On February 11, 2016, the Centers for Medicare & Medicaid Services (CMS) released its long-awaited final rule (the final rule) clarifying one of the prominent provisions of the Affordable Care Act (ACA)—the obligation to report and return federal health care program overpayments.1 Section 6402(a) of the ACA requires any person who has received an overpayment to report and return the overpayment (1) within 60 days from the date on which the overpayment was identified, or (2) by the date any corresponding cost report is due, whichever is later (the Overpayment Statute).2The potential legal exposure under the Overpayment Statute is significant: a person is subject to liability under the civil False Claims Act (FCA) for the failure to report and return an overpayment by the deadline3 if the person also is found to have knowingly concealed or knowingly and improperly avoided or decreased the retained overpayment.4

The Overpayment Statute created significant uncertainty and concern within the health care industry. While providers and suppliers must return self-identified overpayments within 60 days from the date on which an overpayment is identified, the term “identified” was not defined anywhere in the ACA, leaving ambiguity regarding what triggered the 60-day repayment obligation. In addition, the Overpayment Statute failed to address the number of years providers and suppliers must look back to identify, report and return overpayments. The proposed rule published in February 2012 interpreted the word “identified” in the statute as imposing a duty to ferret out potential overpayments over a 10-year “lookback” period. Comments on the proposal were generally critical of this interpretation. Four years later, CMS published the final rule, to “provide needed clarity and consistency” on these issues.5 The final rule applies to providers and suppliers receiving Medicare Part A and Part B reimbursement and will be effective March 14, 2016.6       

The 60-Day Clock – When Does It Start Ticking?

In the final rule, CMS acknowledges that the 60-day clock doesn’t necessarily begin ticking upon receipt of information that an overpayment might exist.7 Rather, the final rule provides that if a provider receives “credible information” that an overpayment may have occurred, the provider must report and return the overpayment either:

  1. Within 60 days from the date the provider completes an investigation of the potential overpayment and quantifies the overpayment, if the provider acts with “reasonable diligence”;or
  2. Within 60 days from the date the provider receives credible information concerning a potential overpayment, if the provider does not act with reasonable diligence and the person in fact received an overpayment.8

While CMS has tempered the obligations contemplated under the proposed rule and shortened the proposed “lookback” period, the final rule is ambiguous in a number of respects. The ambiguities will challenge  providers and suppliers that, potentially through no fault of their own, receive more Medicare reimbursement for a particular item, service or episode of care than they should and, despite conscientious efforts to identify overpayments, fail to meet an outsider’s view of “reasonable diligence” within the window of 60 days.

CMS Interprets “Identified” to Impose a Duty to Exercise Reasonable Diligence
The final rule states that a person will be deemed to have identified an overpayment when “the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.”9 Departing from the criticized definition in the proposed rule that pegged the repayment obligation to standards imported from the FCA—a person’s actual knowledge, reckless disregard or deliberate ignorance of the overpayment—the final rule introduces a “reasonable diligence” standard against which the agency will judge the person’s response to information that an overpayment could have been received in a particular set of circumstances. The standard is quite similar to an overpayment rule, currently the subject of litigation, that CMS imposed on Medicare Advantage organizations in 2014.10 In both cases, the agency’s discussion of “reasonable diligence” in preamble language offers some insight into anticipated enforcement of the rule, while at the same time making it clear that providers and suppliers should understand that their “diligence” in an overpayment context may be called into question by the government or qui tam relators.

CMS Expects Diligence to Include Proactive and Responsive Compliance Measures

Consistent with its view that the ACA’s overpayment provision imposes a duty to “be on the lookout” for overpayments, CMS’s commentary accompanying the final rule declares that “reasonable diligence” includes both (1) responsive investigations conducted in good faith and in a timely manner by qualified individuals acting on credible information that an overpayment has been received; and (2) proactive compliance activities conducted in good faith by qualified individuals to monitor receipts for overpayments.

Under the proposed rule, CMS suggested that a provider or supplier might identify an overpayment by receiving information regarding a potential overpayment and failing to conduct a proper investigation. In the final rule, CMS added that providers and suppliers should pursue “credible” information that an overpayment exists.  According to the agency, whether information is credible is a factual determination that is dependent on the circumstances. In response to commenters, CMS said that examples of credible information would include, but not be limited to: (1) repeated hotline complaints concerning the same or similar issues (or potentially one hotline complaint, if sufficiently detailed); (2) contractor or government audits, to the extent the same issue may exist beyond the scope or timeframe of the audit; and (3) learning (without specifying through what means) that the profits from a practice or physician were unusually high in relation to hours worked or the relative value units associated with the work. 

In addition, under the final rule, liability for failure to repay an undiscovered overpayment could apparently be imposed when a person in possession of that overpayment failed to take adequate proactive steps to find it. Rejecting proposals from commenters who asked that “active compliance programs” be deemed sufficient to meet the obligation, CMS made clear its view that the “reasonable diligence” standard requires evidence that the person is engaged in activities to proactively monitor the accuracy and appropriateness of Medicare claims and payments received.11CMS declined to offer examples of sufficient proactive measures, generally stating its belief that the sufficiency of such measures would be fact-dependent, including based on the type of provider. Given this interpretation, notable questions remain as to what types of proactive compliance measures will be determined to be sufficient. In the meantime, providers and suppliers would be well served to evaluate and document compliance activities aimed at detecting billing inaccuracies and overpayments. 

Is there a Time Limit to Investigate an Overpayment?

Recognizing that the “reasonable diligence” associated with investigating and quantifying overpayments may take time, the final rule clarifies that such investigations must be completed in a timely manner, which CMS believes should be six months at most from the date on which a person receives “credible evidence” of a potential overpayment, absent extraordinary circumstances. Thus, depending on the specific circumstances, the deadline for providers and suppliers reporting and returning overpayments is effectively eight months, if diligence is continually exercised—six months for investigation and analysis and two months to report and return.12

What constitutes extraordinary circumstances is a fact-specific question. However, extraordinary circumstances may include complex investigations that the provider or supplier reasonably anticipates will require more than six months to investigate, which per the commentary to the final rule includes physician self-referral law violations that are referred to the CMS Voluntary Self-Referral Disclosure Protocol (SRDP).13

Significance of Quantifying an Overpayment

Under the final rule, the 60-day repayment period is triggered when through the exercise of reasonable diligence, the provider or supplier determines that an overpayment has been received and the amount of such overpayment has been quantified.14 CMS acknowledges that “good faith” investigations may include auditing work in order to calculate any potential overpayment amount that must be reported or returned. 

CMS recognizes that a common way for providers or suppliers to conduct an audit is first to review a probe sample of claims. If the probe sample identifies a possible overpayment with some of the sample claims, the next step often includes expanding the audit beyond the probe sample and conducting a root cause analysis to determine the cause of the overpayment and whether more overpayments exist. CMS believes it is appropriate to conduct a fuller analysis in order to quantify an overpayment before reporting and returning any funds.15 Thus, if a probe sample of ten claims, for instance, determines that five of the ten claims are overpayments, the final rule does not require reporting and returning any overpayments associated with the five single erroneous claims within 60 days from the date the probe audit was completed. Rather, the 60-day repayment period commences once a provider or supplier has completed the expanded audit and quantifies the overpayment amount for all erroneous claims identified as part of the review. 

How Far Back?

As opposed to the ten-year lookback period suggested in the proposed rule, the final rule implements a six-year lookback period. Specifically, Medicare Part A or Part B overpayments must be reported and returned only if a person identifies the overpayments within six years from the date on which the payment was initially received.16

As a technical matter, in order to allow for return of these self-identified overpayments and “to ensure that the reopening rules do not present an obstacle or unintended loophole to compliance and enforcement,” the final rule amended the Medicare claims reopening rules to extend the current four-year “good cause” reopening period to six years for purposes of self-identified overpayments. Under the amended reopening rules, a provider or supplier may request reopening of an initial determination for purposes of reporting and returning an overpayment within six years from the date on which the claim was originally determined. It is important to note that the reopening rule amendments apply only to overpayments that are self-identified by a provider or supplier. CMS contractors continue to be limited to reopening initial claims determinations within one year for any reason, within four years for good cause or at any time if evidence of fraud or similar fault exists.17

Process for Reporting and Returning Identified Overpayments

The Overpayment Statute provides that if a person has received an overpayment, the person must report and return the overpayment to CMS, as appropriate, at the correct address and include notice regarding the reason for the overpayment.18 Under the final rule, providers or suppliers may use applicable claims adjustment, credit balance, self-reported refund, or another appropriate process to satisfy the report and return obligations of the statute.  Notably, CMS eliminated its extended list of data points that must be included with the report—including how the error was discovered, a description of the corrective action plan, and the reason for the overpayment (statutory reference notwithstanding)—recognizing that such information may not be necessary and deferring instead to the existing processes for refunds (including contractor processes).

For self-disclosures to CMS or the HHS-Office of Inspector General (OIG), the 60-day repayment period will be suspended from the date on which a provider or supplier submits a disclosure to CMS via the SRDP or to OIG via the Self-Disclosure Protocol, and the relevant agency acknowledges receipt, continuing as long as a provider or supplier engages in good faith settlement negotiations with CMS or OIG. If a settlement cannot be reached, a provider or supplier has the balance of the 60-day period remaining from identification to suspension of that 60-day period when CMS or OIG acknowledges receipt of a disclosure to report and return any overpayment.      

Context of the Final Rule

The Overpayment Statute broadly defines an “overpayment” as any Medicare or Medicaid funds that any person receives or retains to which the person, after applicable reconciliation, is not entitled.19 Whereas the statute broadly applies to providers, suppliers, Medicaid managed care organizations, Medicare Advantage organizations and Medicare Part D plan sponsors, the final rule applies to only Medicare Part A and Part B overpayments. A final rule regarding Medicaid requirements has not been issued. However, the Overpayment Statute does not require CMS to issue regulations in order for the Overpayment Statute to be effective. In fact, the first case addressing overpayment obligations after the enactment of the Overpayment Statute, United States ex rel. Kane v. Healthfirst, involved alleged violations related to amounts received from but not refunded timely to the New York Medicaid program.20Given the incomplete overlap between Healthfirst and the final rule, it is possible that providers and suppliers may face slightly different obligations under Medicare Parts A and B versus Medicaid.  In the final rule, CMS reiterates that even in the absence of a final Medicaid rule, “[p]roviders and suppliers that identify overpayments received from . . . Medicaid should report and return those overpayments to the appropriate payor,” as required under the Overpayment Statute.21