CMS Releases Guidance on Heightened Scrutiny

The Centers for Medicare & Medicaid Services (CMS) has issued a set of responses to Frequently Asked Questions (FAQs) on implementation activities associated with the January 2014 home and community-based settings final rule, especially focused on questions around heightened scrutiny. The FAQs focus on settings that have “the effect of isolating individuals receiving Medicaid [Home and Community-Based Services] HCBS from the broader community of individuals not receiving Medicaid HCBS.” According to CMS, the “guidance is designed to ensure that implementation decisions balance the need for robust stakeholder engagement with administrative feasibility.” The guidance directly addresses several policy areas that have created implementation challenges for states.

 Identifying Settings in the Third Prong:

The guidance affirms that CMS intends to take the following factors into account in determining whether a setting may be isolating:

 Due to the design or model of service provision in the setting, individuals have limited, if any, opportunities* for interaction in and with the broader community, including with individuals not receiving Medicaid-funded HCBS;

• The setting restricts beneficiary choice to receive services or to engage in activities outside of the setting; or
• The setting is physically located separate and apart from the broader community and does not facilitate beneficiary opportunity to access the broader community and participate in community services, consistent with a beneficiary’s person-centered service plan.

 This criteria represents a revision from previous guidance; most noticeably, examples of settings that may have isolating effects have been removed.

 Determining Whether Rural Settings Isolate

The guidance also addresses the challenge of determining whether rural settings, which may be remote by their very nature, qualify as “isolating.” CMS indicates that settings in rural areas “are not automatically presumed to have qualities of an institution, and more specifically, are not considered by CMS as automatically isolating to HCBS beneficiaries.” The guidance directs states to compare the access to engage in the community afforded HCBS recipients to that of individuals living in the same geographical area but not receiving Medicaid HCBS.

 Submitting Settings that are Remediating for Heightened Scrutiny

CMS also speaks to the confusion surrounding the state obligation to submit settings for heightened scrutiny when the state expects the setting to come into compliance before the end of the implementation transition period. While the guidance affirms that the transition period extends to March 17, 2022, CMS for the first time introduces a new deadline for resolving compliance issues without submitting a setting for heightened scrutiny review: “If the state initially determines that a setting has the effect of isolating individuals and that setting implements remediation to comply with regulatory criteria to the state’s satisfaction by July 1, 2020, then there will be no need to submit information on that setting to CMS for a heightened scrutiny review.” The settings, however,

should be identified in a state’s statewide transition plan (STP) or identified in information disseminated separate from the STP for public comment. CMS “reserves the right to review any setting that the state has attested has remediated isolating characteristics if the state receives significant public comment disagreeing with the state’s assessment.” Isolating settings that have not completed remediation by July 1, 2020, but which the state determines can achieve compliance by March 17, 2022, should be submitted to CMS by the state for a heightened scrutiny review within 120 days (by the end of October 2020).

 Balancing Privacy Concerns with Public Comment

CMS provides new guidance, superseding any old guidance, around protecting privacy concerns when publishing information related to settings under review in order to solicit public comment. According to the FAQs, “the state should not include any personally identifiable information of beneficiaries in the submission of the STP or in any notifications or information disseminated to the public.” CMS notes that information about a particular setting may constitute Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule if it relates to the physical or mental health or condition of an individual, the provision of health care or payment for care, and there is a reasonable basis to believe the information can be used to identify the individual. While the agency points out that the addresses of settings falling into the first two heightened scrutiny prongs are typically known to the general public, the guidance suggests caution when considering settings in the third prong, and ultimately leaves the determination of the presence of privacy concerns to the state.

 To the extent possible, states are encouraged to disclose generalized descriptions (not including names or addresses of the settings) of how the state determined that a presumptively institutional setting overcame, or will overcome, that presumption.

Should a state determine it is necessary to disclose the name or address of the setting, the state should consider whether the information about the setting that will be publicly disclosed is PHI as defined by HIPAA, based on the circumstances of each setting and the individuals served by that setting. If the information is determined to be PHI, the state can either remove all 18 personal identifiers described in HIPPA regulation, or gather authorizations from every resident of the setting granting permission to release the address and any other potentially identifiable information.

CMS encourages states to notify program participants and family members and guardians identified in the individual’s person-centered service plan as involved in their care that the state has determined that the setting overcomes the institutional presumption of being isolating, the state’s justification for that determination, and how these individuals may offer comments in response. The guidance indicates that states may notify primary aging and disability rights and advocacy organizations only to the extent that the state has determined that to do so would not necessitate the sharing of PHI.  

 CMS Process for Heightened Scrutiny Reviews

Recognizing that a large number of settings may be submitted for heightened scrutiny reviews, CMS provides additional detail about how they intend to review settings under heightened scrutiny. The agency is implementing the following review strategy:

 CMS will use the list of settings provided by a state for heightened scrutiny to compile a random sample of settings to review, which will include any setting the state requests CMS to review and any setting that generated significant public comment in opposition of the state’s assessment.

• CMS will review all information presented by the state and other parties on settings selected for the review sample and will either approve the state’s assertion that the setting overcomes the presumption that the setting is an institution or provide the state feedback on missing information, questions for clarity, or reasons why CMS cannot agree with the state. States will then have the opportunity to provide additional information to support their assertion before final determination is made by CMS.
• The state will use the CMS feedback to remediate settings that have the qualities of an institution not included in the CMS review sample.
• CMS will make final heightened scrutiny review determinations of each setting in the sample available on the Medicaid.gov/hcbs website.
• CMS may request to review additional settings and/or suggest changes to the state’s heightened scrutiny review process if the sample review highlights concerns with the state’s approach in determining whether a setting overcomes the presumption that it is an institution.
• CMS may also request information on any setting for which the state received public comments that the setting was presumptively institutional but was not included on the state’s heightened scrutiny list because the state determined it to meet the HCBS settings criteria.

 Information States Should Submit for Heightened Scrutiny Review

The guidance includes a list of information states should submit to CMS for a heightened scrutiny review. In addition to the list, CMS acknowledges the role of person-centered planning to “identify necessary services and supports to realize each beneficiary’s goals regarding access to and participation in the broader community,” and emphasizes that “the person-centered planning process should not be limited to consideration of services and supports covered solely under a particular Medicaid-funded HCBS authority, but should also include potential natural supports, external resources, or other funding vehicles available to meet those needs.” At the same time, CMS notes that nothing in the HCBS settings regulation requires a setting in which HCBS are provided to finance recreational activities in the community on behalf of Medicaid beneficiaries. The agency also reiterates that “reverse integration”– bringing people from the broader community into a setting—is insufficient to meet the requirements of the rule.

 Promising Practices for Remediation

While CMS announces that it is collaborating with the Administration for Community Living (ACL) to develop a comprehensive set of promising practices to remediate settings that have been identified as being isolating, the current guidance also includes a set of suggestions “for state consideration.”

 Additional Topics

In addition to information clarifying the heightened scrutiny process, the FAQs also clarify two other topics that have often been raised with CMS: whether an individual’s private residence should be assessed for compliance with the settings criteria, and whether an individual should reside in a compliant setting in order to receive Medicaid reimbursement for non-residential HCBS.

 CMS indicates that privately-owned or rented homes and apartments in which the individual receiving Medicaid-funded HCBS lives independently or with family members, friends, or roommates are presumed to be in compliance with the regulatory criteria of a home and community-based setting. States are not responsible for confirming this presumption but should include private residences as part of their overall quality assurance framework when implementing monitoring processes for ongoing compliance with the federal HCBS requirements, as well as any oversight provisions articulated in their approved HCBS waivers or state plan. However, settings where the beneficiary lives in a private residence owned by an unrelated paid caregiver are considered provider-owned or -controlled settings and should be evaluated as such.

 The guidance also clarifies that states are not responsible for ensuring compliance with the settings criteria for residences of individuals receiving only non-residential services. If an individual lives in a provider-owned setting that does not receive Medicaid funding, and leaves that residence to receive HCBS at another site, only the site where the HCBS is delivered must meet the settings criteria.