The federal government has clearly established that failure to report and refund an identified overpayment within 60 days of identification could trigger False Claims Act (FCA) liability. When an overpayment has been “identified” and the 60-day reporting period begins to run has been unclear prior to recent regulatory changes by the Centers for Medicare and Medicaid Services (CMS).

The Social Security Act requires that an overpayment be reported and returned by the later of (a) 60 days after the overpayment was identified; or (b) the date any corresponding cost report is due, if applicable. Any overpayment retained by a person after the deadline for reporting and repaying the overpayment triggers federal FCA liability. The knowing retention of an overpayment can also lead to liability under the Civil Monetary Penalties Law (CMPL), which is enforced by the Office of Inspector General for the Department of Health and Human Services (OIG).

On February 12, 2016, CMS finalized the Reporting and Returning of Overpayment, Final Rule for Medicare Parts A and B. This rule clarifies the regulations at 42 C.F.R. § 401.305 to address the reporting requirements as well as additional provisions, including:

  • Reduces the proposed 10-year lookback period to six years
  • Defines when an overpayment is “identified”
  • Discusses the standard of investigation required
  • Defintion of "Identified"

A person or entity that furnishes healthcare services under Medicare has identified an overpayment when the person has or should have, through the exercise of reasonable diligence, determined that they received an overpayment and quantified the amount of the overpayment. CMS clarified that FCA liability applies if a person “should have” determined and calculated an overpayment “if the person fails to exercise reasonable diligence and the person in fact received an overpayment.”

Reasonable diligence consists of the timely, good faith investigation of credible information, which is completed no later than six months from receipt of the credible information, except in extraordinary circumstances. CMS stated that extraordinary circumstances might apply to complicated Stark Law investigations and self-disclosures through the CMS Self-Referral Disclosure Protocol (SRDP). Reasonable diligence includes both proactive compliance activities and reactive investigative activities undertaken in response to credible information of a potential overpayment.

The 60-day clock begins to run after reasonable diligence is completed and an overpayment is identified. This includes determining the amount of the overpayment due for the look back period, which is now six years from the date the overpayment is identified. If the provider fails to exercise reasonable diligence and, in fact, received an overpayment, the 60-day time period begins on the day they received the credible information of a potential overpayment.

After finding a single overpaid claim, a provider should determine whether the issue affects other claims and time periods before repaying the single overpayment. Similarly, providers should not repay overpayments on specific claims from a probe sample until the full overpayment is identified.

Credible Information

“Credible information” consists of information that supports a reasonable belief that an overpayment may have been received. Determining whether information is sufficiently credible to merit investigation is a fact-specific determination. A provider has received credible information of an overpayment when any employee or agent receives such information. It is important to recognize that information in the hands of employees and agents can be imputed to the organization.

“Credible information” consists of information that supports a reasonable belief that an overpayment may have been received. Determining whether information is sufficiently credible to merit investigation is a fact-specific determination. A provider has received credible information of an overpayment when any employee or agent receives such information. It is important to recognize that information in the hands of employees and agents can be imputed to the organization.

Reporting and Returning Overpayments

The final rule provides more than one mechanism to satisfy the obligation to report and repay identified overpayments. Selecting the appropriate mechanism is a fact-specific determination and can vary based on circumstances and potential legal exposure. The following options are discussed in the final rule:

  • Report and return overpayments to Medicare Administrative Contractor (MAC) using form on MAC’s website.
  • Disclosure to OIG or CMS through their respective self-disclosure protocols tolls the 60-day period and satisfies the reporting obligation under this final rule. In the event that a settlement is not reached in the CMS SRDP or OIG Self-Disclosure Protocol (SDP), the provider has the balance of the 60-day time period remaining from identification to the tolling of the 60-day period when the government acknowledged receiving the disclosure to report and return any overpayments to the MAC.
  • Providers may use the claims adjustment, credit balance, self-reported refund process, or another appropriate process to report and return overpayments.
  • Overpayments associated with cost reports can be reported through the existing cost report reconciliation process and do not require the use of the self-reported refund process.
  • Statistical sampling and extrapolation can serve as an appropriate mechanism to calculate an overpayment amount. If extrapolation uses statistical sampling, include how the overpayment was calculated showing statistically valid sampling and extrapolation methodology used in the report. Statistical sampling should be conducted in a manner that conforms to sound and accepted principles, i.e. RAT-STATS. Providers should only extrapolate to the time period covered by the population the sample was drawn from.
  • Retain documentation of previous audits and refunded overpayments. While CMS will not recover an overpayment twice, any claims that form the basis for a returned overpayment will not be exempt from subsequent government audits.

Addtional Points of Consideration

  • The scope of the final rule applies to overpayments under Medicare Parts A and B only.
  • The final rule is not retroactive. For example, overpayments self-disclosed under the CMS SRDP prior to March 14, 2016, the effective date of the final rule, will not be governed by the six-year lookback period and continue under the previous four-year lookback period.
  • There is no minimum monetary threshold amount for repaying an overpayment in the final rule.

Practical Application of the Final Rule

The final 60-day rule highlighted the importance of effective compliance programs to proactively monitor, detect, and avoid retaining overpayments. Providers and suppliers should consider the following points when assessing current compliance measures and implementing enhanced policies and procedures to comply with the final rule and avoid FCA liability for overpayments.

  • Implement a proactive compliance program to identify and return overpayments.
  • Evaluate current overpayment detection processes and sufficiency of audits.
  • Update overpayment policies and procedures to include six-year lookback period.
  • Develop internal reporting mechanisms and encourage employees to report potential overpayments, including assessing current policies regarding possible disciplinary action for failure to report known or potential overpayments to management.
  • Train staff regarding what is considered an overpayment and how they should notify management if credible information is identified.
  • Encourage a culture of prompt reporting of potential overpayments.
  • Exercise reasonable diligence for investigation of credible information of overpayments.
  • Upon receipt of credible information regarding a possible overpayment, document each stage of reasonable diligence and the repayment process.
  • Implement or revise existing overpayment identification and repayment policies and procedures to reflect goals of meeting the obligations under the final rule.
  • Assure effective communication and coordination between internal and external auditors and compliance department.