assessment for fraud or other misconduct against a DMEPOS supplier and 
the time to file an appeal has expired. Commenters also stated that 
there is no valid rationale to impose liability under the bond before a 
final determination has been made because the bond, by its terms, 
guarantees payment of the assessment. Another commenter stated that 
underwriters should not be required to reimburse CMS for any 
overpayment until the DMEPOS supplier exercises its Medicare appeal 
rights, supplier liability for the claim is firmly established, and the 
supplier is past due on repayment.
    Response: We do not agree that we should be prohibited from seeking 
payment from a surety until all supplier appeals have been exhausted. 
In addition, we believe that it is appropriate for the surety to pay 
CMS a total of up to the full penal amount of the bond when sufficient 
evidence is presented. We note that in revised Sec.  424.57(d)(14), if 
a surety has paid CMS on the basis of liability incurred under a surety 
bond and to the extent the DMEPOS supplier that obtained the bond is 
subsequently successful in appealing the determination that was the 
basis of the unpaid claim, CMP, or assessment that caused the DMEPOS 
supplier to pay CMS under the bond, CMS refunds the DMEPOS supplier the 
amount the DMEPOS supplier paid to CMS to the extent that the amount 
relates to the matter that was successfully appealed, provided all 
review, including judicial review, has been completed on the matter.
    Comment: In order to limit the surety's liability to the penal sum 
of the bond, one commenter recommended that proposed Sec.  
424.57(c)(26)(iv) and any required surety bond form should include the 
following language: ``Regardless of the number of years the bond is in 
force, the number of premiums paid, or the number of claims made, the 
surety's aggregate liability shall not be more than the penal sum 
stated above.''
    Response: We agree with this commenter and have revised Sec.  
424.57(d)(5) (proposed Sec.  424.57(c)(26)(iv)) accordingly.
    Comment: A commenter stated that permitting the surety to cancel 
the bond as to future events will protect CMS and the surety. The 
commenter stated that a bond is an essential requirement for 
participation in the DMEPOS program. The commenter stated that if the 
surety learns that a DMEPOS supplier is violating Medicare rules or 
receiving Medicare overpayments, then the surety should be able to 
cancel the bond. The commenter observed that the surety would remain 
liable for overpayments and other debts already incurred, but it could 
avoid watching its obligations increase if the DMEPOS supplier violates 
Medicare rules or receives Medicare overpayments. Since the bond would 
no longer be in effect, the commenter noted that the supplier would be 
ineligible for reimbursement for supplies furnished after the effective 
date of cancellation. In effect, the commenter believes that the 
surety's cancellation of the bond would protect CMS from having to 
continue to do

[[Page 175]]

business with violators. The commenter stated that a right to cancel 
protects the Medicare program from fraud and abuse. The commenter noted 
that, if the surety mistakenly cancels a DMEPOS supplier's surety bond, 
then the supplier can simply obtain a replacement bond. The commenter 
recommended that proposed Sec.  424.57(c)(26)(iv) and any required 
surety bond form should include the following language: ``The Surety 
may terminate its liability for future acts of the Principal at any 
time by giving thirty (30) days written notice of termination of the 
bond of the Obligee.''
    Response: We agree with this commenter and have revised Sec.  
424.57(d)(6) (proposed Sec.  424.57(c)(26)(v)) accordingly.
    Comment: One commenter stated that the success of the surety bond 
requirement depends on the reasonableness of the terms of the surety 
bond. The commenter stated that sureties have to be able to, based on 
the merits of each applicant, provide the bonds to qualified DMEPOS 
suppliers and decline to offer bonds to unqualified DMEPOS suppliers. 
If the terms of the bond alone place an unreasonable risk on the 
surety, then the bonds will be available only to the largest, best-
capitalized DMEPOS suppliers. Therefore, the commenter maintained that 
it is important that we carefully consider the bond terms and make sure 
that they conform to reasonable standards. First, the commenter stated 
that the penal sum of the bond has to be the limit of the surety's 
obligations. If the surety cannot be sure of its maximum exposure, it 
cannot underwrite the risk. Second, the commenter stated that the 
surety should be able to cancel the bond on 30 days advance notice. The 
commenter stated that the surety would remain liable for any 
overpayments or other defaults that occur before the effective date of 
the cancellation but would be able to prevent future losses. Finally, 
the commenter maintained that there must be a reasonable time limit on 
the surety's exposure so that at the end of that period, if no claims 
have been made, the surety can close its books on the bond and return 
any security or collateral the principal provided.
    Response: We have revised the relevant provisions, including the 
provisions pertaining to 30-day cancellations, and believe we have 
addressed the commenter's concerns in this final rule.
    Comment: A commenter stated that proposed Sec.  
424.57(c)(26)(iv)(B) and (C) partially address the time limit of the 
surety's liability. The commenter indicated that subparagraph (B) 
provides that the bond in force when the claim is made is responsible. 
The commenter stated that this implies that the earlier bond in force 
when the events giving rise to the claim occurred is not responsible. 
The commenter stated that, in effect, any bond is discharged from 
liability (except for claims already made) once the supplier furnishes 
a new bond that complies with the surety bond requirement. The 
commenter also stated that if at any point the DMEPOS supplier fails to 
furnish an acceptable bond, then for up to 2 years we can make claims 
on the existing bond based on overpayments or other events that took 
place during the bond term. However, the commenter observed that 
subparagraph (C)(2) starts the 2-year period from the date the supplier 
failed to submit a required bond or the date the DMEPOS supplier's 
billing privileges were terminated, whichever is later. The commenter 
stated that, in theory, there should not be much difference between 
either starting dates since the supplier's billing privileges should be 
terminated as soon as it fails to renew or submit a bond. Sureties will 
be concerned that, despite CMS oversight, we may not promptly terminate 
the supplier's billing privileges. The commenter stated that the surety 
could then face a liability period longer than the anticipated 2-year 
timeframe solely because of the neglect of CMS or one of its 
contractors. The commenter also stated that this issue would greatly 
concern sureties. Therefore, the commenter recommended that we amend 
subparagraph (C)(2) to read as follows: ``Were imposed or assessed by 
CMS or the OIG during the 2 years following the date the bond 
terminated, expired or was cancelled.''
    Response: We agree, and have revised subparagraph Sec.  
424.57(d)(5)(iii)(B) (proposed Sec.  424.57(c)(26)(iv)(C)(2)) 
accordingly.
    Comment: A commenter states that proposed Sec.  424.57(c)(26)(v)(G) 
provides that ``[t]he liability of the DMEPOS supplier and the surety 
to CMS is not extinguished by * * * [t]he DMEPOS supplier's failure to 
exercise available appeal rights under Medicare or to assign the rights 
to the surety.'' (Emphasis added.) The commenter stated that, upon 
receiving notification of a default from CMS or the NSC, the surety 
should be provided the same right to the appeals process as the 
principal because to provide otherwise would result in unjust 
enrichment for CMS.
    Response: We disagree with the commenter because our relationship 
is primarily with the DMEPOS supplier, as opposed to the surety. 
Accordingly, we believe that only the DMEPOS supplier should be 
afforded appeal rights.
    Comment: A commenter noted that proposed Sec.  
424.57(c)(26)(viii)(B) states that DMEPOS suppliers must submit either 
a continuous bond or an annual bond to the NSC. The commenter stated 
that requiring a continuous surety bond would be the most efficient 
approach and would require minimal maintenance in terms of 
recordkeeping.
    Response: We agree with this comment and have revised Sec.  
424.57(d)(4) (proposed Sec.  424.57(c)(26)(viii)(B)) to require a 
continuous bond. We believe that a continuous bond contains 
administrative benefits for the surety, the DMEPOS supplier, and CMS.
    Comment: One commenter asserted that proposed Sec.  
424.57(c)(26)(x) appears to conflict with proposed Sec.  
424.57(c)(26)(iv)(B). The commenter noted that Sec.  
424.57(c)(26)(iv)(B) states that ``[t]he surety is liable for unpaid 
claims, CMPs, or assessments that are presented to the surety for 
payment when the surety bond is in effect, regardless of when the 
payment, overpayment, or other event giving rise to the claim, CMPs, or 
assessment occurred * * *'' (Emphasis added.) Section 424.57(c)(26)(x), 
the commenter observed, indicates that ``[i]f a DMEPOS supplier changes 
its surety during the term of the bond, the new surety will be 
responsible for any overpayments, CMPs, or assessments incurred by the 
DMEPOS supplier beginning with the effective date of the new surety 
bond.'' (Emphasis added.) The commenter stated that the provision also 
indicates that ``[t]he previous surety is responsible for any 
overpayments, CMPs, or assessments that occurred up to the date of the 
change of surety.'' (Emphasis added.) The commenter suggested revising 
proposed Sec.  424.57(c)(26)(iv)(B) to place liability on the surety 
whose bond was in effect at the time of each respective default as 
provided by proposed Sec.  424.57(c)(26)(iv)(C), which states that 
``the surety remains liable for unpaid claims, CMPs, or assessments 
that * * * took place during the term of the bond or rider * * *''
    Response: We agree and have revised the provisions of this final 
rule to ensure consistency.
    Comment: A commenter stated that the surety bond requirement should 
cover only amounts of proven losses, and thus, should not include 
amounts for civil monetary penalties.

[[Page 176]]

    Response: We disagree because CMPs are debts owed to the Federal 
government.

G. Bond Cancellations and Lapses

    Comment: Several commenters noted that proposed Sec.  
424.57(c)(26)(v) allows a DMEPOS supplier to terminate or cancel a 
surety bond upon proper notice to the NSC. The commenter maintained 
that the surety should also be allowed to terminate or cancel the bond. 
Another commenter agreed that it is important for the surety to be able 
to cancel the bond by providing advance written notice to the DMEPOS 
supplier, CMS, and the NSC. The commenter noted that the events listed 
in proposed subparagraphs (A) through (G) of Sec.  424.57(c)(26)(v) do 
not extinguish any preexisting liability, but cancellation of the bond 
does prevent new liability from accruing. The commenter suggested that 
we revise the last sentence of the introductory text of paragraph (v), 
which immediately precedes subparagraphs (A) through (G), to read as 
follows: ``The liability of the DMEPOS supplier and the surety to CMS 
arising out of the overpayments or other events that occurred prior to 
cancellation is not extinguished by any of the following * * *''
    Response: While we believe that a surety has the right to cancel a 
bond and that it is purely a contractual matter between the two 
parties, we agree that a surety should notify the DMEPOS supplier and 
the NSC when a cancellation occurs. Therefore, we have revised Sec.  
424.57(d)(6) accordingly.
    Comment: A commenter stated that we should not prohibit Medicare 
payments during any lapses in surety bond coverage as proposed in Sec.  
424.57(c)(26)(v). The commenter maintained that this prohibition would 
penalize suppliers by treating reimbursable Medicare payments during a 
lapse in surety bond coverage as overpayments. The commenter stated 
that this practice would, among other things, result in a windfall to 
the government. Another commenter stated that notice from CMS 
indicating that the surety bond is not in effect and that payments will 
cease in 30 days would be sufficient and fair. The commenter maintained 
that retroactively applying a denial is too great a penalty for ``what 
could well be a simple administrative lapse.''
    Response: We disagree with the commenter. If the bond coverage 
lapses, the supplier is immediately and automatically out of compliance 
with the requirement at Sec.  424.57(d) (proposed Sec.  424.57(c)(26)) 
that the bond coverage be maintained in order for the DMEPOS supplier 
to receive payment from Medicare for its provision of DME.
    Comment: A commenter noted that proposed Sec.  424.57(c)(26)(v) 
requires a surety to immediately notify the NSC if there is a lapse in 
surety bond coverage. The commenter stated that this requirement is 
unreasonable because the surety with the expiring surety bond would not 
know whether the replacement surety bond has been issued or if the 
principal's billing privileges have been revoked. The commenter 
believes that providing the surety with the right to cancel the bond 
and requiring the surety to notify CMS and NSC if the surety has 
received a notification of cancellation from the principal should be 
adequate.
    Response: We agree with the commenter and have revised the language 
in Sec.  424.57(d)(6)(iv) (proposed Sec.  424.57(c)(26)(v)(D)) to read 
as follows: ``The surety must immediately notify the NSC if there is a 
lapse in the surety's coverage of the supplier.'' The surety, in other 
words, will only be responsible for notifying the NSC if its coverage 
of the supplier has lapsed.
    Comment: Several commenters believe that we should have provisions 
to protect a DMEPOS supplier if its surety bond is erroneously reported 
as lapsed or cancelled. The commenters stated that a DMEPOS supplier 
should have a reasonable, though limited, amount of time to prove that 
an error occurred, and that it has a valid surety bond.
    Response: Section 424.57(e) (redesignated Sec.  424.57(d)) 
specifies that a revocation of a DMEPOS supplier's billing privileges 
does not become effective until 15 days after the date on the 
revocation notice letter. During that 15-day period, the supplier may 
submit a corrective action plan (CAP) as specified in Sec.  
424.535(a)(1).
    Comment: A commenter stated that the last two sentences of proposed 
Sec.  424.57(c)(26)(x) appear to contemplate that a bond will remain in 
force, but the surety would change. The commenter stated that this 
would be highly unlikely, even though it is arguably possible. The 
commenter stated that if a DMEPOS supplier wants to change sureties, 
then the typical way this would occur would be for it to execute a new 
bond with the new surety and substitute the new bond for the existing 
one. The commenter stated that the respective liabilities of the 
sureties would then be controlled by subparagraphs (B) and (C) in 
proposed Sec.  424.57(c)(26)(iv). The commenter stated that if the 
DMEPOS supplier provides an acceptable bond from a different surety, 
then the new bond should be liable for any claims made after its 
effective date ``regardless of when the payment, overpayment or other 
event giving rise to the claim'' occurred, and the replaced bond and 
its surety should have no further liability other than for claims 
already made. Therefore, the commenter suggested striking the last two 
sentences of proposed Sec.  424.57(c)(26)(x).
    Response: We agree and have revised Sec.  424.57(d)(9) (proposed 
Sec.  424.57(c)(26)(x)) by removing the last two sentences.
    Comment: One commenter noted that proposed Sec.  424.57(c)(26)(xii) 
would give CMS the ability to revoke a DMEPOS supplier's billing 
privileges if the supplier fails to obtain, maintain, and timely file a 
surety bond. The commenter characterized this action as a penalty and 
stated that revoking a DMEPOS supplier's billing privileges would be 
harsh. The commenter stated that revocation of billing privileges 
should be reserved for the most flagrantly noncompliant DMEPOS 
suppliers, that some DMEPOS suppliers may fail to comply with proposed 
Sec.  424.57(c)(26)(xii) due to reasons outside of their control, and 
that first-time ``simple negligence'' should be addressed with a less 
punitive sanction.
    Response: As stated previously, if the bond coverage lapses the 
supplier is immediately out of compliance. This provision is similar to 
the current requirement at Sec.  424.57(c)(11) that a DMEPOS supplier 
maintain comprehensive liability insurance at all times.

H. Exceptions to the Bond Requirement

    Comment: Several commenters urged us to establish an exception to 
the surety bond requirement for physicians and NPPs. The commenters 
stated, among other things, that the Congress did not intend for CMS to 
impose this requirement on physicians and NPPs; and referred to a 
conference report on the BBA of 1997 indicating that ``the Conferees 
wish to clarify that these surety bond requirements do not apply to 
physicians and other health care professionals.'' The commenters also 
noted that section 4312(c) of the BBA, which provides the Secretary 
with the authority to apply surety bond requirements to health care 
providers other than DME suppliers, explicitly states that the surety 
bond requirements may not be extended to physicians or other 
practitioners as defined in section 1842(b)(18)(C) of the Act. 
Commenters in support of an exception stated: (1) Physicians and NPPs 
are already licensed by the State; (2) large DMEPOS suppliers that 
generate significant

[[Page 177]]

revenue may be able to absorb the cost of the surety bond more than a 
physician or NPP who occasionally furnishes DMEPOS items for the 
convenience of his or her patients; (3) government reports show that 
unscrupulous individuals and corporations, not physicians who primarily 
furnish DMEPOS only as an ancillary service to their patients, engage 
in fraudulent DMEPOS supplier conduct; (4) personal instruction in 
disease processes and prevention of injuries for most Medicare 
beneficiaries needs to come from a professionally trained clinician, 
not from a DMEPOS mail order catalogue; and (5) physicians who 
occasionally provide DMEPOS items for the convenience of his or her 
patients may choose not to renew their DMEPOS supplier numbers due to 
the costly burden of the surety bond requirement, and that this could 
impede the ability of Medicare beneficiaries to access immediate, safe, 
effective, and quality care.
    Conversely, several commenters stated that physicians and NPPs 
should not be exempt from the surety bond requirement. One commenter 
stated that physicians have been implicated in large Medicare fraud 
prosecutions and that large, publicly-traded chain suppliers of DMEPOS 
have been at risk for bankruptcy. The commenter believed that requiring 
these suppliers to obtain a surety bond would provide an alternative 
means for CMS to recover overpayments. Another commenter stated that 
physicians are no less likely to cost the Federal program money than 
other DMEPOS suppliers, and a surety bond should not be difficult for 
them to obtain. Another commenter stated that we should not exempt 
physicians and NPPs that furnish DMEPOS as a convenience to their 
patients from the surety bond requirement unless they otherwise meet 
the criteria for an exception.
    Response: In reviewing the statutory language and legislative 
history of section 4312(a) of the BBA, we believe that the Congress 
intended to create an exception for physicians and NPPs. Accordingly, 
we have revised this final rule to establish an exception to the surety 
bond requirement for physicians as defined in section 1861(r) of the 
Act and NPPs as defined in section 1842(b)(18) of the Act, provided 
that the items are furnished only to the physician or NPP's own 
patients as part of his or her professional service as defined at 
section 1861(q) of the Act and as described in section 1861(s)(2)(K) of 
the Act.
    Comment: Several commenters recommended that we not require a 
surety bond for accredited and State-licensed orthotic and prosthetic 
personnel. A commenter stated that State-licensed orthotic and 
prosthetic suppliers are highly clinical and service-oriented, and the 
training and expertise required to provide quality orthotic and 
prosthetic care differ greatly from the provision of DME, which 
typically requires little more than opening a store front and obtaining 
a Medicare supplier number.
    Response: We agree with these commenters and have created an 
exception for State-licensed orthotic and prosthetic personnel 
operating in private practice and who are only providing custom-made 
orthotics and prosthetics and supplies related to custom-made orthotics 
and prosthetics.
    It is important to note that we believe that there is a clear 
distinction between a DMEPOS supplier enrolled as a State-licensed 
orthotic and prosthetic supplier operating in private practice who is 
only providing custom made orthotics and prosthetics and supplies 
related to custom made orthotics and prosthetics, and orthotic and 
prosthetic personnel employed by a medical supply company or co-owned 
with another individual or entity or furnishing DME. Since a medical 
supply company can enroll as a DMEPOS supplier with or without 
employing State-licensed orthotic and prosthetic personnel, we do not 
believe that medical supply companies employing State-licensed orthotic 
and prosthetic personnel qualify for an exception because the owners of 
the medical supply company are responsible for the management and 
billing of products and services, not the licensed orthotic or 
prosthetic personnel. Similarly, we believe orthotic or prosthetic 
personnel are not operating in private practice when another individual 
or entity is a part owner of the enrolled orthotic or prosthetic 
personnel's practice location. Specifically, the business must be 
solely-owned and operated by orthotic or prosthetic personnel who are 
making custom made orthotics or prosthetics.
    Finally, as with physicians and NPPs, State-licensed orthotic and 
prosthetic personnel operating in private practice risk their State 
license if they are found guilty of fraudulent or abusive behavior, 
whereas a medical supply company can reorganize under new ownership and 
reapply to participate in the Medicare program. Consequently, since all 
DMEPOS suppliers are required to be accredited to participate in the 
Medicare program by September 30, 2009, we do not believe that it is 
appropriate to establish an exception based solely on whether State-
licensed orthotic or prosthetic personnel are accredited.
    Comment: One commenter stated that DME suppliers and non-accredited 
suppliers of orthotic and prosthetic services that bill Medicare for 
orthotic and prosthetic services should be subject to the surety bond 
requirement. The commenter stated that, to the extent that these 
providers submit claims for orthotic and prosthetic care when they do 
not possess ``independent validation'' (for example, orthotic and 
prosthetic accreditation certification or State orthotic and prosthetic 
licensure), the surety bond requirement is one way for us to provide a 
basic level of protection to the Medicare program.
    Response: We agree with this commenter. As such, we are not 
establishing an exception to the surety bond requirement for medical 
supply companies that employ orthotic or prosthetic personnel.
    Comment: Some commenters urged us to exempt physical therapists, 
occupational therapists, and physician assistants (PAs) from the surety 
bond requirement. The commenters stated that physical therapists, for 
instance, who work in private practice often specialize in treating 
certain conditions and provide DMEPOS supplies that are integral to 
their plan of care. The commenters also maintained that, given the 
small size of physical therapy practices and the scope of services they 
furnish, the potential for fraud and abuse is limited. Commenters also 
stated that the cost of the surety bond may force some physical and 
occupational therapists to not enroll or to discontinue their 
enrollment as a DMEPOS supplier, which may hinder patient access to 
their services. Commenters also expressed concern that the surety bond 
requirement will allow unqualified DMEPOS suppliers--rather than 
qualified NPPs--to fabricate custom splints because of their ability to 
pay to obtain a surety bond. Commenters stated that the fabrication of 
custom orthotics and the frequent adjustments they entail cannot be 
performed by a DMEPOS supplier that is not treating the Medicare 
beneficiary. Yet another commenter stated that suppliers of material 
for splints will be affected by the surety bond requirement if 
occupational therapists that provide DMEPOS services opt out of the 
DMEPOS program.
    In addition, commenters stated that the surety bond requirement 
will have a negative impact on physical and occupational therapists, 
certified hand therapists, and PAs that work for small businesses, not-
for-profit organizations, and minority-owned companies. The

[[Page 178]]

commenter stated that small businesses that provide occupational 
therapy services, such as outpatient occupational therapy clinics, are 
already burdened with the DMEPOS application and reoccurring 
certification requirement and accompanying expense.
    Response: While PAs are included in the definition of 
``nonphysician practitioner'' in accordance with section 1842(b)(18)(C) 
of the Act, physical therapists and occupational therapists are not 
included. However, we believe that physical therapists in private 
practice and occupational therapists in private practice should be 
exempt from the surety bond requirements, provided that the therapist 
furnishes orthotics, prosthetics and supplies to the therapist's own 
patients as part of the physical or occupational therapy service.
    We believe that this approach is consistent with both the 
provisions that had been established in the DMEPOS competitive bidding 
program prior to the enactment of the MIPPA, as well as the intention 
of section 4312(a) of the BBA. As with prosthetic and orthotic 
personnel, we believe that there is a clear distinction between a 
DMEPOS supplier enrolled as a physical or occupational therapist in 
private practice and physical or occupational therapists employed by a 
medical supply company or co-owned with another individual or entity. 
Since medical supply companies can enroll as a DMEPOS supplier with or 
without employing State-licensed physical or occupational therapists, 
we do not believe that medical supply companies employing State-
licensed physical or occupational therapists qualify for an exception 
because the owners of the medical supply company are responsible for 
the management and billing of products and services, not the licensed 
physical or occupational therapist. In addition, we believe that a 
physical or occupational therapist is not operating in private practice 
when another individual or entity is a part owner of the enrolled 
therapist's practice location. Specifically, the business must be 
solely-owned and operated by the physical or occupational therapist.
    Finally, as with physicians and NPPs, and State-licensed orthotic 
and prosthetic personnel operating in private practice, physical and 
occupational therapists risk their State license if they are found 
guilty of fraudulent or abusive behavior. Nonphysician practitioners, 
physical therapists in private practice and occupational therapists in 
private practice who furnish DMEPOS products or services that are not 
incident to a physician's order, or who enroll to provide DMEPOS to the 
general public, must separately enroll and are subject to the bonding 
requirement. Finally, we recognize that although physical and 
occupational therapists, certified hand therapists, and PAs work for 
small businesses, not-for-profit organizations, and minority-owned 
companies, the bonding requirement is the responsibility of the 
owner(s) of the DMEPOS supplier, regardless of the size of the 
business.
    Comment: A commenter stated that we should require DMEPOS suppliers 
that have a history of committing Medicare fraud and abuse to obtain a 
surety bond.
    Response: We appreciate this comment and are establishing an 
increased surety bond amount for those DMEPOS suppliers that have 
significantly higher risk.
    Comment: Some commenters asked us to waive the surety bond 
requirement for nursing facilities that provide DMEPOS services and 
bill Medicare for those services for their own residents. The 
commenters stated that the surety bond requirement aims to deter 
fraudulent conduct that is primarily and historically associated with 
small, independent, and commercial DMEPOS suppliers, not with nursing 
facilities that provide DMEPOS to their own residents. The commenters 
also stated that nursing facilities are subject to other legal and 
regulatory requirements that ensure that they are qualified to provide 
DMEPOS services to their residents. The commenters also stated that we 
did not demonstrate in the August 1, 2007 proposed rule that DMEPOS 
fraud in nursing homes is a bona fide problem.
    Response: We disagree with the commenters and note that nothing in 
the statute or section 4312(a) of the BBA indicates a Congressional 
intent to exempt nursing facilities from the surety bond requirement. 
Indeed, the statute requires all suppliers of DME, except for 
physicians and NPPs who provide DME to their patients, to provide the 
Secretary with a surety bond.
    Comment: Some commenters stated that we should develop an exception 
to the surety bond requirement for pharmacies that provide DMEPOS only 
when necessary for the administration of a drug and that furnish DMEPOS 
as a convenience to their patients. The commenters believe that 
requiring pharmacies to obtain a surety bond may prevent or discourage 
them from providing DMEPOS services to Medicare beneficiaries, who 
benefit from being able to obtain all of their medications, including 
those that must be administered via a medical device, from a single 
pharmacy.
    One commenter stated that we should exempt pharmacies that furnish 
home infusion DMEPOS services (in other words, services that require 
medications to be administered intravenously in a patient's home) and 
pharmacies that provide a small volume of DMEPOS from the surety bond 
requirement unless they have had a prior adverse history.
    Response: In reviewing the legislative history of section 4312(a) 
of the BBA and the overall purpose of the surety bond requirement, we 
do not believe that there was a congressional intention to exempt 
pharmacies--regardless of size or setting--from the surety bond 
requirement.
    Comment: Several commenters stated that we should develop an 
exception to the surety bond requirement for large, publicly-traded 
chain DMEPOS suppliers. Some commenters stated that these companies are 
subject to laws such as the Sarbanes-Oxley Act, which targets corporate 
fraud by requiring public companies to implement internal controls, 
enhances financial disclosures, and imposes penalties for 
noncompliance. This indicates that large, publicly-traded companies are 
not the type of businesses that the Congress intended to target with 
the surety bond requirement. The commenters maintained that the 
Congress supported the surety bond requirement because it was concerned 
about ``fly-by-night'' companies that can quickly and inexpensively set 
up sham businesses to fraudulently receive Medicare reimbursement. 
Other commenters stated that large, publicly-traded companies tend to 
have established relationships with the Medicare program and 
significant assets. As a result, they pose less risk of nonpayment to 
the Medicare program than other DMEPOS suppliers, which may have less 
established relationships with the Medicare program and fewer assets.
    One commenter suggested criteria that we could use to exempt large, 
publicly-traded chain suppliers of DMEPOS from the surety bond 
requirement. The commenter suggested that in order for a large, 
publicly traded DMEPOS supplier to be exempt from the surety bond 
requirement, we could require the DMEPOS supplier to have a minimum net 
worth for the chain (as set by CMS) and be publicly-traded. The 
commenter recommended that the supplier's net worth should be $5 
million. The commenter also stated that we might

[[Page 179]]

also consider the following factors: Prior history of paying Medicare 
debts; revocation or suspension of a license to provide health care 
products or services; Federal or State criminal convictions related to 
the delivery of health care products or services; and exclusion(s) from 
Federal or State health care programs. Yet, another commenter stated 
that we may wish to adopt criteria for what would constitute a ``large, 
publicly-traded company,'' such as a dollar threshold for 
capitalization and annual gross sales volume.
    Conversely, many commenters urged us not to establish an exception 
to the surety bond requirement for large, publicly-traded chain 
suppliers of DMEPOS. One commenter stated that the exception should not 
be granted because large, publicly-traded chain suppliers of DMEPOS 
represent the same level of risk for inappropriate Medicare billing as 
other DMEPOS suppliers. Another commenter stated that such high volume 
suppliers pose significant risk exposure, particularly if they become 
bankrupt. Yet another commenter stated that there is no legitimate 
basis to exempt larger DMEPOS suppliers from the surety bond 
requirement.
    Response: In reviewing the statutory language and legislative 
history of section 4312(a) of the BBA and the overall purpose of the 
surety bond requirement, there is nothing to indicate that the Congress 
intended to exempt publicly-traded chain DMEPOS suppliers from the 
surety bond requirement. Accordingly, we are not able to establish such 
an exemption for publicly-traded chain DMEPOS suppliers.
    Comment: Some commenters urged us to exempt all State-licensed 
chain pharmacies from the surety bond requirement without regard to 
whether they are ``large'' or ``publicly-traded.'' Some commenters 
stated that, unlike other DMEPOS suppliers, community pharmacies are 
subject to numerous and rigorous Federal and State standards. Other 
commenters stated that staff pharmacists, technicians, and other 
employees at the community chain pharmacies have no financial incentive 
to engage in Medicare fraud because their compensation is not tied to 
the volume of Medicare prescriptions filled or DMEPOS items.
    Response: While it may be true that staff pharmacists at pharmacies 
do not have an incentive to perpetuate schemes that may increase 
reimbursement levels for the pharmacy, there is nothing in section 
4312(a) of the BBA or its legislative history to indicate that the 
Congress intended to exempt these suppliers from the surety bond 
requirement. As such, we disagree that we should establish a broad 
based exception for all State-licensed chain pharmacies.
    Comment: A commenter stated that there should be a monetary cap on 
the amount of the surety bond required for DMEPOS suppliers that belong 
to a chain. The commenter believed that this cap should not be limited 
only to publicly traded DMEPOS suppliers.
    Response: We disagree that such a cap should be established, since 
DMEPOS suppliers are enrolled separately and are required to obtain a 
distinct NPI for each practice location if the DMEPOS supplier is 
operating as an organizational entity.
    Comment: Several commenters stated that businesses falling under 
the Small Business Administration's (SBA) definition of ``small 
business'' should be exempt from the surety bond requirement.
    Commenters stated that criteria for an exception to the surety bond 
requirement for small businesses could be based on a percentage of 
Medicare revenue and/or a percentage of revenue from Medicare DMEPOS.
    Response: We disagree that we should establish an exception for 
small businesses based solely on the fact they are defined as a small 
business by the SBA. This would create an exception for nearly all 
DMEPOS suppliers and would effectively nullify the provisions contained 
in section 4312(a) of the BBA. Moreover, we believe that this 
requirement will limit the Medicare program's exposure to fraudulent 
DMEPOS activity; enhance the Medicare enrollment process to help ensure 
that only legitimate DME suppliers are enrolled or are allowed to 
remain enrolled in the Medicare program; ensure that the Medicare 
program recoups erroneous payments that result from fraudulent or 
abusive billing practices by allowing CMS or our designated contractor 
to seek payments from a surety up to the penal sum; and help ensure 
that Medicare beneficiaries receive products and services that are 
considered reasonable and necessary from legitimate DME suppliers.
    Comment: Several commenters stated that if we implement the surety 
bond requirement, it should hold all DMEPOS suppliers to the same 
standard and no exceptions to the requirement should be granted.
    Response: We disagree with the commenters because, as previously 
explained in this final rule, the Congress intended for some categories 
of DMEPOS suppliers to be exempt from the surety bond requirement.
    Comment: Several commenters stated that if a DMEPOS supplier is in 
``good standing'' with Medicare or has operated for a number of years 
(for example, 5 years) without committing Medicare fraud or abuse, then 
we should exempt the supplier from the surety bond requirement. Other 
commenters stated that we should exempt from the surety bond 
requirement those DMEPOS suppliers that have no prior adverse history 
with Medicare. The commenters maintained that we should exempt from the 
surety bond requirement all DMEPOS suppliers that: (1) Have been 
enrolled in the DMEPOS program for at least 10 years; (2) have never 
had their Medicare billing privileges revoked; (3) pose no increased 
risk to the Medicare program; (4) have not engaged in materially 
questionable billing practices in the past; and (5) have never had any 
history of criminal, civil, or administrative sanctions imposed against 
them.
    Response: We disagree with the commenters. We do not believe that 
anything in section 4312(a) of the BBA indicates that the Congress 
intended for us to establish such a broad based exception for DMEPOS 
suppliers participating in the Medicare program. In addition, we do not 
believe that a broad based exception would address systemic problems 
with fraud and abuse perpetuated by significant numbers of newly 
enrolling DMEPOS suppliers each year.
    Comment: Several commenters maintained that established DMEPOS 
suppliers that open new locations or that acquire established DMEPOS 
suppliers should be exempt from the surety bond requirement. The 
commenters stated that the value of the surety bond in these instances 
would be small compared to the financial and administrative burden 
imposed on the DMEPOS suppliers.
    Response: We disagree with the commenters. While we are 
establishing an exception to the surety bond requirement for certain 
DMEPOS suppliers, for reasons discussed in the preamble to this final 
rule we do not believe that it is appropriate to establish a broad 
based exception for new DMEPOS practice locations or changes of 
ownership for existing DMEPOS suppliers.
    Comment: Many commenters stated that we should consider 
establishing an exception to the surety bond requirement for suppliers 
that provide DMEPOS services on an occasional basis or in a low volume. 
For example, one commenter stated that a DMEPOS supplier with annual 
payments of less than a specified dollar amount would be

[[Page 180]]

exempt from the surety bond requirement.
    Response: We disagree with the commenters. It is not possible for 
us to determine whether a newly enrolling DMEPOS supplier will only 
bill on an occasional basis or in low volumes on a prospective basis. 
In addition, we believe that newly enrolling DMEPOS suppliers should 
develop a business case and market analysis to determine whether it 
makes business sense to open and establish a new DMEPOS supplier 
business. Moreover, with the delay in implementation of the surety bond 
requirement for existing DMEPOS suppliers until 9 months after the 
effective date of this final rule, we believe that existing DMEPOS 
suppliers will need to make the business decision as to whether to 
participate in the Medicare program after the full implementation of 
accreditation in September 2009.
    Comment: Several commenters stated that we should establish an 
exception to the surety bond requirement for home health agencies and 
hospices that provide DMEPOS items as a convenience to their patients. 
One commenter stated that in a 1999 report by the Government Accounting 
Office (GAO) entitled ``Medicare Home Health Agencies: Role of Surety 
Bonds in Increasing Scrutiny and Reducing Overpayments,'' the GAO 
indicated that the primary benefit of a surety bond is the scrutiny a 
surety provides as it reviews an applicant. The commenter stated that 
the GAO recommended that home health agencies with a proven track 
record in returning overpayments be exempt from the surety bond 
requirement. The commenter also stated that we did not explain why we 
ignored this information in the August 1, 2007 proposed rule.
    Response: While we are aware of this report, we do not believe that 
it is appropriate to establish an exception to the bonding requirement 
for home health agencies and hospices. To the extent that HHAs provide 
DME to their patients, the statute requires that they submit a surety 
bond to the Secretary. We also note that we continue to experience 
systemic problems with fraud and abuse perpetuated by significant 
numbers of home health agencies. To address this specific concern of 
home health fraud, we initiated a provider enrollment home health 
demonstration in FY 2008 in Harris County, Texas and in select counties 
in California. Based on the results of these demonstrations, we will 
consider expanding these demonstrations into other parts of the 
country.
    Comment: Several commenters believe that we should exempt rural 
DMEPOS suppliers from the surety bond requirement. The commenters 
stated that exempting rural DMEPOS suppliers that are in good standing 
with Medicare and that do not otherwise pose a risk to the Medicare 
program (for example, meet our accreditation standards) will ensure 
appropriate access to DMEPOS items for rural beneficiaries.
    Conversely, another commenter stated that we should not exempt 
rural DMEPOS suppliers from the surety bond requirement unless they 
otherwise meet the criteria for an exception.
    Response: While we understand the commenter's concerns, we do not 
believe that it is appropriate to establish a broad-based exception for 
rural DMEPOS suppliers based solely on the fact that they are located 
in a rural area. As stated above, we believe that rural DMEPOS 
suppliers should only receive an exception if they meet other criteria 
for an exemption.
    Comment: Several commenters believe that holding all suppliers to 
the same surety bond requirement would place a disproportionate burden 
on smaller suppliers, give an unfair advantage to larger suppliers that 
may have more financial resources, and would not appropriately 
safeguard the Medicare Trust Fund from fraud. The commenters stated 
that small DMEPOS suppliers, particularly those located in rural areas, 
may not be able to remain in business if they are subject to the surety 
bond requirement because the cost of the bond would exceed their annual 
Medicare reimbursement for DMEPOS items.
    Response: As stated previously, we do not believe that it is 
appropriate to establish a broad-based exception for small or rural 
suppliers of DMEPOS unless they meet other criteria for an exception.
    Comment: A commenter stated that the surety bond requirement will 
not stop fraud committed by pharmacies that furnish home infusion 
DMEPOS services or home infusion pharmacies because there will always 
be a means to fraudulently bill Medicare for services. However, the 
commenter maintained that the surety bond requirement will decrease the 
availability of DMEPOS services for patients that need home infusion 
DMEPOS services. Another commenter stated that we should not exempt 
from the surety bond requirement those pharmacies that provide DMEPOS 
as a convenience to their patients unless they otherwise meet the 
criteria for an exception.
    Response: As stated above, the purpose of a surety bond is to: (1) 
Limit the Medicare program risk to fraudulent DME suppliers; (2) 
enhance the Medicare enrollment process to help ensure that only 
legitimate DME suppliers are enrolled or are allowed to remain enrolled 
in the Medicare program; (3) ensure that the Medicare program recoups 
erroneous payments that result from fraudulent or abusive billing 
practices by allowing CMS or our designated contractor to seek payments 
from a surety up to the penal sum; and (4) help ensure that Medicare 
beneficiaries receive products and services that are considered 
reasonable and necessary from legitimate DME suppliers. In addition, 
while we believe that some DMEPOS suppliers will make the decision to 
withdraw from the Medicare program due to the additional costs 
associated with the surety bond, we believe that Medicare beneficiaries 
will not encounter barriers to care.
    Comment: One commenter stated that it is a community pharmacy that 
receives Medicare reimbursement for selling diabetic supplies to 
patients. The commenter indicated that it has neither rented any 
equipment nor bid on any Medicare contracts. If this final rule is 
implemented, the commenter asked whether it would be subject to the 
surety bond requirement.
    Response: We are not adopting an exception to the surety bond 
requirement for community pharmacies because the requirement is 
designed to ensure that owners of community pharmacies maintain basic 
financial solvency requirements to continue participation in the 
Medicare program.
    Comment: One commenter stated that nothing prevents us from 
creating exceptions to the surety bond requirement based on the 
reasonableness of the exceptions.
    Response: We agree that the Secretary has the authority to 
establish exceptions to the surety bond requirement for, among other 
entities, providers of services and suppliers of orthotics, 
prosthetics, and supplies. In response to public comments, we have 
established several exceptions to the bonding requirement for certain 
suppliers of DMEPOS, specifically certain suppliers of orthotics, 
prosthetics, and supplies in this final rule.
    Comment: One commenter recommended that we delay publishing this 
final rule until we receive explicit guidance from the Congress on the 
types of exemptions that should be provided to the surety bond 
requirement. The commenter stated that, since 10 years have passed 
since the BBA was enacted, there appears to be no particular sense

[[Page 181]]

of urgency to publish this final rule. Another commenter stated that 
neither the BBA nor its accompanying conference report gives us the 
authority to grant surety bond exceptions for certain classes of 
suppliers. Several other commenters questioned the need for the surety 
bond requirement at all stating that the bond requirement specified in 
the BBA of 1997 reflected a different era. For example, one commenter 
observed that DMEPOS suppliers are now required to become accredited; 
another commenter stated that the NSC now performs on-site inspections 
before issuing billing numbers.
    Response: We continue to believe that section 4312(a) of the BBA 
permits us to establish an exception to the final rule's surety bond 
requirement. Moreover, in developing this final rule, we have 
considered the impact that accreditation will have on the suppliers of 
DMEPOS.
    Comment: Commenters recommended that we implement a risk-based 
system that would require only DMEPOS suppliers that are likely to 
submit inappropriate billings to Medicare to comply with the surety 
bond requirement. Specifically, commenters stated that the requirement 
should apply only to DMEPOS suppliers that--(1) Have no prior history 
with the Medicare program unless they are part of an existing large, 
publicly-traded Medicare-enrolled DMEPOS suppliers that is opening a 
new pharmacy or taking ownership of another pharmacy; (2) suppliers 
that have engaged in materially questionable billing practices in the 
past; and (3) suppliers that have had any history of criminal, civil, 
or administrative sanctions involving the Medicare program. One 
commenter believed that DMEPOS suppliers that fall into category 1 
above should not be treated as new suppliers because they would be 
subject to the large DMEPOS supplier's policies and procedures. In 
addition, a commenter stated that, in determining the materiality of 
any billing practice under category 2 above, we should take into 
account the overall size of the DMEPOS supplier and its number of 
locations. Finally, a commenter stated that the surety bond requirement 
should only be applied based on the number of locations that might be 
involved in Medicare fraud and abuse unless there is evidence of 
corporate-wide efforts to engage in fraudulent activity.
    Response: Consistent with section 4312(a) of the Balanced Budget 
Act of 1997 (BBA), this final rule implements section 1834(a)(16) of 
the Act by requiring certain Medicare suppliers of DMEPOS to furnish 
CMS with a surety bond. In addition, by establishing an elevated surety 
bond for those DMEPOS with increased risk, we believe that we are 
implementing a risk-based system for those suppliers that are 
considered high-risk.

I. High-Risk Suppliers

    Comment: One commenter disagreed with increasing the bond amount 
based on a supplier's elevated risk. The commenter maintained that 
additional risk is addressed by sureties in the underwriting process 
and that a surety evaluates whether to write a bond based on whether 
the surety believes the principal will perform its obligations. In 
addition, the commenter observed that high risk criteria are taken into 
account in the decision whether to write the bond and whether 
collateral is required from the principal.
    Response: While we agree that sureties consider additional risk 
when determining whether to issue a bond, sureties may not know that a 
particular supplier poses additional risk to the Medicare program based 
on past practices. In order for Medicare to easily convey to the surety 
that a particular individual or organization poses an elevated risk 
level, we believe that it is appropriate for Medicare to require a 
higher surety bond amount for certain DMEPOS suppliers participating in 
the Medicare program or for those DMEPOS suppliers that may be seeking 
to re-enroll in the Medicare program. Accordingly, we believe that we 
are in a unique position to inform sureties that certain DMEPOS 
suppliers pose a higher-than-normal risk to the Medicare program.
    Comment: One commenter stated that we should apply the surety bond 
requirement in a manner designed to exact the higher surety amount from 
DMEPOS suppliers that pose the greatest risk to the Medicare Trust 
Funds.
    Response: We agree with the commenter that a higher surety amount 
should be required from DMEPOS suppliers that pose an elevated risk and 
have revised the provisions of this final rule accordingly.
    Comment: A commenter recommended that we keep the initial surety 
bond to a single amount because CMS may need to gain some experience 
with implementing a base surety amount before it undertakes a more 
complicated approach that involves elevated amounts of surety bonds for 
higher risk DMEPOS suppliers.
    Response: While we appreciate this commenter's recommendation, we 
do not believe that the implementation of varying surety bond amounts 
for high risk suppliers will pose an undue administrative burden on CMS 
or our contractor, the NSC. In fact, no later than 120 days after the 
publication of this final rule, we will notify each existing DMEPOS 
supplier by mail of the need to obtain with an elevated bond to 
maintain its enrollment in the Medicare program. In addition, we will 
work with the NSC to conduct outreach to all DMEPOS suppliers regarding 
the need to obtain a surety bond. Our outreach efforts will include 
discussing the implementation of the surety bond rule during Open Door 
Forums, issuing listserv announcements from CMS and the NSC, and 
posting information regarding this new requirement on our Web site.
    Comment: Several commenters stated that new DMEPOS suppliers that 
have no prior billing history with the Medicare program should be 
required to obtain a surety bond for 5 years to establish a pattern of 
compliance with Medicare rules and regulations. One commenter stated 
that, if no sanctions are imposed against these suppliers during this 
timeframe, then we should no longer require them to obtain a surety 
bond. The commenter stated that new DMEPOS suppliers should not include 
locations that are opened by DMEPOS suppliers that are exempt from the 
surety bond requirement.
    Response: We disagree with the commenters because section 4312(a) 
of the BBA did not specify nor did we propose a limitation on the base 
bonding period. Accordingly, we are not adopting this recommendation to 
establish a minimum bonding period for existing or newly enrolling 
suppliers of DMEPOS. Nevertheless, we believe that the duration of the 
elevated surety bond amount should be limited. Accordingly, in this 
final rule, we have established a 3-year duration on elevated surety 
bond amounts. We believe that this affords the appropriate protections 
to the Medicare program, establishes a reasonable period of time for 
submission of an elevated surety bond amount, and is consistent with 
our established reenrollment period for DMEPOS suppliers found in Sec.  
424.57(f) (redesignated Sec.  424.57(e)).
    Comment: A commenter stated that, in general, surety bonds should 
be required for an entire category of licensees rather than exempting 
certain lower risk licenses. The commenter stated that requiring a bond 
from only a small segment of the group because that segment represents 
a higher risk and will likely cause future losses is a selection 
against the surety. According to the commenter, this is called adverse 
selection. The commenter stated that a

[[Page 182]]

surety needs to underwrite the entire group in order to adequately 
price and spread the risk of exposure. The commenter stressed that 
adverse selection would discourage sureties from participating in a 
market and would make obtaining the bond more difficult for those 
subject to the surety bond requirement.
    Response: While this final rule establishes exceptions for certain 
suppliers of DMEPOS, we believe that a sufficiently large number of 
other types of DMEPOS suppliers will remain in order for sureties to 
calculate and adjust for any adverse selection.
    Comment: A commenter stated that many DMEPOS suppliers have 
``billing-related problems'' with CMS, and that the vague proposed 
criteria (see 72 FR 42005) is not useful. The commenter believed that 
it would be difficult, if not impossible, for DMEPOS suppliers to 
obtain a bond from any surety if this type of criteria is used. The 
commenter recommended that only an ``unpaid final action'' that is not 
satisfied at the time a DMEPOS supplier applies for a surety bond be 
used to identify a DMEPOS supplier that would be subject to an elevated 
surety bond.
    Response: We have clarified Sec.  424.57(d)(4) (proposed Sec.  
424.57(c)(26)(iii)) to address this concern.
    Comment: A commenter suggested that the surety bond requirement be 
eliminated after a business has had satisfactory relations with CMS for 
a 3-year time period. The commenter stated that this should apply to 
any surety bond. If CMS cannot adopt this recommendation due to a 
statutory restriction, then the commenter suggested that we reduce the 
bond level by $10,000 for each successful year of relationship with CMS 
until the bond level amount reaches a minimum threshold of $10,000. The 
commenter stated that this amount would then be in effect ``until there 
is a problem of some kind.''
    Response: We do not have the statutory authority to lower the 
surety bond amount below $50,000 and, as stated previously, section 
4312(a) of the BBA did not specify nor did we propose a limitation on 
the base bonding period. Accordingly, we are not adopting this 
recommendation to establish a minimum bonding period for existing or 
newly enrolling suppliers of DMEPOS.
    Comment: A number of commenters stated that we should require 
current Medicare-enrolled DMEPOS suppliers with a prior ``adverse 
history'' of criminal, civil, or administrative sanctions for billing-
related problems to obtain a surety bond.
    Response: We appreciate the commenters' support for surety bonds 
for those suppliers of DMEPOS that pose a significantly higher risk to 
the Medicare program and note that the provisions of this final rule 
cover such individuals.
    Comment: One commenter observed that, according to the August 1, 
2007 proposed rule, examples of final adverse actions include, but are 
not limited to, the following: Federal and State criminal convictions; 
formal or official actions such as a revocation of Medicare billing 
privileges; a revocation or suspension of a license; and an exclusion 
from participation in Federal or State health care programs. The 
commenter stated that our proposal to increase the bond amount by 
$65,000 per occurrence if the DMEPOS supplier poses a significantly 
higher than average risk to the Medicare Trust Funds may penalize 
legitimate DMEPOS suppliers. The commenter stated that if the final 
rule imposes a surety bond requirement based on risk categories, then 
we need to create an exception to address honest mistakes by a DMEPOS 
supplier or the NSC. The commenter stated that we should limit such 
elevated costs to higher risk DMEPOS suppliers.
    Another commenter stated that we need to specifically define the 
term ``adverse actions.'' The commenter noted that even legitimate 
DMEPOS suppliers can be subject to overpayments, Federal investigation, 
or corporate integrity agreements. The commenter explained that, on 
their face, these actions could appear to be ``adverse actions.'' To 
ensure that legitimate DMEPOS suppliers are not unfairly penalized by 
the surety bond requirement, the commenter maintained that we must list 
all ``adverse actions'' that would subject a supplier to elevated bond 
payments.
    Response: We agree and have clarified what constitutes a final 
adverse action in Sec.  424.57(c)(26)(a). A final adverse action means 
one or more of the following actions:
    (i) A Medicare-imposed revocation of any Medicare billing 
privileges;
    (ii) Suspension or revocation of a license to provide health care 
by any State licensing authority;
    (iii) Revocation or suspension by an accreditation organization;
    (iv) A conviction of a Federal or State felony offense (as defined 
in Sec.  424.535(a)(3)(A)(i)) within the 10 years preceding enrollment, 
revalidation, or re-enrollment; or
    (v) An exclusion or debarment from participation in a Federal or 
State health care program.
    Under the final adverse action as specified in section 221(g)(1)(A) 
of the Health Insurance Portability and Accountability Act of 1996 
(Pub. L. 104-191) (HIPAA), we believe that a final adverse action 
occurs when the action is imposed, not when a DMEPOS supplier has 
exhausted all of its appeal rights associated with the final adverse 
action.
    In addition, we believe that the provider enrollment appeals 
process affords existing suppliers of DMEPOS with an administrative 
avenue to challenge a revocation determination.

J. Access to Bonds

    Comment: A commenter stated that our surety bond requirement may 
hinder DMEPOS suppliers' ability to obtain surety bonds. The commenter 
indicated that sureties may be unwilling to provide surety bonds to 
DMEPOS suppliers because the surety bond requirement imposes conditions 
that extend beyond the standards in the surety bond industry. The 
commenter stated that we failed in the August 1, 2007 proposed rule to 
discuss how this final rule will directly affect the surety industry as 
well as DMEPOS suppliers' ability to obtain surety bonds. The commenter 
urged us to provide this type of analysis in the final rule.
    Response: We believe that we have clarified the obligations of 
sureties in this final rule. Moreover, based on information received 
from sureties as well as our independent research, we are confident 
that legitimate DMEPOS suppliers will be able to acquire a surety bond.
    Comment: A commenter maintained that there must be real-time access 
to supplier information for sureties to evaluate risks. If this 
information is not available or is not provided to sureties, then the 
commenter believed that surety bonds may not be available for DMEPOS 
suppliers.
    Response: We agree that sureties will require appropriate financial 
information in order to evaluate the risks associated with issuing a 
bond to a particular DMEPOS supplier, and believe that a surety should 
ensure that the supplier furnishes this information to it.
    Comment: One commenter stated that we must meet with surety bond 
underwriters and vet surety bond requirements with the underwriters to 
ensure underwriter participation, and then make any necessary changes 
to the surety bond requirement prior to implementing this final rule.
    Response: We have examined the role of underwriters in this process 
and have

[[Page 183]]

made revisions to this final rule as necessary.
    Comment: A commenter stated that it is uncertain as to whether the 
surety industry will be willing to issue surety bonds that comport with 
the surety bond requirement. The commenter stated that it contacted 
three sureties. Two of the sureties stated that they would not issue 
such bonds. The other surety stated that it might consider issuing such 
bonds to DMEPOS suppliers with established and unblemished records of 
participation in the DMEPOS program. The sureties stated that they 
would not issue bonds to DMEPOS suppliers that have their billing 
privileges revoked.
    Response: While we appreciate the commenter's concerns, we believe 
that a reasonable number of sureties will offer to issue bonds to 
DMEPOS suppliers. Indeed, we believe that our implementation of this 
requirement will help create a market for sureties, as will the delay 
in the implementation of the bond requirement.
    Comment: A commenter recalled that in the past we have experienced 
difficulty in attempting to implement a surety bond requirement in the 
home health industry, and that we abandoned that proposal as 
unworkable. The commenter believes that we would have difficulty 
implementing a surety bond requirement in the DMEPOS industry and 
speculated that it would be difficult to identify companies that would 
issue surety bonds for the DMEPOS industry.
    Response: As stated above, we are confident that significant 
numbers of sureties will offer to issue bonds to DMEPOS suppliers; 
however, we have delayed the implementation for existing DMEPOS 
suppliers until 9 months after the effective date of this final rule.

K. Standard Bond Form

    Comment: One commenter stated that, instead of leaving the actual 
terms of the bond up to each supplier or surety, we should require each 
DMEPOS supplier and surety use a standard bond form. Otherwise, the 
commenter stated, CMS will have to review each bond form submission to 
verify that it meets the terms of the surety bond requirement. The 
commenter stated that this proposal would make it easier for DMEPOS 
suppliers to obtain the surety bond, remove any uncertainty as to 
whether a particular bond complies with the surety bond requirement, 
and relieve CMS of a large volume of work reviewing the terms of each 
bond submission.
    Response: While we appreciate the commenter's suggestion, we 
believe that this final rule will provide DMEPOS suppliers with the 
guidance and flexibility necessary to obtain surety bonds that meet the 
requirements of the final rule.

L. Suggested Alternatives

    Comment: Several commenters proposed alternatives to the surety 
bond requirement. One commenter stated that financial statements have 
been recently used by CMS to determine the financial stability of 
DMEPOS suppliers that apply for competitive bidding. The commenter 
indicated that these statements should be an acceptable alternative to 
a surety bond. Another commenter observed that we could require a bank 
letter of credit from a DMEPOS supplier or a DMEPOS supplier could 
provide us with a letter from an insurance broker that verifies the 
supplier's worth.
    Response: We disagree with the comments that the alternatives 
proposed would offer as much protection to the Medicare Trust Funds as 
the proposed surety bond. Also, none of the alternatives offered above 
would allow Medicare to recoup any mistaken payments.
    Comment: One commenter stated that large DMEPOS chain suppliers 
could be given the option to buy a $50,000 surety bond for each site or 
to buy one surety bond that equals 5 percent of their total 
reimbursement at all of their sites.
    Response: We do not believe it is appropriate to allow chain stores 
to purchase a single bond that equals 5 percent of their total 
reimbursement. Moreover and as already stated, there is nothing in 
section 4312(a) or its legislative history to indicate that the 
Congress intended for the bond amount to be tied to the supplier's 
level of reimbursement.
    Comment: One commenter stated that instead of implementing this 
final rule, we should exclude from the Medicare program DMEPOS 
suppliers that have been investigated by law enforcement (for example, 
the Federal Bureau of Investigation) and that have repaid millions of 
dollars in restitution to the government.
    Response: While we have the authority to revoke the billing 
privileges of a DMEPOS supplier, we do not have the authority to 
exclude a DMEPOS supplier from the Medicare program. This authority 
rests with the OIG.
    Comment: Some commenters stated that instead of implementing this 
final rule, we should make accreditation mandatory for all Medicare 
DMEPOS suppliers. One commenter stated that mandatory accreditation 
would ensure that DMEPOS suppliers are legitimate before they are 
issued billing numbers and allowed to bill the Medicare program. 
Another commenter stated that mandatory accreditation would be more 
effective at reducing Medicare fraud than this final rule.
    Response: We believe that accreditation will improve the quality of 
products and services furnished to Medicare beneficiaries, 
accreditation does not offer as much protection to the Medicare Trust 
Fund as the proposed surety bond; accreditation does not allow Medicare 
to recoup any mistaken payments. In addition, section 154(b) of the 
MIPPA added a new subparagraph (F). This subparagraph states that 
eligible professionals and other persons (defined above) are exempt 
from meeting the October 1, 2009 accreditation deadline unless we 
determine that the quality standards are specifically designed to apply 
to such professionals and persons.
    Comment: One commenter stated that DMEPOS suppliers should be 
recredentialed on an annual basis, whereby suppliers would be required 
to provide year-end financial statements, current information, and 
insurance renewals.
    Response: We disagree with this commenter that an annual 
recredentialing process is necessary and whether an annual 
recredentialing process would afford the Medicare program with the type 
of protection afforded by implementing a surety bond.
    Comment: Another commenter stated that we should either delay 
further expansion of the competitive bidding program or allow 
provisions so that bidders who have submitted bids before the 
implementation of the surety bond requirement may have their prices 
adjusted accordingly when the surety bond requirement is implemented.
    Response: As previously stated in this final rule, on July 15, 2008 
the Congress enacted the MIPPA delaying the implementation of the 
DMEPOS Competitive Bidding Program.
    Comment: One commenter stated the following: ``Collecting on a 
surety bond should involve adequate due process protections for a 
surety. While that process can start with a letter from CMS[,] the 
surety should have the ability to `look behind the curtain' to be sure 
that the recoupment has not already been accomplished before sending in 
the bond funds. The same process should apply in reverse. If CMS 
recoups after asking the surety for funds[,] then the burden should be 
on CMS to automatically refund the payment to the source of the funds, 
[which would be] the surety.''

[[Page 184]]

    Response: We disagree with the commenter. Since our primary 
relationship is with the DMEPOS supplier, we believe that only the 
DMEPOS supplier is eligible to appeal our decision.
    Comment: One commenter stated that we are attempting through the 
surety bond requirement to encourage Medicare beneficiaries who need 
diabetes testing supplies to purchase these supplies through mail order 
instead of from retail pharmacy DMEPOS suppliers. The commenter stated 
that this could potentially further reduce declining revenues that 
retail pharmacies would receive from selling Medicare DMEPOS. The 
commenter also stated that, although it would like to continue to 
provide beneficiaries with access to DMEPOS, the increasing number of 
requirements that we impose on DMEPOS suppliers, coupled with a 
potential decrease in retail-based revenues, could cause it to reassess 
the economic feasibility of being a DMEPOS supplier.
    Response: We are implementing statutory requirements to establish a 
surety bond requirement for DMEPOS suppliers. We are not attempting to 
steer Medicare beneficiaries to any particular individual DMEPOS 
supplier or type of DMEPOS supplier (for example, mail order).
    Comment: A commenter stated that the general tone of the August 1, 
2007 proposed rule shows that we do not understand the complexity of 
the surety bond market. The commenter predicted that, if DMEPOS 
suppliers are required to obtain a surety bond as a result of this 
final rule, most of them will have a difficult time obtaining one. The 
commenter noted that many DMEPOS suppliers will have to undergo a 
grueling application process and that many of the suppliers will be 
denied a surety bond by sureties. The commenter observed that there 
will be difficulty with accounting records, lack of audited statements, 
lack of liquidity, and general lack of financial ability. Therefore, 
the commenter stated that any bond requirements should be slowly 
phased-in, be as automated as possible, and that bond forms be 
carefully vetted and discussed with the surety industry before 
publication by CMS.
    Response: While we believe that some DMEPOS suppliers will not be 
able to obtain surety bonds because they have not maintained accounting 
records, or lack audited financial statements, liquidity, or financial 
ability to repay obligations, we do not believe that most legitimate 
and financially secure suppliers will find it difficult to comply with 
the standards necessary to apply for and meet a surety's bonding 
requirements. In addition, as mentioned previously, we are delaying the 
implementation of the surety bond requirement for existing DMEPOS 
suppliers until 9 months after the effective date of this final rule.
    Comment: Several commenters stated that basic principles of 
administrative law require agencies to publish the factual basis for 
their proposed actions to encourage meaningful comments and argued that 
we have not provided any data requiring all DMEPOS suppliers to post a 
bond. Of particular relevance, according to the commenters, would be 
data to show the prevalence and demographics of suppliers that default 
on their Medicare debts inasmuch as the proposed rule would require 
suppliers to post a financial guarantee bond securing unpaid claims.
    Response: We believe that the proposed rule was authorized by 
section 4312(a) of the BBA and published in accordance with the 
Administrative Procedures Act.
    Comment: A commenter stated that it is not within the scope of this 
final rule to interfere with the private contractual rights of the 
surety and a DMEPOS supplier. The commenter observed that the terms of 
their contract are both negotiable and private, that due process in 
private insurance contracts is regulated at the State level, and that 
the parties to those contracts can take care of themselves.
    Response: We agree that the specific language of a surety bond is 
not within the purview of this final rule. However, we believe that the 
Act grants us the authority to require DMEPOS suppliers to obtain a 
surety bond that satisfies certain minimum requirements as a 
prerequisite for participation in the Medicare program.
    Comment: One commenter stated that we should not ``bootstrap'' the 
Federal surety approval list as the only source for surety bonds under 
the DMEPOS program. The commenter stated that the surety bond rule 
should allow for other less traditional bonding methods. The commenter 
noted that new surety bond providers need to emerge, which will take 
time. The commenter also stated that we should specify a system for 
approving new surety systems, which should adapt to the DMEPOS market 
and the risks of that market. According to the commenter, only by 
developing a number of surety bond providers and a competitive market 
will the DMEPOS program have a chance of keeping costs for surety bonds 
reasonable for suppliers.
    Response: We disagree with this commenter because the use of the 
Federal surety approval list will best ensure that sureties are 
legitimate firms. A link to this list, which is maintained by the 
Financial Management Service of the Department of the Treasury, will be 
posted on our Web site within 90 days after the publication date of 
this final rule.
    Comment: One commenter stated that we gave commenters only 60 days 
to absorb and comment on the August 1, 2007 proposed rule, which 
consists of more than 60 pages. The commenter stated that this is 
unfair and will result in many people being unable to submit meaningful 
comments.
    Response: The Administrative Procedures Act requires a 60-day 
comment period on proposed rules with a major impact. Therefore, we 
believe commenters were given adequate time to submit meaningful 
comments.
    Comment: One commenter observed that in the August 1, 2007 proposed 
rule we indicated that we could conduct education and outreach efforts 
to help Medicare beneficiaries locate a replacement DMEPOS supplier if 
a significant number of DMEPOS suppliers leave the DMEPOS program as a 
result of the surety bond requirement.
    Response: As stated above, by delaying the implementation of the 
surety bond requirement for existing DMEPOS suppliers until 9 months 
after the effective date of this final rule, and establishing 
exemptions for certain DMEPOS suppliers, CMS and the industry will have 
time to educate the public about their DMEPOS supplier alternatives.

M. Miscellaneous Comments

    Comment: Some commenters stated that preexisting regulations (for 
example, the accreditation and liability insurance regulations) could 
be modified to prevent fraud in the program, rather than subjecting the 
DMEPOS industry to the surety bond requirement.
    Response: We believe the comments are outside the scope of this 
final rule.
    Comment: One commenter urged us to implement long-overdue 
regulations that would impose payment edits on practitioners and 
suppliers of orthotic and prosthetic care so that only qualified 
orthotic and prosthetic suppliers can be reimbursed under the Medicare 
program. The commenter stated that even though statutory directives 
require us to issue regulations within 1 year of enactment, we have 
never issued the regulations associated with section 427 of the 
Medicare, Medicaid and SCHIP Benefits Improvement and Protection Act of 
2000 (Pub. L. 106-554) (BIPA), a law

[[Page 185]]

that limits payment of certain custom fabricated orthotics and all 
prosthetics to qualified practitioners and suppliers.
    Response: We believe this comment is outside the scope of this 
final rule.
    Comment: In order to more effectively protect Medicare 
beneficiaries and safeguard the Medicare Trust Fund, one commenter 
urged us to permanently expel DMEPOS suppliers that commit substantive 
fraud from the DMEPOS program.
    Response: We do not have the statutory authority to permanently 
expel DMEPOS suppliers that commit substantive fraud from the DMEPOS 
program. This authority rests with the OIG. However, we are continuing 
to implement activities designed to protect the Medicare Trust Fund, 
including expanding onsite reviews of DMEPOS suppliers and revoking the 
billing privileges of DMEPOS suppliers that no longer meet the 
enrollment criteria found in Sec.  424.57 and Sec.  424.500 through 
Sec.  424.555.
    Comment: One commenter asked us to eliminate his copayment for 
DMEPOS items. He indicated that he is a diabetic and has a limited 
budget. He also stated that it is unfair that he must pay for his 
DMEPOS items when Medicare was paying for his DMEPOS items less than a 
year ago.
    Response: While we understand this concern, we believe this comment 
is outside the scope of this final rule.
    Comment: One commenter stated that, because we do not require home 
health agencies to obtain a surety bond, we should not require DMEPOS 
suppliers to obtain a surety bond.
    Response: We believe this comment is outside the scope of this 
final rule.
    Comment: The commenter maintained that if we enforced our own 
publication, Transmittal 656, and implemented existing laws, there 
would be no need to institute a surety bond requirement for orthotic 
and prosthetic suppliers.
    Response: We believe this comment is outside the scope of this 
final rule.
    Comment: A commenter found it difficult to believe that we cannot 
easily verify the legitimacy of home infusion services provided by 
pharmacies by crosschecking documentation (for example, medical 
procedures billed for services allegedly rendered to Medicare 
beneficiaries) in ``the Medicare system.''
    Response: While we appreciate this comment, we believe that this 
comment is outside the scope of this final rule.
    Comment: Another commenter asked whether CMS realizes the impact 
the shortsighted implementation of Part D has had on independent 
pharmacies. The commenter stated that we refused to acknowledge home 
infusion as a highly specialized service and ``lumped'' it with Part D.
    Response: We believe this comment is outside the scope of this 
final rule.
    Comment: Some commenters stated that we can reduce the risk of 
DMEPOS fraud and abuse by conducting credit checks on DMEPOS suppliers 
through established credit rating services, which can provide 
inexpensive and detailed credit reports on individuals and 
corporations. One commenter stated that we could require each supplier 
to provide evidence satisfactory to us that the supplier has a credit 
rating that will enable the supplier to pay 5 or 10 percent of its 
annual billings to Medicare if the supplier is not allowed to remain 
enrolled in the Medicare program.
    Response: While we appreciate this suggestion, we believe it is 
outside the scope of this final rule.
    Comment: Commenters stated that other measures, such as ``real 
time'' auditing and closely monitoring new DMEPOS suppliers, would more 
effectively deter fraud and abuse than the surety bond requirement.
    Response: We believe this comment is outside the scope of this 
final rule.
    Comment: One commenter stated that we underestimated the extent to 
which added DMEPOS costs will force independent pharmacists from the 
program, thus severely limiting patient access to DMEPOS and other 
medications. The commenter stated that it surveyed independent 
pharmacies after we issued the May 10, 2007 final rule (72 FR 17992), 
and that the survey targeted 10 Metropolitan Statistical Areas that 
were likely to be chosen to initiate our accreditation and competitive 
bidding program. The commenter reported that only 31 percent of 
independent pharmacists who responded to the survey indicated that they 
intended to submit bids to attempt to continue to sell DMEPOS supplies.
    Response: We believe this comment is outside the scope of this 
final rule.

IV. Provisions of the Final Regulations

    Based on public comments, we are adopting the provisions of the 
proposed rule with the following revisions:
    In Sec.  424.57(a), we are revising the definitions of ``penal 
sum'' and ``sufficient evidence.'' Based on public comments, we are 
adopting a change in the definition of the term, penal sum from ``is a 
sum to be paid (up to the value of the bond) by the surety as a penalty 
under the terms of the surety bond when a loss has occurred.'' to ``is 
the amount of the bond and the maximum obligation of the surety if a 
loss occurs.'' We are also adopting a change in the definition of the 
term, sufficient evidence from ``means the documentation that CMS may 
supply to the surety in order to establish that a DMEPOS supplier had 
received Medicare funds in excess of amounts due and payable under the 
statute and regulations'' to ``means documents CMS may supply to the 
surety that--(1) Establish both the amount of Medicare funds a DMEPOS 
supplier received in excess of amounts due, the amount of the CMP or 
the amount of some other assessment against the DMEPOS supplier; (2) is 
payable under applicable statutes and regulations; and (3) was an 
obligation of the surety.'' We believe that these revisions will 
clarify the terms throughout the regulation and ensure that sureties 
understand the financial obligation that they are incurring when they 
issue a surety bond to a DMEPOS supplier.
    We believe that the following technical changes to Sec.  
424.57(c)(26) will improve the clarity of the surety bond requirements:
     Redesignating existing Sec.  424.57(d) and (e) as Sec.  
424.57(e) and (f).
     Redesignating the provisions of proposed Sec.  
424.57(c)(26) as Sec.  424.57(d).
     Revising Sec.  424.57(c)(26) to state ``must meet the 
surety bond requirement in paragraph (d) of this section.''
     Making cross-reference changes in the definition of DMEPOS 
supplier Sec.  424.57(a) and the newly redesignated Sec.  424.57(e).
    In the introductory text of Sec.  424.57(d) (proposed Sec.  
424.57(c)(26)), we are revising this provision to reflect the $50,000 
surety bond amount and the delay in implementation: ``Except as 
provided in paragraph (d)(15) of this section and no later than 9 
months after the effective date of this final rule, each DMEPOS 
supplier that is a Medicare-enrolled DMEPOS supplier for each assigned 
NPI to which Medicare has granted billing privileges (DMEPOS suppliers 
seeking to enroll or to change the ownership of a supplier of DMEPOS 
after the effective date of this final rule are required to furnish to 
the NSC a surety bond of at least $50,000 from an authorized surety for 
each assigned NPI for which the DMEPOS supplier is seeking to obtain 
billing privileges Medicare after 120 days following the effective date 
of this final rule.)
    In Sec.  424.57(d)(2) (proposed Sec.  424.57(c)(26)(i)), we are 
clarifying the minimum requirements for a DMEPOS supplier. We specify 
that, unless a DMEPOS supplier meets the requirements for an exception 
in Sec.  424.57(d)(15), the enrolling Medicare

[[Page 186]]

DMEPOS supplier or the Medicare-enrolled DMEPOS supplier must obtain a 
surety bond for each National Provider Identifier (NPI) from an 
authorized surety. The surety bond must be in the amount prescribed by 
the NSC and in the form specified by the Secretary. We proposed to 
adjust the amount of the surety bond in the August 1, 2007 proposed 
rule from $50,000 in 1997 by the CPI and calculate a higher surety bond 
amount to $65,000. For reasons already stated, we have elected to 
require a base surety amount of $50,000 for all individual and 
organizational suppliers of DMEPOS who do not meet the requirements for 
an exception in Sec.  424.57(d)(15).
    In Sec.  424.57(d)(2)(i) (proposed Sec.  424.57(c)(26)(i)(A)), we 
require a DMEPOS supplier to submit a surety bond with its initial 
paper or electronic Medicare enrollment application (CMS-855S, OMB 
Number 0938-0685), or with its paper or electronic revalidation, or 
reenrollment application. In addition, we are clarifying that for the 
purpose of meeting the surety bond requirement, a change of ownership 
constitutes an initial application and that suppliers of DMEPOS, except 
those with an exception in Sec.  424.57(d)(15) (proposed Sec.  
424.57(c)(26)(ii)), are required to submit a surety bond in the amount 
prescribed by the NSC when a change of ownership occurs on or after the 
effective date of this final rule.
    In Sec.  424.57(d)(2)(iii) (proposed Sec.  424.57(c)(26)(i)(C)), we 
are clarifying that we require a DMEPOS supplier seeking to enroll a 
new location to obtain a new surety bond for this new location since 
the location is also required to be enumerated with a unique NPI, 
unless the DMEPOS supplier is a sole proprietorship. With the 
implementation of the NPI as the standard health care identifier on May 
23, 2008, we believe that the NPI, not the TIN, provides the best 
measure of program risk for the Medicare program. Moreover, we maintain 
that a DMEPOS supplier can obtain one TIN for many practice locations. 
However, these same DMEPOS suppliers can only obtain a single NPI per 
practice location (note that there is an exception for sole 
proprietorship). Accordingly, we are adopting a position that a 
separate surety bond be required for each NPI obtained for DMEPOS 
billing purposes. This will allow CMS, the NSC, and law enforcement an 
easy method to identify ownership, determine whether adverse legal 
actions have been previously imposed, and determine the value of the 
bond that each DMEPOS supplier must obtain and maintain in order to 
participate in the Medicare program. Since each of these factors can 
enhance the overall risk to the Medicare Trust Fund, we have determined 
that the NPI, rather than the TIN, is more closely tied to the level of 
enrollment risk, and thus should be used in lieu of the TIN.
    In Sec.  424.57(d)(15) (proposed Sec.  457.57(c)(26)(ii)), we are 
creating an exception to the bond requirement for a DMEPOS supplier 
operated by a Federal, State, local, or tribal government agency if the 
DME supplier has provided CMS with a comparable surety bond required 
under State law.
    In the proposed rule, we stated that in order to satisfy this 
exception, a supplier must not have any unpaid claims, civil money 
penalties (CMPs), or assessments. We decided to remove this requirement 
from the final rule because we believe that the agency has adequate 
protection related to the financial status of government-operated 
DMEPOS supplier. Moreover, we want all of the exceptions to the surety 
bond requirement to be consistent for all supplier types.
    As already discussed in section III of this final rule, we are also 
creating an exception to the bond requirement for physicians and NPPs, 
as defined in section 1842(b)(18)(C) of the Act provided that the items 
are furnished only to the physician or NPP's own patients as part of 
his or her professional service. We believe that requiring physicians 
and NPPs to obtain a surety bond for items furnished for patients other 
than the practitioner's own patients is appropriate and consistent with 
the provisions previously established in accreditation and the 
legislative history of section 4312(a) of the BBA. Nonphysician 
practitioners listed in section 1842(b)(18)(C) of the Act include the 
following: PAs, NPs, clinical nurse specialists, certified nurse 
anesthetists, certified clinical social workers, clinical 
psychologists, and registered dietitian or nutrition professionals.
    We maintain that physicians and NPPs furnishing DMEPOS to someone 
other than the physician or NPP's own patients as part of his or her 
physician service are providing services as a medical supply company. 
Accordingly, we believe that physicians, including clinics and group 
practices, must obtain a surety bond if they are providing any DMEPOS 
items to someone other than the physician or NPP's own patient. This 
will ensure that physicians and NPPs meet the same quality and program 
safeguard standards as other DMEPOS suppliers who are not exempt from 
the bonding requirements found in Sec.  424.57(d).
    While it is true that the statutory exception identified in section 
1834(a)(16) of the Act for physicians and NPPs does not specifically 
delineate between physicians and NPPs who provide DMEPOS supplies to 
their own patients and those who furnish such supplies in a different 
setting, we believe that there is a clear distinction between these two 
scenarios in terms of what the Congress intended in enacting section 
1834(a)(16) of the Act. A physician or NPP who, for instance, furnishes 
DMEPOS supplies as part of her ownership of a DMEPOS supply company is 
not acting in her capacity as a practitioner who is providing ongoing 
care to a patient whom she is treating. Rather, the practitioner is 
operating his or her own side business. We do not believe that the 
Congress intended to allow a DMEPOS supply company to circumvent the 
surety bond requirement by hiring or contracting with a physician or 
NPP who can furnish DMEPOS supplies to the company's customers. To 
permit such a practice would be entirely inconsistent with the intent 
and spirit of section 1834(a)(16) of the Act. To ensure that this final 
rule conforms to the Congress's wishes, we have therefore limited the 
physician and NPP exception to those practitioners who furnish DMEPOS 
supplies only to their own patients.
    We are also creating an exception to the bond requirement for 
State-licensed orthotic and prosthetic personnel operating in private 
practice and who furnish only orthotics, prosthetics, and supplies. 
Orthotic and prosthetic personnel are not operating in private practice 
when another individual or entity is a part owner of the enrolled 
practice location.
    It is important to note that we believe that there is a clear 
distinction between a DMEPOS supplier enrolled as a State-licensed 
orthotic and prosthetic personnel operating in private practice and 
operating independently of a medical supply company or other DMEPOS 
supplier and orthotic and prosthetic personnel employed by medical 
supply company or co-owned with another individual or entity. Since 
medical supply companies can enroll as a DMEPOS supplier with or 
without employing State-licensed orthotic and prosthetic personnel, we 
do not believe that medical supply companies employing State-licensed 
orthotic and prosthetic personnel qualify for an exception because the 
owners of the medical supply company are responsible for the management 
and billing of products and services, not the State-licensed orthotic 
or prosthetic personnel. Similarly, we believe

[[Page 187]]

orthotic or prosthetic personnel are not operating independently when 
other individual or entity is a part owner of an enrolled DMEPOS 
supplier's practice location. Finally, as with physicians and NPPs, 
State-licensed orthotic and prosthetic personnel operating as a sole 
owner and operating in private practice risk their State license if 
they are found guilty of fraudulent or abusive behavior; whereas, a 
medical supply company can reorganize under new ownership and reapply 
to participate in the Medicare program. Finally, since all DMEPOS 
suppliers are required to be accredited to participate in the Medicare 
program by September 30, 2009, we do not believe that it is appropriate 
to establish an exception based solely on whether State-licensed 
orthotic or prosthetic personnel are accredited.
    As already discussed in section III of this final rule, we are also 
creating an exception to the bond requirement for State-licensed 
physical and occupational therapist operating in private practice 
provided that the therapist furnishes only orthotics, prosthetics and 
supplies and only to the therapist's own patients as part of the 
physical or occupational therapy service. State-licensed physical and 
occupational therapist are not operating in private practice when 
another individual or entity is a part owner of the enrolled practice 
location. Moreover, a State-licensed physical and occupational 
therapist furnishing DMEPOS to someone other than the therapist's own 
patients as part of the physical or occupational therapy service is not 
exempt from the surety bond requirement.
    It is important to note that we believe that there is a clear 
distinction between a DMEPOS supplier enrolled as a State-licensed 
physical and occupational therapist operating in private practice and 
operating independently of a medical supply company or other DMEPOS 
supplier and a State-licensed physical and occupational therapist 
employed by a medical supply company or co-owned with another 
individual or entity. Since medical supply companies can enroll as a 
DMEPOS supplier with or without employing State-licensed physical and 
occupational therapists, we do not believe that medical supply 
companies employing State-licensed physical and occupational therapists 
qualify for an exception because the owners of the medical supply 
company are responsible for the management and billing of products and 
services, not the State-licensed physical and occupational therapists. 
Similarly, we believe State-licensed physical and occupational 
therapists are not operating independently when another individual or 
entity is a part owner of an enrolled DMEPOS supplier's practice 
location. Finally, as with physicians and NPPs, State-licensed physical 
and occupational therapists operating as a sole owner and operating in 
private practice risk their State license if they are found guilty of 
fraudulent or abusive behavior; whereas, a medical supply company can 
reorganize under new ownership and reapply to participate in the 
Medicare program. Since all DMEPOS suppliers are required to be 
accredited to participate in the Medicare program by September 30, 
2009, we do not believe that it is appropriate to establish an 
exception based solely on whether State-licensed physical and 
occupational therapists are accredited.
    In Sec.  424.57(d)(4)(ii) (proposed Sec.  424.57(c)(26)(iii)(B)), 
we require that DMEPOS suppliers obtain a surety bond of more than 
$50,000 if the DMEPOS supplier poses a significantly higher than 
average risk to the Medicare Trust Funds by establishing elevated 
amounts of surety bonds for higher risk DMEPOS suppliers. We are 
establishing elevated amounts of the surety bond at a rate of $50,000 
per occurrence when a DMEPOS supplier, has an adverse legal action. The 
term ``adverse legal action'' is defined in Sec.  424.57 and means a 
Medicare-imposed revocation of any Medicare billing number; suspension 
of a license to provide health care by any State licensing authority; 
revocation or suspension of accreditation; a conviction of a Federal or 
State felony offense within the last 10 years preceding enrollment, 
revalidation, or re-enrollment; or an exclusion or debarment from 
participation in a Federal or State health care program.
    We maintain that these adverse legal actions create a significantly 
higher level of risk to the Medicare Trust Fund. Moreover, these 
adverse legal actions are consistent with the denial and revocation 
reasons found in Sec.  424.530 and Sec.  424.535, respectively.
    The following is an example of how high-risk criteria would be used 
to increase the bond amount by $50,000 per occurrence. A DMEPOS 
supplier would be required to obtain a surety bond in the amount of 
$100,000, an increase of $50,000 from the base surety bond amount of 
$50,000, if the DMEPOS supplier or any of its owners, authorized 
officials, or delegated officials (as the terms ``owner,'' ``authorized 
official,'' and ``delegated official,'' are defined in Sec.  424.502) 
had their Medicare billing privileges revoked within the 10 years 
preceding enrollment, revalidation, or reenrollment. If the DMEPOS 
supplier or any of its owners, authorized officials, delegated 
officials had more than one revocation in the last 10 years, then the 
amount of the surety bond the DMEPOS supplier would be required to 
obtain would increase $50,000 per occurrence. Thus, a DMEPOS supplier 
with three different revocations during the preceding 10 years would be 
required to obtain a surety bond in the amount of $200,000; $50,000 for 
the base surety amount and $150,000 (3 x $50,000) for the multiple 
revocations. We are also establishing a provision to require DMEPOS 
suppliers that have a significantly higher level of risk to maintain a 
higher surety bond amount for 3 years.
    As explained earlier, we believe that a final adverse action, as 
specified in section 221(g)(1)(A) of the HIPAA, occurs when the action 
is imposed, not when a DMEPOS supplier has exhausted all of its appeal 
rights associated with the final adverse action.
    In Sec.  424.57(d)(5) (proposed Sec.  424.57(c)(26)(iv)), we 
specify additional DMEPOS supplier bond requirements and the surety's 
liability under the bond for unpaid claims, CMPs, or assessments up to 
a total of the full penal amount of the bond. Regardless of the number 
of years the bond is in force, the number of premiums paid, or the 
number of claims made, the surety's aggregate liability shall not be 
more than the penal sum stated above. Thus, for instance, we proposed 
that surety bonds be issued in an amount equal to $50,000; and the 
surety is liable to us for up to $50,000.
    In Sec.  424.57(d)(6) (proposed Sec.  424.57(c)(26)(v)), we are 
revising this provision to include that the surety may terminate its 
liability for future acts of the principal at any time by giving 30 
days written notice of termination of the bond of the obligee. Also, a 
supplier or surety may not place any limitations on the surety bond 
that contradict or nullify the requirements for a surety bond 
specifically provided for in this section. Any attempt to do so may 
result in revocation of the DMEPOS supplier's billing privileges and a 
determination that the surety is an unauthorized surety.
    In Sec.  424.57(d)(4) (proposed Sec.  424.57(c)(26)(viii)(B)), we 
are revising this provision to specify that the type of bond required 
to be submitted by a DMEPOS supplier under this subpart is a continuous 
bond. While we are not defining the term, ``continuous'', we believe 
that the term, ``continuous'' means that the surety bond will renew 
automatically from year to year unless the bond is cancelled by surety 
or the DMEPOS supplier or the DMEPOS supplier fails to pay the premium.

[[Page 188]]

    In Sec.  424.57(d)(15) (proposed Sec.  424.57(c)(26)(ix)), we 
specify the circumstances under which a supplier will no longer be 
exempt from the surety bond requirement and must submit a surety NSC 
within 60 days after it receives notice that it no longer meets the 
criteria for an exception. Specifically, we maintain that a government-
operated supplier that ceases to be operated by a government does not 
qualify for an exception must submit a surety bond; a physician or NPP 
who provides DMEPOS to beneficiaries other than his or her own 
patients; State-licensed orthotic or prosthetic personnel in private 
practice or physical or occupational therapists in private practice 
have their State license suspended or revoked; or otherwise no longer 
qualify for the exceptions described in paragraph (d).

V. Collection of Information Requirements

    Under the Paperwork Reduction Act of 1995 (PRA), we are required to 
provide a 30-day notice in the Federal Register and solicit public 
comment before a collection of information requirement is submitted to 
the Office of Management and Budget (OMB) for review and approval. In 
order to fairly evaluate whether an information collection should be 
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act 
of 1995 requires that we solicit comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency.
     The accuracy of our estimate of the information collection 
burden.
     The quality, utility, and clarity of the information to be 
collected.
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    We solicited public comment on each of the following issues 
pertaining to the information collection requirements discussed in this 
final rule.

Special Payment Rules for Items Furnished by DMEPOS Suppliers and 
Issuance of DMEPOS Supplier Billing Numbers (Sec.  424.57)

    Section 424.57(d) outlines the surety bond requirements for DMEPOS 
suppliers. Specifically, Sec.  424.57(d) states that each Medicare-
enrolled DMEPOS supplier must obtain and furnish to the National 
Supplier Clearinghouse (NSC) a surety bond in the amount of $50,000. 
The bond must be obtained from an authorized surety, and must be 
submitted for each NPI obtained by a Medicare enrolled DMEPOS supplier.
    Section 424.57(d)(2) outlines the minimum requirements for a DMEPOS 
supplier seeking to become a Medicare-enrolled DMEPOS supplier. Section 
424.57(d)(2)(i) (proposed Sec.  424.57(c)(26)(i)(A)) requires a DMEPOS 
supplier that seeks to become a Medicare-enrolled supplier, to make a 
change in ownership, or to respond to a revalidation or reenrollment 
request to submit a surety bond of $50,000 with its paper or electronic 
Medicare enrollment application (Form CMS-855S). Section 
424.57(d)(2)(ii) (proposed Sec.  424.57(c)(26)(i)(B)) states that a 
DMEPOS supplier seeking to become an enrolled supplier through the 
purchase or transfer of assets must provide a surety bond that is 
effective from the date of the purchase or transfer in order to 
exercise billing privileges as of that date. If the bond is effective 
at a later date, the effective date of the new DMEPOS supplier number 
will be effective no sooner than the effective date of the surety bond 
as validated by the NSC.
    Section 424.57(d)(2)(iii) (proposed Sec.  424.57(c)(26)(i)(C)) 
requires a DMEPOS supplier that is seeking to enroll a new location 
under a TIN for which it already has a DMEPOS surety bond in place to 
either obtain a new surety bond or to submit an amendment or rider to 
the existing surety bond.
    Section 424.57(d)(4)(ii) (proposed Sec.  424.57(c)(26)(iii)(B)) 
states that in addition to obtaining and maintaining a base surety bond 
in the amount of $50,000, a DMEPOS supplier must also obtain and 
maintain an elevated surety bond in the amount prescribed by the NSC.
    For those aforementioned requirements that are not already approved 
under OMB control number 0938-0685, we estimate the burden associated 
with the requirements in Sec.  424.57(d)(2)(proposed Sec.  
424.57(c)(26)(i) and (iii)) to be 3 hours per DMEPOS supplier. In 
addition, we estimate that approximately 67,723 DMEPOS suppliers will 
comply with these requirements. Therefore, the estimated total annual 
burden is 203,169 hours.
    Section 424.57(d)(6) (proposed Sec.  424.57(c)(26)(v)) also states 
that a surety bond may be cancelled with written notice from the DMEPOS 
supplier to the NSC. The burden associated with this requirement is the 
time and effort necessary for either DMEPOS supplier to draft and 
submit the notice of cancellation to the NSC. We estimate the burden 
associated with this requirement to be 3 hours. In addition, we 
anticipate that 250 suppliers will draft and submit the necessary 
documentation. We estimate the total annual burden to be 750 hours.
    Section 424.57(d)(15)(ii) (proposed Sec.  424.57(c)(26)(ix)) 
requires a DMEPOS supplier, other than physicians and NPPs, as defined 
in section 1842(b)(18)(C) of the Act, that no longer qualifies for an 
exception under this final rule to submit a surety bond to the NSC 
within 60 days of receiving notice that it no longer qualifies for a 
exception. The burden associated with this requirement is the time and 
effort necessary for the DMEPOS supplier to obtain and submit a surety 
bond to the NSC within 60 days of receiving notice that it no longer 
qualifies for a exception. We estimate the burden associated with this 
requirement to be 3 hours. In addition, we anticipate that 100 
suppliers will draft and submit the necessary documentation. We 
estimate the total annual burden to be 300 hours.
    Section 424.57(d)(9) (proposed Sec.  424.57(c)(26)(x)) requires a 
DMEPOS supplier that obtains a replacement surety bond from a different 
surety to cover the remaining term of a previously obtained bond to 
submit the new surety bond to the NSC within 30 days of expiration of 
the previous bond. The burden associated with this requirement is the 
time and effort necessary to obtain and submit the new surety bond to 
the NSC. We estimate the burden associated with this requirement to be 
3 hours. In addition, we anticipate that 250 suppliers will comply with 
this requirement. We estimate the total annual burden to be 750 hours.
    Section 424.57(d)(12) (proposed Sec.  424.57(c)(26)(xiii)) states 
that CMS may at any time require a DMEPOS supplier to show compliance 
with the requirements associated with 42 CFR part 424. The burden for 
this requirement is the time and effort associated with maintaining the 
necessary documentation on file. While this requirement is subject to 
the PRA, we believe the burden is exempt as stated in 5 CFR 
1320.3(b)(2) because the time, effort, and financial resources 
necessary to comply with the requirement would be incurred by persons 
in the normal course of their activities.
    However, the burden associated with producing the documents upon 
request from CMS is estimated to be 30 minutes per DMEPOS supplier. We 
estimate that 500 DMEPOS suppliers will be asked to submit the 
requested documentation. The total annual burden associated with this 
requirement is estimated to be 250 hours.

[[Page 189]]

    The following is a summary of the comments received on the 
collection of information section and our responses.
    Comment: A commenter stated that the suggested burden in the August 
1, 2007 proposed rule for DMEPOS suppliers to obtain and keep a surety 
bond is too low in terms of hours and dollars. The commenter stated 
that obtaining all the information and attachments in an effort to 
obtain a bond will more than likely require 2 to 4 hours per 
application. The commenter also noted that a DMEPOS supplier may have 
to submit many applications in order to secure a surety bond, that it 
may have to deal with bankers and accountants to obtain the bond, and 
that it may have to borrow money in order to pay for the bond.
    Response: We appreciate this comment and have revised our 
Collection of Information estimates accordingly.
    Comment: A commenter stated that the surety bond requirement will 
increase DMEPOS suppliers' cost and paperwork burden without 
accomplishing the Congress's and our goals. The commenter stated that 
sureties issuing financial guarantee bonds would be more likely to 
review a DMEPOS supplier's books and might request audited financial 
statements. Since most small suppliers do not have audited financial 
statements, the commenter stated that this requirement could pose a 
serious hurdle to their compliance. In addition, the commenter 
maintained that sureties would be more likely to ask for collateral to 
secure the issuance of a financial guarantee bond, and that sureties 
would likely favor highly liquid collateral such as letters of credit, 
which would require suppliers to incur an additional expense. Many 
commenters believe that this type of review is sensible when it is 
applied to DMEPOS suppliers that are new to the Medicare program, but 
not to established DMEPOS suppliers.
    Response: We appreciate the concerns of the commenters, but 
continue to believe that surety bonds will serve as an effective 
deterrent to fraud and abuse, as well as provide the Medicare program 
with recourse when a supplier fails to pay claims against it, CMPs, or 
assessments.
    Comment: A commenter stated that the cost and burden of the surety 
bond requirement will have a disproportionate impact on small DMEPOS 
suppliers. To ensure that small DMEPOS suppliers participate in the 
DMEPOS program if this final rule is implemented, the commenter stated 
that we should work with the SBA to extend low or no interest loans to 
qualified small DMEPOS suppliers for the express purpose of obtaining a 
surety bond.
    Response: We do not have the authority to issue these types of 
loans to those DMEPOS suppliers that qualify as small businesses.

                          Table 2--Estimated Annual Reporting and Recordkeeping Burden
----------------------------------------------------------------------------------------------------------------
                                                                                    Burden per
    Regulation section(s)             OCN            Number of       Number of       response      Total annual
                                                    respondents      responses        (hours)      burden  hours
----------------------------------------------------------------------------------------------------------------
Sec.   424.57(d)(2)(i).......  0938-New.........           2,000           2,000             3.0           6,000
Sec.   424.57(d)(2)(ii)......  0938-New.........          65,723          65,723             3.0         197,169
Sec.   424.57(d)(6)..........  0938-New.........             250             250             3.0             750
Sec.   424.57(d)(9)..........  0938-New.........             250             250             3.0             750
Sec.   424.57(d)(12).........  0938-New.........             500             500             0.5             250
Sec.   424.57(d)(15)(ii).....  0938-New.........             100             100             3.0             300
                              ----------------------------------------------------------------------------------
    Total....................  .................  ..............  ..............  ..............         205,219
----------------------------------------------------------------------------------------------------------------

    We submitted a copy of this final rule to the OMB for its review of 
the information collection requirements. These information collection 
requirements are not effective until approved by OMB.

VI. Regulatory Impact Analysis

A. Overall Impact

    We have examined the impacts of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993, as 
further amended), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, 
section 202 of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-
4), Executive Order 13132 on Federalism (August 4, 1999), and the 
Congressional Review Act (5 U.S.C. 804(2)).
    Executive Order 12866 (as amended by Executive Order 13258) directs 
agencies to assess all costs and benefits of available regulatory 
alternatives and, if regulation is necessary, to select regulatory 
approaches that maximize net benefits (including potential economic, 
environmental, public health and safety effects, distributive impacts, 
and equity). A regulatory impact analysis (RIA) must be prepared for 
major rules with economically significant effects ($100 million or more 
in any 1 year).
    The August 1, 2007 proposed rule was classified as economically 
significant, as the estimated annual cost of the surety bond 
requirement at that time was $198 million. This was based largely on a 
preliminary estimation that 99,000 DMEPOS suppliers would need to 
obtain a surety bond in the amount of $65,000, at an annual cost of 
$2,000. As explained below, the establishment of a number of exceptions 
to the surety bond requirement, the reduction in both the bond amount 
and its cost, and the utilization of more current data in this final 
rule, has reduced the projected annual cost of the surety bond 
requirement from $198 million to $102.3 million. Accordingly, this 
final rule is considered economically significant.
    The RFA requires agencies to analyze the economic impacts of the 
regulation and alternatives for the regulatory relief of small 
businesses. For purposes of the RFA, small entities include small 
businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
$6.5 million to $31.5 million in any 1 year.
    The RFA requires that a Regulatory Flexibility Analysis be 
conducted for all regulations that will have a ``significant economic 
impact on a substantial number of small entities.'' As already 
explained, we believe that the principal economic impact of this rule 
will fall on large, publicly traded chain pharmacies. Such 
organizations may have to expend several hundred thousand dollars to 
obtain surety bonds for each of their locations. However, even if we 
were to assume that each individual location--

[[Page 190]]

if considered as a stand-alone business--qualifies as a small entity, 
we do not believe that the annual cost of a surety bond ($1,500) would 
have an economic impact on it that rises to the level of qualifying as 
``significant.'' The RFA generally defines ``significant'' as several 
percent; we do not believe that a $1,500 cost would constitute more 
than one percent of a chain pharmacy location's annual revenues. From 
that perspective, we do not believe that a Regulatory Flexibility 
Analysis is required.
    We recognize that the cost of a surety bond may impact smaller 
pharmacies, such as single-site community pharmacies, as well as small 
medical supply companies in rural areas to a greater extent than large 
chain pharmacies. Though we do not believe that, at least in the case 
of community pharmacies, the bond requirement will have a significant 
economic impact on such businesses, we have elected to prepare a 
voluntary Final Regulatory Flexibility Analysis. As many of the 
requirements of the RFA are also contained in our Regulatory Impact 
Analysis, this Regulatory Impact Analysis section, taken together with 
the remainder of the preamble, constitutes the Final Regulatory 
Flexibility Analysis.
    In addition, section 1102(b) of the Act requires us to prepare a 
regulatory impact analysis if a rule may have a significant impact on 
the operations of a substantial number of small rural hospitals. This 
analysis must conform to the provisions of section 604 of the RFA. For 
purposes of section 1102(b) of the Act, we define a small rural 
hospital as a hospital that is located outside of a Metropolitan 
Statistical Area and has fewer than 100 beds. We are not preparing a 
rural impact statement since we have determined, and certify, that this 
final rule would not have a significant impact on the operations of a 
substantial number of small rural hospitals. Our research has disclosed 
that well under 1 percent of a typical small rural hospital's total 
annual reimbursement from Medicare would come from its enrollment as a 
DMEPOS supplier. Equipment furnished in hospitals is generally paid for 
as part of the facility's direct or ancillary costs, rather than in the 
hospital's capacity as a DMEPOS supplier. This is buttressed by the 
fact that less than four-tenths of one percent of all DMEPOS suppliers 
are hospitals.
    Section 202 of the Unfunded Mandates Reform Act (UMRA) of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. That threshold 
is currently $130 million. This final rule does not contain mandates 
that will impose spending costs on State, local, or tribal governments, 
in the aggregate, or on the private sector, of $130 million or greater; 
as previously mentioned, we estimate that the maximum annual cost of 
this final rule will be $102.3 million. Accordingly, we are furnishing 
the aforementioned assessment in this final rule.
    Executive Order 13132 established certain requirements that an 
agency must meet when it issues a final rule that imposes substantial 
direct requirement costs on State and local governments, preempts State 
law, or otherwise has Federalism implications. We have reviewed this 
rule under the threshold criteria of Executive Order 13132 and have 
determined that it does not significantly affect the rights, roles, and 
responsibilities of States.
    The following is a summary of the comments received on the proposed 
rule's regulatory impact analysis and our responses.
    Comment: Some commenters stated that the surety bond requirement 
would mandate each Medicare-enrolled DMEPOS supplier to obtain a surety 
bond for each National Provider Identifier (NPI) the supplier holds, 
and that, under the provisions of the August 1, 2007 proposed rule, 
this requirement would be applied to all DMEPOS suppliers to the same 
extent. Commenters maintained that large, publicly traded DMEPOS chain 
suppliers and community pharmacies have numerous locations and NPIs. As 
a result, commenters stated that our surety bond requirement is not 
only over-inclusive but also unnecessary and unduly burdensome on these 
types of suppliers. Some commenters describe this requirement as 
punitive. To ensure that large, publicly traded chain DMEPOS suppliers 
are not unduly burdened, another commenter urged us to consider 
establishing a maximum or cap on the aggregate dollar amount of the 
surety bonds required for these high volume suppliers. Yet another 
commenter maintained that, if we do not establish an exception to the 
surety bond regulation for large, publicly traded companies that 
provide DMEPOS services, then we should allow a company with multiple 
locations that provide DMEPOS services to obtain one surety bond. The 
commenters stated that requiring this type of company to obtain 
multiple bonds is redundant and greatly increases the cost of doing 
business with the Medicare program.
    Response: As previously stated, we are not establishing an 
exception to the surety bond requirement for publicly traded chain 
DMEPOS suppliers or community pharmacies, for there is nothing in 
section 4312(a) of the BBA or its legislative history that evidences a 
congressional intent to do so. Moreover, we disagree with the comment 
that we should not establish the surety bond at the NPI level, since 
the NPI is established by practice location for all DMEPOS suppliers 
except for those operating as a sole proprietorship.
    Comment: One commenter stated that one way to equalize the burden 
on large DMEPOS suppliers is to require them to pay us a specified 
amount in lieu of a surety bond. The commenter stated that the amount 
could be the average cost of the bond for the previous year. The 
commenter called this option a ``bond waiver fee.'' The commenter 
believes that this approach would, among other things, keep unnecessary 
funds from going to sureties rather than taxpayers.
    Response: We do not have the statutory authority to establish a 
bond waiver fee.
    Comment: Several commenters stated that the surety bond requirement 
could have a devastating impact on Medicare beneficiaries needing these 
DMEPOS supplies. The commenters urged us to ensure that beneficiary 
access to DMEPOS services is not jeopardized as a result of the 
potentially large number of DMEPOS suppliers that may not enroll or 
discontinue their enrollment due to the financial burden the surety 
bond requirement may impose.
    Response: We believe that the exceptions established in this final 
rule will help ensure that beneficiary access to DMEPOS supplies 
continues unabated. In addition, while we expect some DMEPOS suppliers 
to exit the Medicare program due to the surety bond requirement, we 
expect that other suppliers will enter the Medicare program as 
suppliers become acquainted with the new accreditation and surety bond 
requirements.
    Comment: One commenter stated that many small towns have only a few 
DMEPOS suppliers, and that a number of those suppliers will not find 
obtaining a surety bond economical.
    Response: We understand the potential impact that this final rule 
may have on small DMEPOS suppliers and have revised the regulatory 
impact accordingly.
    Comment: One commenter stated that our assumption that most, if not 
all, of the Medicare business conducted by DMEPOS suppliers that 
withdraw from the DMEPOS program due to this final rule would be 
assumed by other

[[Page 191]]

DMEPOS suppliers remaining in the program (for example, by mail order 
or via the World Wide Web) is flawed. The commenter stated that, if 
DMEPOS suppliers in the power mobility industry withdraw from the 
DMEPOS program as a result of this final rule, the assumption that mail 
order DMEPOS suppliers would assume their Medicare business would be 
inappropriate. The commenter stated that DMEPOS suppliers in the power 
mobility industry are required to conduct an in-home assessment, which 
would make Internet or nationwide mail order DMEPOS suppliers a 
nonviable substitute for DMEPOS suppliers in the power mobility 
industry. Other commenters maintained that we should not assume that 
these suppliers can satisfactorily meet the needs of all Medicare 
beneficiaries.
    Response: If DMEPOS suppliers of a particular type of DMEPOS indeed 
exit the Medicare program upon implementation of this final rule, we 
believe that the remaining DMEPOS suppliers would offer the products 
and services similar to those of the exiting DMEPOS suppliers. As 
stated above, by delaying the implementation of the surety bond 
requirement for existing DMEPOS suppliers until 9 months after the 
effective date of this final rule, and establishing exemptions for 
certain DMEPOS suppliers, we believe that remaining DMEPOS suppliers 
will adjust to meet an increased demand for products and services.
    Comment: One commenter stated that the surety bond requirement 
would unfairly penalize home health or home infusion companies that 
provide DMEPOS. The commenter questioned why the surety bond 
requirement would extend to these companies since the commenter 
maintains that CMS has stated that ``the problem is not with home 
infusion providers.''
    Response: We disagree with this commenter because the intent of a 
surety bond is, among other goals, to make sure that all DMEPOS 
suppliers meet more stringent financial requirements before being 
permitted to participate in the Medicare program.
    Comment: A commenter noted that we stated in the August 1, 2007 
proposed rule that the surety bond requirement could cause 
approximately 15,000 DMEPOS suppliers to decide to cease providing 
items to Medicare beneficiaries. However, the commenter believes that 
this figure is likely underestimated.
    Response: We have revised the regulatory impact to account for the 
changes incorporated into this final rule.
    Comment: Some commenters stated that we need to improve the 
regulatory impact analysis from the August 1, 2007 proposed rule. The 
commenters stated that the August 1, 2007 proposed rule violates 
Executive Order 12866, which directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if the regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). Commenters also maintained, 
among other things, that we did not design the proposed rule in the 
most cost effective manner to achieve the regulatory objective, and 
that the regulation failed to take into account the cost of cumulative 
regulations, such as the accreditation process for DMEPOS suppliers, 
and its impact on patient care.
    Response: While we disagree that the regulatory impact analysis in 
the proposed rule was in violation of Executive Order 12866, we have 
revised the regulatory impact analysis to address the concerns 
expressed.
    Comment: Several commenters stated that we did not provide an 
analysis of the percentage of the industry that is contributing to 
Medicare fraud. Commenters also indicated that we overlooked many of 
the Regulatory Flexibility Act (RFA) requirements because we failed to 
address obvious alternatives that would minimize any significant impact 
of the proposed rule on small entities, including discussion of 
significant alternatives, such as an exemption from coverage of the 
rule, or any part thereof, for these small entities. The commenters 
stated that it is not clear from the RFA whether we intended for 
information in the regulatory impact analysis to serve as an initial 
regulatory flexibility analysis for the purposes of the RFA. Commenters 
indicated that our intent should be made clear in this final rule.
    Response: We have revised the regulatory impact analysis to address 
the concerns expressed.
    Comment: Several commenters believed that our economic analysis is 
incomplete. Specifically, although we provided information on the 
number of small DMEPOS suppliers that would likely be impacted by the 
surety bond requirement, commenters observed that our regulatory impact 
analysis offers little analysis of how the rule will economically 
impact small DMEPOS suppliers. For example, commenters noted that the 
analysis does not provide any information on the cost of complying with 
the surety bond requirement based on the size of the DMEPOS supplier.
    Response: We have revised our economic analysis to address the 
concerns expressed.
    Comment: One commenter stated that the August 1, 2007 proposed rule 
fails to conform to the Office of Management and Budget's (OMB) 
standards for analyzing regulations, which are set forth in OMB 
Circular A-4. The commenter observed that OMB Circular A-4 indicates 
that a regulatory impact analysis should analyze a manageable number of 
alternatives, including different enforcement methods and different 
degrees of stringency. According to the commenter, the proposed rule 
does not present this type of analysis, and the ``Alternatives 
Considered'' section in the preamble under ``Regulatory Impact 
Analysis'' neither presents nor analyzes any alternatives whatsoever.
    Response: We disagree with the commenter that the proposed rule 
does not comply with OMB Circular A-4. Nevertheless, as already stated, 
we have revised the impact analysis based on comments we received in 
response to the August 1, 2007 proposed rule.
    Comment: One commenter believes that the cost/benefit analysis of 
the August 1, 2007 proposed rule appears heavily weighted on the cost 
side. The commenter stated that the August 1, 2007 proposed rule 
estimates that 1,000 suppliers would be asked for bond documentation. 
If all of these suppliers required payment to Medicare from the surety, 
this amounts only to $65,000,000 even though suppliers are being asked 
to potentially pay almost $200,000,000 per year.
    Response: As previously stated, we have reviewed and revised our 
regulatory impact analysis in this final rule to address matters such 
as those raised by the commenter.
    Comment: A commenter stated that the August 1, 2007 proposed rule 
provides a confusing array of data with respect to the number of DMEPOS 
suppliers that would be affected by the surety bond requirement. For 
example, in the impact analysis section, in estimating the costs of 
obtaining surety bonds, the commenter stated that we assume that 
approximately 99,000 suppliers will be involved and that the average 
annual cost of a bond will be $2,000. However, in the section of the 
proposed rule summarizing the collection of information requirements, 
the commenter noted that we estimate that approximately 116,500 DMEPOS 
suppliers will comply with the surety bond requirement.

[[Page 192]]

    Response: As previously stated, we have reviewed and revised our 
regulatory impact analysis in this final rule to address matters such 
as those raised by the commenter.
    Comment: One commenter stated that the August 1, 2007 proposed rule 
requires DMEPOS suppliers to have their financial statements audited 
each year. The commenter noted that many DMEPOS suppliers have external 
firms audit their annual financial statements. The commenter believed 
that the annual cost for DMEPOS suppliers to audit financial statements 
would be exorbitant and would exceed the original intent of the surety 
bond requirement.
    Response: While we agree that a surety may require that a supplier 
provide audited financial statements as part of the surety's review and 
evaluation process, we did not propose, nor does this final rule adopt, 
provisions that require a DMEPOS supplier to have its financial 
statements audited on an annual basis.
    Comment: Many commenters indicated that some DMEPOS suppliers are 
already required by State or Federal entities (for example, Medicaid) 
to obtain a surety bond at an approximate cost of $2,000 annually in 
order to provide DMEPOS to consumers. The commenters stated that it 
would be a financial burden to pay for both their current surety bond 
and a surety bond that comports with this final rule.
    Response: The non-Medicare surety bond to which the commenter 
refers covers financial losses associated with those other medical 
programs. We believe that by adopting a surety bond requirement, we 
will protect the Medicare program and its beneficiaries from 
unscrupulous suppliers or suppliers who lack the financial resources to 
operate a legitimate business organization. We note that we have 
already exempted government-operated DMEPOS suppliers who have a 
comparable surety bond under State law from the surety bond 
requirement. Besides already possessing a surety bond under State law, 
government-operated DMEPOS suppliers are financially more secure than 
other DMEPOS suppliers because of their ability to tax. Therefore, we 
have exempted them from the surety bond requirement.
    Comment: Several commenters stated that although DMEPOS account for 
only a small part of Medicare spending, we are trying to reduce 
reimbursement to DMEPOS suppliers even further through this final rule. 
One commenter suggested that the surety bond requirement is another CMS 
rule that is designed to put small DMEPOS suppliers out of business.
    Response: We disagree with the assertion that the rule is designed 
to push small DMEPOS suppliers out of the Medicare program. It is true 
that we believe it is essential to implement the DMEPOS surety bond 
requirement to reduce fraud and abuse in the Medicare program and to 
protect Medicare beneficiaries from unscrupulous suppliers. However, we 
note that a number of the exceptions to the bond requirement will apply 
to small suppliers, such as physician offices. We believe this achieves 
an appropriate balance between the need to protect the Medicare Trust 
Fund and our interest in maintaining the presence of small suppliers in 
the Medicare program.
    Comment: One commenter observed that the January 28, 1998 proposed 
rule sought to require a DMEPOS supplier to obtain a surety bond for 
every TIN under which a supplier billing number was issued. Under this 
proposal, a DMEPOS supplier with more than one location would have been 
required to obtain only a single surety bond. The commenter stated it 
would be unreasonable for us to now require a DMEPOS supplier with more 
than one location to obtain more than one surety bond. Therefore, the 
commenter urged us to require DMEPOS suppliers to obtain a surety bond 
for each TIN or ``some comparable level of `aggregation' '' rather than 
for each supplier location or NPI. This would minimize the negative 
impact of the requirement.
    Other commenters stated that we do not adequately provide the 
reasoning behind the transition from the TIN to the NPI and do not 
analyze the impact of the decision on the DMEPOS industry.
    Response: We note that the NPI was not implemented back in 1998, 
which is why the TIN was used instead. In fact, the HIPAA 
Administrative Simplification Standard Unique Health Identifier for 
Health Care Providers; Final Rule, commonly referred to as the National 
Provider Identifier; Final Rule, was not published until January 23, 
2004. With NPIs now the standard for identifying suppliers and their 
subparts, and in light of the fact that each DMEPOS practice location 
must enroll separately in the Medicare program (note there is an 
exception for sole proprietorships), we believe it is appropriate for a 
separate surety bond to be required for each practice location or NPI 
obtained for DMEPOS billing purposes. This will provide CMS, the NSC, 
and law enforcement an easy method to identify ownership, to determine 
whether adverse legal actions have been previously imposed, and to 
determine the value of the bond that each DMEPOS supplier must obtain 
and maintain in order to participate in the Medicare program. It is 
also important to remember that the greater the number of NPIs a 
supplier organization has, the proportionately more practice locations 
the organization tends to have and, in turn, the larger the amount of 
Medicare funds for which it tends to bill. Since each of these factors 
can enhance the overall risk to the Medicare Trust Fund, we have 
determined that the NPI, rather than the TIN, is more closely tied to 
the level of enrollment risk, and thus, should be used in lieu of the 
TIN.
    Comment: A commenter stated that the MMA makes clear that the 
Congress had great concerns about the impact of remedial legislation on 
small DMEPOS suppliers. For example, section 154 of the MMA required 
CMS to give special attention to developing a competitive bidding 
program to ensure that small suppliers are not driven from the market 
by a system that gives a competitive advantage to larger or national 
DMEPOS suppliers. The commenter also stated that the surety bond 
requirement undermines the Congressional intent, and thus places 
smaller DMEPOS suppliers at a competitive disadvantage.
    Response: We disagree with the commenter. While our competitive 
bidding program for DMEPOS suppliers, which the implementation has been 
delayed by the MIPPA as previously noted in this final rule, did 
include protections for small businesses to participate in this 
program, we do not agree that the Congress intended that all small 
suppliers of DMEPOS be exempt from the surety bond requirement 
specified in section 4312(a) of the BBA. In addition, since almost all 
DMEPOS suppliers are considered small businesses by the Small Business 
Administration (SBA) definition, it is not practical to establish an 
exception for DMEPOS suppliers based on revenue alone.

B. Existing DMEPOS Suppliers

1. Number Participating
    The National Supplier Clearinghouse (NSC) issues 10-digit NSC 
supplier numbers to suppliers that bill Medicare for DMEPOS items and 
services. Some DMEPOS suppliers operate at multiple locations while 
others operate at a single location. Suppliers that are part of a 
single firm share the first 6 digits of the 10-digit NSC supplier 
number, with the last 4 digits set equal to 0001, 0002, and so on, to 
denote individual locations. In the following discussion,

[[Page 193]]

we will refer to the first 6 digits as the ``6-digit NSC supplier 
number'' to represent individual suppliers, while the 10-digit number 
represents individual supplier locations.
    This distinction is important for the impact analysis because: (1) 
DMEPOS suppliers, except sole proprietorships, are required to obtain a 
distinct NPI for each enrolled DMEPOS practice location, and in this 
final rule we have adopted the NPI as the basis for obtaining a surety 
bond; and (2) accreditation organizations generally charge one fee for 
a supplier's first location, and a lower fee for subsequent locations. 
Some of the accreditation organizations also offer lower accreditation 
fees to small suppliers, which typically have few locations.
    In March 2008, there were 113,154 unique 10-digit NSC numbers and 
approximately 58,000 unique 6-digit NSC numbers. Our review indicates 
that there are approximately 50 Medicare-enrolled DMEPOS suppliers that 
are both sole proprietorships and have multiple locations. Therefore, 
we estimate that the total number of NPIs currently associated with 
Medicare-enrolled DMEPOS suppliers is only very slightly less than the 
total number of 10-digit NSC numbers. For purposes of this impact 
analysis, we will assume that there are 113,000 NPIs associated with 
Medicare-enrolled DMEPOS suppliers. Unless noted otherwise, this impact 
analysis will be based on the NPI, rather than the 6-digit or 10-digit 
NSC number.
    In addition, unless otherwise stated, the term ``supplier'' refers 
to an individually-enrolled location with its own NPI; for purposes of 
our discussion, therefore, we will assume that there are approximately 
113,000 DMEPOS suppliers--one for each unique NPI.
    Table 3 identifies the principal categories of DMEPOS suppliers and 
the number of suppliers within each category as of September 2008. Note 
that because a DMEPOS supplier may fall into multiple categories, the 
number of suppliers listed below significantly exceeds the actual 
number of suppliers--113,000--that are enrolled in Medicare. Hence, one 
should not assume, for instance, that there are 54,000 pharmacies 
enrolled in Medicare; we estimate that the actual figure is 
approximately 45,000.

Table 3--Categories of DMEPOS Suppliers as of September 2008 (Denoted by
                                  NPI)
------------------------------------------------------------------------
                                                             Number of
                  DMEPOS supplier type                       suppliers
------------------------------------------------------------------------
Pharmacies..............................................          54,000
Physicians (including Podiatrists and Optometrists).....          30,700
Medical Supply Companies with Orthotic Personnel,                 16,600
 Prosthetic Personnel, Registered Pharmacist, or
 Respiratory Therapist..................................
Medical Supply Companies without Orthotic Personnel,              16,100
 Prosthetic Personnel, Registered Pharmacist, or
 Respiratory Therapist..................................
Opticians...............................................          13,500
Oxygen and Equipment Suppliers..........................          12,400
Orthotic and Prosthetic Personnel.......................          10,800
Grocery or Department Stores............................           7,000
Nursing Facilities......................................           4,000
Independently Practicing/Billing Physical Therapists and           2,000
 Occupational Therapists................................
Other...................................................           1,500
------------------------------------------------------------------------

2. Reimbursement
    Table 4 contains information that identifies the amount of 
reimbursement allowed to DMEPOS suppliers in 2005. The statistics are 
based on the number of 6-digit NSC numbers at that time, or 65,984.
    As explained in section H of this impact analysis, we recognize 
that the percentage breakdown of allowed charges in 2005 may not be 
precisely the same as that which exists today. For instance, Table 4 
shows that approximately 10.8 percent of DMEPOS suppliers in 2005 had 
allowed charges of between $5,000-$9,999. This does not necessarily 
mean that 10.8 percent of suppliers in 2007 or 2008 had allowed charges 
of this amount. We would, of course, prefer to have a table of NPI-
allowed charge amounts over the past 12 months; however, this is not 
possible because use of the NPI was not mandatory until May 2008. 
Moreover, because we used the 2005 6-digit NSC number data in the 
proposed rule, we believe that--for purposes of consistency--it would 
be best to also use this information in the final rule. In sum, while 
recognizing the potential for variations between the 6-digit number 
percentages and today's NPI-based figures, we believe that such 
variations are modest at best and that the percentages shown in Table 4 
are similar to those in 2008. Thus, if 10.1 percent of 6-digit NSC 
numbers received $0 in reimbursement in 2005, this 10.1 percent figure 
is equally applicable to current levels of DMEPOS reimbursement; this 
means that 10.1 percent of the 113,000 Medicare-enrolled suppliers 
(based on the NPI) receive $0 in reimbursement.

 Table 4--Total Number of Suppliers Listed by Allowed Charges for Dates
   of Service in Calendar Year 2005 on 6-Digit Unique Billing Numbers
------------------------------------------------------------------------
                                           Total number    Percentage of
             Allowed charge                  of DMEPOS     total number
                                             suppliers     of suppliers
------------------------------------------------------------------------
$0......................................           6,671            10.1
$0.01-$999..............................           9,168            13.9
$1,000-$2,499...........................           7,092            10.7
$2,500-$4,999...........................           6,744            10.2
$5,000-$9,999...........................           7,117            10.8
$10,000-$24,999.........................           8,896            13.5
$25,000-$49,999.........................           5,478             8.3
$50,000-$99,999.........................           4,026             6.1

[[Page 194]]

 
$100,000-$499,999.......................           7,146            10.8
$500,000-$999,999.......................           1,982             3.0
$1,000,000-4,999,999....................           1,450             2.2
$5,000,000 or more......................             215             0.3
�����������������������������������������
    Total...............................          65,984  ..............
------------------------------------------------------------------------

C. Anticipated Effects of Accreditation on DMEPOS Supplier Surety 
Bonding

    Under this final rule, newly enrolling and existing DMEPOS 
suppliers not eligible for an exception will have to obtain and 
maintain a surety bond to enroll or maintain their billing privileges 
in the Medicare program. However, it is important to note that all 
existing DMEPOS suppliers are required to be accredited by an approved 
accreditation organization by September 30, 2009.
    DMEPOS suppliers will incur costs for becoming accredited. 
Accreditation organizations will incur costs to accredit suppliers; we 
assume that these costs are approximately equal to the accreditation 
fees paid by suppliers. The cost and impact of accreditation on DMEPOS 
suppliers are described in a regulation titled, ``Inpatient 
Rehabilitation Facility Prospective Payment System for Federal FY 2007; 
Provisions Concerning Competitive Acquisition for Durable Medical, 
Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS); Accreditation 
of DMEPOS Supplier'' final rule (71 FR 47870) which was published in 
the Federal Register on August 18, 2006.
1. Factors Affecting the Cost Impact
    As stated previously, in March 2008, there were 113,154 unique 10-
digit NSC numbers. As of September 2008, there are approximately 
113,000 NPIs. This total includes suppliers as well as providers and 
physicians that furnish items under Medicare Part B as suppliers. The 
distribution of locations by supplier type is very uneven across the 
industry. Over 90 percent of suppliers operate a single location, while 
some drug chains, grocery stores, optometry companies, and a few 
medical equipment companies have over a hundred locations.
2. Suppliers That Probably Will Not Seek a Surety Bond Due to 
Accreditation
    Many currently-enrolled DMEPOS suppliers are small, receive 
relatively little in Medicare payments, and do not specialize in 
DMEPOS. In 2005, as shown in Table 4, 10.1 percent of all suppliers 
received $0 in allowed charges during the calendar year. This indicates 
that approximately 10.1 percent of DMEPOS suppliers--or, if based on 
the current number of NPIs, 11,413--are not actively participating and 
billing in the Medicare program. Based on our analysis, we believe that 
almost all of these DMEPOS suppliers will have their billing privileges 
deactivated for 12 consecutive months of nonbilling (see Sec.  424.540) 
prior to the implementation of this final rule, will qualify for an 
exception, or will make the business decision to exit the Medicare 
program on or before September 30, 2009 due to the costs associated 
with accreditation.
    Accordingly, we estimate that 60 percent (or approximately 6,848) 
of the approximately 11,413 suppliers that receive no payments from 
Medicare will exit the Medicare program due to the cost associated with 
accreditation and that the remaining DMEPOS suppliers who receive no 
annual reimbursement from Medicare will have their Medicare billing 
privileges deactivated or will qualify for an exception to the bonding 
requirement. Given that accreditation costs approximately $3,000 for 
single location DMEPOS suppliers, we believe that approximately 60 
percent of the DMEPOS suppliers that are participating in the Medicare 
program and not actively billing the program will voluntarily withdraw 
from the Medicare.
    In addition, we believe that this estimate is consistent with the 
impact analysis contained in the August 18, 2006 final rule (71 FR 
48406) which states that, ``we assume that the 6,900 suppliers that 
currently receive $0 in allowed charges will not seek accreditation.'' 
As such, we believe that 6,848 suppliers will not seek a surety bond 
due to the implementation of accreditation.
3. Suppliers That Probably Will Not Seek a Surety Bond Due to Combined 
Costs Associated With Surety Bond and Accreditation
    As stated above, many suppliers that currently have NSC supplier 
numbers are small, receive relatively little in Medicare payments, and 
do not specialize in DMEPOS. In 2005, approximately 45.6 percent of all 
DMEPOS suppliers received between $1 and $9,999, and an additional 13.5 
percent of DMEPOS suppliers received between $10,000 and $24,999. 
Applying these percentages to the 113,000 current NPIs in the DMEPOS 
arena, we estimate that approximately 51,528 currently-enrolled DMEPOS 
suppliers receive annual reimbursement between $1 and $9,999 and 
approximately 15,255 DMEPOS suppliers receive annual reimbursement 
between $10,000 and $24,999. These suppliers will have to make a 
business decision on whether to pay for the costs associated with 
accreditation and a surety bond. Accreditation is for a 3-year period. 
The impact section of the August 18, 2006 final rule estimated that 
accreditation fees will be approximately $3,000 for a DME supplier, or 
$1,000 per year. The estimated average cost per year for a surety bond 
would be $1,500. (Note that this is $500 lower than the $2,000 per year 
figure listed in the proposed rule. This is due to our decision to 
reduce the bond amount from $65,000 to $50,000.) We thus believe that 
combined costs for both accreditation and a surety bond would be 
approximately $2,500 per year.
    We estimate that approximately 40 percent (or 20,611) of the 
approximately 51,528 suppliers that receive between $1 and $9,999 
annually from Medicare will exit the Medicare program because of the 
combined costs associated with the surety bond requirement and 
accreditation. The remaining 60 percent will consist of, naturally, 
suppliers that chose to remain in the program and suppliers that 
qualify for an exemption to the surety bond requirement. Indeed, a 
significant number of the physicians

[[Page 195]]

and NPPs that qualify for such an exception are relatively small 
billers.
    Furthermore, we estimate that approximately 30 percent (or 4,577) 
of the approximately 15,255 that receive between $10,000 and $24,999 
annually from Medicare will exit the Medicare program because of the 
combined costs associated with the surety bond requirement and 
accreditation. The remaining 70 percent will consist of suppliers that 
chose to remain in the program and suppliers that would qualify for an 
exemption to the surety bond requirement.
4. Suppliers That Meet an Exception to the Surety Bond Requirement
    Section 424.57(c)(26)(ii) establishes exceptions to the surety bond 
requirement for the following organizations and individuals:
     Government-operated DMEPOS suppliers are provided an 
exception to the surety bond requirement if the DME supplier has 
provided CMS with a comparable surety bond under State law, and if it 
does not have any unpaid claims, CMPs or assessments.
     State-licensed orthotic and prosthetic personnel operating 
in private practice and selling only orthotics, prosthetics and/or 
supplies if the supplier does not have any unpaid claims, CMPs, or 
assessments;
     Physicians and NPPs, as defined in section 1842(b)(18) of 
the Act, furnishing DMEPOS to the physician or NPP's own patients as 
part of his or her professional service; and
     State-licensed physical therapists and occupational 
therapists operating in private practice and furnishing prosthetics 
orthotics and/or supplies to the therapist's own patients as part of 
his or her professional service, and who does not have any unpaid 
claims, CMPs, or assessments.
    As indicated in Table 3, there are approximately 10,800 orthotic 
and prosthetic personnel operating independently of a medical supply 
company, approximately 30,700 physicians (for example, podiatry and 
orthopedic/orthopedic surgery) and approximately 2,000 NPPs--
specifically, physical and occupational therapists--who qualify for an 
exception to the surety bond requirement. There are also approximately 
35 government-operated DMEPOS suppliers. This means that 43,535 DMEPOS 
suppliers are eligible for an exemption from the surety bond 
requirement.
    We recognize, however, that it is unlikely that all 43,545 of these 
suppliers will be exempt. As already indicated, the figures in Table 3 
include those suppliers that qualify as more than one supplier type. To 
illustrate, a physician who operates his or her own DMEPOS supply 
company may have indicated on his CMS-855S enrollment application that 
he is both a physician and a supply company. Clearly, such an 
individual would not qualify for the physician exemption. Furthermore, 
even those individual practitioners that only identified themselves as 
physicians, physical therapists, orthotic personnel, etc., may not meet 
the criteria for the exemption due to the composition of their 
practice. For instance, a physical therapist's practice may be one-half 
owned by a DMEPOS supply company, in which case the physical therapist 
would not qualify for an exemption.
    For purposes of this impact analysis, we will assume that 35 
percent of the 43,545 individual practitioners enrolled as DMEPOS 
suppliers--or 15,241--will not qualify for an exception to the surety 
bond requirement. We believe that 35 percent is a high-end estimate and 
that, in all probability, more than 15,241 practitioners will meet an 
exception.

D. Surety Bond Costs for Currently Enrolled DMEPOS Suppliers

    While the costs of a surety bond will vary by surety, we estimate 
that the surety bond requirement as specified in Sec.  424.57(d) is 
$106.2 million annually. This cost is based on the factors identified 
below.
1. Number of Currently Enrolled DMEPOS Suppliers That Must Obtain a 
Surety Bond
    We derived the number of presently enrolled DMEPOS suppliers that 
must obtain a surety bond in the following manner:
    Step A--Subtracted the number of DMEPOS suppliers (6,848) that we 
estimated would exit the program based on implementation of 
accreditation from the total number of NPIs associated with DMEPOS 
suppliers. The result was 106,152 suppliers.
    Step B--Subtracted the estimated number of suppliers (25,188) that 
we believe will exit the Medicare program due to the combined costs 
associated with accreditation and a surety bond from the sum in Step A. 
The result was 80,964 suppliers.
    Step C--Subtracted the estimated number of suppliers (15,241) 
eligible for an exception to the surety bond amount from the sum in 
Step B. The result was 65,723 suppliers.
2. Number of New DMEPOS Suppliers That Will Need To Obtain a Surety 
Bond
    Since any DMEPOS supplier seeking to enroll in the Medicare program 
on or after October 1, 2009 is required to meet all of supplier 
standards at Sec.  424.57, including the accreditation standards at 
Sec.  424.57(c)(22) through Sec.  424.57(c)(25), we believe that a 
smaller number of applicants will apply to enroll in the Medicare 
program as a DMEPOS supplier after this date.
    Before the implementation of accreditation, the NSC received 
approximately 12,000 initial enrollment applications per year, of which 
roughly one-half (or 6,000) were approved. After the full 
implementation of accreditation, we expect that the annual number of 
initial applications will fall to 6,000, of which approximately 2,000 
will be approved. However, given the exceptions established in this 
final rule, it is likely that a number of these new suppliers will 
qualify for an exemption to the surety bond requirement. Nevertheless, 
for purposes of our analysis, we used the higher 2,000 figure to 
account for the possibility that the number of new DMEPOS suppliers in 
a given year may slightly exceed our expectations.
3. Cost of a Bond
    Based on information received from the industry, we estimated that 
the average bond cost is approximately $1,500, or 3 percent of the 
value of a $50,000 bond. We multiplied the number of remaining 
suppliers (65,723) by $1,500, which resulted in a figure of 
approximately $98.6 million. We further estimated that no more than 
one-half of 1 percent of DMEPOS suppliers that are subject to the 
surety bond requirement (or 329 out of 65,723) have had a final adverse 
action imposed against them within the last 10 years and continue to 
participate in the Medicare program. For these suppliers, the average 
number of final adverse actions will be one, which will thus mandate a 
bond amount of $100,000--or $50,000 more than the base bond amount. 
Therefore, if we multiply 329 by the cost of the additional $50,000 
bond amount (or $1,500), the total is $493,500, which when added to the 
$98.6 million amount identified above, results in $99.1 million. We 
then add, as explained above, the estimated 2,000 new DMEPOS suppliers 
that will enroll in the Medicare program each year. With an average 
bond cost of $1,500, this adds another $3 million. Thus, the annual 
costs of the surety bond

[[Page 196]]

increases from $99.1 million to $102.1 million.
    A surety charges its underwriting fee based on the penal sum of the 
bond. We have determined that for this type of surety bond the industry 
usually has an underwriting charge of 2 to 3 percent. We believe that 
there is little variation of the charge based on geographical location 
or type of DMEPOS supplier although the DMEPOS supplier's financial 
average soundness probably will be a factor in the rate charged by the 
surety for the bond. We are unable to make an estimate of the range of 
financial soundness of DMEPOS suppliers, or its impact on the cost of 
surety bonds for Medicare.
4. Paperwork Costs for DMEPOS Suppliers
    As already stated, we estimate that 65,723 currently-enrolled 
DMEPOS suppliers and 2,000 new DMEPOS suppliers per year will be 
subject to the surety bond requirement. We estimated that the year 1 
implementation costs will be approximately $4.1 million and that the 
annual implementation costs thereafter to be approximately $180,000 per 
year.
    To calculate the cost associated with the implementation of the 
surety bond in year 1, we calculated the cost of completing the revised 
Medicare enrollment application (CMS-855S) at $20 per hour along with 
our estimate that it will take on average 3 hours to complete the 
information collection associated with surety bond.
    Using this information, we multiplied 65,723 currently-enrolled 
DMEPOS suppliers by 3 hours to derive the time associated with 
completing this new information collection requirement. The result was 
197,169 hours (65,723 x 3 hours). We then multiplied the result 
(197,169) hours times $20 per hour to calculate the costs for existing 
DMEPOS suppliers subject to the bonding requirement to complete the 
information collection associated with the implementation of the surety 
bond requirement. The result equaled $3,943,380. Similarly, we used the 
same calculation for newly enrolling DMEPOS suppliers and calculated a 
costs of $120,000 (2,000 suppliers x 3 hours x $20 per hour). Finally, 
we are assuming that a maximum of 1,000 suppliers will incur costs to 
update or change their surety. The resulting costs would equal $60,000 
(1,000 suppliers x 3 hours x $20 per hour). Thus, we estimate that the 
paperwork burden associated with the surety bond is $4,063,380 
($3,943,380 + $120,000) in year one and $180,000 annually thereafter.
5. Total Costs
    Based on the information identified in sections IV.D.1. through 
IV.D.4. of this final rule, we estimate that the total cost of the 
surety bond requirement in its first year will be approximately $106.2 
million. The cost in each subsequent year will be roughly $102.3 
million.

E. Impact on Beneficiary Access

    As already discussed, we believe that 6,848 DMEPOS suppliers will 
exit the Medicare program as a result of the implementation of 
accreditation, irrespective of whether these suppliers qualify for a 
surety bond exemption. This will result in 106,152 suppliers remaining 
in the Medicare program. Starting from this figure, we will calculate 
the number of DMEPOS suppliers that will leave Medicare due to the 
surety bond requirement.
    We previously estimated that 25,188 DMEPOS suppliers will exit the 
Medicare program due to the combined costs of the surety bond and 
accreditation requirements. This leaves 80,964 suppliers. If we were to 
assume that there are 15,241 suppliers that are eligible for an 
exception to the bonding requirement, 65,723 DMEPOS suppliers are left. 
We thus estimate that this many DMEPOS suppliers will remain in 
Medicare after the implementation of the surety bond requirement.
    We believe that the majority of remaining DMEPOS suppliers will 
consist of three categories of suppliers: Pharmacies (whether large or 
small, chain or non-chain), physicians and NPPs who qualify for an 
exemption, and larger medical supply companies. Pharmacies and large 
medical supply companies are likely to remain in the Medicare program 
because, notwithstanding the cost of the bond, they have the revenues 
to more than offset said cost--including even those large chain 
pharmacies that will need to obtain a bond for each location. Those 
physicians and NPPs that qualify for an exemption, meanwhile, are 
likely to remain in Medicare for this very reason. We believe that many 
beneficiaries in non-rural areas, where there are a high number of 
chain pharmacies--and, of course, a high percentage of physician and 
NPP practices--will continue to have access to DMEPOS supplies offered 
by these suppliers.
    We estimate that approximately 20 percent of all DMEPOS suppliers 
are located in rural areas. We believe that the majority of DMEPOS 
suppliers in these areas are physician and NPPs, community pharmacies, 
and small medical supply distributors. For reasons already stated, many 
physicians and NPPs will be exempt from the surety bond requirement; as 
such, we do not foresee a significant decrease in the number of such 
rural practitioners who offer DMEPOS suppliers. Nor do we expect many 
community pharmacies to exit the program notwithstanding the need for 
them to obtain a bond. We do however recognize that a number of rural 
medical supply companies may withdraw from the Medicare program. 
However, we believe that much of the business conducted by these 
suppliers will be assumed by community pharmacies, physicians, NPPs, 
and mail-order medical supply companies; in fact, it is quite common 
for rural beneficiaries who are unable to access a local medical supply 
company to utilize mail-order services.
    While we expect that some DMEPOS suppliers in rural areas will exit 
the Medicare program, we do not believe that this figure will be 
significant, nor do we believe that overall beneficiary access will be 
substantially curtailed. Nevertheless, to help Medicare beneficiaries 
in both rural and non-rural areas locate a qualified replacement DMEPOS 
supplier, we will conduct education and outreach efforts to ease the 
transition from a departing DMEPOS supplier to a DMEPOS supplier that 
will remain in the program.
    The category of DMEPOS suppliers that will arguably be most 
affected by the imposition of the surety bond requirement, at least in 
terms of gross expenditures, is large, publicly-traded chain 
pharmacies. These suppliers, as already discussed, do not qualify for a 
surety bond exemption. Some chains have several hundred locations. 
Thus, for instance, a pharmacy chain that has 300 locations, each 
denoted by a separate NPI, will be required to obtain a bond for each 
site. With an annual bond cost of $1,500, the yearly cost of the surety 
bond requirement for the chain organization would be $450,000.

F. Alternatives Considered for DMEPOS Suppliers

    The RFA requires agencies to analyze options for the regulatory 
relief of small entities. In compliance with section 604 of the RFA, 
therefore, we have incorporated several options designed to minimize 
the burden of the surety bond requirement--both a stand-alone 
requirement and when implemented in conjunction with the accreditation 
provisions found at Sec.  424.58.
    First, with respect to accreditation, we have approved multiple 
accreditation organizations that serve smaller suppliers, as well as 
accreditation organizations that will be responsible for only surveying 
the streamlined

[[Page 197]]

quality standards for compliance and not providing any consultative 
services that may increase the time and cost of the survey process. 
Also, we believe that unannounced surveys will reduce the time and cost 
involved in suppliers' receiving and reviewing documents prior to the 
survey.
    Second, we have reduced the surety bond amount from $65,000 to 
$50,000, in part to ease the economic impact on small, rural DMEPOS 
suppliers. Rather than a $2,000 per year cost for a surety bond, the 
establishment of a $50,000 bond amount will reduce the annual cost to 
$1,500. This reduction will not, in our view, will help ensure that 
small, DMEPOS suppliers continue to participate in the Medicare 
program.
    Finally, we have established several exceptions to the surety bond 
requirement. These exemptions apply almost exclusively to small 
businesses--specifically, physician and NPP practices--and will no 
doubt ease the economic impact on such businesses in both rural and 
non-rural areas.
    For reasons already explained, we were unable to establish 
exceptions to the bond requirement for other types of small entities, 
such as single-site community pharmacies. Nevertheless, by reducing the 
bond amount to the statutory minimum and by creating those exceptions 
that were legally permissible, we believe that we have taken concrete 
steps to ease the economic burden on small business to the maximum 
extent permitted by section 4312(a) of the BBA.

G. Uncertainty

    There are at least four important sources of uncertainty in 
estimating the impact of surety bonds on DMEPOS suppliers. First, our 
estimates assume that the vast majority of current DMEPOS suppliers 
with positive Medicare payments will obtain and maintain a surety bond. 
As noted previously, many suppliers that currently have NSC supplier 
numbers are small, receive relatively little in Medicare payments, and 
do not specialize in DMEPOS. We assume that suppliers that currently 
receive no Medicare allowed charges will choose not to seek 
accreditation and a surety bond, and that many of the suppliers with 
allowed charges between $1 and $10,000 may decide not to incur the 
costs of accreditation.
    Second, it is unclear how high or low surety bond or accreditation 
fees will be in the future. With required accreditation causing more 
suppliers to seek accreditation, fees may fall if the accreditation 
organizations can enjoy economies of scale as they expand. This would 
lessen the impact on DMEPOS suppliers.
    Third, the timing of competitive bidding may impact some DMEPOS 
suppliers' decision to continue to participate in the Medicare program. 
With the delay in the implementation of the Competitive Bidding Program 
as mandated by the MIPPA, we cannot calculate the impact that 
competitive bidding will have on existing DMEPOS suppliers continuing 
to participate in Medicare.
    Finally, as discussed in section B of this impact analysis, we 
recognize that the percentage breakdown of allowed charges in 2005, as 
described in Table 4, may not be precisely the same as that which 
currently exists. It is certainly possible that the use of allowed 
charge data based on the NPI, rather than the 6-digit NSC number, will 
lead to a greater percentage of suppliers falling into the category of 
``small billers,'' for a single location (that is, an NPI-specific 
site) is generally likely to receive less reimbursement than an entity 
with multiple locations (that is, a entity denoted by a 6-digit NSC 
number).
    Yet we believe that any such increase in the percentage of small 
billers will be minor. Many of these NPI-specific sites are locations 
that are part of large chain pharmacy organizations; such pharmacy 
locations often receive significant levels of Medicare reimbursement. 
In other words, while the change from the 6-digit NSC number to the NPI 
as the primary supplier identifier greatly increased the number of 
DMEPOS suppliers, many of these ``new'' suppliers were chain pharmacy 
locations that could not be classified as ``small billers.'' As such, 
we are not entirely convinced that the increase in DMEPOS suppliers 
will result in a concomitant rise in the overall percentage of small 
billers. Still, we cannot rule out this possibility and thus concede 
that this issue represented an element of uncertainty in our impact 
analysis.

H. Accounting Statement

    As required by OMB Circular A-4 (available at http://www.whitehouse.gov/omb/circulars/a004/a-4.pdf), in Table 6 we have 
prepared an accounting statement. This statement, it should be noted, 
addresses only the costs and monetary transfers associated with the 
surety bond requirement. It does not address, from a strictly monetary 
standpoint, the prospective financial benefits of the bond requirement. 
While we, as explained in the preamble, expects the bond requirement to 
provide significant program integrity benefits for Medicare on the 
grounds that we will be able to recoup otherwise uncollectible 
overpayments, CMPs, and assessments and that unscrupulous DMEPOS 
suppliers will be deterred from entering the Medicare program, it is 
impossible for us to quantify these benefits in monetary terms. We 
cannot predict how many potentially fraudulent DMEPOS suppliers will be 
kept out of the Medicare program, nor can we determine for certain how 
much money Medicare will recoup from said overpayments, CMPs, and 
assessments.
    The cost section addresses the data discussed in section IV.D. of 
this final rule. The monetary transfers section contains information on 
the transfer of Medicare reimbursement from those DMEPOS suppliers that 
will leave the Medicare program as a result of the surety bond 
requirement (as described in section IV.D.1. of this final rule) to 
those DMEPOS suppliers that will assume the DMEPOS business of these 
departing suppliers. As previously stated, we estimated that 
approximately 30 percent (or 4,577) of the approximately 15,255 DMEPOS 
suppliers that receive between $10,000 and $24,999 annually from 
Medicare will exit the Medicare program because of the combined costs 
associated with the surety bond requirement and accreditation. We 
further estimated that roughly 40 percent (or 20,611) of the 
approximately 51,528 suppliers that receive between $1 and $9,999 
annually from Medicare will exit the Medicare program because of these 
combined costs. For purposes of this assessment statement, we used the 
midpoint of the two aforementioned categories (or $17,500 and $5,000, 
respectively) as the amount of annual reimbursement these suppliers 
receive. As such, we multiplied 20,611 by $5,000 and arrived at 
$103,055,000, and multiplied 4,577 by $17,500 to obtain a figure of 
$80,097,500. Therefore, we estimate that approximately $183.2 million 
in annual Medicare reimbursement will be paid to existing or new DMEPOS 
suppliers in lieu of those suppliers exiting the Medicare program.

[[Page 198]]



       Table 6--Classification of Estimated Expenditures and Costs
------------------------------------------------------------------------
     Category  Surety bond requirement               In millions
------------------------------------------------------------------------
                                  COSTS
------------------------------------------------------------------------
Annualized Monetized Transfers Using the    102.8.
 7% Discount Rate.
Annualized Monetized Transfers Using the    102.7.
 3% Discount Rate.
Who is Affected?..........................  DMEPOS Suppliers.
------------------------------------------------------------------------
                                TRANSFERS
------------------------------------------------------------------------
Annualized Monetized Transfers Using the    183.2.
 7% Discount Rate.
Annualized Monetized Transfers Using the    183.2.
 3% Discount Rate.
From Who to Whom?.........................  Departing DMEPOS Suppliers
                                             to Current or New DMEPOS
                                             Suppliers.
------------------------------------------------------------------------

    In accordance with the provisions of Executive Order 12866, this 
regulation was reviewed by the Office of Management and Budget.

List of Subjects in 42 CFR Part 424

    Emergency medical services, Health facilities, Health professions, 
Medicare.


0
For the reasons set forth in the preamble, the Centers for Medicare & 
Medicaid Services amends 42 CFR chapter IV, as set forth below:

PART 424--CONDITIONS FOR MEDICARE PAYMENT

0
1. The authority citation for part 424 is revised to read as follows:

    Authority: Secs. 1102 and 1871 of the Social Security Act (42 
U.S.C. 1302 and 1395hh).

Subpart D--To Whom Payment Is Ordinarily Made

0
2. Section 424.57 is amended by--
0
A. Amending paragraph (a) by adding the following definitions in 
alphabetical order: ``Assessment'', ``Authorized surety'', ``Civil 
money penalty'', ``Final adverse action'', ``Government-operated 
supplier'', ``National Supplier Clearinghouse (NSC)'', ``Penal sum'', 
``Rider'', ``Sufficient evidence'', ``Surety bond'', and ``Unpaid 
claim''.
0
B. In paragraph (a), in the definition of ``DMEPOS supplier'', the 
cross-reference ``paragraph (c)'' is removed and the cross-reference 
``paragraphs (c) and (d)'' are added in its place.
0
C. Adding paragraph (c)(26).
0
D. Redesignating paragraphs (d) and (e) as paragraphs (e) and (f).
0
D. Adding a new paragraph (d).
0
E. In newly redesignated paragraph (e), the cross-reference 
``paragraphs (b) and (c)'' is removed and the cross-reference 
``paragraphs (b), (c), and (d)'' is added in its place.
    The additions read as follows:


Sec.  424.57  Special payment rules for items furnished by DMEPOS 
suppliers and issuance of DMEPOS supplier billing privileges.

    (a) * * *
    Assessment means a sum certain that CMS or the Office of Inspector 
General (OIG) may assess against a DMEPOS supplier under Titles XI, 
XVIII, or XXI of the Social Security Act or as specified in this 
chapter.
    Authorized surety means a surety that has been issued a Certificate 
of Authority by the U.S. Department of the Treasury as an acceptable 
surety on Federal bonds and the certificate has neither expired nor 
been revoked.
    Civil money penalty (CMP) means a sum that CMS has the authority, 
as implemented by 42 CFR 402.1(c); or OIG has the authority, under 
section 1128A of the Act or 42 CFR part 1003, to impose on a supplier 
as a penalty.
* * * * *
    Final adverse action means one or more of the following actions:
    (i) A Medicare-imposed revocation of any Medicare billing 
privileges;
    (ii) Suspension or revocation of a license to provide health care 
by any State licensing authority;
    (iii) Revocation or suspension by an accreditation organization;
    (iv) A conviction of a Federal or State felony offense (as defined 
in Sec.  424.535(a)(3)(i)(A)) within the last 10 years preceding 
enrollment, revalidation, or re-enrollment; or
    (v) An exclusion or debarment from participation in a Federal or 
State health care program.
    Government-operated supplier is a DMEPOS supplier owned or operated 
by a Federal, State, or Tribal entity.
* * * * *
    National Supplier Clearinghouse (NSC) is the contractor that is 
responsible for the enrollment and re-enrollment process for DMEPOS 
suppliers.
    Penal sum is the maximum obligation of the surety if a loss occurs.
    Rider means a notice issued by a surety that a change in the bond 
has occurred or will occur.
    Sufficient evidence means documents CMS may supply to the surety in 
order to establish that a DMEPOS supplier had received Medicare funds 
in excess of the amount due and payable under the statute and 
regulations, the amount of a CMP, or the amount of some other 
assessment against the DMEPOS supplier.
    Surety bond means a bond issued by one or more sureties under 31 
U.S.C. 9304 through 9308 and 31 CFR parts 223, 224, and 225.
    Unpaid claim means an overpayment made by the Medicare program to 
the DMEPOS supplier for which the DMEPOS supplier is responsible, plus 
accrued interest that is effective 90 days after the date of the notice 
sent to the DMEPOS supplier of the overpayment. If a written agreement 
for payment, acceptable to CMS, is made, an unpaid claim also means a 
Medicare overpayment for which the DMEPOS supplier is responsible, plus 
accrued interest after the DME supplier's default on the arrangement.
* * * * *
    (c) * * *
    (26) Must meet the surety bond requirements specified in paragraph 
(d) of this section.
* * * * *
    (d) Surety bonds requirements.
    (1) Effective date of surety bond requirements.
    (i) DMEPOS suppliers seeking enrollment or with a change in 
ownership. Except as provided in paragraph (d)(15) of this section, 
beginning May 4, 2009, DMEPOS suppliers seeking to enroll or to change 
the ownership of a supplier of DMEPOS must meet the requirements of 
paragraph (d) of this section for each assigned NPI for which the 
DMEPOS

[[Page 199]]

supplier is seeking to obtain Medicare billing privileges.
    (ii) Existing DMEPOS suppliers. Except as provided in paragraph 
(d)(15) of this section, beginning October 2, 2009, each Medicare-
enrolled DMEPOS supplier must meet the requirements of paragraph (d) of 
this section for each assigned NPI to which Medicare has granted 
billing privileges.
    (2) Minimum requirements for a DMEPOS supplier.
    (i) A supplier enrolling in the Medicare program, making a change 
in ownership, or responding to a revalidation or reenrollment request 
must submit to the NSC a surety bond from an authorized surety of 
$50,000 and if required by the NSC an elevated bond amount as described 
in paragraph (d)(3) of this section with its paper or electronic 
Medicare enrollment application (CMS-855S, OMB number 0938-0685). The 
term of the initial surety bond must be effective on the date that the 
application is submitted to the NSC.
    (ii) A supplier that seeks to become an enrolled DMEPOS supplier 
through a purchase or transfer of assets or ownership interest must 
submit to the NSC a surety bond from an authorized surety of $50,000 
and if required by the NSC an elevated bond amount as described in 
paragraph (d)(3) of this section that is effective from the date of the 
purchase or transfer in order to exercise billing privileges as of that 
date. If the bond is effective at a later date, the effective date of 
the new DMEPOS supplier billing privileges is the effective date of the 
surety bond as validated by the NSC.
    (iii) A DMEPOS supplier enrolling a new practice location must 
submit to the NSC a new surety bond from an authorized surety or an 
amendment or rider to the existing bond, showing that the new practice 
location is covered by an additional base surety bond of $50,000 or, as 
necessary, an elevated surety bond amount as described in paragraph 
(d)(3) of this section.
    (3) Elevated surety bond amounts.
    (i) If required, a DMEPOS supplier must obtain and maintain a base 
surety bond in the amount of $50,000 as specified in paragraph (d)(2) 
of this section and an elevated surety bond in the amount prescribed by 
the NSC as described in paragraph (d)(3)(ii) of this section.
    (ii) The NSC prescribes an elevated surety bond amount of $50,000 
per occurrence of an adverse legal action within the 10 years preceding 
enrollment, revalidation, or reenrollment, as defined in paragraph (a) 
of this section.
    (4) Type and terms of the surety bond.
    (i) Type of bond. A DMEPOS supplier must submit a bond that is 
continuous.
    (ii) Minimum requirements of liability coverage.
    (A) The terms of the bond submitted by a DMEPOS supplier for the 
purpose of complying with this section must meet the minimum 
requirements of liability coverage ($50,000) and surety and DMEPOS 
supplier responsibility as set forth in this section.
    (B) CMS requires a supplier to submit a bond that on its face 
reflects the requirements of this section. CMS revokes or denies a 
DMEPOS supplier's billing privileges based upon the submission of a 
bond that does not reflect the requirements of paragraph (d) of this 
section.
    (5) Specific surety bond requirements.
    (i) The bond must guarantee that the surety will, within 30 days of 
receiving written notice from CMS containing sufficient evidence to 
establish the surety's liability under the bond of unpaid claims, CMPs, 
or assessments, pay CMS a total of up to the full penal amount of the 
bond in the following amounts:
    (A) The amount of any unpaid claim, plus accrued interest, for 
which the DMEPOS supplier is responsible.
    (B) The amount of any unpaid claims, CMPs, or assessments imposed 
by CMS or OIG on the DMEPOS supplier, plus accrued interest.
    (ii) The bond must provide the following: The surety is liable for 
unpaid claims, CMPs, or assessments that occur during the term of the 
bond.
    (iii) If the DMEPOS supplier fails to furnish a bond meeting the 
requirements of paragraph (d) of this section, fails to submit a rider 
when required, or if the DMEPOS supplier's billing privileges are 
revoked, the last bond or rider submitted by the DMEPOS supplier 
remains in effect until the last day of the surety bond coverage period 
and the surety remains liable for unpaid claims, CMPs, or assessments 
that--
    (A) CMS or the OIG imposes or asserts against the DMEPOS supplier 
based on overpayments or other events that took place during the term 
of the bond or rider; and
    (B) Were imposed or assessed by CMS or the OIG during the 2 years 
following the date that the DMEPOS supplier failed to submit a bond or 
required rider, or the date the DMEPOS supplier's billing privileges 
were terminated, whichever is later.
    (6) Cancellation of a bond and lapse of surety bond coverage.
    (i) A DMEPOS supplier may cancel its surety bond and must provide 
written notice at least 30 days before the effective date of the 
cancellation to the NSC and the surety.
    (ii) Cancellation of a surety bond is grounds for revocation of the 
DMEPOS supplier's Medicare billing privileges unless the DMEPOS 
supplier provides a new bond before the effective date of the 
cancellation. The liability of the surety continues through the 
termination effective date.
    (iii) If CMS receives notification of a lapse in bond coverage from 
the surety, the DMEPOS supplier's billing privileges are revoked. 
During this lapse, Medicare does not pay for items or services 
furnished during the gap in coverage, and the DMEPOS supplier is held 
liable for the items or services (that is, the DMEPOS supplier would 
not be permitted to charge the beneficiary for the items or services).
    (iv) The surety must immediately notify the NSC if there is a lapse 
in the surety's coverage of the DMEPOS supplier's coverage.
    (7) Actions under the surety bond. The bond must provide that 
actions under the bond may be brought by CMS or by CMS contractors.
    (8) Required surety information on the surety bond. The bond must 
provide the surety's name, street address or post office box number, 
city, state, and zip code.
    (9) Change of surety. A DMEPOS supplier that obtains a replacement 
surety bond from a different surety to cover the remaining term of a 
previously obtained bond must submit the new surety bond to the NSC at 
least 30 days prior to the expiration of the previous surety bond. 
There must be no gap in the coverage of the surety bond periods. If a 
gap in coverage exists, the NSC revokes the supplier's billing 
privileges and does not pay for any items or services furnished by the 
DMEPOS supplier during the period for which no bond coverage was 
available. If a DMEPOS supplier changes its surety during the term of 
the bond, the new surety is responsible for any overpayments, CMPs, or 
assessments incurred by the DMEPOS supplier beginning with the 
effective date of the new surety bond. The previous surety is 
responsible for any overpayments, CMPs, or assessments that occurred up 
to the date of the change of surety.
    (10) Parties to the surety bond. The surety bond must name the 
DMEPOS supplier as Principal, CMS as Obligee, and the surety (and its 
heirs, executors, administrators, successors and assignees, jointly and 
severally) as surety.
    (11) Effect of DMEPOS supplier's failure to obtain, maintain, and 
timely file a surety bond.

[[Page 200]]

    (i) CMS revokes the DMEPOS supplier's billing privileges if an 
enrolled supplier fails to obtain, file timely, or maintain a surety 
bond as specified in this subpart and CMS instructions. Notwithstanding 
paragraph (e) of this section, the revocation is effective the date the 
bond lapsed and any payments for items furnished on or after that date 
must be repaid to CMS by the DMEPOS supplier.
    (ii) CMS denies billing privileges to a supplier if the supplier 
seeking to become an enrolled DMEPOS supplier fails to obtain and file 
timely a surety bond as specified with this subpart and CMS 
instructions.
    (12) Evidence of DMEPOS supplier's compliance. CMS may at any time 
require a DMEPOS supplier to show compliance with the requirements of 
paragraph (d) of this section.
    (13) Effect of subsequent DMEPOS supplier payment. If a surety has 
paid an amount to CMS on the basis of liability incurred under a bond 
and CMS subsequently collects from the DMEPOS supplier, in whole or in 
part, on the unpaid claim, CMPs, or assessment that was the basis for 
the surety's liability, CMS reimburses the surety the amount that it 
collected from the DMEPOS supplier, up to the amount paid by the surety 
to CMS, provided the surety has no other liability to CMS under the 
bond.
    (14) Effect of review reversing determination. If a surety has paid 
CMS on the basis of liability incurred under a surety bond and to the 
extent the DMEPOS supplier that obtained the bond is subsequently 
successful in appealing the determination that was the basis of the 
unpaid claim, CMP, or assessment that caused the DMEPOS supplier to pay 
CMS under the bond, CMS refunds the DMEPOS supplier the amount the 
DMEPOS supplier paid to CMS to the extent that the amount relates to 
the matter that was successfully appealed, provided all review, 
including judicial review, has been completed on the matter.
    (15) Exception to the surety bond requirement.
    (i) Qualifying entities and requirements.
    (A) Government-operated DMEPOS suppliers are provided an exception 
to the surety bond requirement if the DME supplier has provided CMS 
with a comparable surety bond under State law.
    (B) State-licensed orthotic and prosthetic personnel in private 
practice making custom made orthotics and prosthetics are provided an 
exception to the surety bond requirement if--
    (1) The business is solely-owned and operated by the orthotic and 
prosthetic personnel, and
    (2) The business is only billing for orthotic, prosthetics, and 
supplies.
    (C) Physicians and nonphysician practitioners as defined in section 
1842(b)(18) of the Act are provided an exception to the surety bond 
requirement when items are furnished only to the physician or 
nonphysician practitioner's own patients as part of his or her 
physician service.
    (D) Physical and occupational therapists in private practice are 
provided an exception to the surety bond requirement if--
    (1) The business is solely-owned and operated by the physical or 
occupational therapist;
    (2) The items are furnished only to the physical or occupational 
therapist's own patients as part of his or her professional service; 
and
    (3) The business is only billing for orthotics, prosthetics, and 
supplies.
    (ii) Loss of a DMEPOS supplier exception. A DMEPOS supplier that no 
longer qualifies for an exception as described in paragraph (d)(15)(i) 
of this section must submit a surety bond to the NSC in accordance with 
requirements of paragraph (d) of this section within 60 days after it 
knows or has reason to know that it no longer meets the criteria for an 
exception.
* * * * *

    Authority: Catalog of Federal Domestic Program No. 93.774, 
Medicare--Supplementary Medical Insurance Program.

    Dated: May 1, 2008.
Kerry Weems,
Acting Administrator, Centers for Medicare & Medicaid Services.
    Approved: September 18, 2008.
Michael O. Leavitt,
Secretary.

    Editorial Note: This document was received in the Office of the 
Federal Register on Monday, December 22, 2008.

[FR Doc. E8-30802 Filed 12-29-08; 11:15 am]
BILLING CODE 4120-01-P