CMS Issues Final Rule Guidance on Reporting and Returning Medicare Overpayments
EFFECTIVE AS OF MARCH 14, 2016
On February 12, 2016, the Centers for Medicare and Medicaid Services (CMS) issued its final rule on the reporting and returning of overpayments by Medicare Part A and Part B providers and suppliers. (In May 2014 CMS had previously issued a final rule setting forth guidance addressing Medicare Parts C and D overpayments.) The long-awaited regulations provide much-needed clarification as to when an overpayment is considered by the government to have been identified and how far a provider or supplier must look back when identifying an overpayment.
For the full CMS announcement, visit the CMS website.
When the Affordable Care Act (ACA) was passed in 2010, it required that a provider or supplier that has received an overpayment must report and return it within 60 days of the date the overpayment is identified or the date any corresponding cost report is due. However, the ACA did not define when an overpayment is “identified.” In response, in 2012, CMS issued a proposed rule stating that a person has identified an overpayment if the person acts in “reckless disregard” or “deliberate ignorance” of the overpayment. The proposed rule also recommended an “all deliberate speed” standard in conducting an inquiry to determine whether an overpayment exists. Further, the proposed rule adopted a 10-year overpayment lookback period for providers and suppliers to conduct their due diligence inquiry, which mirrored the outer limit of the False Claims Act statute of limitations. The proposed rule met with widespread industry criticism due, in part, to its ambiguity and failure to clearly define when an overpayment is “identified,” as well as the burden and expense on providers and suppliers in maintaining claims data, electronic medical and billing records, and the lengthy 10-year period required for conducting due diligence.
Final Rule Addresses Industry Concerns Voiced About Draft Rule
The final rule is more favorable to providers and suppliers and softens the proposed rule. It removes the terms “reckless disregard,” “deliberate ignorance,” and “all deliberate speed.” It provides that a person has “identified” an overpayment when the person has or should have, through the exercise of “reasonable diligence,” determined that he has, in fact, received an overpayment and “quantified” the amount of the overpayment. Thus, the 60-day identification/report/return date is triggered by either actual knowledge of an overpayment or constructive knowledge that the provider or supplier “through the exercise of reasonable diligence” should have determined it received an overpayment and quantified the amount. CMS emphasizes in its comments to the final rule that the reasonable diligence standard avoids the “ostrich defense,” which is commonly referred to as “willful blindness,” or “conscious avoidance” (not taking action to obtain actual knowledge of an overpayment).
In the final rule, the single term “reasonable diligence” encompasses multiple processes. It covers both proactive conduct and effective compliance programs and reactive investigative activities undertaken in response to receiving “credible information” about a potential overpayment. Credible information can be derived from a variety of sources: outside government or Medicare contractor audits (e.g., OIG, RAC, MAC); internal audits, hotline complaints, and unusual and excessive Medicare payments. The 60-day clock to report and return the overpayment begins ticking when either the reasonable diligence is completed, or on the day the person received credible information of a potential overpayment if the person failed to conduct reasonable diligence (and in fact received an overpayment). CMS states in the comments that reasonable diligence and timely investigations provide “bright line” standards to providers and suppliers to comply in good faith with their obligation to report and return overpayments. Upon the receipt of credible information, CMS also states in the comments that it should take, at most, six months to investigate and quantify the overpayment, followed by 60 days to report and repay (thus eight months in total), absent extraordinary circumstances extending the six-month benchmark for timely investigations. Such circumstances may include unusually complex investigations, such as investigations involving physician self-referral under the Stark law or natural disasters.
The final rule also clarifies that an overpayment is “identified” when it is “quantified.” In other words, part of the identification process is quantifying the amount of the overpayment. Both are precedent to the triggering the 60-day reporting/repayment time clock. The quantification of the amount of the overpayment may be determined using statistical sampling, extrapolation methodologies and other methodologies as appropriate. However, the comments state that when using such methodologies, it is necessary to explain how the overpayment was calculated.
Lastly, in its Final Rule, CMS adopts a “lookback” period of six years. Therefore, the provider or supplier must refund only those overpayments identified “within six years of the date” on which they were received, not the 10-year period recommended in the prior proposed rule. Thus, the provider’s or supplier’s reasonable diligence investigation extends back six years from the date when they received credible information regarding a potential overpayment. CMS states that providers and suppliers may use the claims adjustment, credit balance and self-reported refund process set forth by the Medicare contractor or another appropriate process, including the OIG Self Disclosure Protocol or the CMS Voluntary Disclosure Protocol to report and return overpayments.
Investigations Will Require Resources and Time
The final rule is effective as of March 14, 2016, and is not retroactive. It does not apply to the amounts actually refunded prior to March 14, 2016. It applies only to amounts refunded after or through 2016, even for an overpayment received prior to that date. And failure to report and return overpayments under the standards set forth in the final rule expose the provider or supplier to False Claims Act liability, Civil Monetary Penalties and possible exclusion from participating in health care programs.
In sum, issuance of the final rule will now require providers and suppliers to be even more proactive in their compliance efforts and to undertake good faith efforts to investigate credible information of overpayments. Thus, for compliance programs to be effective, they now must ensure that all levels of an organization are trained and incentivized to recognize and report internally such credible information in order to have the time to investigate if there was actually an overpayment. The comments to the final rule make clear that the reasonable inquiry eight-month timeframe to repay overpayments is the outer limit, and whether a provider or supplier has satisfied the bright line standard is a fact-based inquiry. Thus, health care organizations should prioritize their investigations and recognize they require the good-faith devotion of resources and time.
If you have any concerns or questions about how the final rule will affect you and your organization, or about health care fraud and abuse enforcement in general, please contact Alan J. Sobol. Alan chairs Pullman & Comley’s White Collar, Criminal Defense and Corporate Investigations practice area and is a member of the Firm’s Health Care and Litigation Departments.
© 2016 Pullman & Comley, LLC. All Rights Reserved.