On February 11, 2016,1 the Centers for Medicare & Medicaid Services (CMS) released the long-awaited Final Rule providing clarification on the obligation of Medicare Parts A and B providers and suppliers to timely report and return overpayments.2 The Final Rule implements § 6402(a) of the Patient Protection and Affordable Care Act (PPACA), requiring the report and return of an overpayment by the later of (1) 60 days after the date on which the overpayment was identified or (2) the date any corresponding cost report is due.
In the Final Rule, CMS sought to address a number of ambiguities in the Proposed Rule, released February 12, 2012,3 that raised considerable concern in the healthcare industry and generated nearly four years of discussion as to how and when this rule would apply.4 The Final Rule:
- Established a 6-year look-back period for identified overpayments;
- Defined “identification” as when a provider “has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment;”
- Further clarified that “exercising reasonable diligence” to identify an overpayment generally requires the completion of an investigation within six months of receipt of credible information of a potential overpayment;
- Identified available options for reporting and refunding overpayments; and
- Reinforced the responsibility of providers and suppliers to review potential issues and timely refund any identified overpayments.
Six Year Look-Back Period
CMS shortened the proposed look-back period to six years after receiving substantial comment and criticism of its proposed 10-year look-back period, which is the outside statute of limitations for False Claims Act (FCA) liability. This 6-year look-back period is an improvement from the Proposed Rule but still expands the potential financial exposure as shorter look-back periods previously applied to identified overpayments. When self-reporting simple billing errors, providers often previously used the CMS 4-year limitation to reopen claims for cause5 as the benchmark when making required refunds. Similarly, the Physician Self-Referral Protocol also had limited the financial exposure for violations of the physician self-referral statute, or Stark Law,6 to the 4-year reopening period.7 Further, the look-back periods for overpayments and underpayments are severely mismatched, as a provider is limited to a one-year reopening period to rebill and collect an underpayment.8
The Final Rule, like PPACA’s overpayment provision, does not apply retroactively.9 Providers and suppliers making refunds in good faith prior to the Final Rule’s effective date are not expected to comply with the 6-year look-back period.10 However, providers returning overpayments after March 14, 2016, must comply with the new requirements, even if the overpayments in question were received prior to that date.11
Defining Identification of Overpayments Through Exercise of Reasonable Diligence
PPACA’s time limit for reporting and refunding of an overpayment begins to run after the overpayment is “identified.” In its Final Rule, CMS provided clarity on the meaning of “identification” by stating that “a person has identified an overpayment when the person has or should have, through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment.”12
This guidance comes after the Southern District of New York offered the first judicial interpretation of PPACA’s 60-day rule in U.S. ex rel. Kane v. Healthfirst, Inc. et al., No. 1:11-CV-02325 (S.D.N.Y), opining “[t]o define ‘identified’ such that the 60 day clock begins ticking when a provider is put on notice of a potential overpayment, rather than the moment when an overpayment is conclusively ascertained, is compatible with the legislative history of the FCA and the [Fraud Enforcement and Recovery Act] highlighted by the Government.”13
This definition differed from the Proposed Rule, which deemed an overpayment as “identified” when a provider had actual knowledge, or acted in reckless disregard or deliberate ignorance, of the overpayment.14 The Final Rule also departed from the Proposed Rule by acknowledging that identification includes quantification of the overpayment.15 The introduction of quantification gives providers and suppliers more time to investigate and confirm possible overpayments before they must be reported and returned.
CMS noted quantification “may be determined using statistical sampling, extrapolation methodologies, and other methodologies as appropriate.” In situations where providers or suppliers are paid in excess of the appropriate amount, only the excess payment is considered an overpayment and must be returned.16 When a single overpayment or probe sample reveals a possible overpayment requiring an expanded claims review, piecemeal refunds are not expected. Instead, CMS expects the provider to exercise reasonable diligence and to quantify, report and return the entire overpayment.17
CMS also provided clarity on how providers or suppliers “exercise reasonable diligence.” Providers demonstrate reasonable diligence “through the timely, good faith investigation of credible information, which is at most six months from receipt of the credible information, except in extraordinary circumstances.” Thus, providers and suppliers have eight months (six months of investigation and two months to report and refund) to resolve an issue.18
CMS acknowledged that more complex issues, such as analysis of potential Stark Law violations, may take even longer to investigate. However, CMS noted that a provider or supplier would be expected to document its activities throughout this time period to show it was exercising reasonable diligence. Because a determination of whether a provider exercised “reasonable diligence” will be evaluated retrospectively, providers and suppliers still should resolve issues as quickly as possible and carefully document the investigative process. Any delays may be used as evidence in an enforcement action that providers or suppliers failed to meet the standard, even within the proposed 6-month window.
Methods for Report and Return of Overpayments
Providers and suppliers may use existing processes—claims adjustment, credit balance, self-reported refund or another appropriate process—to satisfy the obligation to report and return overpayments, and CMS may modify these processes or create new processes in the future.19 Whereas the Proposed Rule required use of the existing voluntary refund process and contained a specific list of information that must be reported, CMS amended the Final Rule to eliminate such a list and allow for additional processes to report and return overpayments.20
Disclosures under the CMS Voluntary Self-Referral Disclosure Protocol (SDRP) and the OIG Self-Disclosure Protocol (SDP) will toll the obligation to return an overpayment within 60 days. The tolling will remain in effect only while a provider is actively negotiating a settlement.21
Expectation of Proactive Compliance Efforts
The Final Rule notes that “reasonable diligence” requires providers and suppliers to conduct both proactive and reactive compliance activities. These activities are expected to vary in size and scope depending on the provider’s sophistication and type.22 Demonstrating these enhanced compliance expectations, CMS noted that while Recovery Audit Contractors (RAC) are subject to a 3-year limitation on review of claims, providers or suppliers receiving an unfavorable RAC audit identifying an issue must review claims for the entire 6-year look-back period and cannot rely on the RAC 3-year review limitation.23 Providers and suppliers should also consider other audit results that may put them on notice of broader issues. For example, following a Medicare contractor probe audit or internal audit revealing a high error rate, the provider or supplier should examine its claim processes to determine if a broader audit of additional claims should be conducted. Because these decisions will be judged retrospectively, providers must take all potential billing issues seriously and quickly address issues as they arise.
Future Impact
While the Final Rule provides additional guidance and clarity on the timely refund of overpayments, it likely will not be the final word. UnitedHealthcare filed a lawsuit against CMS earlier this month challenging the agency’s position on when an overpayment is deemed to have been “identified” in a related 2014 Final Rule applicable to Medicare Advantage plans and Part D sponsors.24 It remains to be seen if similar actions will be filed to challenge provisions of the Final Rule.
Increased enforcement actions for the failure of providers or suppliers to timely refund overpayments are also likely to provide further interpretations of PPACA’s requirements. At the same time, this increased scrutiny requires providers and suppliers to proactively and aggressively investigate potential overpayments and make timely refunds after overpayments are confirmed. Because such investigations may be subjected to retrospective scrutiny, providers and suppliers should carefully document all reviews of potential overpayments and the conclusions reached at the close of the reviews.
1 The Final Rule becomes effective 30 days after its publication in the Federal Register, which is March 14, 2016.
2 A person who knowingly and improperly retains an overpayment may be subject to additional penalties, including liability under the False Claims Act, 31 U.S.C. §§ 3729-3733, and the Civil Monetary Penalties Law, 42 U.S.C. § 1320a-7a.
3 77 Fed. Reg. 9179 (Feb. 16, 2012).
4 For background and discussion of the Proposed Rule, please see: http://bassberry2022.wpengine.com/news/for-whom-the-bell-tolls-cms-issues-proposed-rule-to-implement-60-day-return-of-identified-overpayments-02-20-2012/.
5 42 C.F.R. § 405.980(b).
6 42 U.S.C. § 1395nn.
7 See CMS Voluntary Self-Referral Protocol Frequently Asked Questions, https://www.cms.gov/Medicare/Fraud-and-Abuse/PhysicianSelfReferral/FAQs.html.
8 In response to such comments, CMS determined underpayment issues to be outside the scope of this rulemaking. 81 Fed. Reg. 7658 (Feb. 12, 2016).
9 81 Fed. Reg. 7673 (Feb. 12, 2016).
10 81 Fed. Reg. 7674 (Feb. 12, 2016).
11 81 Fed. Reg. 7673 (Feb. 12, 2016).
12 81 Fed. Reg. 7654 (Feb. 12, 2016).
13 For background and discussion of Kane and related decisions, please see: http://bassberry2022.wpengine.com/news/providers-take-notice-recent-cases-find-failure-to-refund-overpayments-leads-to-fca-exposure/.
14 77 Fed. Reg. 9182 (Feb. 16, 2012).
15 81 Fed. Reg. 7661 (Feb. 12, 2016).
16 81 Fed. Reg. 7658 (Feb. 12, 2016).
17 81 Fed. Reg. 7663 (Feb. 12, 2016).
18 81 Fed. Reg. 7662 (Feb. 12, 2016).
19 81 Fed. Reg. 7654 (Feb. 12, 2016).
20 81 Fed. Reg. 7674-76 (Feb. 12, 2016).
21 81 Fed. Reg. 7678 (Feb. 12, 2016).
22 81 Fed. Reg. 7661 (Feb. 12, 2016).
23 81 Fed. Reg. 7672 (Feb. 12, 2016).
24 UnitedHealthcare Insurance Co., et al., v. Burwell, Case no. 1:16-CV-00157 (D.C.C. Jan. 29, 2016).