The U.S. Department of Health and Human Services (HHS) and Centers for Medicare and Medicaid Services (CMS) have issued new rules modernizing the Stark and Anti-Kickback laws.

As discussed in the summer edition of TOPICS, the most transformative part of the rules, now in effect, update both laws to reflect the industry trend of encouraging value-based care arrangements, rather than traditional fee-for-service models. However, this article focuses on additional components of the new rules, including changes to physician compensation that allow for greater flexibility in compensation arrangements and cybersecurity updates.

A. Stark Law

The Stark Law generally prohibits physicians from referring Medicare and Medicaid patients to other providers with whom the referring physician (or a close relative) has a financial relationship unless a specific exception applies.


Effective January 1, 2022, the new rule clarifies physician profit-sharing and bonus arrangements under Stark and prohibits the practice of “split pooling.”

Currently, a group practice may pay a physician a share of “overall profits” derived from Designated Health Services (DHS) as long as the physician’s share is not calculated in a way that relates to the volume or value of the physician’s referral of DHS. DHS includes clinical laboratory services, physical therapy services, occupational therapy services, outpatient speech-language pathology services, radiology and certain other imaging services, and radiation therapy services and supplies.

Previously, some practices were pooling profits from DHS on a service-by-service basis and distributing those profits to a certain group of physicians (a practice referred to as “split pooling”). Under the new rule, practices may not split pool.

Instead profits must be shared in group practices in one of two ways: 1) the practice can aggregate all of the DHS profits of the entire group practice and then distribute those aggregated profits to any physician in the group practice, or 2) the practice can aggregate all of the DHS profits (not just profits from a particular service line) of any pods of at least five physicians and then distribute the profits within the pod.

In both cases, other components of the rule, such as not accounting for the value or volume of any single physician’s referrals, must be followed.

If an entity has multiple pods, each pod may use its own distribution formula. However, the same distribution method must be used for each member of the pod and must be used for all of the profits generated by the pod.

CMS also confirmed that any physician can take advantage of these profit-sharing arrangements, not just owners. Assignments to pods may be based on any criteria, such as practice location, practice pattern, or longevity, so long as pods are not assigned in a way that accounts for the volume or value of referrals.


The new law adds a new limited monetary compensation exception that allows physicians to be paid a total of up to $5,000 per calendar year (adjusted for inflation) for items or services provided by the physician (directly or indirectly) without signing a written compensation agreement set in advance.

This compensation cannot account for the value or volume of referrals, exceed fair market value or be commercially unreasonable. If a provider has multiple such arrangements with the same entity, the total compensation for all of the arrangements must be less than the $5,000 limit.


A new exception protects arrangements involving the donation of cybersecurity technology and related services, such as training or access to a health desk. Donors can be any individual or entity (unlike the narrower list of allowable donors for electronic health records).

B. Anti-Kickback Statute

The Anti-Kickback Statute (AKS) is broader than Stark and prohibits anyone from offering or receiving remuneration (which are benefits that could be either monetary or in-kind) for services payable by a federal health care program, unless the action generally fits into, or almost fits into, a regulatory safe harbor.


Mirroring the new Stark Law exception, there is now protection for donations of cybersecurity technology and services, including certain cybersecurity hardware donations, under the AKS. The predominant purpose of the technology must be to promote cybersecurity efforts and, unlike the electronic health records safe harbor discussed below, there is no requirement that the recipient contributes any funds to the technology to qualify for the safe harbor.


The new rule modifies an existing safe harbor, including modifying the timing of certain required recipient contributions, permitting certain donations of replacement technology and removing the sunset provision.

Providers wishing to take advantage of any of these new rules should ensure that each proposed arrangement meets all of the detailed requirements of the exception or safe harbor.