On November 20, 2020, the U.S. Department of Health and Human Services (“HHS”) released final rules seeking to modernize the Physician Self-Referral Law (“Stark Law”) and the federal Anti-Kickback Statute (“AKS”).

The final rules, released by HHS’ Centers for Medicare and Medicaid Services (“CMS”) and Office of Inspector General (“OIG”), are part of The Regulatory Sprint to Coordinated Care—an effort launched by HHS in 2018 aimed at removing barriers to value-based care. Among other changes, the final rules add new value-based exceptions to the Stark Law and additional safe harbors under the AKS. The important changes to the Stark Law and AKS are highlighted below.

Stark Law

Enacted in 1989, the Stark Law sought to curb the abuses of physician self-referrals which flourished under volume-based reimbursement. Since then, healthcare payment structures have been rapidly evolving from volume-based methods, or fee-for-service, toward payment models that tie reimbursement to value-based outcomes. Recognizing that the Stark Law regulations have hindered the transition to value-based reimbursement, the CMS final rule adds three exceptions to the Stark Law for value-based compensation arrangements. The three exceptions are tiered based on the level of financial risk assumed:

  1. Full Financial Risk: The value-based enterprise (“VBE”) is at full financial risk for the entire duration of the value-based arrangement. The VBE also has the option of achieving full financial risk within 12 months after the start of the value-based arrangement, but must still retain that risk for the duration of the arrangement. The VBE must have assumed full financial risk on a “prospective basis” meaning the risk must have been assumed prior to providing patient care items and services to patients in the target patient population. While the final rule notes that full-financial risk may take the form of capitation payments, CMS is not prescribing a specific manner for the assumption of full financial risk.
  2. Meaningful Downside Risk: The physician is at meaningful downside financial risk for failure to achieve the value-based purposes of the value-based enterprise during the entire duration of the value-based arrangement. “Meaningful downside financial risk” is defined to mean that the physician is responsible to repay or forgo no less than 10 percent of the total value of the remuneration they receive under the value-based arrangement.
  3. Value-Based Arrangement: Remuneration paid under a value-based arrangement must meet an enumerated list of requirements. This exception requires that recipient of the remuneration be assessed by outcome measures that are objective, measurable, and selected based on clinical evidence or credible medical support. Notably, the VBE, or one or more of the parties, must monitor (1) that the parties have actually furnished the value-based activities, (2) whether and how continuing those activities is expected to further the purpose of the value-based enterprise, and (3) the progress toward attaining the outcome measures against which the recipient of the remuneration is assess. All three issues must be monitored at least once annually.

All three exceptions apply regardless of whether the arrangement relates to care furnished to Medicare beneficiaries, non-Medicare patients, or a combination of both.


The OIG’s final rule addressing changes to AKS begins by noting that industry stakeholders regard these two laws as “chilling” healthcare payment innovation and value-based care. The final rule adopts proposed AKS safe harbors for value-based arrangements based on the level of financial risks the parties assume, similar to the Stark exceptions outlined above. The value-based safe harbors vary in several respects, including by the types of remuneration protected (in-kind or in-kind and monetary), the types of entities eligible to rely on the safe harbors, the level of financial risk assumed by the parties, and the types of safeguards included as safe harbor conditions.

Safe Harbors for Value-Based Arrangements

The three new value-based safe harbors listed below offer protection for in-kind remuneration, such as technology or services.[1] However, only the safe harbors with substantial assumption of risk protect monetary remuneration in addition to in-kind remuneration.

  1. Care Coordination Arrangements: The remuneration must be in-kind, and must be used predominantly to engage in value-based activities for the care of the target patient population and must not result in more than incidental benefits to persons outside of the target patient population. The recipient of the in-kind remuneration must pay at least 15 percent of the offeror’s remuneration cost. Notably, if the VBE’s accountable body or responsible person determines that the value-based arrangement resulted in material deficiencies in quality of care or is unlikely to further the coordination and management of care for the target patient population, then the parties must within 60 days terminate or implement a corrective action plan.
  2. Substantial Downside Financial Risk: The VBE has assumed (or entered into a contract to assume within the next 6 months) substantial downside financial risk from a payor for at least 1 year. “Substantial downside financial risk” is defined by three separate acceptable methodologies.
  3. Full Financial Risk: The VBE has assumed (or entered into a contract to assume within the next 1 year) full financial risk from a payor. The VBE must be financially responsible on a prospective basis for the cost of all items and services covered by the applicable payor for each patient in the target patient population for at least 1 year.

Additional New Safe Harbors

  1. Patient Engagement and Support: Protects remuneration in the form of patient engagement tools and supports. The tools and supports could not be funded by anyone outside the VBE, and the in-kind remuneration is subject to an annual cap. This safe harbor excludes the same list of ineligible entities as in the value-based safe harbors, noted in the footnote below, but includes a pathway for manufacturers of devices or medical supplies to provide digital health-technology.
  2. CMS-Sponsored Models: Protects remuneration within arrangements (e.g., distribution of capitated payments, shared savings or losses distributions) sponsored by CMS. The new safe harbor aims to provide uniformity and predictability for those participating in CMS-sponsored models, though existing model waivers will continue in effect.
  3. Cybersecurity Technology and Services: Protects nonmonetary donations of certain cybersecurity technology and related services. The safe harbor is designed to address the growing threat of cyberattacks impacting the health care ecosystem.

Modifications to Existing Safe Harbors

  1. Electronic Health Records: Updates and removes provisions regarding interoperability, removes the sunset provision and prohibition on donation of equivalent technology, and clarifies protections for cybersecurity technology and services included in an electronic health records arrangement.
  2. Personal Services and Management Contracts and Outcomes-Based Payments: Increases flexibility for part-time or sporadic arrangements and where aggregate compensation is not known in advance.
  3. Warranties: Modifies existing language to protect warranties of a bundle of items, or a bundle of items and services. This revision protects, for the first time, warranties covering services, but does not protect services on their own, they must instead be bundled with items in order to fall within the safe harbor.
  4. Local Transportation: Expands the distance limitations from 50 to 75 miles for residents of rural areas, and removes mileage limitations for certain inpatients transported from inpatient facilities to a residence.

Finally, the OIG final rule added an exception to “remuneration” under the Beneficiary Inducements CMP in order to protect the provision of certain telehealth technologies related to in-home dialysis services. The revision should support vulnerable patient populations, such as immobile or rural patients, in addressing their chronic conditions.

The OIG final rule, and substantially all of the CMS final rule, state they will take effect January 19, 2021. It stands to be seen whether these rules will actually take effect January 19, as they both qualify as “major rules” under the Congressional Review Act requiring they wait at least 60 to be effective since being published in the Federal Register. Since both final rules were published December 2, a sixty-day period would have both rules be effective January 31, 2021, at which point the new Biden administration could choose to delay implementation.

[1] The final rule elaborates that some entities are ineligible to use the value-based safe harbors, including: pharmaceutical manufacturers, distributors, and wholesalers; pharmacy benefit managers; laboratory companies; pharmacies that primarily dispense compounded drugs; manufacturers of devices or medical supplies; entities or individuals that sell or rent durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) (other than a pharmacy or a physician, provider, or other entity that primarily furnishes services); and medical device distributors and wholesalers.