On February 16, 2012, the Centers for Medicare & Medicaid Services (“CMS”) published a proposed rule (“Proposed Rule”)1 to implement Section 6402(a) of the Patient Protection and Affordable Care Act (“ACA”),2 the 2010 legislative provision requiring Medicare providers and suppliers, Medicaid managed care organizations, Medicare Advantage organizations, and Prescription Drug Plan sponsors to report and return overpayments of Medicare or Medicaid funds under specific timelines. Under ACA’s newly-established provision — Section 1128J(d) of the Social Security Act (the “Act”),3 entitled “Reporting and Returning of Overpayments” — federal overpayments for certain healthcare services must be reported and returned by the later of (1) 60 days after identifying the overpayment or (2) the date any corresponding cost report is due, if applicable. This legislative provision subjects entities to False Claims Act (“FCA”) liability if they fail to comply. CMS’s Proposed Rule would implement the provision for Medicare Parts A and B providers and suppliers only. The other entities identified in Section 6402(a) will be addressed by CMS at another time, but remain subject to the legislative provisions.

With respect to the Medicare providers and suppliers covered by its terms, the Proposed Rule sets forth an expanded scope of Section 1128J(d) by defining an “identified” overpayment to include actual knowledge of an overpayment or the reckless disregard or deliberate ignorance of the existence of an overpayment. The Proposed Rule would also establish a 10-year “lookback period,” requiring the return of all overpayments identified within 10 years of receipt of the funds. The Proposed Rule further authorizes Medicare contractors to reopen Medicare claims up to 10 years from the date of determination, or redetermination, if an overpayment is voluntarily reported. These additional requirements could significantly revise companies’ compliance, recordkeeping and reporting obligations, as well as their potential exposure to liability under the FCA, among other sanctions and penalties.

CMS has identified a number of areas in the Proposed Rule in which it is particularly interested in receiving comments, which must be submitted by April 16, 2012.

Overview of Section 1128J(d) and the Proposed Rule

The Proposed Rule implements the following requirements set forth in Section 1128J(d) of the Act:

  • Section 1128J(d)(1): Requires a person who has received an overpayment to report and return the overpayment to the government and to notify the Secretary, State, intermediary, carrier or contractor to whom the overpayment was returned in writing of the reason for the overpayment;
  • Section 1128J(d)(2): Requires that an overpayment be reported and returned by the later of (1) the date which is 60 days after the date on which the overpayment was identified; or (2) the date any corresponding cost report is due, if applicable; and
  • Section 1128J(d)(3): Specifies that any overpayment retained by a person after the deadline for reporting and returning an overpayment is an obligation for purposes of the federal FCA. An “overpayment” is defined as any Medicare funds received or retained by a person to which the person is not entitled.

The Proposed Rule mirrors the statutory definition of an overpayment. “Overpayment means any funds that a person has received or retained under title XVIII of the Act to which the person, after applicable reconciliation, is not entitled.” The preamble to the Proposed Rule offers non-exhaustive examples of overpayment situations, including service dates subsequent to a patient’s death, services provided by unlicensed or excluded individuals and overpayments identified through internal audits.

To implement the 60-day requirement, CMS proposes that a person has “identified” an overpayment if the person has actual knowledge of its existence or acts in reckless disregard or deliberate ignorance of the existence of an overpayment. This expansive standard generally applies to overpayments stemming from individual claims. For overpayments stemming from payments reconciled through cost reports, such as graduate medical education expenses, the 60-day requirement may be triggered at a later date if the cost report is not yet due. In addition, some payments reconciled by the cost report are carved out of the requirement to report and return overpayments when the cost report is due because their final reconciliation does not occur with the filing of the cost report. This includes certain reconciliations for payments based on Supplemental Security Income ratios (for Disproportionate Share Hospital payment adjustments) and outlier reconciliations, which instead occur at the time of settlement of the cost report.

With respect to identifying an overpayment, CMS states that if a provider or supplier receives information concerning a potential overpayment, the recipient has an obligation to make a reasonable inquiry to determine whether an overpayment exists. If a reasonable inquiry reveals an overpayment, the provider has 60 days to report and return it. The failure to make such an inquiry, including the failure to conduct the inquiry with deliberate speed after obtaining the information, could result in the provider knowingly retaining an overpayment because it acted in reckless disregard or deliberate ignorance. For example, a provider that receives an anonymous compliance hotline telephone complaint about a potential overpayment incurs an obligation to timely investigate that matter. If the provider diligently conducts the investigation and reports and returns any resulting overpayments within the 60-day reporting and repayment period, it satisfies its obligations. If the provider fails to make any reasonable inquiry into the complaint, the provider may be found to have acted in reckless disregard or deliberate ignorance of any overpayment. CMS does not provide guidance as to when the 60-day clock would begin in cases of reckless or deliberate inaction that leads to this constructive knowledge of the overpayment. This inquiry requirement becomes even more uncertain when applied to CMS’s other example of circumstances that could lead to liability: when a provider or supplier experiencing a significant increase in Medicare revenue for no “apparent reason” fails to make a reasonable inquiry into whether the increased revenue is an overpayment. The unexplained significant increase in revenue, according to the Proposed Rule, may result in a finding that the entity acted in reckless disregard or deliberate ignorance.

Providers and suppliers would report and refund overpayments to their Medicare contractors using the existing voluntary refund process. This process uses a form available on the Medicare contractors’ websites. The Proposed Rule would rename the existing process as the “self-reported overpayment refund process.” In addition, if a provider or supplier needs additional time to make repayment due to financial constraints, the existing Extended Repayment Schedule process may be used. This process would be the only means by which an extended repayment of the overpayment would be permitted.

Of note, the Proposed Rule cautions that Medicare contractors may scrutinize overpayments received through the Section 6402(a) process and make referrals to OIG whenever they believe circumstances warrant them.

Intersection of ACA and CMS Self-Referral Disclosure Protocol (“SRDP”)

Under the physician self-referral statute, physicians and certain other suppliers may self-disclose violations using the SRDP with the intention of resolving overpayment liability exposure. CMS proposes to suspend the obligation to return overpayments under Section 6402(a) of ACA when the Agency acknowledges receipt of a disclosure made pursuant to the process established by the SRDP. Because the SRDP process only suspends the running of the 60–day deadline to return a physician self-referral related overpayment, the disclosing provider or supplier is still obligated to report the overpayment under the new ACA provisions. CMS seeks comments on alternative approaches to avoid duplicate overpayment reporting.

Intersection of ACA and Office of Inspector General (“OIG”) Self-Disclosure Protocol (“SDP”)

Disclosures regarding self-discovered potential fraud resolved through the OIG SDP result in settlements with OIG. A release from OIG’s applicable Civil Monetary Penalties Law (“CMPL”) and permissive exclusion authorities is made in exchange for a negotiated monetary payment that includes the overpayment as well as certain penalties and assessments. CMS proposes to suspend the obligation to return overpayments under Section 6402(a) of ACA when OIG acknowledges receipt of a submission to the OIG SDP. The suspension would remain in effect until a settlement agreement is entered into, or the provider or supplier withdraws or is removed from the OIG SDP. CMS also proposes that once the provider or supplier notifies OIG of the identified overpayment through the OIG SDP, such notice would constitute a report for purposes of the requirement under ACA.

Overpayments and the Anti- Kickback Statute (“AKS”)

Although there is no specific mention of the AKS and overpayment reporting obligations in the text of the proposed regulations, the preamble contains a discussion in which CMS shares its views on the intersection between reporting overpayments and potential kickbacks. CMS reiterates the position reflected in the amendments to the FCA enacted as part of ACA, which indicate that claims resulting from a violation of the AKS constitute false or fraudulent claims for purposes of the FCA. CMS takes the position that overpayments resulting from violations of the AKS are subject to the Proposed Rule’s reporting requirements. CMS acknowledges that the AKS is violated only where the requisite intent exists, and recognizes that in many instances, a provider or supplier is not a party to, and is unaware of the existence of, an arrangement between third parties that may cause the provider or supplier to submit claims resulting from a kickback.

To illustrate this, CMS discusses a kickback paid by a manufacturer of a device to a physician that used the device in a hospital-based procedure. The hospital submitting a claim for the services may not be aware of the arrangement, and even if it was aware of the arrangement, the hospital is unlikely to be in a position to assess whether one or both parties had the requisite intent to violate the AKS. For this reason, CMS states that providers who are not a party to a kickback arrangement are unlikely in most instances to have “identified” the overpayment resulting from the kickback arrangement and have no duty to report it. On the other hand, CMS states that a provider or supplier who does have sufficient knowledge of a downstream kickback violation generally should self-disclose to the OIG through the SDP. Under the Proposed Rule, notification to the OIG under the Protocol would satisfy the overpayment reporting obligations as long as the notification is timely. CMS notes that the obligation to return an overpayment would be suspended in order to allow the parties to reach a negotiated resolution. This is significant because the OIG’s Civil Monetary Penalties authority with respect to kickbacks provides for a negotiated resolution based on the amount of the remuneration, not the amount of the “overpayment.” CMS further suggests that the OIG may look to the parties of the illegal kickback scheme to repay the overpayment, rather than to the innocent provider. Finally, CMS indicates that where it receives a report of such a situation, it will refer the overpayment to OIG and suspend the repayment obligation until OIG resolves the matter.

Lookback Timeframe

CMS proposes that overpayments must be reported and returned if a person identifies the overpayment within 10 years of the date it was received. The Agency explains that it selected 10 years because this is the outer limit of the FCA statute of limitations. CMS believes the proposed 10-year lookback period gives providers and suppliers a reasonable period after which they can close their books and not have ongoing liability associated with an overpayment. The Agency states the length of the lookback period is long enough to sufficiently further CMS’s interest in ensuring that overpayments are returned to the Medicare Trust Funds in a timely manner. The Proposed Rule would also expand Medicare contractors’ authority to reopen claims up to 10 years after the initial determination or redetermination if an overpayment was voluntarily reported. Longstanding Medicare regulations generally limit reopenings to 4 years for good cause and anytime for correcting a clerical error, fraud or a similar fault. This is another area for which CMS expressly solicits comments.

Implications of the Proposed Rule

Providers and suppliers should carefully consider the Proposed Rule and how it impacts their existing operations. The Proposed Rule leaves considerable uncertainties with respect to identification of an overpayment, as well as reporting and repayment obligations. For example, how should the suggestion of a potential overpayment be acted upon, given the risks of FCA liability if a timely investigation is not undertaken? The Proposed Rule does not shed any light on what constitutes a “reasonable inquiry” or acting with “deliberate speed.” In addition, if information suggesting an overpayment exists, would this automatically require an investigation going back 10 years regardless of the time period implicated? And is it fair to conclude that the 60-day clock to report and repay the overpayment amount begins at the conclusion of an investigation? Suppose a provider identifies a potential overpayment related to a billing issue and promptly performs a probe audit of ten sample charts to determine if there is, in fact, an issue. If the probe sample is inconclusive, requiring a larger sample, is there an obligation to report the potential issue to CMS at that juncture? Or should the entire amount be repaid after a full investigation has been completed? These uncertainties also are compounded by the burdens of a 10-year lookback, both with respect to record-keeping (in light of shorter statutes of limitation for record retention for some businesses) and the scope of investigations requiring the examination of records spanning a 10-year period. The 10-year lookback and reopening period may also significantly increase the risks associated with sales or purchases of Medicare providers and suppliers.

In light of the potential FCA exposure imposed by the Act, providers and suppliers must ensure their compliance programs have sufficient safeguards to address the new requirements. Moreover, although the Proposed Rule has provisions to immunize completely innocent providers and suppliers, except in the “most extraordinary circumstances,” the “actual knowledge” standard set forth in the Proposed Rule creates potential liability. For providers and suppliers who have some indication that there is a downstream kickback for a submitted claim, there may be difficulties with determining whether potential kickbacks are reportable, as they have no avenue to investigate a potential kickback resulting from actions by a physician and/or vendor/ manufacturer. The suggestion that a provider or supplier would have to report a third-party kickback arrangement upon discovery to avoid FCA liability, and the idea that CMS could require an innocent provider or supplier to make a repayment for an overpayment that is completely out of its control, are arguably beyond the scope of Section 6402(a) of the ACA.

* * *

The Proposed Rule provides an opportunity to comment on its impact, including the definition of an identified overpayment and implementation of a 10-year lookback period. Providers and suppliers should use the notice and comment period to influence a more tempered process that would mitigate the record-keeping and compliance burdens foreshadowed by the Proposed Rule.