James I. Glasser
Publications

CMS Issues Long-Awaited Final Rule on Reporting and Returning Overpayments

February 18, 2016 Advisory

On February 12, 2016, the United States Department of Health and Human Services, Centers for Medicare & Medicaid Services ("CMS") issued the long-awaited Final Rule on Reporting and Returning Overpayments. The Final Rule:

1. Explains that an overpayment has been identified when the provider or supplier has, or should have, "through the exercise of reasonable diligence," determined that an overpayment has been received and quantified the amount of the overpayment.

2. Clarifies that an overpayment must be reported and returned if the overpayment is discovered within six years of the date that the overpayment was received.

3. Specifies that to report an overpayment, providers and suppliers must either use (a) an applicable claims adjustment, credit balance, self-reported refund, or other reporting process set forth by the applicable Medicare contractor, or (b) the OIG's Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol.

4. Provides that failure to comply could result in liability under the False Claims Act and Civil Monetary Penalties Law and exclusion from federal health care programs.

Following is a summary of the events leading to issuance of the Final Rule and a discussion of its significant provisions, including CMS guidance in the Preamble and response to comments.

The Long Road to the Final Rule

Since the enactment of the Affordable Care Act ("ACA") almost six years ago, health care providers have discussed and debated section 6402 of the Act, which created an express obligation to report and return overpayments. This provision requires that any provider, supplier, Medicaid managed care organization, Medicare Advantage organization or prescription drug plan sponsor that receives a Medicare or Medicaid overpayment must report and return the overpayment within 60 days of the date the overpayment is "identified," or the date any corresponding cost report is due. Given the complex health care regulatory landscape, the lack of clarity in this law made implementation frustrating and difficult. When does the 60-day timeframe begin to run? How far back must providers and suppliers look to identify overpayments? What mechanism or process should be used to report and return these overpayments?

In February 2012, CMS issued a Proposed Rule attempting to answer these questions through implementation of the ACA overpayment reporting and refund requirement. The Proposed Rule sparked considerable controversy, however, and also raised more questions than it answered about the sparse ACA provision. Nearly four years after issuing the Proposed Rule, CMS issued the Final Rule on February 12, 2016. The Final Rule, which takes effect on March 14, 2016, tempers several proposed provisions in the Proposed Rule and provides more reliable clarification on the obligation to report and return overpayments. While the ACA's mandate applies to any provider, supplier, Medicaid managed care organization, Medicare Advantage organization, or Part D sponsor organization, the Final Rule applies only to Medicare Part A and B providers and suppliers.

Significant Final Rule Provisions that Every Provider and Supplier Should Know

The Final Rule does answer many of the significant questions that have raised concerns over the last six years:

A. When Does the 60-Day Timeframe Begin?

The new regulations state that an overpayment is "identified" when the provider or supplier, has or should have, "through the exercise of reasonable diligence," determined that an overpayment has been received and quantified the amount of the overpayment. The many elements of this requirement are each explained further below:

1. Constructive Knowledge

CMS made clear that the legal obligation to report and return overpayments goes beyond actual knowledge to constructive knowledge; the obligation to report and return is triggered when the provider or supplier knows or should know "through the exercise of reasonable diligence" about the overpayment. CMS explained that it adopted this standard to avoid the "ostrich defense," where the obligation to report and return the overpayment is avoided by simply not taking any action to obtain actual knowledge of the overpayment. In this case, what you don't know can hurt you, if you fail to exercise reasonable diligence. CMS provides some examples, including the failure to investigate when there is a spike in Medicare revenue for no apparent reason or when a government auditor discovers a potential overpayment.

2. Compliance Programs

"Reasonable diligence" is not defined in the Final Rule, but CMS stated in response to comments on the Proposed Rule that it expects implementation of both "proactive compliance activities to monitor claims and reactive investigative activities undertaken in response to receiving credible information about a potential overpayment." In both cases, the activities are expected to be conducted in "good faith by qualified individuals . . . and in a timely manner." Compliance programs have long been standard in the health care industry, but in the preamble to this Final Rule, CMS explicitly states that "undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of . . . Medicare claims would expose a provider or supplier to liability . . . based on the failure to exercise reasonable diligence."

3. The Six Month Timeframe

More concretely, CMS further specified that the "reasonable diligence" standard means that providers and suppliers have "at most six months" to investigate the overpayment upon receipt of credible information about a potential overpayment, except in "extraordinary circumstances." This standard provides only a total of eight months to deal with an overpayment: six months to investigate and two months to report and return. CMS pointed out that "extraordinary circumstances" would include "unusually complex investigations" that the provider or supplier anticipates will require more than six months to investigate, such as investigations involving potential Stark Law violations. Other "extraordinary circumstances" include natural disasters or a state of emergency.

Note that this six month timeframe is available to allow for the exercise of reasonable diligence. If providers or suppliers fail to exercise reasonable diligence to identify the overpayment, then they are required to report and return the overpayment within 60 days. In other words, the 60-day time period begins either when reasonable diligence is completed and the overpayment is identified or on the very day that credible information of a potential overpayment is received, the provider or supplier failed to exercise reasonable diligence to look into the matter.

4. Quantifying the Overpayment

Perhaps most importantly, the regulation states that an overpayment is "identified" only when it is quantified. The health care industry has fretted over some interpretations of the ACA that construed the 60-day deadline as beginning when the provider or supplier is first put on notice that a potential overpayment may exist. As a practical matter, two months is generally not enough time to investigate and quantify an overpayment. Anxiety over this stringent interpretation worsened when the Southern District of New York released its decision in Kane v. Healthfirst, 2015 WL 4619686 (S.D.N.Y. Aug. 3, 2015). The court ruled that the 60-day clock is triggered "when a provider is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained." Yet, CMS has now definitively asserted that the overpayment is identified, and the 60-day deadline is triggered, only after the overpayment is quantified. As explained above, however, absent extraordinary circumstances, CMS expects that a provider or supplier will use reasonable diligence to complete the investigation and quantification of the overpayment within six months, leaving an additional 60 days to then report and return the overpayment.

CMS also offered the additional useful tips regarding quantifying overpayments:

  • There is no minimum threshold amount; overpayments of any size need to be reported and returned.
  • Overpayments are determined in accordance with the law in effect at the time that the claims were paid. Subsequent changes in law, regulation, guidance, or payment policy would not render a properly paid claim an overpayment.
  • Where a paid amount exceeds the appropriate payment amount to which a provider or supplier is entitled, the overpayment is the difference between the amount that was paid and the amount that should have been paid.
  • Quantification of the overpayment may be determined using statistical sampling, extrapolation methodologies, "and other methodologies as appropriate."
  • In cases where interim payments are made based on estimated costs, an overpayment is not deemed to exist until an applicable reconciliation has occurred.

5. Tolling

The requirement to return the overpayment within 60 days of identification is tolled while a submission via the OIG Self-Disclosure Protocol or CMS Voluntary Self-Referral Disclosure Protocol is pending, including during any settlement negotiations. However, self-disclosures made to the Department of Justice, Medicaid Fraud Control Unit, or any other governmental entity do not toll the 60-day deadline. This distinction may be an important factor for providers and suppliers to consider when determining where to disclose overpayments.

B. How Far Back Must Providers and Suppliers Look To Identify Overpayments?

In the 2012 Proposed Rule, CMS stated that overpayments must be reported and returned if the overpayment was identified within ten years of the date that the overpayment was received. CMS chose ten years as the look-back period because it is the outer limit of the False Claims Act's statute of limitations. Due to voluminous objections to this proposal, CMS changed the look-back period to six years in the Final Rule. According to CMS, providers and suppliers were concerned that establishing a ten year look-back period would require them to retain their medical records and claims data for ten years, or risk being accused of not conducting reasonable diligence to identify overpayments. Since most providers and suppliers already retain records and claims data for between six and seven years based on existing federal and state requirements, CMS concluded that six years was a reasonable look-back period that would not create a substantial additional burden.

Accordingly, when a provider or supplier receives credible information of a potential overpayment, it must exercise reasonable diligence to determine whether it has received such an overpayment at any time within the last six years. This obligation extends to Recovery Audit Contractor (RAC) findings, even though RAC auditors are only permitted to cover three years of claims. CMS takes the position that RAC audit findings, as well as other Medicare contractor and OIG audit findings, create a credible allegation of an overpayment and trigger an obligation for providers and suppliers to determine whether they have received overpayments as a result of these findings, going back 6 years, regardless of the scope of the actual audit.

The six year look-back period applies to providers and suppliers reporting and returning overpayments after March 14, 2016, the effective date of the Final Rule. Providers and suppliers that returned overpayments prior to the effective date will not be obligated to supplement their prior submissions if they did not use a six year look-back period so long as they made a good faith effort to comply with the ACA.

Additionally, CMS extended the six year look-back to the CMS Stark Self-Referral Disclosure Protocol ("SRDP"), which has generally been operating with a four year look-back period. CMS stated that submissions to the SRDP on or after March 14, 2016, the effective date of the Final Rule, are subject to the six year look-back period. However, since CMS is not yet authorized under the Paperwork Collection Act to collect financial analysis of overpayments using the six year look-back period, for now CMS instructed those utilizing the SRDP that they have no duty to provide financial information beyond the current four year-look back period. Until CMS issues notification of changes to the Protocol, financial information from the fifth and sixth years may be provided "voluntarily." CMS also suggested that overpayments from the fifth and sixth years may alternatively be reported and returned "through other means."

C. How Should Providers and Suppliers Report And Return These Overpayments?

In the Proposed Rule, CMS indicated that it wanted providers and suppliers to use a single self-reported overpayment refund process to report and return overpayments. CMS clarified in the Final Rule, however, that providers and suppliers may use the most applicable process set forth by the Medicare contractor, including claims adjustment, credit balance, self-reported refund process, or another appropriate process to report and return overpayments, including the OIG's Self-Disclosure Protocol or the CMS Voluntary Self-Referral Disclosure Protocol. In order to allow for variation between these different processes, no specific data is required to be reported. However, CMS expects providers and suppliers to include facts explaining how the overpayment was identified and describing corrective actions that have been implemented in response. Furthermore, CMS stated that those relying on statistical sampling should report how the overpayment amount was calculated. Providers and suppliers may also request a voluntary offset from the applicable Medicare contractor in lieu of submitting the total overpayment amount at once.

D. What Rules Apply to Medicaid Overpayments?

Medicaid overpayments are not covered by the Final Rule, and in some states, Medicaid providers may have to report and return overpayments in a different timeframe. For example, in Connecticut, Medicaid provider agreements require providers to "refund promptly (within 30 days of receipt) to DSS [Department of Social Services] or its fiscal agent any duplicate or erroneous payment received, including any duplication or erroneous payment received for prior years or pursuant to prior provider agreements." Providers and suppliers should check their Medicaid agreements and applicable state laws and regulations to determine if more stringent requirements apply.

E. What Penalties Can Be Imposed for Failure to Report and Return Overpayments Pursuant to the Final Rule?

Providers and suppliers that do not report and return overpayments in accordance with the Final Rule face potentially steep penalties, including liability under the False Claims Act and Civil Monetary Penalties Law, which could result in significant civil penalties (between $5,500 and $11,000 for each false claim), and treble the amount of the government's damages. A provider or supplier that fails to report and return overpayments may also face exclusion from Medicare and other federal health care programs in some circumstances.

Action Steps

In the almost six years since the ACA's enactment, there has seldom been a health care conference where the 60-day overpayment issue has not been discussed. CMS's proposed regulations in February 2012 and recent case law on this issue further ignited the flames of controversy surrounding this requirement. The Final Rule offers welcome clarifications, and providers and suppliers now must ensure that they are prepared to comply. Given the austere penalties for failing to report and return overpayments in accordance with the law, providers and suppliers should take compliance seriously.

Policies and procedures should be implemented to investigate, quantify, and report overpayments in accordance with the law. Reasonable diligence must be exercised to identify overpayments. Despite CMS's assurance that the Final Rule provides "bright line standards," given the fact-specific nature of these scenarios, questionable situations are bound to arise. Therefore, providers and suppliers must be vigilant on a number of fronts, including (1) conducting proactive audits of claims submitted to federal health care programs; (2) educating billers, coders and others involved in the claims process on their obligation to report billing issues to compliance staff; (3) investigating credible allegations of potential overpayments, such as compliance hotline calls, patient complaints, and internal as well as external audits; and (4) documenting responses to credible allegations of potential overpayments.

If you have questions about this advisory or want to learn more about the Health Care Compliance, Fraud and Abuse Practice Group, contact Maureen Weaver at [email protected] or Jody Erdfarb at [email protected].

Resources