Latham & Watkins operates worldwide as a limited liability partnership organized under the laws of the State of Delaware (USA) with affiliated limited liability partnerships conducting the practice in the United Kingdom, France, Italy and Singapore and as affiliated partnerships conducting the practice in Hong Kong and Japan. The Law Office of Salman M. Al-Sudairi is Latham & Watkins associated office in the Kingdom of Saudi Arabia. Under New York’s Code of Professional Responsibility, portions of this communication contain attorney advertising. Prior results do not guarantee a similar outcome. Results depend upon a variety of factors unique to each representation. Please direct all inquiries regarding our conduct under New York’s Disciplinary Rules to Latham & Watkins LLP, 885 Third Avenue, New York, NY 10022- 4834, Phone: +1.212.906.1200. © Copyright 2016 Latham & Watkins. All Rights Reserved. Latham & Watkins Healthcare Services & Providers Industry Group February 23, 2016 | Number 1932 CMS Finalizes Long-awaited Rule Implementing ACA’s Overpayment Reporting Requirements CMS provides some clarity in Affordable Care Act final rule, but questions remain, complicating compliance efforts. On February 12, 2016, the Centers for Medicare & Medicaid Services (CMS) published a final rule (Final Rule)1 implementing Section 6402(a) of the Patient Protection and Affordable Care Act (the ACA),2 the 2010 legislative provision requiring Medicare providers and suppliers, Medicaid managed care organizations, Medicare Advantage organizations and Prescription Drug Plan sponsors to report and return overpayments of Medicare or Medicaid funds under specific timelines. The Final Rule, which implements Section 1128J(d) of the Social Security Act (the Act), entitled “Reporting and Returning of Overpayments,” requires federal overpayments for certain healthcare services to be reported and returned by the later of: (1) 60 days after identifying the overpayment or (2) the date any corresponding cost report is due, if applicable (the Overpayment Rule).3 The Final Rule is effective March 14, 2016 — over four years after CMS published the proposed rule (the Proposed Rule). 4 The Final Rule implements the requirements set forth in the Overpayment Rule only as they relate to providers and suppliers under Medicare Parts A and B. CMS published a final rule implementing the requirements set forth in section 1128J(d) of the Act with respect to Medicare Parts C and D at 79 Fed. Reg. 29844 (May 23, 2014). CMS has not published proposed or final regulations regarding the application of section 1128J(d) to the Medicaid program. Even absent the Final Rule, providers and suppliers have been subject to the statutory provision since its effective date, March 23, 2010, and may face liability for failure to report and return an overpayment under the federal False Claims Act (FCA) or the Civil Monetary Penalties Law, as well as exclusion from federal health care programs. The Final Rule provides a number of useful explanations and clarifications regarding application of the Overpayment Rule. For instance, CMS revised the proposed definition of “identified” to clarify that a provider or supplier has identified an overpayment when the provider or supplier has or should have, through the exercise of reasonable diligence, determined that it has received any overpayment and quantified the overpayment amount. The Final Rule also reduced the proposed 10-year lookback period, requiring that overpayments be reported and returned only if identified within six years of the date the overpayment was received. CMS will allow providers and suppliers to use an applicable claims adjustment, credit balance, self-reported refund or another appropriate process to satisfy the obligation to report and return overpayments — a positive change for providers and suppliers from the Proposed Rule. Despite these improvements, CMS has left providers and suppliers to struggle with other questions, such as the scope of required proactive compliance obligations and the ambiguity of the credible information Latham & Watkins February 23, 2016 | Number 1932 | Page 2 standard, which triggers providers’ and suppliers’ responsibility to investigate a potential overpayment. Providers and suppliers should carefully consider how the Final Rule impacts their existing operations. Overpayment Rule The Final Rule implements the following requirements set forth in Section 1128J(d) of the Act: • Section 1128J(d)(1): Requires a person who has received an overpayment to report and return the overpayment to the government and to notify the Secretary, State, intermediary, carrier or contractor to whom the overpayment was returned in writing of the reason for the overpayment. • Section 1128J(d)(2): Requires that an overpayment be reported and returned by the later of (1) the date which is 60 days after the date on which the overpayment was identified; or (2) the date any corresponding cost report is due, if applicable. • Section 1128J(d)(3): Specifies that any overpayment retained by a person after the deadline for reporting and returning an overpayment is an obligation for purposes of the federal FCA. Section 1128J(d)(4)(B) of the Act defines “overpayment” as any funds a person receives or retains under title XVIII and XIX of the Act to which the person is not entitled. Although the Final Rule is not retroactively effective, providers and suppliers were obligated to comply with Section 1128J(d) of the Act as of the ACA’s enactment on March 23, 2010. CMS clarified in the Final Rule that for the period between March 23, 2010, and March 14, 2016, providers and suppliers are permitted to rely on good-faith and reasonable interpretations of the statutory provision. “Identifying” an “Overpayment” Section 1128J(d) requires that any “overpayment” must be returned within 60 days of being “identified.” In the Proposed Rule, CMS proposed that a provider or supplier had “identified an overpayment if the person has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment.” In the preamble to the Proposed Rule, CMS indicated that this definition was consistent with the definition of “knowing” under the FCA. In response to comments describing the proposal as ambiguous, CMS modified the standard in the Final Rule to provide that “a person has identified an overpayment when the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” With the revision, CMS acknowledged that relying on the FCA’s standard for “knowledge” — actual knowledge, reckless disregard or deliberate ignorance — might not adequately convey under what circumstances providers and supplier have a duty to investigate a potential overpayment, or what efforts providers and suppliers must undertake to avoid overpayment liability. CMS stated that the revised definition provides an incentive for providers and suppliers to exercise reasonable diligence in determining whether an overpayment exists, as without such a definition, some may avoid undertaking activities, such as self-audits, compliance checks and other research, to determine whether an overpayment exists. In a positive policy shift from the Proposed Rule, the Final Rule provides that providers and suppliers must have quantified the amount of the overpayment to trigger the 60-day report and return requirement. This bright line rule should assist providers and suppliers struggling with the Proposed Rule’s indefinite constructive knowledge standard and the various time frames one might reasonably interpret from the statutory language. Latham & Watkins February 23, 2016 | Number 1932 | Page 3 Reasonable Diligence Standard The standard for the “identification” of an overpayment relies upon providers and suppliers’ exercising “reasonable diligence.” CMS declined to define “reasonable diligence” in the Final Rule, but described the standard as fact-dependent, including both proactive compliance activities, and the timely investigation of credible information regarding a potential overpayment, conducted in good faith by qualified individuals. With respect to proactive compliance activities, CMS stated that providers and suppliers are responsible for ensuring Medicare claims are accurate and proper, and that undertaking no or minimal compliance activities to monitor Medicare claims’ accuracy and appropriateness would expose the submitting provider or supplier to liability under the Overpayment Rule, based on the failure to exercise reasonable diligence if an overpayment was actually received. Although CMS described the proactive obligation as a “clear duty” to ensure that claims submitted to Medicare are accurate and appropriate, the agency did not require that providers and suppliers adopt a formal compliance plan or audit strategy, acknowledging that compliance activities may appropriately vary based on the provider’s or supplier’s type and size. Whether the claims monitoring that CMS expects is consistent with generally accepted standards for compliance programs — such as those set forth in the US Department of Health and Human Services Office of Inspector General’s (OIG) Compliance Program Guidance — or if the proactive standard imposes a higher bar, remains uncertain. CMS also clearly considers claims tainted by violations of the Stark Law and the federal Anti-Kickback Statute to be overpayments subject to the Final Rule’s provisions. Therefore, compliance programs should not only address potential clerical and billing errors, but also monitor for and identify more complex violations of law that could result in overpayments. CMS also discussed in the Final Rule providers’ and suppliers’ obligation to timely investigate credible information regarding a potential overpayment. The agency described “credible information” as including “information that supports a reasonable belief that an overpayment may have been received” and stated that whether such information was sufficiently credible to merit investigation was a fact-specific determination. Upon obtaining credible information concerning a potential overpayment, the provider or supplier must undertake reasonable diligence to determine whether an overpayment was received and to quantify the amount. For example, CMS suggested that a single, detailed complaint or repeat compliance hotline complaints about the same or similar issues could amount to credible information obligating a provider or supplier to conduct reasonable diligence. CMS also noted that a Medicare contractor or other government audit’s overpayment determination is always credible, requiring the provider or supplier to conduct reasonable diligence to confirm or contest the audit findings. The results of a contractor audit may also serve as credible information regarding an overpayment beyond the audit’s scope if the practice that resulted in the audit overpayment determination occurred outside the audit timeframe. CMS acknowledged, however, that if the provider or supplier contests the audit findings or appeals an overpayment determination, initiating an investigation of nearly identical conduct occurring outside the audit timeframe during the pendency of the appeal may reasonably be premature. Unfortunately, the Final Rule leaves room for interpretation regarding what information qualifies as “credible,” potentially exposing providers and suppliers to liability for an otherwise good faith determination that the available information fails to meet the standard. The Clock Begins to Tick The Final Rule usefully clarifies when the 60-day clock begins to tick regarding the obligation to report and return overpayments. In the Proposed Rule, CMS provided no guidance as to when the 60-day clock would begin in cases of the provider’s or supplier’s reckless or deliberate inaction in the face of information concerning a potential overpayment. Providers and suppliers were left with an imprecise “all deliberate speed” standard, under which they must act upon information concerning a potential Latham & Watkins February 23, 2016 | Number 1932 | Page 4 overpayment or risk FCA liability for “knowingly” retaining an overpayment by recklessly disregarding or deliberately ignoring such information. In the Final Rule, CMS clarified that the 60-day clock begins running when either the reasonable diligence is completed, or on the day the provider or supplier received credible information of a potential overpayment if the provider or supplier failed to conduct reasonable diligence and had in fact received an overpayment. In abandoning the proposed “all deliberate speed” standard as lacking sufficient clarity, CMS stated that a timely, good faith investigation of credible information regarding a potential overpayment should occur within at most six months from receiving such information, except in extraordinary circumstances. The agency specifically identified Stark Law violations, which may reasonably require more than six months to investigate, as an “extraordinary circumstance,” as well as natural disasters or states of emergency. Absent extraordinary circumstances, providers and suppliers will generally have a maximum of eight months (six months plus an additional 60 days) between receiving credible information that an overpayment may exist and repaying the overpayment, if they in fact received one. The six months, plus an additional 60 days, does not give providers and suppliers the luxury of time. Upon receiving credible information of an overpayment, providers and suppliers must move quickly to determine whether an overpayment occurred and calculate the overpayment amount. If the potential overpayment investigation requires considerable resources, the assistance of outside experts, or complex claims audit and sampling, the eight-month window will close quickly. Notwithstanding CMS’ helpful recognition that investigations into Stark Law violations may require considerable time to investigate and analyze, providers and suppliers will need to work quickly to avoid a perceived failure to exercise reasonable diligence while investigating such matters. If a provider or supplier chooses not to conduct reasonable diligence upon receiving credible information about an overpayment, the 60-day clock begins to run at the time they received the credible information. Providers and suppliers should err on the side of review and investigation, even if the credibility of the potential overpayment is a close call. Six-year Lookback Period The Final Rule established a six-year “lookback period,” requiring the return of all overpayments identified within six years of receiving the funds — measured from the date the overpayment is identified. This period is shorter than the Proposed Rule’s 10-year lookback period. While less of a burden on providers and suppliers, the six-year lookback period is effective immediately upon the Final Rule’s effective date; so, overpayments received after the ACA’s enactment on March 23, 2010, that are identified but not yet returned, may be subject to the Final Rule. This change is in line with requirements applying to Medicare Parts C and D. Overpayments reported and returned prior to the Final Rule’s March 14, 2016, effective date need only encompass overpayments arising under the current reopening period of four years. Overpayments reported and returned to CMS on or after March 14, 2016, must comply with the new six-year period. Intersection with the Reopening Rules CMS addressed concerns commenters raised that the proposed adjustment to the reopening rules at 42 C.F.R. § 405.980(b) would expand the authority of the agency’s contractors to reopen paid claims that are not the subject of a provider’s or supplier’s voluntary disclosure beyond the current limit of four years. The Final Rule includes new provision § 405.980(c)(4), which authorizes a six-year reopening period for claims associated with the voluntary repayment of an overpayment requested by a provider or supplier. Latham & Watkins February 23, 2016 | Number 1932 | Page 5 By separating this reopening authority into a separate subparagraph, CMS addressed the administrative hurdle that would otherwise prevent the adjustment of claims following receipt of a voluntary disclosure going back six years, without significantly expanding the agency’s authority to reopen claims of the contractor’s own volition. However, because CMS considers Medicare contractors a source of credible information regarding potential overpayments, providers and suppliers could be placed on notice of potential overpayments that the contractor could not, on its own, reopen, strongly suggesting that providers and suppliers must undertake reasonable diligence to investigate such information over the entire six-year lookback period under the Final Rule. Intersection with the Anti-Kickback Statute With respect to the Anti-Kickback Statute (AKS), CMS reiterated its view that compliance with the AKS is a condition of payment; therefore, to the extent a provider or supplier receives an overpayment arising from a kickback arrangement and has sufficient knowledge of the arrangement, but was not a party to such an arrangement, the provider or supplier must report the overpayment in accordance with the Final Rule. CMS explained that it would refer the reported overpayment and potential kickback arrangement to the OIG and suspend the repayment obligation until the government resolves the kickback matter (either by determining that no enforcement action is warranted or by obtaining judgment, verdict, conviction, guilty plea or settlement). As with the Proposed Rule, CMS noted that it expected the innocent provider or supplier would not be required to repay an overpayment arising from the AKS violation, except in extraordinary circumstances — which the agency described as fact-specific. Although the Final Rule provides no additional comfort to providers and suppliers on this issue, providers and suppliers may lack sufficient knowledge of a downstream kickback arrangement to have “identified” the resulting overpayment and, therefore, have no duty to report it. Intersection with the False Claims Act Providers and suppliers are reminded that the Overpayment Rule specifically provides that retention of an overpayment after the applicable deadline — 60 days from identification or the date any corresponding cost report is due — is an obligation for FCA purposes. Violations of the FCA may result in steep penalties ranging from US$5,500 to US$11,000 per false claim, plus treble damages, and may provide the basis for exclusion from federal healthcare programs. In addition, whistle-blowers known as “relators” may initiate “qui tam” actions against providers or suppliers for FCA violations, and share in any proceeds resulting from the lawsuit. In light of CMS’ position on proactive compliance activities and the timely investigation of credible information regarding potential overpayments, providers and suppliers should be mindful of potential liability under the FCA when making business decisions regarding compliance with the Overpayment Rule. Latham & Watkins February 23, 2016 | Number 1932 | Page 6 Avenues for Reporting and Returning Overpayments In the Final Rule, CMS responded to comments that the existing voluntary refund process is not the only manner by which providers and suppliers refund overpayments. CMS will allow providers and suppliers to use the claims adjustment, credit balance, self-reported refund process or any other appropriate process to report and return overpayments. The Final Rule does not require entities to report the specific list of data elements CMS suggested under the Proposed Rule, and providers and suppliers may use current contractor refund forms. However, if an overpayment amount is extrapolated based on statistical sampling methodology, the provider or supplier must explain in the overpayment report how they calculated the overpayment amount and that more specific data elements, such as health insurance claim and Medicare claim control numbers, are not available for all claims in the extrapolation. Providers and suppliers should report claims-level data for all claims reviewed as part of the statistical sample. With respect to the CMS Voluntary Self-Referral Disclosure Protocol (SRDP) and the OIG Self-Disclosure Protocol (SDP), CMS abandoned the proposal that would have treated the SRDP and SDP differently for purposes of satisfying the reporting obligation. Commenters argued that the proposal would have burdened providers and suppliers disclosing under the SRDP to report duplicative information regarding the overpayment through the voluntary refund process, though a similar requirement was not proposed for parties disclosing under the SDP. Under the Final Rule, submissions to the SRDP or the SDP will satisfy the reporting requirement and toll the requirement to return the overpayment for the duration of the time the provider or supplier is engaged in the SRDP or SDP process with respect to the matter disclosed. If the provider or supplier is no longer engaged in the SRDP or SDP process or no longer actively negotiating a settlement, the tolling ceases and the provider must comply with the 60-day repayment requirements — meaning the provider or supplier has the balance of the 60-day time period remaining from identification to the date of tolling to report and return any overpayment to the applicable contractor. The significant delay associated with resolutions under the SRDP may mean that providers and suppliers will wait significant periods of time — perhaps years — to resolve disclosed overpayments. Good Faith and Reasonable Interpretations of the Statute Beginning on March 14, 2016, providers and suppliers are required to comply with the Final Rule. Regarding the time period between March 23, 2010 — the effective date of section 1128J(d) of the Act — and March 14, 2016, CMS stated that providers and suppliers may rely on their good faith and reasonable interpretation of the statutory provision. This statement provides some comfort that as long as providers and suppliers acted with good faith and reasonable diligence to investigate credible information regarding a potential overpayment, and did not unduly delay investigating such information or repaying any identified overpayments, CMS will not seek to impose a higher standard based on the interpretation in the Final Rule. CMS provided no further explanation regarding the obligation for reporting and returning overpayments during the time period prior to March 14, 2016. Conclusion: New Compliance and Audit Considerations The Final Rule usefully clarifies for providers and suppliers when an overpayment has been “identified” and the standard by which providers and suppliers must investigate credible information of a potential overpayment. However, CMS has left providers to struggle with other questions, such as the scope of the required proactive compliance obligations and the ambiguity of the credible information standard. In addition, while CMS reduced the proposed lookback period from 10 to six years, the Final Rule extends by an additional two years the audit responsibility (and potential liability) of providers and suppliers who may have previously relied on the four-year reopening rule to limit the scope of their internal audits and resulting overpayment calculations. Latham & Watkins February 23, 2016 | Number 1932 | Page 7 Providers and suppliers should carefully consider how the Final Rule impacts their existing operations. And, in light of the potential FCA liability, providers and suppliers should ensure compliance programs incorporate robust policies and procedures for vetting and investigating potential overpayments and conduct that could result in an overpayment (i.e., a violation of the AKS or the Stark Law). If you have questions about this Client Alert, please contact the Latham lawyer with whom you normally consult: Stuart S. Kurlander [email protected] +1.202.637.2169 Washington, D.C. Joseph C. Hudzik* [email protected] +1.202.637.2200 Washington, D.C. Kasey P. Branam [email protected] +1.858.523.5419 San Diego, CA Eric C. Greig [email protected] +1.713.546.7456 Houston, TX * Licensed to practice in Illinois only. All work supervised by a member of the D.C. Bar. You Might Also Be Interested In AseraCare Is Now a Key Case for FCA Defendants CMS Proposes New Medicare Reporting and Payment System for Laboratories OIG Solicits Comments Regarding New Healthcare Rules Latest Developments in Healthcare Fraud: Companies Facing Increased Scrutiny Client Alert is published by Latham & Watkins as a news reporting service to clients and other friends. The information contained in this publication should not be construed as legal advice. Should further analysis or explanation of the subject matter be required, please contact the lawyer with whom you normally consult. The invitation to contact is not a solicitation for legal work under the laws of any jurisdiction in which Latham lawyers are not authorized to practice. A complete list of Latham’s Client Alerts can be found at www.lw.com. If you wish to update your contact details or customize the information you receive from Latham & Watkins, visit http://events.lw.com/reaction/subscriptionpage.html to subscribe to the firm’s global client mailings program. Endnotes 1 CMS, Medicare Program: Reporting and Returning of Overpayments, 81 Fed. Reg. 7654 (Feb. 12, 2016). 2 See Pub. L. 111-148. ACA was amended by the Health Care Education Reconciliation Act of 2010 (Pub. L. 111-152), and both these laws are collectively referred to as the Affordable Care Act, or ACA. Latham & Watkins February 23, 2016 | Number 1932 | Page 8 3 Section 1128J(d) of the Social Security Act is codified at 42 U.S.C. § 1320a-7k(d). 4 CMS, Medicare Program: Reporting and Returning of Overpayments, 77 Fed. Reg. 9179 (Feb. 16, 2012).