On February 12, 2016, the Centers for Medicare and Medicaid Services (CMS) published its long-awaited final rule (the “Final Rule”) governing the requirement that healthcare providers report and return Medicare overpayments within 60 days.1 The Final Rule clarifies several issues at the heart of the so-called "60-day rule," including when an overpayment is considered to be identified and how far providers must look back to identify an overpayment. Given the broad scope of the law and the draconian consequences of noncompliance, healthcare providers of all types and sizes should carefully study the Final Rule and consider its implications for their compliance practices. The Final Rule becomes effective on March 14, 2016.

Background

The Affordable Care Act established a new provision of the Social Security Act that requires a person who has received an overpayment to report and return the overpayment by the later of 60 days after the date on which the overpayment was identified and the date any corresponding cost report is due, if applicable.2 Any overpayment retained after this deadline becomes an obligation potentially subject to enforcement under the federal False Claims Act (FCA). These statutory changes went into effect upon the enactment of the Affordable Care Act on March 23, 2010.

CMS released a proposed rule (the “Proposed Rule”) to implement the law with respect to payments made under Medicare Parts A and B in February 2012.3 In response to the Proposed Rule, CMS received a flurry of comments from industry stakeholders on several of its key components, including its proposal of a 10-year lookback period and its proposal that failure to conduct an inquiry to determine whether an overpayment exists with “all deliberate speed” could result in the knowing retention of an overpayment. Citing the scope of the comments received and the complexity of the rule, CMS provided notice in February 2015 that it would delay publication of the final rule until February 2016.4

In the meantime, healthcare providers grappled with the ambiguities of the statutory provision. Most notably, in August 2015, a federal district court considered when a provider had “identified” Medicaid overpayments, ultimately concluding that “the sixty day clock begins ticking when a provider is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained.”5 Click here for our prior coverage of the case. In addition, the Department of Justice announced the first settlement under the FCA involving a healthcare provider’s failure to investigate credit balances on its books to determine whether they resulted from overpayments made by a federal healthcare program.6 Most recently, a lawsuit challenging CMS’s position on when Medicare Advantage plans and Part D sponsors have identified overpayments, as codified in the agency’s 2014 final rule, was filed in January 2016.7

Key Provisions of the Final Rule

Identification of Overpayments

The 60-day clock for reporting and repayment begins not on a provider’s receipt of an overpayment, but on the provider’s identification of that overpayment. The Proposed Rule considered an overpayment to be “identified” for the purposes of the statute as of the time a provider had actual knowledge or a reckless disregard or deliberate ignorance of its existence. While some commenters encouraged CMS to limit identification to the acquisition of actual knowledge, the agency explained that, “[i]f the requirement to report and return overpayments only applied to situations where providers or suppliers had actual knowledge of the existence of an overpayment, then these entities could easily avoid returning improperly received payments and the purpose of the section would be defeated.”8 Accordingly, CMS adopted a “knew or should have known” standard in the Final Rule to ensure that providers are not discouraged from carrying out a reasonable investigation into overpayment.

Under the Final Rule, a provider has identified an overpayment “when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.”9 The Final Rule goes on to clarify that “reasonable diligence” for these purposes includes both proactive compliance activities and investigations conducted in response to receiving “credible information” of a potential overpayment. The Final Rule therefore reflects CMS’s stance that providers have an ongoing duty to actively review their financial records and address overpayments rather than waiting for agency or independent auditors to identify potential issues. Specifically, CMS says, the receipt of credible information—from internal or external sources—triggers a provider’s duty to conduct a reasonable inquiry to determine whether an overpayment exists and to quantify it. Notably, the Final Rule’s statement that the provider has identified the overpayment only once it has or should have “quantified the amount of the overpayment” contrasts with the above-referenced district court ruling that the 60-day clock starts when the provider is “put on notice of a potential overpayment” and implicitly acknowledges that impossibility of returning an overpayment that has not yet been quantified.

The Final Rule does not include the “all deliberate speed” compliance benchmark offered in the Proposed Rule. Instead, CMS indicates that reasonable diligence is demonstrated through the timely good faith investigation of credible information, “which is at most 6 months from receipt of the credible information, except in extraordinary circumstances.”10 CMS describes extraordinary circumstances as including “unusually complex investigations,” such as those that relate to potential violations of the federal physician self-referral prohibition more commonly known as the “Stark law.” The 60-day time period for reporting and returning identified overpayments begins when either the reasonable diligence is completed or on the day credible information of a potential overpayment is received, in the event the provider actually receives an overpayment and fails to conduct reasonable diligence.

Lookback Period

The statutory requirement to timely report and return overpayments does not include a specific time limit. The Proposed Rule specified that overpayments must be reported and returned only if identified within 10 years of the date the overpayment was received. Citing the many objections of commenters to this proposal, and noting the need to create a limitation on how far back a provider must look to avoid imposing “unreasonable additional burden or cost,” CMS provides for a six-year lookback period in the Final Rule. This period is measured from the date the overpayment is identified.

The finalized six-year lookback period applies to all providers reporting and returning overpayments on or after the effective date of the Final Rule, even if the overpayments were received prior to such time. In its commentary to the Final Rule, CMS noted the effect this change will have on overpayments related to potential violations of the Stark law that are reported to CMS pursuant to its Voluntary Self-Referral Disclosure Protocol (SRDP). CMS previously indicated that a party making a submission to the SRDP may limit its financial analysis of the amount potentially due and owing to the four-year timeframe established for reopening Medicare determinations.11 In the Final Rule, CMS states that providers reporting overpayments under the SRDP on or after the effective date are subject to the six-year lookback period specified in the Final Rule. However, CMS notes that under current law it is only authorized to collect financial analysis of overpayments that occurred during a four-year lookback period, and it is in the process of seeking authorization to collect information using the six-year lookback period. In the interim, CMS advises that providers making submissions to the SRDP may voluntarily provide financial information from the fifth and sixth years or report and return overpayments from the fifth and sixth years through other means.12

Reporting and Returning Overpayments

The Final Rule takes a flexible approach as to how overpayments are to be reported and returned. Specifically, the Final Rule provides that providers must use an applicable claims adjustment, credit balance, self-reported refund, or other reporting process set forth by the applicable Medicare contractor to report an overpayment. Providers may also satisfy the reporting obligation by making a disclosure under CMS’s SRDP or the Office of Inspector General’s Self-Disclosure Protocol.

In the Proposed Rule, CMS specified a list of 13 data elements that should be included in a report of an overpayment. CMS also stated its plans to develop a uniform reporting form to enable all overpayments to be reported in a consistent manner across Medicare contractors. In the Final Rule, CMS removes the proposed data element list from the regulation in an effort to eliminate confusion between compliance with the regulation and compliance with the applicable refund process. CMS did, however, finalize a requirement that, where the overpayment amount is extrapolated based on a statistical sampling methodology, the report must explain how the overpayment was calculated.

* * *

The Final Rule represents a major development for the healthcare industry. Although the Final Rule generally reflects a more measured approach than the Proposed Rule, it will still impose a significant burden on healthcare providers of all types and sizes due to the breadth of the statutory requirement it implements. Providers should consider whether their existing compliance practices are adequate to respond to the demands of the Final Rule. Documentation of each step in the review of a potential overpayment issue will be key—including whether the information regarding the potential overpayment is credible, what diligence is necessary to determine whether an overpayment exists, whether extraordinary circumstances justify a lengthier inquiry, whether an overpayment actually does exist, how the overpayment is quantified, and what efforts are undertaken to look back at historic claims. In all, the Final Rule provides a powerful reminder of the government’s view that providers have an obligation to both bill all claims correctly in the first place and maintain a robust compliance program that includes proactive activities and reactive auditing to address any billing inaccuracies that occur.