Further Analysis of 60-day Medicare Overpayment Rule Reveals Emphasis on Proper Compliance Plans

Last week, we highlighted that the Centers for Medicare and Medicaid Services (“CMS) released a long-awaited final rule regarding its interpretation of the statutory obligation of Medicare Part A and Part B providers to return any overpayments they receive from the program within 60 days after such an overpayment is “identified.  The final rule is significant because violations of this statutory obligation exposes providers to liability under the federal False Claims Act (“FCA), and there had been confusion over what constitutes “identification of an overpayment.  After being afforded an opportunity to more fully review the final rule, we now offer some extended comments on the rule and also discuss some changes from the proposed rule released in 2012.

The 60 day overpayment return requirement, which was introduced as part of the Affordable Care Act (“ACA) in 2010, requires any healthcare provider, supplier, managed care organization, or prescription drug plan sponsor who has received an “overpayment from the Medicare or Medicaid programs to report the reason for the overpayment to the appropriate authority and return the overpayment. 42 U.S.C § 1320a-7k(d)(1).  Overpayments are defined simply as any Medicare or Medicaid funds received by provider or supplier that such entity, “after applicable reconciliation, is not entitled to receive under those programs. 42 U.S.C § 1320a-7k(d)(4)(B). The statute also provides that “[a]n overpayment must be reported and returned the later of “(A)  the date which is 60 days after the date on which the overpayment was identified; or (B)  the date any corresponding cost report is due [for those providers which are reimbursed pursuant to interim cost reports].  42 U.S.C § 1320a-7k(d)(2) (emphasis supplied).  The knowing concealment or improper avoidance of the obligation to return Medicare overpayments under this statute violates the FCA, which exposes providers to per claim penalties and treble damages.  See 42 U.S.C § 1320a-7k(d)(3); 31 U.S.C. § 3729(a)(1)(G).

However, the neither the ACA nor any existing statute or regulation defined the term “identified for purposes of Medicare or Medicaid overpayments.  CMS had released the proposed rule defining the term nearly four years earlier on February 16, 2012.  See 77 FR 9179.  This final rule only applies to Medicare Part A and Part B providers.  CMS had previously issued a final rule for Part C and Part D providers.  See 79 FR 29844.  There has yet to be a rule issued which applies to overpayments to the Medicaid program, but as discussed below, this rule will likely inform, at least to some extent, the federal view on Medicaid overpayments in the False Claims Act context. The Part A and Part B final rule was issued after CMS received nearly 200 timely responses to the proposed rule, and contains some significant changes, which take effect on March 13, 2016.

The most important change in the final rule is an amended standard for when a Medicare overpayment is “identified.  According to the final rule:

A person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.

See 81 FR 7683 (42 C.F.R. § 401.305(a)(2) (eff. March 13, 2016).

The concept of “reasonable diligence is new to the final rule.  The proposed rule set the moment of identification of an overpayment at the moment the person has “actual knowledge of, or acts in reckless disregard or deliberate ignorance of, the existence of the overpayment. See 77 FR 9187.  Those terms in the proposed rule were pulled from the definition of “knowing and “knowingly that appear in the ACA and the FCA, but the final rule does not seek to apply or interpret those terms in the amended identification standard.

The term “reasonable diligence is not defined in the regulations promulgated by the final rule, but the explanation accompanying the final rule explicitly states that reasonable diligence involves both “proactive and “reactive compliance oversight:

“Reasonable diligence includes both proactive compliance activities conducted in good faith by qualified individuals to monitor for the receipt of overpayments and investigations conducted in good faith and in a timely manner by qualified individuals in response to obtaining credible information of a potential overpayment.  The regulation uses a single term – reasonable diligence – to cover both proactive compliance activities to monitor claims and reactive investigative activities undertaken in response to receiving credible information about a potential overpayment.

81 FR 7661.  This is clearly a critical function of the final rule, as CMS further underscored the obligation of providers to have proper compliance:

We believe that undertaking no or minimal compliance activities to monitor the accuracy and appropriateness of a provider or supplier’s Medicare claims would expose a provider or supplier to liability under the identified standard articulated in this rule based on the failure to exercise reasonable diligence if the provider or supplier received an overpayment.

81 FR 7661.  The final rule also explained that the obligation of using reasonable diligence to determine whether an overpayment occurred commences once a provider “obtains credible information concerning potential overpayment.  81 FR 7661

A particularly important aspect of the final rule announces that a provider’s reasonable diligence, or lack thereof, affects when the 60-day period to report and return starts.  If the provider exercises reasonable diligence to determine whether there have been overpayments and to quantify those overpayments, the 60-day period only begins once that reasonable diligence is completed.  However, if the provider “failed to conduct reasonable diligence, the 60-day period begins immediately once the provider “received credible information of a potential overpayment, if in fact the provider received such an overpayment.  81 FR 7661.  Therefore, the final rule allows a provider who properly executes a suitable compliance plan to avail themselves of an opportunity to ascertain and quantify overpayments before the 60-day report and return period even commences.

The focus of CMS on reasonable diligence through compliance plans should be treated by providers as a strong message to not only review their compliance plans and policies for adequacy under applicable rules and regulations, but to test how well these policies work in monitoring claims to prevent and detect overpayments in the first place.  The tolling of the 60-day period for reasonable diligence investigations will undoubtedly serve as an important tool in helping providers satisfy their compliance-related responsibilities and avoid liability under the False Claims Act.  It should be noted, however, that the final rule essentially caps the maximum time for a reasonable diligence investigation at six months, where the previous rule suggested a vague standard of conducting the inquiry “with all deliberate speed.  See 81 FR 7662; 79 FR 9182.  Although this time frame is not included in the new regulations, CMS did note in the explanation of the final rule that, except in “extraordinary circumstances such as “unusually complex investigations involving Stark Law violations, natural disasters, or states of emergency, six months is an appropriate amount of time because overpayment investigations must be prioritized by providers.  81 FR 7662.

It should be noted at his this point that even though there no rulemaking for the 60 day rule as applied to Medicaid at this time, we believe that the Medicare rule informs, at least to some extent, the federal view on Medicaid overpayments in the False Claims Act context. This was demonstrated in the recent case of Kane ex rel. United States v Healthfirst, Inc., where the federal government argued the same standard for “identification in connection with alleged Medicaid program overpayments, and succeeded in repelling a motion to dismiss by the defendants in that case. See 2015 US Dist LEXIS 101778, at * 27, 49 (S.D.N.Y. Aug. 3, 2015) (“an entity has identified an overpayment when it has determined, or should have determined through the exercise of reasonable diligence, that it has received an overpayment to identify (internal quotations omitted)). The same standard also applies to overpayments in the Medicare Part C and Part D programs. See 42 C.F.R. §§ 422.326(c), 423.360(c).

The final rule also corrects an omission in the proposed rule by clarifying that the quantification of an overpayment is a necessary element of identifying the overpayment.  81 FR 7661.  Thus the 60-day period would only be triggered once a reasonable diligence investigation not only established an overpayment, but quantified that overpayment. In most instances, the quantification of the overpayment(s) should not be a difficult task. However, in other situations, due to the sheer number of claims that must be reviewed, this aspect of the self-disclosure can be the most time consuming one.  The final rule also confirms that valid statistical sampling and extrapolation are valid methods to calculate overpayments, if they are properly explained in the report.  81 FR 7662; 42 CFR § 401.305(d) (March 13, 2016).

Some of the other important elements of the final rule include a limitation of the “lookback period the provider must examine to determine how far back in time the overpayments extend.  The final rule now requires that providers must return overpayments which occur within six years of the date the overpayment occurred.  81 FR 7671; 42 CFR § 401.305(f).  This is a departure from the proposed rule’s 10 year lookback period, which corresponds to the statute of limitations for certain False Claims Act cases.  Participants in the CMS Voluntary Self-Referral Disclosure Protocol (“SRDP), which is used to report violations of the Stark Law, prior to the effective date of the final rule, will only be subject to a four year lookback period under current provisions of that protocol.  81 FR 7673.  Going forward SRDP overpayments will be subject to the six year period.

The final rule also prevents providers from using claimed underpayments from Medicare to offset any overpayment liability. CMS notes that providers can address underpayments separately by requesting reopenings under 42 CFR § 405.980(c).  See 81 FR 7658.  The final rule also permits the use of extended repayment plans, but the provider must first meet CMS’s qualification requirements to be eligible, a strict standard that is not easily met.  See 42 CFR § 401.305(b)(2)(iii).  The deadline to toll the return of overpayments can also be suspended through participation in the SRDP or the US HHS OIG’s Self-Disclosure Protocol.  42 CFR § 401.305(b)(2).

Providers should also note that the final rule limits the “applicable reconciliation for potential overpayments to the reconciliation of cost reports.  The ACA provides that the obligation to report and return only accrues if the overpayment persists after “applicable reconciliation.  42 U.S.C § 1320a-7k(d)(4)(B).  The final rule clearly limits applicable reconciliation to “cost report reconciliation, where the provider receives cost-based payments from Medicare on an interim basis throughout the year and then reconciles those payments with its actual reimbursable costs when cost reports are due.  The applicable reconciliation occurs when that cost report is filed, with the exceptions of (1) Supplemental Security Income ratios used in the calculation of disproportionate share hospital payment adjustment; and (2) outlier payment reconciliation for inpatient rehabilitation facilities that receive additional payments for certain high-cost patients.  81 FR 7668; 42 CFR 401.305(c).

Ultimately, the final rule supplies important clarity regarding the obligations of Part A and Part B providers to return overpayments.  Critically, it also underscores the obligation of providers to have suitable compliance plans that not only properly react to information regarding potential overpayments, but that can appropriately monitor claims to prevent overpayments in the first place.

For further information about provider self-reporting obligations, please contact David R. Ross.  For more information regarding the release of this final rule, please contact David E. Nardolillo.

David R. Ross is a Shareholder of the firm. Prior to joining the firm, and under former Governors Pataki and Spitzer, Mr. Ross served as the Acting Medicaid Inspector General for New York State. Prior to his service at the OMIG, Mr. Ross held several positions at the New York State Office of Alcoholism and Substance Abuse Services (OASAS), including Acting General Counsel, Deputy Counsel, and Associate Counsel. Mr. Ross has an extensive practice in Medicaid and Medicare and handles many different forms of self-disclosures for clients.

David E. Nardolillo is an Associate with the firm.  His primary practice involves representing healthcare providers in a broad spectrum of litigation, including criminal, civil and administrative fraud and abuse investigations; professional discipline and regulatory enforcement matters; and Medicare, Medicaid and private insurer audits.