Takeaways From Medicare's 60-Day Overpayment Rule Law360, New York (February 12, 2016, 3:28 PM ET) -- On Feb. 11, the Centers for Medicare & Medicaid Services provided long-awaited guidance to Medicare Part A and Part B providers and suppliers (providers) on how to comply with the Affordable Care Act provision requiring them to report and return overpayments within 60 days after they are “identified.” Although part A/B providers have faced False Claims Act liability for failures to comply since 2010, until this final rule (part A/B final rule), they lacked any directly applicable guidance about how to fulfill their obligations. The part A/B final rule provides some measure of clarity to providers. In particular: • Funds retained after the “applicable reconciliation,” which is defined as the time a cost report is filed, create an overpayment. • An overpayment is “identified” when a person “has, or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.” • Providers have a duty to look back six years to assess the existence of overpayments. The biggest win for relevant providers is CMS’s concession that the 60-day clock may not begin to run until a provider concludes a reasonably diligent investigation into credible information about an overpayment, including quantifying the amount of the overpayment — a process CMS acknowledges can take up to six months. Even with this whiff of breathing room, the rule imposes harsh new challenges for corporate compliance and legal functions. As prosecutors and relators demonstrate greater interest in enforcing the overpayments rule, the stakes grow higher if internal compliance programs are unable to quickly investigate potential overpayments and manage whistleblower risk. Groundwork for the Part A/B Final Rule The “reverse false claims” provision of the FCA creates liability if one “knowingly conceals or knowingly and improperly avoids or decreases an obligation to pay” money to the government. The ACA amended the Social Security Act to define overpayments as an “obligation” for purposes of the FCA. In turn, the same provision defines overpayments as any Medicare or Medicaid “funds” received but “to which the person, after applicable reconciliation, is not entitled.” The statutory deadline for timely returning an overpayment is the later of 60 days after it is “identified,” or the date on which a corresponding cost report is due (if applicable). Congress delegated to CMS the task of operationalizing this statute across the broad swath of providers, suppliers and insurers who fall within the scope of this rule. Because the payment mechanisms vary across federal health care programs, CMS committed to providing program-specific guidance to stakeholders. On Feb. 16, 2012, CMS published a proposed rule (part A/B proposed rule) offering guidance about how part A/B providers should report and return overpayments. Three years later, citing “significant policy and operational issues that need to be resolved,” CMS announced it would need at least another year to finalize the proposed rule. In the meantime, in May 2014 CMS published a final rule applicable to Medicare Advantage plans and Part D sponsors (Part C/D final rule). The rule offered the health care industry a hint at what was to come in the part A/B final rule. Both the part C/D and part A/B proposed rules 2 suggested the same definition of “identified,” namely, the FCA “knowledge” standard of actual knowledge, deliberate indifference, or reckless disregard. However, the part C/D final rule expanded this initial definition of “identified” also to encompass situations in which an organization “has determined, or should have determined through the exercise of reasonable diligence that [it] has received an overpayment.” While purporting to be consistent with the FCA mens rea standard, many have argued that this standard is, in fact, lower than the FCA standard and may include less culpable actors. The part C/D final rule did grant some relief vis-a-vis the part A/B proposed rule, in that it requires only a six-year lookback period for reporting and returning overpayments, rather than the 10-year lookback period set forth in the part A/B proposed rule. Notably, neither rule applies to Medicaid providers. Just one month after the publication of the part C/D final rule, the U.S. Department of Justice demonstrated its early interest in actively enforcing the overpayments rule by intervening in a qui tam suit premised solely on a Medicaid provider’s failure to timely return overpayments. See United States ex rel. Kane v. Continuum Health Partners, No. 11-2325 (S.D.N.Y.). The DOJ’s intervention in Continuum was notable not only in light of the absence of any overpayments guidance applicable to Medicaid providers, but also because the defendant had fully repaid the government by the time the DOJ elected to intervene. Furthermore, the DOJ proceeded on the basis of an aggressive interpretation of “identified.” The relator, a former employee of the defendant provider, had emailed his supervisor a list of claims he believed to be associated with overpayments as a result of a known computer glitch. The DOJ’s complaint in intervention acknowledged that the relator’s email “indicated that further analysis was needed to corroborate his findings.” Nevertheless, the relator filed a qui tam complaint exactly 60 days after sending this email, eventually arguing that this email triggered the 60-day clock. In August 2015, the district court denied the defendant’s motion to dismiss. The court concluded that a provider has “identified” an overpayment when it “is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained.” The court observed that while CMS had not promulgated overpayments guidance applicable to Medicaid providers, CMS likely would apply the same definition of “identified” across provider types. Accordingly, the court extended the part C/D final rule’s definition of “identified” to the Medicaid context. The defendant had argued that because the overpayments rule requires the actual return of funds within 60 days, effectively starting the clock when the defendant merely has notice of a potential overpayment creates a timeline of investigation and quantification that is realistically impossible to achieve. Furthermore, the defendant observed that while the government is given 60 days to investigate sealed qui tam complaints, prosecutors virtually always need to seek extensions. The court conceded the “unforgiving” nature of the overpayments rule, but insisted that its hands were bound because the ACA “contains no language to temper or qualify” this harshness. Forgetting relators’ powerful financial incentives, the court optimistically hoped that “prosecutorial discretion would counsel against the institution of enforcement actions aimed at well-intentioned health care providers working with reasonable haste to address erroneous overpayments.” Just one day after the court’s ruling in Continuum, the DOJ announced a settlement with a home nursing services provider, Pediatric Services of America Inc. (PSA), based on the failure 3 to timely report and return overpayments. PSA allegedly did not investigate credit balances on its books to determine whether they resulted from overpayments made by a federal health care program. As part of the resolution PSA also entered into a corporate integrity agreement. The CIA gives PSA more flexibility than under the FCA (or at least Continuum’s interpretation of it): while PSA has an obligation to repay overpayments within 60 days of “identification,” if the payments are not yet quantified within 60 days of identification, PSA is permitted under the CIA to notify the applicable Medicare contractor of its efforts to quantify the overpayment, along with a schedule of when the work will be completed. Key Provisions in the Part A/B Final Rule Definition of “Overpayment” CMS proposed to use the broad statutory definition of “overpayment” without limitation. A number of commenters encouraged CMS to add nuance to the definition, such as by excluding routine business practices (e.g., certain refunds) or overpayments caused by circumstances outside of the provider’s control (e.g., an error by CMS or a Medicare Administrative Contractor (MAC)). CMS declined to adopt any carve-outs from the plain meaning of the statutory definition, emphasizing that an “overpayment” can exist even where a provider is without fault as to the cause. CMS did clarify that the amount of an overpayment is generally “the difference between the amount that was paid and the amount that should have been paid.” However, for claims tainted by violations of the Anti-Kickback Statute or Stark Law, CMS typically will view the overpayment as the full amount received by the provider. To address concerns that changes in regulations could morph historical, then-valid payments into overpayments, CMS explained that “overpayments would be determined in accordance with the effective date of any changes in law, regulation or policy.” CMS also noted that the part A/B final rule pertains to overpayments only, and providers cannot, for example, offset identified overpayments with identified underpayments. Definition of “Identified” One of the most hotly anticipated elements of the part A/B final rule was the definition CMS would adopt for when an overpayment has been “identified.” While many feared CMS would extend the same definition from the part C/D final rule — particularly in light of the stamp of approval the agency received from the Continuum court — CMS instead offered up concessions to providers. The part A/B final rule defines “identified” as “when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment” (emphasis added). The incorporation of “quantified” as part of the process of identification expands the time frame until the 60-day clock begins running. Under CMS’s standard, there are now two critical benchmarks for providers after which point the 60-day clock begins to run: (1) “when reasonable diligence is completed and the overpayment is identified” or (2) “on the day the person received credible information of a potential overpayment if the person fails to conduct reasonable diligence and the person in fact received an overpayment.” Under the reasonable diligence standard, a provider who “obtains credible information concerning a potential overpayment” must both conduct a “timely, good faith investigation” into the information and quantify any overpayments. CMS promulgated two important definitions to offer further guidance to providers about the timeline of their obligations. First, CMS clarified that 4 a “timely, good faith investigation of credible information” would last no more than “six months from receipt of the credible information, except in extraordinary circumstances.” CMS encourages the use of statistical sampling and extrapolation to investigate and calculate overpayment amounts. Second, CMS defined “credible information” as “information that supports a reasonable belief that an overpayment may have been received.” CMS views “credible information” broadly, which will undoubtedly lead to numerous factual disputes regarding the quality of information received by providers. Length of Lookback Period and Definition of “Applicable Reconciliation” CMS initially proposed to require providers to report and return identified overpayments within 10 years of the date the overpayment was received. However, in the final rule CMS adopted the same six-year period used in the part C/D final rule. This means that if a provider “identifies” an overpayment within six years of the date the overpayment was received, the provider is obligated to timely report and return it. The shorter lookback period gives credence to concerns raised by stakeholders as to the burden and cost of a 10-year lookback. However, CMS declined to adopt suggestions of a phase-in period, placing pressure on providers to understand potential legacy gaps in documentation that could impede efforts to quantify overpayment obligations. CMS clarified that the part A/B final rule is not retroactive and therefore providers that returned overpayments prior to the rule’s effective date, such as through the CMS voluntary self-referral disclosure protocol (which only has a four-year lookback period), need not go back and return additional overpayments spanning the full length of the six years. The term “applicable reconciliation,” is a critical threshold moment in an overpayments saga because overpayments do not arise until funds are retained after this point in time. CMS finalized its proposal to define “applicable reconciliation” as when cost reports are filed. Where a MAC has notified a provider of an improper cost report payment, CMS considers providers to have “received credible information of a potential overpayment,” such that reasonable diligence requires the provider to investigate all of its other cost reports within the lookback period. Report and Return Process CMS did not finalize its rigid proposal requiring providers to return overpayments using CMS’s existing voluntary self-reported overpayment refund process. This process would have mandated the provision of 13 specified data fields, including how the error was discovered, a summary of the corrective action plan instituted to safeguard against future errors, and a description of the statistical methodology used to calculate the overpayment. CMS instead agreed to give providers more flexibility by allowing them to use “the most applicable [repayment] process set forth by” their MAC. While providers need not delineate all of the initially proposed data points, CMS is still requiring the description of any statistical sampling methodology used. Implications for Qui Tam Suits The number of qui tam suits and claims alleging a failure to return overpayments will surely skyrocket, as the part A/B final rule now gives relators and the government the rule they will claim to have been violated as a predicate for FCA liability. Indeed, some relators have already begun to test the theory. For example, the relator in United States ex rel. Graves v. Humana, No. 10-cv-23382 (S.D. Fla.), has argued that when her upcoding allegations arising in the Medicare Advantage/Part C context were partially unsealed and provided to the defendants, this put them on notice of potential overpayments and started the 60-day clock for returning them. 5 Once that clock expired she amended her complaint to add a “reverse false claims” count against each defendant based on the alleged failure to return the “overpayments.” Although some of the defendants argued these claims were redundant of the pre-existing allegations, the court credited the relator’s explanation that the claims could create alternate bases of liability, i.e., if certain unsupported codes were simple mistakes rather than fraud, FCA liability could still exist if the defendants nonetheless had identified the mistakes and failed to return the overpayments within 60 days. Given the highly fact-intensive nature of assessing whether and when a provider has “identified” an overpayment, defendants may face significant challenges in having claims based on alleged violations of the part A/B final rule rejected at the motion to dismiss stage. As the number of qui tam complaints rises, so too an increasing number of providers will find themselves the recipients of subpoenas requesting information about alleged overpayments. Companies responding to these investigations will of course be working against the backdrop of last year’s Yates memo and its requirement that they identify culpable individuals if they wish to receive any cooperation credit. This dynamic presents particular challenges for companies and risks for individuals because CMS’s definition of “identified” threatens to sweep in merely negligent actors. Indeed, compliance and finance professionals may face probing inquiries into whether they “identified” overpayments. Ensuring Compliance Programs Are Up to the Task The outrage generated by the truly “unforgiving” timeline imposed by the Continuum court may have pressured CMS to attempt to inject some measure of reasonableness into its interpretation of the overpayments rule. While the Continuum court characterized the statutory language requiring the return of overpayments within 60 days of identification as clear-cut, CMS apparently tried to assert more realistic expectations by adopting a more flexible interpretation of “identified.” Nonetheless, making a repayment no later than eight months after receiving “credible information” can be challenging even in simple cases, let alone for large providers facing complex historical arrangements. While completing the work in a timely manner poses its own challenges, so too does the task of assessing which allegations to act on. The failure to conduct reasonable diligence in the face of “credible information” will initiate the 60-day countdown immediately. While providers will be safe if the allegations ultimately turn out to be baseless, if overpayments do exist, providers face potential FCA liability. This creates a tremendous burden on providers to quickly understand whether overpayment allegations constitute “credible information” that must be investigated. CMS made clear that a provider’s compliance with its obligations will require “both proactive and reactive” compliance initiatives; mere “minimal compliance activities to monitor the accuracy and appropriateness” of payments will “expose the provider or supplier to liability,” because it will be considered tantamount to a “failure to exercise reasonable diligence.” CMS’s articulated expectations place great pressure on companies to ensure that their compliance programs readily can distinguish “credible information” from baseless allegations and then complete an investigation into that information, including quantifying overpayments if necessary. As the ruling in Continuum demonstrates, even preliminary, uncorroborated results from internal auditing and other compliance activities may later be deemed sufficient notice to providers to trigger the countdown clock. Failing to act within that window will expose providers not only to 6 administrative consequences, but also to treble damages and penalties under the FCA. To best manage the risks and uncertainties presented by the part A/B final rule, providers should take steps now to implement or update their policies and systems to handle overpayments. Process improvements providers may wish to consider in light of CMS’s guidance include: • Establish the internal process by which the organization collects information about the kinds of facts and circumstances that can trigger potential overpayments — from routine billing errors to potentially deliberate fraud or misconduct — and evaluates that information. For most larger providers, this process will be owned by the compliance department. Notably, according to CMS, even having a robust compliance program structured to meet all of the elements suggested by the Office of Inspector General compliance program guidance will not shield a provider from liability if the provider fails to meet the requisite report and return time frame. • Set forth guidelines for investigating potential overpayments issues. These guidelines should address, among other issues, when to involve inside or outside counsel, how to determine the appropriate “lookback” period, and how appropriately to scope any audit of suspected systemic errors or intentional fraud. • Allow for tracking of potential overpayments, the dates of determination, and the date of repayment deadlines consistent with CMS’s timeline. This system should be structured in a way that allows providers to escalate potentially systemic coding and billing errors that will require the most time to evaluate and quantify. This is particularly important as CMS takes the position that senior management need not know of an overpayment before “knowledge” is attributed the organization. Larger organizations will want to establish compliance-led committees to conduct regular (at least monthly) reviews of potential overpayments issues and decisions. • Document the standards to be used to evaluate potential overpayments and the ultimate decision maker for determining whether and when an overpayment has been received. In particular, providers have the opportunity to manage some of the uncertainty introduced by the part A/B final rule by defining the specific criteria they will use to identify overpayments. • Contemplate the temporary suspension of billing or other stop-gap measures related to individual providers or issues while a potential overpayment situation is being evaluated. • Identify the resources that will be allocated to quantifying overpayments as soon as they are identified, according to the company’s policies. While efforts may be made to complete the quantification within the allotted time frame, for complex issues — particularly those overpayments resulting from systemic errors and knowing misconduct — the quantification of the overpayment will exceed this time frame. In those cases, the provider should work with counsel to determine whether nonetheless to notify CMS in writing of the issue and discuss its expectations for completing the quantification. 7 —By Jaime L.M. Jones and Brenna E. Jenny, Sidley Austin LLP Jaime Jones is a partner in Sidley Austin's Chicago office. She represents pharmaceutical and device manufacturers and institutional providers in health care fraud and abuse and food and drug enforcement and litigation matters. Brenna Jenny is an associate in Sidley Austin's Washington, D.C., office. She is part of the firm's healthcare group where she advises FDA-regulated companies and large provider groups on a range of regulatory and compliance matters, with an emphasis on government enforcement actions. The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.  31 U.S.C. § 3729(a)(1)(G).  42 U.S.C. § 1320a-7k(d)(3).  42 U.S.C. § 1320a-7k(d)(4)(B).  42 U.S.C. § 1320a-7k(d)(2).  80 Fed. Reg. 8,247 (Feb. 17, 2015). All Content © 2003-2016, Portfolio Media, Inc.