התמלול המלא של CMS TEAM Compliance Risks Hiding in Plain Sight: Gain Sharing, Data Governance & AI | Ep. 4

you've spent your career at the intersection of healthcare regulation and technology — it'd be really helpful to know what interests you about compliance and the data side specifically associated with TEAM. [03:02] Paul Uhrig: Yeah, you know, TEAM in particular — for decades we've been talking about how the health system is broken. We've been talking about how we should be doing more than just treating patients when they're sick, but making them healthy, or making sure they don't go back into the hospital. And we've been talking about a major problem being misaligned incentives. So the TEAM program, to me, is a great step to solve a lot of those problems. Obviously, the purpose is to make sure patients don't come back — that there are no readmissions — and the whole program is based on the alignment of incentives among the providers in the care continuum. So I think it's a great program that advances our interests. But with any of these types of programs, there is — as we're going to talk about — compliance risk, because underlying that, you have to make sure you have the right structures in place. I'm also interested in TEAM from a data perspective. I've spent a lot of my career in the interoperability space, making sure health data gets to the right place at the right time for the right purpose. And if health systems are really going to manage post-discharge care, information and access to that information is key — and there's a whole regulatory environment behind that as well. The issues we're going to talk about are at times complex, but they're issues we've faced in prior arrangements too. [04:41] Marla Merkle: Yeah, definitely — sensitive topics for some, but ultimately educational, and we're here to spread the news and awareness. That's our role today. With that said, it's helpful to know what compliance conversations are happening internally within the hospital and legal teams, and what conversations they should be having right now but likely aren't. Do you have any thoughts on that? [05:05] Paul Uhrig: Yeah, I think at a high level, legal and compliance teams really should be engaged early on in these discussions. You don't have to be around that long to know that going to legal compliance isn't always top of the list for people working within a system. But what really needs to happen is the operationalization of these programs, and the legal structure need to go hand in hand. So I'm a fan of making sure you get the legal and compliance teams involved early, because they need a view of what's happening operationally — and we need to make sure those operations comply with the various laws: Stark, anti-kickback, and the TEAM program regulations on both the federal and state side. So I think very much creating a committee — getting the right people together, your technology people, your finance people, your legal people, population health — that's the right team. Get everybody together early to really start these discussions. I think

that's key to success. [06:16] Marla Merkle: So I've got a follow-up question. When we're talking about gain-sharing agreements, can you walk us through what's actually involved when a hospital has a gain-sharing arrangement with their downstream providers, as it applies to TEAM? [06:30] Paul Uhrig: Sure. Gain-sharing is one of the arrangements that can be put in place to really manage the care, and — as we talked about — make sure these incentives are all aligned. These can be pretty complex — it's not just simply saying we're going to share the savings. What you've really got to put in place is the right governance, the right data analytics, the right contracting, and then the payment infrastructure, to make sure you're implementing and executing these arrangements appropriately. Because the whole intent is: when there are incentive payments paid by the government, you want to share those with your downstream providers, so they share in the benefits of managing the care appropriately. So you have to look at, as always, the Stark and anti-kickback provisions, the fraud and abuse provisions on both the federal and state side, to make sure you're sharing these episodic financial results appropriately. As I said, you've got the legal documents, but you have to make sure they work hand in hand with your operational side of the house. So I think a legal department really needs to be asking a number of questions about the arrangements as they go into these programs. One is certainly: what's the regulatory authority? You always start there — what are you worried about? Again, it's going to be Stark, it's going to be the anti-kickback statute, it's going to be the TEAM regulation on both the federal and state side. You've got to be asking what the care redesign objective is that you're trying to achieve — is it efficiency, is it quality, is it care coordination, is it all of these things? Then you've got to talk about compensation and how it's calculated — what's the methodology, how are you documenting the sharing of these payments you're getting from the government? You always have to make sure these can't be viewed as rewarding referrals — that's the third rail in all of these arrangements. What you really need to be doing is making sure you're providing the care that's needed. And finally, you've got to make sure you have a written agreement. This is where a lot of people fall down — they think about it after the fact and put an agreement together after the fact. You really have to have all of this documented in your agreements with your downstream providers before you start implementation, before you start providing the care or sending patients to the referral sources. So these are all things you need to worry about, including the monitoring and auditing after the fact, in case the government comes in to audit what's going on with the gain-sharing arrangement. [09:53] Marla Merkle: Absolutely. I think there's some misconception too around what gain sharing actually is for the ancillary providers and community network partners in the post-acute care space. Something we want to emphasize in those conversations is really fostering those relationships early, and getting those communications underway as quickly as possible, as we approach these conversations and build an understanding of what gain sharing is and what those relationships look like. [10:28] Paul Uhrig: Right, because in that case you're probably developing new financial arrangements, where you're going to share the savings or incentives with these providers, and it has to be on the right criteria if you're going to do this properly. [10:43] Marla Merkle: Yeah, absolutely — ethically, legally, and touching on that too — where do fraud and abuse safe harbors really come into play, and in your mind, what's the biggest misstep you see hospitals making here? [10:57] Paul Uhrig: Well, often it's not making sure the actual operations are reflected in the agreement, and vice versa — just making sure you have that coordination. You can't have a perfect agreement if your operations aren't aligned with what's supposed to happen. And again, where this needs to go is compliance. In late 2020, early '21, OIG did issue a new safe harbor around CMS-sponsored model arrangements — so it's relatively new in the grand scheme of things, and you just need to make sure you're in strict compliance with those requirements, and that it's driving the model you're involved in. You need to make sure the exchange of value isn't inducing referrals — often not the case, but you've got to make sure it can't be construed that way. You can't limit services — the point here is to provide the best care, not to limit services or provide medically unnecessary services either. And again, all of this needs to be in writing, in place before you start providing the care and referring patients out. [12:24] Marla Merkle: Yeah, that makes a lot of sense. We've been touching on a lot of things here, and I really want to highlight the importance of the data governance piece you mentioned, because this episode spans both the acute care space and the post-acute care space, and within other settings. What should hospitals really focus on in their compliance teams, and what kind of questions should they be asking around data specifically and how it's used? [12:55] Paul Uhrig: Well, I think the first question is always who you're sharing data with. When you're sharing data with other clinicians, with other providers, there are long-standing frameworks by which that occurs today — whether it's the Trusted Exchange Framework and Common Agreement, whether it's Epic Care Everywhere, your state HIE. So you have the technical infrastructures in place, and often that's covered by HIPAA or applicable state law where you're sharing information for treatment and operations. In that context, the rules of the road are well established, and I think health systems have a lot of

familiarity with this. Where it becomes trickier is who you're hiring as vendors — either to do the analytics around the program, and I know we're going to talk about AI in a second, that's absolutely where it becomes important that you remain in compliance with your federal and state laws. You need your HIPAA BAA — business associate agreement — in place, and the right data use restrictions in place as well. What I've seen often is some vendor may use the data beyond what they should, or maybe the agreement allows them to use the data for purposes broader than what was really intended. So you need to keep a close eye on that data use and the restrictions — is it really only being used for this purpose? [14:35] Marla Merkle: Sure, sure. And on that note, from the hospital regulation side, we really see data becoming a question around the intersection of how it's used — I'm curious what you've seen or managed, any real-life experiences where you've seen it go awry, or any valuable anecdotes that could be helpful. [14:58] Paul Uhrig: I've spent a lot of my time working on and promoting interoperability, but we do unfortunately see some circumstances where the vendor isn't properly vetted, or maybe they have a downstream vendor they use, and there hasn't been sufficient vetting that the use will be limited to what was agreed upon. So it really is a "know your customer, but know your vendor" situation — know what systems they're using, and really scour that agreement to make sure there's no loophole that allows someone to use data — whether identified or de-identified — in a way the health system never intended. Unfortunately, we are seeing some cases where people are using data in ways they shouldn't, and the health system has to be very vigilant about that. Marla Merkle: Absolutely — utilizing it responsibly. Paul Uhrig: Right, right. And then on the other hand, you have information blocking — providers are sometimes in a difficult position, because if they don't release the data, they can be accused of information blocking under federal law, but if they release it inappropriately, then maybe they have problems under HIPAA. So there's a balancing act here to make sure the health system is doing the right thing by their patients. [16:30] Marla Merkle: You know, Paul, that's a really important point as we talk about AI. So what I'm interested to know is: where or how do you feel AI intersects with TEAM compliance and data governance, but in a concrete way? Where do you see the use of that coming into both fields while staying compliant? [16:50] Paul Uhrig: Yeah, obviously we're all talking about AI. I think health systems, both large and small, are really embarking on this journey of what the best governance of AI and the use of data looks like. I certainly see AI being used in terms of TEAM, because you need to do the analytics — you need to wonder if you can use AI to better understand where your patients are going. I certainly see a world

where remote patient monitoring becomes more important in managing post-discharge care, and these applications and vendors are going to use AI to supplement those capabilities. So the governance again becomes incredibly important, in the tools being used. I think systems that are successful have somewhat centralized that governance — you need your individual stakeholders involved, so if radiologists want to use AI, radiology has to be involved; population health needs to be involved. But I do think a system needs some centralized governance to make sure all the AI applications they're using work seamlessly, and you're not developing a bunch of silos. So centralized governance, with the involvement of the applicable stakeholders, is key. But then you have all the issues of the reliability and accuracy of the AI. I still believe that in these early stages, you need that "human in the loop" concept to verify — but how do you balance that, because if the human always has to verify the data, you're not gaining the efficiencies you want. In these early stages, I think you need a lot of diligence to ensure you're getting the results you really want from the AI. And on the flip side with data, you need to ensure your data isn't being used inappropriately to feed into or train LLMs — it may be something you want, but it comes down again to your agreements and what they allow, because you have increasing mobility of data in today's age. [19:28] Marla Merkle: Are there any questions top of mind that you'd recommend a hospital system ask before centralization takes place? What questions should they proactively be asking before they ever set up the structure — any must-asks before they adopt any kind of AI tool in this context? [19:47] Paul Uhrig: Well, it always gets to your goals, and maybe, to some extent, starting incrementally, I'd say. I think it's important for health systems, in order to gain momentum around the use of AI, to get some early wins — and that takes diligence. I think we've seen a sea change in just the past six months within health systems, with administrators and clinicians who — a few months, certainly a year ago — had a lot of skepticism, and now there's enormous enthusiasm. We all use it in our personal lives and see some of the benefits, but we also see some of the risks. So I think you start incrementally, get some wins, do your due diligence, and start on the administrator side, then move into the clinical side of AI use. You have to move deliberately, but we're also in an age where health systems need to move with some speed, because I do think AI will be very beneficial if it's used correctly. [21:11] Robby Wallace: Throughout our conversation, we've been touching on the upstream and downstream impacts of the CMS mandate. I think there are perhaps questions being asked internally within hospitals — and even outside of them — as to whether this is really going to be enforced, and if so, how. And you've lived through something similar at SureScripts with the e-prescribing mandates, right? Paul Uhrig: Yep. Robby Wallace: What's the historical parallel? What would you tell people? [21:53] Paul Uhrig: Yeah, I think a couple of things. One, I do believe this administration — based on everything they've said from the beginning, including from CMS Administrator Oz — that moving value-based programs toward keeping people healthy is a priority for this administration. So I think any programs they're putting in place that advance that need to be taken seriously. But the parallel I lived through with e-prescribing goes back to around the 2008–2010 timeframe. It wasn't just e-prescribing — it was meaningful use and the use of EHRs, where the government put in place both incentives and then, later, penalties for the use of EHRs and specifically for electronic prescribing. We had the same experience where people thought, "well, maybe they'll never do it, they'll waive it, they won't really implement the penalties" — and they did. They stayed true to the word and the regulation. And the data shows it had an impact — there's no doubt the adoption of EHRs and the adoption of prescribing increased because of those incentives, followed by the threat of penalties if you didn't meet the thresholds. So I think history tells us the government will be serious in implementing what they put in place. [23:28] Marla Merkle: Agreed, agreed — that's valuable insight. History has a tendency of repeating itself, as we know. Definitely true. [23:37] Robby Wallace: Thinking about that, Paul — think about our listeners today. In the next 90 days, what would you say their priority should be, as far as hospital compliance and legal, from our conversation today? What would your advice be for what they should prioritize? [23:55] Paul Uhrig: I think this is an important program — a mandatory program that needs to be taken as such. My advice is, as I started with: you have to get everybody together, working across all the various functions in the hospital, to make this a success. It'll be a success for your patients, and it'll be a success for the health system and providers, both financially and clinically. And it's really — no pun intended — that teamwork within the health system that I think is going to be key to success. [24:33] Marla Merkle: Absolutely. Any final closing comments? We're wrapping up on time, and we really appreciate you making the time for us today — any last remarks, any last words or anecdotes that could be helpful as we continue on this first year of the five-year mandate and what TEAM is really going to do for the health system? [24:55] Paul Uhrig: Yeah, I think it's an exciting time, both for Rainfall and for the health systems implementing this. I just wish everybody a lot of success, because I do think it's an incredible program — an important part of solving so many of the problems we've been dealing with for decades. [25:15] Marla Merkle: Absolutely — really valuable perspective from you today, and thank you again for your time. For anyone who has any curiosity about TEAM, please inquire — we like to spread information and education on this topic, and we really look forward to future discussions with anyone who's interested. So thank you all for watching, and Paul, thank you again for your time — it's been a pleasure. Paul Uhrig: Thanks for having me. Thanks. Robby Wallace: Thanks, Paul.