CMS Issues Final 60-Day Rule Implementing ACA’s Overpayment Repayment Provision

On February 12, 2016, the Centers for Medicare and Medicaid Services (CMS) issued the long awaited final rule for reporting and returning Medicare overpayments. This final regulation builds upon CMS’s proposed rule, published on February 16, 2012, and implements Section 6402(a) of the Affordable Care Act. While the final rule provides some relief to certain provisions in the proposed regulation issued four years ago, it also imposes significant burdens on the provider and supplier community, and leaves some important questions unanswered. It should be noted, however, that despite the delay in rulemaking suppliers and providers have been subject to the law since it was enacted in 2010.

Overview of the Regulation

The regulation, the substance of which is found at 42 C.F.R. §§ 401.301 - 401.305, is relatively short and straightforward. Notably, the final rule applies only to overpayments arising from Medicare Parts A and B.¹ Simply stated, any Medicare provider or supplier (referred to in the regulation as a “person”) who has identified an overpayment must report and return the overpayment within 60 days after the date on which the overpayment was identified, or the date any corresponding cost report was due. For purposes of the rule, an overpayment is any Medicare funds that a provider or supplier receives in excess of the amount it should have received for actual services rendered.

In a meaningful departure from the proposed rule, the final regulation revises the definition of the term “identified” to include quantification of the overpayment. As discussed below, under the final rule, a person is considered to have identified an overpayment when they have, or should have through the exercise of reasonable diligence: (1) determined that the person has received an overpayment and (2) quantified the amount of the overpayment.

In another significant change from the proposed regulation, CMS reduced the “look back period” – that is, how far back in time one must go to identify and repay an overpayment – from 10 years to six years. The regulation directs that a person may report and repay an overpayment within the prescribed timeframe through any reporting and repayment process made available by the applicable Medicare Contractor. However, the deadline to return an overpayment may be suspended under a limited set of circumstances, such as if a provider or supplier submits (and either the OIG or CMS acknowledges) a disclosure submission via the OIG’s Self-Disclosure Protocol, or CMS’s Voluntary Self-Referral Protocol. Extended repayment terms may also be negotiated.

Despite its modest 4 1/2 page length, the regulation is preceded by a 200-page preamble. The preamble discussion provides insights into CMS’s thinking and enforcement strategy. This Advisory highlights a number of key CMS considerations, and highlights a number of issues that remain unresolved.

When is an Overpayment Identified?

In perhaps the most significant discussion in the preamble, the final rule revised the definition of the term “identified.” As noted above, the final rule provides that “a person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.”

Providers and Suppliers Must Conduct Reasonable Diligence in Response to Obtaining Credible Information of a Potential Overpayment

CMS explains that “reasonable diligence” includes “both proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments, and investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment.” Thus, it appears that CMS is sending a not-so-subtle signal to the provider community that failure to have an effective compliance program in place could support a finding that a provider had failed to take “reasonable diligence” to identify potential overpayments.

Indeed, CMS states specifically: “we believe that undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of a provider or supplier’s Medicare claims would expose a provider or supplier to liability under the identified standard articulated in this rule based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment.” Thus, despite the fact that CMS has yet to publish regulations implementing the requirement that providers enrolled in Medicare have an effective compliance program in place, the failure to do so clearly puts providers and suppliers at greater risk if they fail to identify, report, and return an overpayment.

What Constitutes Credible Information of an Overpayment?

CMS states that “credible information” of an overpayment includes “information that supports a reasonable belief that an overpayment may have been received.” For example, CMS believes that a single overpaid claim constitutes sufficient “credible information” to trigger a further inquiry into whether there are additional overpayments on the same issue. And, if so, each related overpaid claim should be reported and repaid as a bundle. However, for purposes of triggering the rule’s duty to investigate, whether specific information qualifies as credible is a factual determination. For example, “receiving repeated hotline complaints about the same or similar issues may lead a reasonable person to conclude that they have received credible information that obligates conducting reasonable diligence. However, one hotline complaint may be detailed enough to lead a reasonable person to the same conclusion.”

Providers and Suppliers Under No Obligation to Repay Overpayments Resulting from 3rd Party Kickback Schemes

In the proposed rule CMS recognized that, in many instances, providers and suppliers may submit claims that arise from a third-party kickback arrangement in which they play no role and are unaware of its existence. Since compliance with the federal Anti-Kickback Statute is a condition of payment, claims resulting from a violation of this law are not payable and are considered overpayments. Addressing this concern, CMS previously stated that “providers and suppliers who are not a party to a kickback arrangement are unlikely in most instances to have ‘identified’ the overpayment that has resulted from the kickback arrangement” and, therefore, would have no duty to report or repay it. Where, however, a provider or supplier has sufficient knowledge of the arrangement to have identified the resulting overpayment, CMS expects the provider or supplier to report the overpayment pursuant to the 60-day rule. Where this is the case, CMS expects that – absent extraordinary circumstances – only the parties to the kickback scheme would be liable for the overpayment that was received by the innocent provider or supplier.

How Long Before an Overpayment Must be Reported and Returned?

The final rule provides guidance relating to the initiation of the 60-day time period. According to CMS, the 60-day time period begins when either the reasonable diligence is completed, or on the day the person received credible information of the potential overpayment, but the person failed to conduct reasonable diligence. Importantly, the final rule clarifies that reasonable diligence includes determining whether an overpayment has been received and quantifying the amount of the overpayment. Thus, quantifying the amount of the overpayment is considered to be part of the reasonable diligence investigation, which must be completed before the 60-day reporting period begins. However, CMS also makes clear that the need to perform a reasonable diligence investigation has some limits. Specifically, CMS sets six months as the benchmark for timely investigation, thereby providing a total of eight months for a provider to follow up on a credible allegation of an overpayment, quantify such overpayment (if it is confirmed), and report and return that overpayment.

Interestingly, CMS’s position seems to respond to observations of the federal district court in the Southern District of New York in the case of U. S. v. Continuum Health Partners, Inc., in which Continuum was accused of improperly retaining Medicaid overpayments for approximately two years after receiving notice of the potential overpayments from an employee. Despite the fact that reporting and repayment of the overpayments were eventually made, the court noted that it would be very difficult to justify a two-year timeframe to investigate and repay an overpayment. At the same time, however, the Court noted that 60 days may not provide adequate time for a provider to respond to information about a potential overpayment, and suggested that “prosecutorial discretion would counsel against the institution of enforcement actions aimed at well-intentioned healthcare providers working with reasonable haste to address erroneous overpayments.” It appears that the six-month period to conduct reasonable diligence is designed to address this concern.

How are Overpayments Quantified?

CMS acknowledged concerns that quantifying overpayments may impose significant burdens on providers, by accepting statistical sampling and extrapolation as appropriate components of a provider’s reasonable diligence and confirming that it would be an appropriate method to calculate an overpayment. At the same time, in discussing reporting obligations, CMS makes clear that a provider would be expected to provide the details about the extrapolation methodology used in obtaining the overpayment amount. Thus, suppliers and providers should be sure to document the methodology employed to calculate any overpayments as well as its investigative process.

How Do Government Audits Impact the 60-Day Rule?

The preamble also addresses the impact of a contractor or government audit. CMS specifically noted that any audit by a contractor, whether a MAC, RAC, or the OIG, would qualify as credible information of a potential overpayment and would trigger the provider’s obligation under the law to initiate diligent investigation and return any overpayment. On this point, commenters noted that CMS is prohibited by statute from recouping any overpayment until the second level of administrative appeal has been exhausted. The commenters further suggested that no repayment obligation should exist until after the entire appeal process has concluded and – presumably under the theory that an overpayment cannot appropriately have been “identified” until the conclusion of the appeals process.

CMS answers the commenters’ questions obliquely, saying only that the “responsibility” to repay overpayments “. . . exists independent of the appeals process for contractor’s overpayment determinations.” Thus, despite the fact that CMS may not legally recoup an overpayment during the pendency of the first two levels of the appeals process, it nevertheless believes that providers or suppliers must repay such overpayments during this period, based on audit findings that the provider or supplier is challenging as incorrect. Certainly this position frustrates Congress’s directive to delay required repayment until after the second level of the appeals process has been completed.

Further, in this same section of the preamble, CMS acknowledges that there will be situations where the conduct that served as the basis for the contractor identified overpayment may be “nearly identical” to conduct in “some additional time period” not covered by the contractor audit. In these cases, CMS notes that the provider may reasonably assess that it is “premature to initiate a reasonably diligent investigation into the nearly identical conduct,” suggesting that the provider need not undertake a diligent investigation into the “nearly identical” conduct until after the administrative appeals process has fully concluded. In other words, a provider who files an administrative appeal of audit findings is relieved of the obligation to undertake an investigation relating to nearly identical conduct that was outside the scope of the audit, yet that same administrative appeal provides no relief in connection with the claims that are the subject of the audit.

What is the “Look Back Period”?

As noted above, CMS retreated from its position in the proposed rulemaking to impose a 10-year look back, and, instead, reduced the period to six years. Despite retreating on the proposed 10-year look back, a six-year requirement continues to impose an enormous burden on providers. Historically, Medicare contractors generally limited their look back to three years, consistent with the reopening regulation.

Are Underpayments and Overpayments Treated the Same?

The regulation preamble presented a number of commenters who suggested that when reporting and repaying overpayments, providers and suppliers should be able to offset any underpayments identified against any identified overpayments; other commenters suggested that the look back period for overpaid claims should be the same as the look back period for underpaid claims. Unfortunately, CMS declined to accept either proposal, stating that underpayments are outside the scope of the rulemaking. Instead, CMS suggested that providers and suppliers could seek to address underpayments by requesting reopenings.

Unfortunately, seeking a reopening to address an underpayment may not present a viable solution. First, reopenings are not automatically granted; they are at the discretion of the contractor, and according to CMS, there is no appeal if a contractor declines to reopen a claim. Further, any reopening beyond one year must be based on a finding of new and material evidence, and it is unclear what standard a contractor would apply to meet that burden. Therefore, a provider with offsetting overpayments and underpayments may be forced to repay the overpayment with no remedy to recover the underpayment.

What Impact Does the Rule have on HHS’ Self Disclosure Protocols?

With respect to the six-year look back period, CMS acknowledged that it creates some inconsistency with the current voluntary Self-Referral Disclosure Protocol (SRPD), which has operated with a four-year look back period. CMS also acknowledged that while providers and suppliers reporting overpayments to the SRDP on or after the effective date of the final rule are subject to the six-year look back period, because of limitations under the Paperwork Reduction Act that allow CMS to collect the financial analysis of overpayments that occurred only during the four-year period, until CMS obtains authorization from OMB, CMS may not mandate that providers and suppliers provide information relating to the fifth and sixth years or that they return overpayments for that period. Instead, CMS suggests that providers and suppliers submitting to the SRPD may voluntarily provide financial information for the fifth and sixth years.

Conclusion

Issuance of the final rule implementing the 60-day requirement to return overpayments will undoubtedly serve to trigger new whistleblower False Claims Act cases. The regulation provides guidance to avoid such liability, by imposing a clear duty on providers and suppliers to take appropriate action when receiving credible evidence of an overpayment. Nevertheless, if history is any guide, providers and suppliers will find themselves facing allegations of False Claims Act liability for the failure to fulfill their obligations to make timely repayments of overpayments.