Spark Senior Health · Investment Book · Stage 4 of 5
Legal, Compliance & Risk Management
Entity design, CMS rules, Georgia requirements, and governance
§4.1 MSO Design §4.2 CMS Enrollment §4.3 GA State Compliance §4.4 CMS / Medicare Rules §4.5 Investor Rights & Governance §4.6 OIG Audit Defense
Entity Model
MSO (DE) + Clinical (GA)
CMS Billing
FFS-PFS · NP 85%
NP Supervision
Protocol Req'd · 8:1 (GA 2024)
↓Begin
Stage 4 · Legal, Compliance & Structure · Section 4.1
Corporate Structure — MSO & Clinical Entity Design
Two-entity model separating clinical practice from business operations. Required for investor capital, CMS compliance, and anti-kickback safe harbor protection.
§ 4.142 U.S.C. § 1320a-7b
Stark Law 42 CFR § 411
GA Secretary of State
Two-Entity Structure
MSO owns business assets · Clinical Entity holds CMS enrollment · linked by arm's-length Management Services Agreement
Spark Senior Health, INC
Delaware (investor-friendly) · for-profit corporation
  • Holds investor equity
  • Leases or owns clinic facilities (title entity TBD with counsel); owns equipment, vehicles, tech stack
  • Employs all non-clinical staff (billing, ops, MSO leadership)
  • Holds all IP, brand, software contracts, vendor agreements
  • Board-governed · investor rights attach here
  • Earns management fee from Clinical Entity under MSA
Management Services Agreement
Spark Senior Health, LLC
Georgia · professional clinical entity
  • Holds CMS PECOS enrollment (CMS-855B) and NPI
  • Employs or contracts NP/APRN, LPN, Medical Director
  • Holds GA professional licenses and malpractice coverage
  • Holds CLIA Certificate of Waiver for each clinic site
  • Physician ownership or supervision required (GA law)
  • Pays management fee to MSO under arm's-length MSA
Clinic Operations
Facility management · LPN clinical support · member transport coordination · community site partnerships
Telehealth Hub
Remote NP supervision via Doxy.me · CCM/APCM/RPM monitoring center · care coordinator team
Billing & Compliance
Commure RCM → Palmetto GBA J-J · CCM documentation audit · OIG 7-element compliance program
Management Services Agreement — Key Terms
Links MSO and Clinical Entity · must be arm's-length fair-market-value
💰
Management Fee
Fixed monthly fee or fixed % of clinical revenue (not % of Medicare billings). Must reflect FMV of services rendered — attorney-drafted FMV opinion required before execution. Typically 25–40% of gross clinical revenue under comparable rural practice benchmarks.
Anti-kickback safe harbor: must be FMV, not referral-based
📋
Services Schedule
Exhaustive list of MSO services: billing, coding, credentialing, facility management, fleet logistics, HR, marketing, tech stack, EHR administration. Attorney-drafted to prevent scope creep and AKS exposure.
⚖️
Clinical Autonomy Clause
MSO has zero authority over clinical decisions, treatment protocols, prescribing, or any patient care activity. Required for CMS condition of participation and GA Medical Board compliance.
CMS and GA Medical Board requirement — non-negotiable
📅
Term & Termination
Typical: 3–5 years with auto-renewal. Termination for cause (90 days notice). Termination for convenience (180 days notice). Change of control provision required before a future priced equity round (none is planned in the 5-year model). Transition assistance obligation on termination.
Physician Ownership & Anti-Kickback Analysis
GA requires physician in or supervising clinical entity · Stark + AKS govern MSO equity
GA Requirement: Clinical Entity must be physician-owned — GA does not permit NP-owned independent practices. Adopted structure: a contracted Georgia-licensed Physician Owner holds the PC (ownership, clinical authority, protocols, Medicare enrollment attestations). Contracted collaborating physicians — one per up to 8 NP/PA heads — sign and maintain each NP's protocol agreement. Permit Health bid pending.
Stark Law (42 CFR § 411): Prohibits physician referrals for designated health services to entities in which they have a financial interest, unless an exception applies. The Physician Owner and collaborating physicians are paid fixed, fair-market-value contract fees with no MSO equity. The CMO/Advisor holds an MSO board seat: any MSO equity or advisory pay must fit a Stark exception and AKS safe harbor documented by counsel — fixed, FMV, set in advance, never tied to referrals or Medicare volume — with board recusal on matters involving the MSA or their own referrals.
Safe Harbor Options: (1) Personal services and management contracts — fixed FMV compensation for the Physician Owner and collaborating physicians (adopted). (2) Investment interest safe harbor — required for any physician-held MSO equity, including the CMO/Advisor. (3) No physician MSO equity at launch beyond the documented CMO/Advisor arrangement.
Recommended approach: Medical Director contracted or employed by Clinical Entity with fixed fee/salary. No MSO equity until healthcare attorney clears structure. Clean at formation — extremely difficult to unwind later.
Required legal documents (total ~$39K): Entity formation (LLC/Corp + MSO + PC, operating agreements, ~$8K) · Healthcare attorney review (Stark/AKS, Nurse Protocol Agreement, ~$12K) · MSA drafting + FMV opinion (~$6K) · Shareholder agreements + cap table (~$5K) · Series Seed financing documents (NVCA-based stock purchase, investor rights and voting agreements, ~$8K)
Stage 4 · Legal, Compliance & Structure · Section 4.2
CMS Enrollment — Designation & Provider Setup
Confirmed billing model: straight Medicare FFS-PFS via Palmetto GBA J-J. No RHC designation at launch. The financial model prices claims at the NP rate (85%). PECOS enrollment timeline and clinician credentialing requirements mapped.
§ 4.2CMS PECOS 855B/I/R
Palmetto GBA J-J MAC 2026
NP billing ×0.85
Billing Model — Confirmed: FFS-PFS
Decision made · RHC deferred to Month 18–24 evaluation · FQHC excluded
✓ Confirmed — Launch Model
Medicare FFS-PFS
✓ AWV at ~$148 (G0438) / ~$117 (G0439) NP rate ✓ E&M codes at 2026 MPFS NP rate (×0.85) ✓ CCM/APCM/RPM at PFS non-facility rates ✓ No annual CMS-222 cost report burden ✓ No AIR cap on high-value visit types ✓ Fastest path to first claim (PECOS only) ✓ NPs bill under their own NPI at 85%
⏸ Deferred — Month 18–24 Evaluation
RHC Designation
→ All 10 counties are HPSA/MUA qualified → Fixed-location clinics qualify for RHC designation → 2026 RHC per-visit cap: $165 (one all-inclusive rate per encounter) → CCM/APCM/RPM same rate either way → Annual CMS-222 cost report required → Evaluate at Mo 18–24 once case mix is known
✗ Excluded — Not Compatible
FQHC Designation
✗ Requires non-profit governance structure ✗ Patient majority community board required ✗ Incompatible with for-profit MSO model ✗ Cannot hold both RHC and FQHC designations ✗ Multi-year HRSA application process
QMB compliance note: Under FFS-PFS, QMB members (~30% of panel) generate Medicare's 80% on visits/diagnostics — the 20% coinsurance is written off entirely per federal law (SSA §1902(n)(3)(B)). SLMB members bill identically to standard FFS. CCM, APCM, and RPM are not subject to patient cost-sharing and are unaffected by QMB status. EHR and billing system must be configured to identify QMB status at intake and suppress coinsurance billing automatically.
CMS PECOS Enrollment — Timeline
File ~90 days before first patient · Palmetto GBA J-J is GA's Medicare Administrative Contractor
1
Obtain NPIs (Type I & II)
Individual NPI (Type I) for each clinician. Group/Org NPI (Type II) for Clinical Entity. NPPES registration — free, 1–2 weeks processing.
Month 1 · ~1–2 weeks
2
EIN / Tax ID Registration
Clinical Entity must have its own Federal EIN (IRS SS-4), separate from MSO EIN. Required before PECOS enrollment. GA LLC formation concurrent.
Month 1 · same-day IRS online
3
CMS-855B — Group Practice Enrollment
Clinical Entity enrolls as group provider. Attach NPI, EIN, GA professional license, malpractice certificate, clinic address (fixed location). Submit via PECOS online portal to Palmetto GBA J-J.
Month 1–2 · 60–90 days processing
4
855I/R — Individual Clinician Reassignment
Each NP and MD enrolls individually (855I) and reassigns billing rights to the group (855R). Credentialing documentation required per clinician. NP must have active GA license and active Nurse Protocol Agreement before submitting.
Month 1–2 · concurrent with 855B
5
CLIA Certificate of Waiver
Required before any POC lab testing (i-STAT, Afinion 2, Sysmex XW-100, rapid tests). Application via CDC/CMS CLIA online. GA DCH performs site survey. Fixed clinic address listed as lab site. Fee: ~$180 every 2 years. Apply concurrent with PECOS.
Month 1–2 · 30–60 days
✓
First Billable Claim Submitted
All enrollment complete. CLIA waiver issued. NP under active Nurse Protocol Agreement. Palmetto GBA EDI submitter ID active. EHR live. First clinic visit → first claim submitted → CMS payment arrives 30–45 days later.
Month 3–4 after entity formation = model Month 1 (Clinic 1 · Habersham)
Clinician Credentialing — GA Requirements
Every billable clinician credentialed before first Medicare patient · GA 2024 rules
RoleGA LicenseCMS EnrollmentSpecial Requirement
NP / APRNBoard of Nursing + Composite Medical Board855I + 855RNurse Protocol Agreement with supervising MD · filed with GA Composite Medical Board · specify telehealth supervision modality
Medical Director (MD)GA Medical Board855I + 855RDEA registration · malpractice insurance · immediately available (phone/telehealth) during all clinical hours · signs Nurse Protocol Agreement
LPNGA Board of NursingNOT independently billableServices bill under supervising NP/MD via incident-to rules · phlebotomy training documented in personnel file
DriverValid GA driver's licenseNot a billing roleBackground check · clean driving record · HIPAA training before transporting members
2024 GA Expansion (eff. July 1, 2024): APRNs may now prescribe specific Schedule II controlled substances (previously prohibited). One physician may supervise up to 8 APRNs/PAs (previously 4). Protocol agreements must be updated to reflect expanded Schedule II authority and higher supervision ratio.
Billing structure — confirmed: E&M, AWV and TOC are billed under each NP's own NPI at 85% of the physician fee schedule, exactly as the financial model prices them. Incident-to billing is not pursued. Each NP needs an individual 855I with reassignment (855R) to the Georgia PC before their first claim.
Stage 4 · Legal, Compliance & Structure · Section 4.3
Georgia State Compliance — Complete Regulatory Map
Every Georgia-specific requirement mapped to the fixed-clinic model. NP supervision, CLIA, telemedicine, prescribing, HIPAA, OSHA, and ADA building compliance.
§ 4.3GA Nurse Protocol Act
O.C.G.A. § 43-34-23
GA DCH · CLIA · SB 128
NP / APRN Supervision — Georgia Requirements
Restricted practice state · physician protocol agreement mandatory · no independent practice
📄
Nurse Protocol Agreement
Written agreement between NP and delegating physician. Filed with GA Composite Medical Board before first patient encounter. Each NP needs their own agreement — one agreement per NP, per supervising physician. Must explicitly include telehealth supervision clause for Doxy.me model.
Required before first patient — cannot be retroactive
📞
Physician Immediate Availability
Delegating physician must be immediately available for consultation during all clinical hours. In our model: synchronous telehealth or phone availability. Not required to be on-site at the fixed clinic. "Immediately available" must be defined in the protocol agreement — not just implied.
Define "immediately available" explicitly in protocol agreement
💊
Prescribing Authority (Post July 2024)
NP may prescribe Schedules III–V with DEA number. Schedule II now permitted for specific substances with expanded protocol agreement language. Schedule I prohibited. Non-controlled prescriptions: 12-month refill limit. GA PDMP query required before any controlled substance.
2024 expansion in effect · update protocol agreement language
🔢
Supervision Ratio
One physician may supervise up to 8 APRNs/PAs (updated July 1, 2024, previously 4). Our model: collaborating physicians at one per 8 NP/PA heads — contracted physician coverage grows from 2 in Y1 to 4 by Y4–Y5. NPs are added when visit demand passes 85% of capacity, staying within the 1:8 limit.
8:1 ratio effective July 1, 2024
CLIA, Lab & Diagnostics — Fixed Clinic Rules
Certificate of Waiver covers all POC tests · Fixed clinic address is the lab site
🧪
CLIA Certificate of Waiver
Required before any POC lab testing. Application to CMS via CDC CLIA online portal. GA DCH performs site survey of the fixed clinic location. Fee: ~$180 every 2 years. Medical Director named as CLIA lab director at launch. Apply concurrent with PECOS.
Apply at Month 1 — concurrent with PECOS enrollment
🩸
LPN Phlebotomy
GA law permits LPN to draw blood. Phlebotomy training must be documented in personnel file before first blood draw. POC fingerstick (HbA1c, lipid panel) does not require phlebotomy certification. Venipuncture does — confirm training prior to hire.
Permitted · training documentation required in personnel file
💓
ECG Interpretation
LPN may perform 12-lead ECG tracing; NP or MD must provide interpretation and sign the report for billing. Bill CPT 93000 (ECG with interpretation and report). Interpretation must be documented in chart note before claim submission.
LPN performs · NP/MD interprets and bills 93000
🔊
POCUS (Portable Ultrasound)
Point-of-care ultrasound (Butterfly iQ+) is within NP scope in GA if included in the Nurse Protocol Agreement and the NP has documented training/competency. Billing requires interpretation documentation in the chart. Add to protocol at Month 6 when POCUS is introduced.
Must be specified in Nurse Protocol Agreement · add at Month 6 phase-in
Telemedicine & HIPAA — GA Requirements
SB 128 governs GA telehealth · HIPAA mobile encryption mandatory · clinic network isolation required
📹
GA Telemedicine (SB 128)
Telehealth permitted for diagnosis, treatment, and prescribing after provider-patient relationship established (first in-clinic visit). Synchronous audio-video (Doxy.me Pro or Zoom for Healthcare) required for prescribing encounters. Hub-and-spoke NP supervision model is fully compliant.
Hub-and-spoke fixed-clinic model is compliant
🔒
HIPAA — Network & Device Encryption
All clinic devices (workstations, tablets, RPM hubs) must have full-disk encryption (MDM via Rippling). Clinical network VLAN isolated from guest WiFi. BAAs required with: EHR vendor, Commure (RCM/AI), Chronic Care IQ, Tenovi, Bamboo Health, Doxy.me, Proton, Compliancy Group. 60-day breach notification requirement.
BAAs with all vendors required before go-live
🏥
OSHA — Clinical Environments
Bloodborne pathogen standard (29 CFR 1910.1030): sharps containers, PPE available and documented, biohazard waste disposal with licensed hauler (Stericycle, $90/mo), exposure incident procedure in writing. Annual staff training with completion log. OSHA compliance inspection by operations lead before Clinic 1 opens.
Biohazard hauler contract required before first patient
♿
ADA Building Compliance
Fixed clinic must meet ADA requirements before opening: entry ramp (1:12 slope), accessible restroom (60-inch turning radius, grab bars), van-accessible parking, lever door handles, tactile signage. CASp (Certified Access Specialist) review recommended before lease execution.
Required for Medicare enrollment · CASp review before lease
Pre-Launch GA Compliance Checklist
All items required before first patient encounter · order matters
GA Clinical Entity formed with physician ownership/supervisionREQUIRED
Nurse Protocol Agreement(s) filed with GA Composite Medical BoardREQUIRED
CLIA Certificate of Waiver issued for each fixed clinic locationREQUIRED
PECOS enrollment complete (855B + 855I/R) · Palmetto GBA J-J EDI activeREQUIRED
HIPAA BAAs signed with all technology vendorsREQUIRED
OSHA bloodborne pathogen program · biohazard hauler contract activeREQUIRED
Malpractice insurance (NP/MD) · commercial property + general liabilityREQUIRED
ADA compliance confirmed (CASp review) · accessible restroom + entryREQUIRED
EHR live · QMB identification workflow configured · Commure RCM activeREQUIRED
GA CON review — confirm fixed-clinic primary care is exempt from CONFLAG · attorney confirm
Telehealth platform BAA + prescribing consent workflow in EHRFLAG · pre-launch
FWA + HIPAA training completed by all staff (logged in Rippling)BEFORE GO-LIVE
OIG exclusion screening complete for all staff (monthly thereafter)BEFORE GO-LIVE
Stage 4 · Legal, Compliance & Structure · Section 4.4
CMS / Medicare Rules — Billing, Documentation & Telehealth
Federal billing and documentation requirements for every service Spark Senior Health bills. CCM and RPM have the most specific and audit-sensitive standards — non-compliance is a direct revenue risk and audit trigger.
§ 4.4CMS Medicare Claims
Processing Manual
OIG Work Plan 2026
CCM / APCM Billing — Documentation Requirements
99490 / 99487 / G0558 · time log and care plan are the audit tripwires
Written Care Plan (Required for CCM/APCM)
Comprehensive care plan must be created, implemented, and shared with patient before any CCM or APCM billing begins. Must address all chronic conditions, care goals, responsible providers, medication list, and follow-up schedule. Must exist in EHR — not on paper.
Must exist in EHR before first CCM/APCM claim — not retroactively
Patient Consent (Required)
Written or verbal (documented) consent required. Patient informed that only one provider may bill CCM per calendar month. Consent is a condition of payment — if consent is not documented, the claim is invalid. Obtain and document at AWV or first visit before first bill.
Obtain and document at AWV or first visit — before first monthly bill
20-Minute Monthly Time Log (99490) / 60 min (99487)
Every minute of CCM time must be documented with: date, staff name, duration in minutes, specific activity. Activities: phone calls, medication reconciliation, care coordination, RPM data review, referral management. Generic notes are insufficient. Chronic Care IQ auto-logs time from coordinator activity — use it.
Non-Face-to-Face Requirement
CCM time does not require face-to-face contact. Care coordinator phone, EHR task, and coordination time counts. Clinical staff only — administrative-only tasks (scheduling, insurance verification) do not count toward CCM time.
APCM — No Time Threshold Required
APCM (G0558/G0557/G0556) does not require monthly time tracking — billed based on enrollment and active care plan maintenance. This is APCM's primary billing advantage over CCM. Still requires active care plan on file and care plan being actively maintained.
RPM, Telehealth & AWV — Key Rules
Three highest-value billing categories · each with distinct documentation requirements
RPM — Device & Data Requirements
Device must automatically transmit data (no patient self-reporting — this is the hard line). At least 16 days of data per 30-day period for 99454. 2–15 days for new 99445 (2026). Staff review ≥20 min/month for 99457 with documented clinical note. Tenovi server logs serve as device data audit trail — export monthly.
RPM + CCM/APCM Concurrent Billing
Both may be billed in the same month for the same patient when activities are performed separately by different staff or at different times. Time must not be double-counted between CCM and RPM logs. Both care plans should reference each other in EHR documentation.
Medicare Telehealth — Fixed Clinic as Originating Site
Our fixed clinic is a rural originating site. Patient at clinic + NP at remote hub = qualifying rural telehealth encounter. Place of service: 02 (telehealth). GT modifier on professional claims. All 10 Spark Senior Health counties qualify as rural originating sites. This billing structure must be confirmed with billing counsel — the "fixed clinic as originating site" framing is the key CMS compliance point.
Incident-to vs. Independent NP Billing
Spark Senior Health bills independently under each NP's own NPI at 85% of the Medicare rate — the structure the financial model uses. Incident-to billing (100% under a physician NPI, requiring the physician to have seen the patient for the condition and be immediately available) is not pursued.
Annual Wellness Visit (G0438/G0439 + G2211)
Initial AWV (G0438): requires Health Risk Assessment, cognitive assessment (MoCA), depression screening (PHQ-9), fall risk screening (STEADI), functional ability + safety. G0439 (subsequent): HRA update + care plan review. Both establish CMS attribution. AWV is the primary CCM/APCM enrollment trigger — document 2+ chronic conditions qualifying the member for CCM/APCM enrollment in the AWV note.
Top OIG Audit Triggers — Rural Fixed-Clinic FFS Practice
2026 OIG Work Plan priorities · proactive mitigation is the defense
🔴 High Risk
CCM Volume vs. Panel Size
High CCM billing relative to patient volume triggers RAC review. Mitigation: document CCM eligibility (≥2 chronic conditions lasting ≥12 months) in every enrolled patient's chart before first CCM bill. Chronic Care IQ eligibility flag is the audit trail.
🔴 High Risk
CCM Time Documentation
The #1 CCM audit failure. EHR must produce a per-patient per-month time log. Generic notes are insufficient — activity-specific documentation required. Chronic Care IQ auto-logs coordinator activity: this is the primary audit defense.
🟡 Medium Risk
Telehealth Billing Ratio
If >60% of claims use telehealth codes, CMS flags for review. Spark Senior Health's model: in-clinic visits at the fixed location are the primary encounter type. Telehealth is the NP supervision modality, not the visit type. Clearly distinguish in billing documentation and POS codes.
🟡 Medium Risk
E&M Upcoding (99214/99215)
High frequency of 99214/99215 for a rural elderly panel triggers review. E&M level must be supported by medical decision complexity (MDM) documented in chart note. Quarterly internal E&M audit recommended. Commure Ambient AI coding suggestions should be validated, not automatically accepted.
🟡 Medium Risk
RPM Without Clinical Review
Billing 99457 without documented staff review of physiologic data is fraudulent. Tenovi dashboard provides timestamped review logs — export monthly as audit support. Care coordinator RPM monitoring time must be documented in EHR alongside device data.
Stage 4 · Legal, Compliance & Structure · Section 4.5
Shareholder Documents — Investor Rights & Governance
The investor rights package and shareholder agreement are the legal backbone of the seed round. These documents define what investors receive, how decisions get made, and how equity is protected through future financing events.
§ 4.5NVCA Model Documents
Series Seed · priced equity
Securities Attorney Required
Investor Rights Package — Seed Stage
Rights granted to seed investors at signing · minimal by design · expands at a future priced equity round (none planned in the 5-year model)
Information Rights
📊
Quarterly Financial Reporting
Unaudited P&L, balance sheet, and cash position each quarter-end. Includes portfolio member count, clinic-level EBITDA, and cash runway. Standard for Series Seed preferred holders.
📋
Annual Audited Financials
Full GAAP audit required at a future priced equity round (none is planned in the 5-year model) or a sale process. At seed stage, annual unaudited financials are acceptable. Audit firm selected by board.
📁
Material Event Notification
Investors notified of material developments: key executive departures, CMS audit initiation, regulatory actions, litigation above $50K threshold, or any event reasonably likely to affect the business.
Governance Rights
👁️
Board Observer Right — Lead Investor
Lead investor (largest check) receives non-voting board observer seat. Right to attend all board meetings, receive board materials, and ask questions — but no vote. Does not create liability exposure. Observer right terminates if investor's stake falls below 5%.
⚡
Pro-Rata Right in Future Rounds
Each Series Seed investor has the right (not obligation) to participate in a future priced equity round (none is planned in the 5-year model) at their pro-rata ownership percentage. Prevents dilution without consent. Standard NVCA investor-rights provision.
Shareholder Agreement — Protective Provisions
Governs equity transfers, sale events, and founder protections · attorney-drafted required
Transfer Controls
🔒
Transfer Restrictions
No shareholder may transfer, sell, or assign equity without prior board approval. Prevents equity from reaching competitors, undisclosed third parties, or entities that could create CMS enrollment conflicts. Board has 30 days to approve or reject any proposed transfer.
🏦
Right of First Refusal (ROFR)
Before any shareholder sells their stake to a third party, the company and then existing shareholders have the right to purchase at the same price and terms. Prevents hostile or unwanted outside ownership. ROFR order: company first, then pro-rata among existing investors.
Sale Event Provisions
📌
Tag-Along Right
If founders sell their shares, investors have the right to "tag along" and sell their stake on the same terms and at the same price. Protects investors from being left behind if founders exit. Applies to any sale representing more than 10% of outstanding shares.
🔗
Drag-Along Right
If a supermajority of shareholders (typically 65–70%) vote to sell the company, they can compel all remaining shareholders to participate in the sale at the same price. Prevents a small minority from blocking a strategically approved exit. Required for any clean M&A process.
Founder Protections
⚡
Vesting Acceleration — Single Trigger
On a company acquisition or change of control, all unvested founder shares accelerate to fully vested immediately. Protects founders from being acquired mid-vest with unvested equity captured by the acquirer. Standard in healthcare exits — confirm with securities attorney before signing.
Stage 4 · Legal, Compliance & Structure · Section 4.6
Risk, Audit & Compliance Program — OIG 7-Element Framework
A formal compliance program is not optional — it is both a CMS expectation and an investor confidence signal. Spark Senior Health's program is built on the OIG 7-element framework. Compliancy Group manages BAAs and audit readiness at $400/month.
§ 4.6OIG Compliance Guidance
False Claims Act 31 U.S.C. § 3729
7-Element Framework
OIG 7-Element Compliance Program
Required structure for any Medicare-billing provider · investor signal of operational maturity
1
Written Policies & Procedures
Billing compliance manual: CCM/APCM documentation standards, RPM review protocol, E&M coding guidelines, NP independent billing rules (NP NPI at 85%) and incident-to rules for LPN services, HIPAA privacy procedures. Updated annually. Stored in Notion SOP library.
Required pre-launch · Compliancy Group assists with HIPAA portion
2
Designated Compliance Officer
Responsible for oversight of compliance program. At launch: compliance oversight by the Chief Legal & Compliance Advisor (seat pending) with fractional support. Compliance & Privacy Manager added in Y3 (lean build, $125K/role MSO costing). Reports directly to board, not billing staff.
3
Effective Training & Education
FWA (Fraud, Waste & Abuse) and HIPAA training required for all staff before any patient contact. Annual refresher. CCM/RPM-specific documentation training for clinical staff. Training completion logged in Rippling HR platform — OIG exclusion screening monthly for all staff.
FWA training before first patient encounter — non-negotiable
4
Open Lines of Communication
Anonymous reporting channel (hotline or web form). Non-retaliation policy in employee handbook. Staff must feel safe reporting documentation concerns without fear of job loss. Qui tam risk is real — an employee who sees upcoding and cannot safely report internally will report to OIG instead.
5
Internal Auditing & Monitoring
Quarterly chart review: minimum 10 CCM records + 10 E&M records per quarter. Monthly RPM data review audit. Results reported to compliance officer. Issues remediated within 30 days. EHR must support audit report generation — confirm with EHR vendor before PECOS enrollment.
EHR must support audit report export — confirm with vendor
6
Disciplinary Standards
Written policy: intentional upcoding = immediate termination. Unintentional documentation deficiencies = retraining + 30-day supervised review. Repeat errors = performance improvement plan. All disciplinary actions documented in Rippling HR platform.
7
Responding to Detected Problems
If audit finds systemic overbilling: voluntary self-disclosure to Palmetto GBA within 60 days, repayment plan, corrective action documented. Voluntary disclosure significantly reduces False Claims Act exposure. Document everything. Never ignore an anomalous billing pattern.
Audit Response Playbook
Three audit types · response timing is critical · never ignore
Prepayment Review
Claim held before payment
Submit supporting documentation within 45 days. Common for new CCM billers. Typically resolved within 60 days with correct documentation. Commure RCM flags these automatically.
RAC Audit (Post-Payment)
Retrospective claim review
45-day response window. Pull chart documentation. If valid: contest with appeal. If invalid: repay and self-report. Never ignore a RAC letter — non-response is deemed admission.
OIG Investigation
Systemic fraud allegation
Immediately retain healthcare defense attorney. Do not respond directly to OIG. Document all communications. Compliance program is primary defense — demonstrates good-faith.
Documentation Retention & Records
CMS minimum 7 years · GA state law 10 years · use the stricter standard
Clinical records (all encounters)10 years (GA O.C.G.A. § 31-33-2)
CCM/APCM time logs per patient7 years (CMS minimum)
RPM device data & review logs7 years (CMS minimum)
Nurse Protocol AgreementsDuration + 7 years
Billing records & claim submissions7 years (CMS minimum)
Compliance training completion logsDuration of employment + 5 years
Storage standardEncrypted · HIPAA-compliant cloud · offsite backup
False Claims Act — The Real Risk
The False Claims Act (31 U.S.C. § 3729) imposes treble damages + $27,000–$54,000 per false claim on providers who knowingly bill Medicare incorrectly. "Knowingly" includes deliberate ignorance — a documented compliance program is your evidence of good faith. Whistleblower (qui tam) provisions mean any employee can file an FCA suit and receive 15–30% of recovery. The anonymous reporting channel and non-retaliation policy are not just ethical — they are legally protective. An employee who sees a billing problem and can safely report it internally will not report it to the OIG.
Stage 4 · Legal, Compliance & Structure · Summary
Stage 4 Key Decisions & Open Items
Legal and compliance architecture fully established. Six sections covering entity structure, CMS enrollment, Georgia compliance, billing rules, investor rights & governance, and audit defense. Three open items require professional review before investor distribution.
∑Stage 4 Summary
6 sections complete
2
Entities required · MSO (Delaware) + Clinical Entity (Georgia)
FFS-PFS
Confirmed billing model · NP rate (85%) · NP NPI billing
~Mo 3–4
First billable claim after entity formation (= model Month 1) · after 60–90 day PECOS processing + EHR go-live
8:1
Max physician-to-NP supervision ratio · GA 2024 update (was 4:1)
7
OIG compliance elements · all required pre-launch · Compliancy Group assists
10 yr
Record retention · GA medical records law (stricter than CMS 7-year minimum)
Stage 4 Chapter Recap
Six sections · what was established
4.1MSO Structure — Delaware MSO (investor equity) + Georgia Clinical Entity (CMS provider number). MSA required at FMV — no % of Medicare billings. Clinical Entity (GA PC) owned by a contracted Physician Owner; collaborating physicians contracted (1 per 8 NP/PAs); Permit Health bid pending; CMO/Advisor equity and board role structured for Stark/AKS compliance. Anti-kickback safe harbor documentation required. Legal formation budget ~$39K.
4.2CMS Enrollment — FFS-PFS Confirmed. Straight Medicare FFS-PFS; the financial model prices claims at the NP rate. No RHC at launch (deferred to Mo 18–24). PECOS 855B + 855I/R · CLIA Certificate of Waiver · file 90 days before first patient.
4.3GA Compliance — Restricted NP practice state (no independent NP authority). Nurse Protocol Agreement mandatory — must specify telehealth supervision clause for Doxy.me model. 2024 expansion: Schedule II prescribing + 8:1 supervision ratio. ADA compliance required before first patient. 13-item pre-launch checklist fully mapped.
4.4CMS/Medicare Rules — CCM documentation (care plan + consent + monthly time log) is the #1 audit risk. Chronic Care IQ auto-logs time — primary audit defense. APCM has no time threshold — billing advantage. RPM requires automatic device transmission + documented staff review. Top 5 OIG triggers mapped for rural fixed-clinic FFS practice.
4.5Investor Rights & Shareholder Agreement — Seed investor rights: quarterly reporting, material event notification, board observer (lead investor), pro-rata right in any future priced round. Shareholder agreement: transfer restrictions, ROFR, tag-along, drag-along (65%+ supermajority), single-trigger acceleration on acquisition.
4.6Compliance Program — OIG 7-element framework. FWA + HIPAA training before go-live. Compliance oversight by the Chief Legal & Compliance Advisor (seat pending) with fractional support at launch; Compliance & Privacy Manager added in Y3. Quarterly chart review (10 CCM + 10 E&M). Compliancy Group ($400/mo) manages HIPAA program. FCA treble damages risk mitigated by documented good-faith program.
Next → Stage 5
Operations & Business Processes
HR management · hiring sequence · clinic operations · daily clinical workflow · community partnerships · visual deliverables