CMS Finalizes Rules for Reporting and Returning Overpayments

Earlier this month, the Center for Medicare and Medicaid Services (CMS) finalized its long-awaited rules governing overpayments to providers and suppliers by Medicare Parts A and B. 

Under Section 6402 of the Affordable Care Act (ACA), healthcare providers and suppliers that have received an overpayment must "report and return the overpayment," and "notify in writing of the reason for the overpayment." The ACA specifies that the deadline to report and return overpayments is the later of 60 days after the date on which the overpayment was "identified" or the "date of any corresponding cost report is due." 42 U.S.C. §§ 1320a–7k(d)(2)(A)-(B). Congress, however, did not define what constitutes an "overpayment," and how such an overpayment is deemed to be "identified." The ACA also does not delineate the process for reporting and returning identified overpayments, and the look back period for returning overpayments.

There are serious consequences when a provider fails to report and return identified overpayments – improperly retained overpayments beyond the 60-days (or the date of the corresponding cost report) may trigger liability under both federal and state False Claims Act (FCA).  Section 6402 states that overpayments retained beyond the 60 days are "an obligation" under the FCA and a provider/supplier violates the FCA when it "knowingly conceals" or "knowingly and improperly avoids" returning of an overpayment that has ripened into an obligation. 42 U.S.C. §§ 1320a–7k(d)(2)-(3). Violations of the FCA can expose providers and suppliers to civil penalties and treble damages.

It is worth noting that the mere existence of an obligation is not sufficient to trigger FCA. The provider must either "knowingly conceal," or "knowingly and improperly avoid[]" repayment of its obligation to violate the FCA.   

CMS's Final Rule

The agency engaged in separate rulemaking processes for rules governing overpayments for Medicare Parts A and B, and Medicare Parts C and D. The final rules for Medicare Part C and D plans were finalized on May 23, 2014. 

On February 12, 2016, CMS issued its final rule that implements Section 6402(a) of the Affordable Care Act for Medicare Parts A and B. These final rules become effective on March 14, 2016.

Summary of Key Provisions of the Final Rule

Identification of Overpayments. A key issue for providers and suppliers is what it means to identify the existence of an overpayment, particularly in situations where significant internal investigation might be required to determine the existence or amount of an overpayment. The language of the final rule omits the language that the proposed rule had incorporated from the FCA regarding knowledge, and focuses on whether an overpayment could have been identified through the exercise of reasonable diligence:

A person has identified an overpayment when the person has, or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.

42 C.F.R. § 401.305(a)(2) (emphasis added).

In the proposed rule, a person identified an overpayment "if the person has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the existence of the overpayment."  See 77 Fed. Reg. 9179 (February 16, 2012). CMS had deliberately incorporated these FCA knowledge elements in order to give "providers and suppliers an incentive to exercise reasonable diligence to determine whether an overpayment exists." 

Yet, by incorporating an FCA standard, the proposed rule risked turning the overpayment provision into an automatic treble damage award under the FCA. In a major revision, the preamble of the final rule instead focuses on the goal of the statute, which is to put in place standards for ensuring that suspected overpayments are investigated and actual overpayments are returned. 

Employing this new standard of "reasonable diligence" in the final rule, CMS noted that the term is intended to cover both proactive compliance activities to monitor claims and investigative activities undertaken in response to receiving credible information about potential overpayments.  Failure to carry out proactive compliance activities could lead to liability, along with failure to investigate credible evidence of the existence of overpayments.

The final rule thus clarifies that the overpayment return requirements should not be conflated with standards of knowledge under the FCA, something that relators' counsel have increasingly tried to do by tacking on additional FCA counts solely based on the notion that the defendant commits another false claim when it fails to return amounts received for an alleged false claim within 60 days of first being informed by relator of the existence of such a claim (or by the due date of the corresponding cost report). The first published decision to analyze this issue prior to the issuance of the final rules rejected the contention that an improperly retained overpayment is automatically a violation of the FCA. See Kane ex rel. U.S. v. Healthfirst, Inc., No. 11 CIV. 2325 ER, 2015 WL 4619686, at *13 (S.D.N.Y. Aug. 3, 2015) ( "[M]ere existence of an ‘obligation' is not sufficient and does not establish a violation [of the FCA]."). Issuance of the final rule should go a long way to settling this issue.    

Six Months as Benchmark for Timely Internal Investigations After Receipt of Credible Information. The Preamble to the final rule clarifies the standard for reasonable diligence. The agency refused to adopt the "reasonable" time period to investigate as the applicable standard for reasonable diligence. Instead, the final rule explains that reasonable diligence can be demonstrated through timely, good faith investigation of credible information, which is "at most" six months from receipt of the credible information. The final rule provides some flexibility on this issue, and providers and suppliers may be permitted additional time in "extraordinary circumstances." CMS specifically notes that unusually complex investigations involving violations of the Stark Law may qualify as "extraordinary circumstances" justifying an internal investigation longer than 6 months. The 60-day time period begins when either the reasonable diligence time period is set to expire or, alternatively, if the person failed to conduct reasonable diligence and the person in fact received an overpayment, on the day the person received the credible information.

Tolling the 60-Day Deadline to Report and Return Identified Overpayments. The ACA specifies 60-days as the deadline to report and return "identified" overpayments.  This reporting obligation can be satisfied if the provider utilizes the Office of Inspector General's Self-Disclosure Protocol (SDP), or the CMS Voluntary Self-Referral Disclosure Protocol (SRDP). When the provider discloses to the OIG under the SDP, or to the CMS under SRDP, the 60-day clock is tolled while the provider is accepted into the SDP/SRDP as the parties are actively negotiating a settlement. If a settlement is not reached, the preamble to the rule suggests that the provider has the balance of the 60-day time period to report and return any identified overpayment to the contractor.

Similarly, the time period for reporting is also suspended when a provider requests an extended repayment schedule. The final rule does not provide guidance on disclosure or reporting of the overpayment to other governmental agencies, including the Department of Justice. Arguably, disclosures to other agencies do not toll the 60-day deadline to report and return identified overpayments. 

Six-Year Look Back Period. The final rule reduced the look back period from 10 years in the proposed rule to six years. Thus, overpayments must be reported and returned if the person "identifies" the overpayment within six years from the date the overpayment was received. CMS states in commentary to the final rule that "[c]reating this limitation for how far back a provider or supplier must look when identifying an overpayment is necessary in order to avoid imposing unreasonable additional burden or cost on providers and suppliers." This is obviously a welcome and necessary change, as it would have imposed an impossible burden on many health care providers to reconstruct documentation and supporting information related to potential overpayments going back 10 years. CMS also clarified that the six-year lookback period only applies to overpayments (not underpayments) identified by providers and suppliers; it does not change the 4 year time period for Medicare Contractors to reopen claims. 

Duty to Revise Past Cost Reports as a Result of MAC Audit. Providers should be aware that under the final rule, they will have a duty to investigate and revise past cost reports within the six-year look back period based upon the results of a MAC audit of one cost report year. CMS clarified that if a provider is notified by a MAC of an improper cost report payment in one cost report year, the provider has received credible information of a potential overpayment and they must conduct reasonable diligence on other cost reports within the six-year look back period to determine if they received additional overpayments.

Look Back Period on Overpayments Disclosed Under SPD or SRDP. After the effective date of the final rule, the six year look back period will apply to all overpayments. Stark Law overpayments reported to CMS through the SRDP prior to the effective date of the final rule will remain governed by the 4 year look back period. This includes both overpayments reported and returned as well as those reported and still in the process of being reviewed through the SRDP. Providers and suppliers reporting overpayments to the SRDP on or after the effective date of the final rule are subject to the 6 year look back period specified in the final rule. 

RAC Audits and OIG Audits. Similarly, under the final rule, providers and suppliers will be obligated to go beyond the three-year period covered in a Recovery Audit Contractor (RAC) audit. The final rule clarifies that when a provider or supplier receives credible information of a potential overpayment, they need to conduct reasonable diligence to determine whether they received an overpayment. CMS has stated that RAC and OIG audit findings are credible information of at least a potential overpayment and as such, providers and suppliers are responsible for reviewing the audit findings to determine if additional overpayments may have been received during the look back period.

Final Rule is Not Retroactive. The final rule is not retroactive. Providers and suppliers that reported and/or returned overpayments prior to the effective date of the final rule and that made good faith efforts to comply with the applicable provisions of the ACA will not be expected to comply with each provision of the final rule. CMS stated that for the time period between March 23, 2010 (the date the ACA was enacted) and the effective date of the final rule "providers and suppliers may rely on their good-faith and reasonable interpretation of section 1128J(d) of the Act." However, providers and suppliers reporting and returning overpayments on or after the effective date of the final rule (even overpayments received prior to the final rules effective date) will be required to comply with all of the new requirements.

Process for Reporting and Returning Identified Overpayments. The final rule removes previously published data elements that were required to be included in the overpayment disclosure report.  Rather, until CMS makes available a uniform reporting form, providers and suppliers must utilize the existing voluntary refund process set forth by the applicable Medicare contractor. The preamble to the rule explains that the 13 data element list is omitted from the final rule to avoid confusion between compliance with regulations, and compliance with the applicable refund process. However, if a provider calculates the overpayment amount using a statistical sampling, the sampling and extrapolation methodology must be described in the overpayment report. 

In addition, the final rule makes clear that providers and suppliers may use claim adjustment, credit balance, self-reported refund process, or other appropriate process to return an identified overpayment. 

No Minimum Monetary Threshold. Citing potential for abuse, CMS explicitly refused to adopt a minimum monetary threshold for reporting and returning overpayments. Thus, the final rule appears to require providers to report and return overpayments in any amount.

Overpayments Caused By Contractor's Error Not Reported. CMS's responses to comments also clarify that if a contractor identifies a payment error that is due to the contractor's error, and adjusts the claim accordingly, the provider need not report the overpayment separately. 

Applicable Reconciliation. Applicable to providers who file cost reports, the final rule leaves unchanged the definition of "applicable reconciliation" which remains limited to cost report reconciliation. CMS acknowledged that in some instances, it makes interim payments to a provider through the cost reporting year and providers reconcile those payments with covered and reimbursable costs at the time the cost report is due. These payments will not constitute an overpayment until after "applicable reconciliation" which occurs when a cost report is filed with two exceptions; (i) reconciliations related to Supplemental Security Income (SSI) ratios used in the calculation of disproportionate share hospital (DSH) payment adjustment; and (ii) outlier reconciliation, which is performed at the time the cost report is settled. "The cost report must be filed within 5 months of the end of the provider's fiscal year end, which allows the provider time to reconcile payments and costs and identify any funds to which the provider is not entitled. This overpayment should be returned at the time the cost report is filed."

PIP Providers. CMS also clarified its policy for periodic interim payment (PIP) providers. Overpayments as a result of PIP are to be reported and returned at the time the initial cost report is due. There is no applicable reconciliation until the PIP payments are dealt with in the cost report process. However, CMS noted that if a provider is aware that their PIP payment may not be accurate, they should continue with normal business practices and inform its MAC of the issue.