What Happens When the Rules We’re Following Are Wrong?

I came across an interesting article this week about the Clover Insurance Co. v. HHS decision and Medicare Advantage Star Ratings. Now, before anyone who doesn't work in Medicare Advantage stops reading, bear with me.

Because what caught my attention wasn't really the Star Ratings piece. It was this: What do we do, as compliance professionals, when the rules we've been following are themselves called into question?

That's a much bigger compliance issue.

First, what happened?  (Very simplified version.)

CMS calculates Medicare Advantage Star Ratings using a number of different quality and performance measures. Those ratings matter. They can affect payments, competitive positioning and, ultimately, the plans and benefits an organization can offer.

Clover challenged its 2026 Star Rating and won, at least for now.

The district court found problems with 20 of the measures CMS used. Ten relied on data that the court concluded CMS wasn't statutorily authorized to use for this purpose. Another ten Part C measures hadn't gone through the notice-and-comment rulemaking required by the Medicare statute.

CMS has appealed. In the meantime, CMS has given Medicare Advantage organizations a choice: keep their existing 2026 rating or accept a recalculated rating that removes 18 measures.

Simple enough. Except it isn't. Because the court's reasoning potentially applies to measures beyond the ones Clover actually challenged. And CMS acknowledged in its appellate briefing that none of the measures used to calculate Clover's 2026 Star Rating had been implemented through notice-and-comment rulemaking.

So now we have litigation, an appeal, additional lawsuits and a Star Ratings program that continues to operate while some pretty fundamental questions about its methodology are being worked out.

Welcome to healthcare compliance!  Here's the part I find interesting:  we talk a lot about compliance as though the job is straightforward:

Find the rule. Understand the rule. Implement the rule. Audit against the rule.

If only.

Healthcare organizations don't operate from the CFR alone. We operate from statutes, regulations, CMS manuals, HPMS memos, technical specifications, FAQs, contract requirements, agency guidance and various other instructions that tell us what we're expected to do.

And, in practice, most organizations treat those requirements as exactly that: requirements.

Usually, that's entirely appropriate. But Clover is a good reminder that there's another question sitting behind “What does CMS require?” And that's: “What is the legal basis for the requirement?”

I'm not suggesting compliance officers start conducting an Administrative Procedure Act analysis every time CMS publishes an FAQ. That's neither realistic nor particularly helpful.

But I do think we need to understand that not every piece of regulatory guidance sits in exactly the same place in the hierarchy. And occasionally, that distinction matters. A lot.

So what does compliance do with this?

This is where things get uncomfortable. Because a court finding that CMS got something wrong doesn't necessarily mean an organization should immediately stop doing it.

CMS is appealing Clover. The Star Ratings program hasn't disappeared. Other litigation is underway. And we don't yet know where this ultimately lands.

So the answer isn't: “CMS lost. We don't have to comply anymore.”

But I don't think the answer is: “CMS hasn't changed the requirement, so we'll ignore the litigation and carry on” either.

The better compliance questions are:

• What exactly did the court decide?

• What remains in effect today?

• Does the decision affect something we're currently doing?

• What happens if the decision is upheld?

• What happens if it's reversed?

• Do we have a financial or operational decision that needs to be made before then?

• Who needs to know about this?

And, this one is important: at what point do we need legal counsel involved?

Compliance doesn't have to answer every one of those questions. But somebody needs to make sure they're being asked. This is what regulatory change management actually looks like.

Regulatory change management sounds very tidy when we put it into a compliance plan. Monitor regulatory developments. Assess applicability. Assign responsibility. Implement changes. Document completion.

Done.

Except sometimes the regulatory development is a court decision questioning the validity of the regulatory framework you're currently operating under. There's no neat checkbox for that. Instead, compliance has to connect the dots.

For an MA organization, a Star Ratings issue potentially touches quality, appeals and grievances, pharmacy, finance, operations, data analytics, contracting, legal, executive leadership and probably several other functions I've missed.

Forwarding the article to everyone isn't regulatory change management. Someone needs to figure out what it means for the organization. Maybe the answer is: nothing right now. Keep monitoring. That's a perfectly legitimate compliance response.

Maybe the answer is: we need to model the financial impact.

Maybe it's: legal needs to look at this.

Maybe it's: we need to preserve our options while the appeal moves forward.

The important thing is that somebody has consciously considered the issue rather than discovering six months from now that everyone assumed somebody else was watching it.

And that's my bigger takeaway from Clover:  Compliance isn't simply about knowing what the rules say. It's about understanding enough about the regulatory environment to recognize when something has changed, or might change, and knowing when that change matters to your organization.

Sometimes we're translating a new regulation. Sometimes we're updating a policy. Sometimes we're figuring out how to operationalize a CMS requirement that isn't particularly clear. And sometimes we're watching a court decide whether CMS had the authority to impose the requirement in the first place.

That's the reality of working in healthcare compliance. We aren't always going to have a definitive answer. But we should know when there's a question worth asking. And Clover is definitely one of those times.