Encompass Health (HSOA) Risk Analysis

Each of our hospitals must comply with extensive enrollment requirements and conditions of participation for the Medicare program. If any of our hospitals fail to meet any of the Medicare enrollment requirements or conditions of participation, we may receive a notice of deficiency from the applicable survey agency or contractor, as applicable. If that hospital then fails to institute an acceptable plan of correction and correct the deficiency within the applicable correction period, it could lose the ability to bill Medicare. A hospital could be terminated from the Medicare program if it fails to address the deficiency within the applicable correction period. If CMS terminates one hospital, it may increase its scrutiny of others under common control. From time to time, we have individual hospitals that receive notices of deficiency, some of which are triggered by adverse care incidents or patient complaints. To date, we have addressed those as they have arisen, and we have not experienced a termination. In September 2019, CMS released a final rule adding additional provider enrollment provisions and creating several new revocation and denial authorities in an attempt to bolster CMS' efforts to prevent waste, fraud and abuse. This rule requires Medicare and Medicaid providers and suppliers to disclose any current or previous (in the last five years), direct or indirect affiliation with a provider or supplier that has ever had a disclosable event. A disclosable event is any uncollected debt to Medicare or Medicaid, payment suspension under a federal health care program, denial, revocation or termination of enrollment (even if it is under appeal), or exclusion by the HHS-OIG from participation in a federal health care program. The rule also broadens the definition of an affiliation, including many indirect ownership or control situations such as ownership interests in a publicly traded company. If CMS determines an affiliation with a disclosable event poses an undue risk of fraud, waste or abuse, then the provider reporting that affiliation may be subject to exclusion from Medicare. Currently, information regarding uncollected debt, payment suspensions and enrollment actions are not generally available, so obtaining such information on affiliates could prove difficult or impossible in some situations. Under this rule, CMS may revoke a provider's Medicare enrollment, including all of the provider's locations, if the provider bills for services performed at, or items furnished from, one location that it knew or should have known did not comply with Medicare enrollment requirements, including making the disclosures discussed above. CMS has the ability to prevent applicants from enrolling in the program for up to three years if a provider is found to have submitted false or misleading information in its initial enrollment application. Additionally, CMS can now block providers and suppliers who are revoked from re-entering the Medicare program for up to 10 years. CMS may also revoke a provider's enrollment if it fails to report on a timely basis any change in ownership or control, revocation or suspension of a federal or state license or certification, or any other change in its enrollment data. Any termination of one or more of our hospitals from the Medicare program for failure to satisfy the enrollment requirements or conditions of participation could materially adversely affect our business, financial position, results of operations, and cash flows.

Because Medicare comprises a significant portion of our Net operating revenues, failure to comply with the laws and regulations governing the Medicare program and related matters, including anti-kickback and anti-fraud requirements, could materially and adversely affect us. Our ability to operate in a compliant manner impacts the claims denials, compliance enforcement, and regulatory processes discussed in other risks above. The federal government's reliance on sub-regulatory guidance, such as handbooks, FAQs, internal memoranda, and press releases, presents a unique challenge to compliance efforts. Such sub-regulatory guidance purports to explain validly promulgated regulations but often expands or supplements existing regulations without constitutionally and statutorily required notice and comment and other procedural protections. Without procedural protections, sub-regulatory guidance poses a risk above and beyond reasonable efforts to follow validly promulgated regulations, particularly when the agency or MAC seeking to enforce such sub-regulatory guidance is not the agency or MAC issuing the guidance and therefore not as familiar with the substance and nature of the underlying regulations or even clinical issues involved. Additionally, the federal government is increasingly turning to statistical sampling and extrapolation to expand claims denials and enforcement efforts and advocate for changes in reimbursement policy. Through sampling and extrapolation, the government takes a review of a small number of reimbursement claims and generalizes the results of that review to a much broader universe of claims, which can result in significant increases in the aggregate number and value of claims at issue. Increasing use of extrapolation can be found in payment review audits, such as those conducted by RACs and UPICs. In addition to payment reviews, government agencies may allege compliance violations, including submission of false claims, based on sampling and extrapolation and seek to change reimbursement policy. For example, the HHS-OIG issued a report in September 2018 purporting to identify a high error rate (approximately 80% of claims) among inpatient rehabilitation hospital admissions in a small sample of 220 claims. Based on its findings, the HHS-OIG extrapolated the error rate to the universe of inpatient rehabilitation claims and, among other things, recommended reevaluation of the IRF-PPS. However, the HHS-OIG report involves an extremely small sample size, is not a random sample of cases, includes incorrect references to coverage requirement regulations, appears to conflate technical documentation requirements with medical necessity determinations, and is at odds with actual MAC reviews of claims during that same timeframe which found substantially lower error rates. Notwithstanding the technical statistical flaws that can arise in sampling small groups of claims and the extremely problematic nature of extrapolation in the context of individualized decisions of medical judgment as some courts have noted, sampling and extrapolation pose a growing risk to healthcare providers in the form of more significant claims of overpayments and increased legal costs to defend against these problematic regulatory practices. The Fifth Circuit Court of Appeals has ruled in favor of CMS and affirmed the application of extrapolation errors identified in a sample of claims to support larger claims for overpayment. As discussed under "Reimbursement Risks" above, we are currently challenging, among other things, the use of extrapolation in a 2017 UPIC audit. Any associated loss of revenue or increased legal costs could materially and adversely affect our financial position, results of operations, and cash flows.

Healthcare providers are required to comply with extensive and complex laws and regulations at the federal, state, and local government levels. These laws and regulations relate to, among other things: - licensure, certification, enrollments, and accreditation;- policies, either at the national or local level, delineating what conditions must be met to qualify for reimbursement under Medicare (also referred to as coverage requirements);- coding and billing for services;- requirements of the "60% Rule" applicable to inpatient rehabilitation facilities;- relationships with physicians and other referral sources, including physician self-referral and anti-kickback laws;- quality of medical care;- use and maintenance of medical supplies and equipment;- maintenance and security of patient information and medical records;- minimum staffing;- acquisition and dispensing of pharmaceuticals and controlled substances;- pricing transparency and similar consumer protection rules; and - disposal of medical and hazardous waste. The "60% Rule" is a Medicare requirement that at least 60% of an IRF's patients must have a diagnosis or qualifying comorbidity from at least one of 13 specified medical conditions that typically require intensive therapy and supervision, such as stroke, brain injury, hip fracture, certain neurological conditions, and spinal cord injury. From time to time CMS has adopted changes in the medical conditions that presumptively count toward the 60% compliance threshold to qualify for reimbursement as an IRF. If a facility does not demonstrate compliance with the 60% Rule by either the presumptive method or through a review of medical records, then its classification as an IRF may be terminated by CMS causing the facility to be paid under the acute-care payment system which would result in reduced reimbursement per discharge. If one or more of our hospitals fails to demonstrate compliance with the 60% Rule and CMS re-classifies it as an acute-care hospital, our revenue and profitability may be materially and adversely affected. In the future, changes in these laws or regulations or the manner in which they are enforced could subject our current or past practices to allegations of impropriety or illegality or could require us to make changes in our hospitals, equipment, personnel, services, capital expenditure programs, operating procedures, and contractual arrangements. Those changes could also affect reimbursements as well as future compliance, training, and staffing costs. Of note, the HHS-OIG periodically updates a work plan that identifies areas of compliance focus. In recent years, the HHS-OIG work plans for IRFs have focused on, among other items, the appropriate utilization of concurrent and group therapy, adverse and temporary patient harm events, and billing error rates for IRFs. In September 2018, the HHS-OIG released a report purporting to identify a high error rate (approximately 80% of claims) among inpatient rehabilitation hospital admissions in a small sample of 220 claims. Based on its findings, the HHS-OIG extrapolated the error rate to the universe of inpatient rehabilitation claims and, among other things, recommended reevaluation of the IRF-PPS. However, that HHS-OIG report involved an extremely small sample size, was not a random sample of cases, included some citations to coverage requirements that did not match actual regulations, appeared to conflate technical documentation requirements with medical necessity determinations, and was at odds with actual MAC reviews of claims during that same timeframe which found substantially lower error rates. On September 15, 2022, the HHS-OIG updated its work plan to conduct a nationwide audit of IRF claims in order to determine the extent to which CMS could clarify the Medicare IRF claim payment criteria. We expect the HHS-OIG to issue a report on this in 2026. An HHS-OIG work plan, audit or similar future efforts could result in proposed changes to the payment systems for providers or increased denials of Medicare claims for patients notwithstanding the referring physicians' judgment that treatment is appropriate. As the recent HHS-OIG work plans demonstrate, the clarity and completeness of each patient medical file, some of which is the work product of a physician not employed by us, are essential to demonstrating our compliance with various regulatory and reimbursement requirements. For example, to support the determination that a patient's IRF treatment was medically necessary, the file must contain, among other things, an admitting physician's assessment of the patient as well as a post-admission assessment by the treating physician and other information from clinicians relating to the plan of care and the therapies being provided. These physicians are not employees. They exercise independent medical judgment. We and our hospital medical directors, who are independent contractors, provide training on a regular basis to the physicians who treat patients at our hospitals regarding appropriate documentation. However, we ultimately do not and cannot control the physicians' medical judgment. In connection with subsequent payment audits and investigations, there can be no assurance as to what opinion a third party may take regarding the status of patient files or the physicians' medical judgment evidenced in those files. On March 4, 2013, we received document subpoenas from an office of the HHS-OIG addressed to four of our hospitals. On April 24, 2014, we received document subpoenas relating to an additional seven of our hospitals. Those subpoenas requested documents, including copies of patient medical records, related to reimbursement claims submitted during periods ranging from January 2008 through December 2013. The associated investigation led by DOJ was based on whistleblower claims of alleged improper or fraudulent claims submitted to Medicare and Medicaid and requested documents and materials relating to practices, procedures, protocols and policies of certain pre- and post-admissions activities at these hospitals including marketing functions, pre-admission screening, post-admission physician evaluations, patient assessment instruments, individualized patient plans of care, and compliance with the Medicare 60% rule. We settled the DOJ investigation, together with the related qui tam or whistleblower lawsuits, in 2019 for a total payment of $48 million, and we expressly denied any wrongdoing. In return for the settlement payment, the plaintiffs dismissed with prejudice their pending qui tam claims, and DOJ provided Encompass Health and all its subsidiaries with a release from civil liability. Although we have invested, and will continue to invest, substantial time, effort, and expense in implementing and maintaining training programs as well as internal controls and procedures designed to ensure regulatory compliance, we have in the past been, and could in the future be, required to return portions of reimbursements for discharges alleged after the fact to have not been appropriate under the applicable reimbursement rules and change our patient admissions practices going forward. We could also be subjected to other liabilities, including (1) criminal penalties, (2) civil penalties, including monetary penalties and the loss of our licenses to operate one or more of our hospitals, and (3) exclusion or suspension of one or more of our hospitals from participation in the Medicare, Medicaid, and other federal and state healthcare programs, which, if lengthy in duration and material to us, could potentially trigger a default under our credit agreement or debt instruments. Because Medicare comprises a significant portion of our Net operating revenues, failure to comply with the laws and regulations governing the Medicare program and related matters, including anti-kickback and anti-fraud requirements, could materially and adversely affect us. In the past few years, DOJ and HHS as well as federal lawmakers have significantly increased efforts to ensure strict compliance with various reimbursement related regulations as well as combat healthcare fraud. DOJ has pursued and recovered record amounts based on alleged healthcare fraud. The increased enforcement efforts have frequently included aggressive arguments and interpretations of laws and regulations that pose risks for all providers. For example, the federal government and individual relators have increasingly asserted that incidents of erroneous billing or record keeping may represent violations of the FCA. Human error and oversight in record keeping and documentation, particularly where those activities are the responsibility of non-employees, are always a risk in business, and healthcare providers and independent physicians are not immune to this risk. Additionally, the federal government has been willing to challenge the medical judgment of independent physicians in determining issues such as the medical necessity of a given treatment plan. Furthermore, the federal government has increasingly asserted that violations of laws not directly related to Medicare billing, such as anti-kickback and anti-discrimination laws, represent FCA violations, which typically carry higher monetary penalties. Settlements of alleged violations or imposed reductions in reimbursements, substantial damages and other remedies assessed against us could have a material adverse effect on our business, financial position, results of operations, and cash flows. Even the assertion of a violation, depending on its nature, could have a material adverse effect upon our stock price or reputation and could cost us significant time and expense to defend.

In addition to the legislative and regulatory actions that directly affect our reimbursement rates or further the evolution of the current healthcare delivery system, other legislative and regulatory changes affect healthcare providers like us from time to time. For example, the ACA expanded the federal Anti-Kickback Law and the False Claims Act (the "FCA") increasing compliance scrutiny in the healthcare industry generally. Those changes included additional resources for enforcement, lowered burden of proof for the government in healthcare fraud matters, expanded definition of claims under the FCA, enhanced penalties, and increased rewards for relators in successful prosecutions. CMS may also suspend payment for claims prospectively if, in its opinion, credible allegations of fraud exist. The initial suspension period may be up to 180 days. However, the payment suspension period can be extended almost indefinitely if the matter is under investigation by the HHS-OIG or DOJ. Any such suspension would adversely affect our financial position, results of operations, and cash flows. Some states in which we operate have also undertaken, or are considering, healthcare reform initiatives that address similar issues. While many of the stated goals of other federal and state reform initiatives are consistent with our own goal to provide care that is high-quality and cost-effective, legislation and regulatory proposals may lower reimbursements, increase the cost of compliance, decrease patient volumes, promote frivolous or baseless litigation, and otherwise adversely affect our business. We cannot predict what healthcare initiatives, if any, will be enacted, implemented or amended, or the effect any future legislation or regulation will have on us. On December 14, 2020, CMS announced the proposal of a five-year review choice demonstration for inpatient rehabilitation services (the "RCD"). In August 2023, IRFs located in Alabama began participation in RCD. On June 17, 2024, CMS expanded RCD to include IRFs located in Pennsylvania and billing to a certain MAC. We do not bill to that MAC, so we are not subject to the program in Pennsylvania at this time. In December 2025, CMS announced the expansion of RCD to Texas and California, effective March 2, 2026 and May 1, 2026, respectively. With the expansion to those two states, we expect 33 of our current inpatient rehabilitation hospitals (representing approximately 11.9% of our IRF Medicare claims) to be subject to RCD. After the initial four states, CMS intends to expand the demonstration to include additional IRFs based on the MAC to which those IRFs submit claims. There are no details of that expansion at this time. Under the RCD, participating IRFs have an initial choice between pre-claim or post-payment review of 100% of Medicare claims submitted to demonstrate compliance with applicable coverage and clinical documentation requirements. We elected the pre-claim review option for our IRFs in Alabama for the first cycle. Under the pre-claim review choice, services can begin prior to the submission of the review request and continue while the decision is being made. The pre-claim review request with required documentation must be submitted, reviewed, and approved before the final claim is paid. If a certain percentage of the claims reviewed are found to be valid, the IRF may then opt out of the 100% review. The opt-out validation percentages for the first, second, and third cycles were 80% or greater, 85% or greater and 90% or greater, respectively. In opting out, the IRF may elect spot prepayment reviews of samples consisting of 5% of total claims or selective post-payment review of a statistically valid random sample. Our claim validation rate for the first cycle ending in February 2024 exceeded the 80% threshold at all participating hospitals. For the second cycle, which began on May 1, 2024, we elected not to opt out, so our hospitals in Alabama remained subject to the 100% pre-claim review. None of our hospitals in Alabama achieved the opt-out claim validation rate for the second or third cycles ending in October 2024 and June 2025, respectively. We believe many of the non-affirmations in these cycles were based on application of improper standards or requirements that directly conflict with the Medicare coverage criteria for IRFs. We have engaged, and will continue to engage, with the MAC and CMS to ensure the review process is consistent with existing rules, regulations and statutes. In the fourth cycle which began September 1, 2025, the affirmation rate required to opt-out remains 90% or greater. Given the inconsistent review process applied by the MAC across the previous cycles, we cannot predict the impact, if any, RCD may have on the collectability of our Medicare claims over its five-year term. We may ultimately experience decreases in Net operating revenues and in cash flow, or we may incur costs associated with patient care for which the Medicare claim is subsequently denied, any of which could have an adverse effect on our financial position, results of operations, and liquidity. In January 2020, the HHS-OIG announced an audit to review incentives under the IRF-PPS to discharge patients prematurely to home health agencies. Following this audit, the HHS-OIG announced in December 2021 its recommendation to CMS to establish an IRF transfer payment policy for early discharges to home health care in which the IRF would only receive a per diem rate in lieu of the full case-mix payment. The HHS-OIG estimated the policy could have reduced total Medicare payments to IRFs in 2017 and 2018 by between 6% and 7%. The CMS proposed rule for fiscal year 2023 for the IRF-PPS included a request for comment on a potential change that could be included in future rulemaking. Based on the HHS-OIG report, CMS noted it was considering whether to modify the IRF transfer payment policy to reduce reimbursement for early discharges to home health, similar to how early discharges to acute-care hospitals, skilled nursing facilities, long-term acute-care hospitals, or another IRF, are currently treated under the IRF-PPS. In the final IRF-PPS rule for 2023, CMS acknowledged industry comments on the policy and noted those comments would be taken under advisement for future rulemaking, but neither the proposed nor the final rulemaking for fiscal years 2024, 2025, or 2026 made reference to a change in the IRF transfer payment policy. We cannot predict what legislative or regulatory reforms or changes, if any, will ultimately be proposed, enacted, or implemented, or the timing or effect any of those changes or reforms will have on us. If enacted, they may be challenging for all providers and have the effect of limiting Medicare beneficiaries' access to healthcare services and could have a material adverse impact on our Net operating revenues, financial position, results of operations, and cash flows. For additional discussion of healthcare reform and other factors affecting reimbursement for our services, see Item 1, Business, "Regulatory and Reimbursement Challenges" and "Sources of Revenues-Medicare Reimbursement."

We are required to comply with all applicable federal, state and locals laws and regulations relating to employment, including occupational safety and health requirements, minimum staffing, wage and hour, overtime and other compensation requirements, employee benefits and other leave and sick pay requirements, proper classification of workers as employee or independent contractors, and immigration and equal employment opportunity laws, among others. These laws and regulations can vary significantly among jurisdictions, can change, and can be highly technical and involve strict liability for noncompliance with a seemingly mundane technical detail. Costs and expenses related to these requirements are a significant operating expense and may increase as laws and regulations change. From time to time, we have been, and expect to continue to be, subject to regulatory proceedings and private litigation, including putative class and collective action lawsuits, concerning our application of various laws, rules and regulations governing employment practices, including wage and hour claims. Some of these actions involve large demands, as well as substantial defense costs. Any failure to comply with these employment-related legal requirements can result in significant penalties or litigation exposure and could have a material adverse effect on our business, financial position, results of operations, and cash flows.