The Patient Protection and Affordable Care Act (“PPACA”), signed into law on March 23, 2010, included a provision (the “Report and Refund Mandate”), broadly requiring health care providers, suppliers, Part D plans and managed care organizations that were overpaid by the Medicare or Medicaid program to report and return the overpayment within 60 days of the date when the overpayment was “identified.” See PPACA Section 6402(a). Failure to comply with the Report and Refund Mandate exposes individuals and organizations to liability under the False Claims Act, Civil Monetary Penalties Law, and possible exclusion from participation in federal health care programs. 

On February 16, 2012, the Centers for Medicare and Medicaid Services (“CMS”) had issued proposed regulations (the “Proposed Regulations”) that outlined steps providers and suppliers were to take when they “identified” an “overpayment.”  The regulations, however, were not finalized for the next four years, leaving providers and suppliers without definitive guidance on how to comply with the Report and Refund Mandate.  Courts had to fill this regulatory void in False Claims Act cases alleging a violation of the Report and Refund Mandate -- most notably in Kane v. Healthfirst, Inc., No. 11-cv-02325-ER (S.D.N.Y. Aug. 3, 2015). 

On February 12, 2016 -- almost four years to the day the Proposed Regulations were promulgated -- CMS finalized its regulations (the “Final Regulations”), departing in some important respects from its Proposed Regulations and the decision in Healthfirst, but ultimately giving providers and suppliers clearer direction for complying with the Report and Refund Mandate.  See 81 Federal Register 29 at 7654 – 7684.  As detailed below, the Federal Regulations provide that --

• an overpayment has been “identified” to trigger the 60-day clock when a provider [A] has determined, or should have determined, through the exercise of “reasonable diligence,” that it received an overpayment, and [B] has “quantified the amount of the overpayment;”

• to report an overpayment, a provider can use a menu of options, including an “applicable claims adjustment, credit balance, self-reported refund, or other reporting process set forth by the applicable Medicare contractor;” and

• the “look back” period for determining what claims need to be reviewed for determining the full scope of overpayments is now six years, not 10 years.

CMS Final Regulations

When is an Overpayment “Identified” for Purposes of Triggering the 60-Day Report and Refund Mandate?  The Proposed Regulations provided that an overpayment is “identified” when a provider has “actual knowledge of the existence of the overpayment or acts in reckless disregard or deliberate ignorance of the overpayment,” which tracks how the term “knowing” is defined under the Federal False Claims Act.  CMS suggested that the 60-day clock commenced once the provider had identified the existence of an overpayment, if not the exact amount. 

For its part, the court in Healthfirst embraced the definition urged by the Government, that an overpayment has been “identified” when a provider has determined, or should have determined through “reasonable diligence,” that it has received an overpayment.  Significantly, the Healthfirst court did not address whether, beyond determining that the provider has been overpaid, the provider had to also determine the amount of the overpayment to trigger the 60-day Report and Refund Mandate. 

The Final Regulations essentially adopt the “reasonable diligence” standard relied on in Healthfirst, but clarify that “reasonable diligence” needs to be undertaken only when a provider “obtains credible information concerning a potential overpayment.”  Thus, a mere allegation or suspicion that a provider may have been overpaid, lacking “credible information”, would not compel a provider to undertake an investigation.  Whether information is “credible” then requires an initial threshold judgment call on the part of the provider.

Moreover, the Final Regulations go one step further in clarifying when an “overpayment” has been “identified” -- when a provider [A] has determined, or should have determined, through the exercise of “reasonable diligence,” that it received an overpayment, and [B] has “quantified the amount of the overpayment.”  Therefore, the Final Regulations contemplate that the overpayment is “identified,” and the 60-day Report and Refund Mandate begins to run, after both the amount and fact of an overpayment has been determined.  This clarification will give comfort to providers that they need not rush to make an initial self-disclosure after concluding that it had been overpaid, and can wait until it completes its “due diligence” investigation to determine the magnitude of the overpayment amount. 

On the other hand, a provider cannot avoid or delay the Report and Refund Mandate by not performing any investigation:  the 60-day time period to report and return an overpayment begins when “either the reasonable diligence is completed or on the day the person received credible information of a potential overpayment if the person failed to conduct reasonable diligence and the person in fact received an overpayment.”  If no investigation is performed, then the 60-day clock starts as soon as the provider has received “credible information” of an overpayment. 

How long does a provider have to perform a “due diligence” investigation?  Both the guidance in the Proposed Regulations and the court in Healthfirst advised that providers should act with “deliberate speed” -- a nebulous standard -- to identify whether an overpayment exists after they receive information of a potential overpayment.  In a sharp departure, the guidance in the Final Regulations instructs that providers have “six months” to undertake a “timely, good faith investigation of credible information,” absent extraordinary circumstances.  In other words, once a provider receives “credible information” that it may have been overpaid, the provider has up to six months (absent extraordinary circumstances) to then verify that an overpayment was received and to quantify the amount.  Consequently, a provider potentially has a total of eight months to comply with the Report and Refund Mandate (six months for timely investigation and two months for reporting and returning). 

Notably, the six-month allowance to conduct and complete “due diligence” would not have changed the analysis in Healthfirst, where the government alleged that the provider had not adequately investigated or returned the apparent improper Medicaid claims in over two years since the whistleblower had shared a spreadsheet pointing to those claims. 

Note, however, that the 60-day clock to report and return the overpayment commences once the due diligence is complete and the overpayment has been verified and quantified -- which could be at any point within the six-month timeframe.  Thus, the 60-day Report and Refund Mandate is triggered at essentially the earlier of the date of completion of the investigation or the expiration of the six months, absent extraordinary circumstances.

What needs to be reported, and to whom?  Both the Proposed and Final Regulations include specific details as to what information needs to be reported to comply with the Report and Refund Mandate.  However, the Final Regulations provide greater flexibility about how and to whom the overpayment should be reported.  Unless a provider is making a disclosure under the OIG’s Self-Disclosure Protocol (in the case of suspected fraud) or the CMS Voluntary Self-Referral Disclosure Protocol (in the case of a Stark Law violation), the provider can use an “applicable claims adjustment, credit balance, self-reported refund, or other reporting process set forth by the applicable Medicare contractor” to report an overpayment. 

How Far Back in Time Do Providers Have to Look for an Overpayment?  The Proposed Regulations called on a provider to investigate potential overpayments within 10 years of the date an overpayment was received -- the outside limitations period for a False Claims Act violation.  The Final Regulations reduce this time period to six years.  CMS explained that the shorter, six-year period addressed providers’ concerns about the burden of investigating claims over a 10-year look back period. 

Does “Reasonable Diligence” Only Take ”Six Hours”?  In the Proposed Regulations, CMS estimated that it would only take a provider approximately 2.5 hours or $92.75 of expense, utilizing accountants, auditors, and in-house administrative personnel, to comply with the Report and Refund Mandate.  In an apparent “concession,” in the Final Regulations, CMS now estimates that the “per report” burden to providers to be 6 hours, at the expense of $322.22. 

While CMS estimates the investigation should take only six hours, CMS allows up to six months to conduct the investigation to determine the amount of overpayment.  Respectfully, these numbers do not add up.  It is hard to imagine how any provider, charged with reviewing claims over a six-year period to determine the scope and amount of overpayment, would only need six hours to conduct a proper investigation.  It is likewise highly questionable that telling the OIG, or DOJ, that you spent a total of six hours -- albeit consistent with CMS’ expectations -- to ascertain the full extent of potentially six-years’ worth of overpaid claims, would convince the authorities that you have engaged in “reasonable diligence,” so as to avoid potential liability under the False Claims Act. 

Key Takeaway:  Implement, and Document, Proactive & Reactive Compliance with the Report and Refund Mandate:  With the regulations now final, providers are afforded clearer instruction on how to comply with the Report and Refund Mandate.  Notably, in the guidance to the Final Regulations, CMS states that “reasonable diligence” includes both [1] “proactive compliance activities . . . to monitor for the receipt of overpayments” and [2] investigations in response to “credible information of a potential overpayment.”  Accordingly, this guidance reaffirms that providers and suppliers must implement effective compliance programs to also detect and uncover overpayments that may be received. 

In either circumstance, CMS encourages providers to “maintain records that accurately document their reasonable diligence efforts to be able to demonstrate their compliance with the rule.”  Failing to document one’s steps may expose a provider to the charge that it has not undertaken the required compliance activities or “good faith” investigation, or, as alleged in Healthfirst, has done “nothing” to address possible overpayments in the face of credible information.