On February 16, 2012, the Centers for Medicare & Medicaid Services (“CMS”) published in the Federal Register a proposed rule (the “Proposed Rule”) regarding Medicare providers’ and suppliers’ obligation to timely report and return overpayments.[1] The Patient Protection and Affordable Care Act, as amended by the Health Care Education Reconciliation Act of 2010 (“PPACA”), contains several provisions intended to combat fraud, waste, and abuse in the healthcare industry, particularly with respect to government programs. One such provision requires a person who has received an overpayment[2] to “report and return the overpayment to the Secretary, the State, an intermediary, a carrier, or a contractor, as appropriate, at the correct address” and to provide written notice to the entity to which the overpayment was returned of the reason for the overpayment.[3] PPACA states that the overpayment must be reported and returned by the later of (1) 60 days after the date on which the overpayment was identified[4] or (2) the date any corresponding cost report is due, if applicable.[5] The Proposed Rule outlines CMS’ plan to implement this law by establishing a new subpart D to 42 C.F.R. Part 401.
Entities Subject to the Proposed Rule
Although PPACA’s requirement to timely report and return overpayments applies broadly to all providers, suppliers, Medicaid managed care organizations (“Medicaid MCOs”), Medicare Advantage organizations (“MAOs”), and prescription drug plan sponsors (“PDPs”), CMS states that the Proposed Rule will apply only to Medicare Part A and Part B providers and suppliers (collectively referred to as “providers”). However, CMS warns that Medicaid MCOs, MAOs, and PDPs are still subject to the requirement to timely report and return overpayments, even if CMS has not yet promulgated regulations.[6]
Mechanics of the Proposed Rule
Pursuant to the Proposed Rule, CMS would require providers to use the existing voluntary refund process (which CMS would rename the “self-reported overpayment refund process”) for reporting and returning overpayments. Under this process, a provider uses a form available on its Medicare contractor’s website that generally requests the following information:
- Health insurance claim number (HICN) for the affected claim(s) and Medicare claim control number, as appropriate;
- Provider’s name, Medicare number, NPI, and tax identification number;
- Date of service;
- How the error was discovered;
- Description of the corrective action plan implemented to avoid a recurrence;
- Reason for the refund;
- Whether the provider has a corporate integrity agreement (“CIA”) with the Office of Inspector General (“OIG”) or is under the OIG Self-Disclosure Protocol;
- Timeframe and total amount of refund for the time period during which the problem existed;
- Refund in the amount of the overpayment; and
- Description of the statistically valid methodology used to determine the overpayment (if a statistical sample was used to determine the amount).[7]
Recognizing that the various Medicare contractors have different forms, CMS indicates its intent eventually to develop a uniform overpayment reporting form for use by all Medicare contractors.
Timeline for Return of Overpayment
As stated above, PPACA requires that an overpayment be reported and returned by the later of (1) 60 days after the date on which the overpayment was identified or (2) the date any corresponding cost report is due, if applicable. In the Proposed Rule, CMS clarifies that if an overpayment is “claims related,” the provider would be required to report and return the overpayment within 60 days of identification. CMS would allow providers to rely on the cost report deadline only if the overpayment ordinarily would be reconciled on the cost report.[8]
When is an Overpayment “Identified” and How Far Back Does a Provider Look?
CMS also clarifies that a provider “has identified an overpayment if the [provider] has actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment.”[9] CMS further explains:
In some cases, a provider or supplier may receive information concerning a potential overpayment that creates an obligation to make a reasonable inquiry to determine whether an overpayment exists. If the reasonable inquiry reveals an overpayment, the provider then has 60 days to report and return the overpayment. On the other hand, failure to make a reasonable inquiry, including failure to conduct such inquiry with all deliberate speed after obtaining the information, could result in the provider knowingly retaining an overpayment because it acted in reckless disregard or deliberate ignorance of whether it received such an overpayment. For example, a provider that receives an anonymous compliance hotline telephone complaint about a potential overpayment has incurred an obligation to timely investigate that matter. If the provider diligently conducts the investigation, and reports and returns any resulting overpayments within the 60-day reporting and repayment period, then the provider would have satisfied its obligations under the proposed rule. If, however, the provider fails to make any reasonable inquiry into the complaint, the provider may be found to have acted in reckless disregard or deliberate ignorance of any overpayment.[10]
CMS offers a non-exhaustive list of examples in which it would assert that an overpayment has been identified, including when a provider “is informed by a government agency of an audit that discovered a potential overpayment, and the [provider] fails to make a reasonable inquiry” or when a provider “experiences a significant increase in Medicare revenue and there is no apparent reason” but the provider fails to make a reasonable inquiry into whether an overpayment exists.[11] If CMS’ proposal is finalized, providers likely will struggle with uncertainty over when a reasonable inquiry is required and what CMS would consider to amount to a reasonable inquiry.
Further, providers may also struggle in many instances determining exactly when an overpayment has been identified and, therefore, when the 60-day clock for reporting and returning begins. In the commentary cited above, CMS states that “[i]f the reasonable inquiry reveals an overpayment, the provider then has 60 days to report and return the overpayment.”[12] This appears to indicate that the 60-day clock won’t begin to run until after a reasonable inquiry has been completed. However, reasonable inquiry into whether an overpayment exists may require a provider to use various internal and external review, audit, and sampling mechanisms in order to establish a clear understanding of whether an overpayment exists and to calculate the amount of the overpayment. In many cases, it may not be clear at what point in these processes that the overpayment has been “identified,” and the Proposed Rule does not provide clarification or guidance on this question.
Additionally, the reasonable inquiry process may be complicated by the Proposed Rule’s establishment of a 10-year look-back period, which coincides with the outer limit of the False Claims Act statute of limitations.[13] This is significantly longer than CMS’ current administrative recoupment or reopening rules, and could greatly amplify the time, cost, and complexity involved in making a reasonable inquiry of the existence and amount of any overpayment—especially given the way that coding, billing, and reimbursement rules tend to change over time.
Parallel Self-Reporting Tracks
Because there is some overlap among the obligations to report and return overpayments under this PPACA provision, the existing Medicare Self-Referral Disclosure Protocol, and the OIG Self-Disclosure Protocol, CMS has requested comments on approaches that would allow providers to avoid making multiple reports of identified overpayments.[14] CMS also proposes to suspend the obligation to return overpayments when the OIG acknowledges receipt of a submission pursuant to the OIG Self-Disclosure Protocol. Further, once a provider notifies OIG of the identified overpayment through the Self-Disclosure Protocol, such notice would constitute a report for purposes of PPACA’s report and return obligation.[15] However, CMS notes that reporting and returning overpayments pursuant to the PPACA obligation cannot resolve any potential False Claims Act or OIG administrative liability and that providers “should be aware that the contractors will scrutinize overpayments received through this process and may make referrals to OIG whenever the contractors believe circumstances warrant such a referral.”[16]
Practical Difficulties
CMS further warns providers that they may not delay the identification date beyond the 60-day timeframe or cost report due date when they have identified an overpayment but need additional time to make repayment due to the magnitude of the overpayment. In such cases, CMS states that the only way for providers to seek a repayment extension is through the Extended Repayment Schedule process that is outlined in the Medicare Financial Management Manual.[17] Such requests are not automatically granted and require submission of significant documentation by providers to establish financial hardship. Given this, coupled with the proposed 10-year look-back period, providers may have significant difficulty complying with the requirement to report and return overpayment within the 60-day timeframe.
[1] 77 Fed. Reg. 9179 (Feb. 16, 2012).
[2] Overpayment means “any funds that a person receives or retains under [Medicare or Medicaid] to which the person, after applicable reconciliation, is not entitled.” 42 U.S.C. § 1320a-7k(d)(4)(B).
[3] 42 U.S.C. § 1320a-7k(d)(1).
[4] PPACA contains no definitions or guidelines pertaining to when an overpayment is considered “identified,” although the Proposed Rule does contain such guidelines, as will be discussed.
[5] 42 U.S.C. § 1320a-7k(d)(2). A person who knowingly and improperly retains an overpayment may be subject to additional penalties, including liability under the False Claims Act, 31 U.S.C. §§ 3729-3733, and the Civil Monetary Penalties Law, 42 U.S.C. § 1320a-7a.
[6] 77 Fed. Reg. 9180 (Feb. 16, 2012).
[7] 77 Fed. Reg. 9181 (Feb. 16, 2012).
[8] 77 Fed. Reg. 9182 (Feb. 16, 2012).
[9] 77 Fed. Reg. 9182 (Feb. 16, 2012).
[10] 77 Fed. Reg. 9182 (Feb. 16, 2012).
[11] 77 Fed. Reg. 9182 (Feb. 16, 2012).
[12] 77 Fed. Reg. 9182 (Feb. 16, 2012) (emphasis added).
[13] 77 Fed. Reg. 9184 (Feb. 16, 2012).
[14] 77 Fed. Reg. 9183 (Feb. 16, 2012).
[15] 77 Fed. Reg. 9183 (Feb. 16, 2012).
[16] 77 Fed. Reg. 9183 (Feb. 16, 2012).
[17] 77 Fed. Reg. 9183 (Feb. 16, 2012).